Yahoo! Mail logging in with 2FA code only I came across a serious issue with Yahoo! Mail that I hope someone would help to fix or raise awareness for.

I wanted to create an account on Yahoo! Mail. I entered my phone number to the Yahoo! login, and it asked me if I wanted to receive an access key. So I did that, and typed in the access key... Surprise, I logged in ACCIDENTALLY to the Yahoo! Mail of the previous owner of my current phone number! Someone had used the same phone number years ago and connected it to his Yahoo! mail, and once he stopped using the phone number it eventually was bought by me, and I used this phone number to gain access to his email! Yahoo! didn't even ask me for a name or email, just access to the phone number, and I was able to access his email. I immediately logged out.

Is this a normal thing? Looks like a very serious privacy issue... and Yahoo! could fix it just by requiring the person to enter the full name or email.

This is a fundamental flaw in their system design. They are using a phone number as the username, and phone numbers, obviously, can change hands. They then send what amounts to be a password to the number without any authentication.

Just having the number, not even the original user's device, is enough to log in.

One could say that this is similar to using email addresses as usernames (because password reset tokens can be sent to the email), but email is protected by its own authentication. Over time, emails might also be abandoned and picked up by others, but that's not as common and changing numbers. And it is possible to clone phones and get access to numbers.

So, yes, this is an oddly rookie mistake on their part in overvaluing phone numbers. And they send the code without authenticating the password first.

Can this be fixed? Sure, but not as easily as you might think. This approach (phone as username) should not be fixed, this should be stripped from their system. And codes should only be sent after the password has been authenticated.

How do we inform Yahoo!? They know. They can't not know.

How do we force them to fix it? We can't.

Our response as consumers? Use a better email provider.


Tunnel between two applications, one of them is a 3rd party app I have written an application, that calls a 3rd party application with process.Start().
Inside the Arguments I pass needed credentials.
like so:
proc.StartInfo.Arguments = $"-c: -h: -x: -m:{Hostname} -d:{DomainName} -u:{UserName} -p:{Password}";
Now I want to prevent, any process to sniff on the communication between my app and the 3rd party application. Is there a possiblity, to create a tunnel between those 2 applications?
EDIT: Both applications are running on a windows client.

It sounds (from the comments) like you're just launching another process and not interacting with it after that, right? In that case, there isn't any direct communication between the processes at all! Instead, your process tells the OS "hey, I want to create a process, here are the details including args", and then the OS creates a process including setting up its initial variables (environment variables and command-line arguments). The OS will also return some details to your process (notably the PID of the new process and a HANDLE to it, which a framework such as .NET wraps for you) but that's sent back by the OS, not by the other process.
Talking about a "tunnel" doesn't make any sense in this scenario, because at the time of the "communication", the "recipient" doesn't even exist yet! For it to make sense, you'd have to launch the new process in a way where it can communicate with your process once the new one is running. Sometimes this is an option - some programs can take data from stdin in place of command line args, or can read their arguments out of a file (which might theoretically be a pipe, although many won't like that). However, that depends on how the program is written, and you said you don't control that.
I assume your goal is protect the command line arguments from being captured by an attacker. I have good news and bad news.
The bad news is that command line args are generally not secret. You can see them in Task Manager, for example, if you enable the relevant column in Details view. Processes owned by other users won't have readable command line args unless you're an Administrator, but anything running as you-the-user will have access if it wants. Of course, it doesn't even matter whether the args are directly exposed; any process running with the same privileges as any other process (or running as admin) can simply read the other process' address space directly, pulling any desired secrets right out of memory (the relevant APIs are usually used for debuggers).
The good news is that, assuming you don't have malicious software running on your machine (or at least not with sufficient privileges), the command line args aren't exposed to interception anywhere. They might get stored in a Windows system log (depending on logging settings) but they aren't transmitted over the network or anything like that. The creator process invokes a system call or two (NTCreateProcess on Windows, something like fork or clone followed by execve on *nix systems) which passes the parameters directly to the kernel. It is in theory possible to intercept this, but if your attacker can interfere with system calls you have Much Bigger Problems, as that means they have already taken over either your process or your entire kernel! The kernel then creates the new process and sets its memory such that it sees the arguments you passed it; this is only interceptable if the entire machine is already compromised.
Now, of course, what the new process does with those arguments is entirely up to it! You seem to be starting something that wants a remote host and credentials to access it, which suggests that the credentials will be sent over the network. That's the part you should be worried about, unless you expect your user (the person running your software) to be malicious or to have malicious code running with their privileges... in which case there's nothing to be done, game over.


SmartCard for private keys - personal usage I've just found my notebook has a SmartCard reader.

Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key storage?

Or would I need a SmartCard "writer", which would increase the expenses for personal usage to an impractical height?

Or would I need a SmartCard "writer"

Most (all?) smart card readers can write values to the card.  All you should need is the smart card.  It's worth noting that you probably want a cryptographic smart card.  They tend to cost more than $10. There are other smart cards that cost less but don't do the encryption on the card (which makes they much less secure).  You will also want a card / drivers that will work with your operating system.  Setting up the drivers can be a bit of a pain.  There are also different kinds of certificates.  For example, there are PGP keys and there are x509 certs for PKI.  You will want a card / reader that will work for what you are doing.  Do some googling and see what cards other people have used on your OS.

  Would it be wise/possible/practical to buy a single SmartCard,
  transfer my private key on that (somehow), and use it as my primary
  private key storage?

If you are concerned about security, it is a very good idea.  Computers have many avenues of attack while a smart card has far fewer.  Using a smart card can keep your private keys safe even if your computer is compromised.  Just make sure you do some research on your reader and the card you are looking to buy to make sure it will work with your OS / application.

Another note: although you can transfer an existing key to a card, it is better to generate a new one in a safe environment.  You don't know if your existing one has been compromised before you put it onto the card.


Possible to use CAPICOM to extract current SSL certificate? I'd like to extract the current SSL certificate from the current browsing session, and read the properties.

I'd like to do this at the Browser, for content that is delivered from the server.  I'm not looking for a 3rd party tool.  A likely implementation would be to use Javascript and any invokable object that may be available (ActiveX / COM / CAPICOM?).

Does anyone know if this is possible using CAPICOM or any other control?

http://bozhobg.wordpress.com/2009/04/16/how-to-create-a-digital-signing-solution-with-only-javascript/

I have seen reference to adding certificates through CAPICOM usage.  I haven't seen validating or checking one that is in use.  I wouldn't want to use CAPICOM based on the fact that it's a 32-bit only solution according to the MSDN.  Just my perspective, but I have a hard time wanting to dig any deeper when you are warned off of the API by the software manufacturer.

The other point that could make this difficult is that you are looking for the certificate in use, not a certificate in the store.

I did see that you don't want to depend on a particular product.  Does this mean you don't want to use some browser specific function to try and grab the certificate? I would try browser specific functions first.


Is there a process to identify threats related to a deployments? I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue.

For example, a sysadmin opens a port in the firewall that isn't required by the product.

So is there a methodology that we can use to identify deployment time threats?

Typically what you would do here is integrate some form of testing procedure into your deployment or post-deployment process.

This could be as lightweight as a simple port scan, which could identify ports left open inadvertently, or as large as a full 3rd party security assessment (aka penetration test) where you contract a 3rd party to review the security of the deployed system.


Bruteforce vs Denial of Service I had a problem presented today which I found quite interesting.

You have an application with a management panel. You know some of the accounts as they are standard. You want two things:

You want to prevent bruteforce attacks
You want to prevent a denial of service

At the moment, the user accounts were locked after 5 tries. Meaning you had to reset the password through email. This mitigates the chance of a successful bruteforce attack.

On the other hand the risk is that because there are some default accounts, that someone intentionally keeps sending bad passwords to keep disabling the accounts.
This would result in a kind of denial of service for the administrative accounts.

My solution was to make the management panel only accessible through a VPN. So you would first need access to the VPN before you would be able to attempt a login into the panel.

But what if this is not an option, what can you do? (apart from continuously blocking IP's that perform bruteforce attacks)

For a simple solution I would say to implement an exponentially increasing delay per user per IP address.

Required delay between attempts 1 and 2 from IP a.b.c.d for user x: 1 seconds

...attempts 2 and 3: 2 seconds

...attempts 3 and 4: 4 seconds

...

...attempts 7 and 8: 1 minute 4 seconds

That way an adversary can't DoS access from an IP address or an individual user and you've pretty effectively mitigated brute force because the delay rapidly becomes unreasonable. Even if they have access to a large number of IP addresses, there likely wouldn't be enough to brute force the password keyspace, just some dictionary words.

This would allow for brute-forcing users with the same password, but if you're seeing that number of failed requests you should probably flag it anyway (in that a user with multiple bad attempts is probably not uncommon, but multiple users with bad attempts from the same IP address in rapid succession would be suspicious).


Virtual Environments vs SELinux/AppArmor : Which is better for running unreliable applications? By virtual environments, I mean Linux containers like Docker and Vagrant and not full blown VirtualBox.

So, the issue is that I often have to install packages from untrusted sources in my Ubuntu. However, lately I've become paranoid about these applications, and have been thinking about limiting their access or running them in SandBox.

Here is one scenario which I have been considering:

If I install an untrusted package on my machine and use SELinux/AppArmor for securing it, and this package needs to connect to the network, how can I be sure using SELinux that the package is not sending my key-logs or any other such information over the Internet? In this case, it seems like if I run the app in a separate Docker environment, it would be safer because then it would not have access to my keystrokes or any other such information.

There are many other scenarios too. But my question is this : in general, which provides better security of these two options? What exactly are the security layers/measures provided by these two methods?

Docker attempts some tricks to contain processes, but the creators themselves acknowledge they aren't effective containers of applications out of the box. Since you are concerned about security, but aren't interested in a heavyweight VM environment, I would recommend running SELinux and Docker together. SELinux can automatically apply an MCS label to each Docker container launched which helps protect you against container breakout. This makes it really easy to get the strength of SELinux and the ease of use of Docker.

To further expand on this, Docker doesn't effectively contain applications launched within it. Docker communicates directly to the kernel as there is no hypervisor between it and the host system. This means an attacker inside a container capable of using local privilege exploit attacks which are fairly common and generally easy to pull off.

SELinux would be much more capable of containing the application, since you could effectively prevent it from communicating from any system component it didn't absolutely need to. It can be difficult to build profiles, but this is far and away a better option to contain an application.


Identifying documents by hash: what are the security implications? Suppose that I am developing a service (DocBot) to aid the transfer of large mail attachments.  Instead of attaching documents to her messages directly, Alice appends the hash of each document, and separately sends the hash to DocBot, which requests the full document if it does not recognise the hash.

When Bob receives the message, he asks DocBot for the the original document associated with the hash.  For the sake of argument, DocBot does not require any additional information from Bob – if anyone knows the hash, that is taken as proof that they are authorised to see the original document.

My question is: assuming that the hashing scheme is sufficiently collision and pre-image resistant, and that no one can intercept Alice's messages to Bob, what new vulnerabilities are introduced by this scheme?  That is, does DocBot create ways for a malicious user to learn information they shouldn't, or interfere with other people's communications?

DocBot would allow a malicious user to learn information (read documents) if DocBot is not designed to prevent brute force attacks.

Specifically, if knowing the hash is all the proof that is needed, then iterating a stream of hashes could, in principle, give up Alice's documents.


Exploit Compilation Problem I am trying to compile the following exploit:
http://www.exploit-db.com/exploits/10613/

But get the following error:
local.c:12:22: fatal error: asm/page.h: No such file or directory
compilation terminated.

Your exploit needs page.h header file.
 You must install linux header package.

asm/page.h is available in linux header package

  linux-headers 3.11.6-1 File List :
  .
  .
  .
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/numaq.h
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/olpc.h
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/olpc_ofw.h
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/page.h
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/page_32.h
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/page_32_types.h
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/page_64.h
  usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/page_64_types.h .
  .
  .


How does Windows Server 2008 store local users' passwords? It is not clear to me how Windows Server 2008 R8 stores local account passwords. Is there any salt added or just NT hash is computed and stored?

The following article describes all the methods used by Windows 2008 (even Windows 2008 R2).
http://technet.microsoft.com/en-us/library/hh994565.aspx
I am not sure if I understand correctly that there is no salt?

The SAM database is stored as a file on the local hard disk drive, and it is the authoritative credential store for local accounts on each Windows computer. This database contains all the credentials that are local to that specific computer, including the built-in local Administrator account and any other local accounts for that computer.
  The SAM database stores information on each account, including the user name and the NT password hash. By default, the SAM database does not store LM hashes on current versions of Windows. No password is ever stored in a SAM database—only the password hashes. The NT password hash is an unsalted MD4 hash of the account’s password. This means that if two accounts use an identical password, they will also have an identical NT password hash.

In short, unsalted MD4.


What particular concerns should one bear in mind when wardriving? I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks.

Right now, I'm still in the planning stages of this project.  The plan so far entails:

Loading up a laptop and vehicle with appropriate tools.
Drive through the entire area, to get a general map of wireless network coverage, and gather general statistics about the use (or non-use) of wifi security in the area.
Use gathered statistics to garner support from the local community organization, for further wardriving activities.
Use direction-finding antennae where appropriate, to identify buildings with unsecured or less-secure wireless networks.
Alert owners of vulnerable networks via personal visit, flyer on the front door, letter in the mail, or phone call.
Offer a free or low-cost consultation visit, to help the owner secure their network appropriately.

Currently, I do not run my own personal IT business.  So, I'm more looking to do this as a service to the community - a "Neighborhood WiFi Watch" as I'd like to call it.

I'd like to do this in a way that is ethical, legal, and of course well-received in the local community.  To this end, what laws, best practices, and other policies should I be mindful of when planning or executing this?

While answers addressing any region of the world are welcome, my particular project is in Florida.

I am not a lawyer, so the following is just from experience:

We have found in most countries (exclude the really restrictive ones such as Germany) you should have no ethical or legal issues with wardriving and collecting info on where weak wireless networks are.

The problem is more around what you want to do with it - if you haven't been specifically engaged by the owner of a particular wireless network then the response you get when delivering a report to them could vary wildly from thanks to a lawsuit.

Collecting aggregate data is often safer, so for example you could deliver a presentation to a local community saying that out of x wireless networks, only 30% are secured correctly, and provide them with guidance on how to sort out security. I have done this in the past, for specific communities, and it was well received - with some of the attendees then engaging me on targeted security assessments.


When using VPN on a WiFi network, can the traffic of other non-VPN computers on the WiFi be monitored? Let's say I am using a WiFi connection and am connected through VPN to a private network.

Would the computer using VPN be able to monitor the traffic of other computers connected to the same WiFi, but without using VPN.

The answer is unclear to me as the VPN connection provides an encrypted tunnel to the private network, out of reach of the other computers on the WiFi (or rather: encrypted beyond recognition, hopefully), but I'm not sure whether those computers "outside of the tunnel" are reachable to the VPN connected computer ?

It is not really a "tunnel" actually only the connection between you and the Server is encrypted. This is calles a remote-access-VPN

However there is also a thing called site-to-site VPN which is used to connect whole network with ech other in an encrypted way.

I assume you have some sort of client software which usually means you are using the remote access vpn.

Your computer is able to see other computers traffic in a wifi scenario, thats the reason you are using encryption.


Yahoo account "secure" but spam sent from my address My Yahoo account shows no suspicious activity, only log-ins from my desktop and 2 of my devices. But a friend was spammed twice within a short time today from my email address. I use Yahoo's Account Key system, so there is no password to change. Should I be concerned about this? And what likely happened? Nobody else has reported getting spammed by me, so far at least. Thanks!

As mentioned by @schroeder, it is easy to fake the sender address when sending an email. Because of this, the value of a stolen account is not the address itself but its contacts.

The value in sending spam with a faked origin is to make mail seem to come from a trusted origin. By stealing your contact list and/or the list of people you have emailed, spammers are able to send everyone you know messages with your name on it. You might not trust an email from money@freemoney.biz but would you trust a hair product recommendation from your wife (or more precisely her email)? Often, the answer is yes.

If you are wondering if your account was compromised, ask your friends. If your account was hacked, they'd probably notice the recent increase of spammy emails with your name on it.

In addition, you can return the favor by telling your friends if you suspect that they've been hacked. While I don't suggest doing this by emailing them back (since that might alert a spammer that you are receptive), you could casually bring it up in a conversation (your mileage may vary ;)


What is the significance of Spectre and Meltdown? Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much.

These are cache attacks that take advantage of the instruction pipeline processing implementation in addition to the cache implementation. So this is just another variation of the cache attacks. Why are these two attacks so hyped? Are they that much better? Do they make things easier?

Previous attacks extracted AES keys and other sensitive material from processes.
There have been Javascript based cache attacks before haven't they?
Attacks have been made to work across cores before.
Previous attacks also work on machines with multiple CPUs.

I understand these two variants make the attack much more easier and more controlled? Is that the reason?

There are a few things that make Spectre and Meltdown different from historical cache attacks. Some are specific to the attacks, and some are simply a consequence of the changing computing environment.

Stuff that's different about the attacks:

They're really hard to fix. These are hardware problems, and in the case of Spectre are hardware design problems rather than implementation bugs. Fixing hardware is slow, expensive, and hard to verify. You can't just fix the problem with software updates, the way you can with most security bugs. The "patch" for Meltdown is more accurately described as a work-around than a fix (rather than fixing the underlying problems of userspace programs being able to read arbitrary kernel memory, you just un-map the kernel from userspace programs so there's nothing to read, and eat the performance cost of a context switch on every system call). Spectre doesn't even have that; the closest we've got is things like degrading the precision of JS timers (which may negatively impact some legitimate code) to make it harder (but not impossible) to detect the timing differences.
They're fast, reliable, and easy to carry out. Any language that supports high-precision timers and contiguous-memory arrays with arbitrary indexing (i.e. approximately all of them) can be used, in a very short block of code that is easy to port from one language to another, for successful exploitation. They can be used to extract quite a lot of should-be-hidden data (easily KBs, often MBs or even 100s of MBs) every second. That's a big difference from older attacks that often could only maybe get anything useful, if they had a good long while to work on it.
They allow targeting arbitrary memory addresses, and don't rely on waiting until the processor is doing the thing you want to inspect. Previous cache attacks were mostly focused on seeing what was in other programs' cache lines, which means the attacker couldn't pick and choose what they got. If you know the other program is doing crypto, you might be able to extract the key, but if you mess up your timing (see the point above) or can't force the data you want to access to be accessed (and thus in cache) when your attack is running, too bad. However, Spectre and Meltdown allow reading arbitrary memory addresses of your choosing, which means you can do things like walk data structures to find exactly the information you are looking for.

Stuff that's different about the computing environment:

Cloud computing is common. It is far more typical now, than at any time in the recent past, for two unrelated and mutually-untrusted entities to be running arbitrary code on the same physical machine. Just as processes divide JS sandboxes from the rest of their address space and OSes divide process address spaces from each other, hypervisors divide VM physical address spaces from each other. The very premise of safely in the cloud ("running code on other people's computers") is built on these divisions, and Spectre/Meltdown breaks them.
JavaScript is ubiquitous and useful. What was once a toy language with no use for high-precision timers or typed and bounded arrays has become a very powerful language with most of the features found in other application programming languages. Browsers cheerfully execute code from arbitrary and often untrusted sources (web servers), relying on the JS sandbox to prevent (most) malicious uses of this power. For attacks like Spectre and Meltdown, which bypass the sandbox's protection and can be written in JS, it is an ideal attack vector usable against nearly all end-user machines.


Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL? When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me.

I see SSL Server Certificate, CN, O, OU that appears to match somesite.org issued by thawte SSL CA - G2.

But (and here I disclose that I'm new to this) using

openssl s_client -connect somesite.org:443 -showcerts

I get something very different:

depth=0 C = XX, ST = XXX, L = Strawberry Hills, O = Department
of Misadventure and Zebras, OU = Somesite, CN = www.domz.gov
verify error:num=20:unable to get local issuer certificate
verify return:1

NOTE: OU = Somesite is at odds with Dept. of Misadventure and Zebras.

Certificate chain
 0 s:/C=XX/ST=XXX/L=Strawberry Hills/O=Department of Misadventure and Zebras/OU=Somesite/CN=www.domz.gov
   i:/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-------

If I extract the certificate and process it with

openssl x509 -in abnote.pem -text

I get a result which confirms s_client result.

Unsure for your exact use case, but that is what the Server Name Indication TLS extension precisely addresses.

In HTTPS, the SSL handshake where the server presents its certificate occurs before the server could examine any HTTP header. SNI allows the client to send the name of the virtual domain as part of the TLS negotiation.This enables the server to select one certificate among many. Therefore, with clients and servers that implement SNI, a server with a single IP address can serve different domain names with different certificates.

SNI was added to the IETF's Internet RFCs in June 2003 through RFC 3546, Transport Layer Security (TLS) Extensions. The latest version of the standard is RFC 6066.

It is now the de-facto standard, because in large datacenters the front proxies can serve hundreds or thousands of sites, not speaking of Content Delivery Networks like Akamai or CloudFront (thanks to Mike Ounsworth for that part)

More details on the referenced page.

BTW, openssl can use SNI with the servername option:

openssl s_client -connect somesite.org:443 -servername somesite.org -showcerts

should be enough to get same certificates than browsers get


Could "system volume information" and $RmMetadata pose information leakage on a nuked HDD? I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can find except for a couple of programs which have noted that the $RmMetadata folder still exists with files such as $TxfLog.blf within them.

An example image is shown below:

I have done a litle bit of searching to try and understand exactly what these files are but no one seems completely sure.

Could this data still existing pose information leakage problems for a nuked disk if I were to, say, sell it on?

The name of $TxfLog.blf is self-explanatory: The extension blf indicates a CLFS log file, and TxF stands for Transactional NTFS. You can see that TxF is just a temporary file that backs up transactions to help against sudden crashes, just like similar precautions in modern databases. There can exist some leakage from this file, but it only would consist of the last few transactions.

System Volume Information sounds innocent, but it can contain indexes for fast searching the files on the partition. Leakage is very likely here.

Although the method you've mentioned destroys most of the data, traces like these still can leak information about the original data. Most file systems can't be filled to 100%, so that writing files as long as writing is possible doesn't remove all traces. If you didn't like to use linux directly, you could use DBAN.


Kerberos Authentication : Client authentication only I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation  have is "SSO using Kerberos".

I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN) and I already suceed to decipher some Kerberos token.

What interest me currently is the difference, between how I can technically handle this, and how It should be in the security fields.

To put it simply the workflow (which is in fact the bare minimum possible) :

I receive a request from an unauthenticated user
I answer "Negotiate"
I receive a Negotiate token
I decipher the user in (I handle authorization locally so I don't care about te reste).
I store the information in the HTTP Session (which mean I have a classic SessionID Cookie), and the authentication is finished. I don't answer myself using WWW-Authenticate with a Kerberos token. (I saw it was possible but is it mandatory ? It's a part of the question).
From now on user is authenticated and as long it's session is active he won't be reasked.

If we consider that we're in a HTTPS-only case it seems decent in my view of security (I'am a developer, I do look some stuff around security but no more) and it "technically work".

However the fact is that between all possibilities and what purpose they serve I'm a bit lost. For instance, take this example : Session Authentication vs Token Authentication

It is said that token authentication has beneficial advantages when using distributed system (I am not).

So is my way of doing Kerberos valid ? I don't think my application require high level security since it is within a private network (no Internet) and is not important enough to warrant high security but I'm still interested in the case I have implemented is against what Kerberos should be.

Removing the authentication component of this question for a moment you're asking "is X secure?" It's not a binary answer because you need to ask the question in the context of a particular attack or threat model, which is dictated by what the app is used for and who would use it.

That being said, this is a fairly common pattern and is often considered an acceptable off the type shelf solution. Web apps will not authenticate every HTTP request with a Kerberos ticket because each request would need to go through the WWW-Authenticate handshake, so the only way you can authenticate each request is by creating a session ticket.

Think of it this way... You're accepting a Kerberos ticket that can only be used once for a user from an authority you explicitly trust (the KDC) and exchanging that ticket for a session ticket you explicitly trust (because you issued it) that can be used multiple times. As long as your session ticket generation and validation is secure this is all probably fine.


chosen plaintext attacks against MD5 and SHA1 According to http://tools.ietf.org/html/rfc2617#section-4.9, having the server chose a nonce but not having the client chose a nonce opens up Digest Access authentication to chosen plaintext attacks.  My question is two fold...

Is this a problem with SHA1?  Digest access authentication uses MD5 so maybe the client nonce is intended specifically for that?

Also, how does being able to control the server chosen nonce help?  The link in the RFC is dead.

The goal of the attacker is to guess the password. By observing the authentication message, the attacker already learns enough to "try" passwords at home (i.e. an "offline dictionary attack"), but that's not what RFC 2617 is talking about at that point. Rather, it concentrates on the idea of an attacker who impersonates the server, and thus feeds "server" nonces of its choosing to the client. The client responds to such a nonce by hashing the server nonce, the client nonce and the password together (I voluntarily skip the details here). The attacker may then try to exploit some internal weakness of the hash function to recompute the password from what the client sent. What the RFC 2617 tries to say is that omitting the client nonce can only makes things easier for the attacker (at least provably not harder, and heuristically easier) -- as a corollary, using a client nonce may help in protecting the client in case the hash function is flaky; a client nonce will certainly do no additional harm.

Now no exploitable weakness of MD5 is currently known, when used in Digest Access authentication as described by RFC 2617. Even though MD5 has shown considerable flakiness with regards to resistance to collision, which is another, distinct security property that a good hash function should have (and that MD5 has not). So the protection offered here by the client nonce is only hypothetical. But, as I said, it does not harm either.


Asymmetric Encryption on User Data to Allow Unauthenticated Input Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2).

For a new project, I would like the users to be able to add data to their account without authenticating. All they would have to know is their account identifier (username, email, etc).

Could I accomplish this with asymmetric encryption like RSA? Unauthenticated input would be encrypted with an account's public key, and only the account holder could decrypt with their private key.

Would this be an acceptable approach, or am I totally off?

Edit: To clarify, a use case would be the ability for the system itself to generate data on a user's behalf that can only be decrypted by the user. Assumption that the system makes no logs of this.

I think that your users should be authenticated for adding data into their accounts. Take into account that if somebody could polute the data just by knowing the credentials.

Another approach that you can follow is that your application only will write the user data if has been signed properly. On the creation of the account you store the public key of the user and for adding data to that account only data that has been signed with the privake key that your application can verify. Here is an example:

User generates a private and public keys.
Your application generates an account with (username, email, public key) (account1)
Some user wants to write data on account1.
Your application verifies that the data received has a signature that can be verified with the public key of account1. If this operation is true this means that the data received has been signed with the private key of account1, in any other case you reject the data.

Hope these helps you


What does "if ntp is configured to allow remote configuration" mean in this ntp CVE? I'm reviewing CVE-2015-7850 and it says:

  •   Affects: All ntp-4 releases up to, but not including 4.2.8p4, and 4.3.0 up to, but not including 4.3.77

  •   Summary: If ntpd is configured to allow remote configuration, and if the (possibly spoofed) source IP address is allowed to send remote configuration requests, and if the attacker knows the remote configuration password or if ntpd was configured to disable authentication, then an attacker can send a set of packets to ntpd that will cause it to crash and/or create a potentially huge log file. Specifically, the attacker could enable extended logging, point the key file at the log file, and cause what amounts to an infinite loop.

I have hard time to udnerstand the following line:

  If ntpd is configured to allow remote configuration

What does that mean?

ntpd can be configured remotely with the ntpdc command. See e.g. this for what you can do (add and remove servers e.g.). This is normally only enabled for localhost, if at all.


Can one use a gpg smartcard to implement FIDO2? From what I understand, the idea of FIDO2 is to use symmetric cryptography, with secret key on the token, and public key on the server. When requesting to connect, the server uses the public key to generate a challenge that can only be solved with the private key, i.e., if the user can solve the challenge, he has the token containing the private key, and is granted access.

is that an accurate description of the protocol?

Then, I am curious of:

why would not all tokens containing gpg smartcards and a microcontroller for interfacing be implementing FIDO2?

To take an example, why would there be a Nitrokey Pro with a smartcard and microcontroller that cannot perform FIDO2, vs. a Nitrokey FIDO2 for the sole purpose of doing FIDO2, and without smartcard? (see https://www.nitrokey.com/#comparison ) The Nitrokey Pro has both smartcard and microcontroller, so I guess it could emulate whatever FIDO2 protocol, and do the crypto on the smartcard? Am I missing something, or is it possible to do but just 'doable in theory but not implemented currently'?

afaik FIDO 2 and gpg require two different architectures, thus require two different MCUs. In that the keys are not similar in their padding, and not similarly stored on the key.
If you wish, you might take a look at the technical details of the Pro 2 here, and the FIDO 2 here. Both keys store different kinds of "files" of keys.
Is there a possibility to store an authentication key on the PRO 2 or HSM, maybe, but it was not made for that. You can this question on the Nitrokey support forum, and the people there would know much better.


Internal code-signing certificate on Windows I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, etc.) to be loaded into processes. Unfortunately, many of these were not compiled with ASLR / DEP opt-in flags. Since the affected processes are prime targets for exploitation, I've been going through manually and patching the support in so that so-called "universal" ROP chains can't be exploited.

One side-effect of my changes is that a lot of the components now have invalid code signatures. This doesn't seem to have broken anything, but I'd like to re-sign them with a locally installed certificate, using some kind of personal root certificate as a parent. As a bonus, I can take advantage of the force integrity flag.

What steps should I take to do the following?

Create and install a root certificate, with a child (intermediate?) certificate for code signing.
Strip the existing certificates from binaries.
Re-sign binaries with the new certificate.

I've never really messed with the certificate store on Windows, beyond a few quick forays into checking existing ones or installing the Burp CA, so I'm a little lost here. Is OpenSSL a good option for generating the certificates, or is there a better Windows-specific solution? What tools are ideal for re-signing binaries?

You'll probably want to use the code signing tool as part of Visual Studio, and makecert.exe will probably be easier to use for cert generation. You'll have to make sure you get the proper cert template though otherwise the code signing will fail. A good source of information could be found here: http://msdn.microsoft.com/en-us/library/ie/ms537364(v=vs.85).aspx

If you store the code signing key locally the net security gained is pretty low. You'd really want to at least move it off to a secure machine, or possibly store it on a VM, on a removable disk, encrypted, and never connected. The problem with this though is that any time an app loads the DLL, Windows will attempt to validate the signature and try to verify that the certificate hasn't been put on a revocation list, which means an outbound call to an unknown location, causing blocking timeouts, which leads to awful performance and random things failing to start.

You'd probably want to stand up a full CA (gag) to get this all working properly. Alternative options are to get an actual code signing certificate from a trusted CA, and sign the DLLs using that. Though if those DLLs ever got out into the wild with your signature odds are good your cert will be revoked... eventually.

As well, if you're doing this to core Windows components then you'll likely just break your installation since the internal protections will freak out about the unknown signature.

Lastly, if you're doing this to certain non-Microsoft drivers or kernel-mode components, you might have a bad time because Windows hard codes CAs that can sign certs for certain components that have certain key usages. See: http://www.alex-ionescu.com/?p=146.


Could a state actor MITM Let’s Encrypt certificate issuance to provide a cert they could more easily crack Let’s Encrypt issues certificates of which they are the CA. That cert is based on a private key generated in the server by LE's auto/certbot script.

Could a state actor MITM that transaction requesting a cert and send down a spoofed cert in it's place which would appear valid on the surface? One which the state actor could make weaker and easier to crack?

Alternatively, could a state actor hijack the process to install LE's script in the first place, supplanting it with a script that requested a cert from a CA they controlled? Again, sending back a weak cert they could crack?

Most people just blindly install and run the script. They see a cert working, and move on. They don’t validate the chain themselves. This seems a potential weak point.

I think the private key which doesn't leave the server largely protects against this, but I am not certain if that's the case, hence this question.

So how secure is are those processes? Why are the considered secure? Could a MITM attack like this work based on user carelessness to validate the chain?

The private key never leaves the server requesting the certificate.

The public key in the certificate has to match this private key.

The certificate returned is either invalid (public key not matching private key) or it has the same security. It might be signed by another CA, but that doesn't change the security. It might be considered invalid by some browsers.

If a attacker can MITM the actual connection between client and your server, then a state actor can interfere.


Creating user and safely sending password Assuming I currently use a safe way to salt-challenge-response-authentication-method, passwords are stored secured and all.

I now question myself - how do users set the password?
Meaning, they enter password as plain text in the textbox, and what happens next? should their client hash the password and send it to the server to be salted? isn't that prone to MITM+rainbow-table ?
I was thinking about querying the server for the salt, and then the client hashes and salts the password and that's what will be stored in the DB along aside the salt.

What do you think?

Also,
Is it ok\better to store the first part of the hash which is the combination of the username and password with salt? meaning that when they change username they'll need to reset their passwords aswell.

Thanks!

You should NEVER send passwords in the clear. As long as your communications are encrypted (TLS), your server can hash and salt the passwords when it receives them.


Security concerns related to API Key in Website I want to make a weather-forecast website and was planning to make AJAX requests to the openweathermap API to load the weather data.

However, I am uncertain on how to properly use the API key. I was going to include the key in a JS script, but I am concerned that the key might be "stolen" either from GitHub or the html source.

AFAIK the key can only be used to make weather data requests, but it could still be abused to make an inordinate number of requests.

Would including the key in the html file be a bad practice? If so, how would I properly implement it?

If your website has a backend, you can create an endpoint in your own backend that fires off a request to OpenWeatherMap. That way you can store the key securely on your own server and the client needs never know about it.

If your website does not have a backend, you are going to have to give the client your key at some point so that it can make the request. It doesn't really matter how you pass it to the client, because at some point it will need to be sent to OpenWeatherMap from the client.


symmetric encryption session keys in SSL/TLS This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-private key pairs are superior to symmetric keys regarding key exchange security, why don't use asymmetric encryption for the session keys too?

this is an extension of an existing question: security of PKI, Certificates, certificate authorities, forward secrecy

3 reasons (now):

Asymmetric encryption is slower, much slower, than symmetric encryption. Orders of magnitude slower.
Given the same keylength, asymmetric is much weaker than symmetric, bit-for-bit. Therefore, you need a much larger key to provide equivalent protection. This also contributes to the slowness mentioned in 1.
(As per @ThomasPornin's comment:) Asymmetric encryption carries with it an increase in size of output. For instance, if you use RSA, encrypted data is at least 10% larger than the cleartext. Symmetric encryption, on the other hand, has a fixed size overhead even when encrypting gigabytes of data.


Using MFA to connect to windows shares on domain controller I have a requirement to force MFA for all non-console administrative access to our Windows AD servers. I've sorted out log ins with RSA, but that does not prevent a domain admin from mapping a drive or connecting via \servername\share and making changes that way.

This is the PCI MFA requirement 8.3.1, for those that are familiar with PCI. I've been beating my head against a wall over this for months; I've grilled Windows admins, googled until my fingers bled, and asked for input from several QSAs. None have been able to pose even a potential solution.

Any thoughts, suggestions, or directions to look would be greatly appreciated. I'm stuck.

That's a really great question. My guess is that to allow this you must be trusting domains between the CDE and non-CDE, in which case I’d expect the admin to have logged in initially using MFA.

But it is a great question and I’d actually encourage you to submit it to the PCI SSC - I don't expect you will get a quick answer but it is the sort of question that would generate an FAQ in due course.


Seeking help with implementing SCRAM in .NET I'm late to the party and need to be  caught up. I'm doing my homework looking things up.
I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM.

I think ASP.NET MVC sends cleartext passwords over the wire from what I can tell, and relies on https for security. WebSecurity.Login has username and password fields that are exposed in the controller.

I know I shouldn't roll my own security. Preferably I want to implement a standard that is easy to use and hard to screw up. I want people who work with the code 10 years from now to be able to support/upgrade it without pulling out their hair.

Just in case I need to do some heavy lifting, I have been looking at CryptSharp's sCrypt implementation. On Tony Arcieri's blog I he has a this image comparing different hardware costs to crack a password.

I don't know how legit this is or exactly what the numbers mean (10 char KDF vs a 80-char text KDF), but what I understand from the grid is that SCrypt is fast (64ms) if you know the password, but costs a lot of hardware resources / money to generate a rainbow table for it, and that it can cost substantially more hardware resources than either PBKDF2 and Bcrypt.
Please don't mistake this for me pretending to know anything about these 3 KDFs, I'm blindly trusting the internet here.

Also if I end up having to implement SCRAM myself, am I correct in my understanding that the client and server need to generate the same value? And if so, are there any best recommended javascript+server KDF implementations that get along better than others?

Any insights you guys have will be much appreciated, I'm really in the deep end here. Thanks!

If you are talking about a web site, there is no benefit to protecting the password on the wire.

If the connection between the user and the website is compromised, an attacker can send the user compromised pages/scripts that leak the password before encrypting or hashing it.

A client-side key derivation scheme in JavaScript will also be unpalatably slow, whereas an attacker would be able to use fast native code instead.

So if you need to protect the password on the wire simply protect the whole connection using SSL, and leave it at that.


Strength of key pair I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks.

I appreciate that a user-chosen password will likely have a lot less entropy than a random one - has there been any attempt to measure the difference?

For a brute force attack, I expect the cost of generating a key pair will be much higher than for generating a password, but is there much of a difference in the cost for validating the key pair compared with validating a password?

A password of a given length could potentially be any string of characters of that length, so a simple incrementing counter converted to a string of character codes would give every possible password. However the same does not apply to a key pair - indeed the number of possible values appears to be very sparse. Are there any estimates of how many key pairs exist for a given algorithm / key size?

A start would be comparing password entropy to symmetric key size. A random password of 13 characters has approximately 80 bits of entropy, thus is comparable in security as a 1024 bit RSA key pair.

However, this is mostly theoretical since users typically choose insecure passwords, while key pairs are almost always random.

I would say key pairs always offer better security against brute force, but whether they should be used in your situation depends on other factors.


BufferOverflow : ESP and access violation The context :

I have a small question regarding ESP and access violation.
I just exploited a buffer overflow, with little space after ESP.
So i did this :

part 1 : NOP SLED

part 2 : my shellcode : a shikata_ga_nai encoded reverse_tcp payload, by metasploit

part 3 : some more NOP to fill the space

part 4 : 4 bytes overwriting the EIP saved in the stack. This is the address of a jump ESP instruction in a non ASLS protected segment.

part 5 : [This is where ESP point to at the moment of the crash] I have some NOP

part 6 : the first stage of my exploit :

for the first stage, avoiding \x00 bytes, I did :

mov eax,esp
sub eax,944 (point to the part1 : the NOP sled)
jmp eax

It worked fine :
stack is overwritten, EIP goes to the jmp ESP instruction, arrives in the part 6 of the exploit, it jumps to EAX, wich point to the part 1 of the exploit, and then executes the NOP to arrive to the shellcode.

problem : I got some access violation inside the shikata_ga_nai decoder.

I solved it, adding a mov esp,eax in the first stage :

mov eax,esp
sub eax,944 (point to the part1 : the NOP sled)
mov esp,eax
jmp esp

And it worked like a charm.
So that would means one can not play with the memory in lower addresses than ESP.

The question :

Does ESP really has anything to do with read/write permission inside (outside actually) the stack ? The memory there was allocated, so I used it. Has EBP or other register anything to do with access violation ?

No, both registers just point to stack addresses, with ESP being the top of the stack and EBP the base of the stack frame (usually).


C++ : memset on a struct containing std::wstring - Is it a risk? While reviewing a piece of C++ code I came across instances (reported by CPPcheck) where memset() was used on structures containing string members. I have come across a few references that talk about how this is not a good practice. I am unable to conclude if this behavior can result in a security risk.

references:

http://timmurphy.org/2013/01/23/is-it-safe-to-use-stdmemset-on-c-structs-and-classes/
https://stackoverflow.com/questions/6877281/memset-structure-with-stdstring-contained

My C++ skills are limited. My apologies if I am missing out of something obvious here.

I believe the issue lies with the fact that std::wstring is not necessarily a simple structure in the traditional C sense.

Instead it'll be a class with an internal state, structure and possible a vtable to class functions that are not necessarily visible to you.

So if you memset() the class you may end up destroying internal state and function pointers leading to undefined behaviour if you then try and use the class.  And as we all know undefined behaviour is bad.


HTTPS in request and HTTP in response If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response?

I have such a question because I want to protect my OAuth token in my request. And then use WS-Security in my SOAP response. I am trying to find a way to get these two things work together as it seems WS-Security cannot work with HTTPS...

No - the whole connection would either be over HTTP or HTTPS - request and response.

I can't think of a situation where encryption would be required for the request but not for the response - there is no advantage to this since the SSL handshake would have to take place anyway.


Should a VPN user be allowed to bypass a SSH jump host? I am setting up a computer network for software engineers. I currently have all SSH connections run through a jump / bastion host, with access to production servers requiring SSH agent forwarding.

For the purpose of accessing internally-facing, potentially-unsecured HTTP services (such as an admin dashboard or IPython notebook), the user must port forward the production server's port to localhost.

I am interested in provisioning an OpenVPN server for the users, allowing them to access internal services without port forwarding. However, access to these services (like an IPython notebook) is equivalent to SSH / shell access.

If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection.

Based on this, is it a good idea to deploy OpenVPN at all? If so, what are some ways that I can simplify key management for my users? (Can my users use the same RSA key for OpenVPN TLS and SSH?) How can I collate logging on the server to provide an identical auditing experience for VPN and SSH access?

If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection.

The answer to all of this is yes.  Obviously opening up another method of access to a network is going to increase the attack surface.  The real question is if the benefits are enough to justify the added risk.  You ask if the VPN server is really a good idea, but alternatively, if you have a VPN server, do you really need to keep the SSH server available?  As mentioned in one of the comments, the VPN is a more robust and secure method to provide access to the network-but requires more setup and maintenance.  Keeping things simple, or familiar, for your users is always a nicety to consider, but security should generally overrule convenience.

It sounds like you are dealing with developers who should be competent enough to understand there is generally some give and take between security and convenience, so you need to figure out where that balance lies for your client's specific needs.  The questions about reusing keys and collating audits all depend on the needs of the client, the security policy in place, the level of protection desired for the information, current network architecture and implementation, etc... Re-using a key between two disparate systems is not going to provide the highest level of security, and it comes with more risk.  But depending on the level of protection you need, it might provide ENOUGH security for your implementation, without the more complex and costly setup of a true Single Sign-On system.


How to do Ajax securely? This question is inspired by this security question  https://security.stackexchange.com/questions/1707

What are the threats in using Ajax? (Please note I am talking about security threats, not features drawbacks)
How do I do Ajax securely? (Please give examples, preferably examples in PHP since I am using the CakePHP framework.)

Ajax is just pasing data over HTTP - it's not magic - so you secure it in exactly the same way you do with your normal webpages -

check for authentication and authorization
Encrypt or add salted hash checks to data exported to the browser for resubmission
treat any data received in the request as potentially dangerous
use HTTPS where its appropriate
transform data leaving your PHP using the right method for were its going (htmlentities, mysql_real_escape_string
transform data entering your script using the right method based on its origin (e.g. json_decode)


Using an unknown hash algorithm for passwords and be PCI-compliant? Do we need to know what hashing algorithm is employed to protect passwords at rest in regard to PCI DSS Requirement 8.2.1?

We're using a wireless access point (Yamaha WLX302) in the development branch of our payment service division.

It has a password-protected admin console where the password is hashed (or encrypted-- we can't tell) at rest. According to PCI DSS Requirement 8.2.1, we are required to verify that passwords are rendered unreadable during transmission or storage.

Our QSA insisted that we were required to identify the hash/encryption algorithm but since the manual didn't say anything about algorithm and the password hashes were completely hidden from the console*1, we asked the vendor what algorithm was used to securely store the admin password. The vendor did not agree to disclose the algorithm in use.

So, the questions are:

Do we actually need to identify the hash algorithm of the passwords to be PCI-compliant?
Can we still be PCI-compliant without an administrative access to the password hashes?
2.1. Since we can't see the passwords/hashes, we can't tell if they're even properly hashed*2. Are we still covered?

*1: This prevents even the admin from viewing the hashed passwords so we have absolutely no idea in what format the passwords are at rest-- hence they're indeed unreadable, I think.

*2: At least we can instruct via the console command to encrypt the passwords at rest, but what if there's a security bug that all passwords are actually stored in plaintext regardless of the configuration?

The key phrase in 8.2.1 is 'Strong Cryptography' which is defined in the glossary as:

  Cryptography based on industry-tested and accepted algorithms, along
  with strong key lengths (minimum 112-bits of effective key strength)
  and proper key-management practices. Cryptography is a method to
  protect data and includes both encryption (which is reversible) and
  hashing (which is not reversible, or “one way”). See Hashing At the
  time of publication, examples of industry-tested and accepted
  standards and algorithms include AES (128 bits and higher), TDES/TDEA
  (triple-length keys), RSA (2048 bits and higher), ECC (224 bits and
  higher), and DSA/D-H (2048/224 bits and higher). See NIST Special
  Publication 800-57 Part 1 (http://csrc.nist.gov/publications/) for
  more guidance on cryptographic key strengths and algorithms.

My advice would be to copy this definition and ask the manufacturer whether the storage of passwords complies with this definition of strong cryptography or the definition of hashing (also in the glossary). If the manufacturer says yes then your QSA has to be satisfied.

If the answer is no (and if the manufacturer refuses to answer you can assume that means no) then you’re probably going to have to look at compensating controls or evidence that the password store itself is inaccessible (or regretting your purchase) or further segmentation such that a compromise of the password database would have no effect on the security of the CDE.


Does it make sense to split two factor authentication between identity providers A common multi factor authentication solution will ask a user for a username+password and a one-time password.
In all documents I can find both factors are asked by the same identity provider. This can be the website itself or for example when it supports 'Login with Google' it can be Google who also asks for an OTP.
On our website users can authenticate with SAML against their corporate active directory.
We are considering adding a second factor like TOTP in our application. That way the first factor would be the SAML authentication and the second factor authentication would come from our website.
Somehow this feels weird to me. Is this a brilliant solution or a bad (insecure) plan?

Authentication with SAML uses password in the corporate directory. This password is one authentication factor. The TOTP uses key (password) that has nothing to do with password in the corporate directory. Thus these are two independent factors. For authentication an attacker will need to know both.
Both factors are based on the knowledge of some secret. Normally it is better to use factors of different types, e.g. one is based on knowing of something and one based on possessing of something (like token, card, smartphone) or being something (like fingerprint).
But in the reality TOTP does not require user to enter the key each time. Usually the key is generated randomly and stored in the device, e.g. in the token. This token generates codes based on the key and current time. To compromise this factor often it is easier to compromise the token (e.g. steal it) than to extract the key from it or to retrieve the key from the security system. Thus the security of TOTP is based effectively not on the knowledge of the key, but on the possession of the token.
Thus 2FA in your case is based on knowledge (of the password in corporate directory) and possession (of the TOTP hardware token).
This approach is reasonable and is more or less common. Of course the real strength of the security depends on many things:

The entropy of the passwords in the corporate directory (if it is low, such passwords can be easier brute-forced)
How is password management implemented in your company (e.g. how is allowed to reset passwords for users, in what cases)
How is TOTP organized (e.g. who can get access to the TOTP key on the server side)
How disciplined are users (if they keep their passwords secret or write them down and make then accessible to the others)
How well user care of TOTP tokens (e.g. to they inform your company immediately as they notice that token is lost/stolen)
Etc.

But the approach itself is reasonable.


Getting the uploaded file path without knowing the uploading destination Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it would be stored after uploading. Is it possible to get the file path after the PHP script is uploaded? Somehow making the uploaded script to inform us about its location? I know the question sounds weird. But I was thinking of a capability in PHP in which makes the script to run automatically right after it has been uploaded so for example it can send us an email letting us know about the upload path. Another form of asking such question would be, is it possible to find out about the uploaded file path at all by just uploading PHP or Python script? Although I prefer PHP, there might be solutions in other languages which are supported by server side.
P.S.
If none of the above ideas work, is not it possible to know the upload destination path by any means?

The destination a file is saved to is completely dependent on the application. Even if you could guarantee that a file you uploaded was executed, the file could be stored in a chroot environment and not know its actual location.  That said, you may be able to determine the path for a particular application.

The server will often tell you the path it uploaded to. For example, if you upload an image, find a webpage that contains that new image and find its url. It may be RESTful and not a direct file reference, but its a good place to start.
Look at the source code of the application. If you are looking at an open source application, go look up its source code to see where it stores files. For example, wordpress typically stores files in ./wp-includes/uploads/<date>/file. Determining this for one wordpress site can tip you off too multiple sites.
Try to create error messages. If you can crash the app and force an error message, you may be given information about where files are stored. Some things to help with this would be to include filenames either too long or contain invalid characters for a particular filesystem.
Attempt directory traversal attacks. If you can find a base reference to a known file such as /etc/passwd, you can start guessing other filenames and paths. This is made very easy if the application allows globs for filenames.
Check the robots.txt file. Some applications tend to restrict robots from crawling user uploaded content, so be sure to check the /robots.txt file for unusual entries.
Try a program like dirbuster. Note: dirbuster is super noisy and process intensive for the server.
Reference an image on a webserver you control, and check referrer headers. This can leak the URL of the page being executed. Note: for HTTPS sites, you'll need a HTTPS website.


Are public website s3 buckets vulnerable to DDoS attacks? We are trying to make our web app the most cost effective and secure we can.
For that reason we are using Cloudflare instead of CloudFront as a CDN for our frontend resources.
We put CloudFront between Cloudflare and S3 to be able to use Full SSL (strict). This is required because we have a subdomain for API Gateway, which needs SSL to avoid infinite loops generated when using Cloudflare Flexibe SSL
The problem is that AWS documentation on connecting S3 with CloudFront for Website hosting instructs on allowing public access to the bucket contents (1), while Cloudflare recommends restricting access to Cloudflare Servers IPs to disallow public requests to the website buckets (2, 3)
Specifically, we want to be able to use Cloudflare free DDoS protection effectively. Such that we avoid potentially high costs related to receiving DDoS attacks directly into our AWS deployed resources, and the need of using other non free services as AWS WAF
So my question is, given an architecture using Cloudflare, CloudFront and S3 website bucket with public access bucket policy, is there a DDoS vulnerability, specifically with respect to CloudFront and S3 not being properly protected by Cloudflare?

If you're concerned with massive data transfer costs on CloudFront, you would still be vulnerable as CloudFlare can just be circumvented. You'd need to pay for AWS WAF for protecting your CloudFront distribution.
As an alternative, you can ditch CloudFront altogether and serve content from your S3 bucket allowlisting only Cloudflare IPs for s3:getObject, and still have Flexible SSL just for your assets subdomain/path using custom Page Rules:

https://support.cloudflare.com/hc/en-us/articles/360037983412-Configuring-an-Amazon-Web-Services-static-site-to-use-Cloudflare

Edit: Still need to set up public access on your bucket, but access can be restricted by IP

https://community.cloudflare.com/t/setting-ssl-tls-mode-using-page-rules/118211


How good using hash value of size 32 bit in practice Suppose I want to apply an integrity check on a message sent via the Internet (to check if a message has been modified while transmission). I have the following questions:

If I consider Hash value of length 32 bits to be added as a layer in the packet header (since a packet header length is of length 32 bits), is it considered reasonable in terms of performance? In other word, does generating hash value of this length causes any performance issue?
When I use a digital signature, is the operation of signing this hash value (using symmetric key of length 32 bits as well) considered to be an overhead?

You are mixing two different concepts into one.
Consider two things:  Is the hash to check for integrity for data due to interference that is not likely to have been tampered with?  Or is it for security?
A TCP packet has a checksum (like a hash), for purposes of determining if interference changed part of the packet.
Security hashes, and even file integrity hashes, started with 128 bits, and now are in the 256-512 bit range.  32-bits cannot be considered for any type of secure application, including a digital signature.
A digital signature with a 32-bit key and 32-bit hash is only a little bit better than ROT13 and maybe worse as it might give a false sense of security.


How can Avast detect threats when I install Kali on VirtualBox? I was installing Kali on VirtualBox on a W7 host, and during the upgrading/installation, Avast detected two threats in the Mimikatz package.

My question is, how can Avast "see" through the VM? Is he package held for a bit on the host, before going in to the VM? I've always thought that the two enviroment were isolated and separated. I downloaded Kali from the official site.

And is it normal that a virus is detected? Is it a false positive?

This is not exclusive to Kali. If you run an apt upgrade for metasploit or mimikaz (from, say, Parrot in a VM), chances are you'll get the same alert from your AV. The reason is that the packet goes through the host machine first (then gets caught by your AV) before being handled by your VM.

  and is normal that be detected as virus? Is false positive?

It's not false positive. It's not a virus either in a sense that it'll cause harm to YOUR machine. Note, YOUR. There are exploits and/or scripts in Kali that can legitimately cause harm and is intended to cause harm to identify vulnerabilities in a system.


How to Intercept into an iPhone having access to same Wifi I would  like to know, If I have password of a wifi-router? and I know the MAC address and IP of Target Iphone using this wifi-router, can I get to contents of social media like WhatsApp chats?

No.

Most traffic these days use additional encryption. Things like facebook chat only use TLS between the server and client, whilst WhatsApp uses the Signal protocol for true end to end-encryption. You can not get access to this by intercepting the traffic at the IP layer.


How to get top management support for security projects? I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, however, at the end of year, we found out that only 50 users were using the antivirus properly.

I have discussed this issue and others regarding digital security, but the top management is not supporting us very well.

I want to get full support from management, but I am confused about the way to do it.

Additional Information:

Organization: ISP provider.
Size: 1000 employees
My role: IT Security Manager/Technical
Reporting to: IT Manager, Technical Director, CEO
Is there a role/function dedicated to information security and/or information       management ? This is still unclear, and all security projects started when I joined the company.

Although there are exceptions, generally managers do things for one of two reasons:

Doing it will make them look good
Not doing it will make them look bad

Now apply this to your management to see who the key stakeholders are:

Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV  look good. However, if nobody is using it that will make them look bad if it gets out.
Stakeholder 2: If the company was hacked because AV was not installed someone will look bad.
Stakeholder 3: The company has spent money on AV because the financial benefits of the AV are greater than the financial costs of deployment, which should make someone look good. However as it is not being used properly  therefore the company is incurring the costs without the benefits. This financial drain might make someone look bad

The stakeholders all may be the same person, or it could be separate individuals. Either way these are the people you need to reach. As for how to reach them the first rule in dealing with management is to come to them with a solution, not a problem. If you dump the problem on their lap they will send you on your way telling you to come back when you've figured it out, whereas if you come to them with a solution you are much more likely to get what you need. Remember that managers exist to make work for you, they don't want more work to do themselves, so if you go to them with something that will create work for them they will dump it right back on you. Also, doing the work ahead of time shows you understand the problem and will give you more credibility.

So, make a plan to fix the problem. What's it going to take? Money for extra help? A training program? Figure out how you will fix it and how long it will take. Put it into a powerpoint with 3 simple slides and put it in front of the key stakeholders. Get one of them to "Own the problem", as then they are taking responsibility for it getting fixed.  Start issuing a monthly report showing AV uptake and distribute it to the stakeholders.

Remember what motivates management: it's not about doing the right thing, it's about visibility. Make the problem visible and make them own it.


Does a DDoS attack have other purposes beyond a lack of availability? I'm currently researching DDoS attacks for an article I'm writing and apart from the obvious lack of availability of the target host and their services, is there anything else a DDoS can help accomplish?

I'm thinking things along the lines of a DDoS being the first step for a larger intrusion or compromise. Does it make it easier or assist an attacker in compromising the target. If so, how? Can you provide any attack vectors I can do further research on that depend on a DDoS or a simple explanation would be great.

There are a few ways a DDoS can help in perpetrating extra villainies:

If the DDoS target is a security service (e.g. an intrusion detection system), then deactivating the service can allow easier break-ins. For instance, if a hole is found in an operating system, which allows for remote code execution, then a DDoS on the OS vendor's update site will delay propagation of the fix, thus allowing for a longer exploitation window.
The DDoS itself is likely to generate tons of logs which will make detection of malicious non-DDoS actions harder: log entries which would normally trigger alarms fly under the radar, because the IDS and the people who look after it are overwhelmed by the DDoS-related flow.
Since a DDoS threatens the continuity of business activities, some organization may apply emergency procedures which aim at maintaining the service at the possible expense of security. For instance, if a DDoS implies an overload of an email-antivirus, then the organization may decide to switch off the antivirus, so that emails flow again; but then, virus may enter more easily. Another case is an organization who switches to an alternate site which might not be as well protected.

See this previous question on the same subject.


Encrypting layers of OSI I was reading that WPA2-PSK encrypts layer 2 of the OSI network model. What is the danger of having this layer in plaintext (I know it can be decrypted very easily from within the network)? Is there a point to encrypting it when all higher layer traffic is visible, unless outside sources provide protection, i.e. HTTPS? In addition, if encryption occurs at layer 6 for HTTPS, is every layer below 5 (HTTP) also protected?

Your interpretation is incorrect. WPA2-PSK doesn't completely encrypt layer 2 information.
Management frames are unencrypted (except in cases where management frame protection is implemented). MAC addresses of all communicating parties can also be observed, which somewhat helps to analyze communication flows and gain general information on the network. The sizes of exchanged packets are visible as well, being somewhat useful in understanding what's going on in the network. An attacker can also send dis-association frames, which would cause denial of service.

The payload of the 802.11 frame IS encrypted, meaning that layer 4,5,6 and 7 information IS encrypted.

That encryption is only for the network "outsiders", running PSK would allow you to eavesdrop once you've got the key and you're on the network. This is where other layers' protocol security kicks in (HTTPS, SSH, etc.).

In general, from a practical security point of view, WPA2-PSK would help guarding the integrity and confidentiality of information, but doesn't quite help with availability. For obvious reasons the integrity and confidentiality only rely on the strength of the PSK, which often is less than perfect. There are plenty of posts here on WPA2 and its security, I'd suggest looking around for more information.


Setting up a honeypot I have a spare computer lying around at my house, so I decided to turn it into a honeypot. So far, I have installed Windows XP (no service pack) on it and have set up rules on my router to forward (some) ports to the honeypot. Since my router doesn't support DMZ, I have to manually create rules. Currently, I forward TCP ports 80, 100-140 and 1000-1500 (I chose those values pretty much randomly). On the honeypot, I use Wireshark to monitor the network traffic.

However, the honeypot doesn't seem to get infected. I only receive very little traffic from the outside.

What am I doing wrong? Do I have to forward other ports? Do I have to somehow advertise my presence on the internet?

Thanks for any input!

P.S.: I do know about the dangers of running a honeypot inside of a home network.

If you just want to get your honeypot machine compromised and part of a botnet, you will need to be running vulnerable services on the machine.  The vulnerable services you choose will have to match the ports that you have forwarded to the honeypot machine and will also have to match the services that worms are actively trying to exploit.

For a Windows XP machine, forwarding ports 137, 138, 139 and 445 should get you plenty of attack traffic.  These ports are for NetBIOS and Samba and they all receive a constant stream of traffic from the internet.

Forwarding port 80 will only be useful if you are running a web server on the honeypot machine.  You can go in two directions with a web server; either run an old version of the HTTP daemon itself that has known vulnerabilities or run a current version and then run a vulnerable web application such as an older version of Wordpress or phpMyAdmin on it.

You can just try running services and hoping that they are vulnerable and that worms are trying to exploit them but it might be more effective to look up the services that specific worms target and run those.

The other direction to solve this problem from is to enable logging on your ingress point and see what traffic is hitting you.  I suspect you will see a lot of traffic on the ports I mentioned above but you will probably see traffic on other ports as well.  Find out what the ports are used for an run that service on your machine.

There are a few things I would add to this regarding honeypots:

The purpose of a honeypot is to study what the attacker or worm does once it compromises a host.  You will want to set up extensive monitoring and logging on the box itself so that you actually gain some useful information out of the exercise.  It's also important that you know when you have been compromised.  Most honeypots are run inside virtual machines in order to give you an easy way to compare the current state of the machine to a known good copy.  It is not adequate to do this from within the honeypot because rootkits can modify the very tools you are using to do the comparison.

You will want to be monitoring all traffic to and from the honeypot machine.  By this, I mean full packet captures.  The normal way to do this is with a spanning port on your switch but it can probably be done in the hypervisor of the VM if your switch doesn't have that capability.  You would normally not do it within the honeypot.

You said that you are aware of the dangers of running your honeypot inside your home network.  I presume that means you're also aware of the precautions you will have to take before putting it online.  Specifically, configuring your network and firewall so that the honeypot machine can't contact any of the rest of your local network.  It's also good practice to be careful about which outbound connections you allow it to initiate to the internet.  The first thing it will often try to do is to download a rootkit and the worker programs which you are probably interested in, however the next thing is often to start attacking more targets, and this is not something you would normally want to allow.

There also exist specific tools for creating honeypots.  These tools include entire hypervisor and VM stacks that enable all the things I have mentioned above.  On the same site you can find tools for logging, monitoring and analysing and also a load of information on how to run a honeypot and who you're likely to see attacking it.


Verification code generation and expiration I am trying to implement an application that includes registration,

In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a verification code will be sent to the phone number stored in the database that meets the entered ID number,

I was wondering what would be the best way to implement this verification mechanism in a secure manner? What algorithm should I use to generate the verification code? This CheckDigitSystem Suggested some algorithms but I am more concerned about the time in order to prevent replay attacks.

Is it practical to append or use the time stamp to generate the verification code? What should be the TTL for the verification code to expire?

I am also concerned about the user experience, if I don't want to make the verification code too long, would I need to implement expiration upon number of attempts? Or is it better to use long verification codes?

Sending a verification code is a good option to make use of the information that you have in the database. For the type of algorithm, you can use a complex or a simple ones. The simple one that I have in mind is the timestamp and add salting to it. Like how cryptography works.

As for the expiry time, make it like 3 mins would be sufficient. The number of attempt would be 3 times as well, once it hit 3 error, create a log detail in your system or send a notification to notify you that someone try to hack into the system or something like that.


What are covert channel algorithms? Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be.

Has anyone heard of this term before and what does it mean?

How covert channel algorithms could be implemented in non-Computing environments?

Covert channel algorithms is most commonly used as a name given to a set of algorithms used in IDS/IPS (Intrusion Detection/Prevention Systems) to detect, analyze and identify covert channels in TCP/IP networks, for example by probabilistic statistical analysis by e.g. using the Markov model TCP packet analysis, Bayesian inference and other algorithms, deterministic by static traffic analysis, rule set matching, or by several other techniques / algorithms that might be in place with various intrusion detection systems.

Suggested further reading:

Network Covert Channels: Design, Analysis, Detection, and Elimination (Serdar Cabuk, Purdue University - PDF)
Covert channels analysis in TCP/IP networks (Pierre Allix, IFIPS School of Engineering
University of Paris-Sud XI, Orsay, France - PDF)
A Covert Channel Detection Algorithm Based on TCP Markov Model (Jiangtao Zhai ; Sch. of Autom., Nanjing Univ. of Sci. & Technol., Nanjing, China ; Guangjie Liu ; Yuewei Dai)
A Robust Network Covert Channel Algorithm Based on Spread Coding (NIU Xiaopeng*, LI Qingbao, WANG Zuo)
An Approach to Analyze Covert Channel Based on Finite State Machine (Xiong Liu ; Dept. of Comput. Sci. & Technol., Tsinghua Univ., Beijing, China ; Jian-guo Hao ; Yi-qi Dai)


Is zinc.io PCI compliant (/does it need to be)? zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being sent to and used by their server: example.

It seems that security-wise they:

use SSL encryption
never store the CC information (though they do say they may have it in memory)

From their FAQ: "We use industry-grade 256 bit SSL encryption on all API endpoints. Your card number and login details are in memory on the server only for the duration of each request."

That's it (although truthfully there is no way to tell for SURE if they're not PCI compliant, but nothing on their website seems to suggest otherwise).

My question is, if I wanted to offer similar service (i.e. make purchases on behalf of consumers with their cc info), must I (/are they?) be PCI compliant? Or, is it simply enough to (1) use SSL on my site and (2) never write CC info to my DB?

EDIT:

So I did end up getting a reply from the folks over at zinc.io after all! Here's what they had to say:

  Hey there,

  Sorry for the delayed response -- we noticed your question here as
  well :) We are very much still operating.

  The response you received there was very detailed and mostly accurate.
  However, we are indeed PCI compliant -- at our scale of operation it
  is self-enforced, so the comment about "getting their quarterly ASV
  scans and not mentioning it" doesn't apply here. We do comply with
  everything on the SAQ.

  Cheers, Max

Disclaimer: I Am Not A QSA; I Am Not A Lawyer

  My question is, if I wanted to offer similar service (i.e. make
  purchases on behalf of consumers with their cc info), must I (/are
  they?) be PCI compliant? Or, is it simply enough to (1) use SSL on my
  site and (2) never write CC info to my DB?

Yes, you would need to be PCI compliant.  You would be transmitting and possibly processing cardholder data on behalf of merchants.  Storage of cardholder data is only one of the three things that are sufficient to put you in scope.

You might be able to do it without PCI compliance anyway.  You might be outside the normal methods of PCI enforcement.  Visa might not care enough to send lawyers.  That being said, I would not advise testing those possibilities at all.

I'll expand upon this by addressing the rest of your question.

Zinc.io appears to meet the PCI definition of a service provider:

  Service Provider: Business entity that is not a payment brand,
  directly involved in the processing, storage, or transmission of
  cardholder data on behalf of another entity.

At the very least they're transmitting cardholder data - they receive it and then send it along to the merchant.  They may or may not be processing it.

They do not show up on the Visa Global Registry of Service Providers.  That may simply mean that they're a Level 2 Service Provider, because "Entities that wish to be on the Global Registry of Service Providers must validate as a Level 1 provider."

(IANAQSA, but the only times I've heard a QSA mention level 2 SPs it was to dismiss them).

I'm assuming that PCI considers the cardholder an "entity" for the purposes of that definition.  If not, that might be an interesting loophole.  Because the really interesting thing is that it's not clear that Zinc is in the PCI enforcement chain:

  Without actually establishing a working relationship with Amazon, Zinc
  has been able to simplify the ordering process down to just one call
  to the API.

Ordinarily, a merchant or service provider would be required to

  12.8.4 Maintain a program to monitor service providers’ PCI DSS compliance status at least annually.

but Zinc doesn't work with merchants, or service providers, they inject themselves as a middleman between the customer and the merchant without the merchant's knowledge or consent.  They're not being held responsible to PCI, so they very likely may not be performing the steps necessary to provide mandated protection for customers' card data.

Since they don't list anything about the PCI DSS, or their compliance with it, on their web site, they may very well be working under the assumption that they aren't subject to it - or they may be choosing to ignore it, knowing that the usual leverage used to enforce it can't be used on them (to wit, being dropped by merchants, being dropped by processors/acquirers, or being fined within the context of their PCI relationships).  Or, who knows, they could be carefully doing their SAQ and getting their quarterly ASV scans and not mentioning it...  have you asked them?

Personally, I'd be leery of entrusting them with my card data.  Their TLS configuration doesn't convince me they care deeply about securing it - as of this writing, a B with RC4, SHA-1, weak DH, and a cert signed by StartCom.  Nothing that violates existing PCI requirements, but not indicative of a company that's putting the right focus on security.


Is there any need to penetration test a GoogleAppEngine solution? Is there any need to penetration test a GoogleAppEngine solution? Or will it be protected by googles existing infrastructure?

Just because Google hosts the site doesn't make it anymore secure.

It is still your code that is open to exploitation. If it contains business critical information or user data then it is prudent to use secure programming methods and other practice's to ensure the security of the system and your data. This could include penetration testing.

But be sure you are carrying out the testing against your own system and not Google's underlying infrastructure. Also be sure to check the terms and conditions for Google App Engine to ensure penetrating testing your site/app is not in breach of them.

Terms: https://developers.google.com/cloud/terms/

Google Audits: http://googleenterprise.blogspot.co.uk/2011/08/security-first-google-apps-and-google.html

Note: the above audit blog post doesn't mean insecure code hosted on Google's systems is guaranteed. It means their overall infrastructure has been audited and certified. Your code can still be vulnerable.


Why does OAuth 2.0 specification recommends the use of "application/x-www-form-urlencoded" Media Type? I have a situation where the requests can't be of application/x-www-form-urlencoded Media Type and so the question.

Interoperability. The OAuth standardizes format and names to ensure different implementations can work together out of the box as much as possible.

Why do you have a situation where you can't use this format? All major programming languages have libraries that implements this format, many as part of standard libraries.


Transport Layer Encryption vs. Application Layer Encryption Can anyone tell me the key differences between Transport layer encryption and Application layer encryption and outline example use cases where each are most appropriate?

The research I have done so far is that the Application layer encrypts everything down, as the Application is at the highest level in the OSI model. In comparison, Transport layer encryption means that Application, Presentation and Session layers are all in plain text?

I did have a look at this post before. The answers in the post pretty much said it depends on what you are trying to protect, as I'm not designing anything in particular, it didn't really help my understanding of it. I'm really looking for the Pros and Cons for both and perhaps an analogy or at least some context to where each would/should be used?

This is a question about scope and application interaction. So where one is better than the other depends on the scope of access of the data.

With application layer encrypt the data is only view able in your applications memory space. If this is what you need then application level encryption is the way to go. However when sent to another application, that information is encrypted and they can't view it. This is useful in JSON Web Tokens where the server encrypts and de-crypts the information for checks and balances while preventing other layers of the OSI model from modifying it.

Transportation layer encryption though is akin to TLS/SSL/SSH and such. It's where you encrypt it in transport so people can't listen in unless they are accessing the shared memory on the machine that would release the information. This is useful for sending user input to a server that doesn't need to be encrypted, but still having it view able in a web page.

To condense those explanations down a little further:

Application layer encryption should be used when NOTHING else should have access to the data even on the same machine.
Transport layer encryption should be used when you don't want people listening into the data when it is in transport and no longer on the machine it was created on.

Now I mentioned a website example earlier and that's the perfect way to think about it since all OSI models apply to that on the server side.

Websites are data and in transport if they contain user specific information need to be encrypted but should still be view able to the user when the page displays again on the application layer on their end. This is where the transport layer encryption happens.

However to protect against attacks when a user is sending information back they often include a check in the form of a JSON web token or CSRF cookie/field that is not view able by the client, and is encrypted in the application layer so that no one else can view it or modify it. Then if it's the same when it comes back and the information inside of it checks out, they know it's still valid and can honor it on the server side.