How do VPNs bypass ISP monitoring How exactly do VPNs bypass monitoring of the requests and traffic? I get that the traffic is encrypted, but how do VPNs manage to hide the DNS requests before establishing an encrypted transfer?

If a VPN is also using an ISP, how exactly does it tunnel underneath everything?

Is there not an endpoint that breaks out of the tunnel to make the visible DNS requests?

After a secure VPN tunnel has been established, any traffic sent through the tunnel will be encrypted between the client and the VPN endpoint (or between the two VPN endpoints in a site-to-site configuration). This will usually include DNS requests and any other Internet-bound traffic.

(N.b. I'm assuming, for the purposes of this question, that we are talking about VPN tunnels that capture all Internet-bound traffic from a machine. Most VPNs used for privacy reasons meet this criteria I think.)

However, connections are only protected by the VPN until they reach the endpoint. At this point they are decrypted back to whatever protocol they use (possibly also encrypted), and sent to the actual destination server.

         /------ VPN -------\
 CLIENT <------ HTTPS -------> VPN ENDPOINT <----- HTTPS -----> SERVER
         \------------------/

In this example, the connection itself is HTTPS and is therefore encrypted even after it has passed through the VPN endpoint. However, any cleartext protocols like HTTP and DNS will not be secure beyond this point.

Using a VPN for privacy reasons is therefore best when trying to evade monitoring from local network sniffing, your corporate IT department, insecure wireless networks, or from your OWN ISP. They may also be leveraged for anonymity from the destination server, although TOR might be more robust for these purposes.

The VPN endpoint's ISP can technically monitor all of these connections, and this is why using encrypted protocols (HTTPS, FTPS, SSH, etc) is still important on a VPN. But they're much more difficult (not always impossible) to trace back to you.

If this secondary ISP monitoring is a particular concern, again, you might find TOR to be more suitable for maintaining privacy.

Before the VPN tunnel has been established, nothing is inherently encrypted (although you might, of course, be talking to TLS-wrapped services anyway). Therefore, if you configure your VPN client to connect to myvpn.example.com, this DNS request will go out in the clear. Furthermore, regardless of DNS, a monitoring 3rd party can always identify the IP address of the VPN endpoint that you are connected to, and may therefore be able to deduce that you are using a VPN. However, they can only see which address the messages are going to (the VPN endpoint) - they can't see the contents of the messages, or their ultimate destination.


Why does GoDaddy have four different certificate chain, G2, G3, G4? I see from Godaddy they have multiple certificate chains https://certs.godaddy.com/repository

GoDaddy Certificate Chain
GoDaddy Certificate Chain - G2
GoDaddy Certificate Chain - G3
GoDaddy Certificate Chain - G4

What is the purpose of each and what do the G2, G3 and G4 stand for?

"G" stands for Root certificates generation. Basically, it identifies the generation (version) of a Root certificate that signs the Chain of trust. When CA needs to get a new chain (for example, because of upgrade from SHA-1 to SHA-256), they just increment the generation number. This is good because obsolete certificates can be better identified.


How to Perform a Security Review of Apps from Mac App Store As part of our software procurement process, we're evaluating the security of applications, e.g. by checking if there are non-addressed vulnerability reports and if the vendor embedded secure requirements into their software development lifecycle (e.g. scanning for vulnerable libraries, static code analysis, secure coding practices, etc.). This is to reduce the risk of data confidentiality, integrity, and availability by using non-maintained and vulnerable software. Security through connected cloud services is checked differently, so my questions refer more to standalone (utility/productivity) applications.

Apple already does some sort of review for all applications published on their Mac App Store as described in https://developer.apple.com/app-store/review/guidelines/, but doesn't go into detail on what is being checked.

How should a company review desired apps from the Mac App Store so that they meet the company's security requirements?

The most basic review is stuff already provided by Apple, such as "what permissions does the app request" and "who published it". You can also instruct the OS to not give the app some of the permissions it may want. All apps published through the store are digitally signed, so you can be sure that the version you install is the one that was uploaded to Apple. However, Apple's review is not guaranteed to catch all the ways somebody might do something malicious with the app.

For completely black-box testing an app, the best option is network review; set it up behind an intercepting proxy such as Burp Suite, set the proxy on the device, and start capturing traffic. Verify that the app is using HTTPS or other encrypted protocols. For HTTPS, verify that it is validating TLS certificates both by signer and by host. If the app uses certificate or key pinning, you won't be able to decrypt the data (though you can still tell what hosts it tries to connect to), but if not you can decrypt the data after you install the proxy's root CA certificate on the device. This will let you see if the app is sending any data it shouldn't or to anywhere that it shouldn't.

If you want to actually inspect the app's on-device data and files, you'll need a jailbroken device. Using a privileged file browser, you can retrieve the install files and check them for any libraries from untrusted authors or known-vulnerable versions. If you really want to, you can throw the files into a disassembler / decompiler and figure out exactly what they do, though this is a skilled and somewhat laborious process even if the files aren't obfuscated at all. You can also retrieve any data files (including database files) the app stores in its sandboxed part of the file system. You can check if any sensitive data is encrypted (although its of limited use to do so unless the app itself demands a password at startup; there's nowhere to store the key that an attacker with root access couldn't access with enough effort), or if it's storing data you don't expect it to. You can also check the app's keychain, and see what's stored there.


How can I see if a site supports HTTPS? I have a classic C forking proxy in my LAN; now that I know "how to socket", I'd like to grant some privacy to it.

For instance, the browser extension HTTPS Everywhere (from its Wikipedia page),

  It automatically makes websites use the more secure HTTPS connection instead of HTTP, if they support it.

If I'd use OpenSSL in my proxy, I'd make crypted connections: if my proxy receives a GET request (plain HTTP request for an unsafe connection), with OpenSSL I would protect that connection adding a layer of TLS to it.

But as reported in my quote above, HTTPS Everywhere makes a website use HTTPS connection if the site support it.

So, how can I check (with C code) if a given website supports HTTPS?

...please don't tell me it just needs to attempt a connection to remote server's port 443.

Connecting to the remote site on port 443 is pretty much all you need to do.

If you have a web site running on the default port at a given host name, then it will use port 443 for HTTPS. If the web site does NOT use the default port there is no way to know what port will be used for HTTPS (if any) except attempting a handshake on every possible port: that far too slow for proxying and might get you locked out by IDS.

You might also want check the answer to "how does TLS works" which describes the handshake in detail.


What project is a good SILC substitute? As time has marched on, it would appear that the Secure Internet Live Conferencing (SILC) client/toolkit have lost a bit of steam, I can't find any current mailing lists, their website doesn't seem to get many updates - and the latest client source code has a timestamp from 2009.

I kinda get the feeling it's dead - if thats the case, are there any existing projects that fill the niche that SILC did?

What are all the cool kids using these days?

My wish list would be:

Not a plugin for an IM client, they never seem to work very well.
Cross platform (Linux, Windows, OSX)
Curses client would be great, but.. if it's an anachronism at this point I won't try to fight it.

I'm probably not very cool and don't use any of those currently but how about jabber / XMPP?

This thread from 2009 seems to cover some of the differences and features with a healthy focus on security.


My AP is probing other device? I just installed kismet 2018 Beta update on my kali and test run it on my host but i came across something that i dont understand and i would appreciate if someone would explain to me.
When i check the pcap file of my test run and check my AP it was probing some unknown devices (which can be seen from the pic below). what does this mean?
thanx

When i check the pcap file of my test run and check my AP it was probing some unknown devices (which can be seen from the pic below). what does this mean?

If I understand your image correctly, you are showing captured data sent by your AP (data removed) to the shown wireless clients. If I am wrong, please let me know.

These entries all show probe responses and this is part of normal 802.11 operation.

When a wireless client is looking to join a wireless network (or check for the possibility of roaming to a new one), they send out probe requests. Often these are general in nature and how a device discovers which networks are around them. Think of it as the client device yelling, "Can any wireless networks hear me?"

Probe requests can also be directed to particular networks. "Can network ABCXYZ hear me?" This is required with the SSID is "hidden" and is the default way many mobile devices try to reconnect to stored networks.

When an access point hears a probe request, if the probe request is either general in nature or for the configured wireless network, it responds with a probe response. This behavior is defined by the IEEE standards for 802.11 networks. So your AP will always respond to any general probe request from a wireless client.

You have likely experienced this yourself without realizing it. When you want to join a wireless device to a network, you have likely been presented with a list of wireless networks and selected the one you wanted to join. This listed was generated largely from the probe responses the wireless client received from APs in the area when it sent out probe requests.

All APs also advertise themselves with beacon frames periodically, which is the other way that clients can find wireless networks in the area. However this is a slower process for discovery, so the vast majority of clients use probe request/responses primarily for discovery.


Role of X.509 in signature verification My requirement is signing the message with private key on one side and verifying it on other side using public key. SHA256, rsa:2048 are the algorithms i need to use. May i know whether X.509 is needed for my requirement if yes what is its role during signature generation and verification ?

X509 is a set of standards for a whole bunch of Public Key Infrastructure stuff. Usually, when people refer to X509, they mean certificates since X509 is the widely accepted format for certificates.

So, I will interpret your question as:

  what is the role of certificates during signature generation and verification?

Short Answer:

There's no technology reason why you need a certificate. You sign something with your private key, someone else verifies it with your public key, done. The problem that certificates solve is getting your public key to the recipient without an attacker being able to put in their own public key instead.

Longer Answer:

Let's say you have a private key and the corresponding public key. You sign a message with the private key. You want somebody else to be able to verify your signature. Well they need your public key in order to do that. The question is: how do you get your public key to them without it getting intercepted and replaced by an attacker's public key? This is known as the key distribution problem. If you have a way to do that, like a GPG Public Key Server, or an internal corporate network share then you don't need certificates at all.

But if you need to send your public key over an insecure method, like email, then having a Certificate Authority make a certificate for your public key ensures that no attacker can do a man-in-the-middle and replace your public key with their own.


SHA-256 Timestamp not recognized in windows 7 when dual signed I wanted to dual sign my exe so that the XP and Vista users can use the software. But when i dual sign the exe with SHA1 and SHA256 timestamps, In windows7 only 1 timestamp is shown.

To dual sign I used signtool of windows sdk 8.1 and my certificate is of SHA256 and the signer pc contains the windows server 2012 R2. And I dual signed using the command...

signtool.exe sign /n "certificate name"  /t http://timestamp.comodoca.com /v foo.exe

signtool.exe sign /n "certificate name" /fd sha256 /tr http://timestamp.comodoca.com/?td=sha256 /td sha256 /as /v foo.exe

The dual signing is working perfectly on windows8 and above OS's. Did I left anything? or doing wrong some where? Please help me on this.

Windows 7 doesn't support SHA256 signatures by default. You need to apply this update, in order to get the desired functionality.


How to effectively test for username enumeration risk? I am responsible for some public-facing web applications, and I want to test these for the username enumeration risk as explained in Testing for User Enumeration and Guessable User Account (OWASP-AT-002) by the OWASP project.

These applications are .NET based websites, with a standard login consisting of username/password and typically a password reset functionality.

I could do this by hand, of course, (at least for visual differences) but I would rather use an automated method.

The test should include:

(Visual) Content-Based differentiation (simple for a human tester)
Response (HTML-Text) based differentiation
Time-Based differentiation
(Response faster/slower upon match)
others I forgot?

The test should not include (real) password guessing, just username enumeration. I have a set of some known user names to test with, along with the login screen URLs.

What is a simple and effective method to test for a username enumeration risk?

visual differentiation is a consequence of HTML differentiation. It cannot happen that the same HTML + JS + CSS will lead to different visualizations (barring some intentional fudging like, I don't know... time-dependent background colors or animations?).

So you can send out a sufficient number of queries for real users and compare the same queries for fake users; and you must do the same with all unauthenticated endpoints that are accessible.

This means examining not only the "login" URL but also the "I've lost my password, how do I go to recover it?".

For each such endpoint, in addition to the differences in outputs, calculate the average time to answer and its variance (a high enough variance will negate any reasonable timing attack).

You may want to do this twice, i.e. you check user "marcel" once and then again. The series of the "firsts" we call the unprimed series, the series of the "seconds" is the primed series.

Purge the received contents of any timestamp, unique id or user-related information (e.g. "Sorry, password for user marcel is incorrect" should become "Sorry, password for user USERNAME is incorrect" - simple regex here. Careful if some user is called table, html, or body, since that would skew the results).

Then the desired outcome is that, for all endpoints (1),

all the answers for real users and fake users are identical.
the removed parts ("marcel", "admin", "20160920173511.128", etc.) are either all identical, or all different. It mustn't happen that real users get a real timestamp and fake users get no timestamp or a differently formatted timestamp, for example.
the time to answer for each fake user should be very close to the time to answer for a real user. Ideally you want the same mean and variance.
the times distribution for the primed and unprimed series of real users might well be different (usually, the primed times are shorter). If they are, then the same ratio must hold between the primed and unprimed series for fake users.

Point 3 means that looking for a user that is not in the database must take the same time as looking for a user that is in the database and has data to be loaded and analyzed. Achieving it isn't trivial. I've seen random delays added to the process, but they must be based on the user name (same user name = always same delay) (2).

Point 4 could lead to a twist in timing attacks, allowing to distinguish between real and fake users even if for a single attempt the reaction times are the same.

(1) I've seen several systems that will ask your username to help you recover the password, and cheerfully say "Sorry, that username is not known!". A more suitable message would be: "Very well, lserni (if that's really your account), if you're in our database, you should receive an email shortly."

(2) When a username comes by, I want to add a random delay that will thwart most attempts to time the authentication process. marcel is resolved in 85 ms and juniper in 62 ms. Is that because marcel exists and juniper does not, or because their delays were different? You must not know. But what happens if the delay for user juniper is random every time? It happens that I can average resolving time, and the randomness will slowly (depending on its variance) cancel out. So I add to user juniper a delay which was randomly assigned to juniper, but is always the same whenever juniper tries to authenticate. To avoid saving things in a huuuuuge database, what I really do is calculate a 32 bit CRC from the name, XOR with a secret salt, use the result to seed a PRNG, and extract a random number. At that point even if the attacker knows that existing usernames get a 50 ms delay while unknown usernames get 30, he/she cannot know whether juniper's 62ms were given by 50 plus a random 12 (juniper exists), or by 30 plus a random 32 (no juniper). And the 12 (or 32) will not be the same for a different user who will have a different CRC32. So using the same username will not help, but using a different username will not help either. Of course, I need a random range large enough to "overwhelm" the known/unknown time difference.


How does "Unlock your Mac with Apple Watch" work? What should I consider in the Enterprise? MacOS on 2013 and newer Macs have the following setting at the bottom in system preferences:

Question

How does "Allow your Apple Watch to unlock your Mac work?

From what I've seen, it has a dependency on iCloud, as mentioned in several support articles.

Is there a requirement to permit iCloud to unlock your Mac?
How can I, as an enterprise administrator, ensure that iCloud is using either "two step" or "two factor" authentication?

From Apple's support article on the topic, it appears that prior to being allowed to enable this setting, the user must have 2FA enabled. From the same page, a user must be signed into iCloud on both devices. So yes - that's a requirement. As an enterprise admin, if your users are using the watch unlock feature, then you can assume that they have 2FA enabled.
Quoting from this other answer, your Mac calculates the distance of your watch from it, after pairing with it over Bluetooth. In more detail:

The 802.11v timestamp has been proposed to be used as a “time of flight” calculation all the back since 2008. Apple has decided to use Time of Flight as a security mechanism for the Watch Unlock feature. Rather than just assume that the Watch is in range because it’s communicating over Bluetooth, Apple wanted to increase the security of the Watch/Mac connection. When the Mac detects that the Watch is within 3 meters of the Mac it is connected to via Handoff it is in the right range to trigger an unlock.
When the Watch sends a Bluetooth signal to trigger the unlock, the Mac sends an additional 802.11v request to the watch via wireless. This request is then timed for arrival. Since the Mac knows the watch has to be within 3 meters, the timestamp on the packet has a very tight tolerance for delay. If the delay is within the acceptable parameters, the Watch unlock request is approved and your Mac is unlocked. If there is more than the acceptable deviation, such as when used via a Bluetooth repeater or some other kind of nefarious mechanism, the unlock request will fail because the system realizes the Watch is outside the “safe” zone for unlocking the Mac.
Source


Why cant I bypass user authentication by copying cookies? I am getting confused by a website cookie authentication process. I captured the packets going from the website and saw the cookie being sent. I copied the entire cookie content of the website and created the same cookie on a different machine and loaded the website but I was not able to login.

How is the server identifying me? I did not see anything important sent in packet capture.

The site is probably protecting against session hijacking by using some kind of heuristic to guess that you are not the same user, e.g.:

IP
Geolocation (of IP)
User agent

All of these are imperfect in the sense that they can be bypassed. Some may also filter out legitimate users. Without knowing how the server is configured you can only guess and ivestigate with trial and error. Try sending the exact same HTTP request from a machine with the same external IP and see what happends.

Other ossibilities is that you picked the wrong cookie, missed some other security feature that needs to be included (e.g. CSRF headers), or that the session simply timed out.


To release as Open Source for Audit or to Keep "in house" For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?

Linus Law (the more people have access to the sourcecode, the more people will find and report bugs) only applies when people have an incentive to get bugs fixed. This incentive usually only exists when they use the software. So when your software is highly optimized for you and you don't expect that a larger community will form around it, you won't get many bug reports and patches out of it.

Also, even when your software gets widely used, this is no guarantee that people will audit it properly for you. A good example is the heartbleed bug, which was a quite typical security vulnerability in a very very widely used piece of open source software.

When it comes to pen-testing software there is also an ethical component to consider. Is your software really only useful for penetration testing, or can it actually be abused for cracking? You might not want to hand script kiddies the tools to cause damage and bring themselves into legal problems.


All hash algos shatter... so why not switch from golden bullet to scatter shot? As of this morning any SHA-1 hash can officially be collided for as little as $110k in GPU power on Amazon.

http://shattered.it/

https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/

Obviously this means that for many applications SHA-1 is completely useless and that within the next few years it will have gone the way of MD5.

Question:

It seems that over time we decide that the best way to make things more secure is just to come up with algorithms that need more and more bit entropy and more and more CPU processing power which seems like a false solution.

If 128-bits of entropy is enough entropy (i.e. AES-128 is preferable to AES-256), why don't we just come up with algorithms that can handle 128-bits of entropy better?

Furthermore, instead of moving to algorithms in which flaws will also eventually be found that increase the CPU, memory, and storage requirements so drastically (there's a HUGE difference between MD5 and SHA-256 when you're computing on a phone or a raspberry pi), why don't we just pair two imperfect algorithms together?

For example: couldn't we run 512 bits through the MD5 algorithm and then run those same 512 bits through a SHA-1 and do a simple mux on the combined result and even though both algorithms have known attacks, the coincidence of an attacker finding any set of bits that aligns in the tables of both algorithms seems that it would be quite secure. Or simply digesting the MD5 in reverse every block and scattering some of the previous source bits every n blocks - you could read a block in forwards, reverse the bits, run it through backwards, and then continue to the next block and after 16 blocks take the nth bit of the original source blocks, maybe even have a rolling window on it - holding less than 1k in memory at any given time.

It seems that we're trying to find this single ultimate mathematical solution to entropy to something that could be solved much simpler with two or three simpler mathematical solutions that are out-of-band from each other and this would be faster, more memory efficient, more storage efficient, and more secure than any single algorithm.

Is there a flaw in my reasoning?

This is NOT A DUPLICATE

The other question is talking about taking the final result of a hash in series with another (weakest link):

f(g(x)) => y

My question is about using multiple hashes simultaneously on each block to avoid weaknesses (mutual exclusion of vulnerabilities)

for n of x:
    f(x[n]) \
             (x[n]')XOR(x[n]'') => y
    g(x[n]) /

Because the question is different, the answers are also different.

128-bits should be enough entropy - see this answer. Quantum computers may change this, but that's still theoretical.

It appears to be (relatively) easy enough to design a symmetric cipher where the only effective attack is brute force. AES has withstood some years of cryptanalysis and there are many other ciphers.

Asymmetric crypto generally needs much larger keys for equivalent security.

For hashes, and specifically for collision resistance, we need to worry about the birthday attack. In rough terms, than means a hash needs to be twice as long as the equivalent symmetric cipher. So SHA-256 is a good match for AES-128.

I should point out that both MD5 and SHA-1 had cryptographic breaks - the attacks are better than brute force. SHA-1 is a 160-bit hash, so brute force (with birthday attack) would require 2^80 operations, but the published attack used more like 2^64. It may turn out that SHA-256 has cryptographic weaknesses, but they would have to be significantly better than brute force to make an attack practical.


Best way to store passwords for a LAN tool? I am making an app in Python for linux as a front end to the router (to automate some tasks).

But I need to log in to the router before I can do any operations on it and since it uses a http-auth I need to send it the clear text password and hence the clear text password need to be stored on the system.

What is the best way to do this ? I mean, if I just hard code the password, anyone can simple look at the source code to obtain them. Should I store it in a database ? Or should I encrypt it and then use a master password to unlock it (Not preferred) ?

It depends on who you want to protect that password from. Given that you're going to transmit that in cleartext over the network, you're granting trust to locatl administrators.

If that is accurate,, you can place that password in a data file that is restricted to the local root users through the OS ACL. That way, anyone who acn gain access to it would be able to gain access to the password anyway.


What are the security risks of running a daemon as root even though SELinux is enforcing? On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system.

Are there any potential threats of running as root, even if the SELinux policies are quite well written and stringent?

The daemon collects device diagnostics and sends diagnostics data over IP network to a remote server. The utility is used to tweak a configuration file, that tells the daemon what all types of diagnostics are required to be monitored, collected.

A process running as root has more extensive access to various system calls, which increases the attack surface area. Even if SELinux is correctly enforced, there will still be an increased risk of kernel exploitation. The reason for this is that many system calls have checks to ensure that the process is running as root (more specifically, the checks are usually for CAP_SYS_ADMIN). If the process lacks those permissions, it quickly returns EPERM or a similar error. If it has those permissions, then a bug in between the quick permission check and the much later LSM checks can allow a process to exploit the kernel and disable SELinux, or more.
A privileged process may be able to take actions which SELinux cannot restrict due to there being no appropriate LSM hooks, which mandatory access controls tend to rely on. These hooks are scattered throughout the kernel and, each time they are reached, check whether or not the LSM has restricted the action. For example, after DAC checks (standard Unix permissions), an LSM hook exists that checks whether or not accessing a given filesystem object is permitted. Because the kernel is so complex and has such an extensive relationship with userspace, it is not possible to restrict everything. For one example, the risky ioctl system call (a catch-all syscall against file descriptors which allows kernel drivers to register what is in effect their own system calls) is not restricted by SELinux. In order to provide more fine-grained restrictions, you would need to whitelist the individual syscalls and their arguments. This can be done using the seccomp syscall filter.
No matter how tight you think your SELinux policy is, there is always room for improvement. For example, do you restrict the process' resource limits? Root processes are able to override resource limits, which can have security implications (for example, it is possible to disable ASLR for newly executed processes if you are able to control the stack resource limits).
Overall, there are four main risks that I can think of when running a process as root:

As explained above, the increased attack surface area may be exploitable.

The lack of defense-in-depth will mean that a bug in SELinux could lead to exploitation.

SELinux is not able to hook every possible action a root process can take.

No matter how tight the policy is, it can always be improved (e.g. do you restrict rlimits?)

Unless it is prohibitively difficult to run the daemon as its own user, I would suggest you drop privileges appropriately as if you were using no access control system at all.


Can a VPN decrypt my SSL traffic? Are VPNs able to decrypt SSL traffic originating from my use of services such as Gmail, Dropbox and Skype, Google Talk and HTTPS-enabled websites? I'm asking because I always turn off these and other services before activating a VPN and I'd like to know if it's necessary at all.

A VPN is no more hostile than the Internet "in general". The VPN is a "private network": it is protected against the large Internet; but if the VPN is itself an evil entity, then you are back to where you began. To a slight extent, a corrupt VPN would make the task a bit easier for the attacker because, by construction, all your packets will go through the VPN, but this does not change the situation in a qualitative way.

SSL has been designed to resist an hostile Internet. This still relies on a proper instantiation; crucially, you shall mind the browser warnings, because if you allow your connections to use an unverified server certificate, then security goes down the drain.

Of course, if your specific VPN included the installation of some local software, and you have reasons to believe that this software could be ill-intentioned towards you, then all bets are off. Practically, this software might have installed an additional root CA that it controls, which would allow an accomplice to mount a man-in-the-middle attack which does not trigger browser warnings. There are some enterprise products which do just that (employees have long learned that with SSL they can escape the filters used by their sysadmins on the workplace; sysadmins are currently getting up-to-date). Bottom-line: SSL protects the transfer of data between your computer and the target server; it does nothing about the integrity of your computer.


How does a fraudulent credit card charge to a Department of State work? I looked at my Credit card statement, and noticed a fraudulent charge to what turned out to be the NY Department of State.  This was especially odd to me, since I don't live in NY (and so was obvious fraud), but I also couldn't understand how a criminal could monetize this.
Some Googling reveals that other people have had the same form of fraud for over 4 years, as seen here.  My limited understanding of credit card fraud is that it normally involves purchasing a physical product, and then selling, or just using that product.
This form of monetizing fraud seems different, since presumably there's no physical product you're ordering from the NY Department of State.  How does this work?  How would someone make a charge of over $200 to the New York Department of State and profit in some way from that?

First of all, we don't know if the charge really came from the NY Department of State. This could be a company using a similar name to make it look like NY Department of State and thus get away with it, for some time, as it might be overlooked by NY residents.
Second, assuming the charge was indeed done by NY Department of State I see a few possibilities.
NY DoS might have a platform which allows paying with one credit card, then reversing it by crediting another one. It doesn't seem a good idea for the malfeasants to use a Government Agency for committing fraud, but I guess this would be an option.
A second possibility would be the following. Let's suppose John Doe owes them $200. Instead of paying, he goes to a criminal Alphonse Gabriel which agrees to pay their debt of $200 in exchange of receiving only $100. Alphonse Gabriel pays the sum with a stolen credit card, and receives 100 legit US dollars. John Doe manages to only pay half the sum.
This wouldn't be very bright for John Doe, either, as he would be located when investigating the credit card fraud, and -if found- he would have a much bigger problem that such $200 debt. But Alphonse Gabriel may not care about that.
A third option would be that a payment gateway have some unsecured system which allows a merchant to get payments stating as sender a different company (by changing some merchant id, perhaps). If then the charge-backs go to the NY Department of State, which might not scrutiny much the charge-backs it gets, that could be profitable. Or, if it was the result of a misconfiguration (e.g. a small shop which is charging everyone as the NY Department of State) this could be similar to the first case.
If there was a small company appearing as "NYS DOS CORP 518 473 8 ALBANY NY", it may not be much noticed by the people who knows what that charge is for, and only raise suspicion when they receive some fraudulent purchases which end up on completely random people statements.
A fourth possibility would be that it somehow was legitimate (maybe some proceeding that is handled out-of-state? or a contractor of several states that issued your charge with the wrong sender?)
Finally, remember that you can dispute the charge at your bank, and have it reversed. Given that someone seems to have been able to use it, I would recommend getting a new one issued.


Is using a working computer for private stuff at home safe? Disclaimer: I'm not asking for personal advide on that topic, it's more or less out of curiosity. For context, this is set in Germany.

A coworker of mine recently talked about her using the laptops (our company provides us for work) to do personal stuff at home. Stuff like surfing, online banking, youtube, shopping, etc.

I'm now wondering if this is a safe to do thing, or if the company can, for example, track what she was doing later on?

Edit: With a little research I just found out that the use of software like keyloggers seems to be illegal in Germany, if the person being monitored does not allow it explicitly (which we have not done). But what about other software, like tracking internet history or stuff like that.

If you do not own the device, assume that the owner can monitor everything you do on it.

Obviously the company can not monitor the traffic on the network since it does not pass through their network (unless you connect with a VPN). But there could be monitoring software installed on the computer, and your activity leaves traces that could be uncovered later through forensic analysis. Don't expect that you would be able to detect the monitoring, or clean up the traces.

There might be legal limits to what the company can do here, but I would not rely on them being strict enough. There might be loopholes, and laws may be broken. Just don't do stuff on your work computer that you don't want your boss to know about.


Relationship between threat analysis and attack modeling What could be the Relationship between threat analysis and attack modeling.

Both are pretty close, have different perspectives but I need to know the relationships or in other words, how can they got integrated in an organization.

Update:
Here are the two definitions found on net:

Cyber threat analysis is a process in which the knowledge of internal and external information vulnerabilities pertinent to a particular organization is matched against real-world cyber attacks.

Analyzing the threat is the steps of

defining the scope of threats/risks
Collecting/gathering necessary information
Analyzing the data (Threat/Vulnerability Analysis of Risks and determining the level of Risk)
Action, Mitigation & Anticipation
[Ref]

Attack Modeling
"One of the points we need to make here is that when you try to model things from an adversarial viewpoint, you are Attack Modeling, not Threat Modeling. When you start with a vulnerability, and see what kind of damage you can do, you are modeling an attack. This is how traditional 'bug hunting' "threat modeling" operates. So technically, we haven't been threat modeling at all, we've been attack modeling.

Examples:
THREAT: Getting our customer data exposed to unauthorised individuals.
RISK: The likelihood of getting our customer data exposed is medium and if realised would result in a $5,000,000 financial loss in addition to loss of customer loyalty.
ATTACK: Exploiting an SQL Injection vulnerability resulting in the bad guy being able to download the customer database.
It is important to remember this distinction when you are performing your security evaluations, threat modelling, and penetration testing."
Ref

I'm not sure where you got those definitions, but let me try to simplify.

The English word "threat" has many meanings.  "There's a threat of a hurricane this weekend."  "He threatened to hit me!"  "There's a buffer overflow threat."  Similarly, "Someone could use a buffer overflow to attack that."

In my book on threat modeling, I defined a 4 step framework for thinking about threat modeling:

What are we working on?
what can go wrong?
what will we do about it?
did we do a good job?


What steps need to do to identify security hole I use VPS hosting. Installed CentOS 6 and ZPanel according to this tutorial http://www.zvps.co.uk/zpanelcp/centos-6

Received warning from hosting provider:
This URL has been identified as a phishing site and is currently involved in identity theft activities.
URL: hxxp://111.11.238.177/www.connet-itunes.fr/iTunesConnect.woasp/
(url here and further are a bit modified)

Downloaded server files to local computer. Searched for itunes. Found logs like these

\var\log\httpd\access_log
111.11.160.253 - - [20/Oct/2013:15:18:07 -0400] "GET /www.connet-itunes.fr/iTunesConnect.woasp/ HTTP/1.1" 200 1326 "-" "curl/7.18.2 (i486-pc-linux-gnu) libcurl/7.18.2 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.10"
11.111.144.148 - - [20/Oct/2013:15:30:13 -0400] "GET /www.connet-itunes.fr/iTunesConnect.woasp/ HTTP/1.1" 200 1326 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows\t\t\t\t\tNT 5.2)"
11.111.33.36 - - [14/Oct/2013:03:26:49 -0400] "POST /www.connet-itunes.fr/iTunesConnect.woasp/inscription/ HTTP/1.1" 200 13392 "http://176.56.238.177/www.connet-itunes.fr/iTunesConnect.woasp/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.50.2 (KHTML, like Gecko) Version/5.0.6 Safari/533.22.3"

\var\zpanel\logs\domains\zadmin\mydomainname.com-error.log 1 443,00 KB 23.10.2013 09:12:56
[Tue Oct 15 02:47:30 2013] [error] [client 11.11.253.220] File does not exist: /var/zpanel/hostdata/zadmin/public_html/mydomainname_com/www.connet-itunes.fr, referer: http://www.mydomainname.com/www.connet-itunes.fr/iTunesConnect.woasp/

\var\var\zpanel\logs\domains\zadmin\mydomainname.com-access.log 111,00 KB 23.10.2013 09:12:56
11.11.253.220 - - [15/Oct/2013:02:47:30 -0400] "GET /www.connet-itunes.fr/iTunesConnect.woasp/ HTTP/1.0" 404 - "http://www.mydomainname.com/www.connet-itunes.fr/iTunesConnect.woasp/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)"

\var\zpanel\logs\domains\zadmin\anotherdomain.lv-access.log 4 386,00 KB 23.10.2013 14:02:56
11.11.164.110 - - [15/Oct/2013:02:47:36 -0400] "GET /www.connet-itunes.fr/iTunesConnect.woasp/ HTTP/1.0" 404 42823 "http://www.anotherdomain.lv/www.connet-itunes.fr/iTunesConnect.woasp/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)"

\var\zpanel\logs\domains\zadmin\anotherdomain.lv-error.log 196,00 KB 23.10.2013 12:41:40
[Tue Oct 15 02:47:36 2013] [error] [client 11.11.164.110] File does not exist: /var/zpanel/hostdata/zadmin/public_html/anotherdomain_lv/www.connet-itunes.fr, referer: http://www.anotherdomain.lv/www.connet-itunes.fr/iTunesConnect.woasp/

\var\log\httpd\error_log 36,00 KB 23.10.2013 13:08:36
[Tue Oct 15 03:50:03 2013] [error] [client 11.111.23.90] Directory index forbidden by Options directive: /etc/zpanel/panel/www.connet-itunes.fr/
[Tue Oct 15 05:28:28 2013] [error] [client 11.111.140.53] File does not exist: /etc/zpanel/panel/favicon.ico, referer: http://111.11.238.177/www.connet-itunes.fr/iTunesConnect.woasp/
[Sat Oct 19 17:46:38 2013] [error] [client 5.49.165.166] PHP Notice:  Undefined index: donnee2 in /etc/zpanel/panel/www.connet-itunes.fr/iTunesConnect.woasp/inscription/index.php on line 277

Found one file (virustotal.com identified as PHP:Shell-BH [Trj], PHP/BackDoor.BT, VEX16c0.Webshell, PHP/PhpShell.NAJ, Backdoor:PHP/Shell.Q). Using that file hacker seems can get full control by server files (see, delete, upload, modify); I checked the file on local computer (wamp).

But from all the above I have no idea where is security hole. Location of that file was etc/zpanel/panel/bin/. Does it means that hacker hacked ZPanel? Found one related discussion here http://forums.zpanelcp.com/thread-8604.html But no solution. Please advice what steps need to do to identify security holes

Unfortunately, the log entries you show do not necessarily relate to the vulnerability which allowed the attacker to enter in the first place. These logs show that the attacker pushed an infected file on your server and then used your server as an helper host in order to infect other people -- your server was used as a simple file server. The URL beginning with "http://", then your IP address, then a "/", then a "seemingly honest server name", is an obvious attempt at making human users believe that they are downloading the file from an official iTunes source, and not your server.

The fact that the file was located within the ZPanel directories may indicate that the vulnerability used by the attacker did not grant him full access, but only allowed him to push a file of his own, in a directory that the attacker does not fully control. This would be a good case for you: it would mean that the vulnerability is indeed in ZPanel, and that your machine may be salvageable (i.e. it was only partially breached into). Note that a few Google searches reveal that the security of ZPanel is being questioned.

However, we cannot logically exclude a darker scenario, where the attacker took full control of the machine, and pushed the file in the ZPanel directory only so that you would have low probability of stumbling upon it yourself. If that is the actual scenario, then you will have to reformat the complete server (the "nuke for orbit" cure).

In any case, in order to identify the first vulnerability, you have to look for earlier log entries. The dates of creation / modification of the file on your filesystem may give clues as to when the file was pushed on your server. This may have happened quite earlier (the attacker may have left the file "dormant" for some days or weeks before actually using it for his phishing scam).


Can apps read other apps' RAM content on iOS? Can iOS apps read the RAM contents/cache/data of any other arbitrary app? Assume that the following conditions applies:

The device is using only official iOS (no hacks or "jailbreaking")
Obviously (due to the above conditions), all apps are downloaded and approved/signed by the App Store
None of the apps are using exploits (or all known exploits have been patched) and programmer API restrictions are working as intended
No other app on the device has been specifically set up to communicate with the app that wants to read the data

Context: preventing apps from snooping on each other. In particular, could a malicious app that somehow got through screening read RAM contents from every other app and harvest login cookies or personal information?

According to the Apple developer docs it appears that apps are sandboxed to prevent this from happening; apps that want to share data have to be specifically set up for it (?).

Searching on Google only turned up 2 Q&A's:

Can someone read a iOS class variable from outside the app?
Read data from other app's memory, is it challenging on a jailbroken device?

both of which only discuss the topic in the context of using a developer kit or jailbroken devices, neither of which are on topic in this question.

No, this is not possible without the use of exploits. Even in Android, this is not possible.


Is it more secure encrypting 3 times with GPG? Let's say we are using 3 different length passphrases and 3 different algos to encrypt sensitive data, e.g:

gpg --symmetric --cipher-algo CAMELLIA256 < input.zip > output1 (random 100 characters length passphrase)
gpg --symmetric --cipher-algo AES256 < output1 > output2 (random 150 characters length passphrase)
gpg --symmetric --force-mdc --s2k-mode 3 --s2k-count 65011712 < output2 > output3  (random 200 characters length passphrase)

Is this a much better solution than using only 2. step? Or just wasting time? Is this more vulnerable?

You may be surprised to learn the answer is "you are probably less secure."

Security isn't simply asking "can someone else hack my crypto?" Security is a big picture for protecting yourself and your data that includes three main attributes: Confidentiality, Integrity, and Availability (the CIA triangle.)  What your proposed solution does is it adds a lot of complexity.  A year from now when you try to remember all three pass phrases, and what order you have to decrypt them in, and did you get all the file types and options on the command lines correct, you might find yourself unable to get to your own data.  And because you're doing this on your own, you're not following a standard that other people use; this means you can't look up "how to effectively use three different forms of GPG encryption" and hope to find the right answer that works for you.

By creating such a complex, non-standard process, you are adding risk to the availability of your data.  This reduces your security.

Against this added risk, consider ways you can offset that risk with a gain in confidentiality.  Are you aware of any specific threats to GPG using AES-256?  (If you do know of something, don't use it at all!)  Are you aware of any specific threats against a 150 random character passphrase that would be offset by using a second algorithm with another 100 random characters of password? (For what it's worth, the rest of the world is unaware of any such flaws in GPG; if they were even surmised to exist, the code would have been patched.)

Your greatest risk is almost certainly not the cryptography.  Instead, most risks to security come from flaws in operational security (OpSec.)  Most importantly, you want to secure yourself against accidental releases of information.  Is the box secure and malware free?  Is it online?  Is the software and OS patched and current?  Did you download gpg from a reputable repo; did you confirm the hashes?  Did you compile the gpg binary from source yourself?  Did you use a cryptographically secure random number generator to create the 150 character password, or did you generate it using the output of random()?  How and where do you store the 150 random character password string - might you lose it?  Might someone else find it?  After encrypting the original data did you securely delete it, or did you just drop it in the recycle bin?

After taking these kinds of ordinary precautions, then you can consider the possible existence of external threat actors who could be highly motivated to deliberately steal your secrets (depending on their value).  Have you checked for a keylogger hidden in the cable or buried in your hardware?  Is there a camera observing the keyboard?  And are you re-checking all of your security measures every single time you enter the password?

If you don't understand the risks with crypto at a mathematical level, do not try to re-invent ways of stacking it together imagining you are improving security in some unknown way.  Instead, broaden your attention and make sure you are doing all of your security well.


Active Directory "Forgot password" feature without email or text We're currently looking to implement a secure AD password self-reset feature for our users. Our scenario is to manage people who forgot their password, not those who want to change it. Our users are usually based on remote locations and most of the time don't have access to a VPN. Our first thought was to provide a web-interface where users must authenticate using their username and an authentication factor which could be:

A private question/answer;
An OTP sent by text message to a user's
pre-registered mobile phone;
An OTP included in a password reset link sent to a user's pre-registered private email address (e.g. Gmail).

But due to organizational constrains, we cannot rely on text messages to send an OTP, and we don't consider the question/answer to be secure enough. So we are left with the private email option, which still concerns us because:

The email provider or the email account could be compromised;
The email provider will be able to associate an email with our organization (which can be an issue sometimes);
We consider it would open the door for phishing attacks - going against our communication to users saying that they should never, ever open a link that pretends to come from the organization on a private email address.

So is there a way to allow users to reset their AD password without using text messages or private emails, and without using a commercial (paying) solution?

The problem is that when a user has forgotten his password, you need a special procedure. Private question/answer is generally seen as a poor way, because users generally do not remember what they asked first, whether it was upper case or lower case... and if they can remember it without risk, then anybody that knows about them could answer too... Anyway you say you do not find that secure enough.

But if you want something else, you have to find a other channels. Common ones include a secondary mail address (said differently a secondary authentifiable identity) => something you know and text message on a mobile phone (something you have) - and I can hardly imagine others. Ideally, if your security requirements are medium to high, you could combine both:

when a user has forgotten his password, he asks for a reset procedure (on a HTTP semi-public page - no authentication here)
you send him one unique token on his private mail (no link in order not to break the anti-phishing com...)
you send him a second unique token on his phone with a text message
when he has got both, he connects on the reset page, types his id, the 2 tokens and the new password he wants - the password should be typed twice to avoid typo

That way if either the mail of the phone have been compromised, or if one of the messages are intecepted, an attacker  would not have enough information to reset the password. But I must admit that users could find that complex...


Can unwanted software(like spyware) already present detect the user trying to install an antivirus software and go into hiding? Just wondering to make sure I completely clean up my device.

Yes, malware/spyware can indeed detect antivirus software and perform defensive mechanisms. This is a never-ending ‘arms race’ on how and where they hide code.

Fortunately, once a system is compromised there is no 100% accuracy on getting back to a clean slate without wiping the system back to a known good state.

In my enterprise environment, once we have any concerns, we blow the computer's data away and rebuild...

Best of luck!


Find seed used in Math.random LCG given a list of outputs Given one or two sequential Math.random outputs generated with Internet Explorer's linear congruential generator, is it possible to find the seed used in the LCG and find subsequent outputs? Here is the code given on the repo:

const double kdbl2to27 = 134217728.0;
uint64 sn;
sn = (seed * 25214903917 + 11) & 0x0000FFFFFFFFFFFFull;
double res = double((uint)(sn >> 21));

seed = (sn * 25214903917 + 11) & 0x0000FFFFFFFFFFFFull;

res += (double)((uint)(seed >> 21)) / kdbl2to27;
res /= kdbl2to27;

res is then returned as the Math.random value. I have tried working out the math on reversing the last two lines to get the seed to no avail. I think there's an intuitive bruteforce method I'm missing utilizing the fact that I have two outputs. If it's possible to do with one output that would be nice too.

I can suggest trying to put all of the known data and formulas through something like Microsoft Z3 or other SMT solver. However I can’t predict how long the search would take.


Security implications of using SETCAP CAP_NET_RAW In order to get around the 'problem' of applications requiring root privileges to run, I'm using:

sudo setcap CAP_NET_ADMIN+ep "$(readlink -f /usr/sbin/app)"
sudo setcap CAP_NET_RAW+ep "$(readlink -f /usr/sbin/app)"

to be able to use the required raw net functionality (In this case so python can use SOCK_RAW) without having to use sudo. What are the security implications of doing this in a customer facing environment? Could this be abused in an unforeseen way?

This is running on a Ubuntu server.

Capabilities are described in the capabilities(7) manpage.

To summarize and security-wise:

CAP_NET_RAW: Any kind of packet can be forged, which includes faking senders, sending malformed packets, etc., this also allows to bind to any address (associated to the ability to fake a sender this allows to impersonate a device, legitimately used for "transparent proxying" as per the manpage but from an attacker point-of-view this term is a synonym for Man-in-The-Middle),
CAP_NET_ADMIN: Basically no restriction in controlling the network interfaces, which includes not only the network card itself (modify network configuration, switch the card into promiscuous mode to capture traffic, etc.) but also firewalling (don't miss this one!) and routing tables (allows to route traffic through a malicious host).


Mandadory checks a client should make to verify a ssl/tls certificate Let's say I have a client, not a browser, that wants to connect with https to a server. It could be a python program, an android app or a library etc. Suppose the client has a list of trusted CAs and their public keys.

What checks the client should make to verify that the certificate is valid and avoid man in the middle attacks and what attacks is possible if the client doesn't make this checks?

I know a lot of libraries do this for you but a lot of things can go wrong. The question is mostly theoretical.

As far I have understood you should check:

If the issuer (CA) of the certificate is in your trusted list and the public key of the issuer is the correct one.
Check CN to match the domain/IP you are connecting
If the certificate is expired
Something about X509v3 extension and basic constrains that I haven't understood correctly.

And you should make a lot of checks about the cerificate genuinity, i.e. to avoid MitM or false-issued certificate by "so-called stolen" CA key. Take a look and star at Perspectives Project to have a full picture


Content of a penetration testing authorization Recently I conducted a penetration testing where I used the following text as authorization:

  Penetration testing authorization

  During a penetration testing is possible that:

  The performance of servers and networks is decreased.
  Lost of availability of some services.
  Access to confidential data.
  Modification of web site.
  Physical access to private zones.
  Employees suffer social engineering attacks.

  I acknowledge these risks and authorize yzT to perform a penetration
  testing in my company.

  John Doe, CEO of Some Random Company Inc.

  (Signature and date)

Is this right? Or should I add another information in future jobs?

The right answer is: get a lawyer and make it airtight. When it comes to legal documents it's the same as with crypto:

Don't roll your own!

Generally these things are 10-pagers offloading the (financial) liability to the client if things go wrong. Currently you just make the CEO accept the risks but you do not offload the liability back to them.

Every company also has their rown procedures and will also have other requirements such as and can't be done with the result of the pentest. These documents are quite vast and different for each penetration test.

Also more specifically social engineering can become a gray zone when it comes to segregation of professional and private life. Especially in more privacy minded countries (EU countries mostly) this can be very tricky to offload back to the client.


connect to another ip address remotely via tunnel can be traced? if I connect through the tunnel to my friend's friend work LAN, will use only his LAN (IP) and will not have my own internet at all, force entry connection and getting their internet to host my internet, is it possible to trace my physical location (address)? The only address government will be able to find is that, that ISP have on file for that particular IP thus my friend's friend work address, and it will be impossible for them to find my location?

The problem with this scenario is that you are relying on Network Address Translation (NAT) to hide your physical location.

This assumes that IP Address = Physical Location.

Large IP address sets like 34. *. *. * are owned by top tier providers, who usually sell an address range like 34. 138. *. * to local providers, who assign ranges like 34. 138. 17. * to a business.

Since there are limited IP Addresses most businesses have an internal network IP Address assigned to their employees separate from any Internet public IP addresses. Then the business keeps track of what internal IP address did which request out to the Internet and routes the response to the internal IP address.

This is called Network Address Translation or NAT for short.

Your friend's work most likely has a log of who logged in over the LAN VPN connection. Therefore the government can ask or serve a warrant to your friend's company to see who was on at a specific time. The trail will lead back to your friend. And because his work likely knows where he lives. It won't be hard to find you.

Also depending on the capabilities of the government, they might have physical address location capabilities that don't require the cooperation of your friend's company.

In order to protect yourself from government spying, try a network anonymizer like Tor ( https://www.torproject.org/projects/torbrowser.html.en ).


Why is PKCE secure against man-in-the-middle attacks? In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across PKCE, which I had not previously heard of. Swapping out the client secret for a short-lived nonce seems like a reasonable idea to me, but I can't figure out how we protect against what seems like a fairly clear man-in-the-middle attack. My thinking is thus:

The flow starts with Alice sending bob a hashed code challenge along with some assertion of her identity (like a session token). The challenge is hashed because it cannot be assumed to be secure. The server stores the hashed code challenge but otherwise follows basic OAuth2 and returns an authorisation code. All good so far.

The next step is for Alice to send the authorisation code and the now un-hashed code challenge back to Bob, now all encrypted in an HTTPS POST request. Bob can validate the code challenge by hashing the value and comparing it with the previous hash, and generate an access token for the authorisation code.

I understand that the reason this is "more secure" is because an interceptor ("Eve") would not have the plain text code challenge value in the second step, and thus, even if they heard the authorisation code, wouldn't be able to request an access token. My concern is, though, could Eve not just intercept the initial request and swap out the hashed code challenge for the hash of challenge she created herself? (In practice, I would imagine this being something akin to returning a false 302 response which redirects the user with a swapped out hash in the QS)Then the authorisation code would be associated with that challenge and not Alice's!

I've gone round this a few times and flip flopped between being happy I've understood it and not convinced, so it's probably a case I've thought about this too much. But if someone could explain why I am wrong in plain English I would much appreciate it :)

Thanks in advance!

Such a man-in-the-middle attack is prevented by the use of TLS.

RFC 6749, section 3.1 (OAuth 2.0 Authorization Framework) explicitly states that TLS MUST be used for the communication with the authorization endpoint. And even the introduction of RFC 7636 (PKCE) states the following when referring to the authorization request that returns the authorization code:

  Because OAuth requires the use of TLS, this communication is protected by TLS and cannot be intercepted.

The use of TLS (or IPsec) is further recommended for any OAuth communication by the security considerations described in RFC 6819, see section 5.1 (in particular the first two sub-sections).

The part that PKCE protects against is the possibly unprotected communication to the redirection endpoint. For native apps the custom URI scheme generally used might also be registered by a malicious app, allowing it to intercept the authorization code. But without code verifier it won't be able to request an access token.


Stdapi commands not showing in meterpreter session I created a android payload with public IP (android/meterpreter/reverse_https).
The stdapi commands(ls,cd,webcam_snap etc) are showing when the victim is in the same network.

But when I try to connect over the Internet( i.e. victim is in a different network) using a public IP, the stdapi commands do not show in the meterpreter session.

Further, the meterpreter session is quite unstable, and displays errors after sometime:

  meterpreter session is not valid and will be closed

With metepreter sessions, you need to make sure you migrate to a running application. So for example, when obtaining a session for Windows you would migrate to explorer.exe

If you want to migrate, list the running applications with ps and then it will give you the list. After that, you type migrate [application PID] without the brackets. This should stop your meterpreter session is not valid and will be closed situation.

The stdapi will only be given and only load if the module is handing you administrative rights.


Secure point to point remote access to NAS drive This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?)

I'm looking to set up remote access to a NAS unit locally sharing via samba. I'd like to set up access on a remote PC (all windows) that would see the NAS unit as a mapped network drive.

From what I understand I have two options (I'm open to more this is just all I am aware of at the moment):

Set up a dynamic IP hostname, forward the necessary ports, and map the net work drive on the remote system. (how much of this is encrypted/secure?)
Set up a VPN server and have the user connect to my network to have access to the mapped network drive. (should encrypt everything)

Option 2 would be the obvious choice however I don't want all of the network traffic on the remote PC to also go through the VPN. I want only the mapped network drive interactions to go through the VPN. Is this possible? Is another approach better for achieving this?

In addition I don't want the remote PC to have to manually connect/disconnect to gain access, and furthermore, they may have an existing VPN they are already routing through. Am I asking for too much?

If it matters, the NAS I have in mind is Synology.

My preferred method is SSHFS.

Your NAS server runs a SSH server which you then connect to from your remote machine. Leveraging SSHFS it will mount a drive on your remote machine via SSH (secure, encrypted) from the server you specify.

I've not used the windows client version so YMMV.

https://www.digitalocean.com/community/tutorials/how-to-use-sshfs-to-mount-remote-file-systems-over-ssh

HTH


What is preventing us to start using scrypt in production ? After a lot of reading the expert opinion on password hashing, I understand that scrypt (which is both memory hard and CPU intensive) is a good candidate for password hashing. But I saw the experts recommending a wait of at least 5 years until it is thoroughly peer reviewed and baked (chicken and egg problem ? :) )

In 2015, can we take the plunge and start using scrypt with confidence ?
Is there a plan to make this a standard / recommendation by NIST and other standard bodies ?

ref 1

ref 2

If we want to look for rational reasons not to use scrypt right now, we can find mostly these three:

It is unclear whether a "memory-hard" function is what is needed, with the parameter configurations supported by scrypt. Scrypt was initially designed to support local encryption, particularly whole-system encryption. This means that the password must be hashed during the system bootup process; at that time, the computer has nothing else to do, so the whole CPU and RAM is available for a single scrypt; and since bootup already takes a non-negligible amount of time, a password hashing extending over 5 or 10 seconds is no hardship.

A typical server will need a distinct configuration, that uses less RAM (a server cannot afford a gigabyte per password hashing, if it has to serve several clients and not crumble under peak load) and less CPU (a Web site authentication should be done within less than 1 second, because users are not patient; and, there again, we must account for peak load). Whether scrypt is better than bcrypt when configured for "server usage" remains to be seen; in fact, if you need to put CPU usage down to about 1 ms per hash, then scrypt uses less RAM than bcrypt, making the latter a superior option.
As far as memory hardness is concerned, scrypt turned out not to be as optimal as it could be. Some GPU-based optimization is still doable with time-memory trade-offs. The attacker's gain is not devastating, but if we are to change our password hashing function then we may as well try to find one that fulfils its promises.

Such issues, and other information, can be found in this presentation. To summarize: while the ideas expressed in the scrypt design are quite interesting, the general feeling of cryptographers is that there should be more research; and, indeed, it prompted the PHC: an open competition, in the spirit of past efforts such as AES, SHA-3 or eSTREAM, where new candidates are proposed and reviewed.

If you deploy scrypt right now in production, then it should be reasonably strong, although it depends on the parameters you choose. That is the main conclusion of 5 years of research: the cryptography is sound, there is a time-memory trade-off which is not damning, but we don't have a lot of guidance on how to configure it in ways that will work well in typical servers.


Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App? I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA):

<?php

if (isset($_GET['Submit'])) {

// Retrieve data

$id = $_GET['id'];
$id = stripslashes($id);
$id = mysql_real_escape_string($id);

if (is_numeric($id)){

    $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";
    $result = mysql_query($getid) or die('
' . mysql_error() . '
' );

    $num = mysql_numrows($result);

    $i=0;

    while ($i < $num) {

        $first = mysql_result($result,$i,"first_name");
        $last = mysql_result($result,$i,"last_name");

        echo '
';
        echo 'ID: ' . $id . '
First name: ' . $first . '
Surname: ' . $last;
        echo '
';

        $i++;
    }
  }
 }
?>

Is it possible to crack that?

Also, my other concern is on Medium level. It does have the mysql_real_escape_string() working, but when you use the same SQL injection from Low level AND you remove the quotes, it bypasses the protection. Why is that? How come it was so easy to bypass mysql_real_escape string?

The code (concise version) of the Medium level is this:

   $id = $_GET['id'];
   $id = mysql_real_escape_string($id);
   $getid = "SELECT first_name, last_name FROM users WHERE user_id = $id";

The ‘high’ example is not exploitable. It's not a good approach (in modern code you would use parameterisation instead of calling mysql_real_escape_string, and stripslashes is a relic of an era of magical quotes that is thankfully over), but it is designed not to be immediately vulnerable.

(To SQL injection anyway. It is vulnerable to HTML-injection leading to XSS issues, thanks to those horrible echos, but that's another story.)

  How come it was so easy to bypass mysql_real_escape string? [in the Medium example]

Because mysql_real_escape_string is designed to escape characters for safety when included in an SQL string literal context. Without any surrounding single quotes in the query's injection point, you're not in a string literal context, you're in a raw SQL context.


Wireshark Decode HTTPS Root Certificate I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some stuff about decoding HTTPS but the problem is I dont have there private SSL Certificate.

I was thinking, is it possible to add a own SSL Root Certificate and add it to my system. So I then can decode the HTTPS?

First off all what software would I need other then wireshark? And How can I then decode the traffic in wireshark?

Im useing windows,

Regards Janniek

Try using Fiddler2.  It is free and has a built in HTTPS stripping proxy for exactly the kind of thing you are trying to do.  The one trick is that the application will know that the certificate doesn't match so it may or may not complain, but something like Fiddler2 is your best bet at trying to see what's on the HTTPS connection.  (You may also be able to add Fiddler's root cert to your trusted certificates to make it think it is valid, but it depends if they are looking for a particular cert or just one the system sees as valid.)


Is it safe returning or giving away a sim card you already used? I bought a prepaid sim card and used it on my android, but i had a problem using it and would like to return it. Is it safe to do so? I'm wondering if it could now contain my personal information since I used it, kinda like a hard drive?

This begs one and only one question:

Did you manually store any data on the SIM card?

No? Then yes, it's perfectly fine to return.

Older devices, like feature phones, that didn't have a lot of built in storage or had incredibly slow storage would store text messages or phone numbers on the sim card to save what little space they had and keep your things easily transferable. Eventually they realized how dumb of an idea this was and stopped doing it. So unless you have forcibly saved contacts to your sim, or text messages, or your phone is dirt old, then there is very little to no data on the sim card other than what was already on there.


Running windows in virtual machine, should I bother with security? I'm running Windows in a virtual machine on my mac (via Parallels).

Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)?

I don't care about data in the virtual machine since I'm using Windows just to run some software which I can't in OSX. So if something goes wrong I can just re-install windows from scratch.

Conversely I care about the data I have on my mac and even though I do regular backups it will be really bad if I happen to lose them.

Your virtual Windows is on the same network with your OSX, so the same threats of having an infected device on a network applies to this VM. Your VM is equivalent to a PC in your network its not much different. The same security practices that apply to your PC also applies to your VMs.

Although OSX does not run the same malicious apps that run on windows machines, that VM can still be a threat to rest of the devices on the network.
It can also consume your machine's resources in case it becomes infected and make your host machine slow too.
At times you may login to your email/cloud account on the VM to download something and in case the VM is infected with a keylogger, your data can be stolen.
You may connect a USB Flash drive to the VM to transfer files elsewhere and infection can spread this way.

Try to keep the guest operating system along with softwares used in it updated at minimum. If you use it moderately get a free antivirus like microsoft's Windows Defender.

One other threat is Ransomwares, Parallels Desktop has a feature that shares some of your OSX folders with windows. If your windows VM gets infected with a ransomware, it can possibly encrypt your shared files causing damage to your important data.

Looking at Virtualbox's manual chapter 13, Security guide. Other than the points mentioned above plus the clipboard which SilverlightFox mentioned, it says:

13.3.4. Potentially insecure operations

  Enabling 3D graphics via the Guest Additions exposes the host to additional security risks; see Section 4.5.1, “Hardware 3D acceleration (OpenGL and Direct3D 8/9)”.
  ...
  When Page Fusion (see Section 4.9.2, “Page Fusion”) is enabled, it is possible that a side-channel opens up that allows a malicious guest to determine the address space layout (i.e. where DLLs are typically loaded) of one other VM running on the same host. This information leak in it self is harmless, however the malicious guest may use it to optimize attack against that VM via unrelated attack vectors. It is recommended to only enable Page Fusion if you do not think this is a concern in your setup.
  ...

While you're using a different hypervisor, it is imaginable that same type of risks also apply to that.


CryptoWall 3 - how to prevent and how to decrypt? My father's computer is now infected with CryptoWall 3, according to the link below.

http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#CryptoWall

Is there a way to decrypt the files? I will try to recover them but according to the link, the virus safe deletes the copies of the infected files.

What is the best way to prevent these kind of virus to infect our computers? Are there any way to prevent execution of unknown files? I was thinking about only allow execution permission on known files.

First: there's no known way to decrypt files attacked by CryptoWall. Unless you pay to get the key, they are lost forever. If you don't have offline backups, your files are lost.

One way to prevent the execution of those kind of viruses is to use whitelisting on your Windows. This can be frustrating if your father does not know how to include applications on the whitelist, and will demand a lot of time to do right, but will deny execution of any application not known.


Creating pointers to keys on SmartCard I am new to OpenPGP and SmartCards but I cannot find how to do a fairly straight-forward task.

I am trying to sign a file with a private key stored on a YubiKey device.

Here is my session:

$ gpg --card-status
Reader ...........: Yubico Yubikey 4 OTP U2F CCID 00 00
Application ID ...: D2760001240102010006096334120000
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: 09633412
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 3
Signature key ....: B692 4360 F06A AB92 1B9A  3E6D 3850 24E1 EE26 F6D9
  created ....: 2019-05-14 14:44:27
Encryption key....: [none]
Authentication key: B692 4360 F06A AB92 1B9A  3E6D 3850 24E1 EE26 F6D9
  created ....: 2019-05-14 14:44:27
General key info..: [none]
$
$ gpg -K
$
$ gpg --list-keys
$
$ gpg --with-subkey-fingerprint -K
$
$ gpg --refresh-keys
$ gpg --list-keys
$

I looked at some posts like this one: Create backup Yubikey with identical PGP keys  but I am still not sure what I am doing wrong.

All I need to is somehow use the signature key to sign a file via

gpg --sign -u <key-id> somefile.txt

I need to somehow create a pointer in my local keyring to the Signature key and figure out its id.

I am using gpg (GnuPG) 2.2.12 and libgcrypt 1.8.4

Any suggestions?

The card needs to be referenced from the secret keyring.  The card is not a substitute for your keyring just a safer (in theory) place to keep the secret keys.

When you initially told gnupg to generate a (sub)key on the card or move an existing key to the card it will have manipulated your secret keyring on disk to contain a stub pointing to the card and slot where the key is stored.  You need your secret keyring from wherever you were when you initially set up the key on the card.  This should enable gnupg to find the key in its current location.

If you only have subkeys on the card and not the primary key then the primary key will still be in this secret keyring which would mean that anyone with access to it who can guess the password could generate new subkeys which defeats the purpose of the card.  If this is the case then keep the copy of the key with the real secret key somewhere safe.   To make a safe version of your secret keyring (where the primary key is inaccesible) you can use gpg2 --export-secret-subkeys then import the file wherever you need access to the secret subkeys (including the ones on the card).


What makes a SQL Injection count as blind injection? Firstly, from what I have read so far, boolean-based blind SQL injection is when you can't see any error messages and rely on true or false responses to queries to milk the database. For example, you can craft a query that will ask the database whether the the first character of the table schema name is an "E" or whatever. And you can keep asking until you have the database name, table name and column names to dump the information you want.

I understand that there is also time-based blind SQL injection, but I'm not concerned about that.

Secondly, I have seen many articles & YouTube videos saying that what they are showing is a blind SQL injection (because no error messages are shown). However, they are still able to use UNION SELECT queries to pull information out from the database. For example, id=1' UNION SELECT 1,2,3,table_name from information_schema.tables. Doesn't this count as UNION-based SQL injection? If not, what is this called?

By rights a pure blind SQL injection doesn't allow you to use UNION statements. Am I right? Is there anything wrong with my understanding?

Most of what you say is correct.

The UNION statement in regard to SQL injection is just another way to attempt to break/change/extract data. It can be blind, partially blind, or not blind at all, this depends on the server, code, and error reporting.

If the injection doesn't output any data, but does effect the behavior of the site in a way that you can interpret as having done something different than normal, it is considered partially blind.

If the injection doesn't output any data, and there is no change in behavior of the site at all, this is considered totally blind.

Using UNION may or may not change the outcome, but isn't inherently linked to being blind or not.


Hacking a Cisco 2801 Externally 2 days ago, we had a maintenance checkup in our server room. I noticed that the inspector was carrying a 6 meter fiber-optic cable, and a handheld strobe light with his equipment.

Now, I had an external email sent to me saying that our network has been compromised, as well as quite a few internal IP's, Computer Names, and Login Passwords.

Can this router be hacked using a fiber-optic cable and a strobe light?

(Quoted on behalf of a friend)

With physical access, so many parts of your network could be compromised. I'm not sure I would be looking at the cable and light, but at more basic things, like USB drives, rogue wifi access points, computers left logged in...


Does Ubuntu Server have a "phone home" feature? I've heard that Ubuntu has some sort of "phone home" system that is enabled by default.  The kind of stuff that passes along performance information and that type of things to Canonical.  I don't know if this is true or not, but if it is happening, how would one disable it for a secure environment?

I'm not worried about something like this https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-amazon-ads-and-data-leaks

As there won't be a GUI installed and don't think that Linx/lynx would be passing back advertising information to Canonical.

Like its parent Debian, Ubuntu includes popularity-contest, a package which sends information about the system's installed packages back to Canonical (or for Debian, the Debian project) so that they can learn what packages and architectures people use most.

Both Debian and Ubuntu install the package by default, but disable its functionality; it must be explicitly enabled.


Can SSL/TLS compromise anonymity (e.g. when using HTTPS via Tor)? If I understand correctly, SSL/TLS doesn't just encrypt traffic, but also offers a framework for (optionally?) authenticating servers and clients.

So, if I, for example, open an HTTPS connection through Tor, could the SSL/TLS handshake give away any information about my identity to the HTTPS-server that I am connecting to? Like my local IP address, or some other unique ID that it assigns to my system, etc...

Could this depend on the connection settings used? If so, is there a way to configure Java's SSLEngine to make sure that it doesn't leak any information about the system it is running on?

TLS always authenticates the server (except in some variants that are never used on the web because they're only useful in very specific environments). This is necessary because if neither party authenticates the other, then they cannot ensure that they have an encrypted connection, as opposed to each having an encrypted connection to a man-in-the-middle who decodes and forwards the traffic. The server in an HTTP connection is not anonymous anyway.

TLS only authenticates the client if the client offers to be authenticated. This feature is not commonly used on the public web, mostly on intranets, and more commonly with protocols other than HTTP (for example email clients). Your client is not going to accidentally send a certificate that authenticates it: it would have to create a certificate first, and it would typically not use the same certificate with another client. Of course if you use a client program that you don't trust, it may reveal information about you, but doing it by creating and using a client certificate is a very unlikely method.

TLS itself doesn't send any directly identifying information about the client, but like with any other layer of the protocol it can reveal information indirectly through fingerprinting. The fingerprinting of a TLS client is mostly about which features it advertises to the server (which cryptographic algorithms and optional protocol features it supports).
For anonymity, your best bet is to stick with the Tor browser in its default configuration, so that your fingerprint matches the fingerprint of everyone else using the same configuration. If you use another client, then sticking to that client's default will likewise usually minimize the information leaked through fingerprinting.


MD5 Algorithm: A basic explanation of the process Could anyone please explain the basic idea and steps involved in the MD5 algorithm?

I tried reading it on the web (Wikipedia etc.), but it was just too high level for me.

So, can someone explain the whole process in a very crude way so that I can later go through and understand a more detailed version from a book or a site?

The simplest way to understand MD5 is to implement it from the specification, which is rather simple.

In very crude words:

The data to hash is a sequence of bits. Let's keep things simple, and let's assume that it is a sequence of bytes. A few extra bytes (the "padding") are appended to that sequence, so that the number of extra bytes is between 9 and 72 (inclusive) and the total length after padding is a multiple of 64. The specification explains the contents of the padding; basically a lot of zeros, and an encoding of the input data length.
The padded data is split into blocks of 64 bytes. The blocks will be processed one by one. Processing of each block (64 bytes) takes as input a 128-bit value (16 bytes) which is the output of the processing of the previous block, and outputs a new 128-bit value.
Since the first block has no previous block, a conventional fixed value is used to start the process. The MD5 specification details that value.
The complete MD5 output is the 128-bit value you get after processing the last block.

The processing of a single block splits both the 128-bit value obtained from the previous block, and the new block to process, into 32-bit words (4 words for the previous value, 16 words for the block). All computations are done with these 32-bit words. The overall structure has been described as akin to an encryption algorithm lying on its side: the 64-byte block is used as a kind of key to encrypt the 128-bit running state, in a generalized Feistel scheme. I am aware that such an assertion does not really explain things -- to really get what is going on in the algorithm, use your favourite programming language and try to implement it.

(Any language should be fine for such a task, since it is merely about learning, but some are less fine than others. For instance, Javascript's numbers are really floating point values, which is cumbersome for implementing MD5. Java and C# are good for such tasks, notably because they have integer types with a guaranteed 32-bit length, exactly what you need for MD5.)

You might also want to read this answer, which tries to explain why hash functions are "one-way", and takes MD5 as an example, so it includes a description of MD5.


How a buffer underflow can lead to remote code execution on 64‐bits? I have the following summarized pseudo code in C89 from an ssh server library that provide only access to things like git‑shell (/bin/bashis replaced with the program to run, so it’s not possible to do something else) :

struct _raw_uncapped_ssh_string { // no limit on the size of the string;
    uint32_t len;
    char non_null_terminated_string[]; // by protocol design it have a minimum length of 1
};
typedef struct _raw_uncapped_ssh_string raw_ssh_string;
union buffer {
       void * uncapped_zlib_decompressed_network_data;
       // yes, the size is uncapped, so it’s possible to put 4Gb of
       // data in it that would be copied later into memory. zlib
       // allow easily to turn some Mb in Gb of data, but it’s not
       // the point of the question.

       raw_ssh_string st;
};
get_command (compressed_network_data) {
    size_t len;
    char * command;
    buffer string=uncompress_to_buffer(compressed_network_data);
    len=ntohl(string.st.len)+1;
    command=malloc(len+1);
    command[len]=0;

    // here’s the point, both the string length and content as
    // well it’s supplied size is controlled by the attacker.
    memcpy(command,string.st.data,len);

    return command;
}

Here’s how the command is executed later (the stringcommandis unchanged afterget_command()).

const char *args[]={"/bin/bash",command,NULL}; // /bin/bash isn’t the shell, it has been replaced by git‑shell.

// redirect the program output to the network.
dup2(stdin, 0);
dup2(stdout,1);
dup2(stdout,2);
close(stdin);
close(stdout);

//if this return execution failed and print an error message
return execv(args[0],(char * const *)args); // I don’t know which is the system, so I can’t know about the libc behaviour.

I can’t domemcpy(command,string.st.data,0)since the third member ofmemcpyhas a minimum size of 1, and in my context,size_tuses a 64 bit integer, I can’t perform a buffer overflow, since there islen.

All I can do is to setlento a value larger than the one allocated tostring.st.data. This is a buffer underflow enabling me to read unallocated memory.
I can read the server memory, however, I can’t see what sensitive data a public ssh server can hold (in my case the list of users that can perform ssh is public).

So does a buffer underflow onmemcpyallow remote code execution ?

In general, no, a buffer underflow cannot be used for remote code execution.  Since attacker-controlled data never leaves the space allocated for it, it never has the ability to take over the program's execution flow.

A buffer underflow does have the potential for other types of attacks, such as information disclosure (if the program is counting on the buffer's original contents being wiped out by the new data).


Dropbox Breach - Can I trust 2FA to protect my account? Due to the recent Dropbox credentials leak I'm wondering if my second factor authentication will be enough to be safe. I've check my mail in https://haveibeenpwned.com/ and it appears to be compromised.

I'm using Google Authenticator as two factor authentication utility, is this configuration enough?

No. It is not enough. You need to trust the service to handle the second factor right. So you need to trust dropbox.

The google authenticator probably calculates the OTP value based on TOTP (RFC6238) (in fact it can do HOTP and TOTP). I.e. if you registered a Google Authenticator TOTP with dropbox, dropbox needs to save the symmetric secret key. If they are stupid, they will save it in the same database table like the hashed password. If the attacker retrieves your user's row of this table, the attacker has

a) the hashed password and can start an attack like @WhiteWinterWolf pointed out and

b) can use the secret TOTP key (if it was not encrypted) to immediately calculate TOTP values. (also see https://netknights.it/en/the-problem-with-the-google-authenticator/)

Thus - using a 2nd factor you registered at one service does not immediately mean, you are safer.


RAM Encryption. Is it possible? Without adding any additional hardware, is RAM encryption possible? If so are there any known and currently used implementations for Linux or Windows systems? And if this is something that is possible without extra hardware, is there any software available that can perform this task without needing to reinstall the OS?

Without adding any additional hardware, is RAM encryption possible?

Sure.
You can encrypt whatever you like in RAM, just like you encrypt everything else.
The more interesting quesstion is "where are the keys". You can just leave the keys in RAM as well or give them to the OS which will also store them in RAM.
You can apply some of the fancy techniques proposed by Schneier et. al. in Cryptography Engineering, i.e. one-time-pad encrypt the key to your data, store the pad in RAM and decrypt data only when needed.

  If so are there any known and currently used implementations for Linux or Windows systems

Windows offers the Data-Protection API (DPAPI), letting you encrypt data using the user's log-in credentials. I know that at least some password managers (like KeePass) use this to protect the valuable passwords in RAM.

Using a Trusted Platform Module (TPM; which get increasingly popular as Windows now requires them) or some other dedicated hardware would indeed solve the issue best by offloading the key to a place you trust in case the RAM is compromised.

However there's one solution that is rolling out right now: Intel's Software Guard Extensions (SGX), shipping with Skylake and newer CPUs. They allow you to load a program into your processor, verify its state is correct - remotely - and then protect its execution. The CPU will automatically encrypt everything leaving the processor (i.e. everything that is offloaded to RAM) and will thereby ensure security for you. The only problem for mass deployment is that SGX requires you to have a signed code that your processor will accept, i.e. Intel must issue you a certificate for this purpose.


Is web app safe in not public folder? I'am wondering if it's really safe to use this structure of my web application.

WEBAPP
    Application
        Controllers
        Models
        Views
        ...
    Framework
        ...
        Core
    Public
        ...
        index.php

If I point a website root folder to the /public, so if someone comes to my web page i.e.: www.mywebsite.com ... he will be accessing the /public folder where the index.php is located. My question is, will it be really that safe to not moving my application's core files into the /public folder but into upper level instead ?

Or is it possible to access the webapp/application/ and webapp/framework/ from webapp/public/ folders by some hackers ?

Normally all *.php files (if setup correctly) will be executed, and nobody will be able to download it's source code.  When you have files such as db-functions.inc, people may be able to render this in their browsers; which is what you don't want.

The handy thing of having non-public accessible directories is that you can store backups files (dbdump.sql, backup.zip, ....) and you won't be able to download it directly from the browser..

BUT:

  Or is it possible to access the webapp/application/ and
  webapp/framework/ from webapp/public/ folders by some hackers ?

Unfortunately, yes.  Although it's not possible to go to the directory directly (on proper web server software, one cannot simply do www.site.com/../hidden/hiddenfiles.zip), if your website has directory traversal vulnerabilities , it may be possible to access files outside of your webroot.

Input sanitation is key, the linked wikipedia article is actually a good read-up.


Do we still need to encrypt/decrypt data in Application Layer, despite using TLS/SSL? Actually I got some projects from my ex-colleagues. These are App-Server TCP socket based applications.
I noticed that some of auth/login interactions are using RSA/AES encrypt/decrypt

as I know, if we adopted TLS socket in transport layer, the data between us is encrypted.

so..if we use TLS, do we still need to encrypt/decrypt data in Application Layer Code? or it just a redundant effort.

Yes and No.

Encryption isn't a "have it" or "don't have it" sort of proposition. The concept of encryption only makes sense in context.

As an example that should more obviously demonstrate the failure: Imagine you have a document that needs to be kept safe. You upload it to your Dropbox account. Now, is it encrypted?

Yes, it was encrypted in transit. Dropbox uses HTTPS, so it was encrypted using TLS during upload (and any download). It's then decrypted on the other side after it's been transferred.

Yes, it's is encrypted in storage (as far as we know). Dropbox says they encrypt all data on their servers using keys specific to your account. It's then transparently decrypted for you on demand.

But No, the document is not encrypted in a way that matters to you. Dropbox syncs the files to all your computers, and stores a plain text copy on your machine. So if anyone looks at your computer, they can read the document without having to circumvent any encryption at all.

When encrypting data, you have to figure out what you're trying to protect and whom you're trying to protect it from. You need to understand what you're trying to prevent with your encryption. Once you understand what you're trying to accomplish, it should be immediately obvious whether the encryption you have is doing you any good or not.