Literature about IT security from a hardware standpoint Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)?
I'm primary interested in the motherboard, CPU & GPU, however, if you know any good reading about network equipment (on this subject), please share.

I'm not interested in how you can hack Wi-fi with aircrack or how to make a buffer overflow script. What I'm interested is, e.g., "This CPU instruction under these circumstances can give you access to this protected data". Or, something like "When you access the motherboard like this, you can bypass the BIOS password".

Andrew "Bunnie" Huang hacked the XBox by attaching monitoring equipment to the memory bus and reverse engineering security protocols by monitoring the data on the bus. He wrote a paper and a book about it.

Huang, Andrew "Keeping Secrets in Hardware: the Microsoft XBox Case Study."(http://web.mit.edu/bunnie/www/proj/anatak/AIM-2002-008.pdf) AI Memo 2002-008

Huang, Andrew "Bunnie" Hacking the Xbox : an introduction to reverse engineering (Unlimited ed. ed.). San Francisco: No Starch Press. (2003) ISBN 9781593270292

For a discussion of Intel and AMD CPU security functions McCune et al How Low Can You Go? Recommendations for Hardware-Supported Minimal TCB Code Execution" (2008) is essential reading.

No discussion of hardware security would be complete without discussing FPGAs. Huffmire et al "Moats and drawbridges: An isolation primitive for reconfigurable hardware based systems" (2007) is a great overview of the use of FPGAs in secure systems.

The challenge of building solid hardware security is illustrated in Kocher et al "Differential Power Analysis" (1999). In it they describe a brillant side-channel attack based on power consumption.

On the theory side Lie et al "Specifying and Verifying Hardware for Tamper-Resistant Software" (2003) is a good discussion of adding execute only control to memory to enforce access control.


Being directed to hacked site only when searched through Yahoo A local wolf sanctuary had just posted a warning on Facebook to not visit their site because it had been hacked. However, it only sends you to the hacked site when searching through Yahoo.

I was curious as to how this might be working and why it's different?

The site is whar.org (assuming it hasn't been fixed at the time of reading).

I have just verified this.

If the request header contains the Referer (which your browser adds after being refered by another site), you are redirected to the fake page.

This is the response, which causes the "redirect":

Now we modify the request to not contain the REFERER: header:

And the correct website is loading.

So basically, the "hacker" checks the REFERER header, and if it is set to Yahoo (or possibly others), it will show you the wrong page.


Is it possible to "fake" being connected to a router? A friend of mine is taking a UNIX systems class and mentioned to me that when they take exams they do so on their computers. That is all students are using their own computer/laptop.  Students are not being provided a computer by the professor.  In an attempt to prevent cheating and googling of the answers, all student's are required to connect to a router that the professor has set up in order to take the exam.  This router is not connected to the internet.

If anyone disconnects from the router during the exam time the professor then knows that they were potentially trying to use the internet. Apparently he has told his class that this system is "foolproof" and is so confident in its ability to prevent student network access he often leaves the room during the exam.

I admit that I'm not particularly well versed in this area of networking but theoretically couldn't this safeguard be defeated by using something resembling a man in the middle attack. You spoof a MAC address and IP and send that to the target router, which then thinks you are connected even though there is no real connection? Or is this problem network card based, where the vast majority of computers only have 1 wifi card and can therefore only do network related tasks for 1 network at a time.

Well, obviously it's not "foolproof". Depending on your capabilities, there are plenty of ways to cheat.

Your professor has a point in that your standard wireless network card won't simply support a simultaneous connection to multiple different APs, thus preventing your from using that particular interface for an Internet connection. (Although with some tinkering you could possibly alternate between networks without letting the professor's AP take notice by tweaking your driver to omit the layer-2 management frames that are supposed to notify the AP of your intent to dis-/reassociate.)

However, there are also easy workarounds:

Build in a second network adapter (or plug in an external USB one, once the professor leaves) to connect to a network with Internet access. You can easily do this without interrupting your existing connection.
Connect with your phone or another device instead of your real computer. On that device you can configure the broadcasted MAC address to match the one of your computer. This could fool your professor but probably wouldn't withstand a forensic investigation of the traffic.
Use Bluetooth. Most laptops have built-in BT, so you could  just tunnel your traffic via BT to a hidden device that itself is connected to the internet.
Get creative. There are plenty of ways to bridge an apparent air gap. You might use your sound card to transmit data in a small range (or even your hard drive for that matter) - but then again you could also spend that time studying for the exam.

One effective countermeasure might be capturing every student's screen during the exam, but personally I find that very intrusive. Ultimately, if the professor allows students to use their own computers there will always be some way to prepare the devices to cheat.


What are the vulnerabilities of using NFC on my Samsung SGS3? The new Samsung SGS3 is equiped with Near Field Communications, which is basically an RFID reader inside the mobile phone.  The RFID reader can be programmed to execute commands or run programs.

What are the vulnerabilities of using NFC on the mobile phone?

I think it all depends on particular usage scenario. Because potential attacks can involve for example:

Over/underflow in software handling nfc communication
The same in regard to application software that is using nfc
Potential electrical overload of nfc transceiver
Information disclosure - if there is some "harmless" service code used to test nfc during development
If nfc usage does not involve human acceptance any vulnerability in application software can be exploited without you even knowing about it
Without strong authentication device spoofing can be possible

All of these are potential threats to nfc, as to any wireless technology you might say. So as long as you will be aware that this is wireless and it means that anyone has access to it, and you institute a reasonable precautions you should be ok :). As a final word if it is not needed all the time turn it of :).


mitmf doesn't work when disabled ip forward I have virtual machine windows connected to NAT network.
I also have kali linux virtual machine connected to same NAT network.
I have port forwarding disabled. cat /proc/sys/net/ipv4/ip_forward
gives me 0.

I run the command : mitmf --arp --spoof --gateway 10.0.2.1 --targets 10.0.2.4 -i eth0 . then I go to windows virtual machine type the url and it still accesses the website. Why? I know windows's virtual machine's ip is 10.0.2.4 so its requests have to come to kali linux machine first. I have ip forwarding disabled. so request doesn't go anywhere. why does it still work and accesses the website?

This still works because MITMf automatically enables IP forwarding when using the --spoof option:

def set_ip_forwarding(value):
    log.debug("Setting ip forwarding to {}".format(value))
    with open('/proc/sys/net/ipv4/ip_forward', 'w') as file:
        file.write(str(value))
        file.close()


How did my browsing choices reach an Alibaba seller? Events, spaced about evenly over 2 months:

Repeatedly ordered small amounts of webbing on a rather reputable Polish site (Allegro.pl, much like ebay).
Got targeted ads in Skype for webbing on Alibaba.
Clicked an ad (90% certain it was from Skype, else from targeted ads on some programming site) to see what the hell the image was showing; browsed for a few minutes. I was signed in on AliExpress at the time.
Received an unsolicited "we have webbing sling you may have interests" message, catalogue and quotation (80% complete order, just click "confirm order") from a seller on Alibaba

I have Windows 8 with ESET Endpoint Antivirus, Chrome browser, and gmail for the correspondence. All relatively up-to-date and showing no signs of being compromised. Purchases had been made on a computer with Ubuntu; no hijacks found.

That's all that feels relevant so far.
How did the seller know who to spam with this? Does Alibaba grant sellers access to a list of visitors? Was there some script on the listing or ad?

There are many ways that advertisers can track you across different sites.

As mentioned here, Skype displays Google ads.  In Google's Terms of Service, they state:

  Our automated systems analyze your content (including emails) to
  provide you personally relevant product features, such as customized
  search results, tailored advertising, and spam and malware detection.
  This analysis occurs as the content is sent, received, and when it is
  stored.

This is a likely culprit as Google could have used your Gmail account to use an invoice from Allegro.pl to target you ads.  Since 96% of Google's revenue comes from advertising, Google constantly shares your information with 3rd parties such as Alibaba.

Another option is through the use of tracking cookies - also known as persistent cookies. If you are interested in how they can be used to track you across the web, EFF has published an article on how they are used in the case of Facebook, which has similar tracking practices to Google.
A third option is through browser fingerprinting, which can track browsers through configuration settings.  You can check if your browser can be uniquely fingerprinted via Panopticlick. The about page of the Panopticlick research project states:

  When you load a web page, you will automatically broadcast certain
  information about your browser to the website you are visiting — as
  well as to any trackers embedded within the site (such as those that
  serve advertisements).

  The site may then create a type of profile of you, tied to this
  pattern of characteristics associated with your browser, rather than
  tied to a specific tracking cookie.

If you are interested in reducing the likelihood of this kind of tracking in the future, you may want to install the browser addon Privacy Badger or Ublock Origin which will block connections to tracker domains.  For more advanced control, try UMatrix.


On a server to server SSL connection is there any trustable information identifying the calling server? Imagine server A calling server B over SSL and that both servers have SSL certificates installed.
Later server A again calls server B.
Is there a way for server B to know that server A is the same server in both calls without a client certificate?
In my application I issue a shared security token in the first call. But in the second call I would like to know that the security token hasn't been copied to and is now sent from a third party C, so I'd like to add an additional check that A is still A (not necessarily the same physical server but it has the 'A' SSL certificate installed). I cannot enforce the use of client certificates. I cannot rely on the IP address because they are volatile.
As far as I understand I can get the server A hostname from the [EDIT: encrypted HTTP] header. But I suspect an attacker could spoof the hostname and just insert HTTP host header 'A' even though it is C?
I also suspect that the calling server A isn't using its server certificate when establishing a connection to server B?
I would like to hear if I am wrong in my assumptions and / or if anyone has any suggestions other than using a client certificate
P.S. A solution could be that B could call back to A over SSL and ask if A just posed a question, but that's rather involved and I'd like to avoid such a step.

What you are talking about is called authentication: A needs to prove that it is really A.
One of authentication methods can be authentication based on client certificate (when A want to use some service of B, the we say that A is a client of B).
Another method, much simpler, can be usual User/password authentication. The services that B provides should require authentication. All possible clients should be known to B, e.g. should be contained in some registry or database on B, so that B can check if particular user is known and that the password is valid.
If there are more clients that can call services of B, every client should get its own user/password.
Thus, when B receives some request, it checks credentials and, if check was successful, executes the requested operation, otherwise returns some error.


Thunderbird uses AWS: Secure? In their Privacy Note, Mozilla writes the following:

Amazon Web Services: Thunderbird uses Amazon Web Services (AWS) to host its servers and as a content delivery network. Your device’s IP address is collected as part of AWS’s server logs.

(i) If one has an Amazon account and uses Thunderbird simultaneously, does this mean that Amazon can track me?
(iii) Can Amazon read all my emails?
Thanks a lot in advance! :)

The fact that someone uses AWS for their servers or storage should have no correlation to an individual's Amazon account.
Amazon already has some pretty substantial track and identify capabilities, Thunderbird should be no factor as far as Amazon is concerned.
The question boils down to:

Exactly what data is Thunderbird saving?
Can Amazon read it?
Would Amazon have any interest in reading it?

Amazon is certainly capable of reading AWS content, but their business model would be destroyed if it was a common practice, so outside of a legal directive it's unlikely they have any interest in reading AWS content. Automated hash checks for "Known Bad" may occur.
Apparently Thunderbird defaults to saving a disturbing (to me) amount of meta data. Nothing I've seen implies that they are saving any email, but I have not personally verified that one way or the other. There are controls to turn off sharing Thunderbird meta data, I assume they work but I no longer use Thunderbird since TB78.
Incidentally, many free email services like Gmail, AoL, and others say right in their terms of service that they read your email.


At what level does session key entropy become a real-world issue? Say we have a session key of between 0000000000-9999999999, providing 33.2bits of entropy. This is far short of the 128bits recommended by most.

Of course, it is normally trivial to change session keys to be of reasonable length, but there are a lot of legacy systems out there using shorter session keys.

At what point, assuming that the generation of session keys is random, does the entropy mean that real-world attacks are possible?

33.2bits of entropy on a low-traffic site unable to handle high-speed brute-forcing is still a long time.

Well, you said it. It depends on the context. Precisely, it depends on what the attacker has to do to test an hypothesis on the session key.

If the attacker, to test a key, must talk to your server, then this is an online attack and it won't go faster than what your server can do -- moreover, you could apply countermeasures, e.g. stop talking to clients that obviously engage in attackish behaviour. 33 bits ought to be enough for that. This is, after all, the situation of servers that do password-based authentication of clients.

If the attacker can just do computations on his own machines, to ascertain whether a potential session key is the right one or not, then this is an offline attack, limited only by the computing power available to the attacker. In that situation, 33 bits are way too few to be much of a problem for the attacker. Exact threshold depends on the attacker's motivation, his available computing power, his patience, and the amount of computations needed to verify one session key; but 33 bits are really too low for that.

Whether the context is that of an online or offline attack depends on the details of your protocols. If the "session key" is just sent to the server within a SSL tunnel (e.g. a cookie for an HTTPS Web site), then this is an "online attack" context. Just configure your firewall to block clients that connect too many times within a small time frame, and you should be fine (or, at least, finer than your competitors, so attackers will attack them, not you).


Signature instead of PIN, Visa card Most of the credit cards require PIN to authorize transaction. Recently upon a transaction the merchant required my signature and not my PIN. I understand this is another sort of authorizing the transaction. But this is more to held me accountable , if i denied the payment.
It doesnt offer the security of a PIN since anyone obtaining my card can ran away with the money. The transaction was less than 100$.
 Moreover , i remember my father 10-15 years ago paying for bigger sums with just his signature, before the PIN arrived i guess.
Does this means whoever has either my card / or photograph of my card (both sides with CCV code) can withdraw as much as he wants?

Payment protocols have many variants. However, they mostly boil down to the three following:

The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently with a purely mechanical device).
The card number is obtained by a payment terminal (e.g. with a swipe of the magnetic strip); the payment terminal then talks to the bank. The PIN code is used to authenticate the user (it is sent to the bank for validation).
The card is a smart card; the chip contains some secret value which is used to authenticate the transaction (with a MAC or a digital signature). The PIN is sent to the card and is used to convince the card that its true owner is indeed allowing the operation.

In any case, the point is not exactly to prevent fraud, but to reduce it to tolerable levels. The merchant does not really mind a fraudster running with the money, as long as he will be refunded by the bank. The bank sees the big picture and does not feel invested with the sacred mission of catching all thieves; the bank wants the total fraud cost to be as low as possible, and that's not the same thing.

Banks usually prefer it when the PIN code is used, because it lowers fraud level (by as much as a factor of ten, as I heard). However, this requires a PIN-aware terminal; with solution 2, a network connection must also be maintained with the bank; with solution 3, the card must have a chip (smart card deployment was long delayed in the Americas because banks waited for the 1986 French patent on smart cards to expire). Merchants are not usually cooperative for changes (they must pay for the new terminals) and card deployment is not fast (since each card is valid for several years), so the "first type" payment method (with a pen-based signature) is still possible in many shops. It should gradually disappear, though, because it allows for easier frauds, which makes banks uncomfortable.

Ultimately, this is a question of relative strength between banks (who want to enforce the systems which will ensure the least possible amount of total fraud) and merchants (who want to have the automatic refunding at the least cost for them). The card owner himself does not have much to say... however, legally speaking, the card owner is "protected" as long as he follows the official rules from his bank. As long as the bank does not forbid him to pay with a signature, the bank must refund the user if a fraud on his account occurred.

(Whether bank clerks will make the operation easy is another question.)


How does a website detect proxy? How can a specific website detect that I'm surfing via proxy?
Is there a way to use proxy and not get detected? If so, how?

A proxy will by default tell the destination the IP address of the original requester by adding a X-Forwarded-For HTTP header to the original HTTP request. This make it obviously easy for the server, not only to know that you are using a proxy, but also to know your actual IP address, effectively dropping your anonymity.

Then you have what is called an anonymous proxy or anonymizer. It is the very same software, however this time the proxy server has been configured in order to not add this header. The request therefore appears as originating from the proxy server itself, your own IP does not appear anywhere, thus preserving your anonymity.

However, while your anonymity remains preserved, i.e. the remote site cannot know your actual IP address, it can still determine that you are using a proxy:

There are list of proxy servers available around the net. If a server sees an incoming request originating from an IP address belonging to such lists, then he knows nearly for sure that this request went through a proxy.
Moreover, while the remote server does not know your IP which has been masqueraded by the proxy, all other headers composing your request generally remain untouched. These headers contains a lot of information, like your browser type and version, and the OS you are using.

If a server receives a lot of requests coming from the very same IP address, but showing each time different browsers and OSes, the chances that this IP address is a proxy are rather high. However the server will have no definitive way to tell whether it is an open poxy, that is to say a proxy usable by anyone for instance in order to remain anonymous, or a legitimate private proxy, like you could find in any corporate environment.

There could still be some more advanced checking to be done on server-side like issuing a reverse lookup to get the DNS name associated to this source IP address to check if it corresponds to some well-known proxy services providers, but these may be heavier to put in place and be more error-prone than the X-Forwarded-For header or the known proxies IP lists. You can find some more techniques on this interesting answer.

Now, the best ways to ensure that the fact you are using a proxy is not detected:

Obviously do not claim you are using one, so use an anonymous proxy.
Turn off all advanced plugins like Flash and Java which could bypass your proxy settings and reveal your genuine address to the remote server (actually, I would recommend to turn them off in all cases as a sanity measure, but this is another subject).
Ideally setup your own private proxy server on some VPS provider. Such a private proxy server will have a very low requirement in terms of CPU and memory, so it could be very cheap. It must require an authentication (you do not want bad people do nasty things from your system, do you? ;) ), and ideally this proxy would be listening on a non-standard port and be firewalled to be joignable only by your IP,
If you want to hide your identity and not only your IP address, take care of anything which could link you with any hosting or proxy services you could rent (payment system, email address, IP used to fetch the emails, etc.).


How does firefox sync password recovery work? According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts the data and sends it over the wire without the key.

But if I forget my password, I can still recover it, by having firefox send a password reset email. According to this page: ive-lost-my-firefox-sync-account-information, you can't recover your sync password without your email.

How does password reset work?
How is Firefox able to decrypt your data on their servers without your old key and send it back to your browser for syncing?
Does it stores the old key somewhere or is there some weird crypto magic going on?

The specification says:

  Note that, since the forgotten-password client never learns kB, any class-B data will be lost.

NB: kB is the private key.

Here's how it works:

You generate a new password
A new private key "wrapped" with your new password
Your old data is lost

The developers of the protocol assumed that if you lost your password, you would still have a device with the data synced. Therefore your device would re-sync the data from scratch.

If you loose your devices AND your password, you're doomed.


Whynopadlock.com shows one insecure link on microsoft website. Does that mean that htts communication can be compromised? The question is related to this one from stack overflow.

Can anyone explain when I enter https://microsoft.com to https://www.whynopadlock.com url input form there is 1 insecure url detected.

Does this mean that the whole page can be compromised because of that link?

Some additional googling on trans_pixel.aspx:

Windows 8.1 apps use process named WWAHost.exe that uses HTTP and HTTPS to communicate with several Microsoft webservices such as: ..., http//c.microsoft.com/trans_pixel.aspx (Windows 8.1 Inside Out);
Virus total https service report (can be found here), C-SIRT: "Malicious site", but all the rest URL Scanners say that this is a "Clean site" Analysis date:    2014-11-28 13:02:44 UTC ( 1 year, 3 months ago );

Looking at the page's source code, you can see there's an image element loaded if the browser has JavaScript disabled

I'm believe this is a tracking/analytics element from Microsoft as a fallback for their JavaScript-based tracking script when JavaScript is disabled. If you browse to that page and check your console, you wouldn't see anything out of the ordinary. However, if you disable JavaScript, you'll see this warning:

Having a non-TLS resource in an HTTPS page is referred to as having mixed content. This exposes these requests to tampering by a man-in-the-middle MiTM to inject JavaScript, CSS, or just plain HTML in the loaded page. Even with benign elements such as , an attacker is able to sniff the cookies sent with these non-TLS HTTP requests.

So, is the connection here compromised? I don't think so; being an image element, loaded if JS is disabled, and it's on a separate domain, all makes unlikely for this to be an issue. However, Microsoft should know better than to have mixed content.


What's the safest way to make home server available from outside the network? I have an old laptop that I decided to use as a server, with some samba shares and whatnot (making available some dvd rips and the like), and I'd like to be able to access the files in it from not only inside my home network, but also the outside network.

I read about port knocking, and that seemed like a decent idea — until I realized that because the server would be behind a router it might not be the best idea unless I get a new router that allows for it specifically. Then I read a bit more, and realized it might not be as safe as I'd originally gathered.

While investigating if my router allowed for port knocking, though, I came upon the notion of the DMZ — 'cause my router lets me configure that and all. My understanding of this, though, is that I'd need to make the whole server available to the world, and I'm not entirely sure how complicated it'd be to set up proper protection on a server in a router's DMZ, to later SSH into it from the outside.

Finally, while trying to get some answers out there, I also crossed paths with the idea of maybe getting a RaspberryPi and making it a VPN server so I can VPN into my home network. However, once again, not sure how vulnerable to exploitation that'd be.

I have a limited knowledge of security principles, not being a pro or anything, hence the doubt on this. My knowledge of iptables, for instance, is very limited, so I wouldn't know how to properly protect the router if I put it in the DMZ.

Is one of the three methods mentioned above generally preferred, in terms of safety? And what methods of securing it are generally recommended too? Bonus points: is one of them easier to set up too?

In no way I would put the system directly as fully accessible into the DMZ of the router.

If you only need to make the server available for yourself while outside of your network then a (properly secured) VPN into your network might be the best option when taking both usability and security into account. The VPN makes sure that only you (with the proper credentials) can build the tunnel into your network. And from there you have easy access to the whole home network.

Another option would be to only expose SSH to the outside and transfer your files with SFTP or SCP (file transfer over SSH). This is more secure since only a single service on a single machine instead of the whole internal network is available from remote, i.e it offers a reduced attack surface. But at the same time it might cause worth usability since you cannot simply use the built-in file sharing  to access your files but would need an application like Putty or Filezilla (assuming you are using Windows on your mobile system) to transfer the files.

If the SSH based solution is acceptable to you in terms of usability it is probably the preferable and also the easiest to setup too.


Is it a good practice to include a download URL of my GPG public key in my email signature? I was wondering if I can put a download URL for my recipients to get my GPG public key easily in my email signature.

Is this a good practice? If not, what's a good alternative?

I submitted my keys to known key servers such as http://pgp.mit.edu and put the key ID in my outgoing email signatures.


XSS vulnerabilities: how dangerous are they? A lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a website, in fields such as the search forms?

Cross-site scripting vulnerabilities are extremely dangerous, because they allow the attacker to control the victim's browser to some extend.

This can be used for all kinds of malicious actions:

stealing sensitive cookies or reading personal pages (the user account, private messages etc.)
making requests on the victim's behalf (e. g., ordering products via the victim's account and sending them to an arbitrary address)
exploting the trust of the victim in the site; for example, an attacker might render a fake login form and prompt the user to enter the password. Or they might trick the user into downloading a malicious file which looks like it's served by the site.
attacking the server through a privileged account

So while XSS may look less dangerous than, say, SQL injections at first site, it's actually a major threat for both your users and your server.


How is attacking WPA different from attacking WPA2? What’s the difference between the process of attacking WPA and the process of attacking WPA2?

I know that WPA2 is much more secure than WPA. However, it seems the case that both of them are attacked using the same mechanism — basically, capturing the handshake and then doing brute-force. Are both protocols equally vulnerable to brute-force?

WPA was just a quick update to WEP protocol to solve some security problems until the final version of 802.11i standard was delivered.

The message integrity check, per-packet key hashing, broadcast key rotation, sequence counter and key mixing function were updated from WEP in order to patch some of the current vulnerabilities. This is why in some cases, WPA is considered to be a draft of 802.11i standard.

The main difference between WPA and WPA2 is the encryption protocol used:

TKIP used by WPA, still uses RC4 cipher as WEP, so apart from the patched vulnerabilities it has some new ones like MIC key recovery and an extended version of chop-chop WEP attack.
WPA2 was the final implementation of 802.11i and it introduces a new encryption protocol CCMP. This new protocol uses a stronger cipher AES-256, which represents a huge improvement from RC4.

Aside from this main difference, both WPA and WPA2 uses the same key exchange mechanism. The 4-way handshake is used to exchange encryption keys, so therefore this is why you can attack WPA/WPA2 in the same way, by capturing its handshake and bruteforcing PMK/PTK:

The attacker tries various passphrases, computes PMK and PTK using those passphrases, and then verifies the MAC in order to check if the passphrase was correct.


Bluetooth vulnerabilities for Internet of Things demo For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it that is controllable with a ps3,xbox controller and/or mobile phone.

The premise of the demo is to show a vulnerability in IoT security and the only wireless protocol that is sending out 'sensitive' data to the user, is Bluetooth. So in total we are making 2 rc-cars, one that is protected from outside control/hacks and one that is completely vulnerable to that.

So my question is, what are some (common) vulnerabilities of Bluetooth that we can demonstrate. And it can't just be stuff like "make a stronger password" or "just hide the ssid". There has to be like an exploit like zigbee has/had.

Thank you for considering my question.

ps: Let me know if this is the right stackexchange to ask this question.

We ended up creating a thermostat out of 2 Arduino Uno's. One used to receive and send data through bluetooth and the other one purely for encryption and decryption of the data, they both were connected through I2C.

We demonstrated data being sent and received with and without cryptography. And sniffed it by using the Ubertooth One. Only problem we stumbled upon was that Bluetooth itself used its own encryption to encrypt the packets. So it was actually hard to show it, but we got the message across.

Using HCISnoop or something likely on Android we could show the packets being sent and received. But of course this was a bit of a cheat because the point was to demonstrate someone, a third party, sniffing your data / codes etc.

Edit

In theory the encrypted packets with Bluetooth encryption could easily be decrypted using crackle, I believe.


About SHA1 in default Disk Encryption in Linux Link to the thread: Recommended options for LUKS (cryptsetup)

I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter which one you chose because LUKS loops the Hash until 1 second real time has passed.

So why are there even the options to SHA512, Whirlpool or SHA256? What is the difference? Seems like there isn't one. I'm a bit confused.

Let me just use an answer to explain differences between key-stretching and hashing, even though this isn't an answer to your question.

I'm not going to use a real-world example of collisions, because I don't know what they are, so my hash examples will be purely random.

Imagine your password is pass123, let sha1Result = sha1('pass123').

A collision is when bksdajfdjfaskf can also be used, where sha1Result also = sha1('bksdajfdjfaskf').

A KDF is a feedback loop, where sha1Result2 = sha1(sha1Result) and sha1Result3 = sha1(sha1Result2) and so on n number of times.

The below example KDF() function will be KDF(password, hash-algorithm, iteration-count)

Let kdfResult = KDF('pass123', SHA1, 100,000).

Let kdfResult also = sha1('jadfjlkdfjasldfjskdf') because we have a collision, sort-of, but not really.

Because in order for you to log into my system, you must pass through my KDF(), just having a sha1() collision of my KDF() does not help you, because I do not sha1() your supplied cleartext in order to authenticate you, I KDF() your supplied cleartext, and KDF('jadfjlkdfjasldfjskdf', SHA1, 100,000) does not match KDF('pass123', SHA1, 100,000).

This is a different use-case for a KDF than for HDD encryption. For HDD encryption, the KDF is not used to authenticate, but its used as a key for the encryption of the data.

However, that might be what you should reform your question around. Are the SHA1 collision vulnerabilities still a vulnerability when iterated 103,696 times?


Securely using a WiFi network with weak password My roommate's wifi password is just the ssid with a single-digit number appended. The ssid itself is a word that appears in the dictionary also with a single-digit number appended to it. E.g. his network might be called Dict-word6, with the password being something like Dict-word65.

I want to hop on his wifi but he stubbornly keeps brushing off my requests that he let me hard reset the router and switch to a high-entropy password. I'm wondering if I should just use it and not really worry? How likely is it that some hacker actually cracked his password? (He's not a target in the hacker world by any means, just a regular dude.)

Edit: my question evolved from how secure is it to how do I securely use it. Answers to the second point are in the comments.

It's a pretty awful password, if anybody is trying to break in. A WiFi password brute-forcing tool would almost certainly find it quickly. I certainly wouldn't treat it as Definitely Secure.

On the other hand, the odds that anybody has tried to break in are probably minimal. You (or your roommate) could consult the device table to see who all has connected, but the odds are that nobody has bothered. Most of the time, people don't bother guessing even easy-to-guess passwords; they just go for either totally open networks or ones that are still using documented and consistent passwords.

Hard-resetting the router shouldn't be needed. Changing the password is easy and doesn't usually even require a reboot, much less a complete reset. If you're worried about some malicious actor getting into the device through its WiFi interface and then uploading malicious firmware, a hard reset probably wouldn't even solve that (and also, that's a very unlikely scenario unless the router is so insecure it can be compromised from the Internet through the WAN port).

Sorry your roommate sucks at security. I take it you don't have access to a separate network / Internet connection yourself?


What risk rating models are used for calculating risk scores of web vulnerabilities? What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of those are best to use for web vulnerabilities?

I'm aware of the following three:

OWASP Risk Rating Methodology,
CVSS (version 1, 2 and 3),
Open FAIR (thanks to @atdre).

Do other models or methodologies for an equivalent purpose exist (or currently in development)?

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation.

If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by PivotPoint Analytics (used to be CyberPoint Intl but now a division of) -- http://go.pivotpointra.com/lp-isc2-member-benefit

CyVaR, similar to RiskLens, is a way of engaging information risk in a VaR model. There is also a ton of information in the following three books (increasing in efficiency):

Measuring and Managing Information Risk
Cyber-Risk Informatics: Engineering Evaluation with Data Science
How to Measure Anything in Cybersecurity Risk

Book one would be the most-actionable of the three today, but that may change soon. In the book, you will commonly see vulnerabilities treated as a single variable called Vulnerability, which is a variable among several that bubble up to FAIR's version of likelihood, what the FAIR standard refers to as Loss Event Frequency.

What you need to know about Loss Event Frequency (LEF) is that LEF dictates not only "how" likely, but "how often in frequency". A generic likelihood variable would leave a questioner hanging if an event is "likely" to happen today, this week, this month, this year, this decade, or some other unspecified date. It doesn't say how many exact events will occur. LEF changes all of this -- it gives the decision makers the power to understand how often and how many times (e.g., per year) a loss event will occur.

While I won't likely convince you in this single answer, the Vulnerability variable is difficult to control through mitigation (the Open FAIR standard refers to these as vulnerability controls) which would affect the underlying Difficulty variable. If a Threat Community's (TCom) Threat Capability (TCap) variable overcomes the Difficulty variable, then any TCom with a sufficiently-advanced TCap will cause Vulnerability to rise above 90 percent (often to 100 percent) and thus a loss event will almost certainly occur on this side of the LEF equation.

Let me put this in context for you. Let's say that the Dukes (aka CozyBear aka APT 29) decide that a web-app entry point will grant them a web shell against a target US-based financial services company. A few officers of the Dukes (i.e., handlers) have led a few confidential assets in Eastern Europe to believe that they are participating in an online carding forum. One of the assets has some webappsec experience and is handed a fully-cracked webappsec scanner, Acunetix, at the latest version. The asset runs it against a list of financial services websites provided to the actor by the handlers, who used a previous confidential asset team to conduct the reconnaissance necessary to build a list they are proud of.

After about three weeks, the asset is confident that many webappsec vulnerabilities could be used to upload a webshell, but some of them are SQL injection and have non-standard RDBMS backends, such as PGSQL and DB2. Perhaps one of these also has a web-app firewall (WAF) in place. The Eastern European asset does not have the TCap to bypass the WAF or to load a web shell through these vectors. However, after reporting through the forum (our secondary TCom) up the chain and back around to the Dukes (the primary TCom), the Dukes have the necessary talent to bypass the WAF (e.g., custom tamper scripts they built against the target's WAF using a modified version of sqlmap) as well as the understanding of how to build a web shell against PGSQL and DB2 backends. Thus, the TCap of the Dukes TCom is high enough to bypass all of the Difficulty.

In this case, the target web servers happen to also be connected to at least one Microsoft Domain through BeyondTrust PowerBroker or winbind, and the Dukes utilize the getent(1) utility to dump the users as well as laterally move into the network through SMBRelay and JASBUG. Let's say that the Domain has a trust relationship back to the Microsoft Forest that eventually gives the Dukes Forest Administrator access, and thus read-write to all domains including ones hosting services such as SAP ERP and SAP S/4 HANA, in addition to Oracle Hyperion, HMIS, Essbase, and JDE. These services also host databases that contain the employee, partner, contractor, and customer records -- in addition to financial records, company-wide financial services, and intellectual property. At this point, the Dukes install persistence layers that allow them to act as system administrators with an average longevity of 5 years (typically 3-9 years). At this point, the VaR is the entire company's top line growth -- all of its sales; all of its revenue-generating business.

Do you rate such as scenario as critical? Do you use bold or red in your compromise-assessment report? According to FAIR, the VaR should be shown in monetary amounts, such as US Dollars.


How to tell if human is using website or automated script? I know some websites say in their terms and services that the website can only be accessed by humans and not bots or scripts. How do they tell who is accessing? Especially with tools such as AutoScript that just record the mouse movements and keyboard input, wouldn't it appear fairly natural? This is assuming there are no additional security features like captchers.

I'm guessing if the log files show that the user had been repeating the exact same actions with the exact same timing, this would be a red flag. But wouldn't this be hard to check for?

The most common method is probably a hidden field, bots tend to fill these but humans don't.

Also common is to use a captcha of course.

Then some people use JavaScript to detect page events that typically only happen in a real browser. Such as a click event in a form field.

It might also be possible to get clever with timing things in the browser, again using JavaScript. Humans will type at a much slower pace than bots for example. They will also take much longer to fill in and submit than a bot.


Google Blacklist Workaround? I have a WordPress site that google believes to contain malware and as such, they've blacklisted the IP.

The malware has already been removed and I am taking steps to get google to remove the IP from their blacklist; but in the mean time, is it an acceptable solution to purchase a new IP address, then forward my domain name to the new IP address?

The problem is, this particular business is not able to send emails to their customers because google has blacklisted their IP address.  So, is this an acceptable workaround while I meanwhile try to get google to remove their site from their blacklist?

As your present domain is blacklisted, Google will consequently suspect (blacklist) any other domain to which it forwards. So it is useless to purchase a new IP address for that purpose.

You have to  do the necessary to request Google to remove your domain from its blacklists and be patient (it can take several weeks even if you have done everything correctly. Reading my detailed answer here will let you understand better).

Depending on the activity you are running, I think it is better, if possible, to contact your clients directly and inform them of your new domain.


Who can read my email? I just sent an email to my colleague. Besides his eyes and mine, who can read the body of the message?

Assumptions:

I have a name@mycorp.com address, hosted by Google Apps.
Recipient has a name@hiscorp.com address, hosted by MS Office
365/Exchange Online.
We are both using webmail with HTTPS connections to read/write mail.
Google/MS use SMTP with TLS 1.3 (or some cryptographically secure method) for mail transfer. (This may or may not be really true, but let's assume for this exercise.)
Assume both PC's are not compromised in any way.
Assume hackers, NSA, etc can't crack TLS/HTTPS in a reasonable amount of time.

Bonus points: Are any of these assumptions practically unreasonable? Why?

You probably are well-aware that the providers can access the emails.

The 2 providers may or may not transfer emails between them over an encrypted channel. Some providers have agreements with others to only exchange emails between them over an encrypted channel.

About 50% to 60% of the emails Google exchanged with different providers in 2014 were encrypted, the other 40% to 50% weren't. (Source.)

An unencrypted email transported in plain text between email providers can be read by anyone who sits between their servers. Especially by secret services which have access to internet exchange points.

But against secret services, securing anything via HTTPS is flawed anyways. They can easily create certificates you trust and can easily read or manipulate your HTTPS traffic. Even antivirus companies can compromise HTTPS traffic and in fact do this all the time which I got a lot of downvotes for claiming it here until providing proof. So really, your 6th assumption is wrong. And this means your 3rd assumption is worthless.

We can kick out the 5th assumption, too, because either party is probably using a Windows or Mac OSX computer which have universal backdoors and are already compromised before they are shipped to you. If either party has an antivirus software installed ... well, I think I already discussed who can read then, too, in the previous paragraph.

Countries which don't feel like their secret services are powerful enough – like Germany – simply create a law which states that (in the case of Germany) email providers with at least 1 k email accounts and companies which don't provide email to others but only to themselves with at least 10 k email accounts have to buy hardware which delivers inbound as well as outbound email traffic to authorities. In the case of Germany, these emails are automatically checked and each year dozens of millions of emails are found suspicious and are directed to a human to read.


What are common methods to verify symmetric encryption keys? How can I be certain the same key that was used for encryption? I have an encrypted payload. I use a key and the decryption algorithm to decipher it.

I understand data will be returned whether the key is correct (i.e. it was used for encryption) or not. Is this true of all or any algorithms?

At this point, how can the returned data be verified to be the original plaintext? The padding might already give some idea if present. I imagine some sort of hash (present in the encrypted payload) could also verify this. Are there standard or more creative methods to achieve this?

In practice all symmetric encryption algorithms are just algorithms that scramble data with a key, therefore you will always get some output data, even if you decrypt with the wrong key but will most likely just be random nonsense data.

The standard method is to hash the message with HMAC to get authentication. Most common is to do HMAC over the encrypted message, not the plaintext. Then upon reception you first verify the message and if that was ok, you decrypt it.
Since people have done it wrong by mistake in the past, there are also "packeted" solutions that define how the symmetric cipher and the authentication tag should be created, like AES-CCM, AES-GCM and ChaCha20-Poly1305.


Is there a SSLv2 document? There is no rfc document about ssl version 2.0

Where can i find specification document of sslv2?

I'm curious about available ciphersuite(MD4)
, whether it use mac-then-encrypt or encrypt-then mac

First result in google is this:
http://www-archive.mozilla.org/projects/security/pki/nss/ssl/draft02.html


Sniffing WhatsApp Traffic I was wondering if its possible to obtain private keys for Whatsapp to be able to sniff traffic between two WhatsApp Android devices (both under my control). I understand that WhatsApp traffic is now end-to-end-encrypted, and I have read their technical paper where they describe the encryption used. But is the Message Key (used for encryption) stored somewhere on the client-side where I could obtain it? Can this key be later used to decrypt traffic going out from my device? So far I've tried to root one of the devices and installed "Shark For Root" to see what kind of traffic is passing through. However, I want to be able to see the application-level data that is traveling encrypted between the two devices, could anyone please suggest ways I could do this? I wanted to understand how WhatsApp works and what kind of data is being transferred through. Thanks.

Take a look at this paper here. They also provide the PCAP file used in the research here.

The password file should be stored at /data/data/com.whatsapp/files/pw.

However, if you are not root,  you may want to use this trick to access it:

Install Android SDK
Open cmd
Change your directory and go into 'Platform tools'
Type 'adb shell'
su
Press 'Allow' on device
chmod 777 /data /data/data /data/data/com.whatsapp /data/data/com.whatsapp/*

Also, you can use this application to retrieve the password (also needs root)


How secure is keeping a token in angular for future requests to a Laravel API? I have an Angular JS Front end which consumes Web Services from an API developed using Laravel 5.

BACKGROUND INFORMATION 1

When the user logs in, if it's successful the API returns a token and the token it's like this:

$token = base64_encode("mail=" . $mail);
return Response::json(["token" => $token, 'error' => null]);

Then I have a function in an angular service that knows how to work with the token.

BACKGROUND INFORMATION 2

Every time a user needs to get data, the API takes the mail that is sent to the request as one of the headers request. In Laravel, I have a Middleware that takes that token and do the following validations:

The token is within the headers (in the authorization header)
The token is valid token
The email retrieved by the token exists on the database

If any of this validations fails, the API sends a 422 bad request with some error.

QUESTION

My real concern about this is, is it possible to someone to hack my website? Is it possible for someone (knowing someone else's email on the website) to change that authorization header that contains the email?

NOTE

In theory, the user gets a token if he/she had a successful login, if they didn't they won't get it.

Considering that you appear to only Base 64 encode the email, it's easily bypassed.

Don't try to reinvent the wheel, especially for security.

Use a well known authentication library.
After a user is authenticated, then retrieve data about them from storage based on their authenticated identity and pass that on as required.

Edit If you want to persist with this approach, then you should include a validation token with your json along these lines:

At the point of log in, hash a (server-side) secret concatenated with the user email to produce a validation token.
Send the token to the client
When a request with a token arrives, you can verify that the email hasn't been tampered with by repeating the first step above and rejecting the request if the validation token doesn't match.

This prevents tampering with the email, though it doesn't stop someone from stealing the token and using it in a replay attack etc. etc.


How to verify website owner behind CloudFlare SSL? I went to Bittrex today and noticed the SSL certificate is issued to CloudFlare, not Bittrex, as seen in the screenshot below.

I'm used to seeing information on this screen which can be recognized as corresponding to the expected owner of the website.  But in this case the identity information I expect seems to obfuscated behind CloudFlare's identity.

What's a safe and convenient way to verify the domain I landed at is indeed operated by Bittrex?

I don't want to rely solely on the domain name shown in the browser URL box, as my DNS (or more) might have been hijacked.  I don't want to install (or trust) any third-party plugins like Cryptonite.  I don't want to run any command-line tools simply to confirm I'm on an authentic website.

I did notice Bittrex mentioned when I dug into the Subject Alternative Name (SAN) details on the cert:

DNS Name=ssl763792.cloudflaressl.com
DNS Name=*.bittrex.com
DNS Name=bittrex.com

Is that sufficient?  And how confident should I be that Bittrex's CloudFlare account hasn't been hacked e.g. by someone tricking CloudFlare into issuing a SAN for a domain they don't really own?

In this case, you'll have to rely solely on the Browser trust model. Here's a couple reasons why.

CloudFlare as Proxy

CloudFlare operates by acting as a TLS-terminating proxy. That is - you connect to CloudFlare, and they connect to whatever server their customer has configured to fetch the page. Your TLS session is with CloudFlare, and they may or may not have a separate session with the origin server.

Since CloudFlare is the termination for your TLS connection, whether you like it or not you'll need to trust CloudFlare to use this service. The connection maintains no trace of what was on the back-end connection of the proxy except for the page contents of the result.

Here's the part I don't like about CloudFlare personally: since CloudFlare provides an option for customers to operate without TLS on the backend, you effectively have no assurances when connecting to CloudFlare that this connection was encrypted between CloudFlare and the origin server.

On the flip side - one could argue that it's not CloudFlare's responsibility to secure the connection to the origin if the customer has chosen to use insecure settings.

CloudFlare as Certificate Authority

The certificate is issued to CloudFlare, and they manage the Private Key for their proxy servers. So if you want to use this website, you'll need to trust that CloudFlare is not going to allow the compromise of one of their customers' websites by issuing certificates for a domain they have not validated to be controlled by their customer/user.

The protections against them issuing false certificates are partly technical - as there are watchdog organizations that run crawlers looking for rogue CAs, and we also have Certificate Transparency Logs which can be monitored by domain owners to see if a CA they don't work with has issued a certificate on their domain.

But the main protection against this misbehaviour from CloudFlare is human. The CA/Browser Forum is a collaboration between Certificate Authorities and Browser vendors to set some baseline rules for who is allowed to have a Root Certificate included in the Browser's trust store. If CA's are found to be issuing rogue certificates - or are otherwise in breach of industry best practices - the Browsers may punish them by revoking their status as a trusted CA.


Is it possible to build a partial search mechanism on hashed values? I am hashing some sensitive values to support search mechanism as decrypting the values at run-time would be time consuming. I'm using SHA-512 with salt.

For now, things look good. I have the hashes of the original values stored in DB that were hashed with a defined salt. Whenever user tries to search with the search parameter, the input value gets hashed with the same salt and I simply match the two hashed values. That suffices my work.

But now, I want to offer partial search. So, if I have the hash values of "Hello", "Hi", "Howdy" stored and if the users enters "H", all three values should be matched and retrieved.

Is it possible to obtain this functionality?

No, this is not possible with hashes. Hashes are specifically designed to prevent this, otherwise attacker wanting to obtained the hashed value could start by checking first letter, then the next...

Also, you are likely using salt wrong.


Random bluetooth pairing requests in public Lately, whenever I take public transportation my phone is bombarded with bluetooth pairing requests. I have my bluetooth on because I am listening to music with bluetooth headphones, and in Android 8.1 there doesn't seem to be anyway to not broadcast your device name all the time while bluetooth is on.

My question:

Is bluetooth considered safe to have enabled in public spaces?

Why is someone trying to pair to my device? Are they just hoping that I will eventually choose to accept the pairing?

This thread:
Security wise, is it safe to use bluetooth headphones?
I think answers your first question pretty well. However, occasionally vulnerabilities sometimes do show up, such as Blueborne:

https://www.schneier.com/blog/archives/2017/09/bluetooth_vulne.html

which could allow attackers to hit your bluetooth device without you doing anything. Double the problem when you consider that non-smart bluetooth devices may never get updates to patch these sorts of vulnerabilities.

To the second question: It's possible someone sees your device and is mistaking it for theirs, but if the requests keep coming, I would guess it's probably malicious.


Is using Touch ID with FileVault full disk encryption secure? I recently purchased a Macbook Pro (late 2016) which now includes Touch ID, like the iPhones have been for a while. Although this is a very convenient addition, I am wondering how this affects the security of full disk encryption (with FileVault 2).

As far as I know, it is not possible to use a (biometric) fingerprint as an encryption/decryption key directly (which explains why you need to type in your password after rebooting the machine). This would mean that the password would need to be stored somewhere, unencrypted, which OSX "unlocks" after scanning the correct fingerprint.

(Admittedly, I'm not too familiar with how FileVault works in detail either, so maybe I'm missing something there)

I'm assuming that the data is not unlocked all the time that my machine is powered on (after logging in for the first time), but I can't find any good articles on how this process works exactly. Anyone able to explain or point me in the right direction? Is enabling Touch ID in combination with FileVault considered more/less secure?

Touch ID and Filevault are not related, at least not yet in current macOS versions.

When a Mac reboots, it first loads a small unencrypted partition which presents the password dialog to unlock the "disk" (really only a volume). A key derivation function is used to derive a long passphrase from your password, which in turn unlocks the encrypted volume with the operating system and all of your applications and files.

Once the operating system boots, you may use Touch ID. It uses a similar element to iPhones called Secure Enclave - a small processor that signs cryptographic challenges. When an authentication event takes places on the system, for example screen unlock, your fingerprint matches the stored representation in the enclave and you're allowed in. As an analogy, asymmetric cryptography is being used instead of a symmetric key (a password).

Whether or not using Touch ID is secure would have to be based on a threat model, but certainly it and traditional password-authentication have their unique advantages.


How to generate CSR(Certificate Signing Request) using C++ and openssl I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++.

openssl req -new -newkey rsa:1024 -nodes -keyout key.pem -out x509Req.pem.

I have tried a sample code from the tutorial http://www.codepool.biz/how-to-use-openssl-to-generate-x-509-certificate-request.html

bool gen_X509Req()
{
int             ret = 0;
RSA             *r = NULL;
BIGNUM          *bne = NULL;

int             nVersion = 1;
int             bits = 2048;
unsigned long   e = RSA_F4;

X509_REQ        *x509_req = NULL;
X509_NAME       *x509_name = NULL;
EVP_PKEY        *pKey = NULL;
RSA             *tem = NULL;
BIO             *out = NULL, *bio_err = NULL;

const char      *szCountry = "CA";
const char      *szProvince = "BC";
const char      *szCity = "Vancouver";
const char      *szOrganization = "Dynamsoft";
const char      *szCommon = "localhost";

const char      *szPath = "x509Req.pem";

// 1. generate rsa key
bne = BN_new();
ret = BN_set_word(bne,e);
if(ret != 1){
    goto free_all;
}

r = RSA_new();
ret = RSA_generate_key_ex(r, bits, bne, NULL);
if(ret != 1){
    goto free_all;
}

// 2. set version of x509 req
x509_req = X509_REQ_new();
ret = X509_REQ_set_version(x509_req, nVersion);
if (ret != 1){
    goto free_all;
}

// 3. set subject of x509 req
x509_name = X509_REQ_get_subject_name(x509_req);

ret = X509_NAME_add_entry_by_txt(x509_name,"C", MBSTRING_ASC, (const unsigned char*)szCountry, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

ret = X509_NAME_add_entry_by_txt(x509_name,"ST", MBSTRING_ASC, (const unsigned char*)szProvince, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

ret = X509_NAME_add_entry_by_txt(x509_name,"L", MBSTRING_ASC, (const unsigned char*)szCity, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

ret = X509_NAME_add_entry_by_txt(x509_name,"O", MBSTRING_ASC, (const unsigned char*)szOrganization, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

ret = X509_NAME_add_entry_by_txt(x509_name,"CN", MBSTRING_ASC, (const unsigned char*)szCommon, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

// 4. set public key of x509 req
pKey = EVP_PKEY_new();
EVP_PKEY_assign_RSA(pKey, r);
r = NULL;   // will be free rsa when EVP_PKEY_free(pKey)

ret = X509_REQ_set_pubkey(x509_req, pKey);
if (ret != 1){
    goto free_all;
}

// 5. set sign key of x509 req
ret = X509_REQ_sign(x509_req, pKey, EVP_sha1());    // return x509_req->signature->length
if (ret <= 0){
    goto free_all;
}

out = BIO_new_file(szPath,"w");
ret = PEM_write_bio_X509_REQ(out, x509_req);

// 6. free
 free_all:
X509_REQ_free(x509_req);
BIO_free_all(out);

EVP_PKEY_free(pKey);
BN_free(bne);

return (ret == 1);
 }

It is able to create the x509Req.pem file, but when I open it in the linux with file open, it is showing the error "Could not display 'x509Req.pem' Reason: Unrecognized or unsupported data."
Could you any one please tell me how to solve this error or any other tutorials
to generate CSR using c++ and openssl.

Thanks in advance.

If you compare the output from openssl req -in yourcsr.pem -text with CSR created by the usual openssl commands you will find, that the version is shown as 1 in your CSR while 0 in the usual CSR:

Certificate Request:
    Data:
        Version: 1 (0x1)

This is due to the following code:

int             nVersion = 1;
...
ret = X509_REQ_set_version(x509_req, nVersion);

Looking at the Wikipedia page for CSR you will find that:

  The first part, ASN.1 type CertificationRequestInfo, consists of a version number (which is 0 for all known versions, 1.0, 1.5, and 1.7 of the specifications)

Modifying your code to set nVersion=0 will result in a proper CSR which also can be successfully opened by the viewer you use. It looks like the viewer is an application which tries to adhere to the specification while other CSR reading programs simply ignore the version number since it does not provide any necessary information (should be 0 in all cases).


How can a VPN circumvent MAC address filtering? My DSL-WiFI router provides MAC address filtering. This is used for access restrictions, e.g for parental controls to keep certain devices off-line during certain hours. A device on the restriction list remains associated with the WiFi AP (router), but access to the internet is prevented by the router.

HOWEVER, when a device on my WLAN uses VPN, the traffic simply seems to tunnel straight through the restrictions. In other words, during restricted hours, a device ordinarily has no access to the internet, but when the VPN is switched on, access is provided.

I understand MAC address filtering, and how a WiFi router uses the MAC address to address 802.11 devices and route traffic in the WLAN/subnet. The MAC address is part of the packet header. The IP traffic, incl. VPN application data, resides within that packet. So how can this even fail?

Any thoughts on what might be going on here? Is the VPN possibly robbing a MAC address and overriding the one on the device? (It's an iPhone and my understanding is that the MAC address cannot be changed -by the user or an app-, although it can change randomly with MAC address randomization)

UPDATE: after some experimentation I can confirm that the MAC address does not change with VPN on/off, contrary to what I was thinking. What DOES change is the LAN Status IPv6 entries. They disappear with VPN "on". I posted it as a separate question: When using VPN, why do LAN IPv6 Addresses disappear in router LAN status?

The WiFi parental controls might be focused on certain protocol traffic (e.g. HTTP) and not other protocol traffic, like VPN. Meaning that the controls are not on the hardware level, but the traffic level (i.e. "this device accessing the web at this time").

The router manual might have clues as to how the filtering works.


Does outsourcing infrastructure services reduce risk (and improve security)? I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc.  This from observing how poor they are at practicing good defense (e.g. promptly applying security patches) and the maturing of security conscious providers.

My conjecture is for security immature companies it’s better to outsource to the likes of:

  http://www.zerigo.com/ for dns
  http://www.dropsend.com/ for secure file transfer
  http://mediatemple.net/wordpress-webhosting.php for blogging
  http://chargify.com/ for accepting payments
  ...plus many more

I still believe sensitive information is better kept in-house (e.g. source code), then again it depends on the org.'s capabilities.  But I also say it’s better to let the other guys server get popped versus you having to block lateral movement of an attacker within your network.

From what I’ve seen recently, many SaaS vendors play better defense (they will die if they have too many security incidents).

Outsourcing, whether it be to managed service providers, developers or other third parties should be structured in such a way as to allow you access to the same reporting and management information as you would have had you kept the service in house. This could include results of security testing, alert and event statistics etc.

As mentioned, these requirements MUST be written into 3rd party contracts otherwise suppliers have very little motivation to include them.

The ISF have been working to develop a standard around 3rd party assurance and the International Standards Organisation have just accepted the draft so once published this will give useful guidance.


What should one do when he/she wants to protect him/her home--computer--? As you know, deleting a file by pressing shift-delete or by using the Trash doesn't mean that the file is unrecoverable. It's data persists on your computer.

In day to day life, adversaries use recovery programs to attempt to undelete private data.

There are some program that provide secure erasure such as wipe and shred. As one knows, these programs require more time to perform secure erasure than standard deletion tools take to perform typical erasure.

How should we protect our private data from adversaries?

How should one store his/her data in memory?
Is there an encryption algorithm that will protect data as it is stored?
Should one use a journaling filesystem?
Can one password protect all types of memory?

Some adversaries have advanced tools to recover our private data. To protect against these threats, should we harden our home computer to protect against these threat?

To protect against these threats, should we harden our home computer to protect against these threat?

That depends on the value of the information being processed on the system and who you intend to protect against. There are essentially two physical threats to your home systems:

Theft. Somebody opportunistically takes your computer system.
Surveillance, followed by possible theft. When I say surveillance, I mean that in very broad terms - anyone who is able to observe the entry of passphrases for private keys, disk decryption etc can potentially record that entry.

Disk Encryption?

In the case of disk encryption, it is a very good solution for the first case assuming the computer, when stolen, is powered down or the act of stealing it forces it to be powered down (a desktop fits this bill unless the attacker comes prepared with a UPS...).

However, disk encryption cannot protect you from surveillance-based threats. The fundamental assumption of cryptography is that the decryption process is being done in a secure environment; all an adversary needs to do is to see the input of the password in such a way they can record it. There are many techniques to do this (keyloggers, cameras) and a few techniques for avoiding it (multi factor authentication).

Disk encryption also stops protecting your system as soon as the disks are decrypted (power on). The keys are "in memory" and whilst they may not be readable (i.e. in a self encrypting drive where the OS can't reach - it's worth noting the BIOS can because the implementation of self-encrypting drives requires interrupting the boot process of the BIOS) there is absolutely no access control performed by usual whole disk encryption. You can still get a virus and see every file the OS lets you see.

One approach that is harder to break is the approach taken by Encrypted NTFS, namely that the FEK (File Encrypting Key) is encrypted by public keys, thereby implementing a level of access control. However, when you are logged in as the user holding the private key, the same problem occurs.

So in effect, disk encryption does nothing to mitigate the "internet-facing" vulnerability.

Should one use a journalling filesystem?

Yes, purely on the basis you'd have to go to quite a bit of effort to find a file system without journalling. You'd be looking for VFAT (FAT32) or ext2 or some other ancient setup.

Journalling also provides you with significant corruption-avoiding benefits that you want. There's no point in protecting your data only to have the applications you use it with clobber it.

Finally, if the encryption layer you're using can't handle journalling, find a new one. There's no reason that data should reach the disk unencrypted, whether it's in the journal area or actually on storage. That includes the journal meta-data.

Can one password protect all types of memory?

If you are so minded, yes. I'm assuming you mean password protected via encryption here. There's an implementation issue with this level of protection - namely, most crypto services hold keys in memory so that you don't have to re-enter the password every time you want to write to or read from, say, RAM. If you had to do that, you'd find your computer unusable. It would also greatly increase the chance of password observation and is therefore self-defeating.

Applications encrypting their own data, stack and heap variables is not a new idea and will make "scraping ram" harder. However, there are some fundamental problems with this as a defence, namely if another application can read your applications' ram, it has gained access to supervisor mode rings on your cpu (assuming x86/x86_64). If this has happened, it's game set and match to the attacker anyway, so I rarely see the point using encrypted ram. Unless of course you're still using DOS (in DOS, all programs can read the memory of other programs)?

To add icing to the cake on encrypted RAM, the fact is, to encrypt it, your application had to have it unencrypted anyway, also in RAM, which means you're only making it harder, not impossible.

What should I do?

Use whole disk encryption anyway. This protects your data against theft as in opportunistic thieving and means you can throw the hard disk away and it will be reasonably difficult to extract anything meaningful from it for some time.
Forget about encryption as the ultimate solution and focus on protecting the integrity of your operating system from other forms of attack which are far more likely to steal your data. For example:

Use appropriate security on the web - HTTPS, Javascript blockers, firewalls, antivirus (won't help you against the latest threats, but saying AV is useless is like saying because we can't yet prevent cancer you shouldn't have a TB vaccine - it filters out all the known and yet still circling threats) - the usual drill, basically.
Patch your system. Turn on Windows update, regularly run yum update or whatever update mechanism you have. When bugs of a security-compromising nature are fixed, make sure you have the patch.
Only install software you can reasonably trust.
Reduce things running with Administrator privileges and don't run as an Admin account yourself - i.e. reduce the attack surface.

To be honest, I think a discussion about ensuring secure password entry and physical access to your home computer is probably wandering into the realms of fantasy and is also probably disproportionate to the risk to your data. Most sensitive personal data people hold is also held elsewhere by their doctor, bank, utility company, social networking website etc and your ISP could easily log your internet activity. There is not much you can personally do about the security of that information and it is unlikely all such information is heavily protected, although the more sensitive material (bank account details, etc) usually is.


Cloning Credit/debit card chip I have a nice, expensive, metal credit card with a chip but it's from an older card. I’m wanting to rewrite the magnetic stripe and the chip to my new card. I know how to rewrite the magnetic stripe but what do I need to buy and do, to rewrite the chip?

In almost all cases I've seen (both working at a bank, and owning a bunch of credit cards), when the bank issued you your new card the old card was either immediately blocked, or set to expire (AKA be blocked) 30-90 days in the future. As a result, the magstripe and chip contained in the old card will soon be non-functional, assuming they are not already. I would recommend simply using the new card mailed to you by your bank, and not landing yourself on any watchlists by purchasing the expensive equipment required to attempt what you're looking to do.

Plus, depending on the bank, when you mess up and render the new card useless, they may take great pleasure in charging you a new card fee to allow you the privilege of continuing to access your accounts with them.


Is there a risk in sending the username in a password reset email? We're using a CMS that has a password reset function that works according to best practices out of the box.

Passwords are stored as salted hashes
Forgot Password works like this:

User enters either username or email address in textbox
System generates an email with a "reset password" link
User has x amount of minutes to follow the link and reset the password, or it's disabled.

(Side note, we would like to add two-factor authentication, and the company that develops this CMS is working on providing that, but as of yet it's not available.)

Optionally, we can include the username in the email in case the user has forgotten their username.

Does including the username in the password reset email result in an added security risk?

Clearly it's one more piece of information an attacker has their hands on, but truth be told, if an attacker manages to intercept this email they can already just click the first link to log in as the user, so I don't really see an added risk. Am I missing anything?

No, there should be absolutely no security risk with this approach.

Usernames are public information and should be treated as such.

EDIT

@Polynomial pointed out a key fact I left out. My advice doesn't apply if the username in question is some piece of sensitive information like a SS number.


How dangerous is it to trust an “Example Server Certificate”? When connecting to the Wi-Fi of my university, which authenticates clients via “EAP-PEAP (MSCHAPv2)”, I got the following prompt:

I had no choice but to trust this certificate, because otherwise I won’t have Internet access in the school library. However, out of fear, I unchecked the Always trust “Example Server Certificate” option before clicking Continue.

Is there a security vulnerability in my university’s Wi-Fi authentication system? I suppose even another one creates a certificate with the name “Example Server Certificate”, the digital signature would be different, so I’m probably safe, but trusting a certificate with such a weird name still makes me sweat.

Is there a security vulnerability in my university’s Wi-Fi authentication system?

There are multiple problems:

It looks like they just assumed that the users will just accept any certificate. The correct way is to either use a certificate with a useful subject which was signed by an already trusted CA or teach users how to distinguish a valid certificate from a fake (like checking the fingerprint).
As @schroeder has already pointed out: this looks like the default certificate which might also be used in other installations and where the private key is probably known.

Because of this it will be easy for some attacker to create its own access point which looks the same and mount a man in the middle attack to sniff and modify any connections which are not encrypted (i.e. HTTPS is usually fine, plain HTTP is not).

Of course, it might also be that the university did everything correctly but that you are connected to an access point created by some attacker who hoped for gullible users.


Self-signed CA certificates - Can we throw away the private keys I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion.

I'm working with Amazon AWS IoT, and in order to create our own certificates on a device to communicate with the cloud, we must first create and register our own CA certificate.

We first create the CA private key, then the CA certificate which is signed with that private key.

We then create a device private key and a device CSR with that private key.

We then combine the CA private key with the CA certificate and the device CSR to produce the device certificate which gets registered on the cloud for future comparison when the device wishes to connect to it securely.

Do we need to keep both private keys at this point? (both CA private key and device private key)

Can we even just throw away the private keys  because the device certificate and CA certificate is already generated?

Don't we just need to send the certificate to the cloud when initiating a secure connection and then the cloud uses the public keys to verify that it actually came from the device?

The CA private key that belongs to the self-signed certificate is only used to sign certificates and, possibly, to sign OCSP responses or CRL's. So besides signing (future) child certificates, it may also required to establish the status of already issued certificates. If this is not expected to happen often then you could store the private key away on an offline device or two, and put those in a safe. Don't forget to securely wipe the private keys from the device that performed the signing, or keep that device itself safe. Note that issued certificates commonly have a shorter validity period than the root certificate; you may need to request subsequent certificates even for the same use case.

The device private key is required to perform device authentication. Of course, the other party first needs to establish that the device certificate is valid by performing verification (using the public key) and validation: checking the date, name and indeed certificate status. However, a certificate is public, it can be send by anyone. The device is only authenticated after it proves that it contains or has access to the private key that belongs to the public key within the certificate. So some kind of authentication procedure must be followed, which commonly requires the private key to sign some kind of challenge. The signature over the challenge can then be verified by the other party. As nobody should be able to create a signature over the - hopefully unique - challenge the device is then considered authentic, i.e. the identity of the entity is affirmed. This does of course mean that the private key needs to be available to the device each time the identity needs to be established; it can generally not be stored offline.

So no, you should not securely destroy the private keys while the certificates are valid.


Trusted vulnerability database source Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product vulnerabilities are not found in the NVD database. For example, I search for "Sitefinity" and it gives me no results. But when I do a search on Google, I found something on osdir. Is there another alternative vulnerability database that you know of that is more updated?

NVD is an authoritative source for vulnerabilities reported to them. They do not list vulnerabilities that merely exist in the wild.

So, yes, the NVD is a fine place to go, but it is never going to be fully complete. Not every vulnerability is issued a CVE.


Sophos AV doesn't block standard ClamAV test files The company where I work recently got through a security audit. Everything seems to be solid except our Sophos Cloud Security AV.

I was asked to try and download some of these ClamAV test files on our machines (in particular: clam.mail and clam.zip), expecting them to be blocked by Sophos, but instead I could not only download, but also open the files.

I tried it on my MacBook running macOS Sierra and on an up-to-date Windows 10 laptop, but the end result is the same. Sophos doesn't see these files as threats and doesn't block them.

According to the audit team, these are standard "dummy" test files that are just meant to be picked up by antivirus software, but are innocuous.

Having a look around, it seems that the standard files used in this scenario are actually the EICAR ones. Unlike the ClamAV ones, these are picked up correctly by our Sophos AV software.

We tried contacting Sophos support, but we're still awaiting a response.

In the meantime we tried the same ClamAV files on other test machines with different AV software (namely Windows Defender and F-Secure for now) and none of these pick up the threat.

Since this is the only step preventing us from passing the audit, it would be really important to understand wether it's the Sophos software that should block the files, or if the files themselves are not the correct ones to test an AV functionality.

Clam.exe which is used in these tests is a harmless test program similar to the innocent EICAR test virus, i.e it just prints a message. But, contrary to the also harmless EICAR this test file is not generally treated as malicious by antivirus programs and thus will not be detected. And I have no idea why ClamAV needs to have their own test program instead of the commonly used EICAR test.

Thus if Sophos detects EICAR but not the clamev.exe test program inside ZIP, mails etc you can assume that Sophos still can detect malware inside ZIP files and mails and ignore that it does not detect the ClamAV specific test program.

  According to the audit team, these are standard "dummy" test files that are just meant to be picked up by antivirus software, but are innocuous.

I would question the competence of the audit team if they make such claims. Just check with virustotal and you'll find that almost no antivirus will detect this as malware.


How does paypal store credit card numbers? How does Paypal store credit card numbers?

Have they published any information this?

As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a personal guess.

This is most likely confidential, so I bet you won't get a 100% answer to this one.
However, we know PayPal are PCI-DSS compliant.

This means they are compliant with 3.4 in the standard, which states: "Render PAN unreadable anywhere it is stored". That means with a probability of at least 99% that they store the credit card numbers encrypted. It is possible with compensating controls to store them unencrypted, but it's very difficult to get a compensation control to 3.4 approved by a QSA.

Regarding HSM, we must guess again. It is definitely possible to comply with PCI-DSS without using a HSM, it's just way harder. For a company with a small budget, they might want to avoid the cost purchasing a HSM. For a company like PayPal, it's a no-brainer, so I'm 99% sure they're using a HSM to manage their crypto keys.


Does end entity SSL Certificates need to be re-keyed periodically to improve security? Is it necessary to periodically re-key end entity SSL certificates apart from typical scenarios like Key lost/key compromise? What benefits does it provides in terms of security and others? Is there any guidelines for that period?

TLDR : no it is not necessary as far as your certificate has a 1 or 2 years validity period.
Re-key a SSL certificate means a complete change of it (as the public and the private keys are changed). You cannot keep some parts of the file and change others at the owl file is signed. So "re-key" a certificate is more like put it in the trash and make a new one.
The main benefit of re-key a certificate is obviously to address the scenario where the private key is compromised.
If you know that your private key is compromised, the response is to revoke the certificate, not only renew it.
If you have no clue that your private key is compromised but you want to address the risk in the event of an unknown compromise, the correct periodicity should be something like every year. And, basically, one year is a common validity period for an end point certificate (3 months with let's encrypt). So, in any case the certificate expires after one or two years and the new one will have a different keypair (except if you explicitly mention that you want to reuse the same key).


diceware, why are there so bad words? I like to use the diceware method to generate passwords. But i also wonder, why there are so bad words used in for example the german list. There are a lot of words like

15411 bj
15412 bk
15413 bl

that are not actually words, not even common abbreviations, that are much too short and cant be remembered properly. Is that only a problem of the german list? And why aren't there much more lists, for english there are two as far as I know. For german I could only find one.

The Diceware FAQ has two entries that address this:

Why are there so many meaningless words like abc, du, rrrr or 456 in the Diceware list?
An important goal of Diceware is to keep passphrases short. Based on the limited survey I did, I concluded that most people simply will not accept a 50 character passphrase that they have to type in several times a day to read, send or sign e-mail. Peter Kwangjun Suk had the clever idea that short non-words like "abc" "456" or "dn" are about as easy to remember as regular words and reduce the average length of a randomly selected password.
Also, I never heard of ncaa, boise or a&p.
The original Diceware word list is slanted somewhat to American English. Alan Beale has compiled an alternative list that replaces most Americanisms and many obscure words with more recognizable alternatives. You can find it at http://world.std.com/~reinhold/beale.wordlist.asc
There are some obscure words in both lists. If you passphrase includes a word you don't know, look it up in a good dictionary. Learning the word's meaning will aid you memory and your vocabulary.

You're not the first person to raise your objection, however, and plenty of people disagree with Rheinhold's criteria.  The simplest solution is to use a different word list.  For example, the Electronic Frontier Foundation designed and published alternative word lists based on criteria that agree with your objection:

The Diceware list can provide strong security, but offers some challenges to usability. In particular, some of the words on the list can be hard to memorize, hard to spell, or easy to confuse with another word.

It contains many rare words such as buret, novo, vacuo
It contains unusual proper names such as della, ervin, eaton, moran
It contains a few strange letter sequences such as aaaa, ll, nbis
It contains some words with punctuation such as ain't, don't, he'll
It contains individual letters and non-word bigrams like tl, wq, zf
It contains numbers and variants such as 46, 99 and 99th
It contains many vulgar words
Diceware passwords need spaces to be correctly decoded, e.g. in and put are in the list as well as input.

Note that several of these problems are exacerbated for users with a soft keyboard or other typing systems that relies on word recognition. Using only valid dictionary words makes this setup much easier.

If you like the EFF word list better, just use that.  You're going to be typing quite a bit more, which I think illustrates Rheinhold's motivation:

The words in our list are longer (7.0 characters) on average, than Reinhold's Diceware list (4.3 characters). This is a result of banning words under 3 characters as well as prioritizing familiar words over short but unusual words.

For a 6-word passphrase with spaces between the words, that's 47 vs. 31 characters on average.


Why is the *-property in BPL security model named "star"? I am just looking for the meaning of "star" in this property

When we learned about BLP in class, one of my classmates decided to email Dr. Bell and ask the question. Below is the response we got.

Too bad you haven't happened on the couple of talks I've given on old war stories.
During the oil embargo of 1972, was it?, I was driving an hour to work every day, from Worcester MA to Bedford.  One's mind wanders.
As I was driving down the slope on I-495 towards the Rte. 2 exit, I was thinking about the analogy Len and I were using to build up a "mathematical model", namely books and written documents.  And in my stupor, I suddenly realized that electronic documents weren't like printed documents in the sense that marginalia were obvious.  Changes to the document proper weren't.
When I got to work, I rushed into our office, pulling off my coat and drew the information flow picture with subjects at the middle latitude and a high object and a low object. I didn't know what the [sic] call the don't-let-subjects-open-two-objects-simultaneously-reading-high-and-writing-low.  So, old mathematician that I was, I just scribbled "*-property" at the top. We talked excitedly for a little while, then one of us (lost in the mists of time) said to the other, "you know, if we don't change the name now, we'll be stuck with it."  We couldn't think of a better, more intuitive name, so we left it *-property.
Our task lead was Steve Lipner and he hated it.  When we started the Multics Interpretation, we offered to rename it NWD for no-write-down.  And he said (and I quote) "I will defend to the death the use of *-property.  With an asterisk."  We nominated that for quote of the week and put it on our wall.
And later in life, it amused me that databases had trouble indexing the term *-property (when the DBMS used * as the wild card).  Often inserted as "star-property."
That's it.  Just couldn't think of a good, descriptive name.
Same kind of story for the "tranquility principle."  Had to call it something.   That was the best we could come up with.
So now you know.


RSA vs DSA Digital Signature Message Digest Recovery I'm learning about signatures using RSA and DSA, I've come across this little fact:

  RSA can recover the message digest from the signature, whereas in DSA this isn’t possible – you have to have the original message too in order to determine the digest.

What are the implications of this? - Is the fact you can recover the message digest from the RSA signature a 'bad' thing for security?

It's really pretty much irrelevant. Message digests are done using a preimage-resistant hashing algorithm, which means that knowing the hash doesn't help you find anything that hashes to that value faster than brute force. But the attacker could also do the brute-force attack directly on the signature -- with both RSA and DSA, an attacker can see if the signature is a valid signature for a candidate message. This is inherent to all public-key signature algorithms; it means that if the attacker has a (not very long) list of possible messages, they can fairly quickly see if one of them was the thing the signature is for.

The one thing I can think of that might be different is that textbook RSA signatures and signatures using the old PKCS 1.5 padding will let someone tell whether two signatures are for the same message, without knowing the message, even if the signatures are with different keys (if they're the same key, the signatures themselves are the same, since both methods are deterministic).

RSA-PSS (the newer, randomized signature padding scheme for RSA) doesn't actually have message digest recovery, because it actually computes H(0..0||H(m)||S), where S is a random salt, and then uses that in the rest of the signature. It doesn't have the property above; without knowing the message, you can't easily tell if two signatures were for the same message. So, message digest recovery depends on padding.

Really, though, signatures in general are not designed to provide confidentiality. Anyone can confirm a guess about what your message is if they have a signature for it, so you should give your signatures as much confidentiality as you want for your message.


FOUO on hosted sharepoint I and few of my fellow employees were asking if it was okay to put FOUO (NSA issued) documents on SharePoint. The main justification was that its password protected (which is correct).

But its a hosted site so we don't have ultimate control over the server.

Thoughts?

Ask your security officer, or your contact/security officer at the NSA (the originator).

(When it comes to handling of classified or FOUO material, you probably should not be following security advice from the Internet anyway...)

Apparently, FOUO often means that it contains personally identifying information that should not be made public.
A cynical part of me says that FOUO also seems to be used where disclosure of the information to the public could be embarrassing to some government employee.
Either way, FOUO means that the information isn't very sensitive.  (If disclosure actually posed a danger to national security, it would be classified Secret or higher, not marked FOUO.  The primary purpose of FOUO is to make sure the public doesn't read about it in the newspapers.)  Regardless, breaching confidential information or embarrassing a powerful government employee can be a career-limiting move.  So, your primary concern should be to your own job security.  Think about this from a CYA perspective: what do you need to do, to make sure you won't be blamed if the information gets leaked?

The standard way to CYA is to make it someone else's decision.  Find someone else who is responsible for making these decisions, ask them what they want done, document what they told you, and then do what they told you, whatever it is.  That way, you can't be blamed: you were just following instructions, it's someone else's fault.