What would be a better encryption algorithm then RSA_DES_EDE3_CBC? First off, please let me explain why I'm asking this at all:

The default implementation of EnvelopedCms is using AlgorithmIdentifier which by itself will use RSA_DES_EDE3_CBC or OID
1.2.840.113549.3.7 as encryption algorithm. Many tools using EnvelopedCms seem to just copy & paste example code. Now I don't know about you but in 2017, when I read DES, I think "not safe". Maybe I'm wrong at this point already, DES atleast still is used here and there, but the last time I checked the recommandation was to rather use more advanced block ciphers such as AES.

Now for my question(s):

Is RSA_DES_EDE3_CBC still "secure" enought? When I ask this I mean like is it secure enough for the next few years, since a typical user doesn't want to re-encrypt files every year. For the sake of the discussion let's just assume Moore's law and ignore any unforeseen breakthrough e.g. quantum computing.
If not, as I presume (see title), what OID would be a better pick when using EnvelopedCms? Perhaps OID 2.16.840.1.101.3.4.1.42 (is this even a correct block cipher OID?) or something even more advanced? And most important: where can I find a list of OIDs / FriendlyNames supported by AlgorithmIdentifier?

RSA_DES_EDE3_CBC means RSA is used together with an encrypt-decrypt-encrypt (EDE3) version of DES. If for each step (E, D, E) a unique key is used you are effectively using Tripple-DES (3-DES). According to NIST it still provides a security of 112 bit, which is supposed to be sufficient today (06/2017 - who knows...).
However, NIST also recommends using AES (128 or more).

You can find a list of some supported OIDs here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa381133(v=vs.85).aspx

I do not know what kind of software you are building. If you just want to encrypt something, you may want to use RSA toghether with AES. So you would go with encrypting a message with AES128_CBC (OID 2.16.840.1.101.3.4.1.2) and the encrypting the used key with RSAES_OAEP (OID 1.2.840.113549.1.1.7)

Personally I would try libsodium (https://download.libsodium.org/doc/) which does a lot of things for you without any hazel (key genaration, wrapping, ...). It uses ChaCha20-Poly1305 instead of AES-GCM and Ed25519 instead of RSA.


Threat modeling for visitor access control I am trying to understand threat modeling but it seems too elasti from restrictive requirements to general requirements.

Now i am trying to understand it with some realistic examples. The first example which comes to my mind is physical access control of an office premise in which visitors have preapproved restrictive access and employees have unrestricted access. Each employee and legitimate visitor is given an id card to prevent this. Any official laptop should not go outside office without permission. Each laptop has an rfid tag to prevent this.

Can somebody help me understand threat model in this example? Or can somebody point me to where similar analysis has been done?

I think you're mixing a couple of different sorts of things into your question.  You want to threat model the office, which has a set of entry points, and some stuff* you want to protect.  That stuff includes laptops, which you've identified, and probably other things, like confidential printouts, the hard drives in desktops, those fancy Apple monitor stands, the scotch in the company bar, the employees and their sense of well being... We don't have to be exhaustive.

You have two types of problems you've informally identified: one is the visitor, the other is the laptop walking away.  You have two controls: badges and RFID tags.  Let me now take this, and re-frame it a little.

I advocate for a four-question framework as central to threat modeling:

What are we working on?
What can go wrong?
What are we going to do about it?
Did we do a good job?

So what you're working on is the security system for an office.  What can go wrong, we can approach in a few ways. We could expand the attacker list to include other types of person. That has a failure mode of excluding people, say, kids or drunk employees, and so I tend to avoid it, and focus on the threats (" future problems").  Here we might look at theft, damage, disclosure as a list of threats to worry about. In software, we'd look at STRIDE or a kill chain as a model of the threats.

We'd use that list to come up with a list of countermeasures or controls. You've listed two, we might add turnstiles or other physical controls, conference rooms near the entryway, a second set of doors, etc.  These are the answers to what we're going to do about it.

*I'm carefully not using the jargon 'asset,' because it has too many meanings. Also, 'entry point' is a term of art that lots of people used to use, from a physical protection analogy and so I bring it back here. More commonly, in software-focused threat modeling today, we'd talk about trust boundaries or attack surfaces.


Key Exchange using RSA I'm trying to do key exchange using the following scheme.

Server generates an RSA-2048 key pair and sends the public part to the client
Client generates an RSA-592 key pair (I have to use RSA-592 due to client performance reasons; 592 bits is the minimum key size for encrypting 256 bits using OAEP)
Client encrypts the public part of the key pair using the public key from the server, and sends it to the server
Server encrypts AES-256 key (random) using the client's RSA key pair, and sends it to the client

So, is this secure than plain RSA-592?

Your scheme is not secure as you're sending the private key of the server over the wire (in your first step).

Extension (after update of question)

The scheme is still not secure as now I can intercept the public key from the server and replace it with my own certificate (Man-in-the-Middle-Attack).

To secure your scheme you have to use a CA (even you can create your own CA for this).


Implementing a commitment scheme in java Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated.

Thanks

There is a huge variety of commitment schemes out there; they have various characteristics. The simplest commitment scheme is a simple hash, and Java does offer implementation of the most standard hash functions (through the java.security.MessageDigest API). More advanced commitment schemes allow for proving that the commitment is "correct" (the committed data fulfills some algebraic property) without opening it. Many such schemes have been designed, but none is a standard in its own right, so there is no readily available implementation in standard Java.

(That's the difference between a cryptographic algorithm, as described in an academic article, and a standard: the latter states unambiguously where each bit goes, dealing with boring but important issues like endianness and corner cases.)

At least Java does offer some useful tools for implementing cryptographic algorithms, namely BigInteger and hash functions.


Is it possible to get infected by malware from running a foreign Xcode project? An entrepreneur hired me to build out his mobile app and passed me the Xcode project files. From what I've read and heard about the development agency that built out his beta they're sketchy to say the least. The word SCAM was thrown around plenty of times, and he made it pretty clear his experience with them was dismal at best.

Now I want to run the app, check for bugs; make sure at least the app is copacetic, but I'm uncertain of whether or not I'm opening myself up to vulnerabilities running this foreign project on my machine. Can anyone shed any light on the matter?

If you run un-trusted code on your box ... it is no longer your box

That being said, if you do a full backup of your Mac and Airgap it before running the code.  Then wipe it, and reinstall from backup before connecting it to anything ... you should be ok (as long as a rootkit isnt injected into the firmware which is low probability but still a risk).

Short of that, I would read through every line of code and verify the integrity of any/all third party libs the code is using before running it ... and even then I would step through the entire thing.

IMO if this entrepreneur is willing to buy you a new computer to test the code on ... I would say go for it.  However, judging by his decision to hire this other group to write the beta code (aka cheapest outsource work he could find) ... I doubt he is paying you enough to take the risk with your own computer.


root with no password I was reading that in Ubuntu for security reasons root is disabled / has no password set, hence we cannot su into it. How this is increasing security if one could simply do sudo su and gain identical permissions?

I think you have a slight misunderstanding -

root is generally disallowed to login via SSH, but is still a valid user once on the machine.

When executing simply su, a user will be prompted for the root user's password in order to continue; sharing a password like this is bad practice.

If a specific user has access to sudo su, then only that named / user my become root. Again, sudo su will only work for the users / groups that are explicitly defined in /etc/sudoers.

The this link on why allowing root over SSH is bad practice.


Proxying a Credit Card Transaction? Lets say there is a service that processes a credit card, service X. I want to create a new service (Y) that has a form on it mirroring the fields from service X. I use the credentials entered into service Y and POST them to service X programmatically, and there is credit card information being posted. Is this legal? Is this PCI compliant? I would not be storing any information, however there may be loops involved as in entering this one form in service Y may enter multiple forms on service X, this all would be specified on service Y's Terms and Conditions of course.

My recommendation at that point is use a better service that doesn't require you to pass the information from one form to another.  If you are handling PCI at all, then you have to worry about at least some of the regulations.  It is best to have your system call out to a payment provider, let the user use their site and then their site will tell you about the success or failure.  Many vendors will even let you do it in such a way that it doesn't look like they are leaving your site.


HTTPS MITM Proxy breaks HTTPS I tried to reverse engineer an Android APP using MITMProxy,
and the Server responds with an unauthenticated-error.

If the whole authentication would be using headers (Basic, etc...), the Proxy should forward those headers.
And it does forward the API-Key-Header.

Yet, the handshake seems to fail.

Would could cause that error?

The only thing i can imagine is a client-side SSL-certificate,
which gets replaced by the Proxy, but i fail to find any code setting that certificate...

I figured it out! The app was using a service called Approov, which was a third party service generating a new token every five minutes to prevent third party apps from accessing a protected ressource.

Took a while to get around it, but at least i learned something new.


If SSL private key is compromised, what can they do? If a 3rd party who is malicious manages to get a hold of a SSL private key for domain (ex: xyz.com), but does not have access to the domain registrar or DNS for the domain, how can the 3rd party utilize the SSL private key? Would they be able to man in middle? What are potential attack vectors?

The attacker can use the private key to either mount an active man in the middle attack or decrypt passively sniffed traffic if RSA key exchange was used. The exact possibilities of an active man in the middle attack depends on the abilities and location of the attacker in the network. Some examples:

If the attacker is inside the local network of the victim he might try to use ARP spoofing or DHCP spoofing to either incorporate the router or the DNS server used by the victim.
At the ISP level the attacker could reroute DNS requests to a DNS server under his own control and this way direct the victim to its own fake system which uses the stolen certificate and key.
Similar attacks could be done if the attacker is near the original server or near the authoritative name server for the domain with the compromised certificate.
An attacker at a different ISP could also bring itself in the path to the original server or the authoritative DNS server by rerouting traffic using BGP spoofing.

For more information see the related questions What can an attacker do with a stolen SSL private key? What should the web admin do? and Can an attacker reuse stolen SSL private key to recreate that domain on his server.


Can plain text be hidden/accessed in laptop Firmware? (or elsewhere, not HDD/SSD) Scenario: I just took 1 page of text (.odt) and copied it into a plain text document, that happens to result in a 3KB file.

With that as a random size criteria for discussion, CAN code be written to hide that document in firmware such that it can be accessed, edited with a plain text editor, and then put back, as a means of bypassing traditional hard drive storage that can be confiscated and destroyed?

The very simple answer is yes, and you can check this for yourself by reading BIOS information, or the text that is stored in various devices and drivers. You could even store text in the firmware in most modern keyboards.

Next time you update your BIOS, look at the upgrade file in a hex editor - loads of text in there, comments fields etc.


Additional confirmation for online bank payments Nowadays, when someone is making an online payment, the associated bank often requires an authentication step.

As far as I know, there are mainly two ways to do this:

SMS Verification.
The Bank sends an SMS to the client with a specific code that should be stated on the authentication web page.
Indicate the date of birth. Instead of entering a code, the authentication web page only requires the date of birth of the client.

It seems that the second version is less secure than the first one, as the date of birth is an information that can be found easily from the fact that people provide it on many websites.

So why banks do not only use the SMS verification instead? Does it imply some protocol complications?

I've never heard of just using the date of birth for authentication. It's a bad idea as a date of birth is non-revocable. Meaning if it is "compromised" you can't change it.

If it is the only means of authentication for consulting account or transactions it's a REALLY BAD IDEA.

But that brings me to my second point. It is, in general, not considered your risk, but the bank's. If you can proof their authentication mechanism sucks and you get defrauded, there is a reasonable chance the bank will have to pay you back as they weren't very diligent.

That being said you would still have to go through a lot of hassle to get that settled. If a bank is taking such an approach and there are no other controls in place, I wouldn't stay with the bank.


How can common users defend against the StageFright vulnerability? I was just informed of the StageFright vulnerability in Android devices.

A specially crafted MMS message can gain access to data on the phone; so presumably it's a buffer overflow with subsequent privilege escalation.

Details have not yet been disclosed, but the practical question is: how can common users defend against an attack using this vulnerability?

It seems that not opening MMS messages would be the most important part.
Are there other steps that end users should take to prevent themselves from this vulnerability?

You should disable the automated downloading of media files through SMS/MMS, there are multiple services that use this. Depending on which you use, you should disable this in the settings per service you use.

For google messenger:

More can be found here.

Besides that, don't open any messages containing multimedia files from someone you don't know or trust as you can still download the file manually and trigger the file that way.

Note that the SMS/MMS part is not the real threat here, it's just a way of getting malicious media files onto your phone and getting them to execute without user input. The actual threat is in the way media files are being processed. So receiving & viewing a media file through other channels will be just as dangerous.


Secure alerting for a monitored web application What is a good method to receive security alerts?

Email is the first thing that springs to mind, although it is susceptible to MITM attacks (e.g. an attacker preventing the email from being delivered). Although this is not really a practical attack as the MITM will not usually be suitably placed for this to work (often email retrieval is done over SSL, and it is hard for attackers to intercept the actual delivery). There could be other attacks though such as the attacker DDoSing the mail server to prevent alerts from being received.

Text message sounds a good way, however the number of alerts triggered could be high and unsuitable for this format.

Another way may be a mobile app so that alerts can be received at anytime or anywhere. However, if the app is not currently installed alerts will not be received (e.g. users changing phones, etc, whereas formats such as email and text message are universal).

We are looking to monitor an inhouse, internet facing application deployed to the cloud from a security perspective and would like alerts such as the following to be logged and possibly alerted upon:

Incorrect password attempts.
Forms submitted with incorrect CSRF tokens.
Attempted access to URLs that the user should not be able to access (e.g. if the user tries to go to /Admin or if there is any parameter tampering - /Project/1234 is changed to /Project/4567 by the user).

In a nutshell, any security threats that can be handled internally by the application that we would like to know that has been attempted. We are not interested in trying to detect attempts at XSS or anything "extra" outside our application functionality, simply we would like to know when one of the existing security rules are triggered so we can monitor it and possibly act upon it. By security rules I mean the business logic within the application in order to secure it so this system would be actually implemented at code level to decide on what we should be alerting on.

Security events are already logged, however checking these logs is a manual process. We could introduce the concept of thresholds to reduce false positives. i.e. one incorrect password attempt is only logged, however 5 incorrect attempts in a row against an account of from a particular IP triggers an alert.

So to summarize I am looking for a secure and reliable way to be alerted when a security event is triggered. Either through custom code or some other method as I have a feeling that this is an already solved problem. This will be combined with IDS in future, so this is purely from the internal perspective of the application.

I am currently thinking that text and email solution might be suitable, however the text and email trigger only once and only display a link to log into the monitoring application to view activity.

Nagios has a feature that detects what is called "flapping" which you could implement yourself. Basically it will start sending you text messages, but will stop if it passes a certain tresshold within a given timeframe for a similar type of warning message. It's up to you to decide the thressholds and the intervals and the classification of the events.

Text messaging and email is a good idea for monitoring. But make sure to also log a ticket for each incident and ensure that for every closed ticket a detailed resolution or response is given (just email doesn't provide enough traceability).

You can also use logstash and kibana or if you are a bit richer Splunk to perform automated data agregation and dashboarding to make the process less painful when checking the logs.


Is it possible to read a text file inside a password-protected zip file without the password? I have a text file (.txt) compressed in ZIP format protected by a password. I think it has only one line of text and I want to see the contents of this file.

I tried fcrackzip but I think the password is more complicated than I imagine, so the question is: is it possible to see the content without needing to have the password of the file?

I am not an expert in computer security but a somewhat absurd idea that comes to mind quickly is something like seeing the hexadecimal code of the file and trying to decipher it.

No. There are two ways of zip encryption, a classic one, which is weaker, and a newer one based on AES.

In both cases the password is needed in order to decrypt the contents (i.e. it's not just UI, where you could be asked for a password without the program actually requiring it to read the file). So the process would involve breaking the password (which would be more or less complex depending on the algorithm used and how the password was used).

At most, you would be able to obtain without decrypting, in addition to the filename, the CRC32 of the plain file. But although that would help if you already suspected what the content was, it probably won't be helpful here, even if it is just a line of text.


Getting hmac_sha to work between Erlang and PHP I am trying to get an implementation based on the AWS signed http request API to work between Erlang and PHP. But I can't get it to work.

The core approach is that you constructed a canonical version of an http request and sign it with a secret key and attach that signature to the headers.

On the Erlang side I am using crypto:sha/ which returns a 160 bit/20 byte signature - so I think that is SHA1

On the php side I am using hash_hmac/3 with the sha1 algo.

The Erlang code and output looks like this:

sign2(PrivateKey, Str) ->
    io:format("Str is ~p~n", [Str]),
    Sign = xmerl_ucs:to_utf8(Str),
    io:format("Sign is ~p~n", [Sign]),
    Hash = crypto:sha_mac(PrivateKey, Sign),
    io:format("Hash is ~p~n", [Hash]),
    binary_to_list(base64:encode(Hash)).

giving output of

Hash is <<147,121,203,238,1,247,248,246,157,133,49,21,159,146,41,243,124,101,99,57>>
B64 is "k3nL7gH3+PadhTEVn5Ip83xlYzk="

The PHP signing code is:

public function sign2($privateKey, $str) {
    echo "privateKey is " . $privateKey . "\nstring is " . $str . "\n";
    $hash = hash_hmac('sha1', $str, $privateKey, true);
    $this->dump("hash ", $hash);
    return base64_encode($hash);
}

Giving output of

privateKey is uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o
string is DELETE\n\n\n\nx-amz-date:Tue, 27 Mar 2007 21:20:26 +0000\n/johnsmith/photos/puppy.jpg
hash :217 254 129 103 14 29 63 36 176 253 241 183 51 111 120 22 117 125 167 104
Test hash_test1 fails expected: k3nL7gH3+PadhTEVn5Ip83xlYzk= got 2f6BZw4dPySw/fG3M294FnV9p2g=

This php implementation returns 160 bits/20 bytes which is why I think it ought to match crypto:sha from erlang - but I could be talking mince...

I suspect (from previous experience) that there is some mismatch between what I think hash_hmac is doing and what it actually is.

It's a string problem - turns out single quoted strings and double quoted strings aren't the same in anyway in PHP.

Here's some relevant info:
https://stackoverflow.com/questions/3446216/difference-between-single-quote-and-double-quote-string-in-php

tl;dr; I was using single quoted strings - when I went to double quoted ones it worked.


Decrypting binary code from a base64 string So, this online discussion function use decoded account names in every post, along with that they call "logging data", an example of this can be:

Loggin data: 10878
Encoded account info: U2FsdGVkX19bCgrkbEjt4gDrFKNANCce

Now, the first part of the string when run through a base64 decoder ("U2FsdGVkX1") is just the string "Salted__" and the rest is what appears to be something binary.

So the account string changes for each input by the user, and what I am trying to do is to decode this string in order to determine if the value after "Salted__" is the same, and knowing that this is something that the owners of the software can do, I must assume that the "loggin data" is some sort of salt for the resulting binary data.

So, my question is - is there any way for me (or you) to figure out just how the binary data is encoded and how to decode it? And again - it can be decoded, as long as you know how. :)

This data does not (to my knowledge) contain any personal information and may at most contained the login name or the login ID of the user, so I am not trying to expose any personal information. Only determine whether someone is posting with multiple "nicks" from the same account.

The prefix Salted__ almost certainly means this either is the output of the openssl enc command or something designed to be compatible with it. There are many other password-based derivation, hashing, or encryption schemes that use salt, but none use this particular very simple format.

The salt is in the ciphertext, just after the prefix Salted__, so the 'loggin data' is not the salt; from the information you present, it's impossible to tell what if anything it is. Since the salt is random for each encryption, encrypting the same data (possibly the login or account you are looking for) multiple times will produce an entirely different encryption each time and these cannot be linked except by decrypting.

In order to decrypt this, you need to know, find out, or guess:

the cipher/mode used -- it clearly is either stream or 8-byte block and most likely the latter. If you can de-base64 numerous ciphertexts and any have lengths that are not a multiple of 8 it is definitely a stream cipher (RC4) or mode (CFB, OFB, CTR); if all are a multiple of 8 it is extremely likely a block mode (CBC or usually-bad-ECB) of TDES or maybe another 8-byte block cipher. Worst case there are a few dozen possibilities to try, a hurdle but not insurmountable.
the derivation hash -- almost certainly the default MD5; few people even know there are options
the password used -- if the system is properly designed and operated, this password should be secured so you can't get it, and strong enough you can't guess it in less than say a million or billion years. That said, the openssl enc PBKDF is weak, so if the password is actually known to a person (or persons) rather than on something like a smartcard or USB stick it is probably feasible to brute-force it if you have enough time and CPU power.


Does Apache Tomcat 9 meet PCI compliance? Does Apache Tomcat 9 meet PCI compliance?

From where I should start reading and gather some information about that topic?

Individual software packages are not judged compliant or non-compliant by PCI.  Rather, the organization using them is required to attest that they are following PCI-approved practices where they apply to that software.  A limited subset of examples:

  6.1 Establish a process to identify security vulnerabilities, using reputable outside sources for security vulnerability information, and
  assign a risk ranking (for example, as “high,” “medium,” or “low”) to
  newly discovered security vulnerabilities.

This requires that the merchant track vulnerabilities (for example by reviewing the list here) and patch or apply compensating controls to ensure the merchant's installation of Tomcat 9 is not vulnerable to attack.

  6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security
  patches. Install critical security patches within one month of
  release.

Keeping Tomcat 9 patched is another requirement imposed by PCI.

  6.4.1 Separate development/test environments from production environments, and enforce the separation with access controls.

This is an excellent example of how your practices matter; this is not anything intrinsic to Tomcat 9, but rather a constraint upon how you choose to use it.

As always, the best source to learn more about PCI DSS is the document itself, available from the PCI Security Standards document library.


Can recovery of decrypted text possible with memory dump with root privilege in Linux? Suppose Alice and Bob are communicating using secure channel and both use symmetric key algo (AES) for encryption/decryption. The scenario is like

1. Alice encrypt data M1 with secret key K and sends cipher text C1 to Bob.
2. Bob receives cipher text C1 and decrypt it to get plaintext M1.

3. Bob encrypt data M2 with secret key K and sends cipher text C2 to Alice.
4. Alice receives cipher text C2 and decrypt it to get plaintext M2.

These sequences are followed repeatedly till communication ends.

Both Alice and Bob are using Linux System with latest kernel.

I have following questions with respect to security point of view.

If an intruder somehow manages to gain root privileges on Alice's system, will the intruder be able to capture the plaintext M2 stored in memory while Alice performs decryption operation ?
In case the secret key K is stored in memory (I'm not sure** whether it is) during encryption/decryption is performed, then is Intruder also able to retrieve secret key K the same way?

Edit 1:

From both answers , it is known using MEMORY DUMP , it is possible to recover secret key as well as plaintext.

Can you explain with example?

This question is missing the implementation context - i.e., the software that implements the algorithm in question. With that caveat, the answers are YES and YES. Intruder with root priveleges can extract both plaintext messages as well as the key.

Recent implementations are a super conscious of this - and try to wipe the key from memory ASAP (interpretations of this "ASAP" vary). It is however practically impossible to bring down the exposure to zero for both the message and the key.

At best, the key can be protected in a hardware assisted solution (SGX or a HSM) - or even a separate decryption solution (not as implied by you - decryption on the same system/kernel.

The message itself cannot be protected as long as it is required for use in that system. Some obscurity can be managed though. e.g., some software use techniques that beat a simple "strings" analysis. I wish I stored the reference somewhere. Unable to link it here.


Why is penetration testing important In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy deficiencies, and therefore an actual demonstration of that deficiency though a commissioned penetration test would be unnecessary.

What benefit, therefore, does "Red Team" penetration testing provide to an organization beyond the benefit gained though an audit. Furthermore, would there be significant benefit in contracting with a firm to conduct regular penetration tests against an organization in addition to the otherwise scheduled security audits?

Computer Science is just that a Science.  It would be very scientific to just hypothesize that you are secure without actually putting it to the test.

You can perform source code analysis and other whitebox testing methodologies to find all sorts of interesting and high impact vulnerabilities...  but what if no one could actually exploit these issues?  You can't get hacked with an unexploitable vulnerability,  yet systems are broken into on a regular basis.  (An insider could exploit an issue like this,  but that is a different question.)

Penetration testing to me is about using the Scientific Method to try and answer the simple question,  "In a real world scenario, what could a hacker do to harm my system or to my company?"  To answer this question you get a skilled hacker or team of hackers and purposefully debilitate them by not providing source code or access to the development team.   An ideal penetration test is a strictly blackbox testing scenario.  Just provide a company name,  or an IP address range or even physical address.  That is all the all the information an attacker should need. (The CISSP has a section of physical security for a reason.)

At the end of the penetration test you should receive a report with findings.  A good penetration test will always have findings.  There is no perfect system,  everyone can take steps to improve security.  From the results of penetration test you can identify weaknesses in your system and it can help you decide how to spend your resources to improve the security of your system as a whole.


Is it possible for a phone to be transmitting even while turned off and the battery removed? Is it technically or theoretically possible for any part of a mobile phone's circuitry to be still on and transmitting even while turned off and the battery has been removed? If so, how?

I am thinking perhaps it could remain in a low power state and certain chips and capacitors could hold their charge for a while. Is this plausible or no?

NB: this question is distinct and more specific than this question so it is not a duplicate.

If you have a phone with a removable main battery, you can try this:

Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode.

Make a note of the current time shown on the phone and on your PC by writing it down on paper.

Shut down the phone, remove the main battery and the SIM card. Now wait 5 minutes.

Put the main battery back in, but not the SIM card and then turn the phone on again. The phone should still be in flight mode.

Note the current time on the phone again and the current time from your PC.
Remember when in Flight Mode and without the SIM card, the phone cannot get a time update from the cell tower. If a phone just stored the current time in flash memory before shutting down, then on powering on the phone it would be 5 minutes behind and match the time you wrote down on paper. This is because it would not know how much time had elapsed from when the phone had shut off and when it was turned on again. However that is not what happened, it kept up with the current time even when shut off and the battery was removed. That is because of the second battery on the phone.

This HowStuffWorks article looks into the inside of a digital mobile phone. Quoting from the article: "As you can see in the picture above, the speaker is about the size of a dime and the microphone is no larger than the watch battery beside it. Speaking of the watch battery, this is used by the mobile phone's internal clock chip." This would be similar to the function of a CMOS battery in every PC/laptop. There is also a February 2010 patent mentioning a primary and secondary battery of different size and capacity: "The first battery may discharge during use of the mobile phone without simultaneous discharge of the second battery. Upon discharge of the first battery, the second battery may not be automatically activated."
A standard silver cell watch battery has a capacity of 200 mAh, a Zinc-air battery has a capacity of 620 mAh. From personal experience, my battery in my wristwatch has lasted for over a decade as it was just keeping the time, running alarms and the odd stopwatch. I am not certain which capacity the secondary battery is which is installed on most mobile phones but it could contain a newer, powerful one installed by the manufacturers. The design of mobile phones is typically a closed design. There is a new micro-battery that could fit in and power a credit-card-thin device and be charged 1,000 times faster than regular batteries. Therefore every time you charged your phone, it would charge the secondary battery as well.
When the phone is turned off and the main battery is removed, the secondary battery could do more than just keep track of the time. It is all connected to the same circuitry so it could leave certain chips powered on in a low power state, for example the GPS, the microphone, the camera, or the closed baseband processor on every mobile phone.
Now, hypothetically the secondary battery could be remotely activated and periodically do a burst transmission every x minutes and send GPS coordinates or microphone recordings back to your favourite 3 letter agency. If the chips were just passively transmitting, perhaps they need a StingRay or Reaper drone in the area to boost the signal. The cell tower itself may be powerful enough to pick up the signal.
This article states that the NSA can technically listen in to the microphone of an iPhone even if it is switched off. In Edward Snowden's conversations with Laura Poitras he advised her to put her mobile in the freezer. In Snowden's NBC interview he mentions "They can absolutely turn them on with the power turned off to the device". He even took out the main battery in his phone before a recent Wired interview. Removing the main battery may not be enough to avoid surveillance.
If I add a thick layer of tinfoil to my hat, perhaps everyone's mobile phones have been converted to an always on bugging and tracking device by NSA. They could have bugged every phone and home in the world whether their phones were turned on or not. You could get intel on anyone, anywhere. This could be why NSA does not allow mobile phones in their secure environments. It could activate every time it picks up speech then do a burst transmission at certain intervals. Maybe it only does that if you mention certain key words but maybe the phone does not have that capability with only the second battery running. Usually that analysis usually takes place in the basement of Fort Meade.
I would not be surprised in the slightest if there was a big black screen system with a map inside the NSA with coloured dots all over it. The green dots would be the people with their cellphones turned on and transmitting audio and GPS coordinates back to NSA. Then the orange dots would be people in "flight mode" or who have turned their phone "off", but their phone is still communicating with the tower. Then blinking orange dots for people who have turned their phone off and removed their SIM card, but their phone is still trackable by the unique IMEI on their device. Then red dots for people who have turned their phone off and removed the main battery. Highly suspicious behaviour obviously. A Reaper or StingRay would then be dispatched to the red dot's location.
How would you potentially stop surveillance from our mobile phone even with the battery removed?

Open the phone and remove the secondary battery. This may be difficult if the battery is hardwired to the circuitry and could damage the phone. This will definitely void the warranty as well.
Use a Faraday cage for when you want to go 'off the grid'. Some retailers are selling this as a small pouch or bag you can put your phone in. The effectiveness of this has not been tested.
Do not take your cellphone to places where you do not want to be found.
Destroy your cellphone and get a fully open source WiFi only device (if such a thing exists). Only turn on the WiFi when you want to connect to something. This means no closed source secondary operating system running the closed baseband processor, no GPS and no cell tower connection. You could connect out through various WiFi hotspots using a VPN or Mesh networks instead.

As Brill would say,
"The more technology you use, the easier it is for them to track you."


What is the origin of the three factors of authentication? The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the paradigm. Can anyone shed some light on this?

The origin of three-factor authentication paradig is unknown, but one thing is for certain: it predates mankind. Controversial? Let's see. Ask yourself, how does e.g. a father gorilla recognize a newborn cub as being one of his offspring, even if its mom is not around? By something it has - a smell of its mom. Something it knows - the distress call. Something it is - a newborn gorilla cub. So, we have a newborn gorilla cub that's calling in distress the way gorilla cubs do, and smells of its mom, the way she did when father gorilla mated with her. That's a three-form authentication, and as far as nature is concerned - it's good enough. Does it predate gorillas? Sure. Any animal species that exhibit certain amount of social responsibility, and/or their behavioral patterns dictate the need for such identification of its members would - by this necessity alone - have similar methods in place. Or such goes the Darwinian explanation.

But what about its etymology, the origins of this phrase as us humans use it? The answer is, that we don't know for sure who exactly coined this phrase first, or indeed when. The phrase describing this method of authentication was probably changed many times throughout history, but its modus operandi remained the same. One example of three-form authentication - that would be used in early days of our civilization - would have been in use with military couriers, or diplomatic envoys. Their messages would face authentication scrutiny that is sufficiently confirmed by a three-form authentication. Messengers would be required to know something (password), have something (a recognizable seal) and be something (e.g. a member of some tribe), before they would be allowed to deliver their message to its intended recipient. I believe it's relatively safe to assume, that we do have historical records of such authentication methods being used, that they were described by various names, and that we can not tell with any degree of certainty who could hold a claim to its first use.


How to add a custom CA to androids trusted root system folder As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA.

But this is difficult while testing for certificate pinning in a UAT environment. As a solution I wanted to add the custom CA certificate of my proxy tool (burp or ZAP) to androids system folder.

How to do this? To which folder the certificate needs to be copied? I am using an emulator. So is there a way to do this without rooting the emulator?

Ref: First answer of this question.

Magisk claims to do this.

  This module makes all installed user certificates part of the system certificate store, so that they will automatically be used when building the trust chain.


Is it ok to share relevant login information on an API's public endpoint? I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens.

Any request to the API needs an access token to the Authorization header. The API validates that this access token is signed by a specific tenant (e.g. google), is targeted to a specific audience, and has some specific scopes.

As a user/service, it would be really helpful if the API would expose, on a public endpoint, such information, so that I know from where I should fetch an access token from (e.g. through PKCE), and which scopes I need to request the token from.

A natural mechanism for this is for the API to have a public endpoint with something like

{
    "provider_uri": "https://accounts.google.com/.well-known/openid-configuration",
    "client_id":"...apps.googleusercontent.com",
    "scope":"openid ..."
}

Is this a valid approach? What other relevant idioms exist to address such problem?

Yes, it's a valid approach. The metadata is public information.

The implementation depends on the protocol(s) supported by your API. In case of OpenID Connect as the protocol, OpenID Connect Discovery specification talks about the metadata a service can publish to describe various aspects of its implementation. From OIDC Discovery spec:

  Once the OpenID Provider has been identified, the configuration
  information for that OP is retrieved from a well-known location as a
  JSON document, including its OAuth 2.0 endpoint locations. [...]

  The response is a set of Claims about the OpenID Provider's
  configuration, including all necessary endpoints and public key
  location information.


How secure are PHP sessions? Should i worry about securing PHP sessions for my users? How do hackers steal the sessions?

The information users of my site can view is not at all sensitive and if viewed or modified by a hacker wouldn't really harm users, but would inconvenience them.

Is storing and checking the IP really necessary? How useful is user agent checking? I assume it would be as easy as sending a user agent header.

The session is just a random generated token which is impractical to guess.

There are many scenarios in which stealing sessions are possible such as Cross Site Scripting (XSS) or by sniffing the traffic if the attacker has access to a networkin node between client and server.

To solve the XSS issue you need to not have validation issues. This means proper checking of user input and proper encoding if shown back to the user (output validation).

You MUST use SSL if you want to mitigate attackers sniffing your client's session tokens.

Checking IP is another layer of defence but might give issues when clients are roaming.

If the attacker can steal the session he can steal the user agent as well.


Metasploit: java_signed_applet attack hangs after user response I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at Medium on the victim.

On the attacker machine, I am utilizing the exploit/multi/browser/java_signed_applet module with the windows/meterpreter/reverse_tcp payload. I have SRVHOST and LHOST set to the IP of the attacker machine.

I left everything else as default. I get the security warning on the victim machine but once I accept the risk and click Run nothing happens, metasploit just hangs at "Sending SiteLoader.jar. Waiting for user to click..."

Any pointers is appreciated on how I could troubleshoot this further, thanks.

I'm not sure if this sounds dumb but have you tried clicking/running anything on the victim at the point where you are stuck?

If you have and nothing happens then this may be a bug in metasploit, you might wanna search around about it or report it to communication channels provided for bug reporting.


PCI-DSS Scope with tokenisation My organisation is now using tokenisation and we are no longer storing any credit card information.

I now think I may no longer need some of the following controls:- (there may be others although these are the main ones)
11.1 - Test for the presence of wireless access points and detect unauthorized wireless access points on a quarterly basis.
** No longer needed as Wifi is not allowed in my environment and the tokenisation server is in a DC**
11.2 -  Run internal and external network vulnerability scans at least quarterly......
** Looking at reducing my external PCI-DSS scanning costs and to just continue using external vulnerability assessment tools**
11.3 Perform external and internal penetration testing at least once a year.....
I would descope the PCI-DSS systems from the pen-test if required.  (Something that I would not do anyway)

What are your thoughts?  Can you greatly descope once you are using tokenisation?
- Wireless will not be connected the the card holder data environment.
- I will still need controls on the tokenisation system including the ones I mentioned above.
- If the tokenisation system is in my DMZ with other servers all that have a routable IP address, will this mean all those systems will fall under the CDE and will still need to be scanned as part of 11.2 and 11.3?

The QSA that works with out company is telling us that everything is still in scope for PCI-DSS.  He has recently added our email server into the CDE scope as employees send their personal or corporate credit card numbers via email when they order flowers or flights.  Thoughts?  The email server issue is something I'll fix via policy.

My friend who is a QSA said yes descope and you may no longer need some controls.  What exactly, I'm not sure at this point in time.

PCI says
"Tokenization solutions do not eliminate the need to maintain and validate PCI DSS
compliance, but they may simplify a merchant’s validation efforts by reducing the number of system components for which PCI DSS requirements apply"

"Tokenization systems and processes must be protected with strong security controls and
monitoring to ensure the continued effectiveness of those controls"

https://www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf

Thanks.

Wireless will not be connected the the card holder data environment

Well, that's what the scans are supposed to be determining, isn't it?

  If the tokenisation system is in my DMZ with other servers all that have a routable IP address

That doesn't sound like a good idea. Your DMZ is supposed to be a buffer zone between the outside world and your tokenisation system, which should be in a protected internal CDE network on its own.

  will this mean all those systems will fall under the CDE and will still need to be scanned as part of 11.2 and 11.3?

If there is no network boundary/control point between two machines, one of which is storing/processing/transmitted cardholder data, then both machines are in the CDE, yes.

  we need to consider our email server as employees send credit card numbers out when they order flowers or flights.

Please describe exactly what is happening here because this sounds highly problematic. If credit card numbers are going in the clear over e-mail that's contrary to every intent of PCI (and common sense), and if employees are accessing card numbers to send them from their desktops, you've just brought all your corporate desktops into scope too.

Or are you talking about employees using their own credit cards to buy things, independently of your operations as a merchant? If so that this is not your problem to worry about. (But still - card numbers over e-mail... what?!)


How to put the "trust" into trusted-timestamping As a part of my thesis, I am about to evaluate different approaches to establish the trust in trusted-timestamping performed by a TSA (see RFC3161 - Trusted Timestamp Protocol).
A trustworthy timestamping scheme must provide the following property, taken from the basic paper on this topic (found here):

  It is impossible to timestamp a document with a time and date different from the actual one.

What I want to figure out during my work is, under which assumptions it is plausible that the given statement holds.

I want to use these assumptions in the next step, to evaluate in how far an approach is suited to establish trust.

My question now is: Do you know a framework or approach I can use, to deduce the required assumptions from the given statement (or a more precise version of it)?

Here one example to clear things up a little more:
One approach going to be evaluated is posting timestamps in a blockchain. What I am looking for is a systematic approach to estimate whether this way of making timestamps immutable is trustworthy or not.

I'm assuming your thesis is done by now (hopefully), but for historical purposes and for future readers I'll still provide an answer.

Below is link to an academic paper on the topic of Bitcoin based timestamping noting the benefits and shortcomings.

Short version

Longer version

Paper Abstract:

  This paper examines the way in which blockchain technology can be used to improve the verification of integrity of evidence in digital forensics. Some background into digital forensic practices and blockchain technology are discussed to provide necessary context. A particular scalable method of verifying point-in-time existence of a piece of digital evidence, using the OpenTimestamps (OTS) service, is described, and tests are carried out to independently validate the claims made by the service. The results demonstrate that the OTS service is highly reliable with a zero false positive and false negative error rate for timestamp attestations, but that it is not suitable for time sensitive timestamping due to the variance of the accuracy of timestamps induced by block confirmation times in the Bitcoin blockchain.


The threat of video metadata There are various old questions on stack exchange which say that malicious code in file metadata can potentially be executed when the file is opened (here, here, and here for example). They are all from a few years ago however, is this still a valid threat with today's video players? If so, what steps can I take to make sure that my videos are safe to play?

Try heuristic scanning tools. It's basically putting it all in a sandbox and watch it do it's thing. IF you're adventurous an technically inclined, you also can scan it with forensics tools and get that data visible for inspection. I found a cool book in google books here. If that's too long winded, you could just turn off data execution on your box and any auto run features. This would give you the breathing room to scan the file before deployment and use. Now, let's say you're one of those really paranoid types. Well, get yourself virtualbox, configure a guest, slap on deepfreeze, secure it and tweek it.


Are there any reasonable TrueCrypt forks? Unfortunately, TrueCrypt may have been discontinued yesterday.

I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux.

TrueCrypt has its own license, but it was Open Source. Are you aware of any reasonable fork of TrueCrypt or any other portable alternative?

Goals:

encrypt portable USB disks and flash drives
mountable at least on Linux and Windows (MAC is a plus)
easy setup (no need to recompile tons of stuff)

The main obstacle of a TrueCrypt fork is the non-standard TrueCrypt license.

While the intention of the authors seemed to be to write a share-alike license similar in spirit to the GPL, the license has a few quite unorthodox passages which can be interpreted in a way which puts unreasonable conditions on a fork. These conditions prevented the Open Source Initiative from recognizing it as an open-source license. A fork of the TrueCrypt project might not be legally possible without the permission of the original TrueCrypt authors, who prefer to remain anonymous for now.

Nevertheless, there is a team in Switzerland which promised to continue working on TrueCrypt under the name TrueCryptNext.

Edit: Now there is the company Sirrix from Germany which wants to make a TrueCrypt fork called TrustedDisk. To get rid of the complicated TrueCrypt license, they plan to reimplement those parts with questionable license conditions and release the software dual-licensed under both an common open source license and a commercial version (German news story).


How to bypass restrictive mac address filtering on home network (not malicious) Background

A short sketch of my situation before I formulate my question: I am on a large home network, which is privately administered by a couple of admins. The network consists of a lan and a wireless lan, and controls access centrally by filtering mac addresses (and denying/allowing based on whether they allow that specific mac address).

I have two computers that I have registered and use (and pay for monthly) on this network, one wireless connection (laptop) and one cable connection (desktop). So I have two mac addresses that are allowed on the network, and are allowed access to the internet through the network.

The problem

The problem is that the wireless access is very unreliable, and is unusable for me. The admins of the network don't have a lot of time and are a little lax, so they won't help me with my wireless access problems, even after repeated complaints. They basically told me to fix it myself. Which leaves me with a connection that I'm paying for, but unable to use. I don't have control over the main routers, so I am kind of cut off from the internet on my laptop because of this, which is very frustrating.

My (partial) solution

Fortunately, the mac address filtering is rather simple. The wireless mac address that I've registered does not allow me to access the cable lan part of the network. So I have only one valid mac address (from the desktop) that is allowed on the cable lan part of the network.

What I have done is patch a small router (E-Tech RTVP03) to the main network, change it's mac address to the allowed (desktop) mac address, and patch my computer and laptop to the router. This sort of works (internet access works), but there are some problems that I wasn't able to fix:

The mac address of my router and desktop computer network card is now the same, which causes a lot of conflicts. I have tried to change the mac address of my network card, but that didn't help (or maybe the changing of the mac address didn't work, I'm not sure).
Because the router is between my computers and the rest of the network, I can no longer discover any other computers on the network. Which is a shame, because we share a lot of files on it. Could I change the settings so this becomes a possibility again?

My question

So basically, what I want the router to do, is be as transparent as possible, and only change the mac address information that is passed to the main network (to bypass the mac filtering), and to allow me to share one connection over two computers.

I still want to be able to share files with the main network, and all I want to do is to be able to connect both my computers to the cable network, and have full internet (and network) access with them (because after all, I'm paying for it).

Can anyone come up with a good solution for this?

All though I think this is not the correct way to solve your problem:

What I would do is get another networking card for your desktop and a router that is also wifi capable.

Get a box that's DD-wrt/open-wrt capable and change the MAC address to the one of your desktop or just get them to insert the MAC address of your router. After that you can just use your own router as WIFI AP and physical internet AP. No you won't be able to discover other devices.

I'm not sure how the auto discovery function works, but I think it will scan devices in the same subnet. Since you are behind another router this will not be case. What you can try is to directly connect to the ip of the fileserver.


Is it possible to brute force/pass the hash locally? If the nmap scan returns the result of common ports being filtered/blocked on windows 7 domain, is it still possible to pass the hash to the PC that I have physical access to, without having to connect through port 445?
Secondly, when doing a "live" brute force for example with hydra against a windows domain, do any ports actually have to be open if security policy allows infinite password attempts?
After seeing that most ports on domain are blocked, is brute forcing/sniffing passwords a good starting direction for penetration test or are there more reliable ways to get control of a domain?

Ok so you've got a lot going on with this question. Let's break it down a little bit:

If the nmap scan returns the result of common ports being
filtered/blocked on windows 7 domain, is it still possible to pass the
hash to the PC that I have physical access to, without having to
connect through port 445?

You can connect with SMB over TCP/139(legacy) or TCP/445. If nmap is showing that they are filtered, it means the port (read: destination) is accessible by your host but there is no service listening there.

Secondly, when doing a "live" brute force for example with hydra
against a windows domain, do any ports actually have to be open if
security policy allows infinite password attempts?

Hydra is protocol based. In other words the protocol you are attacking needs to be open. So if you are brute forcing RDP for example, then TCP/3389 needs to be open on the remote host. If it is running on a non-standard port, you can specify the port in Hydra with the -s <port> switch.

After seeing that most ports on domain are blocked, is brute
forcing/sniffing passwords a good starting direction for penetration
test or are there more reliable ways to get control of a domain?

This is a complicated question to answer as every environment is different, but typically password guessing attacks (against listening services obviously) can be an effective starting point -as a result of users notoriously having bad passwords. If you have internal network access: LLMNR/NBNS poisoning can be effective (if it's enabled in the environment -it's on by default) for capturing hashes for use in offline cracking or relaying (Google: Responder). SMB Relay attacks can also be effective if SMB Signing is disabled (again the default in Windows)(Google: SMBRelayX). Don't forget about password guessing on other services besides user accounts (e.g., SQL, Apache/Tomcat, etc.).
Happy Hacking


How do mobile carriers know video resolution over HTTPS connections? Verizon is modifying their "unlimited" data plans. Customers in the USA can stream video at 480p -or- pay to unlock higher resolutions (both 720p and +1080p). They are not the only mobile carrier to implement rules like this.

If I am on a site that implements HTTPS for video streaming, say YouTube or Facebook, how do carriers know what resolution I'm watching? If carriers are throttling bandwidth for all data, then talking about video resolutions seems like misdirection. If it's only video, that would seem to raise privacy concerns.

This is an active area of research. I happen to have done some work in this area, so I'll share what I can about the basic idea (this work was with industry partners and I can't share the secret details :) ).

The tl;dr is that it's often possible to identify an encrypted traffic stream as carrying video, and it's often possible to estimate its resolution - but it's complicated, and not always accurate. There are a lot of people working on ways to do this more consistently and more accurately.

Video traffic has some specific characteristics that can distinguish it from other kinds of traffic. Here I refer specifically to video on demand - not live streaming video. Video on demand doesn't often have those priority tags mentioned in this answer. Also I refer specifically to adaptive video, meaning that the video is divided into segments (each about 2-10 seconds long), and each segment of video is encoded at multiple quality levels (quality level meaning: long-term video bitrate, codec, and resolution). As you play the video, the quality level at which the next segment is downloaded depends on what data rate the application thinks your network can support. (That's the DASH protocol referred to in this answer.)

If your phone is playing a video, and you look at the (weighted moving average of) data rate of the traffic going to your phone over time, it might look something like this:

(this is captured from a YouTube session over Verizon. There's the moving average over 15 seconds and also short-term average.)

There are a few different parts to this session:

First, the video application (YouTube player) tries to fill the buffer up to the buffer capacity. During this time, it is pulling data at whatever rate the network can support. At this stage, it's basically indistinguishable from a large file download, unless you can infer that it's video traffic from the remote address (as mentioned in this answer).

Once the buffer is full, then you get "bursts" at sort-of-regular intervals. Suppose your buffer can hold 200 seconds of video. When the buffer has 200 seconds of video in it, the application stops downloading. Then after a segment of video has played back (say 5 seconds), there is room in the buffer again, so it'll download the next segment, then stop again. That's what causes this bursty pattern.

This pattern is very characteristic of video - traffic from other applications doesn't have this pattern - so a network service provider can pretty easily pick out flows that carry video traffic. In some cases, you might not ever observe this pattern - for example, if the video is so short that the entire thing is loaded into the buffer at once and then the client stops downloading. Under those circumstances, it's very difficult to distinguish video traffic from a file download (unless you can figure it out by remote address).

Anyway, once you have identified the flow as carrying video traffic - either by the remote address (not always possible, since major video providers use content distribution networks that are not exclusive to video) or by its traffic pattern (possible if the video session is long, much more difficult if it is so short that the whole video is loaded into the buffer all at once)...

Now, as Hector said, you can try to guess the resolution from the bitrate by looking at the size (in bytes) of each "burst" of data:

  From the size per duration you could make a reasonable estimate of the resolution - especially if you keep a rolling average.

But, this can be difficult. Take the YouTube session in my example:

Not all segments are the same duration - the duration of video requested at a time depends on several factors (the quality level, network status, what kind of device you are playing the video on, and others). So you can't necessarily look at a "burst" and say, "OK, this was X bytes representing 5 seconds of video, so I know the video data rate". Sometimes you can figure out the likely segment duration but other times it is tricky.
For a given video quality level and segment duration, different segments will have different sizes (depending on things like how much motion takes place in that part of the video).
Even for the same video resolution, the long-term data rate can vary - a 1080p video encoded with VP9 won't have the same long-term data rate as one encoded with H.264.
The video quality level changes according to perceived network quality (which is visible to the network service provider) and buffer status (which is not). So you can look at long-term data rates over 30 seconds, but it's possible that the actual video quality level changed several times over that 30 seconds.
During periods when the buffer is draining or filling as fast as possible (when you don't have those "bursts"), it's much harder to estimate what's going on in the video.
To complicate things even further: sometimes a video flow will be "striped" across multiple lower-layer flows. Sometimes part of the video will be retrieved from one address, and then it will switch to retrieving the video from a different address.

That graph of data rate I showed you just above? Here's what the video resolution was over that time interval:

Here, the color indicates the video resolution. So... you can sort of estimate what's going on just from the traffic patterns. But it's a difficult problem! There are other markers in the traffic that you can look at. I can't say definitively how any one service provider is doing it. But at least as far as the academic state-of-the-art goes, there isn't any way to do this with perfect accuracy, all of the time (unless you have the cooperation of the video providers...)

If you're interested in learning more about the techniques used for this kind of problem, there's a lot of academic literature out there - see for example BUFFEST: Predicting Buffer Conditions and Real-time Requirements of HTTP(S) Adaptive Streaming Clients as a starting point. (Not my paper - just one I happen to have read recently.)


PBKDF2 doesn't seem to have a standardised implementation? I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords:

https://www.djangoproject.com/weblog/2013/sep/15/security/

This is because PBKDF2 "mixes" in the input password with each iteration, therefore amplifying the effect of a large input.
Django originally solved this by setting a password character limit of 4096 bytes.

I tried to replicate this in Go, only to find that their implementation isn't vulnerable. This is because they HMAC the input password before performing the iteration loops, hence the iterations are always on a constant size input. Here's the source in question:

https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.go

I then found that the Django "fix" which set a maximum input size was reversed, and they instead fixed it by implementing a similar solution to Go:

https://github.com/django/django/commit/68540fe4df44492571bc610a0a043d3d02b3d320

This is baffling to me. Does the PBKDF2 spec say that it's supposed to be HMACed first? As far as I can tell, it doesn't. Does that mean that the Go and current Django implementations are non-compliant to the spec? Was the previous Django implementation more correct, but they've modified PBKDF2 to fix the DoS issue?

The OpenBSD implementation doesn't seem to perform the initial HMAC either:
http://bxr.su/OpenBSD/lib/libutil/pkcs5_pbkdf2.c

But the PHP implementation does:
https://github.com/php/php-src/blob/1c295d4a9ac78fcc2f77d6695987598bb7abcb83/ext/hash/hash.c#L600-L723

Why does there seem to be no standardization in this regard? Which is the "correct" implementation?

PS: I found this discussion regarding it, which came to the conclusion that PBKDF2 is not meant to be HMACed first, and that a "user friendly" wrapper should perform the HMAC before handing to the PBKDF2 algo: https://github.com/defuse/php-encryption/issues/230

That makes sense to me based on my reading of the RFC. Is that correct?

Saying that the Golang implementation computes the HMAC of the input password before performing the iteration loop, therefore making PBKDF2 non-standard compliant, is not fully accurate.

The Golang implementation of PBKDF2 is fully standard compliant and interoperable.

First note that - strictly speaking - PBKDF2 requires a PRF (Pseudo Random Function). The PBKDF2 in the Golang crypto library is limited in that it only works if the PRF is implemented as an HMAC (which is fine, since everybody does that in practice).

Having said that, assuming the PRF is an HMAC, the inner and most time consuming loop of PBKDF2 does this:

U_1 = HMAC(password, S || INT (i)) ,
U_2 = HMAC(password, U_1) ,
...
U_c = HMAC(password, U_{c-1}) .

where c is a very high number and all U_x items are short and matching in length the output of the underlying hash function, such as 32 bytes for SHA-256.

For very long passwords, HMAC is actually a composition that looks like this:

Kp = SHA-256(password)
HMAC(password, data) = SHA-256(Kp xor constant1 || SHA-256(Kp  xor constant2 || data))

You may notice that a naive implementation could compute the very same Kp = SHA-256(password) value for every iteration of the PBKDF2 loop (so, c times), with a cost that grows linearly with the length of the password, and that may lead to a DoS if an attacker is free to pick any password (as it happened with Django).

Most implementations (such as Golang's) are more careful and cache the intermediate computation of the SHA-256 function up until data, which is the only value that changes from iteration to iteration, that is:

HMAC(password, data) = SHA-256(Kp xor constant1 || SHA-256(Kp  xor constant2 || data))
                       ^^^^^^^^^^^^^^^^^^^^^^^^    ^^^^^^^^^^^^^^^^^^^^^^^^^
                                         CACHED ACROSS ITERATIONS

In such optimized implementations, every iteration consists of completing the HMAC starting from the cached value by feeding the small data component. The cost of the algorithm is now almost fixed and independent of the password length (apart from the step required to create the cached state).

Conclusion: the Golang implementation of PBKDF2 is fully standard compliant and interoperable, although it only works for the case where the PRF is an HMAC. The implementation is secure against DoS attacks because it precomputes the intermediate HMAC state which is always the same for all iterations, including a contribution from the secret password. However, that is not an HMAC of the password, and it is just an optimization of the standard algorithm.


Block Outbound Connections by Country We want to reduce the number of phishing sites that our users can get to.  Would it be useful or more problematic to block outbound connections by geo IP?  We already block many inbound connections by country. I know it won't block all phishing sites.

I worked in a company that considered this. Here's the problem: if any of your employees have any legitimate need to access sites from those countries; news from home, travel to those countries, etc, then you block that legitimate access, too.

If you look at the "usual suspects" and name Russia and China as common phishing site hosting locations, then by making a corporate decision to block any internet traffic to those countries, you set up a prejudicial environment in your workplace at a corporate level about the people from those countries. Please consult your HR department before considering implementing this.

There are lots of other ways to block phishing sites and if you consider the human effects, those other ways tend to have less tangential impact.


What does "This request does not comply with Chrome's Certificate Transparency policy." in Chrome's Security Tab mean? When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://de.ioam.de when you visit https://www.sportschau.de/index.html)

I know the concept of Certificate Transparency in general but I neither know what Chrome's Certificate Transparency policy is nor do I know what the impact of this statement is.

Obviously Chrome establishes the https connection to this host, but what's wrong here?

Will https connections to affected origins be blocked in the future?

Chrome's Certificate Transparency policy describes the number of distinct Google and non-Google logs that the certificate must have been logged to at the time it was issued. Certs with longer lifetimes must be logged to more logs in order to be trusted by Chrome. This is a relatively new enforcement (April 2018) so it only applies to certs issued since that date.

The cert for the domain in question was issued 22-Dec-2017 so Chrome still makes an https connection to the affected origin today. When that cert expires 21-Dec-2020 if the new cert also does not comply with Chrome's CT policy then it will not be trusted.


Where in a TLS connection can I get the signature of the content sent by the server? I want to be able to prove that a given content returned by a HTTPS server was in fact served.

I have looked over the whole TLS protocol and I found I can use ServerKeyExchange to get the server's signature of a random string that I can send to the server, in order to start the Diffie-Hellman exchange.

However, I haven't found the way for me to get the server's signature of the content it's serving.

Is there any way to do so?

In TLS, neither the client nor server signs any content. The cryptographic signatures that are used in the initial handshake are meant for authentication: the client obtains some guarantee that it talks to the right server, and (if client certificates are used) the server obtains some guarantee that it talks to the right client. However, neither of these guarantees is transferrable: though the client knows that the data it gets comes from the server, the client gets no proof that could be shown to a third party. That's authentication, not non-repudiation.

Even if the client records everything pertaining to the whole connection (all data bytes sent and received, all the negotiated cryptographic keys, and so on), this proves only one thing: that, at some unspecified point in time, the server was, indeed, a TLS server, and has been involved in at least one TLS connection. Everything else, including all the data puportedly received and sent by the server, could have been fabricated afterwards, so it cannot be a proof (in the cryptographic sense).

Thus, you haven't found a way to "get the server's signature of the content it is serving" for the reason that this signature does not exist. If you want the server to sign things, this must be arranged at the protocol level, inside the TLS tunnel: have the server duly sign the data and send the signature as part of what TLS calls "application data". Of course the server will have to be aware of the operation, and this is not part as normal TLS (HTTPS) processing.

Alternatively, have some bailiff or a similar official connect to the server, obtain the data, and sign it himself, thereby guaranteeing (in a legal way) that the server indeed serves these data content.


Firefox redirecting to other webpages and Adobe Flash Player plugin update button redirects to other webpage (not the adobe offical page) When I try to update the Adobe Flash Player plugin for Firefox by clicking on the button for updating the plugin, it redirects to itsmyviews.com. In addition, when I visit the any site, my browser transfers data from nexac.com, itsmyviews.com and many other sites which I can not read because they are changing quickly. It also attempts to connect to bh.contextweb.com, s7.addthis.com and many other sites. When I visit the any webpage an advertisement covers the whole windows when I try to close that ad then that tab of the browser automatically disappear.
Screen Shot of my PC.
https://i.stack.imgur.com/K3EPe.png

Have you tried updating flash via adobe flash update application(not firefox) Link: https://get.adobe.com/flashplayer/otherversions/ as for the redirect issues try creating a new user profile sounds like u got some malware https://addons.mozilla.org/en-us/firefox/addon/profileswitcher/

If making a new user profile does not work i suggest installing anti-malware bytes if your running windows and running a scan.

Hope this solves your issue.


Public API security: authentication vs. rate limiting etc We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around it. These include web apps (sites) facing the general public, a web-based CMS and an iOS app for sales staff. Our clients can either use these or build their own apps to talk to our API.

There has been a long debate between us as to how the API should be secured. It does have authentication (both API key/secret for apps and username/password for users) and role/permission based authorization. At the moment, no useful response can be obtained from the API (apart from its version) unless the requester authenticates itself. This includes endpoints returning data that is available to the general public such as the list of items for sale.

The moot point is whether the API should require authentication for what is essentially public data.

The arguments for authentication:

We can't just keep the API open to whoever wants to call it — even if they can obtain the info anyway by exploiting the public web apps. An open API can be abused or load attacked. Better to control who has access by issuing keys/secrets per client app which will be the first line of defence.

The arguments against authentication:

There is no point in restricting access to what is made available publicly anyway (via public facing web apps that have key/secret with the "public" role built in them);
Making authentication required does not add value and only creates unnecessary overhead by requiring the public apps implement auth clients, keep keys/secrets and refresh auth tokens. The apps should only authenticate against the API when a user needs to log in (which some clients simply do not need as they use guest checkout);
Any concerns of abuse (e.g. exceeding the requests rate limit, load attacks etc.) should be addressed by DDoS protection layer, or the API internally, or both. Authentication is not the right protection from this because a malicious client could obtain app credentials and create troubles to the API anyway, let alone that the rate of auth attempts needs to be limited as well.

Is any of the two positions above horribly wrong or would be laughed at if presented on the market of serious APIs? Is there a right approach here, or are the both approaches sensible in terms of security and could be chosen based on other considerations like convenience/ease to implement?

Is any of the two positions above horribly wrong or would be laughed at if presented on the market of serious APIs?

Considering the data that is returned from the API is public information I do not really see why authentication is required, assuming your statement "The moot point is whether the API should require authentication for what is essentially public data." is correct. (The essentially part in that sentence makes me wonder though)

The statement:

  'We can't just keep the API open to whoever wants to call it'

is incomplete as it does not describe why. Why can't it be open to anyone? What are you afraid of?

Rate limiting should be implemented obviously and the statement that it should be addressed by the DDoS protection layer in insufficient because you should use the defense in depth approach.

This means that you embed protection in every possible layer (within reason).

  An open API can be abused or load attacked.

An example would be to configure the web server that is serving the API with rate limiting as well and not solely rely on the DDoS protection.

  Is there a right approach here, or are the both approaches sensible in terms of security and could be chosen based on other considerations like convenience/ease to implement?

Yes, they both are sensible and a cost / benefit approach can be applied here. How much are you willing to invest in order to protect public data?


Is a router a better device for a IoT botnet than something in the router's network? As some of you maybe noticed, there was a attack this weekand against routers of the german provider Telekom an their routers "W723 Typ B" and "W921".

According to the news here in Germany, they wanted to use a known exploit of the remote maintenance interface port 7547 and a slightley changed version of "Mirai" to capture the routers for their botnet, but most of the attacks failed.

I fell like 900,000 captured routers would have been a really powerful botnet but I'm not an expert. I'm curious to know if routers are the best IoT devices for a botnet or are there any better devices? Is a router able to send more packages per second than the average IoT device and lead to a more effective ddos attack?

When you're talking about DDoS attacks utilizing botnets on this scale, the attacker may actually benefit from actually not having each infected device send out lots of traffic. With a botnet the size of Mirai, you could have each device contribute a small enough amount of the attack traffic to remain undetected and still end up with enough bandwidth hitting the target to bring it down. The objective in this case is no longer necessarily to find the most powerful devices to add to your botnet, but a rather large number of devices with default passwords that are easily compromised, which could be something as simple as a webcam or other connected IoT device.


Why is my Positive SSL certificate deemed insecure by Google Chrome? We run a website over HTTPS with a wildcard certificate from Positive SSL.

Today, when I opened Google Chrome (v. 42.0.2311.90 m) and navigated to the site, I noticed a red cross through the https part of the URL in the address bar. When I click on it, I get this:

Can anyone explain what is going on here? Should I get a new certificate from another issuer?

Google blogged about flagging Certificates using SHA-1 here -> Gradually sunsetting SHA-1

There's no reason to get a new certificate yet as Chrome won't be actually blocking the certificate just treated as “secure, but with minor errors”, I believe that some issuers are offering to reissue certificate but as always, YMMV.


Websocket implication for firewalls (I've read several questions here about websocket but apparently there's no websocket tag)

If I understand correctly websockets are using TCP trafic over port 80.

What are the implication, if any, for rigorous firewalling rules?  For example if I have a firewall only accepting related and established trafic and incoming "TCP packet with state NEW" (the others being taken care of by the related and established packets), will that still allow websocket trafic through?

Also, is websocket trafic part of the already established trafic when a user connects to a website?

Note that this is not a question about iptables and the following example should simply serve to illustrate my above purpose.  Say I have something like this:

a) iptables -I INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
b) iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
c) iptables -I OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

by which rules would websocket be matched?  Only b) and c) or would websocket create initiate it's own TCP connection? (from the client?)

Basically I think my question boils down to: are the any specific firewall settings that needs to be done to allow websockets?

Also, should a major websocket security issue be discovered or should a website decide to not use websocket, can this be blocked at the firewall level?

From what I know of the WebSockets protocol whilst it allows two way message passing, at a TCP level the connection is initiated by the client and as such the most firewall configurations (e.g. those which allow standard web browsing) will allow WebSockets communication without further configuration.  Indeed looking at the Wikipedia Article, this is touted as one of the benefits of the protocol.

The flip side of this is that blocking it wouldn't be possible if the firewall only works at an IP address/ TCP port level, it would need to understand more of the semantics of the protocol to understand when it was being used.  Also if blocking Websockets connections over SSL is needed then the proxying device would need to be able to intercept and decrypt the SSL connection.


rsa encrypted hash == rsa signature $ echo -n "1327943823" > test_ok.txt
$ openssl dgst -sha1 -binary -out test_ok.sha1 test_ok.txt

$ echo "GURbsl4CFPCG83RCZxsEpoRleXicXQhH1OC4Fk77b7EMj2g8aHUhD/L+sm
oGSVpuEwup1fmkZBADXwBel8UKsmxgTLRX+vlGgyTr1XPqqHFNjtL33fd5
7NuKBqaJjwSp7D5xVMeVdQtQQbsKuKx5AvOPPyZfdtdyoJw/all1tl4=" > test_ok.sig.64
$ base64 -D -i test_ok.sig.64 -o test_ok.sig

$ openssl rsautl -verify -inkey test.pub -pkcs -pubin -in test_ok.sig -out
test_ok.sha1.calc

$ hexdump test_ok.sha1
0000000 08 a8 55 9c d4 43 f9 cb ec 9f 04 f4 f2 dc aa 1f
0000010 7f e9 e1 11
0000014

$ hexdump test_ok.sha1.calc
0000000 30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 08
0000010 a8 55 9c d4 43 f9 cb ec 9f 04 f4 f2 dc aa 1f 7f
0000020 e9 e1 11
0000023

test_ok.sha1.calc is an ASN.1 encoded object containing an sha1 hash matching that of test_ok.sha1.

That's all fine and great but...

$ openssl dgst -sha1 -verify test.pub -signature test_ok.sig test_ok.txt

That one matches too.

My question is...  how often are the encrypted hash and the signature going to match?

RSA signatures work like that:

To sign, the signer hashes the input messages, then puts the hash value into an ASN.1 structure (i.e. adds a fixed header to the hash value). The resulting sequence of bytes is then padded (padding details are in the RSA standard) so that the total length matches that of the RSA modulus (an element of the public key). The padded structure is then interpreted as a big integer, with big-endian convention, and the modular exponentiation of RSA is applied, with the private exponent. The result is the signature.
To verify, the verifier applies the modular exponentiation of RSA with the public exponent, which undoes the last step of the signature generation. If this yields a properly padded ASN.1 structure, and the hash value contained within that structure matches that of the input message, then the verifier declares himself content with it.

We shall note that RSA is a signature algorithm with recovery: when verifying the signature, the verifier not only obtains a boolean result ("valid" or "not valid") but also recovers the hash of the input message itself.


What are PHP allow_url_fopen security risk? Recently I was reading an article about file_get_contents and HTTPS.

One part that caught my attention is:

  Of course, the allow_url_fopen setting also carries a separate risk of
  enabling Remote File Execution, Access Control Bypass or Information
  Disclosure attacks. If an attacker can inject a remote URI of their
  choosing into a file function they could manipulate an application
  into executing, storing or displaying the fetched file including those
  from any untrusted remote source. It’s also worth bearing in mind that
  such file fetches would originate from localhost and thus be capable
  of bypassing access controls based on local server restrictions. As
  such, while allow_url_fopen is enabled by default, you should disable
  it without hesitation to maximise security.

I have 2 questions:

What can an attacker do with allow_url_fopen and how he would do it?
Is allow_url_fopen always a security risk or only when you accept user input in fopen wrapper?

Other interesting links

allow_url_fopen in PHP manual
allow_url_fopen on phpsec.org
PHP attack string in access logs
what to do after suspected intrusion on hobby webserver

A sample attack scenario using allow_url_fopen that allows me to download your password file:

Suppose your app allows me to provide a URL to a remote image, which you will download and use as my avatar image.
I provide the following URL: "http://my.malicious.example.com/sbwoodside.jpg;cp%20/etc/passwd%20downloads/foo.jpg;"
Your app uses allow_url_fopen to download the file and stores it as "sbwoodside.jpg;cp%20/etc/passwd%20downloads/passwords.txt;". I have now successfully injected a command into the filename.
Your app wants to compress and resize my image, so you use ImageMagick on the command line with something like exec("magick convert -size 128x128 ".$filename." ".$filename.".128.jpg")
What does exec actually execute? If you haven't sanitized the filename, then it executes the following on the shell:

magick convert -size 128x128 sbwoodside.jpg;cp /etc/passwd downloads/passwords.txt; sbwoodside.jpg;cp /etc/passwd downloads/passwords.txt;.128.jpg

Since ; is a command delimited on the shell, that will be broken by the shell automatically into the following separate commands:

magick convert -size 128x128 sbwoodside.jpg
cp /etc/passwd downloads/passwords.txt
sbwoodside.jpg
cp /etc/passwd downloads/passwords.txt
.128.jpg

And now I just go to http://yourapp.com/downloads/passwords.txt and download your password file. Of course, I can do anything I want, since I'm executing commands as your web server on your system.


How is TSC (TKIP sequence counter) calculated, in WPA? I'm reading about 802.11, from IEEE's PDF, from page  1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images:

How, and from what, is the TSC calculated?

TSC is just a counter used for anti-replay mechanism and it increases by 1 for every MPDU. Thus, its value depends on the sequence of the MPDU. I am not quite certain about its initial value but i suppose it depends on the implementation as usually.


Should I take care when entering incorrect passwords in untrustworthy websites? I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for not so important services. The problem comes when I forget the password of something that I do not recall how important that was for me.

If I entered all my four passwords (from weakest to strongest) in that website, and I still did not get access, how worried should I be that a website stores all my failed attempts and uses those passwords against me somehow? Is this a serious security concern for me?

I have the problem that I usually use 4 passwords that I use quite often.

All of your other trouble stems from this. If you're concerned about security (and you should be) then stop it.

  Is this a serious security concern for me?

Most definitely YES.

Whether this particular site discloses your information or whether one of your "important" sites gets hacked, this technique of yours can seriously bite you. Hackers expect you to re-use passwords on other sites, so they will definitely be looking for this behavior and definitely will try to exploit it. Your plan of having one password for "important" sites and one for "unimportant" sites is also common, so hackers will expect this as well.

You need to use different, unique passwords for all the sites you care about. One password used at paypal and nowhere else, one for each email account and nowhere else, etc.

I'd strongly recommend using a tool like KeePass or LastPass. Both rely on client-side encryption, so no secrets are ever visible to any third party.


Isn't HTTPS insecure over a hacked router? I have heard that a hacker can become a proxy using the router your device is connected to and send his own public key to you instead of you getting the server's public key - which the browser will verify with third parties and they will say this certificate doesn't match the domain, and an SSL error icon will show.

However, what if the hacker also created fake third parties for all certificate authorities and confirmed for your device that yup this is the correct certificate for the domain?

Browsers do not accept verification from just any third party; if they did the whole exercise would indeed be pointless. In order to be accepted as valid, the certificate presented by the website must be digitally signed by a trusted certificate authority. The default list of trusted certificate authorities, which you can see in Chrome by going to Settings->Advanced->HTTPS/SSL->Manage Certificates->Trusted Root Certification Authorities, is limited. Getting on this list requires going through an extensive vetting process with browser/OS developers.

Additionally, there is no need for the browser to ever send a request to the certificate authority to verify the certificate. The browser already possesses the public keys of those trusted authorities (in Windows just click View->Details to see it), and a public key is all you need to prove that a certain entity signed a message (which in this case is a certificate). Read up on how digital signatures work if you want to understand the logic behind this. Just like a signature on paper, a digital signature allows you to confirm that an entity has approved of something without actually having to contact that entity.


Has my Google account been compromised? I received this email from Google (translated from my native language):

  We have got the request to access to your Google account using email address. Your code is XXXXXX.

Does it mean that somebody already has my password and all that he needs is second factor (code)?

It can be two possibilities:

Someone tried to create a new account and enable the 2 Factor Authentication but he enter the wrong phone number. So you receive the sms.
Someone have your password and tried to log in to your account but thanks to your 2 Factor Authentication he can't.

You can try to put your email address here to know if your email address is in public leak.

If you still receive these sms in a few days, you could change your password and security questions to be sure.


What is this authentication method/approach called? Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even figure out the right search terms.

As seen on my bank account:

When I registered, I was asked to pick a phrase that I would remember
Now, when I log onto my website, the process is as follows:

I enter my Username and click "next".
The bank site shows me this phrase.  This helps me to be assured that I am actually on my bank's site, and not some fake site set up to steal my login credentials.
If the pass-phrase matches, I enter my password to complete the authentication process.
If the pass-phrase doesn't match, I know that either I entered my username wrong or I'm on a phishing site, and I go back to my bank's home page and start over.

In my mind, this sounds like "multi-step authentication".  However, when I search for that, I keep getting results for multi-factor authentication - authentication using a token, or two-step authentication as implemented by Google and other sites.  While I'm a HUGE proponent of multi-factor authentication using tokens or codes sent to your mobile device, I also want to figure out how to do what my bank is doing.

Is there a name or term for this authentication pattern?

SiteKey is the feature name that many banks call it and should be able to be searched for under that name.  It adds minimal if any security.  Anything that your server can present to the user, a man in the middle can act as if they were the client and get the same information.  SiteKey (which is likely what your bank calls it) is not secure and doesn't add meaningful security.

It can actually be harmful as it may give users a false sense of security and make them ignore otherwise good indicators such as SSL indicators because the "secure" image or phrase is there.  My general recommendation is do not use such flawed mechanisms as they can do more harm than good.