Why must Meltdown use probe array? This is code snippet of Meltdown assembly language code:

 1. ; rcx = kernel address, rbx = probe array
 2. xor rax, rax
 3. retry:
 4. mov al, byte [rcx]
 5. shl rax, 0xc
 6. jz retry
 7. mov rbx, qword [rbx + rax]

Meltdown uses an array of pages (256*4096 size) where every element is addressed by a 1-byte value to determine what byte [rcx] is. Its paper says it is iterating through all the array's pages to access the first cahe line of every of them and see how much time was taken to do it. If it's done relatively fast, the cache line number is byte [rcx].

Why should Meltdown use the probe array at all to deduce the value of that byte? As I see, when the 4th line's uOP which is responsible for loading byte [rcx] is executed, some page is accessed, and there is the new cache line loaded with the byte's value, unless it already was before this instruction. Why can't Meltdown access that page? Is it because Flush+Reload attack works only for usermode pages?

Cache timing attacks don't tell you anything about the value stored in the cached page. They only tell you which page was cached. The trick of Meltdown (and Spectre) is loading one of many pages into the cache depending on a value that the program is not allowed to know, and that the CPU "forgets" very quickly.

Meltdown exploits the fact that the CPU will briefly act as though an illegal memory read succeeded, and use this illicitly-read value (multiplied by the page size) as an index into an array to cause a page of memory (one segment of the probe array, which can be legitimately accessed) to be cached. The exploit then recovers from the exception (segfault / access violation) of the illegal read, and checks how long it takes to access each page of the probe array to figure out which page of the probe array was accessed, which in turn reveals what the "unreadable" value was.

Line 4 accesses some kernel memory and attempts to read a byte from it; this access triggers an interrupt. (The page that contains this kernel memory will end up in the cache, but this fact is irrelevant to us; we already know what address in the kernel we are accessing.) At this point, we start a race to execute the next few lines before the interrupt diverts this entire thread to its interrupt service routine.

Line 5 is simply multiplying the retrieved value by 4096, which is typically the size of a page in memory. This operation is performed entirely on a register and an immediate value, and is very fast, so it will probably happen before the interrupt catches us.

I don't know why line 6 (or line 3) is needed; perhaps the scenario this code is pulled from cares a lot about whether the retrieved value is zero or not.

Line 7 uses the illicitly-obtained value from line 4 (multiplied by 4096 in line 5) as an index into the probe array, causing one of the 256 pages the array spans to be loaded into cache. This instruction will take a while, and therefore probably not complete before the interrupt catches us, but it will start quickly (just add two registers and hand the resulting address off to the memory manager). When the memory manager returns the value at that address, the CPU will throw it away instead of storing it into the register RBX (because the interrupt causes everything done after it was triggered to get thrown away), but that one page of the probe array will stay in the cache anyhow; the CPU isn't "smart" enough to un-cache pages which were only cached based on the illicit read.

Similarly, when the interrupt catches up, it will revert the illicitly-read value from EAX/AL to its pre-line-4 value (which is zero, as set by line 2). In the theoretical model of the CPU, that register never even received the value; the next few lines simply execute as though it had. In practice, the CPU pipeline has many copies of each register, and the copies downstream of the illegal read store the illicit value (which is then used by the downstream instructions), but that illicit value never gets written to the "real" register. Therefore, the attacker cannot do anything much with the illicit value - it only gets a few clock ticks before the interrupt throws out all the downstream instructions, which isn't nearly enough to do something like "write this value to disk" - but initiating a memory read is fast enough and it doesn't have to complete in time.

At this point, the program receives the "OS trap" triggered by the interrupt, and handles it using a handler that it had already set up (signal handler for SEGV on *nix, or SEH exception handler for access violation on Windows, see https://stackoverflow.com/questions/457577/catching-access-violation-exceptions). The program ignores the trap and continues execution (normally this is dangerous, as it implies something unsafe has happened with your pointers, be in this case we are the unsafe thing). The program then times how long it takes to access each page of the probe array, finds the one that can be accessed super-fast (because it was already cached), and divides that index by the page size (4096 again) to get back the byte which was illicitly read.


Can BeEF hooking be stopped with Content Security Policies I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop attackers/pentesters from hooking browsers using the BeEF framework.

Yes. The Beef hook is just an advanced payload for an XSS attack that relies upon the script-src tag. If you have a healthy Content-Security-Policy, victims browser will refuse to load the external beef hook.

CSP is a secondary line of defense in case you have a HTML-injection vulnerability.


Are there security advantages gained from forcing a website to be available from just one tab at a time? I just found that a website of one Polish bank forces the users to open it in one browser tab only. You cannot for example check your transfer history while  looking for an account number that you want to send money to. I cannot think of any good reasons for doing this except possible security reasons. Are there security advantages to limiting a site to only one site? If so, what are they?

Generally, no, it's not reasonable to force users to a single tab. There are no technical security reasons for making a website available to a single tab only. This is generally common just due to poor system design.

Forcing a single tab also means that when you log out, you won't leave your sensitive information plastered in twenty other tabs. This is poor reason though, as a site that is bothered about this can use localStorage or websocket to simultaneously clear all tabs when logging out from one tab.

The human factor of security is a marginal reason why some sites might deliberately restrict itself to a single tab. By forcing a single tab, you force people to focus on one thing at a time, and this makes you less likely to forget something. IMO, this is a poor reason, as the drawbacks outweighs the advantages.


Secure compiled .NET source code applications ASP.NET and Windows Forms Right now I'm working as a software development leader in my enterprise.

Here's the main issue of everything. A software developer that works with us. There has been some rumours about this user sharing/developing software for other enterprise that does the same manufacturing products. There's not proof that he's really doing this. But he never likes to share code and takes the company laptop to his house.

I cannot put too much authority on him because I'm new in this company and right now we are working in really dangerous and sensitive employee data and other secret projects.

No. we are not making him working in this because we think he's probably going to share this information with other companies.

We knew about this issue because a few employees haben seeing him in other companies sharing information with past managers that used to work with us.

We mainly develop in .NET applications (ASP.NET webForms and windows forms applications)

We really would like to protect our code (He has access to IIS Server).

But the thing is that .NET EXE's and .DLL can be reversed engineered with .NET decompilers really easily.

Do you know what we can do to protect our code even if he has the .NET EXE file?

Thanks.

It sounds like you're looking for an obfuscation tool, such as discussed over at StackOverflow in ".NET obfuscation tools/strategy".  The idea behind such tools is that they make it harder to decompile/understand the program.

Other tricks include compiling the .NET executable to native code and using aggressive optimization as these can help strip the original intent from the code, making it less comprehensible and harder to repurpose the code from the executable.

As Xander pointed out in the comments, you may need to take further action than just obfuscating and lossfully compiling the code as these technical approaches are unlikely to be perfect solutions.


Should I wipe a brand new Machine and HDD ? So I am buying a brand new machine and a HDD separate, when I buy this new HDD should I wipe it before I install it ?

What necessary steps should I take to make sure it's pretty much clean of any thirdparty stuff if any ?

Is there anything I should do to the actual machine ? BIOS etc ?

Thanks
O

When you're installing an OS you'll almost always be creating partitions and formatting them anyway, so any previous data left on the drive shouldn't be an issue, unless this "data" is actually malicious and designed to exploit a vulnerability in the filesystem creation tool, but I haven't heard of such flaws yet.

The only exception would be Windows which does weird things with the MBR; I believe it doesn't rewrite it if a Windows MBR already exists on the disk and doesn't offer any way to wipe it from the installer, so if the disk had a previous Windows installation on it you will most likely be using its potentially malicious MBR.

Just to be safe (and because I like having the disks completely clean before installing an OS) I like to boot on a Linux CD and run either shred -n 1 -v /dev/sdX or issue the secure erase command with hdparm.


Host Keys in Public/Private Key Auth I've chased my tail into a late night circle thinking about public key authentication to cloud instances. As such, I have some questions on the function of host keys when authenticating an SSH session.
If I'm on machine B, and use ssh-keygen to produce B.key and B.key.pub on machine B, I can then use ssh-copy-id to send the information from B.key.pub on machine B to the ~/.ssh/authorized_keys file on machine A. So far so good.
How does machine A use the B.key.pub information in conjunction with the B.key information that is presumably presented when ssh'ing from B to A to authenticate that I'm a client allowed to connect?
Presumably it is not just a case of a straight look up by A to say 'oh, i see you presenting the B.pub.key information and I see that in my authorised_keys, therefore I'll just authenticate you right on in....'
There is obviously some component of magicing B.key.pub with B.key (either on machine A or machine B) so that A knows you really possess B.key and don't just have knowledge of B.key.pub.....But, where does A-host.key and A-host.key.pub come into any of this?
I mean at no stage in this process that I'm aware of has B been provided or loaded with knowledge of either of those two keys before you initiate the ssh connection from B to A....so what are those A keys for?
My gut feeling says that the A-host.key and A-host.key.pub come into it in reverse for mutual auth (i.e. client authenticating server as well as server authenticating client when the client initiates a connection, not just server authenticating client), but, where/when has machine B securely received any verifiable evidence to use as a basis for auth'ing A during this process?
It's not like I've done an ssh-copy-id from A to B, I've never even connected to A, so....?
I guess the 'fingerprint' that you get when you first connect from A to B is something to do with this?
How do you know what A's fingerprint 'should be'? (I mean, if you physically set up both machines on a secure LAN you can probably just assume it is what it says it is....but, in public cloud land, where/when/how does this necessary transfer of information take place so that you can validate A's presented 'fingerprint'?)
I can only see this being solved with an 'out of band' channel so that B can know A's fingerprint in advance....but then you have a chicken and egg problem of the same nature in terms of how to 'secure' that 'out of band' channel....
I'm sure this is somehow obvious, but I've definitely managed to confuse myself...

How does machine A use the B.key.pub information in conjunction with the B.key information that is presumably presented when ssh'ing from B to A to authenticate that I'm a client allowed to connect?

SSH uses digital signatures. B uses the privatekey (for OpenSSH in B.key) to sign some data including the 'exchange hash' which covers all critical key-exchange parameters including nonces (which function as a challenge) and sends this signature along with the publickey in the AUTHREQ message (type 50). The privatekey is not 'presented' and indeed must never be sent or exposed to anyone else. A, the recipient, does two or three things depending how you count:

checks that the signature verifies for the 'exchange' data using the publickey; the details vary depending on the signature algorithm used, which OpenSSH calls the 'type' (i.e. type RSA uses the RSA algorithm or more exactly RSASSA-PKCS1v1_5; DSS uses the DSA algorithm; ECDSA uses the ECDSA algorithm; Ed25519 uses the Ed25519 algorithm which is an instantiation of the EdDSA algorithm). Since for a nonbroken signature scheme a valid signature can only be created using the privatekey, which should only be possessed by its owner, verifying the signature is considered proof the signature came from the key owner and noone else.

checks that the publickey is configured for the requested username (and the username itself is valid); for OpenSSH this is typically in the file ~/.ssh/authorized_keys but can be changed

OpenSSH, but not necessarily other implementations, also provides for some in-between cases. While a client publickey is not accepted at all if not present in authorized_keys or equivalent, and accepted if simply present, it can also be present in the file file with some option(s) specified for it and then it is accepted but only with conditions or limitations imposed by those option(s). See the man pages for details.

My gut feeling says that the A-host.key and A-host.key.pub come into it in reverse for mutual auth (i.e. client authenticating server as well as server authenticating client when the client initiates a connection, not just server authenticating client), but, where/when has machine B securely received any verifiable evidence to use as a basis for auth'ing A during this process?

Your first part is correct, except the 'mutual' usually focusses on the client side. For SSH, and also for SSL/TLS (which you didn't ask about), the server is essentially always authenticated using publickey cryptography. (Technically both protocols do have other options, but they are almost never used. SSL/TLS embeds the publickey in a certificate, while SSH normally does not, but that doesn't change the crypto significantly.) For both protocols it is technically optional whether and how to authenticate the client -- you can use publickey crypto, you can use something else, or you can not authenticate at all -- thus when we say 'mutual' auth it is usually to clarify or emphasize that the client is authenticated, since that's the only part that varies. In practice SSL/TLS is mostly used in situations, like the public web, where we do NO client auth at the communications level (many websites, e.g. Stack, allow anybody to at least connect but have logins at the application level for at least some content or functionality), while SSH is mostly used in situations where we do want client auth, and doing it at comms level is convenient, so we usually choose between SSH password and SSH publickey authentication of the client.
Yes, you (B) may not have known A's host key in advance. SSH was first developed as a replacement for the BSD 'r' programs (rsh, rcmd, rexec, etc) which were used mostly in what was then called a 'campus' environment and today we call an 'intranet' -- a portion of the network controlled by a single organization. In those environments you indeed could distribute the expected host key(s) out of band, especially for a fairly small and largely static set of servers. For example when you reported to work for a new job your supervisor or admin assistant might give you a PC, a bunch of CDs to install, and a pamphlet containing the names (or IP addresses) and host keys or fingerprints (see below) of the systems your job involved using. However, this often required some effort, so users who were busy, untrained/uncomfortable, or just lazy typically didn't use this check and just accepted any host key, which is (as you imply) insecure. This fairly soon evolved into a compromise called trust on first use where when you first connect you accept whatever key the host sends, but the client then remembers that key (for OpenSSH in ~/.ssh/known_hosts) and on subsequent connections accepts only that key. This helps some because an attacker can only succeed if they are present for, and identify, your first connection, though it is certainly not ideal.
If you want to do better, you might be able to, depending on details. See e.g. https://stackoverflow.com/questions/13791219/ssh-fingerprint-verification-for-amazon-aws-ec2-server-with-ecdsa and https://serverfault.com/questions/581367/amazon-ec2-instance-ssh-rsa-fingerprint -- but contrast (my) https://serverfault.com/questions/996828/how-can-i-confirm-ssh-fingerprint-when-connecting-to-a-new-amazon-ec2-instance-u . Note the fingerprint displayed to you by the ssh program -- and recorded in syslog etc -- is a hash of the actual publickey blob, which is sent in the protocol and stored in known_hosts; if you need to convert you can generally just use ssh-keygen -l but if necessary this can be done by hand and I've seen quite a few Qs or As on doing so, but I don't remember which Stacks; if you need that and can't find them I'll try to add.


Is it safe to use a JWT as an Authorization Code? I'm implementing an OAuth 2.0 Authorization Code grant type flow and considering to use a very short-lived JWT as the authorization code so this step doesn't require a database.
I understand that this code is usually persisted and removed after it's used, but are there any significant security risks of using a JWT instead?

Are you trying to avoid the use of regular authorization codes to avoid implementing the logic behind persisting them and expiring them once they have been used? Or do you have an impediment to roll out a database for that?
I think that if you do it with a JWT, you would still need to embed an id in the payload to identify the token and see if it matches the one you are expecting for a particular client, and for that you would need to keep record of which tokens were given out to which clients. Were you thinking of doing it differently?
I don't know the specifics of your use case, but generally speaking I would advise against doing something that is not commonly done in crypto. And if you can avoid doing the implementation of the server yourself, that would be better as well.
Let me know what you think about this.
Cheers!


What makes an Android application vulnerable to Cross-site scripting (XSS)? Definition of XSS

If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject a client-side script into a web site that is viewed by other people who become the victims of the attack.

An example of an XSS bug within Android O.S

  Vulnerability Details

  By sending a crafted intent to Chrome for Android, malicious Android
  apps can inject JavaScript: URIs into arbitrary Web pages loaded in
  Chrome. Injected JavaScript works in the context of the target Web
  page's domain, not a blank domain. So it can be used for Cookie theft
  or so. Such kind of vulnerabilities is often called Cross-Application
  Scripting.

  Version

  Chrome Version: Chrome for Android v18.0.1025123 Operating System:
  confirmed on Android 4.0.4 (Samsung Galaxy Nexus)

  Reproduction Case

  A sample code of a malicious Android app is attached.

  Note

  This issue was initially reported to security@google.com on Jul. 7
  2012, but recently I heard from Google security team that the issue
  might not be filed in Chromium bug database. So now I re-submit the
  issue here which should be a legitimate place for reporting Chrome
  bugs.

My Question

Although I understand what Cross-Site-Scripting is and how Cross-Site-Scripting can take place. I don't know what factors makes a selection of Android code vulnerable to such an attack.

The specific example is not Cross Site Scripting, it is Cross App Scripting. With a specially crafted intent, an Android app could force another app (Chrome in this example) to execute some script in its (Chrome's) context.

This could abuse some privacy and authentication mechanisms. If I am not missing something, this vulnerability (fixed in Chrome quite a while ago) allowed a malicious app to hijack an opened web session with the user's bank and approve money transfer.

This is a bit of exaggeration, normal banking Web sites are protected from such attacks: they require user confirmation (i.e. re-enter password) to complete any sensitive operation.

The problem with Chrome was that it allowed a 3rd party app to impersonate itself via intent extra, and did not perform enough validation. This was not a security hole in the Android OS, and not an exploit that could be statistically used against random apps on your device, to find one that was not protected.


Example Seed and Key Algorithm I am attempting to design a seed and key algorithm for an Engine Control Unit.  This is used to secure resources such as the ability to reprogram the ECU.  The idea is that I request a seed from the ECU, which it gives as a string of bytes.  Both the ECU and I perform some secret calculation to transform the seed value into a key value.  I then submit my calculated key to the ECU, and if it matches the ECU's calculation the resource is unlocked.

I have been looking around for an example calculation to derive my own from, but so far I have just come up with resources merely describing the concept as above.  Does anyone have any concrete examples I could use?

This is done a number of different ways, and no way is perfect.  Usually it involves a pre-shared key one way or another.

Here's an example from General Motors that uses a remote database (assumed secure) to match two values, an ECU ID and a challenge, to a corresponding key value or algorithm (a non-reversible algorithm like a modulus operator).

The diagnostic PC sends a level 3 security access request
The ECU responds with an ID and a pseudorandom challenge
The diagnostic PC references the ID against a (remote?) database of ECUs and their security keys.
The diagnostic PC (or server, as in the GM implementation) calculates and sends a response (e.g. key mod challenge)
The ECU compares this to its own key mod challenge calculation and enters the desired run level if there is a match.

This approach will ensure that the challenge is different every time, which makes this process less vulnerable to eavesdropping.  However, larger security issues remain that aren't addressed (such as session hijacking).


commercial CA for your client certificates? I seem to have mis-understanding around client auth certs...

If you have software that will use Client Auth certificates over SSL (such as those installed on a remote desktop via Windows Certificate manager), and this has proven to work with self-signed certs....

Where / how do you purchase a 'client auth cert' that would be from a trusted CA vs private?

Why do you need the client cert to be signed by a commercial CA?

This is needed for the server side since commercial CA act as a trusted third party for most client application since they have no way to check your public certificate authenticity otherwise.

Most often when using client-side authentication the authority is the organisation owning the server you want to authenticate to, and this is this organisation which will provide or sign you the required client certificates. In other words, if you want to connect to a server owned by company 'A', you need a certificate signed by company 'A' to proceed.

However, for some very specific use cases (some financial transfer protocols for instance) customers can come on board using certificates signed by a trusted third party, but in this case the company you want to connect to will provide you the list of trusted third parties you can choose from (Swift is the most common in this area, but there are a few others).


What does this say? It's in MD5 Some one sent this to me and I have tried to figure it ouut on my own. But have not been successful. Can you help figure out this, he said it was in MD5... 1ce67f05968d51656eb71f13368f0b2d

MD5 is not encryption, it is hashing. Not the same thing at all.

Otherwise, congratulations ! Whoever sends that to you is proposing marriage:

$ printf "You will be my wife one day" | md5sum
1ce67f05968d51656eb71f13368f0b2d  -

(Take care before answering "yes": he looks like a big nerd.)

Edit: the interesting part is of course how I found the source. I just looked it up on Google. The Web + Google makes for a rather good table of precomputed hash values.


What are the benefits of a full format versus a quick format when encrypting an external hard drive? According to a post on the Veracrypt forum, it is recommended that new hard drives are fully formatted. It does not appear to make a distinction between internal and/or external hard drives or USB drives.

Assuming this is the recommended approach, what are the benefits and/or risks of a full format versus a quick format?

For example, does a fully formatted hard drive reduce information leakage? If yes, how?

The scenario is that no sensitive data has been stored on the drive before.

Are there scenarios in which a quick format is acceptable? If yes, what would these be?

For example, is it acceptable to quick format a hard drive that has been previously encrypted? If yes, why? If no, why?

According to the documentation

  Quick format is much faster but may be less secure because until the whole volume has been filled with files, it may be possible to tell how much data it contains (if the space was not filled with random data beforehand)

Apparently the authors of the document wanted you to know that knowledge of the size of the data would be detectable, even without decrypting the contents. That is a small side channel leak, I suppose. This could allow a criminal team to go through all of your hard drives and figure out which ones have the most data on them, for example.


Hashing passwords and dealing with duplicates Currently my project still uses MD5 hashing to encrypt passwords. Yeah, I know.

I'm planning to update the password system to use the newer password_hash and password_verify functions in PHP, which will improve the security of the users' passwords.

However, my moderator team has voiced a concern: since one of our core rules prohibits users from having more than one account, they need ways to tell if two accounts belong to the same person. One such way that they have used is to check if the MD5 hashes are the same on the two suspect accounts - if so, then the accounts have the same password and suspicion intensifies. But with the proposed new system, this will no longer be possible because different hashes will be produced on the two accounts.

In the interest of finding a compromise, is there any way to use the better security of password_hash, while still providing a way for the moderator team to detect when two accounts share the same password?

My thoughts at the moment involve hashing the password in some other way that will produce the same hash for the same password, but I'm worried that this will re-introduce the same vulnerability that we're trying to escape by moving away from MD5. Are there any options here or will I have to use Executive Decision Power to overrule the concern?

One of the reasons that password_hash produces different results for the same password is to prevent information leaks and make passwords harder to crack if the hashes are obtained by an attacker. You really don't want to compromise this security feature - not only will it be less protection for customer data but you will also be rolling your own solution rather than using well supported and accepted solutions.

Using identical password to detect multiple accounts by the same account holder is a bad idea anyway - it is bound to cause false positives and result in you blocking legitimate accounts.


Can I securely keep the user logged into my local application AND use the password as a decryption key? I'm somewhat new to data encryption/safety, but I already read about basic concepts like hashing passwords, encrypting files, etc. If possible, please ELI5 - thanks in advance.

Background: my application interacts with a third party (Twitch) using an OAuth key for IRC as well as a Client ID. Both of these can be used to effectively access the application's Twitch account and do anything with it. The keys are sent as plaintext whenever the application establishes a connection with the Twitch servers (which I can't do anything about and it's not really that huge of a problem). My main security concern is about someone getting access to the user's computer and stealing the keys from there.

I'd like to securely store these on the disk so that the user doesn't have to log into Twitch every time they open the application (to retrieve the keys). To do this, my best solution so far was to encrypt the file containing them. The obvious way to do this would be to require a password when the application starts, then use a stored hash+salt to check that password, and use the password (or its hash with a different salt) as a key to decrypt the file.

As said before, I'm new to data protection, so there might be a much better way to do this. Please do suggest one if there is one. However, as for this...

If possible, I'd also like to not have the user enter their password every time they open the application - simply for user convenience. Prompting the password once per user session (or once every time the computer is restarted) seems reasonable.

I thought about doing this by storing something in RAM, or perhaps by storing some kind of hash as a temporary file. However, I haven't been able to come to an actual conclusion yet. Maybe I'm asking for too much. Nevertheless, is there an actual, decent way to implement this? If not, is prompting for a password on every application startup a better idea than going about storing those Twitch keys securely in some other way?

If it matters - for my specific case, I'm using Python 3.7, and I aim to make my application cross-platform (as long as the system supports Python).

If you want it to be cross-platform, consider using a Python module which provides access to various platforms' existing built-in "keyring" systems. A popular one is called python-keyring.

In all platforms which have a keyring, it is stored encrypted with the user's login password and unlocked in RAM while the user is logged in.

(This isn't super-secure, as technically other programs can also request the same password from the OS... but practically all other "store something in RAM" options would have the same problem, so it's not a downgrade.)


How should high net worth individuals secure their financial accounts? I try to follow account security best-practices (strong random passwords, password manager, multi-factor authentication, etc.) but I still find myself worried about potential compromises to my accounts, in particular financial accounts (e.g., banks, investments) or accounts that could lead to financial account access (e.g., email, phone). It got me thinking. For people who's net worth is on the order of $10M or $100M or $1B, what additional precautions should they take? Special arrangements with financial institutions? Payments to security specialist firms to monitor/manage all accounts?

This question is related, but the asker didn't understand basic security precautions so the answers tended to be rather basic. One of the comments points out that some rich people completely disregard their security:

  Worked for a guy once, owned a decent sized company (and a bunch of smaller ones), with a personal worth of mid-nine figures, and his password for everything was 'bob'. Three guesses what his first name was.

Which is why I'm asking what should high net worth individuals do to secure their financial account access? I'm assuming there must be something given they're a much larger target than Ye Olde Pleb.

Googling around, it seems that some financial institutions offer RSA SecurID. The obvious risk to that is still a phone call to their support team saying you lost it, but it's something.

Bonus question: How much do those extra security measures cost? I.e., at what point in my Inevitable-Rise-to-be-Richer-than-God do I seek out such precautions?

The best security measure is quite simple.  Don't use accounts that allow your money to be easily stolen via the Internet.  Happily, high-net worth individuals have used systems like this since before the Internet was a thing, and are in fact particularly likely to choose them regardless.  While banks certainly aren't perfect at protecting money from theft, historically, they do a massively better job of it than the individuals who have money to protect, high net-worth or otherwise.

First of all, when you're a billionaire, your money is not in a checking account.  Most of it, in fact, isn't liquid at all.  It's ownership of corporations, real estate, things that are difficult if not impossible to steal in any but the most convoluted ways.

For the assets that are somewhat liquid, the vast majority of them are still going to be investments.  And there's not going to be in an E-Trade account with a web login.  They're going to be held by an investment bank that caters specifically to high net worth individuals, managed by private bankers whose job is it to know what's in your portfolio and how its performing at all times.  It simply isn't accessible to outside threat actors.


Which SAQ form do I use for PCI DSS compliance? I run a small business with a Prestashop e-commerce website that sends customers to Sagepay to make a payment using the Presto Chango Sagepay payment module.

In my office I also have a one PC connected to the DMZ interface of our pfsense edge/outer firewall. Nothing else is connected to the DMZ network and all ports out are controlled with nothing being allowed in. This single PC runs Linux and is used to access the Sagepay virtual terminal via a web browser; to manually enter card payment details that are take over the telephone. Very occasionally, we also use the virtual terminal to enter card details given to us in person by a card holder.

In total we probably do not more that £150,000 of card payment transactions per year.

So far I have been using SAQ-C-VT, but I have never been sure that this is the correct form to use.

It is difficult for a small business to get good non-conflicting information on PCI DSS. Therefore, does anyone have a view on the correct SAQ form that we should be using?

Only a QAS can given you a qualified answer to your question, and it's probably worth a few hours consulting time to make sure you have the right scope, but I can give my view anyway.

So yes if you are inputting credit card data one at time then you need SAQ C VT as you say.

You also would need an SAQ to cover your e-commerce system, a quick search shows you have to host presta shop yourself but Sagepay is PCI compliant. If it's a full page redirect to Sagepay or an iFrame, then SAQ A should apply to you.

I think you can either do them separately or combine them in SAQ D and exclude the non-applicable requirements.

Good luck!


How do you test buffer overflows in the lab? I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer overflow attack but no way of testing. By default installing these on my own server will have buffer overflow protections enabled.

I've created my own software to test against. That's easy, but I want to test against something real.

Any ideas?

There's VMs available which include security challenges, as well as old CTF write-ups covering exactly how specific buffer overflows were triggered.
Here's one I found with a quick Google.
A VM called covfefe, and a Walkthrough which includes a buffer overflow.
This is just an example that there's tons of VMs and challenges out there for you to try. Jumping to exploiting real world programs is going to include a lot of protections that may make it difficult to compromise before you're sufficently experienced.


Can any Google Play Store tampering be detected? I've read this Android developers page regarding code signing that states:

  You can use self-signed certificates to sign your applications. No
  certificate authority is needed.

I have also read the answers to "How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?"

My question is: If Google is forced to tamper with a particular Android app on the Play Store (e.g. TextSecure) to compromise it, is any defense possible against tampering targeted at particular individuals?

Example scenario: Persons of interest are using TextSecure on their Android phones to communicate. A government forces Google to push modified versions of TextSecure to those phones to compromise communications.

I can think of one roundabout solution: Using a fork of the Android OS that isn't updated by Google, install a non-Play Store app that constantly checks the validity of the existing TextSecure installation (perhaps using something as simple as hash values).

Are there any other possibilities? (e.g. If an app is signed with a CA-validated cert, would it be checked at run time?)

You would need to manually check that the signature is from the application developer.  Google shouldn't have the private key that the official release is signed with.  Google however could easily make their own signature as they are the signing authority for the Play store, however the new signature wouldn't match up with the certificate for the official application unless Google somehow has the private key the application author used for signing the official version.


How to force browser to trust a self-signed cert In our Intranet. we have a site (https://site1) configured with SSL using a generated certificate for a different site URL (https://site2).

Chrome/FF/IE/Edge browsers are showing invalid certificate error messages.

Error message on Chrome:

  Your connection is not private

  Attackers might be trying to steal your information from
  my.pod6.people.test.com (for example, passwords, messages, or
  credit cards). NET::ERR_CERT_AUTHORITY_INVALID

  Automatically send some system information and page content to Google
  to help detect dangerous apps and sites. Privacy policy Back to
  safetyHIDE ADVANCED This server could not prove that it is
  my.pod6.people.test.com; its security certificate is not
  trusted by your computer's operating system. This may be caused by a
  misconfiguration or an attacker intercepting your connection. Learn
  more.

  Proceed to my.pod6.people.test.com (unsafe)

Error message on Firefox:

  https://my.pod6.people.test.com/

  Peer’s Certificate issuer is not recognized.

  HTTP Strict Transport Security: false HTTP Public Key Pinning: false

  Certificate chain:

  -----BEGIN CERTIFICATE-----

  certificate

  -----END CERTIFICATE-----

How do I get these browsers to trust my site's SSL certificate and ignore the error in the future?

I tried adding the site certificate to Windows Trusted Root Certificate store, is that the right place?

Just to be clear, are you adding the self-signing CA root cert you will be using to sign other certs with?   That's what needs to go in the "Trusted CA" store.  The self-signed "leaf" cert you want the browser to trust doesn't go there.

"Trusted Root CAs" that you have highlighted is where to put the public key of the Certificate Authority (e.g. LetsEncrypt, Verisign, your in-house signing CA being used...)  If you are going to be your own CA and sign your own certs, and want your system to trust those, you need to put your CA public key there.

From your description though, it sounds like you got a site cert signed by some existing CA, and you want your browsers to trust it.

In that case, you are putting it in the wrong place.  You want either "Personal" or "Trusted publishers" but that's still just for the OS to trust it.  As @Steffen Ullrich commented above, you will also need to add your self-signing CA's public key to the browsers trustStore to do what you probably want.


Oauth2 - in traditional enterprise applications I read about Oauth2, mostly in the context of social media service providers like Google, Facebook, Twitter where they

Try to allow access to user data without giving password to third party applications.
Allow to use service without explicitly creating an account (StackExchange allows login through Google, Yahoo etc account)

Now, is Oauth2 relevant if I have the following use case.
I have an application, which is possibly deployed in cloud and provide a SAS model of business. I need user to create account (may be through an existing Oauth2 account), but also need to add other user to their account and manage access based on role. I read scope can be used for specifying roles and fine grained access. But, I wonder whether Oauth2 is meant of enterprise use like these or almost exclusively for social media model of applications.

Thank you.
bsr.

The OAuth protocol is flexible to enough to be used in as a general purpose federated authentication system,  and this was the original intent behind the OAuth specification.  It just so happens federated authentication systems are also useful for social media sites.

CAS is a less popular SSO architecture that is used by businesses and schools.


WPA cracking with Crunch, JTR & Aircrack Now I assume that everyone knows of aircrack-ng and John The Ripper with it's fantastic ability to pause and resume cracking.

With that aside, I want to add Crunch into the mix, however I can't seem to add crunch to it.
The plan as goes:

Crunch > John OR Aircrack  [ If > John, then Crunch > John > Aircrack ]

John > Aircrack [ So Crunch > Aircrack & John > Aircrack ]

I am running this on the MacOSX Terminal, but I guess this doesn't matter because all three have installed successfully, however I have to cd ~/jtr/run/ in order to use john the ripper.

Any idea on how to mix them together, anyone? If you want, I'm using crunch 8 20 charset.lst -f mixalpha-numeric-all-space

So far I have tried

./john -wordlist= -session=stpcrunch -stdout |crunch 8 20 -f ~/crunch-3.6/charset.lst mixalpha-numeric-symbol14-space -i | aircrack-ng -a 2 -b D0:57:4C:56:D2:30 -w - ~/-01.cap

crunch 8 20 -f ~/crunch-3.6/charset.lst mixalpha-numeric-symbol14-space -i |./john -wordlist= -session=stpcrunch -stdout | aircrack-ng -a 2 -b D0:57:4C:56:D2:30 -w - ~/-01.cap

./john -session=stpcrunch -stdout | crunch 8 20 mixalpha-numeric-all-space | aircrack-ng -a 2 -b D0:57:4C:56:D2:30 -w - ~/-01.cap

However all of these had crunch and aircrack working, however john doesn't work... I need all of them to work. - Although doing Ctrl+c stops crunch, but when ctrl+c is pressed again, it can't stop aircrack...?

crunch 8 26 abcdefghijklmnopqrstuvwxyz0123456789 | aircrack-ng psk-01.cap

is an example of what you could try.


How does xss work with web applications that take payload not through url Most of the examples of XSS, I have seen examples of websites that get its parameter tampered through url query parameter. For example:

http://example.com/param1=123&param2=name&param3=<script type='text/javascript'>alert('pwnd');</script>

But if the application receives its payload not through url query parameter but through Post request body, how can attacker lure victim to perform xss by simply providing url to click? You can definitely, tamper with post body values by inserting code, but that will not be considered as XSS, since that is usually done in apps like fiddler or curl which does not run response code. So how can xss occur in this applications. As far as I understand xss does not persist data on the server, but rather affects the user who is making that request.

There is stored XSS and DOM based XSS which do not rely upon a GET parameter.  POST based XSS is exploited using a simple cross-site post request,  which can be triggered using the following HTML and JavaScript

<form id=xss action=http://target/action method=POST>
  <input name=param3 value="'+alert(document.cookie)+'">
  <input type=submit>
</form>
<script>
  document.getElementById("xss").submit()
</script>

Once the XSS payload stored in param3 is executed within the context of http://target,  the Same-Origin Policy is bypassed.


Hashing the cookie token for persistent login In a login system I'm doing, I'm using a per-user, per-device randomly generated cookie token. A part of the script looks like this:

// Generate current device's token
$token = substr(bin2hex(mcrypt_create_iv(200)), 0, 60);

// Include this device's token
$STH = $userDB->prepare("INSERT INTO devices (user_id, token, active) VALUES (?, ?, 1)");
$Res = $STH->execute(array($Id, $token));

if (!$Res)
  throw new Exception("Couldn't store the device in the database");

// To keep users logged in between sessions
$Cookie->email = $email;
$Cookie->token = $token;

However, this implies that if the database was stolen, the attacker would be able to log in as anyone by changing the cookies. This is an issue I want to avoid. I know that sha256 is not valid for general password hashing. However, from the string this comes from,

$token = substr(bin2hex(mcrypt_create_iv(200)), 0, 60);

Is it secure to store a sha256 hash of the high entropy token in the database? Or should I be using the more expensive bcrypt, as with the passwords?

So long as your token is sufficiently long enough, I think you would be OK using simply SHA256. I'm not very familiar with PHP, but it looks like you are creating tokens of length 200, which would be more than sufficient. The reason that I would think that SHA256 would be OK is that the search space for a length token is so gigantic that it doesn't really matter how fast the hashing function is. There is no chance that it will be brute forced in any of our lifetimes.

However, from the programming side of things, I might still recommend using bcrypt. I'm not sure about the PHP implementation, but Bcrypt hashing is generally less difficult to screw up that straight SHA256 hashing, which makes it less likely for you to have bugs in your system. If you are using bcrypt elsewhere for password based authentication, then using it consistently instead of having two different methods for hashing makes your system less complicated and therefor also less likely to have critical bugs. If you are worried about speed, be careful not to optimize your system too soon. Implement it with bcrypt first and then do some profiling of your system. If and only if you identify your token hashing system as slowing down things should you think about using SHA256.


Is replacing bash with another shell a prudent step? Considering that RedHat and other major teams in business are conducting an audit in bash and have uncovered a few other vulnerabilities besides -7169 (-7186 and -7187), is it sensible to link /bin/sh to another shell?

Both -7186 and -7187 were found by one researcher - Florian Weimer - in just a few days (RedHat has been working on Shellshock since September 14), independently discovered by Todd Sabin from VMWare. Just how many more lurk there is anyone's guess. By the way, I'm not talking about permanent replacement, just suspension till things clear up.

To determine definitively the degree to which this might or might not be "a prudent step", I think you would have to do some original security research on the possible replacements, which include:

Debian's dash
OpenBSD's ksh
Busybox ash
MirBSD/MirOS mksh
...and certainly others

Mark's answer suggests that at least OpenBSD's has received security scrutiny already, but I'm not sure of the extent or whether there's evidence to back this up (clearly, they did not apply any scrutiny to a cornerstone of comms security (OpenSSL) until recently when they forked it into LibreSSL). On the other hand, it's pretty clear to me that nobody had bothered to read the Bash source for security until recently, or "shellshock" would have been discovered a long time ago; the whole "function importing" thing is a huge red flag that any security researcher would scrutinize as soon as they saw it (and hopefully recommend the entire feature for removal). But for the others, it's not as clear.

What is clear, though, is that all of the above have a much smaller attack surface than Bash. In order for an attacker to take control over a program, there has to be some input channel. These can of course be non-obvious things like resource limits, system clock, etc. but they're still inputs; a program with absolutely no inputs is trivially non-vulnerable. The security design bug in Bash is that it's taking potentially untrusted inputs (the contents of arbitrary environment variables) and subjecting them to complicated processing (parsing as code). On the other hand, as far as I'm aware, none of the above-listed shells do any processing of the contents of environment variables (except individual ones with specified established meaning like LANG and LC_*, ENV, IFS, PATH, PS1, etc.) or other input; they just treat the contents as abstract data which is passed through.

So from a security design standpoint, even without auditing these alternatives, I would estimate them to be safer choices than Bash. Whether that will remain the case it not clear. Certainly Bash is getting a lot of new attention right now, which other shells are less likely to receive, so we could end up with most of the issues in Bash getting fixed while issues in other shells remain unknown. Then you have various factors to consider, like whether you're likely to targeted individually, in which case using less-mainstream software may be a liability.

Personally, I use Busybox ash most places. If nothing else, both ash and dash use about 1/5 the memory of bash and start 2-8 times faster, so they're very practical choices from a non-security standpoint as well.


Can a VPN Provider read my mails? I'm using mail.com over HTTPS. I sent a mail and I was connected over my access to the company VPN. Is it possible that the administrator of my company can read my mails? I used Firefox / Webbrowser Login of mail.com

Yes.  In your case, since the VPN connects to your company, it is possible that they may have visibility into your outgoing web traffic.  They will see anything over plain HTTP, but many companies nowadays are breaking SSL/TLS at their boundaries in order to inspect it.  A good indicator to check if they are doing this is to go to a site that uses HTTPS (like Google) and then click the lock icon in your browser to view the certificate.  If the certificate doesn't have Google's information in all of the fields, it means that they are decrypting HTTPS and can see your traffic.


How secure are passwords made of whole english sentences I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives me the password "IwG'sA@9.40".

How secure is it if I take instead of this just the whole sentence (including white spaces). To be more concret:

How secure is it to use just an ordinary english sentence as a password with in particular with respect to

a sophisticated directory attack
a brute-force attack

If it is a good idea to do so, are there any rules I should follow to build the sentence? (Number of words, Is it ok if it is a quote from a famous person or has it to be a nonsense sentence...)

How do passwords of this type compare to a just randomly choosen passwort consisting of lower and upper case letters, numbers and symbols of length n?

I have four places in mind where this scheme should be applied:

Your home computer
Internet accounts (email, online shops, social networks,...)
Internet Banking
Storing highly sensible data

The password should be secure enough to follow the technical progress in password cracking and computer hardware for at least two years.

How appropriate is the described password building scheme in those cases, how would one change the recommendations on the sentence length etc. depending in which area the password is used?

Would be great if the answer contains some calculations which estimate the password security and some references about this topic.

Would be great if the answer contains some calculations which estimate the password security and some references about this topic.

I very recently answered almost the exact same question here: Confused about (password) entropy

The time it takes to crack your password is exactly equal to the amount of time it takes to test a single password multiplied by the number of passwords that will be tried before yours. Since you're attempting to predict someone else's behavior, that's really all you can say.

There are other estimates that try to figure out what number this will be in some general case, but those are necessarily always wrong, since the attacker doesn't have to follow whatever mathematical model you construct. Clearly the password will be guessed quickly if the attacker is going off a list of keystrokes from your computer, and clearly the password will never be guessed if the dictionary the attacker is using doesn't contain your password at all.

Occasionally people will use the concept of entropy to make this kind of estimation, but again, in the real world how well does that hold up? A password consisting the letter 'a' repeated 27 times has very low entropy, but would withstand just about every dictionary attack in common use... until extremely long single-letter passwords become all the rage and attackers start looking for it.

The more common a password pattern becomes, the more likely attackers will look for it.

In general, password attacks try passwords in this order:

commonly used passwords
simple dictionary-based passwords (lowercase letters only),
more complex dictionary-based passwords (mixed case, sprinkle in numbers and punctuation according to some common patterns)
exhaustive search of the entire keyspace starting with short passwords and progressing to long ones

If you can withstand the first 3 types and you have a reasonably long password, you're pretty much home free because an exhaustive search of a this size of keyspace is infeasible. Most attacks stop after types 1, only concerted attacks even attempt types 3, and types 4 is desperation.


XSS vectors in img src and background-image url I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's consider this example:

if (location.hash.indexOf('javascript:') !== 0) {
    img.style.backgroundImage='url("'+location.hash+'")';
 }
 img.src='some/local/path/'+location.hash;

Is there an XSS vulnerability in this code?

No, in modern browsers no XSS is possible via the style or src attribute of an  tag.

So neither of these would execute the JS code in any up-to-date browser:

Support for Javascript in CSS attributes has long been abandoned. You can find some older references about it here.

Analysis of your example code

location.hash always starts with a # symbol. Since this character is illegal in JS and not a valid beginnig of a new URL, no XSS would be possible in the first place. (For instance, eval(location.hash) always produces a syntax error.)

Let's assume, you ignore the # and location.hash could really contain any string you want.

Then this security check is flawed:

(location.hash.indexOf('javascript:') !== 0)

An attacker could still construct a URL starting with JaVaScRiPt:. Also, it's risky to assume that no implementation would ever allow leading spaces or control characters (e.g. \t\x00javascript:). And what about URL-encoding? A payload starting with javascript%3a would pass your filter. Also, do you want to allow the data: protocol? If you like to restrict the URL to absolute locations, you could whitelist the beginnings http:// and https:// instead of blacklisting javascript:.

This is fine:

img.src='some/local/path/'+location.hash;

Even if the src attribute was susceptible to script code, your prefix some/local/path/ ensures that it cannot be turned into a JS URL. However, an attacker could specify any relative path to an image file on the same server, which you might find undesirable.

NB: This is about constructing malicious javascript: URLs. If you want to use user-controlled values like location.hash for HTML output or a different context, you have to properly sanitize the string.


Is this a Facebook self-XSS attempt? I recently received a Facebook page link, with a weird querystring payload. The payload was in the form:

?\__xts__[0]=68.XXXXXXXXXXX....

where XXX were random characters (looks like base64, but couldn't decode it).

I googled for: "facebook __xts" and there are several results and pages containing similar querystrings. all start with \__xts__[0]=68.

Is it a Facebook SEO bug or malicious links?

According to github discussions 1 these urls (with the xts param, which is an abbrivation for eXtensible Time Series 2) are likely to track activity. The long string is a unique identifier of the post.


Is Qt framework is under attack or it has something suspicious (only in free version) I was trying to download Qt framework. I went to its Official site (I'm sure, I checked in Wikipedia) for Visual Studio. But when attempting to download Qt for Windows, my Firefox shows this message:

I also scanned using the IP address shown by Firefox and found something suspicious like this: "Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset."

My questions:
    Qt is a famous and recognized framework then how could it serve as malicious or attack page? Can I download from the website? or something is suspicious?

EDIT: Is this a bundler?

I have verified both its SHA-1 and MD-5 hash from the Qt home page. I tried to install Qt on my Windows, but my anti-virus found something strange when installing it? What it does mean?

Is open source download come along with a bundler?  because making collisions for one algorithm is OK but all the Hashes are same MD,SHA-1,SHA-256 or it is just a false positive?

EDIT THREE: [HASH CONFIRMATION]:

Before going brief ,I have noted the following things from your question :

You were visiting the mirror site of some malicious website
The official link differs from the url which you have downloaded

I was able to reproduce the problem while analysing the mirror site and it was flagged as malware as per the virustotal report

Now as you haven't downloaded the image[my rough guess] ,you might be safe from the vulnerable file ,if you have accidentally downloaded it try to remove the file completely and run some AV Scans.

Other than that there were less chances for you as MITM victim,If you still doubt it run a quick traceroute to your router ,if it shows external IP you might be a victim,Also have a look at the MITM question which was asked before over here .Also download the file from official site and verify by generating its checksum.


Is using 'echo' to display attacker-controlled data on the terminal dangerous? Imagine the following code:

ATTACKERDATA="$(cat attackerControlledFile.txt)"
echo "${ATTACKERDATA}"

An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile.txt to anything they desire. The content can be ASCII, UTF-8, Binary, etc. Anything is fine. The machine also assumes that it is infinitely fast, so even an extremely large file of multiple terrabytes would be read and printed immediately.

Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like:

This code only works in bash
This code requires the output to be printed onto a specific terminal emulator
Etc.

Everything else assumes a reasonably sane system. This means that answers such as "If echo is an attacker-controlled binary that's actually malware" does not count, as the existence of malware is not exactly "reasonably sane". Answers that would require a specific software or version of that software to be present do count, as long as that software was not made for the purpose of exploitation.

A similar question asks Is it possible to use the Linux “echo” command maliciously?, but the accepted answer is actually about a flaw in the design of a web application. Furthermore, it requires the attacker to be able to do redirects, which as far as I know, this construct cannot do.

Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like:

  This code requires the output to be printed onto a specific terminal emulator

In fact, yes. Old terminals like vt100 have the ability to use ANSI escape sequences to do special things, like execute commands. The following site below documents this ability using a simple echo, like you describe.

https://www.proteansec.com/linux/blast-past-executing-code-terminal-emulators-via-escape-sequences/

The article is in depth with specific exploit instructions, but the general idea can be summarized from this excerpt from the site:

  Dangerous Escape Sequences
  Terminal emulators support multiple features as described below [8]:

  Screen Dumping: a screen dump escape sequence will open arbitrary file and write the current content of the terminal into the file. Some terminal emulators will not write to existing files, but only to new files, while others will simply overwrite the file with the new contents. An attacker might use this feature to create a new backdoor PHP file in the DocumentRoot of the web server, which can later be used to execute arbitrary commands.
  Window Title: an escape sequence exists for setting the window title, which will change the window title string. This feature can be used together with another escape sequence, which reads the current window title and prints it to the current command line. Since a carriage return character is prohibited in the window title, an attacker can store the command in a window title and print it to the current command line, but it would still require a user to press enter in order to execute it. There are techniques for making the command invisible, like setting the text color to the same color as the background, which increases the changes of user pressing the enter key.
  Command Execution: some terminal emulators could even allow execution of the command directly by using an escape sequence.

As pointed out in the comments, this particular exploit was fixed decades ago on modern terminal emulators.  This just happened to be a simple example that a 30 second Google search revealed that nicely demonstrates the concept that there's still software at work that could be exploitable even in something as simple as displaying a file.

Theoretically, there could be other problems with modern terminal emulators (buffer overflows?) that might be exploitable.


Scanning a binary against YARA rules dictionary I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki, yara-gui, The yara64 (i don't remember the link source) itself and some other tools but non of them are capable of scanning multiple rule's against a single file. Already written a simple python code (It scan multiple times, Not complicated) and it is so slow and messy:

import os

rules = raw_input("Rules Folder: ")
mal = raw_input("Malicious File: ")
paths = [os.path.join(rules,fn) for fn in next(os.walk(rules))[2]]

for i in range(0,len(paths)):
    os.system('yara64.exe "'+paths[i]+'" "'+mal+'" --no-warnings -f -e -m >> output.txt')

So how do you scan your sample against multiple yara-rule's? Any specific or public(free/paid) tool or script which is efficient?

YARA allows you to specify multiple rules files to be used (as the latest version).

yara64.exe path/rule/file1 path/rule/file2 path/rule/file3 malwareFile

I don't know what the limit to the number of rule file paths you can specify is in a single YARA invocation, but this should make it considerably easier to script.


airodump-ng mon0 device My laptop is in monitoring mode. I need to get the details of a client that makes probes and not include other bssid and their station.

I run sudo airodump-ng -w s3 --bssid 74:de:2b:45:ed:d4 mon0
The MAC is my wlan0, but it won't show any client IPs.

If run the command  sudo airodump-ng -w s3 mon0 the s3.csv file shows the all IPs not associated to any of the AP. My requirement is to get the client that probes my mon0.

You should start by setting up your WIFI card to monitor mode on the right channel (it will help airodump-ng find the packets):

airmon-ng start <interface> <AP channel>

After that, the command that you are using is indeed the correct one. I mean, you are using the AP MAC address, right? You can use the -a parameter, it will display only associated clients.

airodump-ng -c <AP channel> -a --bssid <AP MAC> -w <capture_file> <interface>


Why does LastPass give me one password without needing my MFA key? I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (which I get from Google Authenticator on my phone).

However, if I go back to the form from which I triggered the login, the password is now filled in. (This site, as many others are, is set to autofill, but not autosubmit).

How is this possible? Is LastPass's MFA broken?

As far as I understand only your master password is used to derive the key to protect your secret (https://lastpass.com/support.php?cmd=showfaq&id=6926)

2nd factor is used to avoid an attacker to get access to the encrypted data from the lastpass servers only (download it for local decryption). Not for encryption/decryption. I cant find a reference stating this, but also not any reference saying that they do use it for encryption. And it seems true since they can just disable it for you (https://helpdesk.lastpass.com/multifactor-authentication-options/)

Probably it asks it to update the local encrypted database cache for offline usage (https://helpdesk.lastpass.com/your-lastpass-vault/), but if you cancel, it still can use the old data from a previous fetch. I´m speculating a bit on this part, but makes sense. They could refuse the usage of the data after the 2nd factor fail locally, but that also would break offline usage and would not protect the data from an attacker that already has the master password and access to the encrypted data.


iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates) As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2.

However, I'm having trouble finding information on client support.  According to this, Windows supports SHA-2 back to XP SP3, but I haven't been able to find definitive information on iOS, Android, and OS X support.  Can someone here provide a link to a source on these?

In SSL there are two areas where SHA-1 or SHA-256 may be used:

in the specific entrails of the protocol itself, for the internal "PRF" (a function used during the handshake) and for protecting the integrity of subsequent data exchanges;
as part of the signature over the server's certificate, and its CA certificate, and so on.

SSL 3.0, TLS 1.0 and TLS 1.1 use MD5 and SHA-1, not SHA-256. If you want to phase out SHA-1, then you need to switch to TLS 1.2. From this answer and its comments, you can see that support of TLS 1.2 by browsers is not a given, and is slow to percolate throughout the industry. IE on Windows XP will certainly not support TLS 1.2. In particular, many Android-based devices will use old versions of Android and its browser, and won't be updated soon. Fortunately, you can configure your server to advertise TLS 1.2 support but fall back to previous versions if the client does not support it; this is the normal behaviour of a SSL handshake, and should ensure a smooth transition.

What XP+SP3 supports about SHA-256 is the second point: certificates signed with SHA-256 as underlying hash function. This works. This page from digicert (a commercial CA) argues for SHA-256 support, and by that it means SHA-256 support in certificates; when it claims "browser support" it talks about the certificate validation, not TLS 1.2. According to that page, SHA-256 in certificates seems to work "everywhere". They don't tell anything about Android, but chances that Android is up to SHA-256 support because it has supported SHA-256 internally since day one (it is based on Java, which has known SHA-256 for years).

To sum up: you can use SHA-256 for the certificates; it will work (almost) everywhere. You cannot require TLS 1.2 yet (too many client browsers out there cannot handle it) but you can support it, and decide to prohibit previous versions (those which use SHA-1 internally) at a later date.


How does Tor collect addresses of nodes? My name is Alice and I would like to send a package to my beloved Bob. In order to avoid getting recognized by Bob I decide to send my message through several nodes. At each step, a node decrypts the message he received reading:

the address of next node
an encrypted message.

He will then proceed to send it to the address he found in the uncrypted message.

In order to securly encrypt my message I need to know the address of every node and their public keys. How does Tor collects such information?

Your Tor software comes with a list of predefined directory authorities. These authorities maintain signed lists of relays from which your client can choose to build the connection. A new relay publishes a server descriptor to the authorities to advertise itself.

Since not every Tor client acts as a relay, the number is smaller than you might assume and you don't need to somehow aggregate the node list yourself.

The FAQ explains this pretty well:

  Coordination: How do clients know what the relays are, and how do they
  know that they have the right keys for them? Each relay has a
  long-term public signing key called the "identity key". Each directory
  authority additionally has a "directory signing key". The directory
  authorities provide a signed list of all the known relays, and in that
  list are a set of certificates from each relay (self-signed by their
  identity key) specifying their keys, locations, exit policies, and so
  on. So unless the adversary can control a majority of the directory
  authorities (as of 2012 there are 8 directory authorities), he can't
  trick the Tor client into using other Tor relays.

You can explore the bridges and relays at Atlas or Globe.


oauth2 account authentication imagine you secured your application with oauth2 and several oauth providers.

Now imagine someone using provider A with email bob@example.com to log in.

Next time, someone uses provider B with the same email bob@xample.com to log in.

Both provider state that the email address is verified and both are big companies (no way to specify you own provider or something like this).

Should you map both logins to the same account? What are the risks?

The risks I already see are that the attack surface is getting bigger: if I want to hack the account of Bob, I can try to hack provider A or B. But the benefit would be more convenience for Bob, since he will not have to remember which provider he used...

First of all insure that each OAuth provider actually verifies the users email address.  Google and Facebook do this, but not every site will verify your email address (reddit is an example).  Google and Facebook are on the ball when it comes to security,  and I doubt they will be the weakest link.  However,  defense in depth is admirable quality.

A simple solution to the problem of using the email address as the unique identifier is to email the user and ask them to click on a link which confirms that both OAuth providers should be linked.


user/pass auth vs hmac signed for REST API I know they both prevent the RESTful APIs from abuse. Hmac signed api is commonly used than the other. But I think using user/pass pair for authorization is more security, here's the reason:

To sign an api using hmac need a shared secret between client and server. So the server MUST store the secret in a computer readable(reversible) format. If the server get cracked(it's not a small probability event), all it's users are in danger.
While using user/pass to authorize client, server could save hashed(with salt) client password to database. Then it is useless after stolen. Plus using tls/ssl to protect the password during transfer, there's no MITM attack.

So the truth is most companies use hmac signed api. Could someone tell me what I've missed?

Here are a few things to think about:

For mobile apps: do you stored the user's password on the device? At that point you add risk in case the device is stolen. If you use some form of token based authentication, you store the token and not the password - given how users reuse passwords, any chance to reduce the chance of exposure is good.
I wouldn't call salted password hashes useless - they can still be broken as long as the salt is taken as well. Depending on how the hashing is done, even salted, an attacker is likely to have a high success rate.
Unless the calling application has 'pinned' the certificate, don't assume safety from MiTM attacks. While it may require unusual circumstances (hacked CA, CA issuing signing certs, etc), it can (and has) happened.

To figure out the right answer though - depends on the specific threats a service is facing, and which risks are considered most important.


Per-transfer authorization of file transfers on a per transaction basis In my organization, users have the rights to transfer files to and from servers using SSH File Transfer protocol for a variety of reasons; e.g. application troubleshooting, BAU, etc.

Although our servers are configured with logging to keep track of what users have done, we would still like to control the file transfer operation done by the users in a sense that we would like to make it as a privileged operation and is allowed when a user have raised a valid request; not as and when they please.

The most effective way that I could think of is manually enabling / disabling the SFTP service whenever there is a request and having the user perform the file transfer operation on a dedicated workstation. But it does sound a bit strenuous though.

For FSI institutions, how do they control such operation?

SFTP is a not really intended for what you are trying to accomplish. Anything else you would be implementing would be non-standard.

You may want to create a web app for upload where you can also implement a workflow where there are authorization requests and tickets associated with each request that an authorized user must use in order to initiate the file transfer. You could script something server side and still use SFTP.

In manufacturing and financial services, they may use any of a number of techniques and protocols like MQ, Web Services (SOAP/REST), which can build in additional functionality, rules, etc. There is also old school EDI systems with run sheets, and control files.

This is probably also a better fit for Super User since its really an operational problem (though you still need to implement the correct controls throughout the process).


RSA-1024 vs. DSA-1024: Claim DSA SSH key is much faster to brute force Does the brute force speed vary significantly between 1024-bit RSA and DSA SSH keys?  DSA like gpu keypairs are probably DSA/Elgamal? (Can't find docs)

EDIT: The reason I ask is an instructor that "has been involved with computer security for 10+ years" reported that DSA was much faster to brute force than RSA which I find suspect.

I understand brute forcing keys on average you need to test half of the possible keys.  Of course brute-forcing keys is not generally practical and not the best attack vector if you have any other options.

Trying to brute force either a RSA or DSA key would be a losing proposition, there are far too many possibilities and there are far better attacks known.

For properly implemented RSA the best-known attack is factoring the modulus. For properly implemented DSA the best-known attack is solving the discrete log problem.

For a given key size the discrete log problem is believed to be somewhat harder than the factoring problem.

However DSA has a couple of practical problems.

DSA keys were conventionally limited to 1024 bit which is considered dangerously low nowadays.
Traditional DSA implementations are very sensitive to random number generator quality. Making signatures with a broken random number generator can compromise the key.


How do hackers obtain the memory addresses of variables? I've seen countless tutorials on hacking telling you that all you need to do is find the memory address of a variable and edit it, the problem is, they never explain how to do it. I'm not one for blackhat hacking and am only interested in making sure that my programs are as secure as possible but it's quite a hassle for me. I'm not sure whether finding the memory addresses is language/os specific so I'm kneeling on one knee with this question. Thanks

Start the program and use a debugger to find the memory locations. You base your hack around these locations. You then use this hack on a remote system and hope the locations are the same. There are many anti-exploitation defences though, so be careful, but there are also better hacking techniques to get around them. Hope this was helpful.


Broadcast deauth requests are not working While using aireplay-ng  broadcast deauth requests are not working but if i use deauth for specific user it's working fine. But the problem is i don't know how to get the Mac address of specific user. While trying on your own system it's easy you can just check for your own mac address. But how to get mac address of users on different network? Is there any way to overcome this! Thank you for your time.

If you are after just any user on that network, you can use airodump-ng on a specific BSSID. For example, running the command airodump-ng wlan0mon --bssid 00:00:00:00:00:AA --channel 1. Here is a sample output of the command:

 CH  1 ][ Elapsed: 10 s ][ 2016-12-31 12:00

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID

 00:00:00:00:00:AA  -59  93      112      698   69   1  54e  WPA2 CCMP   PSK  Network

 BSSID              STATION            PWR   Rate    Lost    Frames  Probe

 00:00:00:00:00:AA  00:00:00:00:00:AB  -37    0e- 0e     0      696
 00:00:00:00:00:AA  00:00:00:00:00:AC  -47    0 - 1      0       24
 00:00:00:00:00:AA  00:00:00:00:00:AD  -66    0 - 1      0       52

As you can see, running the above command outputs the BSSID, as well as the devices connected to the BSSID (00:00:00:00:00:AB, 00:00:00:00:00:AC, and 00:00:00:00:00:AD). Now you can use the command aireplay-ng --deauth 0 -a 00:00:00:00:00:AA -c 00:00:00:00:00:AB wlan0mon to deauthenticate the specific client.

Make sure to subsitute this example with your own WiFi card, BSSID MAC address, and channel number. The BSSID and channel you're after can be found by using airodump-ng wlan0mon, again using your WiFi card.


Statistics about Significant security breaches in 2013 I am curious in general if there are any reporting that collects statistics about the security breaches? like per country per industry and revenue losses?

I am not interested in anonymized breaches like the ones of Verizon et al. I am interested in breaches admitted by their own companies, like (for example the LinkedIn breach. If there are none, I would appreciate community's help in collecting those for 2013.

One option, although it focuses on dataloss as opposed to specifically security breaches, would be the data loss db.

In terms of the most important breach of 2013 as mentioned in comments already that's subjective, but arguably one could suggest that the NSAs data loss was the most significant of last year


L2TP/IPSec: Mutual authentication BEFORE user can access VPN I came across a question

  You are the network administrator for your company. You have deployed
  Windows Server 2008 on all server computers in your company.

  You have deployed the Network Policy and Access Service role on a
  Windows Server 2008 R2 server named SRV_NPS. You need to configure
  SRV_NPS as a virtual private network (VPN) server. You need to ensure
  that both user and machine authentication is required BEFORE gaining
  access to the VPN server.

  Which authentication method should you use?

The choices are

  L2TP/IPSec

  EAP-TLS

  SSTP

  SSTP

I chose EAP-TLS because I thought both user and machine get authenticated, but the answer is L2TP/IPSec because they say user and machine are authenticated BEFORE user can access the VPN.

But I cannot understand how this is different than EAP-TLS. How would EAP-TLS allow user access to VPN before mutual authentication. Please clarify.

EAP-TLS is just an implementation of SSL/TLS.  Which does not bind any particular client to a machine.  EAP-TLS uses X.509 certificates to authenticate clients to a server.  But certificates aren't tied to a specific machine.  ClientA's certificate isn't bound to IP address 1.1.1.1, it's just what is presented to identify the client.

L2TP/IPSec however does provide both user and machine authentication.  IPSec establishes a secure tunnel by using security policies.  An IPSec security policy is stored in a table and is referenced using a Security Parameters Index (SPI).  Each SPI is bound to an IP address.  If an incoming encrypted packet does not have both the correct SPI and IP address it won't be processed.  L2TP provides the user authentication mechanism.  Once the IPSec tunnel is established an L2TP tunnel is brought up.

L2TP's RFC2661 Section 9.4:

  IPsec also defines access control features that are  required of a compliant IPsec implementation. These features allow filtering of packets based upon network and transport layer characteristics such as IP address, ports, etc. In the L2TP tunneling model, analogous filtering is logically performed at the PPP layer or network layer above L2TP.  These network layer access control features may be handled at the LNS via vendor-specific authorization features based upon the authenticated PPP user, or at the network layer itself by using IPsec transport mode end-to-end between the communicating hosts. The requirements for access control mechanisms are not a part of the L2TP specification and as such are outside the scope of this document.

This implies that IPSec provides network layer access controls as I stated above, but not performed by L2TP.

L2TP provides user authentication in a kind of first cousin twice once removed type of way.  L2TP is a tunneling protocol that runs Point-to-Point Protocol (PPP) through that tunnel.  PPP provides mechanisms for user authentication;  using either Password Authentication Protocol (PAP, which is deprecated) or Challenge Handshake Authentication Protocol (CHAP).


How To Encrypt Group Emails? I'm interested in encrypting e-mails.  My very, very basic understanding is that I am to generate a private key, and share my public key with the message recipient (who will share his public key with me).  Then, I can encrypt my messages utilizing his public key so that only he will be able to decrypt it.

If my understanding is correct - that's great for 1-to-1 communication.  But I would like to encrypt e-mails between a group of users (specifically five users).  All five users should be able to encrypt/send an email to all of the other users.

What's the best way to do this?

PGP uses hybrid encryption. That means that the public/private key system is not used to encrypt the whole message. It is only used to encrypt a symmetric key which is used to encrypt the actual message.

When you address a PGP message to multiple recipients, you only encrypt the message once with a newly created symmetric key, and then encrypt that symmetric key multiple times, once for each intended recipient. That way each recipient can decrypt their personal copy of the symmetric key and then use it to decrypt the message.

Your message would grossly oversimplified look like this:

Symmetric key encrypted with public key of user A
Symmetric key encrypted with public key of user B
Symmetric key encrypted with public key of user C
Symmetric key encrypted with public key of user D
Symmetric key encrypted with public key of user E
Message encrypted with symmetric key

By the way: Hybrid encryption is also used when you send a message to only one recipient. The reasons is that using a different symmetric key for each transmission prevents an eavesdropper from noticing when you write the same message to the same recipient twice. It is also better for performance, because most symmetric encryption algorithms are much faster than most asymmetric ones.


An application started by the root user has root privileges? I'm starting node.js on my server. I have to start the node.js HTTP server as root, because it will listen on the port 80. Once i start the node.js on port 80, if a person is able to execute some code on my server trough the application will this person have root privileges?

I'm using xubuntu.

It depends on the actual server implementation.

While it looks like that node.js started as root will keep these privileges other servers (like Apache or nginx) only start as root and then give up privileges. A typical design for example is to have some master process which binds to the sockets with the necessary privileges and then forks a child which gives up all root privileges permanently before processing any data from the network. This is possible since the listen sockets are inherited from the parent process and the root permissions were only needed to bind the socket to a privileged port but not to accept connections on the established socket.

For example with nginx you will see something like the following:

$ ps -ax -o user,pid,ppid,cmd | grep nginx
root     14746     1 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 14747 14746 nginx: worker process
www-data 14748 14746 nginx: worker process

The first process shown is the master, running as root. The others are the workers started by the master running as non-privileged www-data. Only these non-privileged workers will process user input and thus in case of a compromise due to some unexpected input from the network only the non-privileged user will be compromised first. Of course, an attacker might then try to do a local privilege escalation using additional bugs in the host but that's a different issue.


Why is my debugger detected as a Trojan by anti-virus software? I'm trying to use a deugger (namely OllyDbg) to analyze some exe files.

However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use www.virustotal.com to scan the binary I downloaded)

Are OllyDbg's main behaviors belong to a kind of Trojan?

Currently, I want to download OllyDbg v1.10 defixed (version from [potentialy harmful link] http://4server.info/download/4shared.com/rar/RFNpFbiP/ollydbg_v110_defixed.html)

Here is the scan result of "ollydbg v1.10 defixed.rar" by virustotal:

Does "ollydbg v1.10 defixed.rar" really contain Trojans?

The link provided in the question seems really fishy. If it's a "patched" version supposed to get rid of limitation, it's more than probable the fixer added some kind of additional surprises (like a virus) in it. The official site already proposes a free version of the software, so I would start here to avoid getting a virus from a random stranger.

This being said, it's not impossible that anti-viruses detect innocuous programs as malwares. This happens cause AV checks for some known signatures of exploits and/or detects unusual behaviour, like access to some memory ranges for example.

Debuggers have these kinds of odd behaviours, as the need to bind to existing processes, de-route function calls, check and modify memory, etc.


Is using decrypt_derived more secure than a keyfile? Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS.

The /home partition needs only to be decrypted if / is unlocked and mounted. At boot time, I enter the passphrase for the root partition. Now I have found several possibilities to avoid having to enter multiple passphrases:

Use decrypt_derived from Debian. This retrieves the (master?) key from (secure?) memory and uses that as passphrase for the second partition. It has been mentioned on Unix.SE.
Create a key file from random data, store it on the main partition and use it as passphrase for the second partition. This is easy to setup.
Somehow read the passphrase and write it to the standard input of cryptsetup. This means that the passphrases need to be the same for both partitions.

What are the security implications of each method and which method is recommended?

decrypt_derived is slightly better than the keyfile approach for these reasons:

You could accidentally store the keyfile with the incorrect permissions and thereby leak the contents to non-root users on the system, whereas the master key for a LUKS permission can only be accessed by root.
You could accidentally delete the keyfile, whereas the master key can't be accidentally changed or removed.
If the root filesystem gets corrupted you could lose the contents of the keyfile, whereas the master key would not be affected by this.

Basically, I would use decrypt_derived if it is available (i.e. I'm using Debian/Ubuntu), but wouldn't go to the effort of installing it manually if it's not. In either case I would still add an additional passphrase key to the home partition in case the root partition gets corrupted and the master key is lost.

I certainly wouldn't use the third method you suggested, since it is more work and you want to avoid storing the passphrase anywhere.


How to verify OpenSSL's Heartbleed patch is the correct one? In hearing about the Heartbleed vulnerability, I went to https://www.openssl.org/source/ to download the latest patch, but was quite surprised to find that the security certificate for that site has not been refreshed since the exploit was discovered ("not valid before" date is Tuesday, August 30, 2011 5:30:50 AM CT).

So, how can I be sure what I'm looking at is the true OpenSSL site and not an impostor who stole their certificate (even before the exploit was revealed).

In other words, I downloaded https://www.openssl.org/source/openssl-1.0.1g.tar.gz, which that same site claims to have an MD5 of de62b43dfcd858e66a74bee1c834e959, which it does, but is that the right fingerprint for that patch? Or am I downloading something malicious that has a new backdoor coded in it?

UPDATE: Following suggestion from @Lekensteyn, I verified that the PGP signature provided for that download was valid and signed by key 0xFA40E9E2, which seems to be the key of Dr Stephen N Henson <steve@openssl.org> (which the the website agrees with). But to be super-sure, I'm assuming I can't trust the website right now. What other ways can I get faith that the 0xFA40E9E2 key is the one that should be signing that release?

Does anyone have an OpenSSL download from the 0.9.8 branch (that was not compromised by Heartbleed and would be old enough to have been distributed before the exploit), that they can verify is signed by that same key?

Concern: I found this notice of an update to the OpenSSL website, just before the exploit was revealed (April 2), and the change to the site was to mark Dr. Henson's key as expired, and add 0xFA40E9E2 as his new key, but that key was created back in 2005? So it's a new key to identify Dr. Henson, but then that's the key they chose to sign this super-important patch to Heartbleed? Does that seem off to anyone?

Your question is actually:

  How can I be sure of the authenticity of the downloaded file?

Let's start with the details you mentioned. The checksum (MD5, SHA1, whatever) is a fingerprint of the file which allows you to check the integrity of the file. That is, whether the data has changed since the fingerprint was taken. If you get the checksum from a reliable source, then you can safely assume that the downloaded file is valid.

If you do not trust the checksum and want to authenticate the file, use the GPG signature if available. For the file in your question, this is available at http://www.openssl.org/source/openssl-1.0.1g.tar.gz.asc. If you trust the signer, and the signature matches the file, then you can assume that the downloaded file is valid. If you know nobody in its keyring, then you can look for others who trust it. For example, Debian has a copy of the signing key at http://sources.debian.net/src/openssl/1.0.2%7Ebeta1-1/debian/upstream-signing-key.pgp. This Tor script containg a GPG fingerprint of Dr Stephen Henson's private mail which has signed the openssl.org address.

If you are really paranoid and have older sources available, then you can download the file, extract it and compare the sources:

# Assume openssl-1.0.1f to be a known good source
tar xf openssl-1.0.1g.tar.gz
diff -Nur openssl-1.0.1f/ openssl-1.0.1g/

This requires some knowledge of the language in which the program was written (C for OpenSSL) though. If someone put in a backdoor, it would likely not be as obvious as // backdoor requested by the NSA.

Yet another alternative is to avoid the single download completely and fetch the sources from the source code repository at https://git.openssl.org/gitweb/?p=openssl.git. Some files may be different between the release tarball and the git repo (like the configure script), but the sources themselves should be the same.


Why is passing a token for each API request more secure than passing a username and secret for each API request? I guess this could also be phrased as JWT vs. Basic Auth, similar idea?

Passing a token for each API request seems to be the more common and recommended approach, and I have the gut feeling that it just "feels better and safer", but I am not sure why and how to clearly communicate it.

In most use cases, a token is a form of identification, similar to a username without a password.

If you are certain that nefarious actors or incompetence won't compromise that identification, then many people will use that as a form of authentication, such as with session tokens inside of browser cookies, or as the token in JWT.

A token is typically generated from a much higher entropy source than a username or a password, and is unlikely to be reused or shared with third parties, unlike passwords.

Additionally, if a token is compromised, it only affects one account in one system.  If a user's password were compromised, it might affect most of the user's accounts across many systems, possibly also giving access to the user's bank.

(Please use a password manager and generate random passwords for every account, people!)

If the username and password are generated randomly with high entropy, and assigned only to a specific account and not re-used on other systems, then there is little difference between using a username and password, and using a token. In the end, both are simply authentication using shared secrets.  Tokens just generally don't get shared with third parties the way that security-ignorant-users' passwords are.


If I seperate VPS into WebApp/MySQL VPS & separating WebApp projects into Admin/User projects. Is It more secure? If I want to deploy Laravel WebApp using MySQL DB on VPS like DigitalOcean, Vultr or similar platforms, should I separate VPS into WebApp VPS & MySQL VPS? Is it more secure?

And what if I separate Laravel project into AdminProject and UserProject but use same MySQL DB & VPS. Is it more secure?

In general, for the first part, separating systems could improve security since a compromise of one doesn't immediately result in the other being compromised. That said, if your web application server is compromised and has readable database credentials sitting around, an attacker could pivot to the database anyway.

For the second part, I see no issue with using the same database server for both as long as each project users its own set of unprivileged credentials for the database. This way, even if one of the web applications is compromised, the other project's data won't be accessible.

There is one downside to splitting up into multiple VPSes: complexity. If you were running all services on the same host, you could just have the database listen on localhost only and not worry about securing it from the network. However, if the database runs on a separate server, you will need to expose it to the network, ensuring it is properly restricted with access controls, firewall rules, and possibly encryption.