Why doesn't netsplit riding work on single node networks? I've been reading up on netsplit riding (a.k.a riding the split) and according to multiple sources, it's only a risk to multi server networks.

Now I understand that a netsplit occurs when a node disconnects from the IRC network, so a netsplit is not possible on a single server network as there is only one node.

But theoretically wouldn't an attacker be able to disconnect everyone from a single server network and acquire the op status? This technically wouldn't be riding the split but it would be very similar.

You've basically answered your own question. The way I see it is that an attacker can disconnect everyone, including the attacker, by performing a denial of service attack or exploit a vulnerability in the IRC daemon/server.

While performing a denial of service, in theory the attacker could gain op in one or more channels by stopping the denial of service and then quickly connect to the IRC network.

However, there are also IRC operators that could easily get back the channel, especially since it's a small network, so global rules for specific networks do not apply.

Counter measurements would be to install (a) service(s) like Anope where people can register their nick(s) and/or channel(s) to prevent take overs.


Lost in a field of Degrees and certifications I have another semester or so before I graduate with my As in Information security. This is going to be a two part question.  Other than the degree I will also have a few different certifications. Also adding a small 140 hour internship with my last semester.

CompTIA A+
CompTIA Security+
CompTIA Network+

With the degree and the certs what I will have other than help desk what am I looking at for employment.

Part two of this question is more schooling. I really want to move forward with a BS in a field of information security, assurance, or cybersecurity. I am however having a hard time finding a bachelor’s degree in one of those fields. I live in Florida and would like to attend an online school for this. I really do not want to take just a general IT degree. So any knowledge or help would be great.

I am in a similar Situation, about to get my first cert, and doing an internship right now.

If you'd like to take online classes related to Cyber Security I can recommend Dakota State University. I am a student there and while the campus/school are relatively small the classes are awesome.

The School is known for it's great program and does a great job at balancing hands on experience with lectures (at least in my opinion).

Here is some info on my Major (It's called Cyber Operations, but that's just a fancy word for Computer Security mixed with Computer Science).

DSU Cyber Operations

One main PRO about DSU is that it's part of the NSA funded program called Cyber Core, which is a crazy good scholarship for students just like yourself. Another PRO is that it's a great place to network. Most Professors and Instructors are ether very experienced in their field and one of my instructors even works for the NSA (Great guy, don't even care if he reads my FB messages). This is my second internship and I have to say I would never have thought that I could get this far solely on the connections I made through Teachers and mentors here.

If you want some more info feel free to contact me, I'd be glad to tell you more about it!


Is wiping memory at code/end good practise? Sometimes passwords/hash/keys & other private information is stored in variables and hence in memory/RAM during code execution.

while some situations (i.e. Linux Kernels see here Is there any Linux distro or kernel patch that wipes a process memory space after the process exits? ) care about wiping used memory I was wondering more about the broader picture:

Question is therefore:
Should the programmer of code care about wiping (i.e. zerosetting) sensitive information by her/himself?
More precise should I do something like this

int main()
{
    char bufferWithSecret [10];
    sprintf (bufferWithSecret, "%d",generateKey());

    // do some stuff
    // ...
    // ...

    sprintf (bufferWithSecret, "000000000"); // wipe the memory
}

If you wipe sensitive information early, you might arguably reduce the time window for an exploit while your program is running, but in general (and in particular in a when-process-exits context) it's a pretty useless endeavor.

It's much more important to lock memory that contains sensitive data, so it cannot be swapped out. Sensitive data being swapped out is something you want to avoid at all cost.
The worst thing about a page with sensitive data being swapped out is, by the way, not even the fact that it's written to disk, but the fact that you cannot guarantee that it will ever be deleted from disk again (due to drives doing wear-levelling). This is totally out of control of the operating system, or even your application.

Memory pages are zeroed before being handed to a new process on every non-joke operating system, so zeroing them manually does not really add anything (not on a realistic threat model, anyway).
Of course someone might use a DMA exploit (such as Firewire) to read physical RAM pages that have not been cleared, but they could already do that while your program is running, insofar not much is gained by erasing them a little earlier.


Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node? This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path.  I'm focused on how to use technology in a way that adds value to a secure cloud solution.  I have no interest in using this technology for nefarious purposes.

Use case

Suppose I have a multi-tenant server where each customer determines the visibility of their domain.  For example: x.myhost.com can choose to be "public" and xyz.myhost.com is private and only accessed by a hidden .onion address.

As I understand it there are two ways for a server to interact with Tor:

Do nothing, use SSL, and trust that the last exit node has not been compromised
"Hook" into the Tor network using a hidden service and a .onion address

Threats

From what I understand, the session is vulnerable to a compromised .EXIT node.  Some hacks I've read about include:

disclosure of data protected by SSL
Loss of anonymity if the user uses many services over the same Tor network, enabling correlation

Question

Now that the world is moving to claims-based authentication, SAML, and OpenID, how should Tor be used with these technologies, considering that .exit nodes could be compromised?  Given that correlation hacks exist, should OpenID/SAML be used at all?  Some questions that affect architecture include

Is public OpenID less secure than those with forms-based authentication?
Does using OpenID/SAML enable session correlation? Are some OpenID providers better than others?
Should the OpenID/SAML server has a .onion address?  Will that help prevent correlation attacks?
Are there benefits of using a public OpenID server (Google/Yahoo) to a private one (Microsoft ADFSv2)

I don't fully understand your question, but there are 2 ways of interacting with TOR users

1) They reach the Internet through TOR. This should utilize SSL/TLS. As a TOR user who connets to the global Internet, I often utilize an SSL/TLS Proxy, such as CGIProxy or PHProxy on Apache with valid PKI (e.g. SSL certificates). I also often specify an exit node with .exit -- often selected by sorting country-of-origin and performance lists in Vidalia. The reason for this is because exit nodes do not encrypt your outgoing traffic by default, so the only safe web destinations are SSL/TLS destinations (unless you use an SSL/TLS Proxy).

2) They are trying to reach a TOR hidden node on the .onion hierarchy. If this is the case, you don't really need SSL/TLS because the traffic is encrypted. However, in order to maintain sessions, you will want to lean on the typical HTTP mechanism: cookies (or similar such as hashses of Panopticlick-like data if it is disparate enough). This would be completely independent of the TOR network, so I don't see any reason why you can't use any of the technologies you mentioned to produce valid cookie-based sessions.


Website login protection with chrome extension Right so I'm developing very private systems recently, and I'm looking into admin login protection. I'm a PHP dev with essential knowledge of js/jq. While I handled most of the stuff so far, I'm looking to protect the login process itself. Now, from what I understand, only internet explorer is allowed to hook into a device (say a CD or a thumb drive) and check for file, only to allow login afterwards, so I'm looking into something that I can actually use. So my idea was a chrome extension, developed internally and unpublished, that would perform something rather complex and thus protect the login page. So I could have a blank login page, or one filled with spammy adds with no login form anywhere, yet by clicking the extension, I'd be able to login.

Also, I'm looking for ideas, not necessarily code, and while I understand it's a generic question, I haven't been able to gather much data on this as the search for "chrome extension protected login" and similar can be quite misleading.

One other thing I found to be cool, but unsure if it's usable, is an NFC tag. In theory, you'd have the website check NFC receiver connected to the PC, if it finds a specific device on top of it, lets you login, otherwise, it doesn't. Just an idea. Considering the environment from which you login is pretty controlled (it's always a PC, always windows, always Chrome, always same country), feel free to hit me with any ideas how would you solve this. Without investing a whole lot of money if possible.

It sounds like you are potentially looking for a physical form of two factor authentication.  You may want to look into the YubiKey.  It's an easy to add two factor auth to a PHP web app (they even have PHP libraries for you).  The keys themselves are very affordable (although I don't know your budget)

If you don't really need a physical device, then definately go with what itscooper suggested.  Certificates are totally free, and require pretty much no user interaction (although that can be a downside if the users system isn't secure).

I would have added this as a comment, but I don't have enough 'points'.  So silly.


Demonstrating reflected XSS with GET Parameter and URL encoding A client is developing a website which is vulnerable to reflected XSS through a GET parameter:

https://example.com/vulnerable-url?")||true)alert("XSS");</script>

I would like to demonstrate this vulnerability by providing a link like the above but the text contains characters (such as the ") which are URL encoded by a browser, resulting in an invalid, unexecuted script.
I've also found that using a form within HTML to perform a GET request also results in URL encoding of the payload string.

I can however use the BurpSuite proxy to make the request without URL encoding, resulting in the script execution.

I would like to demonstrate script using only a browser available in the client environment. Any ideas on how this could be achieved?

A few possibilities:

Internet Explorer doesn't automatically hex-encode characters in the query string. Up to your client whether that browser still has enough market share to matter to them.
Apostrophes (single quotes) don't get encoded in Edge, and maybe some other browsers. If there's a string you can inject into delimited by those, there you go.
Backslashes don't get encoded in any common browser. If you have two injection points and the first one is immediately followed by a string-terminating character, you can escape that character and may be able to get everything up until the second injection point was due to start treated as text, in which case the second injection point will be treated as code.
<> are encoded in all major browsers other than IE, but if you can inject them, you don't need any special dancing about with quotation marks; just terminate the script block (even in the middle of a string!) and inject your own HTML.
Make sure you can't restructure the request as a POST, and insert your payload in the body. No auto-escaping there!
Check if the payload can be put in a parameter body, rather than its name; some browsers might do less escaping there.
Check if there's anywhere in the site that reflects input unsafely after decoding it in some way (URL, HTML, JS literal, etc.). It's actually pretty weird for a web app to reflect parameters without decoding them first.


What does Bluffdale mean for privacy? I posted a question related to tracing webserver attacks over here and the responses got me google-ing. My understanding has always been that privacy is dead
and that essentially there's always someone somewhere who can connect the dots and that the internet by its design is not an anonymous network but the responses especially regarding Tor (which I didn't really know much about) surprised me.

After a bit of digging around I found that (presumably) all Tier 1 traffic is being syphoned and data-mined by someone.

Then I came across a really interesting article in a recent edition of Wired regarding a new NSA datacenter at Bluffdale, Utah.

Question:

If essentially all traffic via the USA (pretty much any internet search or webpage view if you traceroute/backtrace your general online activity), shouldnt this provide the 'antidote' to Tor or at least be capable of re-stitching the 'in' and 'out' points across the Tor network?

Excuse the newbie question I'm more developer rather than security expert..

Tor works by creating a chain of nodes (other Tor users) between Alice and Bob. Each connection in the chain is encrypted separately, such that only the correct node can read its assigned payload. This is enforced using asymmetric cryptography to distribute the keys. When each node receives a message, it strips its assigned layer of encryption off, revealing its instructions and the payload to give to the next node.

               (key3)
               (key2)         (key3)
              *(key1)        *(key2)      *(key3)
Alice   --->   Node1   --->   Node2 --->   Node3   --->   Bob

This system ensures that a node only knows which node it got the message from, and which node to send the message to. Since the origin of the message (in this case Alice) sends a standard payload, Node1 doesn't know whether Alice is the source or just another node in a chain. Node2 knows who Node1 is, but doesn't know if it is the message origin, or a node in the chain. Node3 knows it is the exit node (unless Bob is running as a Tor hidden service, in which case the encryption is maintained right to his front door) and knows that Node2 gave it the message, but has no idea who the message originated from. So, at no point does any node know both the source and target.

Now, how would we attack Tor? The first thing to remember is that each chain has to have some kind of identifier. In this case, the best identifier is a TCP connection. If we know Node3 created a TCP connection to Bob, we can look for connections to Node3 that started at roughly the same time. This gives us the IP address of Node2. The same can be applied to each node in the chain, until we have no correlating connection. In theory, we can use this to trace people through Tor. In practice, it's a little more difficult.

Bluffdale only siphons traffic going through tier 1 nodes in the USA, whereas Tor has nodes operating worldwide. Furthermore, Tor actively attempts to geographically distribute the nodes in a chain. In fact, I'm relatively sure it tries to avoid having the first node in the same country as the last node, but I'm not certain on that one. Anyway, let's assume Node3 is in America, well within the grasp of Bluffdale. You might have access to connection logs to and from Node3, you have no way to tell where the connections went after that because Node2 is in Russia and Node1 is in Spain. Good luck filing subpoenas there!

There are other attacks that correlate traffic when both the origin and target are within your logs, but they're much more probabilistic, which makes life difficult for law enforcement if they need to get a warrant. It does, however, provide them with leads to investigate.

So, whilst Bluffdale does represent a theoretical attack against the Tor network, there are a lot of variables to consider before they can mount a practical attack. On a slightly more reassuring note, this project costs millions of dollars per year to run, so utilisation will be focused on high priority threats. The NSA are hardly going to waste money tracing petty credit card theives and Anonymous members when they've got international terrorism on their plate, so they're certainly not going to bother reading the emails of a random netizen.


Facebook page receiving improbable amount of likes from unknown users A bit of an odd problem, but I'm not totally sure where to post this.

I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began on July 12th and has gradually been increasing since then.

Most of the likes are from users in Japan, China, Egypt, Pakistan, Iran, Philippines, and other countries who I know are not related to my page.

I checked out a few of the users. Some of them are definitely fake (or inactive) profiles, but others seem to be real people.

However, if their respective likes are compared, you can see a trend of MANY pages liked recently, including pages in common. Coincidence? I think not.

Given how widespread this appears to be, I find it odd I cannot find anyone complaining about this. Obviously this is extremely negative for any facebook page owner, quality of fans counts far more than quantity.

My questions are:

What is causing this to happen? Hacked accounts? An app with invasive privileges? Facebook security hole? Facebook user "bot farm(s)"?
What is the most effective way to "fight back"? Individually removing and banning each user seems tedious. Setting a country filter seems restrictive and potentially ineffective.
How can facebook really be notified about this? They tend not to respond when applied to.

EDIT:

Another interesting statistic: Probably all of the likes come from "Facebook Recommendations". Not that this throws any light on the problem...

There are definitely some bots out there, but it's entirely possible that it is real people who are clicking like. There are people who spend an inordinate about of time liking things on facebook, and it can have a viral effect. Some of them are new to FB and have poor English skills so they like everything everybody else likes for no good reason. It's what I call Like Pollution, where your demographic gets muddled by gratuitous likes.

It could also be that you are being targeted in a Like Pollution attack, that someone is deliberately attempting to make it seem as though you are artificially pumping up your like stats, thereby having the opposite effect on your popularity.

Either way as for what to do about it I'm afraid there's no easy answer. FB makes it easy to put stuff on their site but hard to take off. If it were me I'd learn the FB API and write some algorithms to remove likes automatically. It's a pain, but if you feel it is important that's your option.

As for algorithms I'd suggest that you implement some sort of thresholds. If a liker have more than 4 likes a week for more than 2 weeks then remove their like, if a liker has more than 100 likes a year remove their like, that sot of thing. You may end up wiping off legit wipes but you'll at least get rid of some of your like pollution.


Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated? Some months ago, I watched online a video recording of a talk/presentation aimed at an audience interested in information security.

The talk concerned UI/UX/usability, convenience, and security, and made a number of useful recommendations for people developing software in which those concerns need to be taken into account.

One of the points it made was that by default, browsers do not warn if the user attempts to access a webpage over HTTP, but do warn if the user attempts to access a webpage over HTTPS if there's a problem with the certificate. This produces the false perception in the user that the latter is a greater privacy/security risk than the former. I have not encountered that observation elsewhere.

I recently wanted to reference the talk, but was unable to, as I did not bookmark it and now cannot find it despite extensive web-searching.

My question is: if you have also seen this talk, please can tell me which talk this was, or at least suggest an alternative citable resource that discusses the browser warning issue mentioned above.

In case it helps:

I probably found the video on YouTube.
The talk might have been from DEF CON, Black Hat, CCC, or a smaller event: I forget where it was recorded.
I do not recall when the talk was given, but I think it was within the last decade.
The talk included at least one screenshot of a browser warning the user about an invalid HTTPS certificate.
I believe the speaker had a position in academia.
I thought at first it might have been a talk by Dan Kaminsky or Wesley McGrew, but have re-watched several of their (excellent) talks now without any luck, so it was probably by somebody else.

I think you might be referring to the video of Moxie Marlinspike's presentation at DEFCON 17, where he talks about his 'sslstrip' tool:

Video: More Tricks For Defeating SSL, Moxie Marlinspike, DEFCON 17, 2009-07-31  (starting from ~11:45).


How to block BYOD users from installing malicious versions of a common app? How does Mobile Device Management tools (MDMs) identify mobile apps in order to allow to install only whitelisted applications?

First I though some kind of hash but because the APK changes in the Play Store I don't think so.

If it is the name in the application or other attribute in the Android manifest.xml probably it can be faked.

In fact, what I'm really worried about is this news that applications like Wifi Analyzer installed from alternative app stores have been trojanized...if my MDM allows Wifi Analyzer from Play Store would it also allow a trojanized Wifi Analyzer from an alternative app store? [Link to article]

Android uses a code signing system to prove who the author is of any particular app. This means that you can trace any Android APK back to the Google account of the developer (or company) who did the build.

Since this is built in to the core of Android, I would assume that MDMs use it as part of the app whitelist process. ie any version of the same app signed by the original developer is ok, a version signed by anybody else is not ok.

As mentioned by @schroeder, exactly how the whitelisting is done probably differs from MDM to MDM, and is undoubtedly proprietary information. For a more concrete answer, you should contact the customer support of your MDM vendor.


Difference in Web Language Compilation and Execution I'm trying to get a handle on the difference between certain web languages and the security implications of each. Specifically this is with regards to executing code in the context of the web browser on the server side.

I understand with many injection flaws such as cross site scripting and Javascript you can have improperly sanitized output displayed within the HTML element - which is then interpreted as code instead of it's original intended context (i.e. most likely text). I also appreciate that this is largely because the code processing is taking place on the client machine.

With other languages such as PHP you could also have a piece of information included in a web page which also contains valid PHP code such as <php phpinfo(); ?>. The server parses over this code and executes it as valid PHP, triggering the PHP information display.

My question is - at what stage does the code have to be within the page before the browser will treat it as valid code for the language?

I.e. Could you have a XSS vulnerability turn into code execution because someone injects PHP code instead and the server parses it?

Would this be different for something like a stored XSS* vulnerability vs say a reflected XSS vulnerability?

Is there such as thing as DOM execution of PHP code?

Is there any difference between other languages such as aspx / asp with relation to PHP vs something like Javascript?

* When I say XSS I simply mean unsanitized and unescaped code being passed to the server.

There seems to be a bit of confusion here, I will start by clarifying a few things.

When I say XSS I simply mean unsanitized and unescaped code being passed to the server.

This might be what you mean, but it isn't what anyone else means.  XSS is the injection and execution of javascript on the browser.  This injected javascript can come from the server (stored) or the browser itself (reflected).

...you could also have a piece of information included in a web page which also contains valid PHP code such as <php phpinfo(); ?>. The server parses over this code and executes it as valid PHP...

No, that isn't correct.  It takes more than just including PHP in a HTTP request to inject code on the server side.  If what you were saying were true, it would be a security disaster.

To answer your questions:

...at what stage does the code have to be within the page before the browser will treat it as valid code for the language?

I would say that if it is part of an attack it would not be included in the page at all.  If someone is trying to attack a website, they will most likely do it from the HTTP request level using an HTTP proxy.  This is beyond the scope of a page.

Injecting code on the server requires some specific vulnerabilities in the code.  Give this article a read to get an idea of how it would happen in PHP.

Could you have a XSS vulnerability turn into code execution because someone injects PHP code instead and the server parses it?

No - server side code injection and XSS are two totally different things.  An XSS vulnerability doesn't become server side code injection just because you provide PHP.

Would this be different for something like a stored XSS* vulnerability vs say a reflected XSS vulnerability?

I don't really understand what you are asking here, but the answer is probably yes.  Server side code injection and XSS are totally different.

Is there any difference between other languages such as aspx / asp with relation to PHP vs something like Javascript?

Again not really sure what you mean.  There are obviously differences between these languages.

I would focus on learning the difference between XSS and server side code injection - I think a firm grasp of these concepts will clear up a lot of the confusion.

Best of luck!


Wordpress - blocked by firewall for Malicious File Upload Our work website is getting flooded with these types of hacks:

The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running fine, as far as I can tell. How can I troubleshoot this vulnerability?

Old versions of Wordpress are known for some vulnerabilities inside them. Since a possible attacker might not know what installation you are running, but instead sees that you have got specific files available he might run some 'blind' attacks. This type of attack is often automated and run against multiple, possibly vulnerable, targets.

Please refer to http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html for some publicly known vulnerabilities in wordpress.

There is a specific exploit that seems to fit your situation on https://www.exploit-db.com . You might want to check it out here: https://www.exploit-db.com/exploits/3960/

EDIT: Arminius' comment is in fact correct and the here provided exploit might not fit perfectly. I assume that the OP's monitoring software generalizes the attack from "injection" to "file upload".


Securely establish and verify PIN over network Is there a (relatively simple) protocol for setting up a (6-digit) PIN on a remote server, that also prevents those, who may get a DB dump from the server, from brute-forcing that PIN?
Is PBKDF2 and key transfer via TLS 1.2 good enough a solution?
Or is there a more appropriate way?

that also prevents those in control of a server from brute-forcing
that PIN?

Essentially, no.  No matter how securely it is set, or how strong the hash format is, once the server operators have a 6-digit hashed value they can brute-force it reasonably quickly.  The short and predictable length of the PIN make it susceptible to brute-force attacks.  You don't mention if it's numeric or alpha-numeric, but either is trivially forcible at a length of 6.

Is PBKDF2 and key transfer via TLS 1.2 good enough a solution?

Those are good solutions for hashing and transferring the hash.  But the limited key space of the PIN will still leave it vulnerable to brute force, and if you can't trust those who control the server then you don't have a trustworthy solution.


Why JMP ESP instead of directly jumping into the stack Firstly, I'm sorry if this post doesn't fit exactly here, or may be fit better in RE. We could move it if necessary.

So, I was reading this writeup about an exploit in vulnserver (for those who don't know it, vulnserver is a program designed with flaws in mind, this is, to practice exploitation techniques)

At at certain point, it says:

  In this step we have to check the registers and the stack. We have to find a way to jump to our buffer to execute our code. ESP points to the beginning of the C part of our buffer. We have to find a JMP ESP or CALL ESP instruction. Do not forget, that the address must not contain bad characters!

This makes sense, but; Wouldn't be possible and easier to directly jump into the stack since we control EIP? (We are assuming ASLR and DEP are disabled of course). Mainly  because:

How does he know ESP points to his shellcode? Why ESP points exactly there? Shouldn't it point to the end of his shellcode instead?
How is this supposed to work trough reboots or in different computers?

Thanks.

Your exploit payload ends up on the stack because you're overflowing a buffer on the stack, and this is how you gain control of the return address as well.

ESP points directly to the start of your payload (after execution of the ret in the function you're attacking) because you put the payload right after the 4 bytes that overwrite the return address on the stack.  ret pops 4 (or 8) bytes into EIP, leaving ESP pointing to the payload that directly follows.

But you don't know what value ESP will have at that point, because of stack ASLR and because a different depth of call stack leading up to this point could change the address.  So you can't hard-code a correct return address.

But if there are bytes that decode as jmp esp or call esp anywhere at a fixed (non-ASLRed) address in the process's memory, you can hard-code that address as the return address in your exploit.  Execution will go there, then to your payload.

This is in fact often the case: Some DLLs don't have ASLR enabled for their code, and the main executable's code may not be ASLRed either.

Code ASLR for all code defeats a jmp esp attack, unless the attacker can cause the target process to leak addresses.

Note that for 64-bit code, you're unlikely to be able to use jmp rsp for string-based buffer overflows, because code addresses will contain some leading 0 bytes.

Thus, jmp esp gives you a much more reliable exploit than repeatedly guessing a return address (with a very large NOP sled).

Repeated guessing will crash the target process every time you're wrong, but a jmp esp can give you a high chance of success on the first try. This will avoid leaving crash logs.  It could also defeat an intrusion-detection system that looks for crashing server processes and blocks connections from your IP address, or similar.

Note that the 2-byte instruction you're looking for can appear as part of another instruction when the program executes normally, or as static data (especially read-only data is often in executable pages).  So you just need to search for the 2-byte sequence, not for jmp esp in disassembly of the program.  Compilers will never use jmp esp, so you won't find one that way.

More generally, any function that ends with a buffer pointer in any register (e.g. from a memcpy or especially strcpy) can allow a ret2reg attack, by looking for a jmp eax instruction.

This can work in 64-bit mode, where addresses have some high zero bytes; if strcpy's trailing zero writes that high address byte for you, the end of your exploit string could be the non-zero address bytes that overwrite the return address on the stack.

In this case, the executable payload would go before the return address, at the spot in the buffer where the function leaves a register pointing.  (Typically the beginning of the buffer if there are any useful pointers to the buffer in registers at all).


John The Ripper and PBKDF2-HMAC-SHA1 I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I need PBKDF2-HMAC-SHA1. I have looked everywhere and have exhausted all my options. What is the correct format of PBKDF2-HMAC-SHA1 that is recognised by John and will let me crack it? Thanks in advance!

It's definitely supported, and definitely one of these format names (one for CPU, and the other for GPU):
$ john --list=formats | tr ',' '\n' | grep PBKDF2 | grep SHA1
 PBKDF2-HMAC-SHA1
PBKDF2-HMAC-SHA1-opencl

At this point, it sounds more likely that your method of generating PBKDF2-HMAC-SHA1 is the issue here. Have you tried your attack against a "known good" hash? One that's easy to grab and almost certain to work is the example that ships with John itself:
$ john --list=format-details --format=PBKDF2-HMAC-SHA1
PBKDF2-HMAC-SHA1    125 16  128 01020003    22  PBKDF2-SHA1 128/128 AVX 4x  0x107   20  192 iteration count 0   $pbkdf2-hmac-sha1$1000.fd11cde0.27de197171e6d49fc5f55c9ef06c0d8751cd7250

... which should be crackable by dropping it into a file and running john against it:
$ cat test.hash
$pbkdf2-hmac-sha1$1000.fd11cde0.27de197171e6d49fc5f55c9ef06c0d8751cd7250

$ cat wordlist.txt
3956

$ john --format=PBKDF2-HMAC-SHA1 --wordlist=wordlist.txt test.hash
-rwxr-xr-x 1 royce royce 24690360 Jun 16 14:50 /usr/local/src/sec/crack/john-latest/run/john
Using default input encoding: UTF-8
Loaded 1 password hash (PBKDF2-HMAC-SHA1 [PBKDF2-SHA1 128/128 AVX 4x])
Cost 1 (iteration count) is 1000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 1 candidate left, minimum 16 needed for performance.
3956             (?)
1g 0:00:00:00 DONE (2020-07-25 05:40) 4.347g/s 4.347p/s 4.347c/s 4.347C/s 3956
Use the "--show --format=PBKDF2-HMAC-SHA1" options to display all of the cracked passwords reliably
Session completed.

One common error is that, if you're trying to crack the hash on the command line directly and not attacking hashes within a file, depending on your operating system and shell, the '$' has special meaning to the shell (variable substitution) and results in the hash being mangled. Putting the hashes in a file, or putting appropriate quotes around the hash, or escaping the dollar signs (usually with a backslash), will address this issue.
If that's not it, then it's most likely that there's something wrong with how your hashes are being generated.


Why Aren't Credit Card PINs Required For Online Transactions I have never heard of credit card PINs being required for online purchases. Why is this? Wouldn't it drastically reduce online fraud? Physically stolen credit cards couldn't be used in online transactions either if a PIN was required.

Consider the threat model -- today, a rogue website (or one taken over by an attacker) can siphon off your credit card number and make fraudulent purchases.

Ok, so we implement a PIN, required for online purchases.

The same rogue website just asks you for your PIN too, and then uses those to make fraudulent purchases.

The method they use in Europe (IIRC) uses the PIN in conjunction with a chip on the card, which prevents the website from being able to give up that authorization to an attacker. I'm not sure of the actual method, but I'd imagine the PIN unlocks a certificate on the chip, and the certificate is used to sign the transaction.


With Samsung's Knox proven weakness, how should I secure my Samsung device? This post shows that the device pin is stored in the clear, which presents a major weakness in device security.

Can I just delete the file? Or is there a better way to protect my device?

It appears the original post refers to Consumer Knox (as @Flash posted) but the problem still remains: How do I protect myself appropriately when my PIN is stored in the clear?

Ares, who posted the original vulnerability, has added a couple of updates

Samsung mentioned the following in their press release: "Concerning the second issue, KNOX does save the encryption key required to auto-mount the container’s file system in TrustZone. However, unlike what is implied in the blog, the access to this key is strongly controlled. Only trusted system processes can retrieve it, and KNOX Trusted Boot will lock down the container key store in the event of a system compromise."
I think Samsung speaks here about their Knox Agent. At the beginning of my analysis I used geohots towelroot to gain root access on the Samsung device. During the analysis the phone wanted to update some "Samsung Security Policies". After the update the Agent blocked the root access to the phone. So this agent seems to be working like a usual Anti-Virus tool. It can only detect attacks if it knows the attack. And as we all know, Anti-Viruses are useless against unknown attacks :). This is the same for their so called "TrustZone".

Which does suggest Samsung are taking the view that an attacker with root access can do any damage they want anyway - but failing to include an understanding that various attacks will get you to root. Not sure how I feel about this one.
A further update on that same page now says:

Apparently Samsung said in their press release that user should try out My Knox, as Knox Personal is deprecated. I just tried to install it but sadly My Knox only works on Samsung Galaxy S5 and Samsung Galaxy Note4. So Samsung, you're leaving all devices older than the S5 with a vulnerable version of Samsung Knox??

So there is a fix but only on newer hardware that hs TrustZone functionality.


Is creating secondary account on Black-Box Pentest Forbidden? Okay, so here it goes. I am the Red Team Lead, and as described earlier; not far (like about a week), I posted this. At the time, I was looking for a beautiful technical title which could match down my findings. I mentioned it as 'Weak Password Policy'. Since most of the penetration testers failed, I had to take the assignment and made through the entire thing successfully. Now, there is a little situation (in which the client had already mentioned the test had to be a black-box and not white-box in specific {we were not given any credentials}).

Now after patching up the identified vulnerabilities, we got exactly this reply from them (isn't it why you woudl sign a NDA for this at the first place if you had never trusted the company you push your black-box pentest into!?):

What was the intent ? backdoor?
It it ethical? Shouldn't we just let the party know that week password, instead of creating a secondary account(with fake name) and NOT informing US about it.  NOT ACCEPTABLE!
How do we trust that no data was downloaded and mis-used?
How do we make sure there were not more accounts created with some malicious intention?

What happened here was, for testing purposes like more often in a black-box pentest, the tester requires to test additionally all the checks, if a priviledged account could had been achieved. There is this situation (afore-mentioned) which keeps bugging me, what would I say here? I need opinions and a great in-sight to reveal if what I did was wrong or they shuld had known what a 'black-box' assessment was for the first place (to reveal impacts!)

ok so on any security assessment you must have a terms of engagement (which should largely spell out what is and is not in-scope of the review).  Assuming you're doing what would traditionally be thought of as "red-team" style assessments, then on those generally "any action an attacker might take" is valid for the assessment. However there are many different definitions of red team (like there are many for penetration test) and that's why the scope and contract are so important (to make sure the customer and supplier are on the same page).

As the comment from @adnan mentions, at the end of the test you should tell the customer about any created accounts, so that they can remove them from the system (along with any data created).  If you haven't done that, then a level of suspicion from the customer isn't too surprising.

However generally I would be inclined to respond that the account was created as part of the conduct of the test and as to data mis-use, this is governed by the NDA and contract that you have in place (again it's really important these are in place) which dictate what you can and cannot do with data retrieved during the conduct of the test.


Security/Malware implications of storing data in a BLOB as opposed to the file system From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system.  The debate always seems to center around performance.

I've always wondered about the risk of infected files being saved in the database.  Suppose I allow internal users to upload documents that are available on our company's website to our external customers.  I would really hate to have our website serving infected PDF documents to our customers, for example.

Aside from incorporating policies that require our content editors to scan files before uploading them, is there any sort of protection that can be implemented to detect infected documents?  I can't imagine that anti-virus can scan within BLOB fields (but I could be wrong on that).

It just seems more risky to me.  If we have them upload to the file system, as can at least have anti-virus scanning the upload location.

Is this a valid concern?  And if so, what tools or approaches are recommended for dealing with this potential threat?

This has been answered before on this site, in extensive detail.  See these questions:

What are the security risks of letting the users upload content to my site?
Is it necessary to scan users' file uploads by antivirus?
Antivirus for scanning anonymous file uploads
What steps should be taken to validate user uploaded images within an application?
What are security risks of serving user uploaded files without Content-Disposition?
Why should I restrict the content type of files be uploaded to my site?
Is it safe to store and replay user-provided mime types?
Is it safe to serve any user uploaded file under only white-listed MIME content types?

The answer to your question about databases and the format of the file is: it doesn't matter how you store the file.  The risks are the same whether the uploaded file is stored as a BLOB, as a binary field, on the file system, or in some other way.  That's just an implementation detail.

What's important is what kind of validation you do, and how you address the threats.  Any of the standard mitigations can be made to work, no matter how you decide to store the uploaded file -- the important thing is that you understand the risks and select mitigations appropriate that are appropriate for your application.

For general advice relating to web security, OWASP is always a good resource.


Can malicious code trigger without the user executing or opening the file? If a file is downloaded from the Internet, and saved on disk, but is not opened by a user (if we keep autorun off), are there any chances that malicious code (e.g. a virus) in the file could trigger?

I'm not asking about attacks that could be made while downloading, or on browsing to a site - imagine the file has somehow been stored onto the disk with no attack taking place. What risk do I then face from malware?

There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples, but other cases are sure to exist:

The file targets a vulnerability in your antivirus which triggers when the file is scanned
The file targets a vulnerability in your file system such as NTFS where the filename or another property could trigger the bug
The file targets a bug which can be triggered when generating a file preview such as PDF or image thumbnail
A library file (ex. dll) could get executed when saved to the same directory where an application vulnerable to binary planting is executed from
The file is a special file that can change the configuration of a program such as downloading a .wgetrc file with wget on Linux
…and more


Read-Only Hard Drives Has anyone come across a 2.5 SSD or HDD that has a physical read-only switch similar to this? Or an enclosure that can render a hard drive read only?

It sounds like you're looking for a "Hardware Write Blocker" http://www.forensicswiki.org/wiki/Write_Blockers

It's important to know why you need it.  There are cheapish ones out there that probably work fine.  Search for "Hardware Write Blocker Enclosure".  Stuff comes up, eg.., http://www.digitalintelligence.com/cart/ComputerForensicsProducts/3.5-Inch-USB3-Hard-Drive-Enclosure-WRITE-BLOCKER.html  It probably works fine.

For legal and military applications (Cameron can correct me if I'm wrong) evaluation, selection, procurement and custody is controlled for these kinds of devices.  I.e., they work because people qualified and responsible for ensuring they work say they work.  Money isn't much of an issue with that kind of thing.

For normal people, money is an issue.  Following the forensic and military leads on this information is probably the best we can do.


iPhone 5c iOS 7.1 deleted video recovery? Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered?

1) the video was not in the camera roll
2) the video was deleted 3 weeks before seizure of device
3) app used to download/play video was deleted, re-downloaded and deleted again before seizure of device
4) no passcode locking device

Is recovery of the deleted video possible? And if so, how likely?

Recovery is possible if the page-files containing the video have not yet been overwritten. I would advise you to act fast as SSD drives are more prone to permanent data loss compared to classic HDD drives. To make things more difficult, different SSD drives use different approaches for writing/updating data sectors so even if you have extra space, installing a new app or storing extra data could overwrite the page-files which contained the video. Another problem is that SSD drives use voltage to set 1/0 bits and depending on the quality of the drive and the up-keeping mechanism, deleted data sectors could degrade (permanent loss) over-time hence you should act quickly.


Analyse disk requires admin, but why? To analyse for fragmentation in Windows you are required to be an administrator.

What dangers could a disk analysis pose?

Taking a look at the Defrag Documentation of Microsoft Technet:

  Locates and consolidates fragmented files on local volumes to improve system performance.

Now, imagine that you have an operating system with 3 users, only one of them being Administrator. How could and algorithm running unprivileged manage to access files that can't be read? Would not happen. Access to those files would be denied, and the defrag process will be suboptimal, since i cant calculate how spread is a file that is not owned by my unprivileged user inside a volume. And why an unprivileged user should have raw disk access to disk? There is no reason why, and it will allow users to circunvent all protection to disk devices that the OS create and ignore the access rights implemented by the filesystem.

Situation two: Imagine that the analyze tool has some "automatic administrator" configured(like runas /user:.\Administrator /savecred defrag C: /U /V). If this software has the ability to read information about files, and it had Administrator credentials saved, it could be a feasable attack vector to extract information from other users, using your unprivileged user that is running this software. It's just a matter of time to have some bug explored on functions used to open files called by your defrag binary.

That's why you cant give disk manipulation or raw disk access to non-admin users.

Related Stuff:

Is it possible to defrag the hard disk without admin rights? - answer
Technet - Allow non-admin users to run Disk Defragmenter
Symantec - Top 5 Reasons Why Users Need Administrator Rights


Can a web app fingerprint your device as identical to a native app's fingeprint I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint.

I tried the web version on Chrome for Android with a different email address etc and my account got shadowbanned immediately too. Can a mobile web app come up with an identical fingerprint to the native app that they are able to identify the device as being identical?

Potentially, yes.

Usually a mobile OS comes with a browser engine, that is used to both power actual browsers, as well as for running native apps built with web technology. So it is possible that the app you installed and Chrome was running the same browser engine that produces the same fingerprint.

This is a bit speculative though. I don't know for sure if this would work in practice, or if this is what actually happened to you. Might just as well have been your IP that got you blocked.


User Groups (Circles) Inside a Web of Trust Assume I have a universe of U users. Every user has his private key.
I want to build user groups by adding a company sub key to his key set.
Now users can sign his company sub key with there company sub keys.

Now the user resigns from the company. He is lazy and will not revoke his sub key right away, or he plays not fair, and will never revoke it. Ok, others could revoke their signatures after they have been notified that he left the company,
but others may never revoke their signatures.

How can I assure that after he resigns, he will be dismissed from/denied access to the group?

Update:
I found that PGP supports something called "Designated revoker". The definition for it is:

  A designated revoker in OpenPGP is a partner key that we trust and that can be used to
  revoke our public key in the case when we have lost our own private key and cannot do the
  revocation ourselves.

Could that be a solution to my problem?

There are two generic points which must be made:

PKI is for authentication, not for authorization. "Certificates", be they X.509 or OpenPGP "key signing" (same concept, different format), are meant to bind identities to public keys; they convey the information "Bob's public key is X". Certificates don't work well to manage authorization-like information such as "Bob is allowed to sign in the name of Company Y".

Revocation is the subject where this distinction is most easily seen. Revocation is asynchronous; it is not efficient as propagating changes quickly. If Bob is fired, you want to revoke his "signing rights" immediately, preferably five minutes before informing Bob himself that he is no longer welcome. You don't want to remove the rights some hours or days after the deed, because there is a lot of harm that a disgruntled Bob could do.
You cannot enforce forgetfulness. In cryptography, power is knowledge: you can sign or decrypt by virtue of knowing the corresponding private key. When a participant has this power, then he somehow "knows" the private key, if only potentially (e.g. the key is in his computer). If he chooses to remember the key forever, well, he can. You cannot make sure that he did not keep a backup somewhere.

To remove signature power from a user, you must make his key obsolete. This means generating a new signature key, and giving it to all the remaining signers (excluding Bob).

Sharing signature keys is not recommended anyway. When a secret is known to more than two persons, it is no longer secret, only somewhat discreet. If you want to allow a group to perform signatures in the name of the group, a robust solution would take the form of a signed, dated, short-lived, authoritative list of "allowed signers". A document which says "On April 30th 2013, Alice, Charlie and Donald are allowed to sign in the name of Group Y"; the document is then signed by a group manager. Verifiers will check the signature on this document to see whether the signer is really part of the current list of allowed signers.

The "group manager" must be an entity who can decide who is part of the group, and who is not. This is inherently centralized, thus at odds with the decentralized model of the Web of Trust.


Security risks of scanning an unknown QR code What are the security risks of scanning a QR code from an untrusted source?

If the QR code was constructed by an attacker, what can the attacker do to me?  Do widely used QR scanners have any known vulnerabilities?  What information can be stored in a QR code, how is it handled by QR scanners, and how could this be used by an attacker?

I know a QR code can contain a URL, and many readers will launch a browser to that URL, so a QR code could be used as a launching point to mount any attack that can successfully be exploited against my browser. Is there anything else?  Can other data be stored in a QR code and automatically processed by the scanner?

You never must trust in user input, independly if this is a string, a bar code or a qr code.
All of them, can exploit your application. Eg. SQL-Injection.
Take a look in this PDF, its very useful for your question :)
http://qrcodethursday.files.wordpress.com/2011/03/qr_code_security.pdf

Bonus: I don't know if this is a joke or really true, but make sense: http://cicero.files.wordpress.com/2010/04/500x_for_traffic_cameras.jpg


Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload? I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, each project automatically has their own certificates.

Now my questions is, if I add includeSubDomains and preload to the HSTS directive, can I still have a separate certificate for each subdomain?

I read that all the directive above does, is tell the browser that my domain and subdomains will always be served over HTTPS but it's the preload that scares me. I'm afraid it will cache the certificate from the main domain and use it in the subdomains.

Yes, you can use different certificates and change certificates as much as you want, as long as you keep using HTTPS. HSTS, preload included, does not restrict what certificates you can use. It only forces you to use HTTPS.

(HPKP, on the other hand, restricts what certificates you can use. But that is another story.)


Is Tomcat session ID generation FIPS compliant? I am trying to achieve the following security rule

server must generate a unique session identifier using a FIPS 140-2 approved random number generator.

I am using Tomcat 7.0.68 for my server, I am unable to find any information on if the generating of the session IDs for tomcat are FIPS compliant.

Does anyone know if the Session ID generator for Tomcat is FIPS compliant and if not if it is possible to use a FIPS compliant random number generator with Tomcat?

There is a FIPSMode configuration option in Tomcat's APR Lifecycle Listener, which looks like it would fulfill your requirements. As observed in this very similar StackOverflow thread, and Tomcat/APR Lifecycle Listener documentation, it's really about the operating mode of OpenSSL, not Tomcat.

On a not-unrelated note, Tomcat isn't FIPS-certified, due to the cost, time and red-tape involved in FIPS-certification, however, there are some commercial offerings that have tested Tomcat with FIPS-compliant JSSE providers, which may be sufficient for your purposes.  Additionally, Oracle and IBM both provide documentation on enabling FIPS mode/compliance with the JSSEs they provide, so it may not be necessary to use a 3rd-party offering, again, depending on your requirements.

On the specific question on Tomcat's Session ID generator, since it's open-source, we can check, and it appears that Tomcat's SessionID Generator uses Java's SecureRandom library, which "[...] complies with the statistical random number generator tests specified in FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1."

public class SessionIdGenerator {

/**
 * Generate and return a new session identifier.
 */
public String generateSessionId() {
byte random[] = new byte[16];
// Render the result as a String of hexadecimal digits
StringBuilder buffer = new StringBuilder();
int resultLenBytes = 0;

while (resultLenBytes < sessionIdLength) {
getRandomBytes(random);
for (int j = 0; j < random.length && resultLenBytes < sessionIdLength; j++) {
byte b1 = (byte) ((random[j] & 0xf0) >> 4);
byte b2 = (byte) (random[j] & 0x0f);

if (b1 < 10) buffer.append((char) ('0' + b1));
else buffer.append((char) ('A' + (b1 - 10)));

if (b2 < 10) buffer.append((char) ('0' + b2));
else buffer.append((char) ('A' + (b2 - 10)));

resultLenBytes++;
 }
 }

if (jvmRoute != null && jvmRoute.length() > 0) {
 buffer.append('.').append(jvmRoute);
 }

return buffer.toString();
 }

/**
 *
 */
 private void getRandomBytes(byte bytes[]) {
SecureRandom random = randoms.poll();
 if (random == null) {
 random = createSecureRandom();
 }
 random.nextBytes(bytes);
 randoms.add(random);
 }

 /**
 * Create a new random number generator instance we should use for
 * generating session identifiers.
 */
 private SecureRandom createSecureRandom() {

SecureRandom result = null;

long t1 = System.currentTimeMillis();
 if (secureRandomClass != null) {
 try {
 // Construct and seed a new random number generator
 Class<?> clazz = Class.forName(secureRandomClass);
 result = (SecureRandom) clazz.newInstance();
 } catch (Exception e) {
 log.error(sm.getString("sessionIdGenerator.random",
 secureRandomClass), e);
 }
 }

if (result == null) {
 // No secureRandomClass or creation failed. Use SecureRandom.
 try {
 if (secureRandomProvider != null &&
 secureRandomProvider.length() > 0) {
 result = SecureRandom.getInstance(secureRandomAlgorithm,
 secureRandomProvider);
 } else if (secureRandomAlgorithm != null &&
 secureRandomAlgorithm.length() > 0) {
 result = SecureRandom.getInstance(secureRandomAlgorithm);
 }
 } catch (NoSuchAlgorithmException e) {
 log.error(sm.getString("sessionIdGenerator.randomAlgorithm",
 secureRandomAlgorithm), e);
 } catch (NoSuchProviderException e) {
 log.error(sm.getString("sessionIdGenerator.randomProvider",
 secureRandomProvider), e);
 }
 }

if (result == null) {
 // Invalid provider / algorithm
 try {
 result = SecureRandom.getInstance("SHA1PRNG");
 } catch (NoSuchAlgorithmException e) {
 log.error(sm.getString("sessionIdGenerator.randomAlgorithm",
 secureRandomAlgorithm), e);
 }
 }

if (result == null) {
 // Nothing works - use platform default
 result = new SecureRandom();
 }

// Force seeding to take place
 result.nextInt();

long t2 = System.currentTimeMillis();
 if ((t2 - t1) > 100)
 log.info(sm.getString("sessionIdGenerator.createRandom",
 result.getAlgorithm(), Long.valueOf(t2 - t1)));
 return result;
 }

}


Can biometric vectors (i.e. fingerprint vector) be considered as Sensitive Authentication Data (SAD) in PCI? I am designing a system that uses a certain biometric vector as a secondary user identification step before authorizing a payment. My system does not handle payment card details, rather the payment card processor consumes my service to authenticate the user (as an additional step). In order to do this, my system needs to register a biometric vector of the user in its database, for comparison against subsequent authentication requests.
Following is a definition of what entities come under PCI scope.

The PCI DSS applies to all entities involved in payment card
processing, including merchants, processors, acquirers, issuers and
service providers. It also applies to all other entities that store,
process or transmit cardholder data or sensitive authentication data.

Source: https://www.onespan.com/blog/multi-factor-authentication-comply-pci-dss-32
Since my system does not store or process card holder data AND it is located in a separate environment (a remote REST service), the only possibility of it coming under PCI scope would be if it is hosting sensitive authentication data (SAD).
By PCI's definition, SAD is:

Security-related information (including but not limited to card
validation codes/values, full track data (from the magnetic stripe or
equivalent on a chip), PINs, and PIN blocks) used to authenticate
cardholders and/or authorize payment card transactions.
Source: Pg 19 of https://www.pcisecuritystandards.org/documents/PCI_DSS_Glossary_v3-2.pdf

Sources such as this one indicate that SAD is data that is available on the card itself.
However, the PCI definition does not clearly indicate whether SAD is only considered as data available on the card itself or not.
Can anyone provide any direction or guidance on this matter? Would such biometric vectors be considered as SAD in the PCI scope?

I'd say no. SAD is information relied on by the card issuer to authenticate a transaction. So PINs/PIN Blocks, full track data and CVC2 are all placed on the card by the issuer (OK, that is simplistic for PIN) and only used by the issuer to validate the card and the customer during the authorization process.
The table on P7 of v3.2.1 of PCI DSS is the authoritative reference, the glossary is not normative.
However, technically you are a service provider to the processor, and they may require you to comply with PCI DSS as a contractual measure because that what allows them to be comfortable about your security, whether or not it strictly applies from a card brand perspective.


Why would I ever use AES-256-CBC if AES-256-GCM is more secure? I guess the gist of my question is: Are there cases in which CBC is better than GCM?

The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack exchange, and this explanation of an attack on XML (since I'm encrypting json in my work, although it's not streamed anywhere, but apparently a chosen cipertext attack is possible), then I should never, ever use CBC, and just use GCM.

In other words: There's no reason to use CBC, as long as GCM exists (which it does on OpenSSL, the library I use for my encryption work). Because:

GCM = CBC + Authentication.

Could someone please tell me whether my conclusions are correct?

IMPORTANT UPDATE: Since this question is getting popular so fast, I'd like to point out from my research that GCM IS NOT A SILVER BULLET. There's huge problem with GCM, which is that if you use the same IV twice it can compromise your key (due to the use of GMAC, so it's no fool-proof). In case you're paranoid (like myself), CBC with HMAC (encrypt then MAC) is probably the best if one wants to be on the safe side. (Also please correct me if I'm wrong on this update).

CBC and GCM are quite different. Both are secure when used correctly, but CBC isn't as parallelizable and lacks built-in authentication. Due to this, CBC is only really practical for encrypting local files that don't need random access.

As for any advantages it might have, CBC doesn't fail as catastrophically if the IV is reused, and it can be faster if implemented on basic hardware.

As for GCM, it's basically GCM = CTR + Authentication (not CBC). It's fast and secure if used correctly, and very versatile, hence its popularity.


How can I modify Windows registry programmatically? Which programming language I can use to modify Windows registry? Can I use js or powershell?

You can use any programming languages that provide access to Win32 API: C++, C#, Visual Basic, Java, Python and many others.


I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do? So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an anonymous tip. So far I haven't done anything too crazy, just using the os library to browse the directory structure a little. I'm not sure how much damage I could do, though. There is a Python web app and a MySQL database running on the server.

Could I somehow give myself SSH access? I can't exactly figure out how I would go about that. I also don't think I can access the database, as I don't have any of the user information.

So, what is pretty well the practical limit of the worst damage I could do here?

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user.

From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the app has access to the database already).

Also, as @Aroth pointed out in the comments, you can also compromise other apps running under the same user account.

Finally you can take a look at what version the running kernel/libraries are and eventually use an exploit to gain root privileges.


Can IMSI catchers detect encrypted communications? I would like to know if IMSI catchers can detect encrypted communications in general. Anyone got experience with that?

Thanks

Yes they can because they can read any datastream they capture. They cannot necessarily decrypt it.

So the agent with the IMSI catcher knows that there is an encrypted communication, but he cannot get the plain text (in general).


Any issue with allowing CORS on an oauth2 endpoint I am tempted to let my OpenID Connect/Oauth2 OP to accept CORS request on an oauth2 endpoint after checking that client id and its allowed origin match.

This way a RP would be able to get a response directly without using redirect_uri or a postmessage relay or a web storage relay madness.

Any foreseen issues?

If you are restricting the output of CORS headers for trusted client IDs and origin combinations only then this should not open up your site to any CSRF attack vectors.


Cloud-based IM protocols / services saving messages encrypted on server which is decryptable only by user? I am looking for a cloud-based (i.e. not end-to-end) secure IM protocol or service. The first one comes to my mind is telegram. Here is a quote from telegram's privacy policy:

Cloud Chats
Telegram is a cloud service. We store messages, photos, videos and documents from your cloud chats on our servers, so that you can access your data from any of your devices anytime and use our instant server search to quickly access your messages from waaay back. All data is stored heavily encrypted and the encryption keys in each case are stored in several other DCs in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.

My understanding about this statement is that, although the messages are encrypted, if the server admin / company wants to read your messages, he can do it, because both of the keys and the messages are stored on their server, although not on the same server. So, is it not secure enough? Is my understanding correct?
If the above protocol is not secure, is the following (rough) protocol secure enough, assuming that my devices are not hacked, but every people (ISP, server runners...) on the Internet are privacy stealers? This is only simple asymetric encryption with only the bolded parts special.
Registration:

Client program generates a pair of public-private key.
Client program sends the public key (for encryption only) to the server.

Establishing chat session:

A wants to start a session talking with B. A sends the request to the server.
Server send the request and public key of A to B.
Server send the public key of B to A.

Chatting:

A send the message encrypted with A and B's public key RESPECTIVELY to the server. (i.e. send the same message twice, encrypted with different keys)
Server save the encrypted messages, and send the message encrypted with B's public key to B.
Client program of B uses B's private key to decrypt the message

Login from a new device:

A use a safe method (e.g. USB stick, SD card, etc) to copy the keys from the original device.
Client program of A receive the chatting history not on the device from the server which is encrypted with A's public key
Client program of A uses the private key of A to decrypt the messages

I think this so-called protocol is really simple and can even be a school work (for it just works)... But I cannot find an IM service doing that. Am I missing something, or is this protocol not secure at all?

This part worries me:

Server send the public key of B to A.

Chatting:

A send the message encrypted with A and B's public key RESPECTIVELY to
the server. (i.e. send the same message twice, encrypted with
different keys)

This tells me that A at one point received B's public key, and that to send a message the client needs to have both public keys. If A has B's public key this could allow an impersonation attack where A establishes a chat session with C.
I'm fairly confident the service has more layers of security but from this extract that that you posted here that would be one concern for me.


Who is responsible for revoking a certificate? The CA issues certificates to clients/servers. Whenever a request is made by the client/server, the certificate is used to verify the identity.

Now, if a certificate needs to be revoked then who does it and how?
Does the client/server "mark" it as revoked? Or does the CA do it? If the CA does it then how does it know when to revoke what?

Also, is there a field on the certificate that tells that it is revoked? Or is there a blacklist of certificates maintained somewhere that contains all the revoked certificates?

The answer by user2320464 is good, but I'd like to expand more.

Summary: The certificate holder generally does not manage their own revocation information, because the whole point of revocation is to announce that holder of this certificate is not trustworthy. The rightful owner of the cert needs to be able to declare the cert Revoked, but in a way that an attacker who also has the private key can't "undo" the revocation. If the owner of the cert themself are no longer trustworthy, you need a way to revoke the cert even against their will.

The best solution we've found is for a 3rd party to track the revocation info, usually the CA that issued the cert. They maintain blacklists, and can also respond to online requests for "is cert #28277392 revoked?".

Why revocation is ugly

Revocation really is the ugly duckling in the certificate world; we haven't yet found an elegant way to handle it. The reason it's hard is that there are seemingly conflicting requirements:

When a server hands their cert to a client, the client should be able to tell if the cert is revoked.
The server shouldn't be responsible for generating or passing on revocation information for its own cert. That's like asking the dog to go check if the cookies are still there, and not lie about it.
So the CA needs to be dynamically generating revocation info for each cert. (or at least tracking it and publishing the black list hourly or daily).
One of the beauties of certificates is that they contain all the data to validate the signature, which you can do offline and very fast.
But revocation has to be real-time, you can't just put it in the initial cert and forget about it, because you never know at what point it will be revoked.
If the client has to contact the CA directly for every cert validation then it's impossible to validate a cert offline, and you add network lag.

There are two main revocation mechanisms in use today: CRL and OCSP (see below), but neither are really elegant solutions.

Why certificates get revoked

Your comment

  Does the client/server "mark" it as revoked?

leads me to believe that you don't fully understand why a certificate would get revoked. There are typically three broad reasons for revoking a cert:

The rightful owner of the cert is abusing it. Typically this would be a sub-CA who is issuing certificates they shouldn't. Their cert gets revoked to tell the world not to trust them anymore.
The server is decommissioned, or the cert is no longer needed for whatever reason.
Key compromise of the private key corresponding to the certificate. We can no longer trust anything signed by, or encrypted for this cert because we no longer know if we're talking to the rightful owner or the hacker.

In case 2) the owner of the cert could flag their own cert for revocation in the way you're suggesting, but in the other two cases the attacker could just use an older version of the cert from before it was revoked. So revocation really needs to be handled by a 3rd party, out of the control of the cert holder. Usually it's done by the CA that issued the certs.

To revoke a cert, you typically contact the CA, prove you are who you say you are, and request them to revoke the cert. I think it depends from CA to CA what level of proof they need before they will revoke a cert for you - this is to prevent an attacker from requesting a cert be revoked as a denial-of-service. For end-user certs like a server cert, often revocation is automated and signing the network message with the cert's private key is good enough (ie a cert can revoke itself). For revoking high-value certs like a sub-CA, there is a lot of IT work and cleanup to be done, end-user certs to be migrated and re-issued, fines to be paid, etc, so a revocation will be a major incident involving many people from both companies.

How certificates get revoked

  is there a blacklist of certificates maintained somewhere that contains all the revoked certificates?

Yes. The simplest mechanism is called a Certificate Revocation List (CRL) which is exactly what you expect: a list of the serial numbers of all revoked certs. Each CA is responsible for tracking the revocation status of all certs that it has issued and publishing a new CRL hourly or daily. The CRL is signed by the CA key, so it is tamper-proof. It's just a .crl file that you can download, pass around, wtv. This can be used semi-offline, as long as you connect and refresh it once every 24 hours, you can use it offline (but of course, you have no way to know if you're talking to a compromised cert until your next CRL refresh).

The more complex "cloud-friendly" mechanism is called Online Certificate Status Protocol (OCSP). The client opens a connection directly to the CA and asks

Client: "Hey, I've got cert #9388038829188 that you issued, is it still good?"

CA: "Yup, it's still good".

This solves the delay problem with CRLs, but requires the client to be online, and adds network lag to the crypto process.

In 2011 a system called OCSP Stapling was introduced that allows the sever to pre-fetch the OCSP response from the CA, say once every 5 minutes, and bundle it with the cert when handing it to the client. This, among other things, speeds up the client's crypto to validate the certificate because it has a local copy of everything it needs, no new network connections needed. This is considered an elegant solution for TLS (ie https, ftps, ssh, vpn, etc) where you are opening a connection to a server that has internet access, but it does not solve revocation for non-TLS uses of certificates, like logging into Windows with a PKI smartcard, launching code-signed software (like any mobile app), opening a signed PDF document, etc which I would like to still work even if I'm not connected to the internet.

How it gets passed to the end user

  is there a field on the certificate that tells that it is revoked?

Yes, in an X.509 certificate (like SSL) the address where you can find the CRL goes in the CRL Distribution Point field, and the OCSP address goes in the Authority Information Access field. For example, the cert for *.stackexchange.com that is protecting this page contains:

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl3.digicert.com/sha2-ha-server-g5.crl
[2]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl4.digicert.com/sha2-ha-server-g5.crl

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://ocsp.digicert.com
          URL=http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt


Is EncFS secure for encrypting Dropbox? I've encrypted my Dropbox folder with EncFS according to a few tutorials I found on the web, advocating this approach.

But I've found the following critical statement concerning EncFS's security in this security-audit:

  EncFS is probably safe as long as the adversary only gets one copy of
    the ciphertext and nothing more. EncFS is not safe if the adversary
    has the opportunity to see two or more snapshots of the ciphertext at
    different times. EncFS attempts to protect files from malicious
    modification, but there are serious problems with this feature.

So, as long as they only get one copy of the encrypted files it's fine, but if they get more, it might be dangerous.

Well, when using Dropbox, they would get a hell lot of different snapshots of the encrypted files (since they will be synchronized after every change).

Thus EncFS would be not a secure solution in combination with a cloud-service à la Dropbox, right?

This is basically a full re-write of the answer as of Feb 2020, with significantly more detail.

EncFS is reliably safe under the kinds of circumstances and threat models that most casual users would expect to encounter, particularly with document-synchronization services like Dropbox. More specifically, it works great when your expectation is something along the lines of: "an attacker cannot read my files."

But it doesn't do so hot when you start chaining more complex assumptions on top of it. This typically happens when the directory you're protecting is used in ways thought up by someone else, like the profile directory of a browser, the data storage of some automation pipeline, or the home directories for all the users in a company. If your expectation is more vague and all-encompassing, like: "attackers will all be thwarted because the directory is encrypted," then this isn't the tool for you.

To make a well-reasoned choice, it helps to understand what trade-offs you're making. So here's what an attacker can do, and under what conditions they can do it.

Metadata

EncFS stores exactly one encrypted file per unencrypted file, and with the same sort of directory structure, the same modification times, and similar file sizes (and filename sizes). So the attacker will know basically all of the metadata about your files. This is an intentional security trade-off, so if this sounds dangerous then EncFS is not for you. You can infer a lot from just dates, sizes, and directory structure, particularly if you're watching over time (see below). This could be all the information the attacker needs in order to deduce certain kinds of behavior. If that matters to you, then it's an example of relying on EncFS to protect more than just the contents of the files, and means you need a different tool.

Of particular note, EncFS supports sparse files, which means that long (very long) runs of zeros aren't encrypted. Any of these empty chunks are readily identifiable in the encrypted store. This is another intentional security trade-off; it can save you a lot of storage space, but at the expense of revealing a bit more about these special kinds of files than you may be comfortable with.

Metadata History

If the attacker can see the changes over time, then they get even more information. They can see which files change and how often, whether the changes influence the file size, and so on. In some cases they can even tell roughly which part of the file was changed.

Dropbox stores some amount of file history (30 days or more, depending on your subscription and settings), which makes this possible even without a persistent presence, though obviously with a limited window.

History-Based Attacks (Passive)

Additionally, if the attacker can see an absolutely vast amount of changes to a single file (perhaps millions), they may be able to leverage that information to gain even more insight at the math level, not just metadata.

Realistically probably not, though. No known attacks actually exist, and Dropbox-synced files generally don't change enough times for the proposed attack patterns to be relevant. And even if they did, Dropbox doesn't just let you download a set of millions of old revisions to a single file.

Write-Based Attacks

If the attacker can write files that you will attempt decrypt, then now you've got some real problems. At the very least, the attacker can selectively delete or destroy files. They may even be able to guess which files to break by using the metadata as a guide. Additionally, they may be able to break only certain parts of a file.

And remember the bit about the sparse files; an attacker can zero out huge chunks of a file by zeroing out the corresponding ciphertext.

Additionally an attacker with write access to your Dropbox could revert the file to a previous version... though that's also an explicit feature of Dropbox. Which sorta brings up the point that if you consider platform features themselves as a serious vulnerability, then you gotta ask yourself whether Dropbox is really what you're looking for to begin with.

And that's the whole point here. There's a lot of benefit to layering client-side crypto on top of a cloud sync service, sort of like a second layer of defense. But if the guarantees you're trying to produce run explicitly counter to the features of the underlying platform, then you're probably trying to hammer a square peg into a round hole. You might be able to produce a functional solution with carefully chosen tools, but your overall experience is going to be worse because the underlying service is optimized for doing precisely what you don't want.

Interactive Attacks

If the attacker can modify the ciphertext and then see what the plaintext was (or whether it successfully gets decrypted at all), then they presumably could make millions or billions of file changes to zero-in the decryption key. There isn't a known attack to actually derive the key. But if they could do it then it'd be the master key for the whole volume, which is the main reason which that fact is worth bringing up. And one of the protections against this (the MAC settings) may be easy for the attacker to disable.

Also, if the attacker has code running on the victim's machine then they may be able to leverage timing information to gain insight into the key. Again no actual known attacks, just speculation. And in these cases, the attacker is typically well-positioned enough to not actually need the key.

Conclusion

For your typical "personal files" use case and with the typical attack model, EncFS is generally fine. If offers a level of protection that would satisfy the average user's expectations, even considering Dropbox's file revision history. The main caveat there is the Metadata thing, since it's the most reliably exploitable part of the story, and people rarely put much thought into how much an attacker can learn from just metadata.

But for more serious protection, especially if this is playing into some sort of automated or shared setup, then you probably want to encrypt a disk image rather than this sort of pass-through system. And you probably don't want Dropbox either.


Can an attacker listen to a DSL signal by calling telephone? With a normal telephone connection you can't call two people separately and simultaneously. You can have a conference call where the signal is shared by all participants. With my DSL line I can call and use the internet at the same time. This means that a phone call is essentially a conference call with me, the person, and my ISP, just in different frequency bands. If the person did not just listen to the audio frequency band but also the DSL one, it seems that they could listen to my internet traffic.

Is this true?

The DSL signal only exists between your house and the DSLAM on your street.

Voice is separated out and transmitted on a TDM digital channel with only 8kHz bandwidth.

So, no, nobody in a multi-party conference call will get more than that 8kHz voice channel connected to them, and therefore have no idea whether you have DSL or not.


TLS/SSL Certificate - Key usage and encryption So I'm looking at google.com's SSL certificate and do not understand a few things:

I totally get that it ensures the identity of Google's webserver, but don't understand how it proves anything about my identity to the webserver?

Also I'm wondering why there is no "Key Encipherment" or "Key Agreement" purpose for this certificate? How can SSL perform a key exchange / diffie helmann? Is the 2048 bit RSA key (visible under the details tab) used for encryption?

... how it proves anything about my identity to the webserver?

It does not. It only proves the identity of the server to you so that a man in the middle attack (where someone claims to be google.com) is not possible.
If client identification is required (usually not) client certificates could be used.

"The certificate is intended... Proves your identity" does not mean that the certificate is actually used for this purposes. It only means that the certificate can be used for server authentication ("identity of a remote computer") and for client authentication ("your identity"). But in this case it is only used for server authentication.

Actually "your identity" is in fact confusing because it does not mean your identity at all. What this means is that if you would own this certificate (which you don't) then you could use it as a client certificate to prove your identity. Other certificate viewers (Chrome on Linux) show this Extended Key Usage in a less confusing way:

 TLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1)
 TLS WWW Client Authentication (OID.1.3.6.1.5.5.7.3.2)

  Also I'm wondering why there is no "Key Encipherment" or "Key Agreement" purpose for this certificate? Is the 2048 bit RSA key (visible under the details tab) used for encryption?

The certificate I get for google.com with Chrome has no RSA key but is an ECDSA certificate with a 256 bit key. But with some changes to the cipher preferences I can also get the 2048 bit RSA certificate.

According to Which key usages are required by each key exchange method? it needs digitalSignature in the ECDSA certificate and it has this. According to this Q&A it would also need "Key Encipherment" for ciphers like AES128-SHA (which google supports). But the 2048 bit certificate is missing key usage completely so in this case we refer to RFC 5280: 4.2.1.12.  Extended Key Usage:

  This extension indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension.

Thus if no key usage is given but extended key usage we can imply the key usage from this. And in the same section of the RFC it then states that serverAuth implies digitalSignature, keyEncipherment or keyAgreement. Therefore we have the required keyEncipherment even if it was not explicitely given.

Apart from that neither RSA nor ECDSA keys are used for the encryption of the connection itself, only for authentication and with the ciphers inside the key exchange. Encryption of the traffic is done with symmetric encryption using a key created within the key exchange. See How does SSL/TLS work? for more details.


Scanning DVWA with w3af - Unable to detect SQLi when security on low I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get past the login screen of DVWA, but w3af still doesn't seem to be finding any sql injection anywhere (which is guaranteed).

I've seen a few vague tutorials online showing it to be trivial, but even when tweaking my setup in a few ways I still have yet to see it detect SQLi.

Anyone have an suggestions or ideas as to why this may be an issue?

Thanks in advance!

You need to configure w3af not to spider the logout link.


Malware able to "read" one's screen I was searching online about multifactor authentication. One of the reasons that people recommend it is because they fear someone may use a keylogger to "steal" their password, so they use one more step to be safe.

What I am wondering is if there is some kind of malware that is able to "read" someone's screen or take screenshots of it, making some multifactor authentication services vulnerable.

In order to explain what kind of services I mean, a lot of times a multifactor authentication service doesn't use another device to authenticate, but sends either a code to the same device or the user has to use a message that the service has generated for him. So if the malware can capture the screen the attacker can read those.

If there is a malware that is capable of something like that how can someone protect from it?

malware that is able to "read" someone's screen or take screenshots of it, making even the usage of multifactor authentication vulnerable.

There is a wide variety of legal and illegal remote access software which enable the attacker to fully control the system, see the remote desktop etc. Some banking trojans integrate this facility to work around onscreen-keyboards the user might use. There are also mobile applications which capture the SMS used sometimes in 2FA or online banking.

  If there is a malware that is capable of something like that how can someone protect from it?

There is no special way just for this kind of malware. This means the same protections are used as against other kind of malware. And same as with other malware you have to be aware that no antivirus or whatever security product will catch every malware.  Thus for best security use dedicates machines which are only used for this specific task (like online banking) and where you don't do normal surfing, mail reading, ..., i.e. all the ways how malware usually spreads.

There are also hardware products which can be used together with 2FA and which are not affected by malware because they just have this single purpose minimal system which cannot be simply updated to integrate malicious functionality. Using these for 2FA is more expensive but also more secure.


Is there a current best practice for authorizing an SPA to get/post to API I have an API and an SPA.  The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so.

It seems that all of the OAuth best practices, e.g. PKCE, depend on a user actually logging in, which will never happen.

Am I overthinking this?

Both apps are hosted in Azure and I've gone down the path of setting up API Management there but that doesn't seem to be a good fit for this scenario.  The API is a .net core Web API so if there are solutions I can implement on the API side I'm open to those as well.

The general best practices are to use SSO/client auth. But since they don't apply to you, you can consider this approach:

If you trust your users to not share the unique links that you passed sent to them, you can use that unique property of those links to request a session variable from the server and then pass that session variable in all the requests that you make.

This request to fetch the session variable can be made at the page load time or at any point before the first POST call to the server. This will increase the time before your users can make a POST call to the server but will at least ensure that the POST call is made by a legitimate user and through your SPA.

Of course, whatever requests you make to a server can be mocked by replaying the request. There is no way to circumvent that.


sql injection: single quote vs double quote Can someone explain me why this code:

$sql='select * from admin where user_name="$user" and password="$pass" ' ;

$re = mysql_query($sql);

is not vulnerable (payload: "or 1=1-- ) while this code:

$sql="select * from admin where user_name='$user' and password='$pass' " ;

$re = mysql_query($sql);

is vulnerable (payload: 'or 1=1-- ) ?

I only alternate single quotes with double quotes.
System: FreeBSD 10.2-RELEASE
MySql: mysql  Ver 14.14 Distrib 5.6.24, for FreeBSD10.1 (i386) using  EditLine wrapper

Thanks

In PHP variables will not expanded inside single quotes (see http://php.net/manual/en/language.types.string.php) so that when the whole string is included in single quotes it will not be affected by your SQLi example.  That means the following statement would be sent to the SQL server:

select * from admin where user_name="$user" and password="$pass"

This is probably not what you would expect, because you expected that the variables get expanded, i.e. something like this:

select * from admin where user_name="some-user-name" and password="some-password"

To make the variables expand in the string you must use double quotes around the string in PHP, like you did in your other example. But then you are vulnerable to SQLi like you noticed.

For information on how to properly protect against SQLi see http://bobby-tables.com/.


How password_hash / password_verify can work with any arguments (PHP) I already know how to use password_verify and password_hash functions, but I don't really understand how they work.
When I use them I do something like that:
$save_hash = password_hash( $password, PASSWORD_DEFAULT );
$check = password_verify( $password, $hash );
How password_verify can know the algorithm used, the salt and the cost? The PHP official documentation say this:

Note that password_hash() returns the algorithm, cost and salt as part of the returned hash.
Therefore, all information that's needed to verify the hash is
included in it. This allows the verify function to verify the hash
without needing separate storage for the salt or algorithm
information.

But I don't really understand why all that information is included in the hash, so a possibly attacker will know too. So, if attackers know the salt, why is it secure? They only have to put the salt at the beginning and try a brute force attack the same way they would do without a salt. What am I wrong about?

How password_verify can know the algorithm used, the salt and the
cost?

$save_hash looks like this:
$2y$10$nmqlFAguURkkWhjgn7LP7.QxLw2fQ9GYSkiaEbypgXg6L4bESC.Mu

Which is a bunch of fields separated by $:

What
Means this

2y
Type of hash, in this case bcrypt

10
The cost

Salt and password hash
The first 22 characters are salt, the remainder is the hash

So, yes, all the information required to mount a brute-force attack on the password is there.

But I don't really understand why all that information is included in
the hash, so a possibly attacker will know too. So, if attackers know
the salt, why is it secure?

The salt is not designed to be secret; it is designed to be distinct for each user, meaning that an attacker will have to adjust their attack for each user.  Without salts, every user with "p@ssw0rd" as their password would have the same exact hashed password, and the attacker would only need to crack it once.  With salts, the attacker has to do the work separately for each user/salt.
As an example, let's take 100 users.  Without salts, an attacker needs 10 tries to test 10 passwords.  With salts, the attacker needs 1000 tries to test 10 passwords.  The cost of the attack is multiplied by the number of salts.
See also this question about salt.


Share and store RSA - public key in java server and vice versa My requirements are:

Requirement 1: Share public key to java server.

Steps:

Generate public-private keys in iOS app.
Store the generated keys in keychain.
Send generated public key to java server.
Java server shall be able to store shared public key in database.

Requirement 2: Store public key sent by java server.

Steps:

Java server sends public key of other user.
Process data sent by java server and generate public key from it.
Store generated key in keychain, which can be later retrieved for encrypting message to be transferred.

I am able to achieve steps 1-2 in requirement 1 by using below method defined in SecKeyWrapper class (CommonCrypto sample):

- (void)generateKeyPair:(NSUInteger)keySize

Question 1: Now problem is-  how shall I send that key to java server?

We have getPublicKeyBits method in the same class, which returns an NSData object, on some googling I found that it is in DER encoded format.

Question 2: If I send the same NSData object to server, which I guess it will interpret as ByteBuffer object, will it be possible for other devices, in my case it could be android, to interpret that data?

Question 3: What is the best way to share public key in above scenarios?

Java servers and Android apps expect the public key in X.509 format, see http://blog.wingsofhermes.org/?p=42 on how to convert.


How do you evaluate and audit Central Authentication Service (CAS)? This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing list is active, is there any reference document or standardized checklist for security auditors to refer to?

I have not seen a compliance guide for evaluating the security posture of CAS, but I have some urls that might be useful.

Securing Your New CAS Server
https://wiki.jasig.org/display/CASUM/Securing+Your+New+CAS+Server

Auditing and Statistics Via Inspektr
https://wiki.jasig.org/display/CASUM/Auditing+and+Statistics+Via+Inspektr

Enabling auditing will generate logs, but you might want to look at something to ingest logs and provide some analysis (like Splunk).

I hope this gives you a place to start.