Customize John The Ripper BF technique Is it possible for me to customize the way John the Ripper brute forces a .cap file? I, knowing my WiFi password, want to crack it fast as possible (no hit with word list).

Can I customize John to only try with 4 numbers and 5 letters in a 9 character password?

I've searched and read a lot of posts, but nothing seems to match my question. Also, doesn't matter if it's John, Hashcat or any other cracker.

There's no native way to create a single variable-content mask with John or hashcat. Instead, you can generate a set of all possible masks that fit your criteria. See my answer here.

In your case, the policygen command might look something like the following (assuming lower case):

$ policygen --minlength=9 --maxlength=9 \
  --mindigit=4 --maxdigit 4 --minlower=5 --maxlower 5 \
  --maxupper=0 --maxspecial=0 -o target.masks


mitigating anonymous DOS (tor combined with pyloris) I found this rather scary video in youtube, that takes DOS to a whole new level, by making it look like coming from multiple sources.
As a counter measure to Rsnake (Robert Hansen) slowloris.py script, this vulnerability mainly in Apache web servers, is addressed by limiting the number of concurrent connection from a single source done in the Apache configuration file.

just imagine these two combined:
1- PyLoris can utilize SOCKS proxies and SSL connections, and can target protocols such as HTTP, FTP, SMTP, IMAP, and Telnet; when correctly configured, it use low bandwidth, making it possible for a single machine to bring a server down
2- Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Tor works with many of your existing applications, including web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol.

Is there any way to detect such a denial of service any suggestion or discustion is highly encourged

sarepta: To start off, I am the author of PyLoris, so I have done a good amount of research into this. In fact, the attack you have envisioned is one that I specifically coded to when developing PyLoris--the current version even comes bundled with an helper app tor_switcher.py which routes the attack through multiple Tor exit nodes.

The only good way of detecting a Tor-based flood is by checking source IP addresses against known Tor exit nodes. This is trivial with blacklisting or plugins like mod_security. In my research, mod_antilors does not prevent the PyLoris+Tor vector as it is IP address based. My personal choice for preventing this attack is to use any server other than Apache to handle direct connections from the internet. This could mean using a reverse proxy like Varnish to marshal requests or switching to something like nginx for your web server.

Aside from rethinking your infrastructure, I do feel that a combination of low timeouts, IP connection limits, minimum data transfer rates, maximum connection time limits, and maximum request sizes can provide adequate protection from this form of attack. I say this all with the disclaimer that there is no way to prevent this form of attack, and that these configurations should be thought through thoroughly to gauge their impact on a per-server basis.

To counter Tom Leek's assertion that Tor is not an efficient way of performing Denial of Service attacks, PyLoris and SlowLoris are application layer attacks, and are not based overwhelming bandwidth. In fact, connection exhausting methods like the one these use are one of the few techniques that work in throttled environments (see Slow/PyLoris' use in Iran's Green Revolution). At the peak of a *loris attack a server would likely experience less than 1kbps of traffic.

To counter D.W.'s reasoning, one of the big selling features of Atlas Networks' Pravail APS was the ability to prevent PyLoris and SlowLoris (explicitly stated in their earlier brochures). This attack method is less prevalent than standard HTTP floods like LOIC, but only because it is a significantly more difficult technique to use correctly.


VM security, how to access main OS Is there any way for me to access the main computer if the VM has been infected?

Let's say that I am  running Debian or ubuntu in a VM and the main computer uses Windows (or other way around just so that OS is as different as possible). And let's say that the VM has been accessed and is full of viruses and such. Is there any way for whoever infiltrated the OS in the VM to access the actual os that is running it.

What steps would attacker have to take to go from the VM to the main OS running it.

Possible duplicate: How secure are virtual machines really? False sense of security?
However I am asking for ways of getting to main os from vm rather than how secure vm really is.

A VM is nominally supposed to prevent code in the guest from escaping to the host. So when such an escape is possible, then it is due to a security hole in the VM implementation. Some such holes have been found in various VM engines.

See for instance Cloudburst, an exploit described in 2009. In this case, the video emulation is instrumental to the escape, because the engine's goal of providing fast video emulation implies using some internal sharing of resources between host and guest, and this it at odds with the security goal of the isolation layer. Modern computers are complex systems, so full virtualization is also complex, and it is rather unavoidable such holes of that kind happen.

To be fair, holes which allow true guest escape are rather rare. Good maintenance (promptly applying security fixes from the vendor) for a VM engine is a reasonably low-risk strategy. Note, though, that the same cannot be said for information leaks: a VM can learn things on what happens in other VM, or in the host, through timing attacks. It has been demonstrated (in lab conditions) for encryption algorithms: one VM could learn the secret key used by another VM, because that other VM was using a table-based AES implementation, and was running on the sister core of the attacker's VM (thus with a shared L1 cache).

Guest escape can be facilitated by the configuration, though. For instance, when the host shares part of its filesystem with the guest, then, by definition, the guest has access to part of the host filesystem. Similarly, host and guest often share a more or less virtual network, thus remotely exploitable holes on the host are in range from the guest.


How to use character mask in hashcat? I do not get hashcat working the way I want.

I got this handshake captured file. I can crack it with ?a?a?a?a?a?a?a?a --increment but since I know the password is between 14 and 16 charters that is unnecessary work. Therefore I am trying to use ?a?a?a?a?a?a?a?a?a?a?a?a?a?a --increment-min 14 --increment-max 16.

But it is complaining about ?a?a?a?a?a?a?a?a?a?a?a?a?a?a being too much and I know that the password only contain lowercase, numbers, and these usual symbols: (!_-,.:;/).

How do I make this custom mask to only use relevant information?

It is indeed too large of a keyspace. ?a is 95 characters. 95^14 is 4x10^27, which won't be exhausted any time soon.

If you want to reduce the possible characters as you describe, use a custom character set:

hashcat -1 '?l?d!_-,.:;/' ?1?1?1?1?1?1?1?1?1?1?1?1?1?1

But even this keyspace 44^14, or 1x10^23 - too large to reasonably exhaust.

Unless you can narrow down your keyspace further, brute force won't help you here.


Why is programming skill required for cyber security job positions? It is evident that programming knowledge such as Python, C, or bash scripting is required for most cybersecurity jobs.

What makes it somehow mandatory to have knowledge in this area and how can it help?

Is this knowledge for customization and improving existing software?

Is programming knowledge mandatory for an Information Security job?

No, it's not. You can certainly become a pentester or a security architect by focusing your studies on these fields, with only minimal or no programming knowledge.

  Does programming knowledge help?

Yes, it does. Because programming in turn teaches a lot about how computers work, and more informally, also how programmers work. This explains why some vulnerability classes still exist, even if they have been known for 20 years now.

  Does every job include fixing or customizing software?

No. Pentesters generally don't fix software. They show vulnerabilities and make suggestions on how software can be fixed. Other Information Security jobs may indeed require such suggestions to be implemented, which then basically equates to "being a programmer", and thus requires programming knowledge.

  Why do so many Information Security jobs require programming knowledge?

Because Information Security is a vast field, like mammals. Asking "Do Information Security jobs require programming knowledge?" is like asking "Are mammals dangerous?". The answer is, some are and some are not.

As mentioned above, some jobs may require you to do a lot of programming, and thus naturally they will require skills in those programming languages.


nmap script with credentials I'm using Nmap for penetration testing for a while, and I need to know:

Assuming I obtained user credentials, is there any script that I can use, for searching what resources this user is able to access?
 e.g What places he's able to connect (RDP).

I used this script:smb-enum-shares.nse to reveal the shared folders he can access, but this can be done easily with other programs.

For the broadest coverage with the fewest arguments, use your credentials as input into Nmap's credential brute-forcing scripts. Any of the scripts that use the unpwdb library will read usernames and passwords from a common source, which you can specify on the command-line:

nmap --script brute --script-args "userdb=userfile,passdb=passfile"

If the userfile contains the username and the passfile contains the password, then the brute-forcing will just use the one combination and then end.

Use caution in selecting scripts, though; not all of the brute-category scripts use unpwdb library, so some of them may perform bruteforcing with other lists of usernames and passwords: Here's a list of them.


Security at application layer Originally asked on https://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead.

I saw lots of questions asking about encryption over http, such as this.  Most of the responses I saw said there is no way to verify server's identity so vulnerable to MitM attack.

My question below will be slightly different, because it is asking about mobile environment, where I assume the app is downloaded from AppStore or PlayStore.  In this way, I can assume the code is verified and not modified by hacker and the public key of server bundled with the app is not modified either so that it can verify server's identity.

Given these guarantees, is it possible to do encryption at application layer and is there any existing libraries to do it?

More specifically, I am writing some app that talks to HTTP server.  The server is hosted on some cheap plans where no HTTPS is available.  Assuming the server handles HTTP requests using PHP or Python, is it possible to implement the client and server, so that they do some handshake at the beginning of the session over HTTP, to agree on some encryption keys; afterwards, all messages are encrypted using the keys.  So from hackers point of view, they see the HTTP traffic between client and server and they see some basic fields in HTTP headers, e.g. host and endpoint, as plaintext but everything else are just encrypted as HTTP body or some URL argument.

Is that possible and is there any libraries doing that easily?  Intuitively speaking, it is just implementing TLS in the application level, so theoretically it is totally possible and has the same security strength as TLS.  Do I miss any security holes here?

the first security hole is your shared "el-cheapo" server. if you can not trust your machine, you can not trust your applications.

what this means is that if you have no controle over the machine itself, adding security to it is pointless, an attacker will just attack your webserver instead of your connection and makes sure he can do anything he/she wants to do and "Steal all the data!"

have a look at the OWASP pages. they offer much information about how to secure any (web-) program.

If in the end all you want to do is have a limited set of clients use your "app" and do it secure, you could look at implementing an SSH client / server architecture (basically making SSH do all the security and connection and just use it as a tunnel for your purpose)

good luck


Does PCI DSS require an SAQ for each site? I am with an organization that is just starting to work on PCI. We have 3 sites that are connected via point to point connections. Only the main site stores the card holder data. The other two sites have workstations that connect to the card holder data environment via encrypted connection. We need all 3 sites to be PCI compliant.

Based on the information above, I have a few questions...

Do we need a separate SAQ for each site? Or just for the main site?
We understand that the 2 sites that do not store card holder data are in scope, however, do we just need to harden those environments or do we need to go through each PCI requirement and ensure it is met? We understand we have to do that for the main site.
We understand that risk assessment is requirement for the PCI. Since we are just implementing it, when should we conduct a risk assessment? At the beginning when we define the scope or at some later time?
Should we go through the SAQ to see where we stand (gap analysis) before or after the risk assessment?

Thank you very much for your help!!!

Quick answers from a mobile device:

PCI is an organization-level commitment, so it is one per legal entity that has a CDE or merchant or processing agreement or other engagement with cards.

Not really either of those, but the latter is closer. Each requirement has to be met across the full scope. That one ordinarily does IT planning on a per site basis is immaterial.
It sounds like what will be needed is some partitioning and segregation at the sites so that a scope can be reasonably defined.

Scope has to come first, then risks can be assessed for a given scope. That said, defining scope is complex and understanding risks can help enormously in incentivizing all parties to reduce and enforce the smallest feasible scope.

You can use the SAQ for a gap analysis as soon as you have a scope.


I am looking for feedback on Secure Development Lifecycle for Scrum that has been tested? This question is indeed targeting SDL but for Scrum. The A-SDL from Microsoft is nice, but honestly I am not even daring testing it in reality as it seems too academic.
I mean what they request for, requires an army of developers! or a dedicated Scrum for Threat Modelling --in case the models are sound!
So, I would be thankful if you can share feedback on any SDL approach you have used for Scrum (including A-SDL as you may prove me wrong!)

Very good question... SDL and Agile are often seen to be at loggerheads, though they dont need to be.
In fact, I recently gave a talk at OWASP about this (Agile in general, not necessarily SCRUM), and met with some skepticism at first... but eventually most were convinced of the possibility, at least.

I agree about MS's SDL, while I think its one of the best models for large companies, it is "heavy" (as I said in another lightweight SDL question), and has quite a lot of overhead. (though I dont think its academic, it just doesnt apply to most of us).

Without setting up a complete SDL here, and without context of knowing your org, I would say these are some of the important elements:

Training (which is already a big part of most Agile practices)
Map SDL requirements to Agile tasks, and allow the team to complete these themselves. It's not about passing your checkpoints...

Non-functional stories added to backlog
Completion criteria (sprint / release)
Product security requirements -> "ab user" stories

Frequency based "Wedges" (not wedgies)

Some tasks are one-time requirements, simply need to be completed like any other requirement
Some tasks are for every sprint - these are designated "Sprint Completion Criteria"
Some are only for public releases (some methodologies seperate the two, some treat every sprint as a public release) - "Release Completion Criteria"
Sometimes you might want to do a "Security Spike" - a whole sprint focused on different security aspects
MS idea of "Bucket" requirements seems nice, though I've never implemented it and would depend greatly on the culture/needs of the org. (Set up a group of req's with the same classification, or "bucket", and each time you need to choose one from each bucket).

This is just the general outline... Let me know if you want more detail. Of course, what goes into each wedge, and what activities must be performed when/how, really depends on knowing your organization, culture, needs, risk profile, etc etc.

I find the overriding change in concept from "Classic" SDL (or "Waterfall" SDL) that needs to be accepted is:

  "Classic” SDL was about control.
  Agile SDL is about visibility


Can checking HTTP headers protect against CSRF? It is enough presently to check Referer or X-Requested-With HTTP headers to protect against CSRF ?

All CSRF protections that only relies on putting a predictable value in a HTTP header has the same basic problems:

If you enable CORS with Access-Control-Allow-Headers, you may suddenly be allowing the X-Requested-With header to be set cross origin. Off course, you can solve this by just not setting a bad CORS policy. (The Referer header is "forbidden", and can't be set no matter your CORS policy.)
There have been Flash exploits (and if history is any guide, there will be more) that allows headers to be set in cross origin requests. Sure, Flash is dying, but it's not dead yet.
The Referer header might be blank for loads of legitimate reasons (e.g. stripped away by a proxy). To make this check secure you would have to block requests with a blank header, but that would on the same time block many legitimate requests.

So I'm afraid you still need to rely on setting a header (or some other variable) to a value that an attacker can not predict. In practice, this leaves you with a couple of options, such as a classical token, double submit cookie, or using a bearer token in the auth header.

As always, reading OWASP gives a lot of guidance.


Hashed passwords storage: iterations vs entropy Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them.
The DB holds user's accounts passwords. All connections are secure and the registration/login pages can not be bruteforced (out of the question's range).

Threat model: A hacker manages to get a copy of the DB and wants to crack the passwords. The hacker has very powerful hardware power at his disposal (CPU/GPU/RAM/ASIC) and only needs to crack one single password to be considered as the winner (protecting a maximum of users is not enough, all users must be protected).

Question: Which of the cases below would be considered the most secure against the hacker efforts?

Traditional iterations based hashing with salt (scrypt/bcrypt)
Handmade multi-peppered hashing with very long secrets held at each "stage" (webserver/middle/DB).

Webserver operation: Hash1 = SHA512 (password + secret1)
Middle operation: Hash2 = SHA512 (hash1 + secret2)
DB operation: Hash3 = SHA512 (hash2 + secret3)
DB storage: Hash3 with salt

My opinion is that case 2 is by far the more resistant because iterations will not protect poor (low entropy) passwords such as "123456" for more than a few hours/days at best.
As long as the secrets are very long and at least one of them remain unknown then I think the increased entropy will secure everyone for decades.

I do not see such scheme rolled out on production very often though, in general the consensus is "iterations+salt or get shamed", so maybe I am missing something.

Of course the implementation would need to be secure (handmade vs more standart scrypt) and the secrets must remain unknown. Moreover if a secret is revealed and must be changed, the update process would be a pain.
On the other hand, login process would be more hardware friendly (no iterations).

Edit (based on Matthews comment): My question is not about the benefit of a pepper in an iterations based method. It is the security difference between iterations based vs secrets based methods.

Edit 2: I made more searches and managed to find a similar question after all, my bad (maybe the results improved based on my activity on current question though). It has a nice answer (by Thomas Pornin) similar to here.

A message authentication code with a secret key that's unavailable to the attacker will indeed resist many attacks that resource-intensive password hashing won't.  There's no question there.  You don't even need the excessively complex three-tier key architecture; just one 128-bit secret key would be plenty.

(Side note: I highlight "message authentication code" because that's the cryptographic construct that's appropriate for your proposal.  Your "SHA512(password + secret)" betrays that you don't seem to know what construct is appropriate for what you've proposed; HMAC-SHA512(key, password) would be the better choice.)

But here's the big, difficult topic that your question completely sidesteps: how do you protect those secret keys? You say this:

  Of course the implementation would need to be secure (handmade vs more standard scrypt) and the secrets must remain unknown.

...but those two are precisely where laypersons who attempt to implement your proposal will fail, again and again!  You already have questionable crypto in your proposal (handrolled keyed hash instead of HMAC, three layers of MAC computation when just one would do), and you say nothing about how you'll make sure your secret keys don't get disclosed—which is the point on which the security of the scheme hinges!

  Moreover if a secret is revealed and must be changed, the update process would be a pain.

This can be solved with a hash-then-encrypt approach, like Dropbox has adopted (with bcrypt, however).  The equivalent in your no-iterations approach would be something like encrypt(key, hash(password)), or (scarcely) better encrypt(key, hmac(salt, password)), which would allow you to later rekey the encrypted hashes.

  I do not see such scheme rolled out on production very often though, in general the consensus is "iterations+salt or get shamed", so maybe I am missing something.

Insecure storage of long-term secret keys is really, really common, and nearly everybody who suggests using a pepper haven't really thought the key management problem through.  This is what makes key-less schemes like resource-intensive password hashing so valuable and such a strong recommendation; if we can avoid or reduce the reliance on secret keys, that is generally a plus.  Basically, key management is hard, so the fewer long-term cryptographic keys we need to store and defend the better, and the more we can mitigate the consequences of failure the better as well.

Secret keys should therefore only be considered for password hashing after:

You've adopted resource-intensive password hashing, which serves at least as a fallback line of defense if the keys are disclosed.
You have a well-thought out and well-engineered system for protecting and managing your systems' secret keys—ideally one where the keys are stored in just one secure key management system whose only purpose is to store long-term secret keys and never to leak them to any external system.  A KMS shouldn't disclose the keys not even to its clients, who instead must resort to asking the KMS to perform cryptographic operations on their behalf.  Some examples:

A hardware security module
Secret management tools like Amazon KMS or HashiCorp Vault's Transit backend.


Free hotspot: Open wifi vs. WPA2 wifi with known password If we would want to give internet for free via WIFI, then what would be the better option and why from a security standpoint if we could only choose between:

A non-encrypted wireless network setup
An encrypted wireless network setup with known password (WPA2/AES/PSK, and the SSID is "The password is: free internet")

UPDATE: If we do not require the following:

You need to ensure that if users of your free WiFi service do something illegal, you can provide the authorities with information that allows identifying the offender. This is a legal requirement in some countries.

UPDATE#2: I am searching for an answer with offical references that why is the 2 choice better.

A wireless network that is unprotected means that anyone can simply connect to your wireless access point, and collect all of your traffic.  If users of the network aren't using HTTPS (SSL/TLS enabled) webpages then their passwords, usernames, and any other sensitive information would be unprotected.

Using WPA2-PSK, the wireless access point uses the common passphrase to generate unique encryption keys for each wireless client.  Meaning that even if users aren't using HTTPS enabled webpages their traffic is still protected with WPA2.

How WPA2-PSK Authentication Works

  Using a technology called TKIP (Temporal Key Integrity Protocol), that
  passphrase, along with the network SSID, is used to generate unique
  encryption keys for each wireless client. Those encryption keys are
  constantly changed.

TKIP is considered insecure and should not be used.  Instead the WPA2-PSK with AES option should be used to provide unique keys for each wireless client.

Long story short, always choose the encrypted option.

NIST Guidance

  Wireless networks and handheld devices are vulnerable to many of the
  same threats as conventional wired networks. Intruders who gain access
  to information systems via wireless communications can bypass firewall
  protection. Once they have accessed systems, intruders can launch
  denial of service attacks, steal identities, violate the privacy of
  legitimate users, insert viruses or malicious code, and disable
  operations. Sensitive information that is transmitted between two
  wireless devices can be intercepted and disclosed if not protected by
  strong encryption. Handheld devices, which are easily stolen, can
  reveal sensitive information.

  Before establishing wireless networks
  and using handheld devices, organizations should use risk management
  processes to assess the risks involved, to take steps to reduce the
  risks to an acceptable level, and to maintain that acceptable level of
  risk. Using risk management processes, managers can protect systems
  and information in a cost-effective manner by balancing the
  operational and economic costs of needed protective measures with the
  gains in mission capability to be achieved through the application of
  new technology.

Secure Your Wireless Network

  The convenience of having a wireless network in your home comes with
  added security risks. If it isn't secured properly you are vulnerable
  to someone using it to get to your information or to hijack your
  connection or computer for their own purposes.

  You could be held liable if someone uses your internet connection, as
  any illegal activity will be linked back to your ISP account.

  Having an unsecured wireless network can allow anyone within
  range-your neighbours or anyone on the street-to access your network
  or use your internet connection. They could use up your download
  allowance (possibly resulting in excess usage fees), intercept and
  read your files or email or, more seriously, use your account to
  access illegal content or undertake criminal activities.

Security Risks with Using Unsecured Wireless Networking

  Whether you are using a wired router or a wireless one, if it is not
  configured properly, both of them could pose potential security risks.
  The common notion that wireless routers or networks are not secure or
  less secure is true, but only in circumstances where it is used right
  out of the box without correctly configuring its security settings. If
  your wireless network is ‘unsecured’ or ‘open’, an intruder can easily
  gain access to your internal network resources as well as to the
  Internet, all without your consent. Once the intruder has access to
  your network, he/she can use it for a variety of operations, such as:

To steal your Internet bandwidth.
To perform disruptive or illegal acts.
To steal your sensitive information.
To perform Denial-of-Service (DoS) attacks to make the network unusable by sending out false requests.
To infect the network with malicious threats.


Perl CPAN modules in a PCI-DSS environment We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and running large applications, mostly legacy.

Now the advisor we pay to help us implement the PCI stuff is not very well versed in Perl and deems the CPAN a risk. The prebundled packages containing CPAN stuff that are available as rpms in the openSuse repository on the other hand are safe to use, according to this guy. He thinks that we should have someone from the outside audit all the code from CPAN we want to install. This person would need to have strong security background and deep knowledge of Perl. Unfortunately, they don't know anyone like that.

Addition: After the CPAN code for each individual module was security-checked, we would create our own rpm package from it (one for each CPAN module) and use these to install on our servers.

My main question is not for some-one who can be that auditor for us (although I'd happily take hints on that front), but rather how other companies working with Perl are handling this issue. As a Perl dev I feel the CPAN is one of the very reasons Perl is still around for larger projects. Not being able to use the stuff people built, documented and thoroughly tested for me feels like having my legs chopped of.

I would be very much obliged about war stories within the same context, personal experience or references to other companies that are using CPAN and are PCI compliant and might be willing to talk about this on a professional level.

Can he point out the section in the PCI DSS Requirements an Security Assessment Procedures 2.0 which he is using to justify this? It's not quite clear if the problem is the fact that it's third party code, or that it's sourced via a collectively managed repository.

If this is only a PCI-DSS audit, then argue your case:

  PA-DSS does not apply to payment applications developed by merchants and service providers if used only in-house (not sold, distributed, or licensed to a third party), since this in-house developed payment application would be covered as part of the merchant's or service provider's normal PCI DSS compliance.  [page 9]

and

  Note: It is not a PCI DSS requirement to use PA-DSS validated applications. [page 16]

You must review your custom code (PCI-DSS §6.3.2), not necessarily all code (PA-DSS §5.1.4).

In a strict sense, unaudited third-party code or repositories are risks. You need to demonstrably understand and manage those risks.

You should have a detailed inventory:

List of hardware and critical software in use in the cardholder data environment, along with description of function/use for each

To meet Requirement 6, you should have a verifiable process to use that inventory to check for, and apply in a timely manner, relevant security updates (§6.1, §6.2) for third party software. This should also be covered by your documented change control procedures (§6.4.5).

You should have a process to evaluate (not audit) modules so that features which fall under PCI-DSS are verified and understood (e.g. authentication, encryption and logging related). This probably means you need to have approved baseline versions of certain packages, and configuration guidelines (e.g. for CA stores, allowed ciphers), where it is relevant.

You should have a documented process for configuring CPAN, including but not limited to, a set of approved mirrors, requiring gpg/Module::Signature (where possible), procedures for sourcing developer signing keys, and requiring a proxy so that downloads are logged and traceable.


Securing sensitive data in a DB,is using H2 worth it? I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles.

Now of course, besides the usual password hashing + salt +.... I was thinking of putting those specific tables in an encrypted H2 database, and the rest of the data in a MySQL db. The advantages of H2 in my case are:

in-memory storage (so means faster access)
encrypted db (so an additional layer of security in case the server gets compromised)

is this a common practice when an additional security layer is demanded? meaning is it a good idea to separate the login info (in my case, it is the sensitive data) from the other data?

Encryption of the database prevents low level file based access to the database evading the database permission system. This is especial useful, if it is likely that an attacker gets physical access to the computer (think of stolen notebooks).

On servers it has the issue on what do to with the key/password. If you store it outside the encryption, you make it easy for the attacker to access it. But not storing it requires manual interaction on a server restart which is often not desirable for availability reasons.

Encryption of the database does not help against an attacker who can leverage an web-application that has permission to access the database via SQL-injection.

Having a second database, especially a second database software increases the attack surface: You are vulnerable to the union set of bugs of MySQL and H2. And you need people who understand both systems to operate it securely.

There is one advantage through: There is only very little code that accesses the authentication information. SQL-injection vulnerabilities in the huge majority of the code will not be able to access to the isolated authentication information.

At my workplace we did this for our web application instead: We use different database connections depending on the role of the user doing the requests. So an anonymous users for example gets a database connection which has very little database permissions.


Where does Google search take my geolocation from? After a bit of googling, found that the gs_l parameter that gets automatically appended to my google queries is my real location encoded in some way. The thing is, there is no sign of me having it approved in the past in my browser settings. Where does it come from then? Or does the search have automatic extra privilege in Chrome?

In Google Support, you can find next:

  Google automatically detects your computer’s location using its IP
  address, Location History (if it’s turned on), and recent locations
  you’ve searched for.

How Google uses your IP address

  Your IP address is usually based on a real-world location, so Google
  might use your IP address to guess where you are and give you local
  results.

  For example, Google could use your IP address to give you the weather
  forecast for the town you're in when you search for weather.

For location history, you can check here. And for recent locations here.

Also, I will not be surprised if Google did a "wardriving" in Hungary (while working on Google street project) - Source, so based on that, it can be possible to determine almost exact location.

This peace of Python code is old and doesn't work anymore, but it can give you an idea for what I'm taking right here.

Connect to your Wi-Fi and run this code (:

function showPosition(position) {
    var latlon = position.coords.latitude + "," + position.coords.longitude;

    var img_url = "https://maps.googleapis.com/maps/api/staticmap?center=
    "+latlon+"&zoom=14&size=400x300&sensor=false";

    document.getElementById("mapholder").innerHTML = "<img src='"+img_url+"'>";
}


Keychain-dumper and Secure Enclave Is it possible to use keychain-dumper to extract private keys that are protected by the secure enclave?

Keychain-dumper works with "/private/var/Keychains/keychain-2.db". If a private key is generated using SecGenerateKeyPair() with the kSecAttrTokenIDSecureEnclave attribute, will it still reside in keychain-2.db?

No, it won't reside on the keystore.

The secure enclave and the keystore are two different things:

KeyStore, is a secure database, implemented in iOS. It resides in the filesystem. While it is built with security in mind (I don't want to characterise anything as "secure") and is encrypted on the filesystem, its contents at specific time frames reside on the system memory unencrypted.

Secure Enclave is a completely different chip. it runs a separate operating system and can only be instructed to conduct some operations. It offers anti tampering mechanisms, TRNG (True Random Number Generator), etc. Keys can NOT be imported or exported, only generated and of course can be used for cryptographic operations.

It should be noted though, that only signing & validation ECC operations can take place in the secure enclave, as stated here.

EDIT: Validation & signing is the same operation with encryption & decryption, only the used key is changed. On signing the private key is used (so verification can happen with your public key) and on encryption the public key is used (so only you can decrypt it with your private key)


How can youtube track user in sandbox? I used Chrome in Sandboxie, and even after deleted contents of the sandbox, youtube.com still recommended videos for me, which based on vids I saw.

Only after I deleted all history in Chrome then youtube did not recommend these vids.

All of these actions are in sandbox, then how can youtube track user even when I delete all contents of the sandbox? At first I think youtube is based on my IP so deleting contents is useless. But youtube will not give those recommended vids when I deleted browsing history when browse in sandbox, which seems it is not based on my IP anymore?

There must be some info stored somewhere, because after deleting all contents, youtube should not be able to recognize any history, which will equivalent to delete browsing history.

I don't think youtube can penetrate sandboxie, so the only other option is that there is info stored in server. Someone can give it a try and explain it to me:

1/ Install chrome and sandboxie, both are free.

2/ Run Chrome in sandbox mode, go to youtube.com, search and watch some vids, e.g. martial art, so you tube will recommend those kind of vids to you.

3/ Delete all contents of sandbox.

4/ Run Chrome in sandbox again, go to youtube.com and you will see those recommended vids. How can this possible? youtube.com must recognize user based on IP or something else.

5/ Go to history, check and clear everything.

6/ Go back to youtube.com, those recommended vids disappear. How can this possible? Where did the recognition info be stored that cant be deleted?

Chrome is generally not too secure
You have an IP address that is tracked, many general spam recommendations will be based on that
History is irrelevant and so are cookies (in this case), but cache is not
Your browser has an unique ID that you can be identified by (this is used by the very advanced trackers)

What to do:

Use a private browser instance (and I recommend you use Opera - way more secure)
Do not be logged in into absolutely anything (no google, fb, y, skype etc)
Use a web proxy on the private instance (Opera has extensions with multiple selectable big proxies - browsec as example)
Use an unique ID changer to identify your browser as a general version wide-spread one (yes, there's an extension for that too)


Do I enhance security by appending all passwords with a fixed long string? I've been reading lots on stackoverflow specifically about security for login passwords. I read that security is enhanced when a variety of character sets are used and/or longer passwords. Thus, something other than a-z, A-Z, 0-9 to include things like 'special' French, German or Spanish characters (umlauts, accents etc), and passwords that are 20 characters are better than passwords with eight characters.

This got me thinking - let's say I force my users to input a password, minimum 8 characters in length, to include number, uppercase, lowercase character. Let's say that I always apply a 1000 character fixed string to the password (so its hardcoded in the javascript and viewable to the client via view source).

Once a strong hash is made out of this extended string, have I enhanced my security in anyway, or is the fact that the hard coded string being public not offer me anything extra?

I suspect that if someone wanted to perform a dictionary attack, by appending a 1000 character string to the source I slow them down because the hash would take longer to compute since it would be computed on an extra long string? True or not?

No, this is not a good idea. Since the appended string is public, the attacker would just append it as well to all the words in the dictionary when doing a brute force attack.

You argue that the increase in time from hashing a long string instead of a short would slow down the attack, but the effect would probably be small. More importantly, modern hash functions like PBKDF2 and bcrypt are already designed to be slow and have a build in way to make them slower by allowing you to set a cost factor parameter. If you want to slow an attacker down, just increase that. No need to come up with your own home brewed solution.

If you are not using a modern password hashing algorithm, then this is the time to fix that instead of considering hacks like this.

If you were to keep the string a secret (by appending it at the server instead of at the client) then it would be a pepper. That is a commonly used technique to increase the security of password hashes, but it could be argued that just encrypting the hashes is a better solution.


Man in the middle and goto fail My question is inspired by apples goto fail; bug.

I am wondering if the bug is really as dangerous as it is propagated everywhere. The reason I am in doubt about that is that there is a MITM attack required to abuse the bug, isn't it? And if this is the case then the only point this becomes dangerous is in public WIFI's or hotspots or anything like this. Or I understand this wrong and there are possibilities to be MITM-attacked from outside, that means in between two ISP routers for for instance?

Don't get me wrong, of course I know this is very dangerous, but is it still dangerous if I am only connected to the Internet through my private LAN?

Yes it can be. Since i do not use MAC or i-Phone or anything i'm not sure about how it is exploited  but i'm sure you don't have to be a coding genius to understand this code
So here's the Apple bug:

static OSStatus
SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa, SSLBuffer signedParams,
                                 uint8_t *signature, UInt16 signatureLen)
{
    OSStatus        err;
    ...

    if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)
        goto fail;
    if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
        goto fail;
        goto fail;
    if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
        goto fail;
    ...

fail:
    SSLFreeBuffer(&signedHashes);
    SSLFreeBuffer(&hashCtx);
    return err;
}

Source:
So it is a mistake by not commenting the second goto fail; so this can be a really dangerous loophole if you are on an open network (It lets you make a secure connection to an IP without considering the signature) . Not much danger in private LAN  if you trust the others in the network.


Challenge-Response Application in E-banking Why is it important that Alice doesn't know K? What could happen if Alice knew K?

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID.

Password generator is a shared service

In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, then she could calculate H(R,K) on her own. This would allow Alice to pose as any user to Bob. The communication would be:

Alice --> Bob: I'm Joe User
Bob --> Alice: R
Alice --> Bob: H(R,K) which Alice calculated on her own

Alice has now successfully spoofed Joe User.

Password generator is a personal authentication token

In this situation, the token is being used to implement 2FA. The something you know factor is Alice's PIN, and the something you have factor is the authentication token. If Alice knows the K that is stored on her token, then she can compute H(R,K) on her own. This would allow her to log into the system using only a single factor, namely something that she knows. While there are two somethings: her PIN and K, it is still only the something you know factor. As the whole point of the token is to implement 2FA, K must be kept secret from Alice.


What files yield the most useful information when an attacker leverages a memory vulnerability? I'm trying to understand what information is left behind after an attacker exploits a vulnerable application leveraging a memory vulnerability (overflows, ROP, etc.).

I wanted to know:

What are the files that are looked at when trying to understand an attack?

Which logs (or other files) do you look at?

Are logs all the information you have?

Are there any other data that give useful information?

What do you mainly look for? That is, what pieces of information will help you determine the type of attack or where the vulnerability is?

There are two places you could look for evidence of such an exploit: the syslog and coredumps.

System log

I'll assume you are talking about the record of the exploit attempt itself and nothing before it (such as remote access logs), and that you have not enabled any extra logging which may track file accesses or process creation. For the exploit itself, there is typically no trace left behind in log files if the attack succeeded. The only way there would be is if it failed at least once and triggered a segmentation fault, which may be logged to the kernel log buffer (shown via dmesg), which itself is likely logged by your choice of syslog daemon.

Core files

If you have coredumps enabled, then you may be able to get a lot more information about exactly what caused the segfault, assuming you have and know how to use gdb, and have the original binary which had crashed. as processes will log their core memory to the disk upon such a crash. But just like checking the system log, this only works if the exploit has failed at least once and triggered a crash. It also does not provide any information about who the attacker is, what their vector of exploitation was, what they are after, or what they used to attack. Also remember that, unless you have a special setup, coredumps are written to the disk with the same permissions as the program which crashed, so in some cases an attacker may have sufficient privileges to erase it (and examining that act goes into filesystem forensics, which I won't go into and isn't particularly related).

Compile-time hardening

As for what I do, I compile all programs locally, so I can use compile-time security features which attempt to trigger crashes on exploitation attempts. A few examples:

UBSAN (Undeined Behavior SANitizer) - Traps various types of undefined behavior to the ud2 instruction, which is an intentionally illegal instruction and crashes the program. Some types of undefined behavior can be used to exploit a program.
SSP (Stack Smashing Protector) - Creates a secret canary on the stack and aborts the program if it is ever overwritten. An attacker who only has an arbitrary write primitive will not be able to easily exploit a program which is utilizing SSP, unless they also have an arbitrary read primitive and can read the value of the canary (and put it in his overflow code).
FORTIFY_SOURCE - A collection of header files which wrap certain functions that expect a length as their argument, like strncpy(), to add runtime checks to ensure that the maximum length is not exceeded when it is known at compile-time.
PIE (Position Independent Executable) - Adds support to an executable for addressing libraries who's base is not known at compile-time. This allows a program to make use of ASLR, which loads libraries at random addresses to make it more difficult to exploit buffer overflows.
RELRO (RELocations Read Only) - In partial mode, makes ELF sections read-only after the linker has set everything up. In full mode, additionally makes the GOT read-only.
BINDNOW - Causes libraries to be resolved at executable load time, rather than when they are first referenced, which is necessary to benefit from the full potential of RELRO.

There are more security-related features which can be done at compile-time, like CFI and SafeStack. That was just a list of some of the most popular. You can use the updated checksec script to see whether or not a binary has bee compiled with various hardening flags:

$ checksec --file /bin/bash
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   Yes     13              33      /bin/bash

Log entry examples

Logs will generally only be created when the program is compiled with the correct hardening flags (with the exception of segfaults which will occur regardless of how you compile the binary). These hardening flags do not guarantee that an attacker will be unable to exploit a given binary, but it does make it more likely that an exploit will fail and possibly leave entries in logs. Some examples:

Segfault triggering SIGSEGV (in this case, a null pointer dereference):

$ gcc <<< 'void main() { char *a = 0; *a = 5; }' -x c - 2>/dev/null
$ ./a.out
a.out[24078]: segfault at 0 ip 000000720ab0b6f4 sp 000003c8ad38d170 error 6 in a.out[720ab0b000+1000]
Segmentation fault

UBSAN triggering SIGILL (in this case, an out of bounds index):

$ gcc <<< 'void main() { char a[2]; a[-1] = 5; }' -x c - -fsanitize=undefined -fsanitize-undefined-trap-on-error 2>/dev/null
$ ./a.out
traps: a.out[24130] trap invalid opcode ip:62a7e64673 sp:3be53c5fe20 error:0 in a.out[62a7e64000+1000]
Illegal instruction

Stack Smashing Protector (written only to stderr):

$ gcc <<< 'void main() { char a[2]; strcpy(a, "abcd"); }' -x c - -fstack-protector-all -include string.h 2>/dev/null
$ ./a.out
*** stack smashing detected ***: ./a.out terminated
Killed

FORTIFY_SOURCE (written only to stderr):

$ gcc <<< 'void main() { char a[2]; strncpy(a, "abcd", 4); }' -x c - -O -D_FORTIFY_SOURCE=2 -include string.h 2>/dev/null
$ ./a.out
*** buffer overflow detected ***: ./a.out terminated
Killed

But again, and I can't stress this enough, a successful exploit will not leave logs like these. You must check for signs of the original intrusion and not rely on the chance that their exploit fails.


How can I make a master policy file for Windows using Python? A while ago I was asking questions about using python to secure windows.  This was an answer I recieved.  Could someone tell me how someone would do this?

"As an overall way to do it, if you can find out which settings are contained in the registry, it's not difficult to create/write registry keys to which you have access. Other settings, such as GPOs, are harder to do. Sometimes you can change those with Powershell - so you may need to have Python call Powershell to configure some of those settings. If you aren't on a domain and are using local policies, you can configure a master policy file that you have Python replace.

On the whole, if you're looking to configure settings for new devices, a better way to do that would be to create them on a VM and use DISM to snapshot a sysprepped image and then lay it down on a new device. That's the more "Windows-y" way to do it."

baldPrussian

My bad, that should have been "folder" not file.  There is info about the group policy folders located here.  Technet also has a lot of info about how to make local policies using gpedit.msc.

As far as having Python replace a directory, that's also available in Stack Overflow and in the Python documentation.  You'd need to run any script that does that as Administrator or System.


Client-only authentication instead of server-only authentication, using OpenSSL First, some background:  I've got a C++-based client/server system that uses the OpenSSL C library to encrypt the client/server connections.  This is done in (what I believe is) the canonical OpenSSL fashion; that is to say, the server holds a .pem file containing both an RSA private key and the corresponding public key "certificate" (as generated by openssl req -x509 -days 3650 -nodes -newkey rsa:1024 -keyout my_private_key.pem -out my_public_key.pem ; cat my_public_key.pem >> my_private_key.pem), and the client holds a .pem file containing only the public key "certificate".  When the client connects, the client uses the OpenSSL protocol to verify that the server really is who it says it is (that is, that the server really has the private key and is not an imposter or "man in the middle") before allowing any application-level data to be encrypted and sent across the connection.

This all works fine, but the problem is that authenticating the identity of the server isn't quite what I want to accomplish; in this scenario, the server and client are both on the same private LAN, and the server is physically connected to some custom hardware, so a fake-server isn't a big concern -- any fake-server or man-in-the-middle attacker would still need to connect to the real server in order to do any damage; the worst a fake-server could do is pretend that the hardware had done things it really hadn't, and since the user will generally be physically in the room with the hardware, the user would immediately see (by observing the hardware) that his commands were not being acted on.

Rather, my primary goal for OpenSSL here is to authenticate the client -- in particular, before I allow the client machine to send any commands to the hardware, I want to verify that the client machine is actually an authorized user, and just not some hacker/saboteur who has somehow gained LAN access and is trying to cause trouble by sending malicious commands to the hardware.

In my (admittedly naive) understanding of how public/private authentication works, this should be straightforward to accomplish, simply by switching the roles of the client and the server; that is, in this scenario, I think the client machine should hold the private key, while the server should hold the public key, and that way it is the server verifying the client's identify before proceeding, rather than the other way around.

However, when I try to set up the above using OpenSSL (by having the client call both SSL_use_certificate() and SSL_use_PrivateKey_file(), while the server calls only SSL_use_certificate()), it doesn't work (the client emits an error like SSL_write() ERROR!4560385472:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1536:SSL alert number 40), and I'm not sure if that's because I'm simply calling something wrong, or if it's an indication that what I'm doing is unsupported by OpenSSL, or even fundamentally unsupportable for some reason.

I'm pretty certain I could obtain exactly the semantics I want by having the server make an outgoing TLS connection back to the client (so that the "client" becomes the "server" of the new connection), but I'd prefer to avoid that approach if possible (since the client could have a firewall installed that would make that reverse-connection difficult).

My questions are:

1) Is there anything fundamentally wrong-headed or futile about what I'm attempting here?

2) Assuming not, is it known that OpenSSL (as it is currently implemented in v1.1.1c) cannot or does not support this use-case?

3) Is there some other approach I should be considering (other than the usual "figure out where the mistake is in your software" one?)

Once a TCP connection is established, it's symmetrical, so what you're doing is possible by having the client start a TCP connection but have the server initiates the TLS handshake.

A much simpler way though, if you really don't care about server authentication, is to configure the server with self-signed certificate and then configuring the client to ignore certificate verification.

However, I'd question the wisdom of skipping server certificate verification at all. Why do you want to skip server certificate verification in the first place?


Xcode's git still vulnerable (CVE-2014-9390)? What's the best practice here? In December everyone and his grandmother were talking about CVE-2014-9390 and we were all busy installing the git maintenance releases.

Looking at my Xcode installment today - 41 days later - I still see a version 1.9.3 (Apple Git-50) from October lurking in /Applications/Xcode.app/Contents/Developer/usr/bin/.

Apple did update git in Xcode 6.2 beta 3. But apparently they didn't bother updating their current "golden master build".

So, if you are using Xcode's built-in git services, you are still working with a vulnerable version. What is the recommended approach in this situation? Delete the file?

Since the exploit is triggered only when you pull from untrusted repositories, and Apple has not released patches for previous XCode versions, you have two options:

Jump to the beta branch.
Do not pull from untrusted repositories. GitHub repos are safe, because they explicitly disallow repositories containing the exploit. Update internal git servers, and inspect unknown repositories before pulling.

Edit (3/10/15): As of today, upgrading to XCode 6.2 is an option! The new release fixes this option (see APPLE-SA-2015-03-09-4)


Would an RP3 do well as a firewall appliance? I have seen this post about the Raspberry Pi for use as an IDS. But how well would it do as a firewall appliance in a residential setting? I will soon be setting up a new network and want to exercise my knowledge of network security. I don't exactly have an old pc to dedicate as a security device. I would purchase a Pi 3 for this sole purpose. Any thoughts or experiences to guide me?

This all depends on how fast of an internet connection you want to run a firewall for.  A firewall needs at least 2 interfaces, so you'd have to attach a 2nd USB ethernet device.  Because the on-board ethernet on the Pi is attached to the USB bus as well, you'll have all the bandwidth over the one USB interface.

For a slow connection -- something like 20Mbit or slower -- a Raspberry Pi3 will probably work fine.  If you need anything approaching 100Mbit or faster, it just won't happen over the interfaces available on this board.


BLP Lattice-structered system from Access Control Matrix I've been reading a Computer Security book by Walliam Stallings and have found this example:
http://i.imgur.com/5CAlc.png
of an Access Control Matrix. Any example will do I just thought I'd screenshot this off coursesmart.

My question is on how to convert an access control matrix like the above into a BLP and if there should be any additional security level(s) added?

Edit: BLP is http://en.wikipedia.org/wiki/Bell%E2%80%93LaPadula_model

If I recall correctly, BLP is an example of a MAC (mandatory access control) system, while the access matrix you post is a simple RBAC system. You can't necessarily 'convert' between the two. MAC is based on the idea of labels (secret, top-secret etc), preventing information flow in certain directions between labels. RBAC is a completely 'flat' system; users are given rights to objects without regards to information flow.

So, you can't 'convert' the access matrix, but you can arrive at a lattice based on the access matrix by 'inventing' the extra information needed. Try to categorize the objects into MAC levels, and then assign users to those levels. You may arrive at conflicts: a user that has write access to a lower level (which violates the no-write-down property of BLP). Perhaps you could split the user in two, but in reality you wouldn't want people using multiple accounts. Another solution is to upgrade the classification of some objects, but that may give rise to new conflicts.


Have gotten a blackmail email with a password of mine - what to do? I've gotten the following email today (the password has been changed; and the Greek characters are reproduced verbatim):

  Your ρasswοrd is REPLACED. Ι kηow α lot more τhngs about you τhaη τhαt.

  How?

  I ρlaced α malwαre on τhe ροrn websιte αηd guess whαt, yοu visιτed
  this web sιte to hαve fun (you kηow whaτ I meαη). Whιle yοu were
  wατchιng the video, yοur web brοwser αcτed as aη RDP (Remoτe Desκτoρ)
  aηd α κeylogger, whιch ρrοιded me αccess το yοur dιsplαy screen and
  webcαm. Righτ αfter τhατ, my sofτware gathered αll your conταcτs frοm
  your Messenger, Fαcebooκ αccouητ, αnd emaιl αccοuηt.

  Whατ exαctly did I dο?

  I made a sρlιτ-screeη νideo. The fιrsτ ρarτ recοrded τhe vιdeο you
  were νiewing (yοu'e goτ aη excepτιoηal τasτe hαha), aηd the next pαrt
  recorded yοur webcam (Yep! τ's you \doing ηαsty τhιngs!).

  Whaτ shοuld you dο?

  Well, I belιeve, $2000 ιs a fair prιce fοr οur little secret. You'll
  mακe τhe ρayment vιa βiτcoιη το the below αddress (if yοu doη't kηοw
  τhιs, seαrch "hοw to buy βιτcoιn" in Gοogle).

  Βιτcοiη Address:

  bc1qsqhjhalkn5e9m06vvph7mtml8ryuvzxcgdrhqy (Iτ is cAsE sensitινe, so
  copy aηd ραste ιτ)

  Imροrταnt:

  You haνe 24 hοurs τo make τhe pαymeηt. (Ι haνe a unιque pιxel withιn
  this email message, αnd rιght now Ι κnοw τhat you have read thιs
  emaιl). If I dοn'τ geτ the ραymeητ, I will seηd your νιdeo το αll οf
  your cοntacτs, ιncludιηg relατiνes, coworkers, and sο
  fοrth.Nοneτheless, if I do geτ ρaid, I will erase τhe νideo
  ιmmedιαtely. Ιf you waητ evidence, reply with "Yes!" aηd Ι wιll send
  your videο recordιng tο your fiνe frιends. Thιs ιs a ηοη-negotιαble
  οffer, so doη't wαste my τιme aηd yοurs by reρlyιηg το thιs emαιl.

  Millicent Brillinger

Now, I wasn't watching porn online, nor do I have a webcam connected to my computer; nor are my email contacts available online (that I know of), but that password is a weak one I am using on quite a few websites. Also, some careless mailing list servers occasionally send that password to me as plaintext every once-in-a-while.

I'll mention the email comes from some outlook.com address;  and my email was migrated to MS Outlook 365 a couple of years back.

My question: What - if anything - would you suggest I do, both to defend myself from the person behind me and to possibly warn/protects others above/from him?

Ignore the email.

Change all your accounts that use that password.

Move on.


vulnerability management 101 Looking at a typical vulnerability scan report from Nessus or Qualys most people are terrified, lost, and basically with more questions than answers. For example, how on earth am I going to deal with all these findings? From what I was taught, a vulnerability management process can be broken down into 4 steps (not mentioning its close relation to patch, change, risk management):

Identifying vulnerabilities
Evaluating vulnerabilities
Treating vulnerabilities
Reporting vulnerabilities

Vulnerability scanner scoring/risk rating and how does it match your org.
While the scanner provides its own risk ratings and scores such as CVSS, and I guess these are somehow helpful in telling org’s which vulns require immediate attention, but do they really reflect the true risk? I mean a vulnerability can depend on some other factors beyond the mentioned scores and vulnerability scanners do not have the intelligence to tell whether the finding is a true or false positive (to a certain extent, e.g. issues with backported patches), whether there are any security controls that would reduce the likelihood and/or impact of this vulnerability being exploited, how would it impact confidentiality, integrity and availability of the exploited system, data, how would it impact your business, what your org’s risk management strategy is and many others.
So I guess that vulnerability scanners, like any other security-related software, are not perfect, but still, they provide us with a large amount of information (sometimes valid, sometimes not) and here’s where we as human beings take over to produce something more meaningful that will aim to increase an org’s security posture and lower its risk exposure.  I guess that’s step 2 in the process, vulnerability evaluations.
While exploring the topic, I hear voices like “your vulnerability management needs to be risk-driven, so that you make informed decisions” or “your vulnerability management needs to be threat-intelligence-driven, to learn and predict how an adversary might strike”.
How to evaluate, prioritize, remediate?
So what I’m looking for is maybe not a recipe but direction or guidance from experienced members on how to:

not waste unnecessary time on findings, because they are false positives anyway (e.g. backports). Should the first step be verification whether it’s a false positive or not?

select the correct ones to address first (I’m looking here for suggestions on whether vulnerabilities should be first grouped based on their nature, e.g. injection vulnerabilities or any other criteria. What I know, that it's generally recommended to export or filter scanning results by plugin ID instead of IP’s so that we will have only a few hundred vulnerability groups that will have x amount of systems in those groups). I’m aware of the CVSS scoring system, so could or perhaps should I use it to conduct a more accurate assessment based on my org/environment?).

I really would want to avoid a situation where I’m only the guy that bothers others with calls and emails asking whether given vuln’s have been addressed but would rather want to make an impact on the security posture of the organization where I’m currently working. Other than that, I could possibly go through the list of all the findings and provide information in form of advisories on how to verify and patch a given vulnerability, but in some cases my ability is limited I guess, meaning I don’t know all the details about a given system, so just providing a recommendation to upgrade to the latest PHP version where a number of functions were deprecated is not going to help the concerned system owners.

PS. If there are any books one could recommend, I would greatly appreciate it !

This entire thing boils down to one simple concept: risk management.
You have a piece of software that gives you raw information about potential threats. Now you go through the process you outlined:

Identifying vulnerabilities
Evaluating vulnerabilities
Treating vulnerabilities
Reporting vulnerabilities

False positives: you evaluate the identified vulnerabilities to determine if they are a risk that needs to be treated.
Vulnerability prioritisation: you evaluate the identified vulnerabilities to determine which risks need to be treated first based on what risks matter most. You can use scores or any other method that works for you.
Getting others to remediate: you need to communicate in a way that is effective in your environment. We certainly cannot provide a single answer to address this. This is often far more political and cultural than it is something related to security or risk.
So, given all this, it appears that you want to know how to evaluate vulnerabilities in a way that is relevant to the risks in your organisation. Relevance being key here. And this is more of a risk management process.
Risk management:

you assess the threats (the vulns in this case) as to whether they might have an impact on goals and objectives, and how much impact that might be (known as assessing "inherent risk")
you determine whether existing controls affect the impact (known as assessing "residual risk")
you tackle the ones that will have the highest residual risk

This can take seconds, or it could take months, depending on your context and how many variables there might be. So, a lot of orgs take shortcuts and just use CVSS scores without assessing existing controls unless remediation has a high cost and a cost/benefit analysis needs to be made.


Buffer overflow: How is it actually implemented in a pen testing environment? Background:

So when exploiting a Buffer Overflow vulnerability, the attacker needs to
 not only generate the payload (Let's say to create a binding shell), but also set up the corrupted buffer with the said payload to be sent to the victim's machine. (ie. a tcp echo server that utilizes a vulnerable BoF function call  that is running on Windows XP OS). And as part of setting up the buffer, there needs to be certain parameters taken from the victim's machine; such as

the EIP offset at the moment of the crash
the memory location of the corrupted EIP (pointing at the payload to
be executed).

My Question is:

In a professional pen testing environment how would the pen tester access the above two parameters without having access to the victim's machine? Meaning without having to install a disassembler and debugger inside the victim PC and actually analyze the program in the debugger.

Is there another way to simulate this attack without having access to the victim's machine?

Most of the times you'll have to emulate the target's system and develop your exploit locally. About how to learn about the target's system, that has to do with the enumeration process. Of course depending on the binary you're trying to exploit, it may be possible to achieve an information leakage, and in that way you'll be able to make your exploit work even remotely even if your system is a bit different from the target's system (of course if your target uses e.g. linux you'll have to use linux also, but not the exact version).

For example, in case of a format string vulnerability you may be able to leak libc remotely. But there are other cases also, for example if the binary uses a string writing function, like puts (or printf etc...), it may be possible to use that function to leak libc base address from a GOT entry in runtime so you can construct a multi-stage exploit that bypasses even aslr. Now about how you can compute libc base address from a leak, there many ways (you can either use libc database or a web wrapper of libc-database here etc...).


SSL and redirects security I have a domain, let say:

example.com

I also have a domain

server.example.com

which points to my Elastic Beanstalk.

I've written some rule, that redirects certain traffic from example.com to server.example.com (thus my Elastic Beanstalk):

example.com -> server.example.com -> elasticbeanstalk

Now, on my example.com I've got a wildcard SSL (*.example.com, is active on both example.com and server.example.com).

I've also updated that certificate to the Elastic Beanstalk loader.

Now, I am wondering If this set up is secure?

For client redirect : If all domains use https AND HSTS, then the redirect is  as safe as possible.

For server "proxy": If they are on the same server http is probably fine. If they are in the same internal network, http is not a good idea. If internet is between them, http is not safe at all. For https, make sure the servers check the validity of the certificates.


Any alternative available for RSA? Is the web still visible to NSA? After the Snowden revelations, is there any mass change being carried out to HTTPS protocol?

As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA protocol. Is there any existing alternative of RSA that the government and multinational organizations (where confidentiality is top priority) are using right now?

I am trying to view the contemporary picture post to Snowden revelations.

There is nothing in the "Snowden revelations" which even hints at any special NSA ability at breaking RSA. Even taking all that Snowden says as gospel, NSA is still at the same point as everybody else, meaning that breaking 1024-bit RSA is "theoretically feasible" but subject to the building of a very special machine whose design has been roughly sketched, which would cost a substantial number of millions of dollars, and, crucially, which would need quite some time (months...) to break every single key. For a 2048-bit RSA key, just forget it.

According to all the Snowden-powered information, when NSA "breaks SSL", they do it sensibly, i.e. not by punching through the cryptography upfront. Instead, they bribe the hosting sites to put spying hooks directly on the clear data, SSL notwithstanding. This is way cheaper, works reliably, and does not require invoking sci-fi level supposed cryptanalytic advances or alien technology.

Building and using RSA-breaking technology for mass-SSL spying would strike me as an extremely inefficient use of budget by the NSA.

Nevertheless, there are alternatives to RSA, and some have been part of SSL since the days of SSL 3.0, two decades ago. With the standard core protocol (called TLS 1.2 these days), you have the DH_DSS and DHE_DSS cipher suites, which involve Diffie-Hellman for key exchange, and DSA for signatures (with DH_DSS, the server's certificate contains a DH public key and the issuing CA contains a DSA public key; with DHE_DSS the server's certificate contains a DSA public key and the DH key pair is produced on-the-fly). Elliptic-curve variants have also been defined. Modern browsers and Web servers support DHE_DSS and elliptic curve variants thereof.

Historically, these alternatives were developed not for security, to fix some perceived or alleged weakness of RSA; they were put into SSL because at that time, RSA was still patented in the USA, and none other than the US federal government needed a patent-free but secure protocol for its own usages.

Now that the RSA patent has expired (more than 12 years ago), everybody does RSA. Yet alternatives are ready, and will be used if RSA appears broken. Which it currently does not, even against NSA.


My certificate seems fine but my TLS fails (Cert not validated) I set up my certificate for my mail server at https://mail.xxxx.com/
I exported my certificate as described in my mail servers documentation and pointed to it in the server settings.

The certificate seems to validate 100% on all tests, even the issuer verified that all is well. However my mail clients like outlook and thunderbird seem to fail with invalid certificate warnings.

You can see it fail at http://www.checktls.com/ if you use the email address support@xxxx.com

    [001.838]
Certificate 1 of 3 in chain:
subject= /OU=Domain Control Validated/OU=PositiveSSL/CN=mail.xxxx.com
issuer= /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
[001.886]
Certificate 2 of 3 in chain:
subject= /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
issuer= /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
[001.933]
Certificate 3 of 3 in chain:
subject= /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
issuer= /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority          Validation Secure Server CA
    [003.400]       Cert NOT VALIDATED: unable to get local issuer certificate
    [003.401]       this may help: What Is An Intermediate Certificate
    [003.401]       So email is encrypted but the domain is not verified
    [005.791]       Cert Hostname VERIFIED (mail.xxxx.com = mail.xxxx.com)

Edit : The chain moves to the second certificate but then repeats, and if i look at the chain anywhere else it connects fine.

Im hoping someone can maybe shed light on what the problem is.

Many thanks

You client is looking for the server to provide copies of the intermediate certificates and it appears your server is not doing so.  The exact configuration will vary based on your server, but it should be possible to download the intermediate certificates (from your CA) and share them along with your server certificate in order to get to a certificate that the client trusts.

Basically, the client doesn't want to have to (or is unable to) look up intermediate certificates on the Internet.  Thus, you need to provide them so that each step in the chain can be validated.  Some clients will go out and find them or may already include many common intermediate certs, others do not.


OpenSSL Heartbeat (Heartbleed bug) - what's the payload used for? So the heartbeat bug can lead to memory read overrun, exposing (parts of) the process memory, because it reads the payload when there actually is no (or less) payload.

But what do you need a payload for, especially in a heartbeat?

It looks like it's just memcpy'd into the response. How is it used, exactly?

Edit:
Similar question, very interesting answer: Why does the client supply the length of the message at all?

Edit in response to TildalWave's comment:

This question is not a duplicate of 55116. I'm asking what the payload is used for. The other question is asking how the exploit works in general ("How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?") and does not even contain the word "payload".
Clarification - it seems my question is a little unclear.

A heartbeat is usually used to check if the other system is still there, which is basically a yes/no question - so why is there a huge 64 KB sized payload at all (Mark has already mentioned sequence numbers though)?
The server does not care about the contents of the payload, it simply copies it into the response (expecting the client to provide the payload length instead of checking it, at least before the heartbleed fix), right?
What kind of data would a client put in the payload? A number? A word? A random string? If possible, please provide a link to a source file (preferably C) together with the relevant lines of code.
Can someone provide an example for a use case that requires the payload be longer than, say, 8 Byte? Why would using an 8 Byte hex sequence number be a bad idea?

The TLS "heartbeat" feature is intended for TLS over UDP or other connectionless protocols.  "Heartbeat" packets are a way of asking the server "are you still there?", but with a connectionless protocol, there's no guarantee that packets won't be dropped or delivered out of order.  The arbitrary-sized "payload" field permits a great deal of flexibility for telling one heartbeat packet from another.

The problem is that this flexibility is overkill for almost all uses: a simple sequence number or other fixed-size field would work just as well.


How are "fake cell towers" detected With the recent (and not so recent) news about fake cell towers popping up in different part of the world, I was wondering how these are detected (from a technical point of view).

I'm not really looking for information about how an end user could detect or protect himself, but rather I'm wondering how a fake cell tower is identified (even with specialized equipment)

Well, if said end user had a rooted Galaxy S3, they could use Darshak on their phone to check for "baseband attacks" that indicate they are communicating with a rogue tower. There's a company called ESD that sells a "cryptophone" that can do the same thing, but for a hefty price tag (like 1,300 USD!). Edit: Here's another cool app I found from a comment by @wesleyac: Android IMSI Catcher Detector.

Unfortunately, no one seems to have a good explanation of how it's done. But ESD does release the source code for their phones freely for security audits, and the SecUpwn group has released their app on Github. If you want to wade into the implementation details, that would be a good place to start. A brief technical explanation of the GitHub app is here.

These towers seem to be the modern-day number stations. We may never know, but we'll always get that creepy feeling when we think of them ;)

(I am not affiliated with either of these products.)


Shared host that is not a service provider, with no SAQ/AoC. Is compliance possible? Shared web host says they are not a service provider and have no attestation of compliance or SAQ. But they say they are PCI compliant.

According to SAQ, it would seem like I couldn't be compliant on their hosting:

  If merchant website is hosted by a third-party provider, the provider is validated to all applicable PCI DSS requirements (e.g.,
  including PCI DSS Appendix A if the provider is a shared hosting
  provider);
  All elements of payment pages that are delivered to the consumer’s browser originate from either the merchant’s website or a PCI DSS
  compliant service provider(s);

This is very surprising since they are a fairly large US host specifically saying they are pci compliant.

Can I be compliant on their hosting?

In your previous question, you indicated that you need to complete an SAQ-A-EP. Since all of your infrastructure is being provided by the hosting provider, you are relying on their PCI compliance. You are being placed in a difficult situation since they are not providing an Attestation of Compliance. They can say they are compliant but unless they provide an AoC then you only have their word. If you can't demonstrate the compliance status of your service providers, you run the risk of not meeting requirement 12.8.

Here are a few options:

Check the Visa Registry of Service Providers to see if they are listed.
Contact the hosting provider directly either through a relationship or customer manager. Ask them how you can be compliant without their AoC.
Talk with your acquiring bank. Since you are accountable to them regarding your compliance, ask them for guidance. They can give you suggestions for how to address the situation to their satisfaction.
Look for another hosting provider. Yes, this isn't optimal but if the hosting provider consistently pushes back on demonstrating their compliance, and your compliance is vital enough, then the hosting provider is increasing your risk. Many hosting providers actively publish their AoCs. For example, Microsoft publishes the AoC for Azure.


What impact do the frequency of password resets have on password reuse? Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce password reuse.

The research shows that requiring time-based password changes increases re-use (users will use a password from another site, since they've already got it memorized, or will use a near-duplicate of their previous password), decreases password complexity, and increases the odds of the password getting written down somewhere.

The answers and papers in this related question would be a good starting point for further reading, for example, the introduction and conclusion of  this one.

In short, if you want to minimize password re-use, don't require time-based password changes.  The best way I've seen to encourage unique passwords is to provide the user with a randomly-generated password at account creation, rather than letting them specify a password.


How to proceed after attempted cracking to accounts? I was woken today at 05:15 by a phone call from my bank, notifying me that the PIN number is XXXX. I did not ask to change my PIN number, and actually, have not accessed the bank account electronically in a while.

I then checked my email and noticed that my guru.com account was accessed, and is now locked due to failure to answer the security questions correctly. Needless to say, it wasn't me who tried to access the guru.com account.

This attempt was made at 02:41 from Dhaka, Bangladesh, from IP Address 123.108.246.44 (the ISP for this IP is GrameenPhone (widely abbreviated as GP, is the leading telecommunications service provider in Bangladesh)). I do not reside in Bangladesh.

Any suggestions how to proceed, besides the obvious changing of credentials?

The first step is to identify if the attackers even managed to gain access to any accounts, or were still trying to get in. Head over to Have I Been Pwned? and check if any of your accounts have been leaked in the past. If that's a 'yes' - check if you were reusing your passwords. If that's a 'yes' again, go reset them and ensure that you use unique passwords this time around.

Next - if the attackers were attempting to access your accounts (I'm assuming this is the case, since your account was locked due to bad answers to the security Qs), I'd not worry as much. Reset the account, and go through the reset questions to ensure that you haven't given away the answers to them on social media or to anyone else you know.

All of this is general security advice. It's applicable to every question regarding actions to be taken after a breach.

Finally, if you're feeling very paranoid, you could call your account while you look around for what may have provided the attackers with information - scan your PC, wipe it if you have to. Do the same for all devices that you enter credentials on. Have you logged in on any new devices? Someone else's device?


Is it safe to use Redis to store username and hashed passwords? We are taking a look at using Redis for a Cache Aside pattern, and I am thinking, is it safe to store username and hashed passwords in Redis Cache? If yes, are there security issues with having a key structure like user:username?

Or for initial authentication / login using username and password, it is safer to perform direct DB read, and then store the Refresh Token instead in Redis?

I don't see any problem with using Redis if these conditions are both met:

You trust your network between your application and your Redis instance, since Redis lacks native support for SSL.
Your Redis instance requires authentication.

The user:username key shouldn't be a problem neither, as long as you correctly handle username changes (creating the new cache entry, and deleting the old one).


HSTS: Clicking through certificate errors We have a website www.example.com with a certificate for domain www.example.com, we also have HSTS enabled. The Qualys SSL Labs (https://www.ssllabs.com/index.html) confirmed that HSTS has been enabled.

I noticed that if you go to https://test.example.com (which is served by the same Web Server), you encounter a certificate error, which is to be expected, as there is no certificate for test.example.com loaded on the Web Server. However, I have noticed that you can click through the certificate errors, and the web content is then served.

To me this is unexpected behavior. I thought that one of the central ideas behind HSTS is that you cannot click through certificate errors. From Wikipedia: "If the security of the connection cannot be ensured (e.g. the server's TLS certificate is not trusted), show an error message and do not allow the user to access the web application".

This happened with both Firefox 59.0.2 (32-bit) and Chrome (65.0.3325.146 (64-bit)).

My question: Why would a browser allow a user to click through certificate errors on a website where HSTS is enabled?

Your browser doesn't apply the HSTS policy of test.example.com because it hasn't seen the header before over error-free secure transport. Therefore, it still allows you to "add an exception".

  The user agent processing model [...] stipulates that a host is initially noted as a
     Known HSTS Host, or that updates are made to a Known HSTS Host's
     cached information, only if the UA receives the STS header field over
     a secure transport connection having no underlying secure transport
     errors or warnings.

(From RFC 6796, emphasis my own)

Seeing the header over plain HTTP or with certificate warnings doesn't count:

  The Strict-Transport-Security header is ignored by the browser when your site is accessed using HTTP; this is because an attacker may intercept HTTP connections and inject the header or remove it.  When your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor the Strict-Transport-Security header.

(From MDN)

Also, note that your includeSubDomains directive from www.example.com doesn't apply since test.example.com isn't a direct subdomain (doesn't match *.www.example.com).


ASP.NET MVC Security Check List I am planning to start a new web site on ASP.NET MVC 2 (3).

Does anybody have a full (if possible) check list of actions or approaches I should go through to avoid most security issues?

Barry Dorans, author of Beginning ASP.NET Security, provides some good material on the subject. I read his book and he covers a lot of ASP.NET MVC specific material.

If you are looking for a check list of application security controls, be sure to also check out the OWASP ASVS project.


WPA2 Enterprise AES encryption key size? I have recently set up a RADIUS server with EAP for my wireless router, however, I have some questions about the key size and how WPA2 enterprise (AES) works in general.

I have read that in Enterprise mode, the key used to encrypt the traffic between the wireless AP and the devices connected to it is randomly generated and expires each time a user connects/reconnects. I also know that in WPA2-PSK, the maximum key length is 256-bits.

However, I have not been able to find any place that tells me where the key generation for WPA2 enterprise takes place, and which device has the burden of generation and negotiating that random key. Is the key generated by the AP? is it generated by the RADIUS server? what is the length of the encryption key?

Also, is there a way to actually check to see if the traffic is encrypted?

Thanks!

You are correct in thinking that each session uses a set of psuedo-randomly generated keys. If the network is set up to use a Pre-Shared Key (PSK) then the process works as follows:

The connecting device makes itself known to the Access Point (AP).
The AP sends a psuedo-randomly generated nonce to the device (as plaintext).
The device generates its own psuedo-random nonce.
The device then uses these two nonces, the MAC address of the AP, the MAC address of the device, and the PSK as input to a cryptographic hash function, to create a block of keying information called the Pairwise Temporal Key (PTK) which is 64 bytes, or 512 bits in length.
This PTK is cut up to produce 5 separate session keys. The Key Confirmation Key (KCK) is 128 bits long, the Key Encryption Key (KEK), 128 bits, the Temporal Key (TK) 128 bits, and two shorter keys Rx and Tx used for providing Messsage Authentication Codes (MACs), both 64 bits long.
The device now responds to the AP with its own nonce, concatenated with a hash of the AP's nonce it received and the KCK.
The AP derives the same PTK and session keys as the device as it now holds the same input information (nonces, PSK, the MAC addresses). It can then hash its own nonce with the derived KCK and check it against the received one. This confirms that the device shares the PSK and the device is now authenticated to the AP.
The AP responds to the device with a hash of the device's nonce using the KCK and a sequence number to prevent replays of previous messages by an active attacker.
The device checks the received hash of its own nonce against the expected result (with the KCK), and if they match the AP is authenticated to the device.
The device responds with an acknowledgement of receipt, and the handshake is complete.

From this point onward, messages between the AP and device are encrypted using AES with the TK derived by both devices. The Rx is used to create MACs on messages sent by the device, and the Tx is used to create MACs on messages sent by the AP.

Note that the use of the KEK is not mentioned. I'm not entirely sure on its use, but I assume it was added to the standard to allow for implementation specific extensions to the authentication handshake.

This answer might be more theoretical than you were looking for but I hope it helps.


What method for CSRF token generation should I use in my scenario? I'm working on a RESTful API to work with my AngularJS application.

Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using FormsAuthentication.Encrypt. This approach could result in the authentication cookie being stolen, however that problem is out of scope for this question.

The question is about generating an CSRF token. I want to generate the token based on the authentication cookie, that way when the user logs out (or logs out and back in) the token will be invalidated. Problem with generating a token for each form is that then the form could expire before the authentication expires. I want forms to remain valid for as long as the user is logged in.

If the authentication cookie is hijacked, all security is lost anyways. Because of that I don't see any added risk to the CSRF token relating to the authentication cookie. The token will be sent to the client as cookie, and to the server as header.

Additionally I'll check referer/origin headers, but that's out of the scope for this question.

Some example:

# URL that doesn't require authentication
GET /api/security/session HTTP/1.1
HOST localhost:1234

HTTP/1.1 200 OK
Set-Cookie: .ASPXAUTH=SomeLongHexCodeHere; Expires=...; HttpOnly
Set-Cookie: CSRF-Token=TheToken; Expires=...;

# URL that does require authentication
GET /api/account/data
HOST localhost:1234
X-CSRF-Token: TheToken

For generating the CSRF Token I was thinking about generating a salted hash from the .ASPXAUTH cookie. Would this suffice in the protection against CSRF, assuming XSS is blocked and the authentication cookie isn't hijacked?

Two final notes. Although my code runs on the ASP.NET platform, it's not using any of the ASP.NET technologies (WebForms, WCF, MVC, WebAPI, etc.) and cannot use their CSRF protection methods. Secondly the site doesn't use SSL, and sadly won't use SSL. It'll be vulnerable to MITM attacks, and there's not too much I can do about it.

For generating the CSRF Token I was thinking about generating a salted hash from the .ASPXAUTH cookie. Would this suffice in the protection against CSRF, assuming XSS is blocked and the authentication cookie isn't hijacked?

The answer is yes, it's sufficient, assuming you have marked the ASPXAUTH cookie as HttpOnly.

The token needs to be a hard-to-guess value that the server can correlate with the session cookie.  A hash of the cookie works quite well.  Since it is HttpOnly, scripts running on the browser will be unable to read it and won't be able to forge the hash.


How to trace AD Admin Login How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?

You can refer to this document http://dl3.checkpoint.com/paid/a6/CP_R75_IdentityAwareness_AdminGuide.pdf?HashKey=1406609615_673007d65df939c943ee67df223fe99e&xtn=.pdf.

It is checkpoint's feature to do what you want.

The basic idea is simple.
Monitor DC's windows event log for user's logon message. There are specifc event types for user logon event. There is IP and user binding info you need in the log message.

For multiple domains, you need monitor all DCs of the domains.


In the context of SSL Labs where is the "trust store"? When I'm testing a site with https://www.ssllabs.com/ssltest/ I'm getting this:

Could you explain:

Why are there two paths? Where do they come from, where are they configured?
What is this "trust store" mentioned? Is it in my browser? On the server I'm testing? On the SSLLabs.com server?

In the end I'm getting an "A":

But Chrome still complains:

I'm suspecting that this is because the trust chain on the first picture, but I'm not sure how to "fix" it. I read all the links in this question so I understand the basics, but my particular situation is not covered (or I cannot connect the dots).

Why are there two paths? Were do they come from, where are they configured?

A signature is created by using the public key of the issuers certificate. Two certificates can contain the same public key (typical after re-issuing a certificate) and this leads to alternative trust path if both of these CA certificates are included in the trust store.

  What is this "trust store" mentioned? Is it in my browser? On the server I'm testing? On the ssllabs server?

This is on the SSLLabs server where they try to use a trust store similar to the browsers. Of course the real trust store used by the browser depends on the browser and/or OS, so it does not reflect fully what happens in the browser.

  But chrome still complains:

Hard to tell what's really going on, but the signature of a certificate in the trust store is not relevant, only the signatures of leaf and intermediate certificates. It might be a false positive.