Why download firmware from the internet when hacking CCTV cameras? I saw a video about the hacking of CCTV cameras:

He downloads the latest firmware from the internet.
He uses some reverse engineering on it.
He retrieves the password from etc/passwd file. And he logged in with root.

I don't understand why he downloads the latest firmware from the internet? As I understand it, the firmware is on the device, so we should do reverse engineering on that device.

The reason he downloaded it rather than getting it directly from the device is simply because it is easier to do it that way. When you download it, all you have to do is figure out the format and unpack it. When you take it from a device, you have to physically open up the device and often plug in complex logic probes and digital interfaces to the flash chip or EEPROM containing the firmware and extract it manually. That takes time and effort that could be alleviated simply by getting the firmware online.

There is the additional factor that you do not usually need to be in possession of the device in question to download its firmware. This can be important if the device is rare, expensive, or can only be purchased in another country. It sucks to have to open up and potentially damage a perfectly good device when you could just download the same firmware it uses and get the same results.

See also How do I extract a copy of an unknown firmware from a hardware device?


Triple handshake attack against TLS Triple handshake attack was discovered lately, and to quote the article "The secure renegotiation indication extension only binds handshakes on the same connection, but does not apply if the session is resumed on a new connection.", that is to say, after an initial handshake in one connection, the old session is resumed in a new connection and then the resumed session would be renegotiated in the same connection.

However, if the resumed session is in the same connection as the original session, can this attack still exist? Intuitively, it still exists, since the renegotiation will only check the finished message of the just closed session which is the resumed session rather than the original session. Is it right?

The Finished value checked by Secure Renegotiation is for the previous handshake on the same connection as seen by each party, but the attacker had to tamper with the initial (full) handshake, so the check values differ. Look at the items in red in their figure; those cause log1 and log1' (prime) to differ, similarly log2 and log2'.


How do I verify versions of Adobe? I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. Does anyone know how to look for the versions of Adobe in Wireshark? (or any tool that will remotely pull the versions would be helpful).

**edited. I did say Apache in my first question. I found the Apache article and had that stuck in my head when I wrote it. I need ADOBE versions.

It's EVERYWHERE... like a virus.

Adobe uses Apple's Bonjour service also known as mDNSResponder.exe to communicate with the mother ship. More about Bonjour here. Adobe transfers things like licensing, usage, and error data. They also run a service called armsvc.exe which is the Adobe Acrobat Update Service that also calls home to check for updates periodically. Adobe has a video about how to remove mDNSReponsder on their TV site.

If you're running a Creative Suite on your server (not likely, but not unheard of) you'll also get traffic from different plug-ins in various apps that connect to web services, also anything that uses the Creative Cloud will also likely transfer data and try to authenticate a license, as well as all web programs like Dreamweaver, Muse, and Flash obviously.

If this is a Windows box, you can use sysinternals process explorer to check for different running apps and the company name of the owner of the process. If it's a Mac server then you can open activity monitor to see what's running, in addition to top via command line.


How did the Shattered.io group manage to create a SHA1 collision for a PDF that is similar looking to the original? So I've been trying to understand what a SHA-1 collision is and what it means but there's one thing I'm not quite understanding.

How did they manage to not only find two documents with the same hash - but also one that looks visually almost exactly the same as the original? All the text is the same and the only difference is the background colour.

My understanding is that the really difficult part of this was finding any two document where the hash matched and that it took $100k of computing power to do this.

Wouldn't it be substantially harder if you were restricted by only collisions of documents that looked similar? Did they plan ahead for this to happen or was it just a coincidence?

The main idea behind this attack relies on Differential cryptanalysis.
You have two inputs t0 and t'0 with a difference of Δ0. Once these two inputs have gone through the function f (the compression function in the case of SHA-1) you get a difference Δ1 and so on (see following picture)...

The goal here is to find a difference in the input Δ0 such that after some iterations you get Δ2 = 0, in other words no difference.

the SHAttered Attack

Because of the Merkle–Damgård construction of SHA-1, one can choose to alter the differences between the iterations in order to improve the differences to match his needs. In the case of the SHAttered Attack, they chose an initial prefix (P), then later on the next blocks they introduce a difference (M1(1),M1(2)) and remove it (M2(1) and M2(2)). At this point they already have their collision. They just need to continue with the same following blocks (S), leading to a collision on the whole input.

SHA-1(P|| M1(1) || M2(1) || S)= SHA-1(P||M1(2) || M2(2) || S)

The values of M1(1), M1(1), M2(1) and M2(2) are as follows:

The difficulty is thus to find the correct Mi that satisfy the chosen prefix criteria P and that cancel themselves nicely afterwards. The probabilities of such to occur are really small, thus the need of massive amount of calls to SHA-1 compression function (263.1).

In the case of the provided PDFs, they also give a nice infographic which explain where the difference is located in the PDFs:


Formula Used in Qualitative Risk Scales I am reviewing NIST SP800-30 rev 1 and I am having a hard time understanding how they determine the distribution of values within the risk matrix. In the document, they define semi-qualitative values – I am assume that these values are used in the calculation – however, the calculations are not provided. I am trying to programmatically calculate the result.

Here is is an example straight from the guideline:

My attempt using [Likelihood of Initiation] * [Likelihood of Occurrence], This does not yield the same results based on the scales provided.

What is the correct formula to calculate this?

Although I dont use this particular metric I use something similar.

The only time I've seen differentiation from the table is using greater then (vs greater then or equal to). You are using the minimum values out of a range instead of a midpoint.

In the examples you have using 9 vs 8 for the high value should do it. Quantative values like this are really just estimates.


What level of anonymity can I expect while using a library's user session? At the library, computer are typically open for internet browsing, if you can provide them your library card number.

To what extend can I expect to protect my internet browsing privacy from library's monitoring?

The short answer is in comments and @msw's response. There is, literally, no way that you can use the library's (or anyone else's) systems and/or infrastructure and have a 100% guarantee of anonymity.

If the system and/or network owner is determined to be able to monitor and log your activity, there is nothing you can do to prevent it except simply not use their systems and/or network.

Some options available to the "library":

Software keyloggers on the computer
These can be difficult to detect, but can easily be worked around (e.g.: use your own live CD/USB) if preventative measures are not in place. That said, preventing and monitoring for the workarounds isn't difficult either.

Bear in mind that "keylogger" here is a catch-all for any local monitoring tools which may in fact include screen capturing & recording or other methods of tracking your usage.

Hardware keyloggers on the computer
Depending on the implementation, these can be difficult to nigh-impossible for you to detect. Any attempts to assess a system for the presence of such devices is likely to draw attention.

Network traffic monitoring
Anything sent in the clear is an easy target. SSL/TLS, when properly implemented, can protect most data-in-transit but it will not obscure the addresses of the sites you visit. Some web-based proxies can be used to get around this, but it's also easy to block access to those.

SSL/TLS Proxy
For encrypted traffic, the network provider may set up a server that effectively acts as a man-in-the-middle for otherwise secure connections. They present themselves as you to the sites you visit, and as the sites you're visiting to you. Meanwhile, they can read all your traffic (SSL/TLS or otherwise) no matter where you go or what you do. (Bearing in mind that, at this point, the network provider still already knows what server you were trying to do it on.)

If the network provider also has ownership and/or control over the computer you're using, they can make this process practically transparent. Unless you're making a specific point to manually inspect the certificate of every site you visit, you'll never know what's going on. If they don't have such control (e.g.: you're using your cell phone or laptop on the free WiFi) you may see a warning pop up. Your options there are to click through the warning - thereby allowing the network provider to monitor your connection - or just not do what you were about to do.

Block what can't be monitored
Of course, every system has its limitations. And there's nearly always a way to work around common monitoring mechanisms. But these are largely well-known weaknesses and there's a simple way admins can force users into using only the applications, ports, and protocols they're capable of fully monitoring: whitelisting. They just configure the systems and network to only allow usage of the things they can monitor, and deny all others by default.

When the admin's got full control over the configuration of the network and/or system being used, they really can restrict the user to "their way or the highway". Of course, there's ultimately ways that nearly anything can be circumvented. But it's really hard to get around good security without being too conspicuous in a public setting.

Granted, this can come at the cost of user convenience and features. But would the admin rather let your the do whatever they want, or risk little Sally walking up to a workstation with the likes of tubgirl or goatse on the screen (to say the least of what could happen)?


Is reading from /dev/urandom on macOS Catalina a safe way to produce cryptographically secure data? I'm reading a lot about entropy on macOS...

I know it doesn't use Yarrow anymore as per this FIPS 140-02 doc a NIST compliant DRBG.

I read a lot:

https://github.com/briansmith/ring/pull/398
How can I measure (and increase) entropy on Mac OS X?
https://stackoverflow.com/questions/5832941/how-good-is-secrandomcopybytes
http://serverascode.com/2014/03/04/yarrow.html
https://stackoverflow.com/questions/3170500/random-number-generator-dev-random
https://stackoverflow.com/questions/42197958/secrandomcopybytes-provider-sha1prng-or-nativeprng-type-in-objc

Even mailed Craig F:
https://apple.stackexchange.com/questions/362531/does-macos-still-use-yarrow-as-its-cryptographically-secure-pseudorandom-number

I see that SecRandomCopyBytes is now effectively using:

https://opensource.apple.com/source/xnu/xnu-4570.41.2/osfmk/corecrypto/ccdbrg/src/ccdrbg_nisthmac.c.auto.html

While /dev/urandom uses:

https://opensource.apple.com/source/xnu/xnu-4570.41.2/osfmk/prng/random.c.auto.html

I have much old code using /dev/urandom, on Catalina is it still valid to use /dev/urandom/ for key material, is it cryptographically secure?

I don't want to port everything to a macOS specific lib.

Even libsodium seems to use /dev/urandom, so I guess it's ok?

So, somewhat serendipitously, Apple released an updated platform security guide in December just gone (Dec 2019).
Which directly covers random number generation for cryptographic purposes:

Random number generation
Cryptographic pseudorandom number generators (CPRNGs) are an important building block for secure software. To this end, Apple provides a trusted software CPRNG running in the iOS, iPadOS, macOS, tvOS, and watchOS kernels. It’s responsible for aggregating raw entropy from the system and providing secure random numbers to consumers in both the kernel and user space.
Entropy sources
The kernel CPRNG is seeded from multiple entropy sources during boot and over the lifetime of the device. These include (contingent on availability):
* The Secure Enclave’s hardware RNG
* Timing-based jitter collected during boot
* Entropy collected from hardware interrupts
* A seed file used to persist entropy across boots
* Intel random instructions, i.e. RDSEED and RDRAND (macOS-only)

The Kernel CPRNG
The kernel CPRNG is a Fortuna-derived design targeting a 256-bit security level. It provides high-quality random numbers to user-space consumers using the following APIs:
* The getentropy(2) system call
* The random device, i.e. `/dev/random`

The kernel CPRNG accepts user-supplied entropy through writes to the random device.

So the answer is Yes, it is still valid to use /dev/urandom/ for generating key material on macOS Catalina (10.15.2 (19C57)).
This also ends my speculation on whether 160-bit Yarrow or 256-bit Fortuna was at the heart of the CSPRNG.


Can a person be non-DDoSable? I have a friend who claims he cannot be DDoSed by a conventional web booter.

We have tested this with him multiple times.

The public IP given to us when he joins a server, I.e. client connection info on teamspeak3, is the ip that we try to stress via dns.

We use conventional methods to test this- but we are now curious, why is this the case? His public IP seems to remain the same when the attack hits.

Could someone explain why he experiences no lag from this? Why is his internet specifically like this, unlike others?

From a theoretical perspective this is impossible. The base of a distributed denial of service attack is flooding a system with so many requests it cannot keep up. No matter how little resources a system uses for processing, you can always add more requests to increase utilization, eventually reaching capacity.

From a practical perspective, yes, this can be the case. You have very little available attack power. There are many companies that have sufficient processing power to handle your attacks; your friend could be using one of them as an upstream, and malicious requests get dropped before ever reaching his local system. This is the basic idea behind anti-DDoS services.


Transparent pixel in nginx error log...Is this hacking? I'm assuming this is a hacker, but what gives here.

  2016/05/06 20:10:01 [error] 11878#0: *4135 open() "/usr/local/www/nginx/MYDOMAIN/public_html/images/G/01/x-loc
  ale/common/transparent-pixel.CB386942464.gif" failed (2: No such file or directory), client: 42.159.144.101, server:
   MYDOMAIN, request: "GET http://g-ecx.images-amazon.com/images/G/01/x-locale/common/transparent-pixel.CB38694
  2464.gif HTTP/1.0", host: "g-ecx.images-amazon.com"

Someone sent a request asking your server to fetch that image from Amazon, and your server interpreted it as a local file which it then failed to find (which is a good thing).

They were probing for an open proxy, which would return any requested URL to them.  This would let them visit any web site and as far as the site could tell the traffic would all come from you (although proxies and the true originating address can often?sometimes? be detected).


Why Qualys SSL Server Test is giving me 80 and not 100 in Key Exchange? My openssl ciphers -v 'CIPHER' output is the following:

ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256

I think that my server meet all theirs Key Exchange requirements to get a 100 SSL Server Rating Guide

My guess is that the DH parameters used for your DHE cipher suites use a 1024-bit modulus.

(I must say that this "scoring" is completely arbitrary and not very rational; awarding 128-bit symmetric keys a grade lower than the one for 256-bit symmetric keys makes sense only if 128-bit keys can be considered somehow "breakable" in the foreseeable future, which is a rather preposterous assertion.)


Is an SSH key with a passphrase a 2FA? This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)?

Indeed, I need the SSH (private) key, which could be considered as the first factor, and the passphrase which could be the second one.

If we compare to a single password for login, I see two 'elements'  with a passphrased SSH key.

A second factor is defined as independent of the first factor. That means your system should stay secure, even if one of the factors is compromised (and you are aware of the compromise).

For example, a door badge and a fingerprint are independent of each other, and just having the door badge or the fingerprint is not enough to gain access.  This is often called "multi-step authentication" instead of "multi-factor authentication".

Now imagine your scenario: You have a private key, encrypted with a strong passphrase. Are those two factors? No, because the private key can also exist without passphrase. An attacker that compromises the private key can thus log into your system, even without knowing that passphrase. In fact, the server is completely unaware if your private key is protected by a passphrase or not.

If you want true multi-factor authentication, there are SSH modules that do exactly that. That being said, a private key encrypted with a strong password is often enough.

  Note: The original question talks about "an SSH key with a Passphrase to login on a server", which I interpreted as a private key, encrypted with a passphrase.


How does a virus scanner inspect URLs entered in a browser? I have a virus scanner installed (avast on Windows 8) and it blocked the access to malicious websites in Chromium. There's no proxy activated in Chromium so how is the scanner capable of rejected a connection to some websites? Is there some kind of kernel module that has a low level access?

Anti-virus (AV) software usually install their own NDIS Intermediate Drivers or Windows Filtering Platform Callout Drivers which allows them to tap into the network traffic, modify it, drop it, divert it, and basically do whatever they want.

So when your browser sends a request to a potentially dangerous website, the AV sniffs the HTTP request parameters and compares the URL to a list of blacklisted URLs and when it finds it there it drops request. It's even capable of responding to your browser with a page telling you that the request has been blocked.


How to get more information on TermDD Security Layer Disconnects (Event 56) In my Admin event log, I see the following errors:

  The Terminal Server security layer detected an error in the protocol
  stream and has disconnected the client. Client IP: XXX.XXX.XXX.XXX

Sometimes I see IP's here that I don't believe should have access to my server. The server is 2008 R2, uses NLA and sits behind a robust network Firewall. I do NOT see any Security Events (either Successful or Failed) of these IP's authenticating, which leads me to believe they were not authenticated to begin with, but I am not positive. I also do not see any RDP\Terminal Logon or Disconnect events from these IPs.

How would I go about finding more information about these events after they've already happened?

This USUALLY happens during times of heavy traffic to the terminal server.  The connection to the server gets corrupted as traffic becomes too heavy to handle.  I had this happen with my users at a former job quite a bit and almost every time I would see one of these in the Event Viewer I could talk to the user with the IP in question and correlate it to the time when they got disconnected from their terminal session.

See this for a very detailed explanation.

Mostly, it's not of malicious intent, but there is always the chance that an attacker is trying to DoS certain aspects of your systems, including your terminal server; to what end or goal they would do this, I cannot say, other than the usual buffer overflow type objectives.  Again, we could go on forever about potential objectives.  Mostly I wouldn't be too concerned as this is a very common occurrence on RDS/Terminal servers for Microsoft.

I would, however, validate the IPs listed in the log and make sure they are authorized IPs that your private IP scheme allows for and that they were in fact from legit users on your network connected to the server.

You can also check the RDS/terminal server settings and see if there is a timeout set on sessions; there usually is a default one, so I'd look for that first.


How to get Hashcat keyspace for combined princeProcessor plus rule-based attack I am trying to do something like
 pp64 --pw-min=10 words.txt   |  hashcat -a 0 **--keyspace** -r myRule.txt

but this syntax is incorrect.  Is there a way to get the keyspace for this combined attack?

Keyspace from a piped source cannot be calculated by hashcat, because hashcat does not know how many words will be received (which should make sense, if you think about how pipes work in Unix).
If your rules are simple, you can approximate your total keyspace by running your hashcat command against a baseline wordlist (say, 10,000 or 100,000 words), and then multiplying that keyspace by the total number of permutations expected to be generated by pp64 (using the number from its own --keyspace parameter. But that is going to be very back-of-the-napkin, because keyspace calculation isn't always linear and doesn't necessarily mean what you might expect.
Instead, since you're probably looking to get a rough estimate of how much time it's going to take to run your attack, set keyspace aside. It isn't as useful as the actual runtime for time estimates.
Instead,  do the same baseline test run as above, but instead of using --keyspace, just run it long enough to get a stable time estimate from hashcat's status output.
For example, if 100,000 words with your specified ruleset takes 10 minutes, then multiply that time by the total number of permutations you're expecting from pp64, divided by 100,000.
That should give you a practical runtime estimate.


Correct auth method using oAuth 2.0? Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches.

Our specifications are:

Secure a REST API.
Own apps and websites connect to our API.
Users access our services without credentials.
Currently our API is private but possibly making it public in the future.

From the research I have done, I think I should be using oAuth 2.0 (Two-Legged) authentication with "Client Credentials" grant type.

I'm worried though that I may be misunderstanding the process, as it would seem that under this method all that is required is sending through your ConsumerId and ConsumerSecret. Whereas, the OAuth 1.0 method requires a HashKey, ConsumerKey, Nonce etc.

In Summary, my questions are:

Is the oAuth 2.0 (Two-Legged) using "Client Credentials" the best approach for me to take.
Is the auth flow as simple as sending your ClientId and ClientSecret and getting back your bearer token.

Thanks in advance

Sources I used for oAuth 2.0 (Two-Legged)

OAuthBible - Lays out all the different oAuth approaches

Shows how oAuth (Two-Legged) is implemented in 1.0 and 2.0

www.tomdupont.net/2011/03/oauth-1.html

If you are not authenticating the user, IMHO it does not make any sense to use oAuth.
oAuth is all for authenticating the user and authorizing an application to do stuff on behalf of that user.
if you want to authenticate your application with the API you can just use SSL with client authentication - that will do three things - authenticate the API to the application, authenticate the application to the API and encrypt the communication between them. SSL with client authentication requires that beyond the server sending its certificate to the client also the server demands the client certificate and can authenticate the client.

NOTE - this is just in case of a back-end application such as a web application. If you intend a client application to access your API you have no way to keep your API really private. In that case you can try to obscure your API from the public using some kind of token, but this token will have to be embedded in your client code which anyone with basic reverse engineering skills will be able to extract and use.


How detrimental is a NULL pointer dereference vulnerability today? Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via mmap()ing the NULL page and then memcpy()ing some shellcode which calls commit_creds(prepare_kernels_cred(0)); (or whatever else) from user-land to cause subsequent code to be executed in context of the root user (usually to spawn a root shell). This was a very popular exploitation method around over a decade ago.

A mitigation, mmap_min_addr, which prevents mmap()ing of low pages was introduced, and people (of course) found ways to bypass it (the articles I read were all in 2009). However, there are (seemingly) no (known or public) methods of bypassing this mitigation (and of course other kernel-hardening causes memory-corruption bugs such as this to become more difficult or completely infeasible too).

Given this, just how detrimental are NULL pointer dereferences today? It seems as though the best one can leverage is denial-of-service (in a modern kernel with mmap_min_addr enabled [perhaps neglecting ASLR, DEP/NX, SELinux/AppArmor/PaX/grsec, etc.]). Is it possible to leverage privilege escalation in particular environments? (Excluding disabling of mmap_min_addr, of course). And if so, what are some examples?

These days null pointer dereferences can only directly be leveraged as denial-of-service conditions, as the zero page is always protected against being allocated. There are cases where the dereferenced pointer is not null, but does point to deallocated memory (e.g. UAF in a JIT), and these can generally be leveraged to gain LPE or RCE in certain cases - the latter mostly being applicable to JavaScript engine vulnerabilities.

That said, triggering a null deref can often have secondary effects outside the scope of DoS, e.g. producing a stack trace or core dump that leaks sensitive data in a way that an unprivileged user can access it.


Do firewall rules have to be symmetric? That is, does a firewall have to block a particular traffic type both inbound and outbound Do firewall rules have to be symmetric? That is, does a firewall have to block a particular traffic type both inbound (to the protected site) and outbound (from the site)? Why or why not?

I have to answer the above question. What is the meaning of symmetric rules in firewall? can anyone please explain it to me

I believe you have some terminology mistakes in your question, but I still think I can answer it. To answer your question I'll explain both common types of firewalls, stateful and stateless. Both types of firewalls compare packets against their rulesets. Both work from a set of data often referred as a tuple, which typically includes Source IP, Destination IP, Source Port and Destination Port. There are some important differences I'm going to outline below.

Stateful firewalls maintain a table of connections. This means that once a connection is established, traffic that matches that session is allowed through the firewall. For example, if you created a rule that allowed port 80 from the internet to a system behind the firewall, the packet the server sent back as part of the TCP handshake would be allowed. Since a stateful firewall is aware of TCP state it is capable of filtering packets with invalid TCP header information.

Stateless firewalls are limited in their filtering capabilities compared to a stateful firewall, but generally are much faster because of their simpler rule processing logic. Each direction of a connection must be explicitly allowed since no state is saved and each packet is checked against the firewall rules each time. For example, if you created a rule that allowed port 80 from the internet to a system behind the firewall, the packet would be allowed as before. However, without a corresponding rule for the packet from the server back to the client, the response packet would be dropped. These firewalls are not generally able to filter packets with invalid TCP header information.


Active Directory Admin policy I work for a small company (35 employees). Earlier this year we implemented Active Directory (to support an enterprise level application). We didn't implement AD for AD's sake but to provide LDAP authentication for a line of business application. In this company I provide IT support and am responsible for all things computers. AD is not my strong suit. We hired a consultant who did a great job with the implementation.

Now, we're so many months into this and I'm getting a lot of complaints about security being too tight. This has grown to the point where the CFO (my boss) is asking to loosen the security by allowing a subset of our company to become PC-Admin users and several others to be allowed Domain Admin rights. Our consultant has repeatedly advised against loosening or sharing the Administrator controls. I've tried repeatedly to explain the value of what AD is and why the security is now so tight.

My initial response is no don't do it. I've said this much to him and it has not changed his mind. Basically, they want what they want and they're not as concerned with security.

My question to this community is: What options do I have?
I don't think I'm going to be able to change anybody's minds on this (both the CFO & CEO have stated that they want this changed). I also don't want to stand in the way of users being to do their jobs either.

We're running AD on Server 2012 R2 with all windows 10 clients.

I apologize if this is not the correct forum or if I have posted in bad form. This is my first post to Stack Exchange. I really appreciate all of the information that gets shared with SE and look forward to being able to contribute myself.

You will have to weigh decisionmaker risk tolerance against your overall business loss exceedance, typically both on curves of the same graph.

What is at risk (tell the CFO and CEO that what's at stake is the top-line of the company -- it's entire sales and all of its growth capabilities)? What will cost extra to manage installs and centralize Domain Administration as opposed to allowing willy-nilly admin access? If your company makes under $100M per year, then you are already fortunate to be running at a Active Directory domain functional level of Server 2012 R2 (which allows Protected Users) and utilizing the amazing security protections that default in Windows 10 client infrastructure. You could also stand to gain some advantages by adding SysMon and EMET log streaming to a centralized log infrastructure (a free one named MozDef, which runs on Linux, comes to mind but there are also free AutoRuns and SysMon Windows-based services). However, Windows 10 is so strong, it would only need EMET for the event-log capabilities.

Try to upgrade everything to Powershell v5, if not already. Windows 10 gives many advantages with Powershell v5 as well, but these advantages can work against you. Consider implementing AppLocker in any form (even as strong as whitelisting everything -- but you'll likely want to blacklist a few things, at least occasionally) which, when combined with Powershell v5, has Script Block Logging, Protected Event Logging, and Antimalware Scan Interface Integration  (AMSI). Please enable all of these -- they're free wins. If you really want to go crazy, get the Microsoft Advanced Threat Analytics platform. Do not loosen UAC policies, but ensure that servers have full/max UAC for any accounts used on them. Domain Administrator is very dangerous -- use Protected Users and mark these up with full UAC. Protected Users should only be able to log into servers and regular users only into their workstations (possibly by OU or however you categorize).

If decisionmakers can live with a 1 percent chance per year of losing anywhere from $5M to $75M, then you'll be fine with a few free tools, at least until you can prove out your program. I don't see any reason for you to provide any extraneous admin access to anyone (not even local). Have one or two sets of Forest/Domain Administrator accounts (never use them except in emergency, make their passphrases 30 characters long, safely print them, and then store in fire safe or two), and a few Protected Users (for those who need server or domain-change access).

If your time and the company's resources are better spent elsewhere, then don't do any of this. It's really unlikely you'll be compromised if you indeed have only Windows Server 2012 R2 with a domain functional level of the same and all clients are Windows 10. One XP machine can mess this all up, though. One user with local admin or domain admin privileges can completely mess this up. Your consultant is right to tell you that handing out admin accounts willy-nilly is weak form.

My suggestion is to grab the book Windows PowerShell in 24 Hours, Sams Teach Yourself and use its guide to install OneGet, Chocolately, and ChocolatelyGUI. Then you can use your powers as admin to make installs and upgrades of applications very easy for everyone. Another alternative is to get the book Learning Puppet for Windows Server, but this will require a Linux server for the Puppet components. Using Foreman (a web UI for Puppet), you can setup normal users with just enough access on Foreman to install apps to their PCs. This way, you do so through the Puppet agents and not through admin accounts.

When you log in to a computer as Domain Admin on console, through runas, or via RDP you are severely degrading the ability of each system to defend its registry, especially the Security (especially Policy Secrets) and System hives. Attackers use tools such as mimikatz to access these hives, but can also pull tokens out of running processes to impersonate Domain Admins. The best way to avoid running as Domain Admin is to use the Protected Users, as well as either WMI (through wmic) or PS Remoting to make changes, install things, et al.

Your job is to enable the business by protecting it. You are being challenged by people very skilled at negotiation -- so you have to understand it's a little give and a little take. What you can't allow to be taken is control of admin rights -- i.e., privileged-account management. You could show them that you could do so if you were given an allowance to purchase all of the solutions from CyberArk, BeyondTrust, Varonis, and STEALTHbits, but that a typical integration of those four solution sets costs around $10M. Instead, offer to solve the problem by providing better-quality service from yourself regarding changes and installs. If you can automate this via Chocolately (or OneGet) and/or productize installs through Foreman, then you are really seeing win-win with your C-levels. This is known in negotiation as a BATNA. If all else fails, tell them that by giving away admin access, the 1 percent per year for a loss of $5M to $75M still applies but that they are adding a separate other 10 percent per year for a loss of $10M. See if they like those numbers and want you to give up access still. They'll probably ask where you're getting those numbers from. Tell them howtomeasureanything.com/cybersecurity

A lot of my answer comes from the information culled out of this slide deck -- http://www.info-assure.co.uk/public_downloads/Talk%20is%20cheap-IR%20tools%20can%20be%20too.pdf


How to make an outbound request to users to update their passwords? Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their passwords?

Technical half: changing the password

The simple and secure way is a round-about, "You don't."

When a user logs in with their old password, display a notice saying they must reset their password. Generate an email with a reset token and send it to their email address. The email address token must be used because we no longer trust the password (and we hope that the email address is still under a users' control).

Human half: discussing a breach

If you're requesting users update their passwords, it may be because you're changing hashing algorithms. That really should happen behind the scenes, or involve reclaiming old accounts rather than leaving them dormant. It probably is because you've encountered a breach, though.

Breaches affect customers even if you don't hold any sensitive information because online presences are often linked (same username, email address, etc.) and because passwords are often re-used. If you've lost control of your password database, users may be at risk of having those passwords brute-forced and then used against accounts from other sites.

Regardless of your motivation, the technical method of changing passwords remains the same. If you've had a breach, though, disclosing that is important for your ethical duty to your users and sometimes for legal requirements depending on your jurisdiction. How the letter is written is a combination entirely of legal and subjective matters, but it should explain why users may need to be concerned about other accounts and why they need to reset their password on their next login.


PHP Handlers and Caching I recently began configuring our production server for a new Drupal site.  Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except where image uploads, etc may occur.  The vps we purchased is from a company that actually removes this from the WHM configuration choices, leaving suPHP as the default.  I can override this, but I'm now thinking about the impact this choice has for both security and performance.  Because suPHP doesn't allow for caching via APC, or other tried and true caching systems, I was wondering if a DOS attack could be more effective?  In a previous project, a botnet group that seemed to originate from a hacked flash program, was continually "clicking" something that generated ajax requests.  This did in fact cause MYSQL errors to be visible at one point, and even seemed to trip up the authentication (I didn't verify this, but I remember a non admin seeing admin privilege protected pages), so I wonder if the ajax request was cached if this could have occurred?  I have also read that caching itself can be the target of a DOS attack...

If you're not running an opcode cache then you're DOSsing yourself already, particularly if you're running Drupal! It makes for a nice business model if your renting out server hardware!

There are some edge cases where running suPHP makes sense from a security point of view (but the number of these is massively reduced by php-fpm's support of pools per user) - but this is not one of them. (if you were using php-fpm, then it might be worth considering having a dedicated user for handling the file upload path).

The best protection against a DOS attack is having the capacity to deal with it. The second best option is being able to profile the attack and easily inject specific handling / blocking.

  and removed write privileges for any directory/file except where image uploads, etc may occur.

This is not enough on it's own - you also need to disable PHP parsing (and, preferably any direct webserver access) to the uploads dir.

Controlling your server via WHM is not a good idea if you're concerned about security.

Regarding the previous attack...this is a seperate question, and there's not nearly enough information to hazard a guess - even if that information were available, it's probably beyond the scope of an answer here. It's rather unlikely that the PHP config would cause the symtpoms you describe ('I remember a non admin seeing admin privilege protected pages') - it's more likely to be a code defect  / issue elsewhere in the stack.


How can I create a password that says "SALT ME!" when hashed? How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his user database will see the "hash", realize the insecurity of his application, and eventually make the world a better place for everyone.

Md5 outputs 128 bits, which is 16 bytes. If I had a 16-byte message, getting the original plaintext password would be equivalent to a pre-image, which to my knowledge is practically impossible. However, I'm only looking for 8 specific bytes in my hash.

Is obtaining such a password feasible in day-timeframes on a typical computer? If so, how can I compute such a password?

The output of MD5 is binary: a sequence of 128 bits, commonly encoded as 16 bytes (technically, 16 octets, but let's use the common convention of bytes being octets).

Humans don't read bits or bytes. They read characters. There are numerous code pages which tell how to encode characters as bytes, and, similarly, to decode bytes into characters. For almost all of them (because of ASCII), the low-value bytes (0 to 31) are "control characters", hence not really representable as characters. So nobody really reads MD5 output directly. If someone is "reading" the hash values, then these values are most probably encoded into characters using one of the few common conventions for that. The two most prevalent conventions are hexadecimal and Base64.

With hexadecimal, there are only digits, and letters 'a' to 'f' (traditionally lowercase for hash values). You won't get "SALT ME!" in an hexadecimal output...

With Base64, encoding uses all 26 unaccentuated latin letters (both lowercase and uppercase), digits, and the '+' and '/' signs. You could thus hope for "SaltMe" or "SALTME". Now that is doable, because each character in Base64 encodes 6 bits, so a 6-letter output corresponds to 36 bits only. Looking for a password which yields either "SaltMe" or "SALTME" will be done in (on average) 235 tries, i.e. within a few minutes or hours with some decently optimized code.

Note, though, that someone who actually spends some time to read Base64-encoded hash values probably has some, let's say, "social issues", and as such might not react the way you hope.

And it is done: When hashing with MD5 then Base64-encoding the result:

infjfieq yields: SALTMEnBrODYbFY0c/tf+Q==
lakvqagi yields: SaltMe+neeRdUB6h99kOFQ==


What parts of an SSL Certificate can I share without revealing the Certificate Authority's identity? I want to share information and screenshots of my SSL certificate to help identify a potential security issue.

The potential security issue involves private company-owned computers which list my employer as the Certificate Authority. As such, I do not want to reveal information about the CA which could potentially reveal my employer's identity.

What parts of an SSL Certificate can I share without revealing the Certificate Authority's identity?

Based on my understanding of your question, you are trying to prove that your employer is intercepting and inspecting your HTTPS traffic.

Ok, you've found your company's CA cert in your java trust store. That tells us that they have the ability to perform the MitM attack that you are describing, but it does not prove that they are actually doing it. That cert may be there for a completely legitimate reason, like for example so your VPN client can authenticate the VPN server, or so you don't get certificate errors when connecting to internal network resources.

To be sure that they are inspecting HTTPS traffic, you need to actually catch them in the act. When you make a TLS connection that you suspect of being MitM'd, look at the server cert you are presented; if it chains to your company's CA then that connection is being MitM'd and you'll have proof, but if it chairs to a publicly trusted CA then it's secure.

You'll need to do some digging about the java application you're using to figure out how to see the details of each TLS connection (you may be able to do this through JVM settings, but I'm not sure). Browsers, for example, are quite good about showing you the details of the TLS connection.


Media players (vlc, spotify and windows media player) don't work after a virus attack I just got attacked by a couple of viruses while my laptop was completely unprotected. I installed the necessary programs and tried to get most of the symptoms to go away. I also think I deleted most of the malicious files both with the antivirus and manually.
Now everything seems quite normal on my computer but for one thing: I cannot play music or videos with VLC, Spotify or WMA. For Spotify the songs just skip after one second without making any sound whatsoever, WMA says it can't play file, while VLC just counts the seconds without producing any sounds. I still play YouTube videos and the likes but I can't figure out what the problem is with this stuff.

The standard advice we give on recovering from a malware infection is "nuke it from orbit". By which we mean wipe the computer, reinstall the Operating System and Software from known good copies (such as a CD or a download from the vendor) and then very carefully restore your data from backup.

The reason this is the standard advice is that modern malware is usually modular. The first bit of malware gets in, and then it installs a range of other pieces of malware. So even if your AV reports that it has removed the original infection it detected, you can't be sure that other malware has been installed that the AV hasn't found.

It might not actually be remaining malware that is causing your current issue (I suspect it more likely that the malware or the AV's cleanup has damaged some files, probably a codec.) But you can only be sure with a complete reinstall of your OS.


Should I trust my bank after this I have just discovered that I can login to my bank with passwords that is not mine.

Example:

My password is "1234" but I am authorized with all possible post characters. For example "12345" or "12341234" will authorize me.

Also note that my password was assigned to me by the bank (four digits) and the login is a normal html form (username input type text/password input type password)

Why would any bank design such a auth protocol and is this something I should worry about?

The meta question on whether you trust your bank is not answerable here :-)

However the core question is answerable:

  Is accepting further characters after my password is matched good practice?

If they have a fixed 4 digit passcode, then they will just be truncating at 4 and dropping the rest - which means it won't affect your security at all.

To actually find out whether they are truncating, you'd need to ask the bank.


How could disabling 'Hide File Extensions' in Windows make a system more secure? I'm reading up on the Cryptolocker virus, and I came across this comment, it says:

  And one additional measure: disable the default "Hide extensions for known file types" check box in Explorer. I still consider this one of the stupidest moves MS ever made in Windows.

The comment has 17 thumbs up, and comments below agreeing. I've never heard this before? How does this make a system more secure?

Consider a file named doubleclick.pdf.bat.  If "Hide extensions" is enabled, then this will be shown in File Explorer as "doubleclick.pdf".  You, the user, might go ahead and double click on it, because it's just a PDF, right?  It'll load up in Acrobat if you do that, right?  When, in truth, it's a batch file, and whatever commands it contains will run when you double click on it.

That's why "Hide extensions for known file types" is a stupid move in Security terms.  It allows an attacker to create wolf files that look like sheep.


Information disclosure via ktpass tool The Microsoft ktpass tool can be used to generate a .keytab file that contains a secret key. I'd like to understand the output of the tool.
An example output can be found here. I'm interested in the following part:
keylength 16 (0xdd74540caa4a230af2ed75558a37995d)

The Microsoft documentation is quite vague on the exact meaning of this output. Is this the actual key that has been generated? What would an attacker be able to do with this information?

It is in fact the final derived key.
It's not particularly leaky in this context because as the caller you already have access to the raw secret (you need the password to generate the file), as well as once all is said and done you have the file itself which contains the keys in cleartext.
Of course if someone is taking the output of the tool and logging it somewhere broadly readable, well, that's certainly bad.


Telling donors we will no longer accept card information in writing What is positive wording for telling donors we no longer accept card information in writing, for their security?

I'm assuming this is to avoid having to take special physical security precautions for all of your correspondence to comply with PCI-DSS (if you aren't sure what that is, then I've made a bad assumption). For the benefit of other readers, PCI-DSS is not limited to computer security; it also covers telephone sales and other low-tech physical methods, right down to the venerable "knuckle-buster".

How will you accept their card information? Over the phone, on a secure web site, etc? I would emphasize the approved secure methods of supplying payment card information first, and then either not even mention other methods you won't use, or if you must, simply convey that your bank will not accept card information obtained any other way.


Does TRESOR protect against attacks like HeartBleed I was wondering if the linux TRESOR module (http://en.wikipedia.org/wiki/TRESOR) would protect a webserver against HeartBleed or other similar attacks.

No. TRESOR only provides a method of storing AES encryption keys in the CPU. It will not prevent an attacker from stealing certificates, user information, password, or whatever else may present in the server's RAM


MITM or Something Else? Problem:

When a given set of user devices (tablets/laptops) downloads files from a certain server from outside the host server's country, downloads are sporadically and routinely interrupted. The cause is unknown.

If the downloads were to occur domestically within the host server's country, no problems would be experienced, regardless of distance.

This behavior occurs using any download method, including browsers such as Chrome, Safari, and Firefox.

WGET produces some more information on the error as follows:

Read error at byte 139935417/324659120 (A TLS packet with unexpected length was received.). Retrying.

(WGET then reconnects and finishes the download. These interruptions occur multiple times during a download.)

To rule out any concerns about connection reliability, it can be confirmed the connections are considered stable and reliable.

Question:

What could be causing this error, and, could these errors be failed MITM attempts?

Based on the location of the server in relation to the location of the client, there is a high probability it is indeed a malicious attack of some unknown type. Perhaps not MITM, but something which does illicitly interrupt the connection. The attack could be considered sophisticated because it occurs randomly on an active TLS connection. (Random to the user, on command to the attacker).

Neither the server nor the client are within the possession of the attacker, and the attacker is yet able to interrupt an active international TLS connection at will. Serious stuff. If it is verified to be an attack, state sponsored actors are likely the culprit.

This type of attack is documented in CVE-2014-3466 for GNUTLS as a memory corruption attack, termed the 'Hello Vulnerability'. A bug report or security report should be submitted to bugs AT gnutls.org so that this issue can be studied.

Further information on this vulnerability can be found here:

http://radare.today/posts/technical-analysis-of-the-gnutls-hello-vulnerability/

-and-

http://gnutls.org/security.html


Should cookies that contain non sensitive information be encrypted? I'm in the process of creating a website and uses cookies to track user login. The only bit of information I store in this cookie is the users username.

Should I be encrypting the username even though it isn't sensitive information such as a password?

I've noticed other sites which use cookies to track logins have all their cookies information encrypted.

What potential security threats could arise if I weren't to do this and the only bit of information in the cookie is the username?

Forget about encryption. You are tracking user logins through cookies and the cookies only contain usernames. How much difficult it is for someone to predict someone else's usernames. If you don't encrypt the session information, there is always the threat of someone sniffing the cookie and hijack the session. But in your case I think a user not only can hijack a single session, he can hijack every login session just by changing the username in the cookie. OWASP recommends a session ID of length 128 bits generated through a cryptographically secure Pseudo Random Number Generator (PRNG). Take a look at OWASP session management for further details.

Once you configure the session management according to the OWASP session management guidelines inside your web application code, establish an encrypted tunnel and communicate over the encrypted tunnel. A lot of people use SSL for the login part but as soon as the user is authenticated, communicated reverts back to HTTP. Make sure the cookie is always communicated over the encrypted tunnel as well. If session cookie is in plaintext, a user who sniff the cookie over the network can replay the cookie and gain access to the user account. Firesheep is a tool that demonstrate the exploitation of this vulnerability through a single click.


What is the difference between tunnel mode and transport mode in IPSec? In tunnel mode, whole IP datagram including IP header is encrypted and new IP header is appended to packet. But in transport mode IP header is not included in encryption and kept as it is. It is said that tunnel mode provides more secrecy as routing information(source, destination addresses) is hidden(encrypted). But my confusion is, what difference does it make when IPSec gateway(in my ipsec is enabled at router) is anyways going to modify ip header for NATing purpose?

Without IKE NAT Traversal
If you tunnel it is possible to get through the NAT with an outer header that is modified but dropped during decapsulation. The inner header remains exactly the same as it was when encapsulated and was protected by ESP. This is described in rfc 3715 4.1.
If you use transport mode, you want to use the same IP header as NAT has modified. This is not possible while checking the integrity as this is a violation of integrity as defined for AH.
With IKE NAT Traversal
If Traversal is configured, traffic appears to be on UDP ports (500 or 4500).
The traversal manages transport's header integrity problem by substituting back the original IPs. Consequently, both modes should seem much the same, but tunnel has size overhead of keeping a real header and transport has more manipulation to reconstruct a header, so more potential for integrity check failures.
As an example, an unusual IP option can be neatly handled in a way that is hidden from the NAT in tunnel mode, while it may cause compatibility issues being on the packet being routed.


Security implications of stolen .git/objects/ files As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers.  The attacker accessed the .git/objects/ files.
I already modified .htaccess to make .git and its content inaccessible.
The attacker may get some model file which includes some data queries but not with database credentials.  Should I worried about it?

Should I worried about it?

Worried? No, of course not.
You should be absolutely terrified and have nightmares about this.
Having stolen .git directory means the attacker have the current and past source for the production server, all history of all code since the start of the repository. With that, they can reconstruct your infrastructure, and do a white box testing against the code.
They will be looking for remote code execution, file inclusion, and SQL Injection right now. And your developers must review every function handling user supplied data (cookies, parameters, URL queries, etc) for any possible vulnerability.
You did a good start by denying access to .git on the servers, but your work is just starting. Your code is now known to attackers, and they are inspecting the code for vulnerabilities. If any time someone hard-coded credentials on the code and commited it, the attacker have that password.
Things you should do:

full code review from a reputable company
consider using a Web Application Firewall
install IPD/IDS (Intrusion Prevention/Detection Systems)
change every single database password
rename the database if possible

Be prepared to fight fine-tuned targeted attacks.


How to report a security vulnerability involving multiple unrelated companies? While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products.

All those issues aren't security vulnerabilities per se, but they become one when combined. None of the issues is more critical than the others.

I would like that vulnerability to be fixed, so I plan to report it to vendors.

Following responsible disclosure guidelines, each report should not contain information about the other vendors' issues, but I'm afraid that all vendors will reject the report, explaining that their issue is the expected behavior.

Each vendor has a security program and a competent security team. The only problem is communicating the issues' impact to each of them.

What would be the best way to handle this problem?

Involve a trusted third n-th party.

While JonRB's approach can work, involving another trusted party, like a national or transnational CERT, can speed up the process and bring it to the desired outcome.

We have seen in the past, that big companies did not react properly to reports of major bugs/vulnerabilities in their products. The companies in question either did not react at all, did not try to develop a solution or sometimes the issue just got lost in a big corporate labyrinth. This ultimately led researchers to publishing vulnerabilities on their own to pressure vendors.

When you involve another trusted like a CERT, you can be relatively sure that the affected companies will realize the seriousness of the matter and handle the issue with a certain elevated attention.

Be sure though, that you trust the party that you plan to involve. If the companies that are involved are based in different countries there is probably no one single entity with authority over all of them. Luckily most of the world's bigger CERTs work together and are (somewhat) organized.


What is "KDV" in antivirus databases? I scanned a file (virus) on VirusTotal and 3-5 antivirus labelled it as Generic.KDV.549626

Is there any central "KDV" database where all the entries related to a virus are stored?

Each anti-malware company develops their own databases for this kind of thing. You would have to look up that entry on each vendor's db in order to better understand what it is.


iPhone Credit Card Payment I am trying to understand what is the best way to implement a credit card payment flow into a native iPhone app. From what I see on the market, most of the apps use a WebView to process the payment. I haven't found examples of native implementation of it. What are the drawbacks of a native solution? Is either one of these solutions PCI compliant?

Using a WebView makes a lot of sense.

You have to be connected to the Internet anyhow.
Performance is not an issue.
There's lots of already written and well tested web-based payment processors.
Many people (and you specifically) already have a web-based payment processor in place for non-mobile uses.
More secure since as much as possible is on your servers rather than in the client.
Apple less likely to demand you use the built-in payment systems (with their cut).

PCI is not really optional, so if someone has a working business based on payment from iPhone via WebView then it's going to be possible to meet PCI.


Why is VeraCrypt more secure than TrueCrypt? TrueCrypt retired with a mysterious "Using TrueCrypt is not secure as it may contain unfixed security issues" (source)

Yesterday Slashdot reported VeraCrypt as a better replacement (source) since it bumps up several KDF iteration values (probably just #defines in the code :/ )

Why is this so? I doubt the original issue with TrueCrypt was the iteration values since hacking any KDF with any decent sized passphrase is still extremely difficult. In other words, I doubt it's the KDF that was the weak point to begin with, so VeraCrypt's changes appear like installing a steel vault door on a house with plenty of glass windows.

So, on what evidence can we consider VeraCrypt more secure than TrueCrypt?

Only through code review and testing.

Changes in iterations may indeed make those areas of the code more resilient to brute-forcing, but iterations are only a part of the overall architecture that needs to be considered.


Is branch predictor flush instruction a complete Spectre fix? I have understood that Spectre works mainly by exploiting the branch predictor state. Bounds check bypass and branch target injection are two faces of the same coin, the interaction of speculative execution with the branch predictor.

Now, immediately when hearing this I thought we need an instruction to clear the branch predictor state. Such an instruction could be used when switching context from user space to kernel space or vice versa or between two user space processes.

Apparently I am not alone in this. Mark has an excellent answer to the question Just how bad is Spectre? and Mark proposes the same thing. This has also been proposed at Real World Tech discussion forums.

Is this however a complete fix to Spectre? What about VMs such as JVMs that need to run untrusted code in the same user space process that runs also trusted code? Could the instruction help in securing such VMs?

A predictor-flush instruction is necessary but not sufficient for protection from Spectre.  A full protection against the Spectre attack requires two things:

Flushing the branch predictor state on context switch.  This prevents one process from attacking another by giving each process its own branch-predictor state.  It does not, however, prevent a sandboxed component of a process (such as JIT-compiled Javascript) from attacking other components of the same process.
Branch predictor state must take the full address of the branch instruction into account (currently, to save space, only the low-order bits are used).  This will prevent a process from attacking itself, since different parts of the process must have different addresses.  It does not, however, prevent one process from attacking another, since different processes may use the same address.


automated decryption I need to store credentials on my private root server in order to run some automated tasks like file transfer from remote servers via sftp etc. I might use shell scripting or maybe php to run those automated tasks, triggered by a cron job.

Now I have to make sure nobody breaking into my server will be able to read the stored credentials. My first thought was to simply encrypt the data and decrypt it on the fly when it is needed. But then I will have the same problem with the key: It has to be stored somewhere on the server. Thus an invader will be able to find the key and use it to decrypt the credentials anyway.

Is there a pattern or a standard solution for this kind of problem?

What you're asking for is impossible. If the server can decrypt the data, so can an attacker with physical access to the device. Before thinking about strong crypto, think about strong physical security. Hosting companies aren't what I would call strong security.

If you're merely concerned about defending against malicious root access, then an HSM will prevent them from stealing the keys for later reuse, but they'll still be able to use them while they have access to the server.


Sensitive information to exclude from Linux server before providing complete backup to vendor for troubleshooting A vendor requested a complete backup of a server for troubleshooting a bare metal restore issue, but they said we are free to exclude any sensitive data.

I’m thinking I’ll exclude:

/etc/shadow
exim.conf (it contains a password / API key)
any SSL private keys and SSH private keys of concern
/etc/group
/etc/gshadow
/root/*
/etc/my.cnf
/etc/ssl/*
/etc/pki/*
/root/.ssh/*
/var/lib/mysql/mysql

Does this seem good or is there anything else important I'm missing?  I know the answer depends on what's on the server / what it's being used for, but I imagine there might be some good general "be sure to think of ____" responses.

there are sometimes automated backup-files for various reasons, so i'd add

/etc/shadow*
/etc/passwd*
/etc/gshadow*
/etc/group*
/etc/*~
/home/**/.ssh/*

and, because one never knows ...

/tmp/*
/var/tmp/*
/var/spool


Windows Domain Account Unlock Best Practices? We have a setup where if a user gets locked out of their Windows machine, then their department or assistant manager can unlock their account. We are being asked to expand this so that any employee can unlock another employee's account.

Note: We have a script that can unlock a user which can be run if you are in the correct AD security group.

This strikes me as a bad practice. Should this be allowed? If so, why?

Allowing any user to unlock another is definitely not a best practice and introduces the risk that use of "the script" could allow potentially unauthorized unlocks to occur undetected (e.g., malicious attackers performing password guessing). For example, if an attacker is guessing passwords and locks out an account and the real owner asks a co-worker (non-IT / manager) to unlock it, the intrusion attempt may go undetected. IT/Managers "should" be trained to be on the alert for suspicious lockouts with unknown root causes.

That said, there is some validity to the comment that in a small organization this might be acceptable, but doesn't scale well from a security POV in larger organizations. If the org is going to move forward with this practice, there should be some level of security awareness training that accompanies its use, and perhaps a procedure for manual documentation of events or automated logging (and subsequent review of said logs).


Ingress client certificate authenticate requires CA certificate to be stored in secret? I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be stored in a secret. My question is: Assuming that I use client-certificates that have been issued by a trusted CA (that's how it works right? CAs issue client-certificates that they sign?), why would a trusted CA give me their CA certificate to be stored in AKS cluster as a secret? Do CAs just hand out their certificates out to public? Isn't that a security issue? (since I can sign client-certificates using that CA certificate)

In the context of X.509, which is used in TLS, we usually use the term “certificate” to refer to a structure which contains, along with identifying information, a public key.  Since this key is public and the certificate is generally available to anyone on the Internet, there's no risk in providing it.  It probably needs to exist in a secret store only because it's a convenient place to load it from, not because it's actually secret.
What you're probably thinking of is the private key corresponding to the public key in the certificate, which you of course won't be able to access.  Publicly trusted CAs usually store the private key in a hardware security module, so even the people running the CA probably can't access it (only use it to sign things).


How handle Informational waste I do big tiding of my flat and I found out, that lot of my waste consists from boxes with my addresses and receipts from online store deliveries. What is the most easiest and also most efficient way to discard such type of waste at home?

Paper Format

Shred the copies with a cross-cut shredder or if the volume is large enough you could pay an organization to dispose of them for you. If you're really paranoid you can take your shreddings and mix them up across multiple recycling bags and dispose of them in different areas.
Burn them (assuming that you have a facility to safely do that and you're not burning anything harmful to you or the environment such as plastic)

Digital Format

Use software such as DBAN or similar alternative that will overwrite your data with multiple passes to ensure it cannot be recovered
If data is stored on an SSD note that the destruction process may differ and you'll want to ensure your product has a Secure SSD Erase feature
You may also choose to open up the disks and physically destroy them for an added layer of protection


How to learn IP range from inside company I'd like to block all users from inside Company X from visiting my website.
However I don't work at Company X. Is there an efficient way to learn
what the IP is when people inside Company X access the outside world?
For instance, are there logs around the Internet that might be searchable?
Note that I don't care if they access the website from their homes.

There are certain companies that provide such information.
An easy way is to go to the following url and put the company name you want to get the adresses for into the search box:

http://bgp.he.net/

You will be presented with a list of ip addresses connected to the specified company if there are any.
The link leads to the "BGP Toolkit" of Hurricane Electric, a internet service provider. It the tool behind that link vanishes at one time you might find similar tools from other providers.


Nmap update - SSL/TLS ciper strength indication Previously with nmap I found it easy to understand the strengths of ciphers noted by the tool (strong, weak...)

However this has now changed to a rating of A-F.  What does this mean and why did they make that change?

Below is an example of the output of the tool

|  TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (dh 1024) - D
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_SEED_CBC_SHA (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp384r1) - C
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_RC4_128_SHA (secp384r1) - A
|       TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA - F
|       TLS_ECDH_anon_WITH_AES_128_CBC_SHA - F
|       TLS_ECDH_anon_WITH_AES_256_CBC_SHA - F
|       TLS_ECDH_anon_WITH_RC4_128_SHA - F
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 4096) - C
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 4096) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 4096) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 4096) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 4096) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 4096) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 4096) - A
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 4096) - A
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 4096) - A
|       TLS_RSA_WITH_IDEA_CBC_SHA (rsa 4096) - A
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 4096) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 4096) - A
|       TLS_RSA_WITH_SEED_CBC_SHA (rsa 4096) - A

Per the nmap documentation for the SSL-enum-ciphers script the A-F rating is intended to be an indication of the quality of the cipher (with A being the best rating and F being the worst.

As to the reason for their change, I think you'd need to ask the relevant developer about that (there's an e-mail address on that documentation page I linked) if you want to know that.


What are SSDP notify requests and where can I find out exactly what this traffic is? What is a SSDP protocol request with notify http/1.1 ? How can I find out what this network traffic is?

It's the protocol used to control the WiFi access-point that sits between your cable-modem/DLS and your home.

It does a number of things for you. First of all, it tells you that the device exists, with a URL. You should then see an icon appear in various places on Windows that you can click on in order to open up a web browser to access to pages on the device to manage it. That's especially important for the multipurpose devices that support disk drives, music players, printers, and so on.

It's also used by applications in order to open up ports on the firewall. For example, if you run P2P applications like BitTorrent, you'll use this system to open up the port to receive incoming connections.

It's a Windows things, btw. Macintosh uses a competing standard based on MDNS.

The Wikipedia article is pretty scarce on this:
http://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol


Why is php-fpm trying to connect somewhere on port 443? I have nginx and php-fm set up to front a word press site.  I used certbot to setup TLS.
When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port 443 for some reason and getting blocked.
The AVC looks like this:
# ausearch -m avc --start recent
----
time->Tue Nov 24 22:55:16 2020
type=AVC msg=audit(1606258516.914:398337): avc:  denied  { name_connect } for  pid=211463 comm="php-fpm" dest=443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0

audit2allow on the violation produces this policy:
module somerandomname 1.0;

require {
        type httpd_t;
        type http_port_t;
        class tcp_socket name_connect;
}

#============= httpd_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     httpd_can_network_connect, httpd_graceful_shutdown, httpd_can_network_relay, nis_enabled
allow httpd_t http_port_t:tcp_socket name_connect;

What is php-fpm trying to do here?  How could I find out the host it's trying to connect to?

After doing a tcpdump packet capture, I am highly confident that this was two things.  Both things were attempting to contact wordpress.org.  A DNS request would go out for api.wordpress.org immediately before the HTTP request would fire.

Listing themes/plugins from wordpress.org
Checking for updates from wordpress.org

I believe now the reason this wasn't triggering denials before is because it was under /var/www/wordpress which has slightly different default policies.  The new machine went into /usr/share/wordpress which seems to have made a difference.
I have left the socket requests blocked and the only harm I have suffered is I can't view available themes/plugins directly from the wp-admin panel.  A worthwhile trade off in my opinion for the security.


Security of encrypted data and decrypting key I am writing a python program in which I use encryption. The user can set the password and when it will be an input, the database will be decrypted. However, the function needs the decryption key to decrypt. So I thought about hiding that key somewhere(encryption and decryption key will be generated dynamically which means that the user on new device will have another decryption key.). I have no idea where I could hide it, so program could use it, but the user could not crack it.

You can't have a decryption (or encryption) key anywhere that a program can use it but the user whose permissions the program runs with cannot. This is the same problem DRM schemes have. There's no trust boundary between the user and their software; the software can't do anything that the user couldn't write software to do.
There are ways to hide the key (such as storing it in an external security module - either hardware or software that runs in a different, more restricted security context - but such systems will still encrypt/decrypt whatever the user's software asks them to, so not actually having the key is a meaningless distinction for a local "attacker" like this.
Assuming you're not simply deriving the key from the user's entered password (and never storing it persistently, at least not in plain text, anywhere), you might as well store the key in the user's profile directory (alternatively, in an OS-specific key store, which Windows and MacOS provide), with permissions set such that only the user can read it. Obviously this doesn't prevent the user from reading it with their own software, but they could also just modify your Python code or run it in a debugger and extract the key that way, even if there was some way to more securely store it.


How to get and use constantly changing cookie JSESSIONID values in Hydra? Related: how to get cookies from aspx site to use it with hydra

My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-cookie: JSESSINOID=XXXXXXXXXX in every single Response, so the JSESSIONID for the next request is different every time. Is there a way to get around this?

My syntax:

hydra XX.XXX.XX.XX -l admin -P pwlist.txt http-post-form “/Path/to/page.do:method=LoginAction&formName=loginform&pageType=1&userName=^USER^&password=^PASS^:Please enter valid User name and Password.:H=Cookie: JSESSIONID=XXXXXxxxxxXXXXXX”

Thanks for your help.

You can keep the session ID in the http response in a variable in the python prox and you can also send this session key with http requests.

https://forums.kali.org/showthread.php?18055-Hydra-using-Proxy
https://null-byte.wonderhowto.com/how-to/sploit-make-proxy-server-python-0161232/


Is it acceptable to share private SSH keys across servers for read-only access to a Git repository? I'm working on a project currently stored in a private Git repository on Bitbucket, that will be deployed to multiple external servers.

Because the repo is private, I need these servers to be able to authenticate to clone the repository as well as pull when there are updates. For this, it looks like access keys are the way to go.

My question is - is it acceptable to generate one SSH key and copy the private key onto each server that needs to clone the Git repository? The public key would be added to Bitbucket the first time, so every server that had the private key would be able to access the Bitbucket repo.

My rationale is just convenience - the provisioning process for these servers is going to be largely automated, and it would help a great deal if I could copy an existing private key as part of the process, and then immediately get going by cloning the repository. If I have to create a private key per-server, it means manually logging in to my Bitbucket account to add each key.

I understand that in general, the answer to "should you share private keys" is a solid "no", but I couldn't find much information relating to this particular use case. The keys would only be used for access to this one repo. I don't need to identify which server is accessing what on the repo, because all of the servers will largely be completing the same actions.

If your only use-cases are cloning and pulling, the ideal way to share a bitbucket repository is indeed with an access key, previously called a deployment key.

These keys give read-only access to the repository, so an attacker who infiltrates any one of your servers do not get push access to your repository (which could have severe effects), they do however obviously get access to your code, and a key to clone and pull the repository.

It's better practice to use separate access keys per server since sharing the access key would mean switching the access key on all the servers if one server gets infiltrated. In contrast, using one access key per server means if one server gets infiltrated, disabling that one access key removes access to your repository from the possible attacker.


What client side encryption algorithm/libraries should I use to make syncing easier? I want to build a webapp and a sister mobile app (using react native) that uses client side encryption. The encryption would be for text entries written on a daily basis that the user could create and edit. If the user goes offline, I want them to still be able to edit entries currently on their device and to create new entries, and I want those edits to be pushed to the server when the user comes back online.

If the user enters text offline for a particular day on one device, then forgets and enters different text offline on another device for the same day, I'd like the two entries to be merged into one entry when the devices go back online. Is there any sort of magic that would allow me to do that on the server with the encrypted files?

If not, I'd have the devices send a hash of the encrypted text as it was before the edits. When the updated text hits the server, I would send the hash along and compare it to the hash of the encrypted text that was currently stored. When the second update comes, the hash would not match the stored text, and the stored text would be sent back to the client to be reconciled. Are there existing protocols/libraries out there for this sort of thing? I'd rather not reinvent the wheel.

Let my rephrase your preconditions:

All data stored at the server or transferred to the server are encrypted.
The encryption key is only known to the clients.
There can be multiple clients, all use the same encryption key or some key derived from a shared secret. How this key/secret is shared between clients is outside of your question.

Then you are assuming that two clients might edit the same data and ask for a way  to merge these edits at the server side.

First, it is unclear what the result of this merge should be in your opinion even if the data are not encrypted. Therefore I'm simply assuming that you can somehow split the data into independent parts (like sentences or paragraphs) and treat these parts as fully independent entities when merging, i.e.:

If both clients have edited different parts just make each client replace this part only. Similarly you can detect and resolve if both clients have added new parts at different places or if one removed a part which the other did not touch.
If both clients have conflicting edits on the same part someone would need to resolve the conflict. This could be done that the first edit wins (i.e. you need timestamps) or that you ask for manual conflict resolving.

Note that with above merging algorithm there is no need to actually look at the contents of the parts, i.e. the algorithm could be executed on plain text, on hashes of the parts and also on encrypted parts if all parts were encrypted independently from each other. Only the manual conflict resolution would need to somehow present the contents to the user so that he is able see what he is actually resolving. But since all clients share the same key/secret each clients could also decrypt any part encrypted by the other client and display it within the manual conflict resolving.

In other words: how the merge is done can be made independent from the data being encrypted simply by splitting the data into independent parts (which you would need for merging anyway) and then encrypting each part individually and independent of the others. The exact implementation, libraries etc to do the merge are thus not a problem of information security anymore and thus would be off-topic here.


I ran netstat and one thing that came up was MSN bingbot, does that mean my computer is being used as part of a Microsoft botnet? I ran netstat on my computer, and one thing that came up was msnbot-65-52-108-216. I did some research and what came up was that it's from an IP originating in Redmond, Washington and that it's likely Microsoft Bing bot or something like that. Does that mean Microsoft is using my computer as part of a botnet for Bing or something? What might that network be doing, and if my computer is being used in that botnet is there a way to disconnect myself from it?

My computer is running windows, and it's not hosting a server....

As answered here, this IP address is in legitimate Microsoft IP space, and the msnbot process appears to be related to fetching Windows/Bing search results for the search functions integrated into Windows.

Such processed are only called "bot" because search engine crawlers are often called "-bot" (GoogleBot, etc.)


Why is faking SSL certificate difficult? In the news that comes from Iran, you hear that Iran has succeeded in making fake ssl certificates, so that they can find people's gmail account credentials.

Some analysts are saying this is possible but difficult, I wonder why it's difficult, where does the difficulty lie in, why can't your ISP do that to you?

Let me explain via a practical example.

There are a set of Certificate Authorities (CAs) that browsers implicitly trust. You can see the list of trusted CAs in your browser. For eg. the CAs trusted by Chrome browser can be found at "Wrench Menu > Preferences > Under the Hood > HTTPS/SSL (Manage Certificates) > Authorities tab".

So, the certificate that mail.google.com presents to your browser is 'signed' by Thawte SGC CA. This CA is implicitly trusted by the browser. These CAs will issue certificates only after thorough (and manual) verification.

You and I cannot trick Thawte or Verisign to sign us a fake certificate for google. Although such cases do happen but are rare and mostly require some insider help.

Now, on your own machine, you can go ahead and create certificates stating them to be of google.com. But these certs are 'self-signed' and will not be trusted by browser because the CA (you) are not in its trusted certificates list. In this case, browser will show you the certificate warning.

So, now to answer your question, there are a couple ways in which spoofed certificates are created (or made to work):

Just as I mentioned above, a person can trick a CA (which is trusted by browser) to issue you a certificate for a site which doesn't belong to you. For this reason people often manually remove trusted CAs from their list. God know what procedures does that CA in that never-heard-of country follows. I've seen paranoid people removing CAs from browsers trusted list.
The CA gets hacked (or is made to issue fake certs). In such a case you can issue certs at your will. Not to mention, such CAs immediately go out of business once this is found.
You can also have a fake "self-signed" certificate of google.com and still manage to bypass the browser security check if you explicitly add your own CA to browser's trusted list. Companies can do it. I've seen (and worked at) companies where they openly do it for "Compliance reasons". Since your desktop machines are in their control, they install their own CA to your browser's trusted store and present a fake gmail cert to the browser - which browser trusts and they happily intercep ALL your conversations/emails.

In all the cases - what do you get by faking a certificate: You can MITM (Man in the middle) the server and the users computer and decrypt the SSL session.

I've left many finer nuances of certificate creation in my description above to present a broad picture. You can read about Cert Patrol and perspectives to see how you can prevent falling a victim of a fake certificate even if its CA is in browsers trusted list.

You can also read about certificate pinning which can help prevent such certificate hijacks.


Possible to use "Blackberry Protect" in conjunction with a BES IT Policy? Is it possible to use Blackberry Protect in conjunction with a BES IT policy?  If so, what settings are incompatible?

So far I discovered that Memory encryption appears to be incompatible, but I'd like to see if anyone has more complete information than my trial by error approach.

More info

It looks like it creates a partition on the device for the end user that doesn't allow you to mix the personal data with business data. A lot of 3rd party companies are doing this.


Https POST Request for POST Parameters im looking to allow a previously GET request of a url like:
myurl.com/site/id/1 where the value 1 in this case - is a pseudo random and not too difficult to guess.

I'm looking to bring this id/1 key/value into my request BODY .

Is this more secure by using POST and putting the key and value into the request BODY, than using GET and having it in the url ?

How can I make this even more secure?

This is a tricky question to answer because GETs might be totally fine, or might be totally broken, it depends on how you've built the security mechanisms on your API. Have a look at the OWASP REST Security Cheatsheet.

In some cases there's no difference between URL parameters in a GET, and body params in a POST. For example, take RFC 6960, the wire protocol for Online Certificate Status Requests (OCSP), appendix A.1 allows the same data to be sent in a POST or a GET (if under 255 bytes), and must be treated the same by the server.

  A.1.  Request

  HTTP-based OCSP requests can use either the GET or the POST method to
     submit their requests.  To enable HTTP caching, small requests (that
     after encoding are less than 255 bytes) MAY be submitted using GET.
     If HTTP caching is not important or if the request is greater than
     255 bytes, the request SHOULD be submitted using POST.

In general though, I think POSTs give you more control over security. For example, many phishing attacks work by getting the user to click on a link. All browsers treat link referrals as GETs, so if a particular resource is only accessible over POST, then it's not possible to do link-based phishing attacks (or, at least, the attack requires multiple steps, like getting the user to click the link and then click a button on the phishing page).

Another win for clean separation between GETs (used only for fetching data in a "Read" type way), and POSTs (used only for modifying or storing data in a "Write" type way) is cross-site request forgery protection [source]:

  In HTTP GET the CSRF exploitation is trivial. For example, a simple hyperlink containing manipulated parameters and automatically loaded by a IMG tag. By the HTTP specification however, GET should be used as a safe method, that is, not significantly changing user’s state in the application. Applications using GET for such operations should be rewritten to use HTTP POST and/or use anti-CSRF protection.

TL;DR1: It's hard to say that switching from a GET to a POST will magically give you more security, because it depends what that API endpoint is doing. POSTs do give more options for how you implement your security mechanisms and a few less attacks to worry about, but with the right understanding and attention to detail you can build perfectly secure GET APIs.

TL;DR2: It's hard to answer your question by itself, out of context of what your API is doing, and what security mechanisms you have in place (CSRF protection? How does you authentication and authorization mechanism work? etc). I would suggest that you read the OWASP REST Security Cheat Sheet and look at your API security as a whole.


Why should memcmp not be used to compare security critical data? From man 3 memcmp:

  Do  not  use  memcmp() to compare security critical data, such as
  cryptographic secrets, because the required CPU time depends on the
  number of equal bytes.
         Instead, a function that performs comparisons in constant time is required.

Why is that so? My thinking is that if someone has access to the machine that processes this "security critical data," then these secrets are already compromised because that person can extract them from RAM. Or, if that person has no access to the machine, then they cannot accurately measure CPU time anyway.

Exploiting timing information is one possible attack against things like password authentication systems.

Conceptually memcmp() works by comparing two sets of binary data on a byte-by-byte basis (in reality processors can compare multiple bytes at a time, depending on optimizations, but the same principles below will apply). The function starts at the beginning of the data, compares each byte sequentially, and exits as soon as it finds a difference. If no difference is found then the function returns a code indicating that the data matches.

Because the function returns as soon as it finds a difference, an attacker with a sufficiently accurate clock can deduce secret information. They can induce calls to memcmp() with different inputs and by measuring which inputs take longer they can deduce what a stored secret might be.

Example:

Consider a classical password hashing system. Suppose your password is stored as a secret hash, say for example Ek8fAMjPhBo. (That hash was generated using the DES scheme provided by the Linux crypt() function with a salt of na and a password of secret. Note that this function is insecure and you should not use it in real systems.)

In a strong password system your hash Ek8fAMjPhBo is stored, but your password is not stored. When you are asked to authenticate the system will take your password, hash it, and then compare the two hashes to one another. If the resultant hashes match then you are granted access to the system, if the hashes do not match then your password is rejected. This allows the system to check to see whether or not you know your password without actually storing the password itself.

How an attacker can use timing to attack this system:

In order to attack this system an adversary really just needs to figure out what password hashes to the stored hash. Normally the stored hash is kept secret, but the adversary can use timing information to deduce what the stored hash could be. Once the adversary deduces the stored hash it is vulnerable to much faster and off-line rainbow table attacks, as well as circumventing on-line security measures like password retry limits.

The password system above has to compare a candidate hash against the stored hash in order to function properly. Suppose it takes 10 nanoseconds to compare each byte of the candidate hash to the secret stored hash. If no bytes match (one comparison) then memcmp() will take about 10ns. If one byte matches (two comparisons) then memcmp() will take about 20ns. Your attacker generates a few passwords and runs them through the system, recording how long each one takes. Suppose the first few hash comparisons take about 10ns each and then return, indicating that none of the bytes of the candidate hash match the stored hash. After a few tries one of the hash comparisons takes 20ns- which indicates that the first byte of the candidate hash matches the stored hash. In the example above this indicates that the attacker has deduced that the first byte of the hash Ek8fAMjPhBo is E.

Hashes by design have the property that you can't predict what hash will correspond to what password, so for example this does not tell the attacker that the password starts with s. However, the attacker could have a large table of pre-computed hashes (a rainbow table) so they can look up other passwords that hash to a string starting with E. After they try enough hashes they'll eventually get an input that causes memcmp() to take 30ns, which indicates that the first two bytes match, and they have deduced that the first two bytes of the hash are Ek. They repeat this process over and over until they deduce all or most of the hash. At that point they either know the password or can brute force it with a traditional rainbow table attack.

This is a little hypothetical, but you can find lots of practical information about timing attacks elsewhere on the net, for example:

https://research.kudelskisecurity.com/2013/12/13/timing-attacks-part-1/