how to design a policy enforcement system, that prevents dictionary attack on forget password flow? Use case is to prevent any dictionary attack on forget password flow, where attacker can trigger any no. of emails using forget password flow.

A user selecting the 'Forgot Password' button should only be able to enter a valid user email address and be required to then only interact with the system to reset the password via the link provided in an email to that address.

Furthermore, the link provided needs to have a time-out value assigned to it so it is only valid for perhaps 30min at the most. If an attacker already has compromised a valid users email that is used to login there isn't a lot that could be done and that person would not need to brute-force the login.

But, to stop brute-force logins just put in a limit of failed attempts before the IP address is no longer permitted to attempt a login


Is there a risk of using AEAD encryption algorithms when the key is generated from a password? I need to encrypt something on a smartphone. The data is relatively  small and would be stored encrypted on the phone.

I was thinking AES-GCM with a key generated by a password (chosen by the app's user), but I wonder if there is a risk, with Authenticated encryption, that an attacker could use the MAC as an oracle in order to brute-force the password from which the key is derivated.

What is your opinion about this ? Should I stay away from Authenticated Encryption when using Password-based derivated keys ?

Thank you for your feedback.

One of the security properties of a PBKDF is that it should not be reversible.  You should not be able to obtain the password, even if you know the key, without exhaustively testing candidate passwords by running them through the KDF until you find matching output.

So, no, I don't think the attack you're considering is in fact a threat.   You should use an appropriate PBKDF function with as high a work factor as is reasonable in order to protect the password from dictionary attacks to the extent possible, but the password will not be recoverable from the key, and much less from the MAC itself.


Is TLS security for web server reliable or suffer a major design flaw Best practice in term of security for the web are enforced by major actors like Google or Mozilla, but it feels a bit like something is messed up in the global design.

To mitigate all man in the middle and other types of attack on SSL/TLS a lot of new protocols and practices has been created like:

OCSP stapling
Do not use wildcard use multidomain certificates
Do not use this cipher suite it's too old (still very hard to break but too old)
increase DHGroup
put a DNSCAA record in your DNS
and the list can goes on

Are these "enhancements" the result of SSL/TLS being fundamentally flawed?

Is there any plan to replace this protocol with something more reliable, or is it that most problems are implementation-based and all those best practices/RFCs are there to mitigate possible human error?

Is there any plan to replace this protocol with something more reliable, or is it that most problems are implementation-based and all those best practices/RFCs are there to mitigate possible human error?

There isn't a simple answer here, so I would "yes and no to all of the above". There are lots of factors at play.

Is TLS flawed?

Much like any other protocol (take HTTP or HTML for example) SSL/TLS is an evolving standard. Like any other protocol, it evolves to include:

new features (ex. DNS CAA or OCSP which give higher security)
performance enhancements (ex. OCSP stapling, and a lot of the TLS 1.3 stuff to improve speed and bandwidth usage)
new use-cases that reflect the changing way in which the internet is built (ex. wildcard vs multi-domain vs multiple certs in a load-balanced cloud server context).

Unlike other protocols, TLS also needs to keep up with increases in the CPU power available to hackers, and cryptographic research (both research into new algorithms, and research into breaking existing algorithms). That's why you see new ciphers added, old ones dropped, and key sizes gradually increase.

I wouldn't say that TLS is flawed, but rather that, like any software, TLS is being improved over time to reflect the changing internet.

Implementation errors

You are right to point out that most of the egregious vulnerabilities in TLS are not due to a problem with the TLS specification, but due to programmers not following that spec properly. Two examples come to mind:

Mining your Ps and Qs

[Paper]

The issue here is with (mainly) small embedded devices (think home routers or internet-enabled webcams) that need to generate TLS server keys on first boot-up. Turns out these devices all roll out of the factory almost identical, which means the keys they generate on first boot are not very random.

This is certainly a TLS vulnerability, but is not the fault of the TLS spec.

ROBOT

[Project homepage]

Here, the TLS spec (RFC 5246 section 7.4.7.1) gives very clear instructions for how to avoid Bleichenbacher-style attacks:

As described by Klima [KPR03], these vulnerabilities can be avoided
by treating incorrectly formatted message blocks and/or mismatched
version numbers in a manner indistinguishable from correctly
formatted RSA blocks.  In other words:

  1. Generate a string R of 46 random bytes

  2. Decrypt the message to recover the plaintext M

  3. If the PKCS#1 padding is not correct, or the length of message
     M is not exactly 48 bytes:
        pre_master_secret = ClientHello.client_version || R
     else If ClientHello.client_version <= TLS 1.0, and version
     number check is explicitly disabled:
        pre_master_secret = M
     else:
        pre_master_secret = ClientHello.client_version || M[2..47]

That's 3 pretty straight-forward steps. Turns out that the software developers behind a large number of the TLS implementations out there did not these steps properly, leading to vulnerabilities.

Again, his is certainly a TLS vulnerability, but is not the fault of the TLS spec.


Is there an any risk with HTTP header value reflection? This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header.

I understand why it does that, but is there any possible exploit that could be performed with this reflection of a header value from request to response?

I attempted CRLF and it failed since the response header didn't decode URL encoding or Unicode entities in the request.

While I don't think there's any immediate vulnerabilities, it would still be good practice to check if the reflected value is properly filtered for XSS. It may be possible to chain other vulnerabilities that aren't immediately obvious. For example, there could be a part of the site that will use the If-None-Match header in the content, in which case you'd have an exploit if XSS isn't being filtered correctly.

If you're sure CRLF doesn't work, I'd just make a note of the reflection and continue digging around.


Deterring Mobile phone Tethering in the workplace How do you put in controls to prevent a staff using his/her mobile phone to tether 3G/4G connection and download unauthorized files onto the office PC?  Of course minimally there must be an AV in place to check for viruses and stuff. But how to stop the tethering in the first place? Any recommendations?
thanks

There are potential technical options you can pursue, and several of those have been mentioned in other answers, such as global policies or BIOS settings to disable the USB ports, or physically disabling the USB ports.

However...

My suggestion is that if you have a systemic problem with this sort of thing, it isn't, in fact a technical problem at all, but a policy or people issue instead, and you should be looking for ways to deal with the underlying issue, and not the symptom of mobile tethering.

The most likely cause, is in fact you.  (You being inclusive of the IT department, management, and the policies in place.)   If your policies are too restrictive, and people are having a hard time doing their jobs because you've removed or disabled the tools that they need, good employees will become frustrated, and they will find ways around your restrictions in order to accomplish their duties.   With good employees, productivity always wins the day, no matter how hard you try and prevent it with policy and technology.   As the saying goes, security at the expense of usability comes at the expense of security.

So, if that is in fact the issue at play here (and in order to find out you'll have to actually talk to the employees!) then you need to figure out how to change your policies in order to enable them while still effectively managing risk to the business.  There will have to be trade-offs, but such is life.

There are other less likely possibilities, such as perhaps this behavior is limited to users who don't know that it isn't allowed, or who would rather goof off at work with things that have no business purpose than do their jobs.   If that is the case, it's still a human resource issue, not a technology issue, and the solution is not to crack down on tethering, but to crack down on those employees and educate them or show them the door.

In any case, don't jump straight to a technical solution for a behavioral issue.  You likely aren't going to solve the problem, but may in fact make it worse.


Doing a dictionary attack on RSA if you have the public key? I'm trying to learn exactly how RSA works. Currently I have a very, very simplictic overview that goes like this.

Having the public key allows you to encrypt things. Encrypting the same message "Hello" on two different computers using the same public key will produce the same resulting encrypted message.
Having the private key allows you to decrypt the message.

However, if you have access to the public key, could you not simply do a dictionary attack, encrypt all 5 letter words with the key until you find a matching encrypted message and then you know that it was "Hello" that was stored.

In a sense, is it not as easy to brute force RSA encryption of passwords as it is to brute force hashing of passwords?

I know that RSA is usually used for longer messages making it unfeasible to enumerate them all, but is there any advantage to using RSA encryption over hashing if you don't actually want to decrypt the password?

RSA encryption, as per the standard, mandates the use of a padding method which includes random bytes, precisely to avoid the problem you describe. This makes RSA encryption non-deterministic (encrypt the same message twice with the same key, and you won't get the same output; but decryption removes the padding and recovers the message, of course).


How to protect encryption key while application is using it I made an J2SE application that uses AES (in CBC mode using BouncyCastle library) to encrypt application config file & some user provided files.

I stored the raw AES key in a file that is stored on a flash drive.  To use the application the flash drive should be plugged to machine first.  Users doesn't have physical access to the port that flash drive it connected to.

But the problem is:  How about copying KEY file or opening it using an HEX editor & writing bytes on a paper?

How Can I protect key file against copying (by the file or visually)?

Note: I thought about loading the key into RAM and forcing the user to unplug the flash drive but this only decreases the time for copying the key.

One solution is to use a Smart Card rather than the flash drive: these can be arranged to perform the cryptography without letting the key go out. This works fine if speed is not an issue.

For high volume of data, you can use a random key for each file, and preppend it to the to the ciphertext, after being enciphered using the long-term key in the Smart Card, so that the Smart Card is necessary to recover the key that will decipher the file. Next step is to use asymmetric crypto in the Smart Card, and move to hybrid encryption, with the benefit that one can encipher a file for a certain user, without knowing that user's deciphering key.


What is the mechanism to protect photos uploaded on social media? I know water mark the photograph is one method to protect ones copyright over the picture. is there any other technique through which one can prevent or detect the plagiarism of photos.

There's not any fool proof way. If you upload or host a photograph on a server and it's accessible by users or it's accessible by anyone with an internet connection the content becomes fair game for anyone to take/reuse/re-upload/edit/copy.

Here are some mechanisms that certainly slowdown people form misusing your content:

Watermarking (as you mentioned)
Stenography can be used to hide information in the photo that lets you do an image search via google's image search and always find instances of your photo, then you can ask the user to remove the misused content.
Preventing users from taking screenshots (poor form and i.e only)
Preventing users from right-clicking image


Offline mobile app data storage Guidelines, Standards We are currently working on a project to develop an "offline" mobile application that synchronises data with our current cloud software solution that would allow field workers in potential mobile black spots to still be able to carry out their work without a signal.

This would require (depending on the client size) up to 10GB of data  to be downloaded to the device. Some of the data is of restricted classification (PII) and is just a defined read-only dataset specifically required for the role of the identity who downloaded them (not an entire db dump).

We defined a security policy that only one identity could be provided to the mobile phone app at any point in time (to protect the security of the data on the device). Although the burden would belong to the organisation on how they used it. This current policy defined proper rules such as device data encryption, and the correct AAA procedures.

With agreeable reason, customers have told us its not a valid to restrict the device to one user. As user A might work Monday, Tuesday but user B may work in the same role Wednesday, Thursday. Why should they fork the cost of multiple devices just to meet our policy.

My solution, is the downloadable device data must in entire belong to a defined set of roles which would be standard practice anyway. If the user must have those roles to be able to download the data, then a secondary identity must also have that role if the data has been downloaded (even if the user does not intend to use the offline capabilities).

Concerns then would be the integrity of the data. UserA could modify the device database to affect the work userB carried out (that may benefit userA).
Having a separate encrypted database per user is not feasible (as its up to 10GB per user).

I can't seem to find any guidelines, or standards on this specific scenario of having a large subset of information on a device outside the central store. Is anyone aware of any material for this? NIST Special Publication 800-164 appears to be closest, but still doesn't really cover the problem

Any direction, or additional concerns would be helpful. I'm sure this is not a unique problem..

I am very interested in to know how you worked around that. NIST reference is good but does not cover specific scenarios like the one you described, My first thoughts were that following the principle of "grant access on a need To know" basis I would consider another role segmentation perhaps with a Logical Control within the devices itself, if they are capable of executing such control (not sure the firmware, os, version, model, etc of your case). If they don't definitely capable of doing that I would suggest a policy and addendum to their contract with some NDA clause that encloses the appropiate use of resources (I guess that already exists like in most cases but you can add verbiage that properly covers the mobile devices and the information within it).

Most solutions will only lead you to compensate for the risk but from a compliance perspective (for different regulations), as of now, you won't be allowed to do that and the answer will be to stop using that in a typical case of security over cost and effectiveness. If you continue with any compensatory control for it you should add this to your risk assessment as this is PII data, meaning sensitive information that the company should have to protect and I can tell you that the responsible parties for the risk acceptance will give it a second thought if they're smart enough.

HIPPA as an example won't allow you to do that (https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/techsafeguards.pdf). And you can review all the documentation but you will encounter the same barrier that overlaps regulations, certifications, best practices, etc: that access PII must be RESTRICTED.

Plus: Mobile Devices are often exposed, they are considered an easy entry point for criminals so sharing with a non-authorized person to access PII is not recommended as the risk calculation (risk=vulnthreatconsequences) will be really high.


Gmail shows my photo after I enter my emaill address (but before my password) If I have a profile photo associated with a Google account, then when I enter my email address into GMail, but before I enter my password, the photo is shown.

Is there a possible security breach there? For instance, if someone guesses at an email address, perhaps after obtaining part of it, the photo appearing confirms ownership, without that someone needing to know my password.

I know not to associate a picture with my account, others may not; but let's discuss Google's side of things, not the account holder's.

In the past I have noticed that the full name of the account holder was sometimes displayed too, before entering the password. But not systematically, it seemed to be account-dependent. Perhaps the OP can confirm this.

There is a potential breach of privacy here, even if you put a picture of your cat. Because many people reuse the same image for their profiles on other sites such as forums or social network sites. A simple reverse image search can often match a picture with other profiles and ultimately a real identity.
This is one of the most basic doxxing techniques.

If your real name is already embedded in your Gmail address, you probably don't care. If you have some made-up address, that you use to register, post (and sometimes troll) on forums, maybe that should concern you because you are not as anonymous as you think you are.

Think of it, at one point, we have all upset someone with something that we wrote, for good or bad reasons. As a result, we may have had to deal with stalkers at least on one occasion.

Everything you post can and will be used against you. A picture is very often uniquely identifiable data and the metadata sometimes tells a lot: for instance a raw picture from a tablet, camera or smartphone will often have GPS coordinates embedded in the EXIF data. Plus the name and model of your device. Normally the thumbnails will drop all EXIT data but you still have to think twice before posting or uploading anything.

The EXIF can even get you in trouble with the tax authorities. A famous example is late french singer Johnny Hallyday betrayed by pictures posted on his Instagram and Twitter accounts. The geolocation metadata revealed that he spent little time in Switzerland, where he claimed to have fiscal domicile.

Therefore, I recommend using exiftool to systematically strip all EXIF data from your pictures before uploading them to a site. As easy as:

exiftool -all= picture.jpg

The tool has plenty of other options, including bulk options. You could also fake some of the data if you want to have fun with adversaries.


What are the types of DNS spoofing? I saw a post on here about how there are multiple types of DNS spoofing, it said:
"DNS spoofing refers to the broad category of attacks that spoof DNS records. There are many different ways to do DNS spoofing: compromise a DNS server, mount a DNS cache poisoning attack (such as the Kaminsky attack against a vulnerable server), mount a man-in-the-middle attack (if you can get access to the network), guess a sequence number (maybe making many requests), be a false base station and lie about the DNS server to use, and probably many more."

But when I google 'types of DNS spoofing' I get no useful answer.

Can someone explain to me these different kinds of DNS spoofing and how they work?

There are many different ways to do DNS spoofing:

  Compromise a DNS server

This one is as simple as it sounds. If the attacker controls a DNS server that is in the resolution chain that the victim is using, then the attacker can control which IP addresses domains resolve to.

The initial compromise would be via any normal method that an attacker would use to compromise a server - password guessing, weak SSH keys, reused credentials, vulnerabilities, leaked details, etc. Once they have control they can do what they like, including in regards to DNS responses.

  Mount a DNS cache poisoning attack (such as the Kaminsky attack
  against a vulnerable server)

If the attacker can send enough responses to the server to cover the 16 bit query ID address space, they can make their victim's DNS server cache one of these rogue responses. Now, whenever the victim's machine queries the hostname, it will resolve to one of the attacker's choosing, rather than the real domain name. This is usually mitigated by using random source ports to increase the entropy pool.

  Mount a man-in-the-middle attack (if you can get access to the
  network)

Again, as simple as it sounds. If you can intercept DNS response, then you can alter the IPs in the data stream.

  Guess a sequence number (maybe making many requests)

This is essentially the Kaminsky attack, although you could execute it directly against the victim rather than the victim's DNS resolver.

  Be a false base station and lie about the DNS server to use, and
  probably many more.

True. At the end of the day DNS is a network service, just like any other. Its unauthenticated and unencrypted nature means that it's game for eavesdropping and MitM attacks.

Other attack vectors could include dropping a hosts file on the victim's machine as a very easy way to redirect their traffic to a specific domain. A similar one is the badusb attack where the USB device acts as a network card, and provides rogue DNS settings to the victim's machine directly.


What is a good backup strategy against ransomware? From my understanding, most ransomware works in the background until they are finished with encrypting all their chosen files.

I assume that while the ransomware work in the background, if I plug in my external USB hard drive to make a daily (or weekly) backup, the ransomware would also target my external hard drive rendering my backup useless.

What is a good backup strategy to counter ransomware?

Have multiple backups with at least one offsite. The time scale will depend on your usage. For example, many businesses will use daily offsite backups. For personal use, weekly or monthly may be sufficient. You will minimize your risk this way.

I doubt the ransom-ware will wait long to see if it can infect your monthly backups, because the longer it is on the system, the more likely it will be discovered/removed.


Can a webpage read another page's cookies? I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long story short, I was wondering whether a webpage could access cookies that it didn't put there (thus getting a rather accurate browsing history as well as information on the user). It seems to me that this should be (and probably is) defended against, but if it is, how? I can read cookies on my computer and at least see where they came from, so it doesn't seem that they are encrypted...

This is defended against using the same origin policy, which generally prevents one site reading anothers cookies.
When you see behaviour where adverts seem to know where you've been it's likely due to 3rd party ad tracking cookies.
So as a simplified example if you go to site A which uses an ad network, that ad network can record that you were on that site by placing a tracking cookie on your PC.
Then when you go to Site B which uses the same ad network, the ad network reads the cookie that was set when you were on Site A (which it can do 'cause it's loading content from it's domains in both cases so it doesn't break same origin) and can then offer you adverts based on your browsing habits.


Security implications of exposed Dropbox API key and secret I've noticed that the Dropbox PHP SDK requires you to put your API credentials in a JSON file that might be publicly available if the SDK code is placed within the DOCUMENT_ROOT directory. What are the security implications if an attacker discovers these?

... the Dropbox PHP SDK requires you to put your API credentials in a
  JSON file that might be publicly available if the SDK code is placed
  within the DOCUMENT_ROOT directory.

This is definitely not true. I think some of the example apps use a nearby JSON file to store various credentials for convenience, but there's nothing in the SDK that requires you to do that. (You could store the JSON file elsewhere, and the constructor for AppInfo takes a key and secret, so you can manage them however you want.)

For most apps it's probably not a big deal to expose the app secret, but I would still discourage developers from doing so.

To learn more, look around for discussions about exposing OAuth consumer secrets. Notably, mobile apps typically do expose those secrets (at least in OAuth 1), so there's been a fair amount of discussion of the security implications.


Using Diffie–Hellman key protocol to create a safe secret key Let's say, I have a friend far from me and I want to send some secret messages to him. I have to say, I'm pretty newbie in security. That's why I'm wondering, does the Diffie–Hellman key exchange protocol allow me make a secure communication with him by sending a public key to him and them after all necessary computations, get a secret key (which will be the same for us both, of course) and use it for encrypting/decrypting the messages from and to each other? And our communication will be secure, correct?

Diffie-Hellman allows two parties to generate a secret key which cannot be recovered by someone snooping on the communication. This secret key can be used to set up a secure channel between the two parties that ran the DH protocol.

The secret key is established between the two parties that exchanged the initial messages. If you send out one message and receive a response, you have no way to know that this message comes from your friend. It could come from a man-in-the-middle instead. A MitM can reply to your message and send a message to your friend, and thus set up one secret key to communicate with you and one to communicate with your friend. Form that point, both you and your friend have a secure channel with the MitM, who can choose to relay messages and snoop on them, or modify them, or withhold them, or inject messages as he wishes.

There is no way to set up a secure channel without authentication. If you want to be sure that you're communicating with your friend, then you need to know something about your friend before the protocol starts, so that you can tell your friend from an attacker. For example, you might have your friend's public key. Your friend faces the same problem.

Once each party knows the other's public key, DH is a possible way of establishing a secure channel. The DH setup messages are signed by the public key, so the receiving party can check their authenticity.


Possible reason for displaying two different websites on single domain? This is something interesting.
Try going to http://www.circaventures.com/
You will get a venture capital company.

Now go to google and search "Circa Ventures". The first result you get is the exact same domain but the description is "medical website". Click it, you get to same domain but now a medical drug website is shown at exactly same domain!

One can of course see the previous website visited and accordingly force display of the other website but why? Is this SEO experiment? Or am I missing something? Other possible reasons?

This is obviously a spamming or scamming site, either setup on purpose or a hacked legitimate site. If visited without Referer header it will show some seemingly innocent site:

$ curl http://www.circaventures.com
...
<title>Circa Ventures | helping you close the loop</title>

If visited with a  Referer from a search engine it will show spam:

$ curl -H "Referer: https://www.google.com/" http://www.circaventures.com
<frameset rows="*,0" framespacing="0" border="0" frameborder="NO">^M
                <frame src="http://mantrshopo.com/redirect.php?z=cialis" noresize="" scrolling="auto">^M
                </frameset>

This seems to work for any Referer which contains Bing, Google, Yahoo or similar, i.e. even when using https://this-site-is-not-yahoo/ as Referer. Using a different Referer like https://this-site-is-not-stackoverflow/ instead will result in the seemingly innocent site.


Is it possible for a hacker to cause hardware dysfunction? Sorry, I am noob to security. Is it possible to blow up a computer by hacking it or at least provoke a hardware dysfunction?

The BIOS will probably have settings to change at what temperature your CPU or GPU shuts down or forces a machine reboot, and a sufficiently motivated attacker could flash new dangerous values from a running machine, then run some intensive programs to force them to overheat and permanently damage the hardware.  On most consumer hardware, I doubt it'd "blow up", but you'd be out some potentially expensive hardware.

Stuxnet is a well-known government-level malware that executed a more sophisticated form of this attack on nuclear centrifuges: it would override the safety controls display so that they appeared to be operating at safe levels, while simultaneously ramping up the centrifuge to a level at which it would break.


Why is it bad to connect internal systems to the Internet? We have an intranet system we use to book, track and process invoices for our core business. My boss would like to move this system to the Internet to make it "accessible everywhere". However, I feel this is not wise. Are there some reasons that connecting internal systems directly to the Internet is a bad thing?

The system does have its own user and authentication system and was developed in-house by some gifted coders. It has also been penetration tested, but this was all done on the basis that the system was only accessible from the internal domain.

First, it might be best to fully understand the client (your boss's) needs. It's possible he or she only needs access to one small subset of the data on this server from anywhere and not necessarily all of it.

Where possible, instead of saying no in this situation come back with a few options.

VPN so people travelling, can access the data wherever they are at. If possible add additional security controls like internal firewalls and Data Loss Prevention (DLP) if needed. Harden and add additional security controls here as necessary.
Strong authentication and encryption to a separate server which contains a small subset of the data but possibly not all of the sensitive data. Harden and add additional controls here as necessary. Only allowing the server with the sensitive data to push data to the one that can be accessed publically and blocking all packets from the publically accessible server going back to the one containing the sensitive data can be a helpful trick (one-way firewall rule).
Create a secure front-end server which can be accessed from anywhere and has controlled access to the backend server. Harden and add additional controls here as necessary.
Harden the server itself and if applicable deploy a WAF, or other controls, in front of it.
Think of other creative solutions depending on your boss's actual needs (your question isn't specific about the actual needs).

No matter which option is chosen make sure you log and monitor access to the system. It would be wise to follow up with your boss after the system starts getting connections from other countries (or at least IP's that are obviously not from people who work with you) and show him or her the global connections to the system. Sometimes this real-world feedback is required for people to understand that the risk.

Use this as a chance to educate your boss but do so in a very humble manner sticking strictly to real data, he may have had too many people selling security to him with Fear, Uncertainty, and Doubt (FUD) and may simply not listen to anything that sounds similar regardless of how legitimate this information is. Beware of FUD fatigue. If he or she has reached their limit anything you say in this respect will have the opposite effect you want. When this occurs your best solution is delivering factual data and allowing him or her to come to their own conclusions.

Be a problem solver here, provide your boss with solutions, rather than simply with reasons to say no. Don't be afraid to propose expensive solutions that you think are too expensive for the company, your boss may be ok if it moves functionality forward quickly for him or her. That said when possible, always keep security as inexpensive as possible long-term (avoid recurring costs that may get cut during an economic hardship). View this as an opportunity for you to get more security in place by enabling the business rather than fighting it. If you show that you can empower the business and frame needs in terms of what moves the business forward or how things could affect the business you'll get much better response from people like your CEO. Understanding when the business is in a rush is important too, it's not uncommon for a company to pay more money for a solution or approve things which they might not otherwise approve if it can add value and be deployed quickly. To this end, knowing when to time requests and understanding the urgency of the projects in flight will also help you.

Think of this part of business as a martial art, you want to leverage your opponents energy and redirect it to a place you want them to go while minimising your own energy expenditure. If you can quickly grab his or her desire to have this accessible, now might be a great time to get a lot more security in place. Speed is important here and you need to get buy-in while it's hot so to speak.

Finally, recognize that you will be much better off addressing this as a business problem that you can help with, rather than just a technical security problem. Likewise, start looking for and anticipating additional security needs going forward and bring them to your boss early on so you look like someone helping the company rather than as a roadblock to progress. This bit of framing accomplishes the same objective but gets security in faster and with less conflict.

Addition after original post: One thing that may also be helpful for you is to create a long-term security roadmap and share that with your organization. What this entails will be different for every organization but it's very important to show the work you are not currently doing and also work that may be things your organization will never do internally (small start-ups are less likely to have forensic teams in-house). The reason for this is to help educate and also to help set expectations with your leadership team. This is something many security teams have in their head but formalizing a plan and showing a path forward can help you get more buy-in for your security program. A large part of this is about communication and having a shared vision business-wise but another part of this is about educating senior management about where they are risk-wise. I find that visualizing your organizations security-debt helps people automatically make more thoughtful decisions.


Is it safer to use a port other than 21 for FTP? Usually (as far as I know), FTP uses port 21.

Since this port is used for FTP so often, is it safer to use another port? My guess is that if someone with malicious intentions tries to break FTP accounts, they will try port 21.

It is not safe to use ftp over any port. Those who have a malicious intent to get in your network or system will not scan your system for port 21 but for all ports, and will figure the other port in virtually no time.

You are better with sftp as your file transfer tool.

On the other hand, you have the option of adding some security to your ftp transfers and ports if you run it over a VPN tunnel instead.


How can I determine (as a layman) if an E-mail was set to self destruct? I tried to access an old E-mail to print for a court case only to find there is no content. I checked on all my devices and outlook account. The E-mail in question is from a gmail user and I have subsequently learned there are ways to get the content to self destruct. This single, most damning E-mail is the one that is missing its message content.

Is there a way to analyse the header to determine if there was some self destruct/expiration setting. For clarification, this was not an attachment, but a body of text that appeared as a normal E-mail message from the sender.

Emails, sent through SMTP, have no way of "self-destructing" internally built in to them. They're basically just text files that hang around for eternity until all copies are manually deleted. The fact that you still have the email's headers is proof enough; if messages could self-destruct, their entry would be entirely removed from your mail client, as if they never existed.

However, there is a way to destroy the body of an email: simply have the email point to an external inline image, then later delete the image. In short, the body of your email might look like this (HTML sourced):

<img src="http://www.example.com/message-images/012345.jpg" />

Thus, when you first open the email, your client displays the image, which appears to be just plain text to a layman. The only obvious hint that it is not text would be that you can't "copy and paste" it, but it'd still be printable, etc. Some clients will warn you about inline images, because that itself is a security risk (at minimum, you can presume that the author now knows you've opened or scanned the email).

Finally, the author simply needs to delete the original image file. Once deleted, clients would probably display nothing or perhaps a "broken image" icon. Alternatively, they could switch the image out for a 1x1 transparent pixel, which would render as... nothing.

You could, however, view the source of the email (see your client's help documentation on how to do this), then find the image link, as described above. From there, you might do a Google search; if it's cached by Google, you might be able to recover the source from there. Of course, if the image was hosted without a domain name (e.g. stored by IP address), you might be entirely out of luck.


Found Unusual Services running on my VPS I am running a Debian VPS and i did a port scan and found these services

135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
593/tcp  filtered http-rpc-epmap
1720/tcp filtered H.323/Q.931
6881/tcp filtered bittorrent-tracker
6901/tcp filtered jetstream
6969/tcp filtered acmsoda

The one that stood out for me was the bittorrent-tracker, i do not use it for torrenting and therefore do not know why it would be on there. Does this mean it could have been compromised?

Also do you know how i would remove this service?

nmap indicating "filtered" simply means that the packets are being blackholed somewhere between your nmap client and the target being scanned.

It does not indicate anything specific about your VPS itself. It is more likely an indication that your VPS provider or their facility filters traffic on these ports.

  Filtered means that a firewall, filter, or other network obstacle is
  blocking the port so that Nmap cannot tell whether it is open or
  closed.

  -- http://nmap.org/book/man.html

You can simulate this for a specific TCP port on Linux (with or without something listening on that port) using iptables and a DROP target. The DROP results in a complete lack of response, and triggers the "filtered" result in nmap.

Compare this with a "closed" port which would result in an RST being sent, or a port which you may have configured with an ICMP "administratively prohibited" or similar message.


Website sent me my new password (after reset) in clear text I was resetting my password on a website and the website emailed me a new password in plain text rather than giving me a reset link to change the password myself. I logged back in and changed the password to something else.

I'm wondering - Does this email indicates that these passwords are stored in plain text or with reversible encryption?

The difference between this and other password reset questions (which may or may not be technically significant) is that I could decide to keep using the password they sent me and not change it.

No, this does not indicate whether they are storing your password in plain text or with reversible encryption. They might be, but this still leaves other possibilities open. All you know for certain is that they created a new password and emailed that new password to you. That password may well be hashed appropriately for storage in their system.

However; this is a poor security practice and I would absolutely gripe to them about it, and point out that such a poor practice in one regard makes you suspicious of the quality of their security practices in other regards.

Email is not secure, and they shouldn't be doing password resets by sending you a new password in any form, anyway.

EDIT:

I just installed an open source file transfer application on one of our servers to check it out.

I confirmed that it is hashing passwords for storage in the database, which increased my comfort level. Then I created a couple of accounts and realized that the stoopid thing emails the passwords at the moment of account creation in plaintext to the new account holder.

I am beside myself. One of these was actually a fairly sensitive account, for which the account holder should absolutely not have to change the password (but will now be forced to do).

This utterly stupid, utterly non-secure nonsense has got to stop. A plaintext password should simply never, ever, under any circumstances EVER be emailed. Ever. End of discussion. That entire mode of thinking should be quashed instantly whenever it is encountered, and public websites that engage is such practices should be punished for it.

END EDIT:

They should be doing password resets by sending you something like a reset link with a (long, complex) embedded code/token, which permits you to choose your own new password, over a secure (HTTPS) connection. Ideally, upon clicking that link, you would still be required to answer another security question or two, in order to confirm your identity. Or some kind of 2FA should be implemented, where you click the link, then you have to punch in a code that was texted to your phone. And I still feel that you should have to answer at least one more security question on top of that, because 2FA is still utterly susceptible to having your phone stolen or cloned.

That reset link should have a very short valid lifetime. In my opinion, it shouldn't work for more than about 5 to 15 minutes. If you don't get around to changing your password in that time frame, you can always request a new link when you're ready.

If you ever encounter a site or service that sends you your existing password in plaintext, then you must assume they're storing it in plaintext or using reversible encryption.


Would it add security to set a GRUB password if HDDs are encrypted and UEFI settings can be opened anyway? So I'm using Debian 9.1 with KDE and have my hard drives encrypted. Now I'm wondering whether to additionally add a GRUB password as described here.

Would that make sense? As the hard drives are encrypted nobody should be able to boot/access them right? Also before the GRUB bootloader starts the UEFI settings can be accessed even before entering the GRUB password.

However, this page also lists "Preventing Access to the GRUB Console" as one of the reasons to set a GRUB password. And maybe there are some changes / configurations that I need to do for it to add security?

Should I instead only set a password on my UEFI settings maybe? Or are bios passwords entirely redundant in my case?

Adding grub password is needed to protect the boot sequence, but protecting the boot sequence only makes sense if you protect the entire boot sequence, in other words if you enable grub password, you should also enable UEFI password and vice versa. It's kinda pointless to set one but not the other, so to answer one of your question, no, it's not redundant.

When you have Secure Boot, each component in the boot sequence should cryptographically verify the image loaded for the next boot component. In other words, UEFI loads and verifies a cryptographically signed GRUB image (using UEFI Secure Boot), and GRUB loads and verifies a cryptographically signed Linux kernel/initrd/drivers. When you have the entire chain verified using Secure Boot, then the only vulnerability left is if the attacker replaced the motherboard/Boot ROM, this is a physical attack that can be delayed or made difficult by using physical security measures (e.g. casing/rack locks, security cameras, security guards, tamper evident stickers).

There's little sense in encrypting /boot, but there are good reasons to cryptographically sign the files in /boot to prevent boot hijacking). Secure Boot in UEFI and GRUB are part of the solution to booting an operating system without a cryptographically signed boot sequence; adding boot passwords prevents people from making unauthorized changes to UEFI/GRUB settings or booting unsigned systems from UEFI Shell/GRUB Shell.


Is Python's `secrets` module using the same code as the `random` module? The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually make reference to the same underlying functions.
For example, the definition of secrets.randbits is basically a reference to random.getrandbits:
from random import SystemRandom
_sysrand = SystemRandom()
randbits = _sysrand.getrandbits

Another example is secrets.token_bytes which is basically a reference to random.randbytes, which later ends up calling random.getrandbits:
def token_bytes(nbytes=None):
    if nbytes is None:
        nbytes = DEFAULT_ENTROPY
    return _sysrand.randbytes(nbytes)

So what is exactly safer? Is this more of a namespace improvement to keep the community from writing their own token-generating code? PEP 506 is not very clear about this IMHO.
Please note this is not about /dev/urandom and the quality of its entropy.

The motivation is in my opinion pretty clear from PEP 506:

... concerns that Python's standard library makes it too easy for developers to inadvertently make serious security errors ... Although the documentation for the random module explicitly states that the default is not suitable for security purposes [2], it is strongly believed that this warning may be missed, ignored or misunderstood by many Python developers ...

Thus, this is about providing an API which is easy to use and has secure defaults in order to reduce security issues caused by hard to use interfaces with insecure defaults. Therefore this is not a reimplementation, but just an easier and more secure wrapper around existing functionality.


Can two different Root certificates have the same serial number? Can two different Root certificates and their intermediate certs have the same serial number?
I issue two root certificates:
Organization: My Example Organization:

My Example Organization Root Certificate Authority (serial number is 00)
----- My Example Organization Intermediate Certificate Authority (serial number is 10)

My Example Organization Secure Root Certificate Authority (serial number is 00)
----- My Example Organization Secure Intermediate Certificate Authority (serial number is 10)

Is the above okay? Or is it really mandatory to use different serial numbers for the certs issued by the same Organization?
This What is the difference between serial number and thumbprint? doesn't mention about the same organization. So, it does not answer my question.

From RFC 5280 section 4.1.2.2:

The serial number MUST be a positive integer assigned by the CA to
each certificate.  It MUST be unique for each certificate issued by a
given CA (i.e., the issuer name and serial number identify a unique
certificate).

Thus, the certificate must only be unique regarding the certificates issued by the same CA. Any requirement of being globally unique among all CA's in the world would also be kind of impossible to enforce since there would need to be some form of coordination among CA.


How to handle legacy website account login credentials I have a lot (>1000) of credentials for website logins in my Chrome's password safe. Some of them are quite old (> 10 years) and have weak (dictionary) passwords. Some of the accounts have low value to me so that I could just consider them hacked/hackable and abandon them altogether. Other accounts have higher (historic) value to me and I would like to preserve them at least for some time. Because of the sheer amount of credentials, it seems unfeasible to update all accounts to secure passwords manually.

What would be the most secure process to update my credentials and which tools could help me with it? I would execute these tasks manually:

Get a list of all websites Chrome has credentials for
Request a password reset / update link for a given website
Update password to a random password on the website and in Chrome's password safe
Set up MFA (multi-factor authentication) where possible

Use Lastpass and let it import all your passwords from Chrome. Then you have a nice database that can be shared, updated and exported easily.


smtp tls configuration I've configured a company postfix server for requiring always starttls before any smtp command is used.

The problem is that if configured so, I start receiving lots of errors in the logs like:

400 STARTTLS is required first.

This is, someone trying to send me an email.

If my server is asked with ehlo, these are the options (among others):

250-STARTTLS

So, if my server is offering STARTTLS, why the hell the other end choose not to use it? Shouldn't be those servers removed from the earth for being insecure?

Besides, this post postfix TLS states that "According to RFC 2487 this MUST NOT be applied in case of a publicly-referenced Postfix SMTP server. This option is off by default and should only seldom be used."

Don't understand why plain smtp commands should be allowed at all, nowadays everything is secured but smtp, one of the most used services. Can someone explain this?

From the graphs and responses I see (admittedly mostly 2014 and 2015) it looks like for incoming mail, only about 60% of servers support STARTTLS.  Is that insane?  Yes, of course it is.  It is, however, reality.  The advice to not require STARTTLS is still, unfortunately, valid.

Facebook has some 2014 info, though spot googling doesn't show that number has budged that much since.


Tor browser further anonymity requirements Tor and Tor Browser do a good job of providing anonymity, but we cannot rely on them alone.

The development of newer techniques for identifying web users (such as canvas fingerprinting) mean that using Tor or its browser alone are not enough to provide useful anonymity, or prevent tracking across the internet. For this reason, I was trying to understand the most important things to further ensure anonymity when using Tor/Tor Browser, and these are the two most important ones I came up with.

Change the size of the browser each time (preventing the canvas fingerprinting identifying you by eg, your screensize)
Never log in to a personalised service (eg email, obviously identifying)

I must have missed other important items. I want to know what else is important to know about, and why?

NOTE: I do not see how my question is at all a duplicate of another question which is specifically about Tor, and how Tor can be trusted. One is about a browser, and preventing being tracked against browser identifying techniques, the other is about Tor generally. Clearly no similarity.

Use a VPN at all times. It wouldn't hurt knowing your ISP doesn't know you are using TOR. Also make sure the VPN doesn't store or make logs.
Stay away from anything such as CP.
Don't use services like Google Maps on TOR. And of course don't enter any addresses around where you live on any search engines.


When taking ownership of a TPM in Windows 7, how is the SRK derived from the password? When you take ownership of a TPM in Windows 7 you encounter a screen like this:

Based on this document, it is my understanding that completing this dialog box somehow results in the generation of the Storage Root Key (SRK) based on the password:

  Storage Root Key: The Storage Root Key (SRK) is used to wrap TPM protected keys which can be stored outside the TPM. This builds a hierarchy of keys represented in figure 4 on an external storage device like a hard disk drive. The SRK is embedded into the TPM and is generated during the process of taking logical ownership of the platform. It can be re-generated by creating a new platform owner which destroys the previous key hierarchy and all the data and keys it contains.

This raises the following questions:

How is the SRK derived from the password?
How is the SRK stored?
If the SRK is somehow compromised, how easily can the password be derived from the SRK?

Disclaimer: I'm not a TPM expert - most of this has come from a half hour's worth of research. I've managed to cobble together a reasonable understanding of the process and details from the TCG TPM spec, the TPM API documentation on MSDN, and various papers on the subject.

The SRK is an RSA key pair (of at least 2048-bit size) that is used as the root for a chain of trust within the TPM. It acts as the ultimate authority of trust. If a secondary RSA key is loaded into the TPM and signed with the SRK, that key is classed as trusted, and other materials signed with that key may be loaded in via that chain of trust. The SRK is not derived from a password - it is an RSA key generated in hardware.

When ownership is taken of the TPM, the process involves two things: one is generating the SRK, the other is storing the owner authentication secret. Once set, this secret is used to authenticate owner users in future sessions, usually via a HMAC-based exchange.

The Trusted Computing Group (TCG) spec for TPMs does not specify how this secret is to be created, but Windows uses a SHA1 hash of the UTF-16LE encoded password, with the null terminator of the string excluded (source). If you were able to retrieve the owner authentication secret from the TPM, you would be able to crack it just as quickly as you could any other SHA1 hashed password, e.g. via oclHashcat. Simply capturing an authentication exchange (HMAC of a challenge value using the secret as a key) is not enough to crack the authentication secret, since the challenge value is generated by the TPM.

The SRK is stored in the TPM in an encrypted format, using one of two different encryption methods. If the Authorisation Data Insertion Protocol (ADIP) is used, the SRK may be encrypted with AES-128-CTR or simple XOR. If ADIP is not used, XOR is the only method defined by the spec. Therefore, the system is expected to compute its own key, and store secondary information such as the IV inside non-protected areas of the TPM. The creation of the key for the encryption is, again, entirely reliant on the OS.

It stands to reason that different keys can be used for ownership and internal encryption, i.e. an SRK key and an owner key. However, it appears that Windows simplifies the situation by using the same key for both.


Is there a way to bypass escape function in javascript? Is there a way to bypass escape function in javascript for exploiting a XSS vulnerability ?

Sure, lets say you have the following PHP code that is vulnerable to XSS:

<?php
print "<script>var t=escape('".$_GET['t']."')</script>";
?>

You can supply this file with the following XSS Prof of Concept to get an alert window:

http://localhost/xss.php?t=');alert('xss');//


How long it will take to crack a RAR password? I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we consider that the cracker (law enforcment) uses the latest technologies to crack the RAR password and has pretty much computing power how long it will take for him to crack the password?

A completely random alphanumeric password of length 16 has an entropy of 95 bits (16*log2(2*26+10)). I forgot the exact value, but I think rar uses around 100k iterations for its KDF, increasing the security level by about 17 bits, resulting in an effective security level of 112 bits.

With standard GPUs breaking this would cost around $1019. Custom hardware shaves off a factor 100 or so, still giving you a cost of $1017. Even if Moore's law continues, it'll take several decades until this is remotely feasible.

Related question: How expensive is it to guess a 15 character password, and should I be worried?


What is the best way to explain (a non-technical person) the risk of leaking version information? I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided.

For example version leakage through:

the HTTP X-Powered-By header,
the HTTP Server header and/or,
public readme and changelog files.

Is there any example or metaphor that makes this easy to explain? I usually don't get any further than "Leaked version numbers make it easier for an attacker to match with known version specific software exploits in public vulnerability databases..."

Imagine a car robber specialized in stealing Toyota Prius models from 2010 to 2015. It will be pretty easy for him to identify this type of car, just by looking around and analyzing the model characteristics.

Now let's assume the car robber is blind and can only identify the car models by touching them. This would make it much harder for him, to spot the type of cars he is specialized in.

It's more likely that the car robber will identify and steal more cars of this type, in the first scenario.

In this metaphor:

The car robber is the attacker
The car model is the version information
The blind car robber is the blind attacker


Should police departments recommend the securit.leadsonline.com website as a secure place to store information about our valuables? This is kind of a social engineering question -- my local law enforcement agency sent out this email today:

  Help us by keeping identifying information about your valuables safe
  and accessible – Use ReportIt - it’s web-based and FREE.

  In just minutes, you can help the Police Department and other Law
  Enforcement Agencies in the battle to recover and return stolen
  property to the rightful owners!

  As part of our ongoing public safety partnership, we are recommending
  a tool that you, our community, can use to help us stop and solve
  crime…and it’s FREE!

  Through the website www.reportit.leadsonline.com, community members
  can safely and securely store important information to identify and
  recover lost or stolen property. You can store descriptions, photos,
  and other identifying information for up to 100 valuables through
  Reportit – for FREE. Leadsonline is a property recovery system used by
  us and other Law Enforcement agencies to help identify and recover
  stolen property sold to second-hand dealers. However, recovery of
  stolen items is only possible when victims of crime can provide the
  police with specific identifying information about their stolen
  property.

  Because the system is web-based, ReportIt accounts and their
  information can be accessed by any computer. Log in through the web
  from anywhere with internet access and retrieve critical information
  that Law Enforcement can use through the Automated Property System

I've removed local identifying information, but it was sent from the police department online alert system, so I trust that it's really from them, other police departments also recommend the system. If it didn't come from the police department, I would have assumed it was a social engineering attack.

Encouraging citizens to hand over a list of valuables to a third party seems like an exceptionally bad idea since the unending news of data  breaches makes it clear that if there's valuable information to be had, it won't remain out of reach of hackers for long. (

Perhaps making it worse is that the URL in their email for www.reportit.leadsonline.com results in an SSL warning because their *.leadsoline.com wildcard cert doesn't include that URL, so the PD is training users to ignore certificate warnings when they give out personal data.

My question is, is this serious enough for me to mention to my police department that it's a bad idea (not that they'll listen to me), or is it not really a big deal?

You should most certainly warn your police department this is a bad idea. We are a facility in Florida who is being told by our law enforcement that we MUST report all our customers sensitive information (including ID, fingerprint, address, phone, and more) to this company. As constitutionalists we've been researching a legal leg to stand on against this requirement. The fact that their certificates are provoking warnings is all the more reason to be concerned.


Securely launch local application from IE? I am facilitating an management system project in intranet environment(but with internet access for many domain users) for printing barcode labels from a web interface.

1.
The current method our vendor employed is to launch a local bar code designing solution from IE and print barcode from there. The software checks license on startup, the webpage passes in a temporary license when invoking it. It will quit with error if launched directly.
Their webpage use WSH FSO to launch this exe, we have to enable insecured ActiveX content in IE setting for this to work.

2.
Our company deployed policy blocks all writing operations by regular users to C:\Program Files folder, and nothing outside of Program Files folder is executable by user other than administrators. Effectively rendering all executables read-only, writable files in-executable.
But this barcode software needs to write to a lic file in its program folder.
So here is the second dilemma. If placed outside of Program Files it will not execute, if placed inside, it will crash on error, due to a unwritable lic file. It was suggested to assign the user to administrator group.
Adding together, it sounds a security nightmare.

My current solution to Issue1 to add this intranet address to trusted sites list and allow trusted zone to run insecure activex content.
For Issue2, since there are multiple ways from different layers to prevent program from running (ACL,group policy,etc), I locally added Full control permission of the lic file to current domain user, so that the program can write its lic.

Though I still not feel comfortable with the vendor's way of label printing. I think the current workaround I proposed have minimum negative impact on current system security. But I am open to different opinions.

Another thing, if we move on to Window10, will win10 still support the scripting objects?

It's just an idea - haven't tried it: Could you create a symbolic link to the actual .lic file in a different folder?
To do so, go to a command line window, and type:
mklink /H Link Target

With Link being the full path to the file where your application 'thinks' that it is, and Target being the full path to the actual file (outside of your 'Program Files' directory).
Here's a great guide if you like to read up more about symbolic links


Determining the target address in a heap overflow For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step :

hdr->next->next->prev = hdr->next->prev

I understand that the address of hdr->next->next->prev is calculated as hdr->next->next + 4 . Pretty clear.

Now, this value will be overwritten by the address hdr->next->prev which is controlled by the attacker and which contains the shell code possibly in the heap itself(assuming it is executable)

The target address i.e. the value in hdr->next->next in a vanilla heap overflow should be the address in the stack that stores the return address after free() has completed its job.

Q1. How does an attacker determine the Exact address of the return pointer of free() on the stack ?

Q2. The whole reason this occurs is because the pointer adds 4 to the hdr->next->next value to write the prev pointer. Has this been fixed or is it still one of the reasons for current heap overflows. (The reason why I'm asking this is, I am aware of other heap exploitations such as double free and so on, just want to make sure if the primitive reason was fixed)

A great, in-depth resource on a buffer overflow attack is the Smashing the Stack tutorial by Aleph One.  While stack overflow and heap overflow are subtly different, the techniques are similar/related.

Felix "FX" Lindner writes an excellent article (2006) on The H Security which describes your exploit in depth. Condensed version below; strongly recommend the full article for clarity.

In answer to Q1, determining the exact address pointer for the stack is the catch. Often - because of stack allocation, varying program and data length, etc, you can't detect the exact position without significant knowledge of the memory layout .  Instead, a common technique is to pad a series of instructions around the payload code in an attempt to "hit" the stack pointer.  A series of NOP instructions are written before the payload code so that "if" the SP is caught in the resulting buffer overflow, the SP will advance until it runs your payload. For the case where the SP is "after" your payload code, you might write a series of JMP instructions all pointing to the head of the payload. (See the tutorial; Aleph covers this process in detail).

The goal of this heap overflow is to corrupt heap record metadata just prior to the 'write' operation implicit in the assignment of hdr->next->prev to hdr->next->next->prev. With the linked list corrupted, it is possible to overwrite the return address used by the end of free on the stack.

In answer to Q2, I'll assume you're asking about the GNU Libc implementation of free().  Other implementations will likely have different code.  Multiple sanity checks now exist to prevent invalid sized objects and double free, etc. (See the _int_free() and related functions in Git). This is not to say (definitively) the vector is impossible through other means, but it is more difficult now.

A third (draft?) source of information on this subject is a whitepaper by Justin Ferguson: Understanding the Heap by Breaking It


What tools does the Google safe browsing service rely on? What are the tools Google uses to blacklist a website as being malicious (hosting a web malware)?

I know it is partly fed by users themselves who can enter unsafe URLs into Google's database.

But what, apart from this, are the tools Google uses? Does it rely on anti-viruses, for example?

Also, why is the Google safe browsing API not opensource?

Google  provides two experimental APIs for the Safe Browsing service

(1) Safe Browsing API v3

https://developers.google.com/safe-browsing/developers_guide_v3

(2) Safe Browsing Lookup API

https://developers.google.com/safe-browsing/lookup_guide

Both these above mentioned tools can be downloaded and used anytime .

https://developers.google.com/safe-browsing/

For anyone who wants to know more about how Google's detection system works , a detailed tech report can be found here

https://static.googleusercontent.com/media/research.google.com/en//archive/provos-2008a.pdf

There is also this page where a user can easily query to check the  site

http://grapethinking.com/google-safe-browsing-diagnostic

Google Chrome includes an optional feature called "Safe Browsing" to help protect users against phishing and malware attacks

https://www.google.com/intl/en/chrome/browser/privacy/whitepaper.html


Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic? So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts.  Of course, I've found a LOT of IPs requesting the files.  Too many to try and blacklist and too many different netblocks to block at a high level.

I'm thinking about redirecting all subsequent requests for the files to some kind of blackhole/tarpit/honeypot/bad guy reporting system, but I'm not sure if such a thing exists for HTTP traffic.

Ideally, I could redirect these IPs to the Internet police and they would be subject to investigation and stern talking to's, but I doubt a system like that exists due to it's potential for abuse

I'm afraid all those IPs are nothing but victims clicking on phished/malicious links.

Your client was hacked and malicious scripts were hosted on their server in order to infect inconspicuous victims. Whether you like it or not, your client contributed to spread malware.

The next step for you is to just serve a 404 Not Found on those requests and make sure your customer doesn't help spreading malware again. If you like you could just setup a 301 or a 302 pointing to a law enforcement site or serve a static page telling your visitors that they probably just clicked on a phishing/malicious email link.

As per your initial question, any tarpit (e.g. keeping TCP sessions open) you setup on a webserver will only slow your server down more than those guys. Seriously, there's no point on doing that.


Lifecycles of a computer virus According to what I read there are four phases:
- Dormant phase
- Propagation phase
- Triggering phase
- Execution phase

I however am having trouble finding a chronological order in how these events occur and a scenario.

The user downloads or acquires an infected .exe file

Would this be considered the dormant phase? The virus is idle not doing anything.

The user executes the infected .exe file

Now that the virus is activated it starts to replicate itself into other programs etc.. Is this the propagation period?

The user triggers the virus via a system event.

This I am guessing is the triggering phase?

The virus is now executing it's payload.

Finally once the virus has been triggered the payload is obviously executed, this could be harmless or damaging such as displaying text to the user, spamming the network, destroying the hard drive, you-name-it. I am to believe this is the final phase, the execution phase?

Is this how a typical virus works? Or am I lost.

Your chronological order is correct. Viruses can also cycle through this order.
From the Computer Security course by Dr. Indrajit Ray at Colorado State:

Dormant phase: The virus is idle. The virus will eventually be
activated by some event,

A date
The presence of another program or file
The capacity of the disk exceeding some limit.

Propagation phase: The virus places an identical copy of itself
into other programs or into certain system areas on the disk.
Each infected program will now contain a clone of the virus,
which will itself enter a propagation phase.

A virus will typically not propagate to another infected
program

Triggering phase: The virus is activated to perform the function
for which it was intended. Can be caused by a variety of system
events

Execution phase: The goal of the virus software is performed

Harmless - e.g. display message on screen
Malevolent - e.g. deletion of program or data files

There is an annotated piece of code on slide 8 that shows a virus structure. There are also atypical viruses that deviate from this cycle.


Is it insecure to send an email from a PHP script to an email address on the same domain? I have a php script that sends an email using mail(). The php script lives on domain.com, and it sends the email to info@domain.com. Is this a secure transaction? The website runs over https.

It's a good rule of thumb to assume that any email that you send becomes public.
If you want to preserve the integrity - sign it.
If you want to make sure that no one else can read it - use encryption.


How to forward an specific FTP User to a Honeypot? What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in monitoring users that I don't want to.

Is there a better way to obtain information of a Specific Shared Hosting User?

This is possible? The server is CentOS.

To do this, you would need an FTP proxy which was capable of proxying to different actual FTP servers based on the username that was supplied.

Frox has this essential functionality; it can route users when they use user@actual.ftp.host syntax for their username.  So clearly it is possible to implement a proxy that does what you want.  However, I don't think Frox does exactly what you want, because you want one subset of users with normal names to be sent to one server, and all users not in that subset to default to a honeypot instead.

It might be possible to do what you want using the Connection Translation feature of ftp.proxy, but I've no experience with which to say.


How to get net anonymity while browsing? I am a college student and I am getting free wifi for using the "Hostel campus" facility. To access the Internet, I have to put a proxy IP address to my browser.

I have heard that they can see all the sites I visit, so if I want to visit a porn site, it could definitely get me into trouble. I tried using VPN, but it won't get installed.

I would like to know if browsing with Tor would protect me from the administrator checking my browsing logs?

I'm not saying either answer is WRONG, but here's the answer to your question: Yes, Tor ought to protect you from an admin looking at your traffic. If that's all you wanted to know, stop reading now.
HOW TOR DOES THIS:
Tor employs a principle called onion routing to ensure privacy (hence its name, The Onion Router). Here's how it works: You hook up to the Tor network. Then Tor works out a path THROUGH ITS OWN NETWORK OF COMPUTERS WITH TOR for your data to take. Here's a graphic showing a prospective path:

Now you perform something called a Diffie-Helfman key exchange (SE community, please correct me if I'm wrong about this part) with all computers along the path individually. In a 3 computer path you now have worked out f(x) (with the first computer), g(x) (with the second computer), and h(x) (with the third computer). Let's call your request for information m. You work out f(g(h(m))) and send it to computer 1. Computer one, who only knows f^-1(x) (meaning f-inverse of x), performs that operation, and sends the result along to computer 2. Computer 2 only knows g^-1(x), so it performs that and... well you get it. After computer 3 has undone the third encryption, it takes a look at your request and passes it on to the pornography server you were trying to contact, named Bob. Bob sends computer 3 your erotic Animorphs fanfiction (sorry, couldn't resist). Computer 3 now sends your fanfic along the same chain of communication that we already looked at.
This system is effective for several reasons, but I'll just say this: Due to the properties of the Diffie-Helfman exchange (there's another answer on here that explains it just beautifully) your sysadmin will never see the keys for f(), g(), or h(). All he will see is that you're sending an encrypted packet to an IP that doesn't belong to any website at all. Will he be able to determine that you're using Tor? Almost definitely. Can he do anything about it? Well, he can stop you from accessing the internet (in fact, he might decide to), but he can't see your internet traffic, which means that you can keep your erotica to yourself. I would warn you that Tor includes an add-on called NoScript that stops you from watching video, so I hope your fanfic is in text form.


Securing data transfer between public network and personal accounts I would be traveling soon and I am looking for all kinds of ways to encrypt the data transfer (usernames, passwords, emails ...) between the new networks to which I will connect my Laptop, that is running Ubuntu Oneiric (11.10), and my server, my accounts, my everything that I will connect to.

So, what do you recommend me to do so?

This is the classic use case for a Virtual Private Network (VPN).

If you're technically savvy, you could set up your own VPN server at home. Strongswan is the one packaged with Ubuntu.

Or, you could use a third party VPN provider. Obviously though you have to find one you trust with your data. Note also that they won't typically get you inside your home network, they'll just get you to their network.


Check certificate expiry along with Public key pinning Will public key pinning completely avoids the default server authentication process by client?

For example, by default server authentication process server checks for certificate expiry, By implementing public key pinning it means that only public key will verified, and the certificate expiry check that happens as part of default server authentication will not happen?

The usual public key pinning as done in browsers is done additionally to the other validations. But one could implement public key pinning in specific applications so that it relies only on the key or certificate. This might make for example sense when the application developer controls both client and server and the server uses a self-signed certificate for authentication.


Collecting banking, credit-card statements from users I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following information:

Date
Description of transaction
Amount
Account balance

Unfortunately, I noticed that credit card statements also contain the following information:

The person's name
The credit card number
The banking institution's phone number

I do not store the latter information but it does travel through my system. If anyone were to gain access to the server that extracts this information, they could retain a copy.

I have the following questions:

Is there a way to collect the desired information without risking the person's personal information?
Can someone spend the user's money with this information? (If so, how?)
Does my service have to be pci-compliant? I am processing information that contains the user's credit card number but (1) The client willingly handed it to me (2) I am not extracting this number (3) I am not a credit card company, a merchant, nor their supplier (4) I did not sign a PCI contract, nor do I believe I will have to do so.
As far as I can tell, users are not liable for unauthorized spending on the their credit card and banking accounts so long as they do not give out their password (which they are not). In the case of unauthorized spending, is the user or my service liable for any lost funds?

Credit Card Numbers are property of the VISA, Master Card, American Express and other issuers so you cannot store them without abiding their rules even if you are not a merchant.
If the card passes in clear text in your system you will have to comply with their requirements.
You are not forced but if you have a breach you will not be able to prove that you had due diligence in protecting all the data if you do not follow their requirements.
I think the same is valid for the Private data.

I am no expert but i think in your case it is a risk management issue that you need to validate in order to understand what is best for your business.


How does pfsense block torrent traffic? I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more technical, the better.

As far as I know pfsense performs very simplistic traffic shaping where by it prioritizes traffic based on port range.  This is just so that you can play games with someone else using BitTorrent on the network.  This is just to be friendly,  this is not for "security".

Trying to filter all BitTorrent traffic at the gateway is very a difficult problem and a VPN or another type of tunnel can always be used to undermine this kind of filter.


What Is The Mechanism To Refresh Access Token In RFC 6749 Section 4.4 regarding Client Credentials Grant:

4.4.  Client Credentials Grant

   The client can request an access token using only its client
   credentials (or other supported means of authentication) when the
   client is requesting access to the protected resources under its
   control, or those of another resource owner that have been previously
   arranged with the authorization server (the method of which is beyond
   the scope of this specification).

Hardt                        Standards Track                   [Page 40]

RFC 6749                        OAuth 2.0                   October 2012

   The client credentials grant type MUST only be used by confidential
   clients.

     +---------+                                  +---------------+
     |         |                                  |               |
     |         |>--(A)- Client Authentication --->| Authorization |
     | Client  |                                  |     Server    |
     |         |<--(B)---- Access Token ---------<|               |
     |         |                                  |               |
     +---------+                                  +---------------+

                     Figure 6: Client Credentials Flow

   The flow illustrated in Figure 6 includes the following steps:

   (A)  The client authenticates with the authorization server and
        requests an access token from the token endpoint.

   (B)  The authorization server authenticates the client, and if valid,
        issues an access token.

It states that

  A refresh token SHOULD NOT be included

In this scenario, how should the token be refreshed if not supplied in the response? It will mean that the client will have to re-authenticate to get another access token.

the Client Credentials Grant should only be used in use cases where you can trust both endpoints (e.a. you control both ends).

as an example when being used in a server-server connection. for these connections you would never need a refresh token because for the rare case your token has expired you can simply redo the original request.

(your app has all the data to do the full request to get an access  token again).

having a refresh token would mean you open a secondary vector by having another credential that represent your authorization and authentication.


gpg --armor --export-secret-key differ on last 4 characters I created a backup of a gpg key by doing:

gpg -a --export-secret-keys foo@bar > private.key
gpg -a --export foo@bar > public.key

Then on another system, I import them:

gpg --import private.key
gpg --import public.key

I trusted the key as ultimate, and the backup seems to be working, the only thing that I notice is that when doing:

gpg --armor --export-secret-key foo@bar

The last 4 characters differ for example:

dutrV4c4hoPc6ntI3n9VztsL4LmmvoCcH969nJD6bTh4H1VMH98r8zECshtCSfVE
tMIIhXjA9xO1IZ6vMqHJU8TNhV2ttOE1Z/sUjcB46X4=
=TGyi
-----END PGP PRIVATE KEY BLOCK-----

In the new computer:

dutrV4c4hoPc6ntI3n9VztsL4LmmvoCcH969nJD6bTh4H1VMH98r8zECshtCSfVE
tMIIhXjA9xO1IZ6vMqHJU8TNhV2ttOE1Z/sUjcB46X4=
=/eDz
-----END PGP PRIVATE KEY BLOCK-----

Wondering why the last characters differ, in this case
=TGyi and =/eDz

TO THE ASCII ARMOR SPEC! -- RFC 4880. The ASCII ARMOR specification is given in Section 6.2:

  Concatenating the following data creates ASCII Armor:

  An Armor Header Line, appropriate for the type of data
  Armor Headers
  A blank (zero-length, or containing only whitespace) line
  The ASCII-Armored data
  An Armor Checksum
  The Armor Tail, which depends on the Armor Header Line

So the last 5 characters (=TGyi and =/eDz) are a checksum of the armored data. Oddly Section 6.2 doesn't define the checksum format, but an older version of the spec, the 1995 Internet Draft for PGP, does:

  The Armor Checksum   is a  24-bit CRC   converted  to four  bytes  of
     radix-64 encoding, prepending an   equal-sign  (=) to the   four-byte
     code.

Checksums are used in a number of other places is the RFC, always defined as two-octet sums modulo 65536:

  Then a two-octet checksum is appended, which is equal to the
     sum of the preceding session key octets, not including the algorithm
     identifier, modulo 65536.

It does seem a bit odd that two copies of the same data would have different checksums, ... maybe there's enough ambiguity in the spec that different versions of openpgp use different methods to compute the checksum?

(Disclaimer: this is my first time diving into the PGP spec, perhaps someone more familiar with it can explain properly)


Installing and updating a CA certificate on a client I am trying to implement a system where a client can download application packages from a server to install/update them on the client. I suppose that the client is something like a platform on an embedded system. For integrity of the application packages, I am considering using a digital signature.

I did some research and found that the client would have to have a CA certificate and the server would have to have a server certificate signed by a CA and a private key. I know that the server certificate could be issued by a CA if I asked. Then, the server would store it somewhere and send it with application packages and signatures of them so that the client can verify them using a CA certificate.

My questions is what the client is supposed to do to install/update a CA certificate. When we used other type of client such as web browsers and mail applications, we would not recognize what those applications are doing for installing/updating a CA certificate. But I would need to implement it on the client.

My questions are

Is the client supposed to download a CA (root) certificate from a web site of the CA before it is used?
Or does a CA (root) certificate has to be pre-installed on the client?
Or is the server supposed to keep a CA certificate and tell the client where to download the CA certificate?
What is the client supposed to do to update a CA certificate for some reason?

I would appreciate it if someone could reply to me.

The Official Way

The certificate is a valid legal identification for a person/company/agency. As with any formal document you have to obtain it from an official Certificate Authority. There are many.
As a developer you have to get from them at least 2 certificates: one for your server, and one for you as a client. To get them you have to do a requisition. When you do this you'll be granted your certificate and your private key file for every certificate.

After this legal process you can install it on your apache server like this:

First you install the certificate chain in the server. These are some certificates, publicly available from the CA (certificate authority).
This chain, can be only one root certificate or many.
If there are many you put them all in a file together. There are other ways but I
found this one to be better.

Then you add this lines to you apache configuration:

SSLEngine on
SSLOptions +StdEnvVars +ExportCertData
SSLCertificateFile      /home/<youruser>/<yourCertFolder>/server.crt #server file
SSLCertificateKeyFile   /home/<youruser>/<yourCertFolder>/server.key #server private key
SSLCertificateChainFile /home/<youruser>/<yourCertFolder>/rootCA.crt #server certificate  chain
SSLCACertificateFile    /home/<youruser>/<yourCertFolder>/rootCA.crt #server CA certicate file (if you're in the test process below, should be the same file above)
SSLVerifyClient require
SSLVerifyDepth  10

Go to your browser and import the certificate chain of the CA that issued the certificates.
Import your personal certificate to it. There are some certificate types. If you bought A1 (files) certificates you just import it to the browser. If you bought an A3 token (like an USB flashdrive but for certificates) you have to first load the driver to the browser and then it will import it automatically when you enter a SSL enabled site.
The certificate you're using in the browser has to have the exact same certificate chain than the server is using or the server won't be able to validate it.
After this you should see a window asking you to select you cerficate when entering the site.

Lot of stuff huh ? believe me, learning this was an harsh process.

The Test Way

But there is something you can use as a test process. You can create you own CA and emmit your own certificates locally in your server and development machine. Here's how you do it:

First install openssl in your machine if it's not already installed. Then use these scripts:

Create CA and server certificate:

#/bin/bash
echo "Create CA private key"
openssl genrsa -des3 -passout pass:123 -out  ./rootCA.key 2048
echo "Remove passphrase"
openssl rsa -passin pass:123 -in ./rootCA.key -out ./rootCA.key
echo "Create CA self-signed certificate"
openssl req -config openssl.cnf -new -x509 -subj '/C=US/L=Dev/O=COMPANY/CN=CA' -days 99999 -key ./rootCA.key -out ./rootCA.crt
echo "Create private key for the server"
openssl genrsa -des3 -passout pass:123 -out ./server.key 2048
echo "Remove passphrase"
openssl rsa -passin pass:123 -in ./server.key -out ./server.key
echo "Create CSR for the server"
openssl req -config ./openssl.cnf -new -subj '/C=US/L=Dev/O=COMPANY/CN=server' -key  ./server.key -out ./server.csr
echo "Create certificate for the server"
openssl ca -batch -config ./openssl.cnf -days 999 -in ./server.csr -out ./server.crt -keyfile ./rootCA.key -cert ./rootCA.crt -policy policy_anything

issuing certificates:

#!/bin/bash
if [[ -z "$1" || -z "$2" ]]; then
    echo "Use: issueCertificate <NAME>"
    exit
fi
NAME=$1
DN="/C=US/L=Dev/O=COMPANY/CN=$1"
ARQ="${NAME//[[:space:]]/}"
echo -e "\nCreating folder... "
mkdir $ARQ
echo "done."
echo -e "\nCreating private key... "
openssl genrsa -des3 -passout pass:123 -out ./$ARQ/$ARQ.key 2048
echo "done."
echo -e "\nRemoving password..."
openssl rsa -passin pass:123 -in ./$ARQ/$ARQ.key -out ./$ARQ/$ARQ.key
echo "done."
echo -e "\nCreating CSR... "
openssl req -config ./openssl.cnf -new -subj "$DN" -key ./$ARQ/$ARQ.key -out ./$ARQ/$ARQ.csr
echo "done."
echo -e "\nCreating client certificate"
openssl ca -batch -config ./openssl.cnf -days 999 -in ./$ARQ/$ARQ.csr -out ./$ARQ/$ARQ.crt -keyfile ./rootCA.key -cert ./rootCA.crt -policy policy_anything
echo "done."
echo -e "\nExport client to pkcs12 and import in browser"
openssl pkcs12 -export -passout pass:123 -in ./$ARQ/$ARQ.crt -inkey ./$ARQ/$ARQ.key -    certfile ./rootCA.crt -out ./$ARQ/$ARQ.p12
echo "done."

So I guess that's all. I've has to translate some things and change some var names and constants in order to remove my company's name and this whole process is rather complex. So I appologize if I forgot something or something doesn't work. Please inform and I'll correct promptly.

Good luck. :)


Why does SSL/TLS use message authentication code instead of digital signature? In SSL/TLS process, message authentication code ensures a message's data integrity.
However, digital signatures offers not only data integrity but also non-repudiation.

Then, why does SSL/TLS use message authentication code instead of digital signature for data integrity?

Message Authentication Code (MAC) are based on symmetric cryptography. Digital Signature are based on asymmetric cryptography.
Using the existing algorithms, symmetric cryptography is by far computationally cheaper than asymmetric.

It means that you can create and verify a MAC for each packet on a network traffic with a reasonable increase of calculation, i.e. without slowing the traffic to much. With digital signature, the cost of signing and verifying each packet will surely create a bottleneck slowing drastically the traffic or needing a huge amount of computational power.


Law of Large Numbers vs. OpenSSL RAND_bytes I have a system where tens of thousands of users log in whenever they like and my server has to assign them to one of many databases. I would like to distribute the users evenly amongst the databases. I was thinking of using one of two methods, and cannot decide which will give me a more even distribution:

RAND_bytes from OpenSSL modulo number of databases.
Current Timestamp (in seconds) modulo number of databases.

The first option relies on RAND_bytes and the second relies on the Law of Large Numbers.

Users log in mostly during certain peak hours.

Which one will give me a more even distribution?

By definition, a cryptographically secure PRNG will give you the most uniform distribution -- because any detectable bias would be considered as a weakness. If the PRNG is "strong", then this means that nobody ever detected a single bias, even though they were trying real hard.

OpenSSL's RAND_bytes() function is supposed to be a cryptographically strong PRNG, and many systems rely on that.

With timestamps, you can only hope that nobody will guess your method and create accounts at regular intervals precisely to always fall on the same database and thus make your life harder.

Therefore, use RAND_bytes().


REST API and security In a few occasions, pen-testers asked me to avoid the use of detailed HTTP return codes that could reveal information to an attacker.

For example, they said that it is wrong to return a 404 when the resource does not exist because this helps to enumerate the existing resources.

All the articles I have read about best practices for the development of APIs, suggest to return meaningful error codes and in particular they stress that a 404 should be returned when the identifier of the resource in a GET does not correspond to an existing resource.

Isn't this behaviour a security vulnerability ?

See HTTP Status Codes as an example

If you have this Y-problem,

  it is wrong to return a 404 when the resource does not exist because this helps to enumerate the existing resources.

then this means you have this X-problem:

Resource enumeration should be prevented.

This in turn might affect all resources or unauthenticated resources only. In other words you might be able to mitigate the problem by requiring authentication before asking for a given resource.

Otherwise, you could make said resource difficult to guess, and implement some kind of scanner detection (simply storing what resources get 404'ed by which network for some time could be enough. You could perhaps offload the problem to an installation of fail2ban).

The problem as stated makes little sense because you cannot return a valid resource if an invalid one was requested - in general, you can't make up sensible, believable resources out of thin air! So there will always be a way to distinguish between resources that exist and resources that don't. Granted, supplying the information in a HTTP status header makes things simpler for the attacker, but it also makes things easier for you.

In some cases you might be able to synthesize a nonexisting resource. For example say you offer something akin to an avatar service. Then /users/lserni/avatar.png could return my picture, while /users/someoneelse/avatar.png could return a random picture generated using "someoneelse" as random seed, so that the same someone else always gets the same PNG back. But as you see, this kind of approach requires specific domain knowledge, there can't be a one-size-fits-all rule.