Is Double NAT a secure way to create a public wifi network? I'm trying to create an open, public WiFi network in my house for guests to use, as I am hosting a (somewhat) large party later tonight. However, none of my routers have any built-in guest networking features, and they do not support alternative firmware like DD-WRT.

Traditionally, what I've done is simply create a double NAT by connecting the WAN port of a second wireless router to a LAN port of my main router. The main router is secured with WPA2, while the second router (for the guest network) is left unsecured. See the diagram below:

My question though: is this setup actually secure? As in, is there any way for a guest device to access my computer, at 192.168.1.3, or monitor traffic on the main network? I tried pinging while connected to the guest network and it seems like the packets are not reaching computers on the main network, but is there a way to get around this? I read a few articles online about using Double-NAT as a way to create a guest wifi network, but none of them really go into detail about security.

Thanks in advance!

EDIT:

-I drew the diagram in Cisco Packet Tracer because I don't have another program for drawing these diagrams, but I'm not actually using Cisco hardware. The main router is a Verizon Actiontec; the guest network is a cheap Tenda.

You've got it hooked up backwards if you want to secure your network against guests.  Computers on the 192.168.0.0/24 network can freely access computers on the 192.168.1.0/24 network.

If you want to use double-NAT to create a guest network, you need to place the guest network closer to the Internet connection than the network you want to protect from them.  Against casual attackers, NAT acts as a firewall with a "default deny" policy for inbound connections and "default permit" for outbound connections, so you need to put the computers you want to protect on the "inside" of the second NAT.

Against serious attackers, you want your public and private networks to meet only at your Internet connection, where you set up a proper firewall that blocks any communication between the two.


Detecting unusual network activity I have a small business network consisting of ca. 15 devices, a few switches and a two routers. Recently it occurred to me that all the security measures I have been doing are not very productive: I either block some ports (or to be more specific, all ports except a few) or monitor retro-actively what is happening in the network.

For example, I have a NAS device which normally does not have any communication with Internet. I'm the only one who logs into it (which I could also confirm from the server logs). However, using the traffic monitoring tools in my Ubiquiti EdgeRouter Lite I could see that the device had SSL communication with something/someone somewhere. Because I have not any permanent traffic sniffing, I have no idea or way to find out why or with whom this happened.

Is there a solution doable for a small business to handle these kind of situations better, e.g. setting some usual behavior patterns for network devices and start monitoring them and creating alerts when the observed behavior deviates from the assumed usual patterns? For example, I would like to specify that if the server at 192.168.199.100 communicates with any device in Internet, I should receive an email, or if the server at 192.168.199.101 uses any protocol except FTP with a server outside of a specific country it should be blocked from communicating with Internet.

I think it is doable for a small business provided someone can spend a chunk of time setting up a free tool with the rules you need for your environment (I'm thinking of Snort).  I see that you are a developer from your reputation on SO, so I assume there is someone who can do that.  It is just a matter of spending the time getting the tool in place and writing the rules (and keeping them updated and responding to alerts).

That said, Snort will do exactly what you want.   It has real-time alerting that can send emails and block unwanted traffic.  Snort rulesets are often the basis for other Intrusion Detection / Prevent systems.

A good example of the work you might be doing is revealed in these questions:
https://serverfault.com/questions/255843/custom-rules-for-snort

https://serverfault.com/questions/703559/how-can-i-put-snort-in-front-of-nginx-server

https://superuser.com/questions/930742/are-these-snort-rules-redundant


SFTP between guest virtual machine and its host The System

I am using Windows 7 host with Cygwin and a virtual machine running Linux. The actual running guest is an Arch Linux ISO.

The Objective

I want to share files between the Cygwin host and the Arch guest.

Possible Solution

A good solution seems the SFTP protocol, using the Cygwin host as the server, because SSH is available out of the box in Arch and it is easy to configure an SSHD deamon in Cygwin.

I want to reduce the external attack surface and ideally only the virtual Linux guest should be able to remotely log.

Constraints/Challenges

The Windows Cygwin  SSHD daemon runs on the local account that I normal use for my projects, it would be impractical to use a very long and strong password  (since this is the password re-enter every time I leave my desk).
It would be nice to use a different password for SSH, but I think that in this case I should create a different account with a different user home directory, which would make difficult to share files.
The guest IP is dynamically assigned by the virtual machine application software. Therefore it is difficult restrict the remote IPs logging to SSH.
I need to check often my project against new Arch Linux versions, so I start from a clean ISO and I install my project files via the SFTP share. Therefore I can't easily put a private key on the client, as files get to the guest system when the connection is already established.

Solution Security

My current ideas consist in combining an alphanumeric password with a restriction of the remote  connections to the private address space, via host access control files:

# /etc/hosts.allow
sshd: 192.168.0.0/255.255.255.0

# /etc/hosts.deny
sshd: ALL

This is still not satisfactory, since a hacker in a public Wi-Fi network might brute force the password.

If there are safer or more efficient ways to share files between host and guest machine, please fill an answer.

Update

I am currently using VMware Player, but I make my tests with Virtual Box too.

Shared folders

Someone suggested the use of shared folders. As noted sub 3, I need often to test my projects against the current ISO.

VMware Shared folders  do not have an official Arch package.
VirtualBox  Shared folders  do have an official Arch package, but I saw it is often required to reboot to make changes effective, which is useless in the ISO static  environment.

I'm not familiar with VMWare Player, but with VirtualBox, if the network is in "NAT" mode (or, presumably, host-only mode, but I haven't tested it), the source IP address for network connections from the guest to the host is the address of the host's network adapter.  For example, if the host's address is 192.168.0.10, connections from the guest will show up as coming from high-numbered ports on 192.168.0.10.

If you set your hosts.allow file to only permit connections from the VM host's public address, this should provide the security you need.

As an alternative option, VirtualBox supports "shared folders": portions of the host's filesystem that are accessible from the guest.  This requires support software on the guest, though, and an Arch LiveCD may not have it.


In OpenId Connect, why aren't requested claims included in the Id Token? In OpenId Connect Implict flow, after the authorization server has authenticated the user and the user has granted the client access to the requested claims, an Id token is given back to the client.

This Id token contains Claims about the authentication of an End-User by an Authorization Server. These claims consists of a set of required claims, some optional and "MAY contain other Claims".

At a later point, the client may hand the access token to an API, which in turn can retrieve information claims from the UserInfo endpoint.

What is the reason that the claims returned by the UserInfo endpoint is not returned directly to the client after the user has been authorized instead, as part of the Id Token? Why is the UserInfo endpoint necessary? If the claims were returned as part of the Id token, no additional claims would be needed.

Is it because the Id Token may contain data which one don't want to share with the API, such as a refresh token?

Consider that the point of the authorization server is simply to decide whether you should be allowed to do something. The point of the user info endpoint is to provide information about who you are. The fact that the authorization server can provide this information to you doesn't mean that it should.

In some cases the authorization server may not know who you are beyond some credential, so it defers to another server to provide more information.


How dangerous is it to use textmods from internet sources? I have been playing a game (.exe file  downloaded from Internet) that supports the use of Textmods (altering of the game code in terms of textures) so long as they only affect visuals, and not actual game mechanics (leveling, trading, etc.).

I am a bit skeptical to download these Textmods since they come from a third party source on the Internet. How can I verify that it is indeed safe to use the text mods, and what dangers can stem from downloading these Textmods?

Without knowing about the precise game/mods involved, it's only really possible to discuss the risks in abstract.

From what you've said the application processes a file (textmod) which is downloaded from a 3rd party. So to process any data an application is going to need to open the file, read it, parse it, and then act on the instructions therein.

If there is a bug in the parsing code, for example, depending on the language the original program is coded in, you may get something like a buffer overflow or other undesired condition.

Assuming that this occurs, you then would look at impact which in the case of a game being run by the user, is likely to allow the malicious program to execute code with the privileges of the application (likely user-level).

In terms of mitigation, well at a basic level you could open the text mod files and see if they appear to be well formed and lacking obvious attack signatures (e.g. writing much larger quantities of data than might be otherwise expected in a field)

At a more advanced level it would be possible to write code to parse and validate the correctness of the file (assuming that there's a specification available) which could use to check textmods before loading them.


NIDS/NIPS vs HIDS/HIPS Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a traditional NIPS or HIPS?

No, you cannot interchangeably deploy HI?S versus NI?S.  They attack different subsets of the same problem.

Most simply N* is limited to network inputs, whereas H* has access to a far richer set of inputs (files! processes! network listeners!) to be judgmental about (and has less network visibility, so usually doesn't have the rich network parsing and signature set that a N* does).

See also Can Snort be configured as HIDS?.

That said, if your concern is satisfying an auditor or security requirements that say HIDS/NIDS, then either will do - such requirements are often written solely with the goal of making sure you're taking extra steps to secure yourself, not with the goal of dictating one technology or another.


What to do if you ever lose a smart card? I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks.

My idea is to generate the key using GnuPG on an isolated computer, encrypt it and backup that file. Then transfer the key to the smart card (is there a way to do this in GnuPG?)

Any better ideas?

When using a smartcard, this is usually a bad idea to generate a signature key with an external device. It dramatically increases the risk of key leaking. Of course you can mitigate these risks by using an offline computer or storing the backup into a safe but it is always more secure to generate the key inside a cryptographic device.

But what happens when your lose or break your smartcard and there is no backup? The answer is simple: nothing. Because humans can lose their keys, the revocation mechanism have been invented. After you revoking your key, nobody will be able to make a valid signature with your key. But all the signatures you created before the revocation can always be validated by any third-party.

Thus, even if you lose your signature key, no backup is needed. Revoke this key and create a new one. Full stop.

Note that I'm only talking about signature keys. Encryption keys are different. If you lose your encryption private key you won't be able to decrypt encrypted messages that people sent to you. That's why it may be useful to have a backup of your encryption key.


SANS training - worth it? I am a programmer, doing mostly web development now, dealing also with securing the web applications in my line of work. I have reasonable knowledge of security matters, though not always staying up-to-date on the latest developments (mainly due to laziness and lack of time). I'm not doing any pen-testing and not plan to specialize of security only, though I of course want to keep my projects secured.

So, from this point of view, is it worth for me to do SANS training - I specifically mean training courses like DEV522 or SEC542? Would they add enough to my knowledge that it would justify a week spend on them (and the money of course :)? I took their free assessment test and made 92% without any preparation and in half of alotted time (missing ones I suspect are some acronyms that are outside of my line of work), but not sure if that means anything.

Especially interesting would be to hear from people of similar background that went to one of these courses or similar ones.

P.S. I understand this is somewhat subjective, but given the info on the background I think there are many people with similar background that may use such information. I just want to try and estimate the level of the course against the level of average security-conscious programmer.

P.P.S. For suspicious minds: I have nothing to do with SANS and don't know much about them, I'm posting the links only so it will be clear what is being asked about. But I like the way you think :)

My subjective opinion is that these particular courses are not worth it for you.

These courses are expensive at $4,000+ per course. They are highly structured and compacted into a short time period. These courses are perfect for someone who needs to learn a lot quickly and will do well in a structured intense formal environment.

Based on the assesment test you appear to know a good bit of material. You don't seem to be in a hurry, and it looks like you are more interested in learning how to write good software than earning a certification or writing security papers. (I have a security certification, and I like reading security papers.)

In my opinion learning to write secure software is best done by writing software, having peers review it, testing it, discovering vulnerabilities, and fixing the vulnerabilities. Don't assume that it all has to be done for your employer. Follow announcements and news at OWASP or CERT.org or Dark Reading. Contribute to a honeypot project. Read and answer questions at security.stackexchange.com

It takes time for security knowlege to be collected, ordered, and formatted for classroom teaching. While some instructers will throw some of the 'latest developments' into their classes, most of the class will be well vetted security knowledge.

I think that the classes have value, just not for you.


Securing an IMAP service I need to secure an IMAP service running on dovecot.

Which wrapping layers of security can I enhance security with?

I am using most of the built-in dovecot-specific security features, like encryption and secure authentication/databases, so I am interested in OS-level tweaks that play well with offering IMAPS.

e.g. for such a system, would port-knocking add or subtract hardness?

Environment: debian.

this depends if it is public or not.

if private:

use vpn-access, so you imap-server will be invisible to the outside, or
listen on another port than standard
use a tcpwrapper/iptables to restrict access onyl for certain ips

if private or public:

enable TLS
log failed attempts
monitor your server (Nagios, Splunk, OSSEC)
use iptables anyway

sceuring debian:

please Read This Fine Manual


Why is it harder to brute force an iphone than a zip-file? Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second. But for an iphone (let's say iOS9 if it matters), it is said that it would take years to do so. Of course there is the time-lock that restricts password attempts after a few failures. But I think there should be a way, by using an external device, to copy the encrypted iphone's data(the combination of 0s and 1s in the entire hardware) to bypass such 'software' restrictons. Would it still be tough to crack the data? If so why is it so much harder than cracking a 6-digit numeric passworded zip-file?

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second.

This depends on the hashing or encryption algorithm, and the hardware as well.

  But for an iphone (let's say iOS9 if it matters), it is said that it would take years to do so.

Again, this depends on the hardware and algorithms used, and whether it's a hash, or if it's encryption.

  Of course there is the time-lock that restricts password attempts after a few failures.

You are trying to compare breaking the password on an offline zip file, whose brute force protections (if they even exist) can be circumvented by simply writing your own unzip utility, to the breaking of a password on an iPhone's lock screen which stops you after 10 incorrect attempts. The two are entirely different concepts and problems, but they do seem somewhat similar, I'll give you that.

  But I think there should be a way, by using an external device, to copy the encrypted iphone's data(the combination of 0s and 1s in the entire hardware) to bypass such 'software' restrictons.

Regarding the last part, please read Rory McCune's link.

Is there any hope to crack "impossible" encryption?

While some news articles are reporting that it's impossible to break the encryption of the iPhone, and "even the NSA can't do it," I'd take it with a grain of salt as this is a red herring.

Who cares about your Dr. Dalek AESontaren 256 billion bit Racnoss Encryption if you can exploit a vulnerability in the iPhone itself? Let's say in the example of a malicious application.

Instead of unlocking the heavily-fortified front door that's capable of withstanding tremendous punishment, what if you could just break the window and climb in? A vulnerability that allows you to run malicious code, which in turn allows you to view the actions of a user in real-time, and access the contents of their device, is the new frontier. If you can compromise any device, either Point A, or Point B, then encryption becomes a moot point.


How do I know that mobile apps aren't stealing my login info? This thought just occurred to me. If you're using an unofficial client to access a service (ex. BaconReader for reddit), how can you be certain that your login information isn't being stolen?

You can't, which is one of the big problems with password-based authentication for mobile apps.

Reddit also offers and strongly encourages use of OAuth. You can read more about OAuth elsewhere, but the summary is that each individual app gets its own token to use to authenticate to your account. This means you can revoke access for one app without needing to change your password for the website or other apps. In many OAuth implementations, you can specify a restricted set of permissions for each token as well, so you can limit the app from doing things other than what you expect it to.

However, many reddit apps have implemented the OAuth flow in a way that still allows them to sniff your password. The flow involves sending the user to reddit.com, where they authorize the app and are redirected back to the app. The least disruptive way to do this is to use a webview inside the app, but then the user is still entering their password into the app!


Https server side, as well as client encryption? I'm new to data-encryption and do not understand the following:

I convert my domain into a "https" domain, by means of something like "Lets Encrypt".
I have an android app that talks to an api on my domain.
Do I still need to perform client side encryption using a public key on the android app -> send the encrypted data to my api -> decrypt it on the server using my private key?
What does it mean if my domain is already https? Do I need to distribute public keys to every user who visits my domain? How do I do that?

No, the whole point of TLS is to encrypt the traffic between your app and your server. TLS deals with the key distribution, which would otherwise be a really hard problem. TLS was made exactly to solve your problem. Adding another encryption layer that is essentially the same as TLS does not add any security for your system. It only increases complexity (attack surface).

Make sure your TLS implementation is secure and users cannot bypass it (using legacy HTTP or something). Consider using modern security features like strict transport policy and focus on web security (XSS, CSRF, etc.). Experience shows that most of the time the implementations are insecure, not the crypto.


Is it possible to "reverse engineer" identicons? As shown in this question, default user avatars (like mine) are identicons and are generated with the user's email (where provided) or the user's IP address (where the email is not provided).

Given any identicon and information of whether it was generated from an email or IP address, can the email or IP address be identified? If yes, post my email in a spoiler (I registered an email with my account). If no, provide reasoning why.

It used to be possible, as Gravatar identicons are a graphical representation of the MD5 hash of an encoding (trim leading and trailing whitespace and convert letters to lowercase) of your email or IP address. Both of these things are small enough to make brute force feasible. Nowadays, Gravatar includes a secret salt in the hash operation, making it impossible to even attempt to brute force them without knowledge of that secret. The secret is stored somewhere on the Gravatar servers. If someone was able to obtain that secret, they would be able to brute force the email or IP address.
Note that Stack Exchange's Area 51 site still does not use a salt, unlike the rest of the network.


How do VPN services in the US choose to comply with foreign law enforcement requests? Imagine a user from Russia uses a VPN-service which obeys US jurisdiction. This user did violate Russian legislation and the violation is being investigated by Russian law enforcement. Let's assume that this is not a serious offence (e.g. the user has shared private pictures in violation of a local law).

Everything the police have have is an IP address that is used by the VPN-service. Will the US-based VPN-provider (PrivateInternetAccess for example) share logs with the Russian police if they ask for it? Or are they  able to refuse to share logs with non-US police?

Assuming that the VPN service provides logs to law enforcement, then yes. Internet companies in the United States are required to adhere to U.S. data laws. That includes VPN services. That includes the providers used by private internet access.

"Wait, what? But Mark Buffalo, Private Internet Access claims to not keep logs!" Yeah, that doesn't matter. PIA doesn't own the servers you connect to. These servers are leased by hosting providers all around the world. They are the ones who have lots of logs, even if PIA doesn't. Suddenly, hiding behind a VPN seems a lot less secure, huh?

If you're from Russia, and you use a VPN service which obeys U.S. jurisdiction, and you use it to commit fraud (shame on you!) on Russian Territory, then the FBI will likely help the Russian police bust you, and anyone else involved.

Why? There is already precedent for this:

Nine People Charged in Largest Known Computer Hacking and Securities Fraud Scheme
After a dozen raids around the world, police are detaining the hackers behind 'RAT' software, which lets attackers take over Facebook accounts and infect computers

International Cooperation Disrupts Multi-Country Cyber Theft Ring

Search the internet. You'll find lots of evidence of the FBI helping foreign governments bust criminals.

Additionally, you may want to read the Stored Communications Act. If any data is logged, companies are required to hand that over to authorities. Most companies would be more than willing to help law enforcement, as they can charge them access fees.

Now what's the best way to avoid the authorities? It's easy, really.


What is the proper terminology and base CVSS score for the following cache related behaviour? An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in another way.

In order to do so, the server should enforce HTTP headers that require the browser to revalidate (must-revalidate) the source on every request (not to cache it). Practically meaning that when a user is logged out, it should not be possible to browse back in the browser (unauthorized) and see the content that is meant to be restricted to the authenticated user.

What is the proper terminology and base CVSS score for a caching mechanism that allows the browser to cache authenticated content?

I suppose an acceptable CVSS score might be:

CVSS Base Score: 4.0
CVSS Severity: Medium
CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

I believe the proper scenario for this would fall into security misconfiguration according to OWASP.And even falls into the top 10.

Top 10-2017 A6-Security Misconfiguration

I currently agree with the score. But it needs to validate other circumstances also. Such as the information that it stores. If the cache stores credit card information or any financial/personal pages then that can even increase some points 4.2 perhaps.

I would consider this a smaller score if it wasn't on the OWASP
top 10. What I mean is because it is happening a lot it should have a bigger attention. But it can be something critical if an attacker can access multiple browsers. So then again by it being easy to do makes it more critical.


Can Hash Length Extension attacks be avoided by changing the data structure? I read about Hash Length Extension attacks here and here. From the articles I gained that this attack relies on the data structure, in the way that the secret has to be prefixed to the data (please correct me if I'm wrong). If that was the case, would it be a reasonable defense mechanism against this kind of attack to simply move the secret in the data structure?

From the article:

let secret = "secret"
let data = "data"
let H = md5()
let signature = hash(secret || data)

Would this (i.e. moving the secret to the middle of the signature):

let signature = hash( string.Format( "{0}{1}{2}", data.Substring( 0, ( int ) ( data.Length / 2 ) ), secret, data.Substring( ( int ) ( data.Length / 2 ) ) ) );

be safe?

Let formalize the secret in the middle as;
signature = Hash( m[1..l/2] || secret || m[l/2+1..l] )

where l = len(m). This construction is not differ from the original H(k,m) since simply consider that k = m[1..l/2] || secret and then apply the length extension attack, success!
The attack append-only attack H(m,k) - linked by user49075 on the comments - described in section 6 of the HMAC paper, "Keying hash functions for message authentication" by Bellare, Canetti, and Krawczyk only works if

The hash function is not collision-resistant, and
The collision pairs have the same length.

Of course, once the hash function is turned into non-collision resistant like MD5 and SHA-1, it might be easy to find files that have the same length.
The good point is that HMAC doesn't require the underlying hash function to be collision-resistant.

New Proofs for NMAC and HMAC: Security without Collision-Resistance

So you can use HMAC-SHA1 even though SHA-1 has lost its collision resistance.
The construction of the HMAC is complex due to the Merkle-Damgard construction. With the SHA-3, due to it's resistance to length extension attack, one can use KMAC
Similarly, one can use Blake2(K||m) safely since Blake2's design is based on the HAIFA constitution and that can be easily turned into length extension attack resistant hash function as in Blake2.

Why HAIFA and sponge constructions are not prone to length extension attacks?


Kerberos unconstrained delegation for user I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers but haven't seen users mentioned anywhere.

Can anyone clarify what this does compared to setting this for a computer?
I understand that with a computer, say a web app, the server could use any user's ticket that connects to it and delegate it to the DB server or any other server (when talking about unconstrained delegation).

But what happens in the context of a user having this same right? Can the user just request any user's ticket and delegate it? How does the user get access to the tickets in the first place and what is needed to impersonate the other users? Just an exported TGT ticket?

Thanks a lot!

When you do Kerberos Constrained Delegation (or anything pre-Resource-Based Delegation) on Windows, you assign delegation rights to the identity of the process accepting the kerberos tickets from the inbound hop.

So in short, if the process is running as a domain user, that user needs delegation enabled. If it's running as a System-type identity, the computer does. But you should always Constrain delegation, or use the newer Resource-Based Delegation model (where instead of identifying back-end SPNs, you identify front-end Identities allowed to delegate to the target service identity from the target service identity).

Unconstrained delegation is a bad idea - it might best be considered a stopgap solution in Windows 2000 which gained constraints quickly in Windows Server 2003. It allows impersonation of any qualifying service principal (read: User or computer) to another service, with no restrictions. Get someone's ticket, do anything they can do - so control of a service set with unconstrained delegation meant control of any connecting user.

For IIS Web Applications, that generally means the App Pool Account - the base (non-client-impersonating) identity of the w3wp.exe processes associated with that App Pool. If the app pool is running as LocalSystem (don't do that), Local Service, Network Service or ApplicationPoolIdentity, then the identity used for decoding Kerb tickets and delegation is the computer account. (Couple of other caveats there like UseAppPoolCredential=true or UseKernelMode=false might also cause a non-custom user identity to be used to try to decode a ticket, but that's out of scope.)

Any Security Principal can be assigned delegation rights. Giving any User object a Service Principal Name (SPN - use SetSPN.exe), which computers have by default (HOST/computername) will enable the Delegation tab in DSA.msc.

One exception to the above is Group Managed Service Accounts (gMSAs), which should be your first choice for any new service which uses a Domain identity to run a service, as it self-manages its complex password, preventing easy long-term-password attacks on the account itself.


Is Request.getHeader("host") vulnerable? If the following is the code snippet, what would be your suggestions?

<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>

Is this a clear example of XSS? If yes, what are the attack scenarios which can be used by an attacker?

It is a XSS vulnerability, but it's quite difficult to exploit: Take for example the following URL:

http://anything."><script>xss</script>.example.com/aa/bb

This URL will carry an XSS payload in Host parameter when navigated to, but:

DNS would have to resolve this strange domain to the IP with vulnerable application (so unless the DNS is quite forgiving attacker would require DNS poisoning)
The browser would have to skip encoding the hostname - usually the hostname is percent encoded by the browser (so <script> becomes %3Cscript%3E). You could of course forge the request outside browser.
Target server would have to process the request in the context of the vulnerable website, which is not that simple. For example - if this application is installed as a VirtualHost in Apache, this Host header will not match any VirtualHost and will be processed by a fallback or first VirtualHost.

It would be much more dangerous if this XSS was stored and not reflected, because then you could skip the (1) DNS and (2) encoding requirements. You could just plant the payload by sending manual HTTP request outside the browser. This payload would be then visible for 'standard' browser-based visitors of the vulnerable site.

So, as a conclusion - this is a XSS vulnerability, but with low exploitation probability. Still, the application should fix it by escaping the Host header being displayed.


Do I correctly understand how CORS proxy works? There are a lot of CORS proxy servers like this one:
https://cors-anywhere.herokuapp.com/

This allows us to send requests from different origins. For example I can send request from my client's frontend.com JS to GET whatever.com main page.

But I wonder - the server which hosts whatever.com will get my site user  IP or the cors proxy server IP?

I think it definitely should be the cors server IP. Am I right?

If you are trying to defeat CORS you are actively trying to create insecurity and vulnerability for your end users. CORS was not created because we delight in creating unnecessary hurdles to make developers' lives miserable. (We do, but that's not why we did it this time!) CORS helps protect end users. It's super important and it is the way of the future. Here's a really good article explaining CORS. I would urge you not to look for ways to bypass it and work around it. Look for ways to get your web site working with it.

If you build a web site that depends on some proxying site in order to work, but you're not paying that proxy and you're not running that proxy, your whole web site might just stop working one day because that proxy goes offline. Or the user might have trouble reaching the proxy from their network location while they have no trouble reaching your web app from their location. The net result to your end user is that your app looks like it doesn't work, when it's really a problem with them reaching that proxy.

It's a sloppy workaround that bypasses a really useful security control. I'd urge you to rethink this approach.

To answer your question, yes, your javascript or XHR or JSON payloads will have to pass through the proxy. And that's the IP address you're going to see for some requests. It will hinder your ability to analyse who is visiting your site, expecially if anyone is doing something malicious.


How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC? What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (deriving an alternative private key from a public key through manipulating cryptographic algorithms so you can spoof a certificate), I don't really understand the technical aspect and how it's used to subvert ECC validation.

what's the logic behind the exploit, how does it work technically to undermine Elliptic Curve cryptography and what can be done with it?

To answer the second part of your question (What can be done with it?): The curveball vulnerability essentially undermines the trust of a certificate (which is crucial in PKI). This allows an attacker to sign content with a spoofed certificate. The content will appear as trustworthy to a user, even though it is not.

Basically everything that uses the Crypt32.dll for verification is affected. Arguably this is most problematic in HTTPS connections (an attacker could perform a Man-in-the-Middle attack that goes unnoticed by the user) and code-signing (an attacker could bring a user to execute code that the user believes to be from a different source).


Securing web applications with only a reverse proxy In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to internal web services for processing.

The idea is that my client has "strong" network level security: the various web applications sitting behind the proxy would carry no security constraint as they cannot be accessed from the outside. They want to keep debugging easy when multiple internal services call each other. Plain http for internal calls, no TLS.

I'm thinking it's a terrible idea to leave internal applications "wide open" because any attacker that manages to get inside the network has basically free access to sensitive (cleartext) customer data... and history seems to prove that it happens a lot. From an operational standpoint, it will be a pain to enforce fine grain constraints like ACL from a proxy (OAuth scopes/URL matching), and maintain configuration up-to-date when new services are deployed.

Do you guys see anything I'm missing? Any additional argument for implementing application level security?

EDIT : Some important detail I did not clearly mention/explain :

The web applications I'm talking about here (hiding behind only a security proxy) are all web services.
Web applications with user interfaces (public/internal "sites") are in another network zone, and carry some decent application-level security compared to the web services in question.

The "strong" network security I mentioned is all about zones, end-users (and unauthorized insiders) theorically cannot access the web-services directly (only through the proxy). I guess ops could still offer some kind of route when they access the machines, as stated in the answers.

Based on my understanding, I think you don't even need to get inside the internal network to prove that's it's a terrible idea. An attacker (who can be an ex-employee, third party contractor or an existing disgruntled employee) having some context about this insecure internal application, including details such as internal host address where the application is hosted, important functionalities of the application, some knowledge of overall look and feel of the application (this will obviously help in creating a phising website), and of course, the fact that application is vulnerable to common web application issues (especially Cross-Site Request Forgery).

Alright. Based on the above assumptions, I can think of the following possible attacks:

Tricking an internal user in making a state-changing request to the application by exploiting a CSRF vulnerability. This itself can be used to exploit other common vulnerabilities in the application by tricking an authenticated user to visit your website, where your JavaScript will be waiting to make requests to the application with your payloads, but with the victim's session cookies. You can send injection payloads for command injection, SQL injection, XSS, etc. Since you know your attack surface, you can craft the requests accordingly.
Exploiting a misconfigured JSONP or CORS implementation on the application. Again, for this, you'll be utilizing the CSRF vulnerability to make a request to the internal application with their session cookies. But this time, instead of performing a state-changing request, your malicious JavaScript will be reading back the sensitive response from the application (because of JSONP and CORS). You can read more about it here, here and here.
Phishing internal users (via DNS cache poisoning, maybe). Now since you know how the intenal application looks like, you can create a phishing website or just the login page for the application and host it on a public address. You can then either poison the DNS cache of the enterprise DNS server within the network, or by simply modifying the hosts file of internal systems (maybe by tricking them into downloading a malware). This last step is a bit tricky to exploit from outside the network, but I hope you get the idea. More details on DNS cache poisoning in case you are interested in further readings: DNS and DNS cache poisoning. Once you have that set up, there is nothing preventing you to phish the internal users because the application is not over TLS (no authentication)!


Can a tor exit node know the ip of .onion sites? I am just wondering about this since I heard that tor exit nodes know the ip of the website the user is visiting

No, a Tor exit node does not know the IP of a .onion site. The only node that knows the real IP of a .onion site is a special node called guard node. It's the first node the hidden service connects to, so it knows the real IP.


Secure Exchange Rate for Restful API I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another API #2 (same API provider) with that confirmed exchange rate to execute money exchange.

To avoid storing state on server and to protect the exchange rate from being modified by the user, what I can think of is that API #1 needs to return a plain exchange rate together with its corresponding encrypted one using symmetric key. Then pass the encrypted one to API #2 for transaction execution.

Am I correct? How to securely implement the encryption? Per-user symmetric key with login name & login timestamp? Or generate a session key randomly for every login session?

There is no need to use encryption since the information is not secret. The important part is instead to protect the information against modification (which is not even provided by all encryption methods).

Since both API's are provided by the same provider a way to do this is to have a secret only known to the provider and then use the secret and the exchange rate together inside a HMAC. This HMAC can then be created by API#1 and send together with the exchange rate to the client. The client will use the given exchange rate and the HMAC when calling API#2 where the server can compute a new HMAC using the provided exchange rate and compare it with the HMAC send by the client. If both match the rate was not tampered with. Implementations for HMAC are available in most common languages. See also Wikipedia:HMAC for more information.

If both API's are not provided by the same party then a shared secret can not be used. In this case one could use digital signatures: The provider of API#1 would create a key pair (RSA or ECC) and publish the public key of it. The private key would be used to sign all messages which need to be protected against modification, i.e. the exchange rate in this case. Everybody who got the public key would be able to verify the signature and thus detect tampering. For more see Wikipedia:digital signature.


What is the "Australian Failure"? In the notes for my Computer Security course, the lecturer refers to the "Australian Failure" on slide 19. I'm assuming he's referring to a well known security system failure, but I can't find what it is, does anyone know what he's talking about?

An entry like that is probably a speaking point for the presenter. I'd put something like that there if I knew of a case where a multi-level security system that related to information classification had a notable failure... in Australia.

But it's not a well-known name for any failure, and I've tried a few variations of http://www.google.com/search?q=%22australian+failure%22+security with no apparent hope of getting anything other than the slides in question.

Given the location in the presentation and the topic of that section, I'd say it's not a well-known vulnerability. It's probably a specific implementation failure example. You just don't really run into much that does that kind of classified handling outside of places that play with governments. Security there is a different world.


What is this scheme called and how should it work exactly? So I was thinking about client-server communication and how to keep this private, especially from man-in-the-middle attacks. I came up with a scheme that I'm sure exists already, but I could not find sufficiently concrete search results to learn more about it.

It started by my thinking that when a client connects to the server, they would like to establish a secure communication channel, so the client could generate a private/public key pair and send the public key to the server. The problem is getting the public key to the server securely (otherwise a man in the middle could just decrypt all messages using the public key it grabbed from the first message, attach its own public key to the message, use the corresponding private key to decrypt the response and, after storing that, re-encrypt with the client's actual public key).

So I thought of a possible solution: the client first receives a public key from the server, that it will use to encrypt its own public key. The MitM can intercept all messages, but won't be able to decrypt any of them - only the actual server can decrypt the client's request and the response can only be decrypted by the actual client. Once the server knows the public key of the client they securely store that and use it to encrypt any further communication.

I have a few related questions.

What is this type of security / handshaking called?
I have heard the word nonce but am I right that this is about preventing replay attacks and not the MitM problem I'm trying to solve?
The initial key that the server sends to the client, should that be fixed and possibly published somewhere, so clients can skip the "give me your public key step" on subsequent sessions? Or should it be a freshly generated key for each client at each new session request?
Conversely, should the client's public key change with every session or can client re-use the same key once it's been securely communicated to the server?
What are the risks to this, other than the obvious failure by one of the involved parties to keep private keys private?

I am sure that this is fairly common and probably already how a lot of authentication schemes work, so rather than answering all these questions separately, I would be happy if someone could provide me with the proper terminology (I tried some combinations of keywords like "client/server", "asymmetric encryption", "establishing session"; but they are too general to find anything useful). And even though this is a theoretical SE, I guess that like with all good security one should not roll their own implementation, so any example code of a proper client/server application (e.g. in PHP) using well-established libraries would be welcome.

The specific phrase you're looking for is "key exchange".
https://en.wikipedia.org/wiki/Key_exchange

There are a few schemes(many deprecated) for accomplishing this securely, but if you're writing your own program(and thus aren't as worried about "who is this person actually", and just about securely exchanging the keys), Diffie-Helman is a good place to start at.
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

Diffie-Helman is specifically designed to make exchanging keys secure even if observed. If you are wanting to make key exchange secure against MitM attacks, that is where having certs signed by a trusted CA comes in. A trusted CA will not(or is not supposed to) sign the same identity for multiple parties, so an attacker in the middle intercepting the legitimate public key before it is given to the intended converser will not be able to sub in their own public key, since it won't be properly digitally signed.

Nonces are indeed there in order to make sure each message is only being replied to once, and usually within a set time. They don't prevent an attacker from intercepting them, forwarding them on, intercepting the reply, forwarding that, etc.
Forward Secrecy is considered the best practice now.
https://en.wikipedia.org/wiki/Forward_secrecy
With systems implementing forward secrecy, new keys are generated each session, so that previous session information cannot be compromised using a mitm interception of the new keys. Note: you're not generating new long-term private keys each session, you're generating new and random 'secret keys' (i.e. the key used only during that session to encrypt traffic).
The user-specific private keys which are used to generate per-session secure keys are kept, but those keys are not the keys being used to directly encrypt and decrypt traffic.
Apart from private key compromise, nothing can prevent a mitm from tampering with traffic they can touch. Proper CA signatures can prevent the certificate chain from being valid if they do tamper with something, but that won't actually protect the data; just its trustworthiness.


Better way to store user authentication on phone app We are creating an app and registration of user happens in following way.

User sends via app: email-id/phone and username.
Server sends a pin to enter in app via phone/email.
User enters the pin in the app.

After this we are thinking of two ways we could store some authentication information on app.

A. Server send a token which used by app with all subsequent requests.

OR

B. We negotiate on a secure key using Diffie–Hellman. Then there is a login function which includes server sending challenge and user answering. After this token is generated, used, and later discarded.

All communication is happening over https. Though option B looks better, option A is easier. Any particular reason we should choose B ? One reason I see is unable to
change token, but are there any obvious security risks ?

Also comments to improve A or B are welcome.

Don't store long lived auth-tokens, as they can be replayed.

Don't store anything connected to a global shared secret, because that could compromise the user indefinitely.

Don't store anything derived from the user password, as that opens up very easy dictionary attacks.

SHA(last-session-key) is one of the best and most secure authentication tokens you can store.  It doesn't compromise previous sessions. It's a large secret with plenty of entropy. It can only be used once. It's easy to combine with other factors if you want even more security.


Truecrypt compromised? (Coldboot attack) In light of recent developments in computer forensics and "password recovery" utilities, can encryption technologies such as TrueCrypt still be relied on for a high degree of protection?

It would seem to me as though the ability to retrieve decryption keys from a device's RAM (even after shutdown) means that hardware-based encryption solutions will be the way to go in the future.

can encryption technologies such as TrueCrypt still be relied on for a high degree of protection?

Yes, provided you understand exactly what protection you're getting from Truecrypt.

Encryption is not access control and it does not protect your system whilst it is powered on. Once you put the key material anywhere near the computer (e.g. typing it in, loading it into memory) you should treat the computer as containing the key material because it does.

Therefore, anything that can extract your computer's RAM can read this key material. This should not be remotely surprising in any way. I have looked through the truecrypt driver code in a fairly extensive way (I don't approve of the statically allocated stack buffers they use, they should prefer ExAllocatePoolWithTag, but what do I know?) and it would not be all that difficult to write a driver to pull the volume keys out of memory on a system which has truecrypt running.

If you want encryption of your disks to be effective, you must do two things:

Ensure that you do not attach the key material to the system when you can be observed by somebody you wish to prevent from accessing your data.
Have the system powered down when the data is stolen.

Against a casual, opportunistic thief, point 1 happens by default since the thief in question is almost never there when you are using your device. This makes disk encryption a good defence against stolen laptops, for example, since opportunistic thieves who steal powered down laptops get some hardware, but not some data.

The determined attacker, or what cyber-literature refers to as an advanced persistent threat, however, may have the resources to observe 1. This could be through several means:

Bugging the locations you input the key material including hardware keyloggers, cameras and whatnot.
Exploiting the good old remove the RAM, freeze it and whatever techniques preserve system memory after power down.
Compromising your system whilst it is powered on - firewire, malware, whatever.

This has been the case for as long as disk encryption has been in use and will be the case for as long as disk encryption is in use in its current form. Encryption does not protect you against these threats - for these, you need good access control, good auditing procedures, good security practises to prevent malware access, good physical security etc.

Slight update, for extra fun:

Hibernation is a known attack vector in modern operating systems which depending on your implementation stuffs up secure boot entirely. The work done on this was derived from the fact it was possible to bypass Patchguard by altering the page file to load code.

The motto of the story in these two cases is that the operating system cannot trust the state it loads from disk unless it has control of the CPU.

How does hibernating affect your in-memory key? That depends on whether the hibernation file exists on the encrypted drive or not. If it does, good - you'll need to re-enter the key to decrypt it (and you'll have prevented the hibernation file attack vector, too). If it doesn't, then if the key is written out into the hibernation file you are in trouble. If it isn't, you're still not massively safe, as a sufficiently determined attacker with serious resources can probably take advantage of that.


How secure is Ubuntu's default full-disk encryption? How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it?

If someone could at least provide a link to some documentation or article regarding that I would be very grateful.

Reference:

In a word: sufficient.

This is block-level encryption, so it is filesystem-independent.

Ubuntu's transparent encryption is done through dm-crypt using LUKS as the key setup. The built-in default for cryptsetup versions before 1.6.0 is aes-cbc-essiv:sha256 with 256-bit keys. The default for 1.6.0 and after (released 14-Jan-2013) is aes-xts-plain64:sha256 with 512-bit keys.

For older versions of cryptsetup:

AES you certainly know; it's about as good a cipher as you could want.
CBC is the chaining mode; not horrible but certainly not what I would pick for new projects: it has several issues but it can be used securely.
ESSIV ("Encrypted salt-sector initialization vector") allows the system to create IVs based on a hash including the sector number and encryption key. This allows you to jump straight to to the sector you want without resorting to predictable IVs, and therefore protects you from watermarking attacks.
SHA-256 is the hashing algorithm used for key derivation. LUKS uses PBKDF2 to strengthen the key for (by default) a minimum of 1000 iterations or 1/8 second, whichever is more. On a fast computer, expect around 200,000 iterations. With respect to security, you couldn't ask for a better arrangement.

And with newer versions of cryptsetup:

XTS is counter-oriented chaining mode. It's an evolution of XEX (actually: "XEX-based tweaked-codebook mode with ciphertext stealing"), while XEX ("xor-encrypt-xor") is a non-trivial counter-based chaining mode; neither of which I can claim to completely understand. XTS is already very widely supported and looks promising, but may have issues. The primary important details are these: No fancy IVs are necessary (plain or plain64 is fine), and half of your key is used by XTS, meaning your original key must be twice as long (hence 512-bit instead of 256-bit).
PLAIN64 is an IV generation mechanism that simply passes the 64-bit sector index directly to the chaining algorithm as the IV. plain truncates that to 32-bit. Certain chaining modes such as XTS don't need the IV to be unpredictable, while modes like CBC would be vulnerable to fingerprinting/watermarking attacks if used with plain IVs.

Other options not used by default

LRW has been largely replaced by XTS because of some security concerns, and is not even an option for most disk encryption products.
benbi calculates a narrow-width block count using a shift register. It was built with LRW mode in mind.

Altogether, this makes for a pretty tight system. It isn't the absolute best system theoretically possible, but it's pretty close. You should be able to trust it in any reasonable circumstances as long as your password is sufficient. Your attacker will almost certainly choose brute-forcing the password as his preferred attack method.


Utility company does not hash passwords in the database I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this pretty insecure and contacted company with my concern, they basically said that they don't feel that hashing passwords is necessary since nobody but me knows my account and user name. Trying to explain implications of not hashing passwords didn't lead anywhere - I don't think they understand the problem.

Whom should I contact to force them to correctly store passwords?

  This question was IT Security Question of the Week.
  Read the Jan 27, 2012 blog entry for more details or submit your own Question of the Week.

There are two sides to this problem:

Security implications for you

Basically, the only working mitigation is to use a different password on every account you own (And then, use a password manager like KeePass, 1Password, etc. to store them)

For the utility company

Hashing passwords adds security. Unfortunately, it also adds cost - to implement it, to test, etc. Password recovery procedure will change, etc, etc, etc.

Basically, you need to be a good salesman to explain their risks to them and show them that the potential losses (reputation, etc) are worse than the cost of hashing - if it really is.

So, to do that, you need to get in contact both the CISO (or CIO, or CTO), and then, after convincing him :) - approach those who will shell out the money for this.


How to tell if my MacBook is being spied on I've been trying to determine if there is malware on my OS X 10.9.3 Mac, that is could be doing keylogging or other forms of non-destructive intrusion.

Given the (not technically based) suspicion I have that my machine was compromised and that the compromise may have survived a complete HD wipe and OS reinstall, I'm wondering what steps I could take to determine if the machine is still compromised. I am not asking for help determining if I am being spied on personally, just trying to determine whether my laptop is secure. Please no comments explaining why it is unlikely that something is happening. I'm asking about technical steps I can take to increase confidence that no one is currently monitoring my laptop.

Steps I've taken so far:

Manually inspected several areas of my disk using basic shell tools. Some files had been overwritten including binaries within specific application directories, and a rogue process that was identified as spyware which I was able to remove, prior to eventually wiping the hard drive and reinstalling OS X (over Air from another machine, since this is a MacBook).
Installed Sophos AntiVirus (many months after OS reinstall). Full HD scan found no threats. Background process scan has yet to alert me of anything.
Wireshark has found several suspicious (to me) network streams sending varying amounts of encrypted packets at regular intervals to several servers, including ones with no DNS entry, a few from *.nl or *.ch TLDs, and some that have turned out to be explained. (A process named SophosWeb is sending encrypted payloads every few seconds, rotating ports in the 5K range, back and forth from a server registered to Google. So, sounds legit...) Wireshark produces a lot of data.

On the last in particular, where the ultimate concern is spying on my activities or data, I don't know how to wade through the noise of frequent traffic between my laptop, the Verizon router, my phone... Some of this looks completely kosher, but then there are things like UPnP exchanges between my Apple laptop and the Verizon router, which are questionably secure at best, and hard to know how to turn off. If I close Chrome I can get traffic down to enough of a trickle to manually investigate each unknown server, but I don't know what to look for.

Reduce your exposure
within System Preferences > Sharing close everything you don't need.
To give you a practical example, in my case, everything is off.
Shut off netbios:
cd /System/Library/LaunchDaemons
/usr/bin/sudo launchctl unload -w com.apple.netbiosd.plist
ps ax | grep 'PID|netbiosd'

This might highly reduce network noise.
Scan for residual crapware
See How to scan a Mac for rootkits and other stealthy security hazards
Detect basic data leak
This isn't bullet proof, but will detect most known data leak and call back home to help you focus on serious problems.
Little Snitch 3
This is a fantastic tool. It won't detect everything but will help you to reduce the abnormal traffic to a very reduced one.
Hunt within a reduced traffic
And now to the core business,
look at residual strange connections:
netstat -A
tcpdump -i en1
wireshark


Tools for Second Order SQL Injection Was doing a CTF where 2nd order SQL injection was needed. It's all been done manually but was interested whether there were tools that could have automated the process.

One page allowed you to add a query to a cell via a URL parameter and another page executed that query and put it in a nicely formatted table rather than just dumping the results of that query.

Thanks

Yes, sqlmap has a second order parameter.

From the documentation :

--second-order=S..  Resulting page URL searched for second-order response.

See https://github.com/sqlmapproject/sqlmap/wiki/Usage for more informations.


On the use of gpg2 for long-term encryption I am looking for tools/libraries for symmetrically encrypting millions of files (many terabytes' worth of content).

In particular, I am exploring the possibility of using gpg2 for this1.

One concern I have is that many years may elapse between the time these files are encrypted and the time it becomes necessary to decrypt one of them.  Therefore, it is essential to preserve whatever is required for decryption all this time.  I am not clear of what this would be in the case of gpg2.

This example will clarify my point.

When I type the following on my terminal

% gpg2 --symmetric > the_answer.gpg

...a dialog pops up asking for a passphrase, and after I enter it, another dialog pops up asking to confirm it2.  After I do all this, I can type in a message.  So I continue with

% gpg2 --symmetric > the_answer.gpg
42

...and then I type Ctrl-D.  At this point, the file the_answer.gpg contains an encrypted version of the message I typed in.

If I now run gpg2 --decrypt the_answer.gpg, gpg2 just goes ahead and decrypts the message immediately, without asking for a passphrase at all:

% gpg2 --decrypt the_answer.gpg
gpg: AES256 encrypted data
gpg: encrypted with 1 passphrase
42

I figure that gpg2 must have stored the passphrase somewhere3.

Q1: If, say, 10 years in the future, I had the file the_answer.gpg, plus the original passphrase, and some other machine running some future version of gpg2, would this be enough to decrypt this file, or would I need something else?  Or would I also need to have some persistent database-type files currently residing somewhere in my computer?

Q2: Since gpg2 implements an open standard (OpenPGP), are there other tools besides gpg2 that I could use to decrypt the_answer.gpg if I know the passphrase?

1 ...even though I realize that gpg2 is a tool optimized for asymmetrically encrypting an individual's email communications, a very different task from what I have in mind.

2 I realize that such dialogs are a deal-breaker if one wants to encrypt millions of files.  I understand that it is possible to supply the password without going through these dialogs, so I will ignore them for the purpose of this question.

3 Moreover, somehow it knows that this passphrase was used for this message.  Indeed, if I encrypt other messages with different passphrases, I can decrypt them too, as shown above, without ever being prompted for a passphrase.

Yes, to both of your questions.

GPG uses the passphrase to programatically generate a symmetric encryption key that is used for the encryption/decryption process when the --symmetric flag is passed to the program.

Yes, any program that uses the OpenPGP algorithms can create the decryption key from the same passphrase (that algo is the special sauce, and it is part of the open code, so anyone can use it).

Also, just so ya' know, PGP/GPG encrypts everything with symmetric encryption.  The difference triggered by the --symmetric flag is that normally it generates a completely random encryption key per output file, but then uses asymmetric encryption to encode this key to each listed "encrypted to" party, and includes those at the beginning of the file.  That way any of the encrypted-to parties can use their private key and the first part of the file to find the symmetric decryption key.  But since symmetric is so much more efficient, it is what is actually used to encrypt the payload data.


Is preventing XSS/HTML Injection really this simple? A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection.

Obviously, this doesn't prevent issues such as:

<img src="%injectable%" />

But I can't think of a way around his suggestion.

Is it really that simple?

I think your example describes exactly why it isn't that simple.  There are many forms of XSS, and quite a few of them don't rely on attackers injecting entire tags at all.

What Rook was getting at in his comment is that you should generally rely on a good existing XSS filter to deal with the threat rather than trying to piece one together your own, as your colleague seems to suggest.


I managed to capture a botnet control host, what do I do with it? A few days ago one of my webhosting customers had their FTP login compromised, and the attacker modified his index.php file to include some extra code, and roughly twelve thousand other bots have been trying to access it via a POST operation since

I'm okay at PHP but no genius, but from what I've been able to garner it takes the (encrypted) data included in the POST, decrypts it together with the contents of another file left behind on the host, and sends a response packed into a HTTP 503 header.

From the behavior, I get the feeling this system was set up as a control host for a botnet.

I've managed to save a copy of the PHP code as well as a packet capture of one of the bots trying to POST after I'd already deactivated the site... But now what do I do with it? I don't have the time or expertise to further analyze the damn thing myself, what groups should I forward the lot to?

If you want it analysed for business reasons then you need to find an appropriately skilled forensic incident response consultant (excuse the jargon: 'A log analysis guy'). These generally cost money, lots of it.

Bear in mind though that most botnet deployments aren't targeted and are very wide-spread. There probably isn't much to learn about it that isn't already well-known and which affects everyone else. Groups that deal with advanced threats won't be terribly interested in this sort of thing, but you might have luck with an AV vendor. Symantec, Sophos, etc sometimes like to collate this kind of data for their glossy white papers.

The most interesting logs are going to be the ones just before the suspicious traffic starts when the botnet actually exploits the system, since that will allow you to do a post-mortem on the attack. However I'm going to use my amazing psychic abilities to assert that something wasn't appropriately patched and that's how the bot got in.

Addendum: For the love of the Gods don't just give access to your systems (or sensitive data on your systems) to some random person on this site.


Is an OTP alone useful for a hacker? Further, does an unused OTP expire by itself? i.e in regards to digital banking - in case a hacker accesses your SMS's through malware or other means.

It depends on who provides OTP. If the application is designed / implemented badly, it can accept OTPs without expiration. If the application is designed / implemented correctly, it will have expiration time for each OTP.


Is this an example of XSS attack? A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor running a javascript that could be any javascript. I didn't practically try it but I could include "bugs" that changed layouts on other parts of the page. For instance I could redecorate the link named "next" in a pagination list for comments by posting a comment with CSS and I'm sure that if I allowed users to post code I wouldn't allow them to execute javascript from another user and allowing CSS from a comment to override elements the page has surely is unwanted. Is what I'm talking about a site that has a vulnerability for XSS and therefore should increase its security?
Thanks

Yes, that is exactly what is talked about when discussing XSS vulnerabilities. In the context you described, one could also add code to redirect a user to any site or present possibly malicious code directly from that website. Changing the target of password forms, posting cookies to other websites and many other malicious acts are possible.


is deleted data immediately overwritten with new data in hard drives In hard drives deleted data can be overwritten. But is it immediately overwritten when new data is stored? For example, I take a picture and deleted it. After sometime, I take a new picture. Is that older picture overwritten? I'm interested mainly in how drives overwrite data.

In general, no, you cannot expect recently deleted hard drive blocks to be the first used for writing new data.

In the case of traditional platter disks, the performance read/write for individual files is affected by where (physically) on the platters the data is written.  Some operating systems, and some utilities, will choose where to write data based on complex optimization algorithms (often during Defragmentation).  So there are factors other than "what got recently freed up" that go into deciding where to write data.

With newer SSD drives, the problem gets even worse - the hardware controller on the drive itself does the same thing, choosing write locations according to algorithms designed to maximize coverage and minimize rewrites.  As a result, you can't even be guaranteed to overwrite the entire disk by filling the disk - you must use ATA Secure Erase to clear the data.

If you're concerned about deleted files being recovered, you need to be proactive:

Use a secure file wipe program on files instead of deleting them - shred, sdelete, PGP wipe, etc.
Use whole disk encryption; that way, if the disk is swiped, an attacker can't simply pull (plaintext) raw disk blocks off the drive.
If on a platter disk, wipe slack space on a disk (e.g, Windows cipher /w:c:) regularly


What to do if a webpage on the dark web is blocked because I need to enable JavaScript Having JavaScript enabled on the dark web is suicide, but what should one do if a site displays a big poster saying "JavaScript needs to be enabled to access this site"?

JavaScript on its own shouldn't be a problem in the context of a darkweb browser such as Tor. The browser is configured to use a proxy and JavaScript can't magically get around that in order to reveal your real IP.

The problem is that JavaScript can be used as part of exploits. If there's a vulnerability in your browser, a malicious page might be able to exploit it in order to get code execution on your box, or otherwise perform operations that deanonymise you.

If you trust the site and you're accessing it over HTTPS, feel free to run JavaScript on it. Shouldn't be a problem. If you're accessing over plain HTTP then I would be more concerned, because a malicious exit node could inject malicious JavaScript.


Does IOMMU prevent DMA attacks? what does IOMMU actually do, does it manage memory access for devices like MMU does for processes or is it more simplified thing and doesn't provide virtualization/access control ?

So basically my question is: does IOMMU mitigate DMA attacks ?

Here's a low-level programmer's point of view: yes, an IOMMU can mitigate DMA attacks. The IOMMU determines which part of the RAM devices can access. If the IOMMU doesn't let a device map a particular part of the memory then that part of the memory is immune to direct attacks from or through this device.

In practice, effectively leveraging the IOMMU can be difficult. Depending on the machine architecture, the IOMMU may have less flexibility and a coarser granularity that the MMU, so that the OS can't always implement the optimal security policy. Devices may be multiplexed on the same bus in such a way that different devices with different requirements and different levels of trust have a common IOMMU configuration, requiring compromises.

So having an IOMMU helps, but it is not an automatic defense. And, in practical terms from a system administrator's point of view, having an IOMMU is not enough, what matters is how the OS configures it.


self reset password with MFA I need to implement a reset password feature with Multifactor authorization. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user.

I think the order of these should be: answer qs---> send code ---> create new password. But our current wireframe has: send code --> answer the qs ---> create new password.

Thoughts?

Your idea of changing the order is good, because the additional question could be used to avoid sending unnecessary password reset messages just by typing in the username or the email address. The security question is not there because it's secure: their nature tend to be easy to answer after researching the target. That's why the order matters for other reasons.

If you use email addresses as login names, they are bind together in a way that makes it easy to know where the information needed to reset the password goes. That's not generally dangerous to every user, but on a large pool of users there may be someone who's vulnerable. Also, if the email gets compromized first, it may be used for resetting passwords for such sites. In this case, two factors isn't much.

There's all kind of variations, but the factors should always be independent: something you must know and something you need to have access to. Using both email and SMS adds extra level of security, e.g.

Ask security question to launch the process.
Email one-time link to a password reset page.
This page, when accessed, sends a code to the phone.

Nowadays it's common that people have their email on their phone. Having unlimited access to someones phone gives ultimate power over two of these factors: email & SMS. That's why security questios aren't completely pointless even if they don't add a strong layer of security. The phase 1 possibly prevents an unlocked stolen phone from being used for a password reset.


How can I safely view the code of a VBA macro? I have received a phishing email with the usual bogus bill in the form of a Word document. I am curious about what the probable virus wants to do so I would like to inspect the code.

At the moment Word opens the docx in protected mode, and I am not going to disable that as I assume that the VBA macro would execute immediately.

I know that a VM might be a solution, but excluding that (I don't have one to hand), is there a simple way to see the macro code without executing it? I'm thinking something like open it in Notepad or similar. I know Notepad doesn't read .docx but along those lines.

Microsoft Office fileas are actually nothing but glorified zip files. If you change the extention to .zip you can extract the content. There you should find the file word\vbaProject.bin that contains the VBA macros. However, as the extention suggests, this file is binary and is not much help in letting you read the source code.

Fortunately Microsoft has published the specs for the format, and there are a number of programs that can help you. I have not tried any of them, but there is a nice list on Decalage. Check it out for more details! These are the programs listed there:

olevba
oledump.py
officeparser.py
OfficeMalScanner

A minor detail: A docx file should not contain a macro, as those are not allowed in docx files. According to Microsoft:

  Word lets you save macros in two Word file types: a Word Macro-Enabled Document file (.docm) and a Word Macro-Enabled Template file (.dotm).


How to restrict LAN addresses in a browser? How to prevent Chrome to connect addresses from LAN to prevent CSRF attacks like this?
<img src="http://192.168.0.1/some_action">
Info for other browsers is welcome here too.

Enable the Chrome flag Block insecure private network requests.
chrome://flags/#block-insecure-private-network-requests


How to make sure that my operating system is not affected by CVE-2016-5195 (Dirty COW)? I am running following version of Linux operating system.

Distributor ID: Debian
Description:    Debian GNU/Linux 7.2 (wheezy)
Release:        7.2
Codename:       wheezy

I am not sure whether this version is affected by CVE-2016-5195

Can some one help me out to clear my doubt?

Update : After running the command mentioned by AliCelebi I get following

3.2.28-cerberhost-0.6-modules-grsec

You can do uname -rv to find out your Linux kernel version. You will get an output similar to below:

4.4.0-42-generic #62-Ubuntu SMP Fri Oct 7 23:11:45 UTC 2016

If your version is earlier than the following, you are affected:

4.8.0-26.28 for Ubuntu 16.10
4.4.0-45.66 for Ubuntu 16.04 LTS
3.13.0-100.147 for Ubuntu 14.04 LTS
3.2.0-113.155 for Ubuntu 12.04 LTS
3.16.36-1+deb8u2 for Debian 8
3.2.82-1 for Debian 7
4.7.8-1 for Debian unstable


What are all these connection attempts in my firewall log? I've read many similar answers, but they all dealt with machines that were running publicly accessible services. In my case, I have a (newly installed and fully patched) Ubuntu machine that is used as a file server, with no GUI, web server, or anything else installed.

However, I am getting hundreds of connection attempts every day which are blocked by ufw. The strange thing is, this machine is not accessible from outside - I have a hardware firewall and I don't have any forwarded ports or anything that should even allow external IP addresses to connect to this PC. Here's a sample (I've removed some of the duplicate requests...):

[  785.659880] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=68.128.204.97 DST=192.168.1.103 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=0 DF PROTO=TCP SPT=443 DPT=42023 WINDOW=28960 RES=0x00 ACK SYN URGP=0
[ 1162.810808] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=104.73.231.80 DST=192.168.1.103 LEN=60 TOS=0x08 PREC=0x40 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=40491 WINDOW=28960 RES=0x00 ACK SYN URGP=0
[ 1212.008102] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=173.194.214.188 DST=192.168.1.103 LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=4599 PROTO=TCP SPT=443 DPT=40711 WINDOW=42780 RES=0x00 ACK SYN URGP=0
[ 1214.007927] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=173.194.214.188 DST=192.168.1.103 LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=5571 PROTO=TCP SPT=443 DPT=40711 WINDOW=42780 RES=0x00 ACK SYN URGP=0
...
[ 1226.355604] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=65.54.225.168 DST=192.168.1.103 LEN=56 TOS=0x00 PREC=0x00 TTL=43 ID=10430 DF PROTO=TCP SPT=443 DPT=43674 WINDOW=65535 RES=0x00 ACK SYN URGP=0
[ 1232.364241] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=94.31.29.160 DST=192.168.1.103 LEN=60 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=80 DPT=43995 WINDOW=28960 RES=0x00 ACK SYN URGP=0
[ 1302.304905] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=74.125.196.188 DST=192.168.1.103 LEN=52 TOS=0x00 PREC=0x00 TTL=46 ID=3459 PROTO=TCP SPT=5228 DPT=49283 WINDOW=349 RES=0x00 ACK URGP=0
[ 1302.590812] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=74.125.196.188 DST=192.168.1.103 LEN=64 TOS=0x00 PREC=0x00 TTL=46 ID=3660 PROTO=TCP SPT=5228 DPT=49283 WINDOW=349 RES=0x00 ACK URGP=0
...
[ 1322.776168] [UFW BLOCK] IN=ens160 OUT= MAC=00:0c:29:7d:dd:c9:00:1f:12:5c:02:0c:08:00 SRC=216.68.248.26 DST=192.168.1.103 LEN=64 TOS=0x00 PREC=0x00 TTL=60 ID=60176 PROTO=TCP SPT=443 DPT=49431 WINDOW=255 RES=0x00 ACK URGP=0

It's weird because my router firewall should definitely be blocking port 80/443, much less 5228 (Google Play Store? No idea what's going on with that.)

What is this traffic and why is it reaching my PC?

It looks like your ufw is missing a rule for accepting ESTABLISHED, RELATED connections. Not sure how that works on ufw, but on plain iptables it is iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

What you are seeing there is that your computer started a connection but then is blocking the response.


What are the privacy and infosec risks with Apple Watches and Android Wear? From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE.

Conversely Android watches have the ability to run full applications, and therefore have a local storage component.

Some regulations require that data be encrypted locally, and this is an extension of Activesync Exchange policy.  In addition, it's possible to remotely wipe a phone.

Do either Apple Watches or Android Wear have local storage, or cache data from the connected phone?
Is there an ability to encrypt, and wipe that cached data?
What is the privacy of the data on the device?  Can an app on the phone read all data on the watch?  What constraints exist?
If the watch connects to the internet, is an always-on VPN an option? (some phones have this)

I am sorry but I cannot speak for Android Wear, I don't know their technical infrastructure. I know a lot about the Apple Watch. So:

  Do either Apple Watches or Android Wear have local storage, or cache
  data from the connected phone?

Yes, the Apple Watch has 8 gig of internal storage and yes they cache the last data you received on each indiviual app (WatchOS1). So for example if u open your news app, the next time you open that app it will continue with the last data. This is a choice for each developer. Banking apps I use don't cache personal data at all (that's why it is so slow).

  Is there an ability to encrypt, and wipe that cached data?

From the GUI there is no such option. Building your own app you can do that.

  What is the privacy of the data on the device? Can an app on the phone
  read all data on the watch? What constraints exist?

Apps on the Watch always come with an iPhone app. It's part of the download. That app can read all data from the watch app. But no other app can.

  If the watch connects to the internet, is an always-on VPN an option?
  (some phones have this)

The Apple Watch doesn't connect to the internet. It uses the iPhone's connection. So, partly, yes.


DLL hijacking - How to find out if path is relative I am playing around with dll-hijacking and was wondering about something that I haven't been able to find out myself by googling.
I get how the basics work with the fact that DLL's are loaded by an executeable/service/installer. I also understand how windows goes through the loading "path" to find the DLL's. So I can get my DLL's to execute calculator when I put my DLL in the path of the program itself when I know for sure it tries to find the DLL's in the path of the program.

But here is my question: How can I find out if a DLL is loaded by an executeable using a relative path?

What I want is to be able to execute that "not found" DLL from a directory in the PATH variable, so if I am just misunderstanding that, that would be possible please tell me as well.

Edit

I see that my question isn't a 100% clear by the comments/answers I am getting. So I will clarify a bit: I am just playing around so I have a testlab setup. What the question really is about is if there is any way to see if the DLL's that are loaded by an executable are loaded with a relative path and not by a absolute path. SO if the executable tries to just find test.dll or if it is refering to c:\windows\system32\test.dll. I am using procmon to see what DLL's are loaded by several applications (like Discord). In procmon I cannot see how the executable tries to find the DLL (relative or absolute path) and that is what I want to find out, how to see if the executable goes trough the different paths as described in this Link or if the executable is only trieing to load the absolute path of a dll.

It's a pretty old threat but the following might help you. Just take the .exe in question and move it to a user writable directory. If you then notice that it tries to load a DLL from the application directory you have a prove that the DLL is loaded not specifying absolute paths, because if that’s the case, the Windows OS has a pre-defined search order for such situation to ultimately be able to load the needed DLL.
As an example. I’ve copied the  WinSAT.exe from C:\Windows\System32 to C:\test. If I then execute WinSAT.exe from C:\test with Process Monitor running I can clearly see that it tries to load the dxgi.dll from the C:\test directory:

If you don’t already know that, folders that are created at the root of a partition are granted permissive rights. And that’s the case with our C:\test directory. Now guess what. YES! You can place a evil DLL under C:\test, name it dxgi.dll and load your DLL with some evil badness.
PS. Here’s a nice visualization of the actual search order:


TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error Late last year the CA/Browser Forum decided to limit the maximum valid term of TLS/SSL certificates issued after 1 April 2015. After this time, as the official guidelines put it..

  CAs SHALL NOT issue certificates with validity periods longer than 39 months.

I've recently been (re)issued a certificate with a validity period of 2015-04-07 08:57:25 GMT to 2018-07-09 07:00:18 GMT. This looks a lot like 39 months and 2 days to me but every single SSL checker I've used says it's totally valid. It also works fine in Firefox 37.0.1 and Internet Explorer 11.0.9600.

Problem is, Chrome gives me a NET::ERR_CERT_VALIDITY_TOO_LONG error, a point with which I tend to agree. This occurs in versions 42.0.2311.68 m and 44.0.2360.0 canary (64-bit).

Is this an issue with the certificate or a bug in Chrome?

More specifically, how are "months" supposed to be calculated for the purpose of TLS/SSL certs?

Note this shouldn't be related to the sunsetting of SHA-1 signed certificates that happened in Chrome 42, the new cert is definitely signed with SHA256.

It should be noted that there's nothing wrong with the certificates from a TLS or x509 point of view. The CA/Browser forum applies to CAs issuing publicly-trusted certificates that subscribe to those guidelines. Not all TLS or x509 use cases involve public trust.

An internal government or enterprise CA, for example, might reasonably choose to completely ignore these guidelines. In fact, if Chrome is applying those rules strictly to non-public certificates it's kinda contradicting x509v3:

  In some situations, devices are given certificates for which no good
  expiration date can be assigned.  For example, a device could be
  issued a certificate that binds its model and serial number to its
  public key; such a certificate is intended to be used for the entire
  lifetime of the device.

Obviously Chrome is under no obligation to accept such certificates, but they are a legitimate type of certificate nonetheless. An intranet user who wants to trust their own intranet CA (say, Active Directory) might find Chrome prevents them from doing so, based on requirements that are irrelevant to them because they don't subscribe to the CA/Browser forum.

It is incorrect to say that an x509v3 certificate is invalid because it has a long expiration date in the general case.

It is correct to say that an x509v3 certificate is invalid because it has a long expiration date when it is being issued by a ca which is expected to conform to the CAB requirements and is consumed by a user-agent which expected to conform to the CAB requirements.

It is therefore important to recognise that there's no intrinsic technical mechanism for determining whether a CA is supposed to be CAB conformant or not. Thus, browsers are left to either:

a) Assume the CAs subscribed to the CA/Browser Forum are conforming appropriately and accept false positives if the CA doesn't conform, for whatever reason.

b) Aggressively reject certificates that don't conform to the requirements in every case, regardless of who the CA is, imposing CAB-style requirements even where they might be actively harmful.

Neither is wrong, I think (unless there's a bit of the CAB that puts an obligation on the browser, I can't claim to have memorised the entire thing word for word - See addendum). What is correct is the SSL testers you've used don't reject the certificates as being inherently invalid. Without any context, it would be wrong to say they were invalid.

The outcomes you've described, then, is exactly what one might expect from these requirements and the answer to the question "Is this an issue with the certificate or a bug in Chrome?" is, in my opinion, the certificate, because it was issued by a CAB-forum subscribed CA that failed to implement their obligations in a non-ambiguous manner, forcing the browsers to make up their own mind about whether to enforce those obligations by veto or not.

Addendum:

  The Requirements are not mandatory for Certification Authorities
  unless and until they become adopted and enforced by relying–party
  Application Software Suppliers.

Chrome (a relying-party Application Sof..... zzzz) have adopted and are enforcing it, thus by the letter of the law we can assert is mandatory for CAs that are dealing with publicly-trusted certificates and are subscribed to the CAB Forum requirements to create certificates that conform to this requirements.

(Unless we're being hyper-pedantic, in which case it's a plural and we'd actual need 2+ browsers to enforce it because otherwise Chrome is only a relying-party Application Software Supplier, not Suppliers.)

I think it's amusing that the obligations CAs are actually bound to changes depending on individual implementation details in every supplier. Any time a web browser or any software associated with the CAB anywhere in the entire world is updated suddenly a CA might have to implement a requirement that they didn't previously.

Thus, until it failed in Chrome, there was no obligation on the CA to conform. The moment Chrome was patched to start throwing this error, the CA was in breach of their obligations. Surprise, MF!


Analyze attack as an outsider Today I visited my favorite news outlet using Firefox on my Android and suddenly I got malicious .apk file downloaded to my phone. Of course, I immediately reported the incident to the site owner.

While the site owner didn't fix the issue, what can I do to understand the attack more thoroughly? I don't have any control over the site.

I skimmed through the source of the main page but failed to find malicious JS.
I plan to look at the .apk file itself after the issue is fixed, but for now I want to focus on the site.

BTW, I connect to the site over https.

This stuff usually happens not because of malicious scripts but because the ad provider has ads with malicious content. Contacting the site owner will only make him aware but since he probably still wants to display ads he will not do anything about it.

What can you do?

Contact the ad provider and tell them they have malicious ads (Maybe they don't know?)
Download a Firefox Android ad blocker extension to block these in the future (You can browse through the extensions here).


Is there some way to protect apk file from being decompiled? I'd like to know if there's something to help with that that isn't over complicated as I'd like to protect an Android application against that at least a bit.

I'd like to make clear that I'm talking about avoiding the decompilation of the apk file itself, I know there are some tricks to make the code harder to understand, as using Proguard to obfuscate the code or not storing raw values (I'll also implement them), but what I want to know if there's some way in which if someone where to obtain the apk and put it on an Android decompiler he couldn't get the code (at least in some cases).

This looks hard at first but I don't think its impossible, I renember that years ago some desktop applications where able to detect that were being decompiled, and not allowing its code to be taken, if I renember well they could at least detect they were being detected by some decompiler like OllyDbg. I don't see a reason why it shouldn't be possible with an apk file.

PD: Not sure if this goes here or in reverseengineering, I think the question is in reality about anti reverse engineering which I think is a subfield of information security. But I'd like to ask an admin to move it there if needed.

Thanks for your time.

It's impossible to completly obfuscate your code. What you can do however is to compile some of your business logic into native libraries.

System.loadLibrary("yourlibrary.so");

and then invoking the natives with JNI. It would still be flawful but at least  better than using the pure code. I'm not a proficient Java developer, but a similiar feature in C# would be DllImport. It won't prevent you from being debugged but it's harder to debug, especially against script kiddies.

Oh and remember it'll be a pain to maintain, especially when you'll not be writing java to the .so file. And also remember to target multiple architectures.

From my understanding you can make it harder but not impossible. ProGuard should do fine.


How secure is wiping an encrypted Android device? based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are destroyed, making the data within the device useless.

Android also provides encryption by using dm-crypt and I believe it encrypts everything when the device is in boot stage. Now let's say I reset the device to factory settings. I know that without encryption, I can recover a significant amount of data by acquiring and carving files from the physical image.
However, I am wondering if there has been any research done on acquiring an encrypted image after resetting to factory settings and recovering useful data from it.

I've found that some presentations from defcon and such sort of delve into this topic but I was wondering if there is anything more concrete out there.

Thanks for the help.

The principle is the same whether Apple or Google does it. Most of the data stored on the device (including all user data — everything but some startup code and of course the encryption key) is encrypted, and the only way to decrypt it is with a key that is stored on the device. (The key may be itself encrypted with the unlock passcode, but that's a separate matter. For our purposes here, there is a key file, which contains the key in a potentially-recoverable form.)

Once you wipe the key file, there is no way to recover any of the encrypted data. The only information you may be able to get is a rough upper bound for how much data was stored on the device, and even this only if the device was not initialized with random data — I don't know if all Android integrations do this. The data itself can only be recovered with the key.

The data may be recoverable if you've backed up the key outside the device (or if you've backed up the data itself of course). As long as you don't leak your key backups, the data is unrecoverable once the key on the device has been wiped.

In both cases — Apple or Google — it may be possible to recover the key file from the part of the flash storage that is currently unused due to wear leveling, if that part happens to contain the key file. This isn't something you can do in software, you need a bit of electronic equipment and fiddling with the flash storage (I think you have to unsolder it from the board, which is already a major stopper for casual attackers and kills the device's resale value).