Blocking all incoming traffic, will it still accept a response from a request I initiated? I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this I mean, I only want my severs to be able to initiate contact with Facebook servers and get the response back from them, not vice versa (I do not want any Facebook servers to be able to initiate contact with me due to IP spoofing attacks/DDoS concerns).

My initial thought was to allow all outgoing traffic to Facebook server (use a whoami command to get a list of IP addresses), but block ALL incoming internet traffic. If I have this configuration and I send a REST request to Facebook, will the response be blocked even though I initiated the contact? The main question I am trying to answer is: if I block ALL incoming network traffic, does this include responses from a request I initiated?

Stateful firewalls are mindful of incoming connections that are part of a circuit that was previously established. iptables can certainly do this.

The short answer is that you need a firewall rule that blocks all new incoming connections, but allows established incoming connections.


Torrented files under my IP address Last year (2018) I was accused of torrenting Files whilst in my residence in Germany. I have never torrented any file ever. One thing that stands out is that during the same day CyberGhost (the VPN [paid license] provider I use) installed a plug-in in my computer approximately 5 hours before the time and place I am accused of the torrented files. Is it possible that this Plug-in used my IP address, or hacked into my personal information and an anonymous user committed the crime? I am now forced to pay a fine of 1000+ EUR or go to court. Can someone help me out here and provide me with sources/feedback to articles regarding this possibility? Any help is really appreciated because I do not dispose of the money to pay a fine for a crime I did not commit. Thank you all.

I encountered similar situations.

P2P itself is not illegal. German law considers that sharing content protected by copyright is illegal. You can share non-protected content, like let's say an .iso image of a public Linux distribution. Simply using P2P does not violate anything.
If they can prove that you did download copyright protected files, then yes, fines are possible, but not that easy. German courts have stated that the owner of the internet access is in theory responsible for any wrong-doings happening on that network and that it is their duty to secure them.
An IP address does not represent a person. Legally, an accusation based on IP-only does not stand. That IP can be hijacked by malware or another person can be behind the terminal using it when the offense is done.
The notice you got can be considered blackmail. I put it under blackmail because the letter is sent by law firms (that hire specialized third-party services that are scanning P2P nodes and clients, recording IP adresses that are currently downloading illegally in Germany, after which they are authorized by law to ask your internet provider to disclose any information linked to that IP adress), which in turn are hired by companies owning the copyrighted items. So it's a 3rd party involved. Basically, the letter is a warning to let you know that this 3rd party entity knows what you did and if you do not want to go to court you should pay a fine.
Given (4), such a case would rarely reach a court because of (3) and other aspects.

Conclusion: Ignoring it would be the recommended choice is this situation. You'll probably never hear from them again, unless you repeat the offense, in which case they will dig more into the matter and they could gather more evidence than (3), which will make the basics for a possible legal case. If you also received a document named "Unterlassungserklärung" you should not sign it as doing that would be an admission of guilt, which would give them a lot more legal ground to pursue things further.


When does one require NetBIOS? I've heard others talk of disabling NetBIOS, but over the years I have never understood exactly when this protocol is required. The wikipedia page explains very abstractly what it is, but not which products rely on it. I'd love to disable any services I have no use for.

This blog post does a pretty good job at explaining what requires NetBIOS. It includes a few examples of programs that need it as well.

To summarize, every machine with NetBIOS will broadcast its name, IP, and any services every 60 seconds. If there is a WINS server configured they will register with the WINS server instead and the network will be much quieter, but EVERY machine needs to be configured with WINS, the ones that aren't configured will continue broadcasting every minute.

NetBIOS is needed to join a domain and there are quite a few legacy apps that were designed around it and therefor need NetBIOS to function properly. Here is a short list taken directly from the above blog post link.

Exchange 2003 with certain Outlook features
McAfee Enterprise ePolicy Orchestrator
Symantec Endpoint Protection
Symantec Backup Exec
Computer Associates AV
SQL
Mapped Drives
Printer sharing (not published in AD)

Full credit for this information should go to the author of the referenced blog post Ace Fekay


Risks associated with IP whitelisting I was told that IP whitelisting should not be considered safe and are hence obsolete.
I fail to understand why this statement holds: can IPs be impersonated? if not, then why is it a bad/obsolete way of securing a service? (assuming the traffic can't be sniffed)

As with many/most/all things in security, this will depend on the threat model of the service(s) you're looking to protect.
The downside of IP address whitelisting as a single control is that it assumes that you can trust all the traffic that comes from the white listed addresses, which is often not a great assumption to make, especially on larger networks. On a smaller network where you control all the endpoints though, it might be a reasonable control to use.
Also, it's often not a bad control layer to use as part of an overall security plan. For example white-listing on the Internet, where you're only expecting traffic from a small number of source IP addresses, can cut a load of noise and random attacks off from targeting your service.
To provide one example of why you may not want to rely solely on white-listing. Imagine a scenario where you white-list a network for access to a service, and then within the white-listed network, someone starts a proxy server. Now untrusted users can use that proxy server to access your service.


Why are many Security sites not using HTTPS? I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a  noob at cybersecurity so I'm not knowledgeable about such details.

Why are security companies that specialize in cybersecurity using the less secured HTTP instead of HTTPS? Is this a big issue to be concerned about, and what does it say about the "quality" of those companies?

In this day and age, plain HTTP should not be used at all. Period.

This may be a radical standpoint, but all the reasons that have been stated over the years just don't matter anymore. There is just no good reason to not use HTTPS.

  I don't do anything confidential, so my site doesn't need HTTPS.

Any attacker with Man-in-the-Middle capabilities can modify your site to include malicious code. Not using HTTPS endangers your end users.

  HTTPS has such high overhead. My servers would fry!

No, this is an urban myth. The site "Is TLS fast yet?" dismantles this myth in detail. The overhead required for TLS is negligible.

And just on a side note: The performance impact for your users is magnitudes higher when you decide to include jQuery to add a class to a <div> as if you were to enable TLS.

  But certificates are expensive! I'm just a private person doing a personal homepage!

Certificates are absolutely free from Let's Encrypt.

  It's so difficult. There's like private keys and certificates and all those things and I'm confused.

Certbot automatically generates keys, certificate signing requests, takes care of validation and your server configuration.

All you have to do is type the following:

sudo certbot --apache

And if you use apache, Certbot has now successfully added your certificate.

But why do big companies still not use HTTPS if it's so easy?

Because some companies still firmly believe in these myths. Aside from that, their infrastructure may depend on ancient hardware, back then when computers were mechanical and debugging meant pulling literal insects out of the relays. Okay, maybe not that ancient, but still pretty old.

Lots of that older software doesn't work well with modern cryptography. While technically it may be possible to solve this, the budgets of IT teams, both in terms of time and money, is limited. And if they have to choose between investing the time to get HTTPS running on their website, or setting up an internal web application that the vast majority of employees desperately need, their priorities may be elsewhere.


Can programs replicate hidden versions of themselves? I'm currently studying malware techniques of replication to gather information for coding an antivirus. Could a malware (if run) create a duplicate of itself in the startup directory with the hidden file attribute therefor making it harder to detect by users, and if so how would they achieve this in code?

Yes, with appropriate vulnerability and privilege, a malware that attempts to hide itself from detection even by security programs is called a rootkit.

They can do this by modifying the operating system itself or sometimes the firmware in the hardware, so that the OS and hardware lies to the user and other programs. For example, a rootkit may replace the code in the kernel that returns directory listing to exclude its files.

Generally, a rootkit would have to somehow obtain administrator privilege first to install themselves deeply enough to become undetectable, usually through other vulnerabilities or by tricking the user into running it with administrator privilege.

Malware that runs at this level of stealth are very rare though, as they're difficult to write and most malware are successful enough even when they're not that stealthy.


Getting subscribers on website from nowhere? I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about 100 to over 1200 which seems a bit odd to me.

The website in question is an e-commerce site selling vegetable and fruit seeds I coded from scratch, and since it's not really the season to buy seeds at the moment I thought it's quite unusual that I'm getting all these subscribers. At first I thought there might have been some error and the website maybe recorded someone's email a thousand times, but I checked and everything seems ok, no duplicate email addresses at all.

Furthermore, google analytics tell me that at the moment I'm getting 10-20 users on the website per day, but subscriber count goes up by 20-30 a day which is really odd to me.

My question is how am I getting all these emails? Is there some kind of bot that would insert email addresses as subscribers on websites, and if there is, why would it do that?

This doesn't sound like a natural influx of customer. Something fishy is probably going on.

I would guess that this is a bot. So why would a bot sign up for your newsletter? It is probably looking for bulletin boards or comment fields or anything where it can post spam. Since bots can be quite dumb, it doesn't understand that it is just a newsletter it is signing up for, and that there will be nowhere to post spam after signup. I would not be surprised if this kind of bots operate on the principle "try everything, and hope that something works".

Another less likely explanation is that someone (perhaps your competitions) is trying to get your newsletter blocked as spam. If they sign up random people who do not want it, some of them will flag it as spam which could lead some spam filters to block your email adress. But for a newsletter about seeds with 100 subscribers this sounds a bit far fetched, and just a tiny bit paranoid and conspiratorial.

If you want to stop this behavior, I see two possibilities:

Add a CAPTCHA (will stop bots).
Have users verify that they do want to sign up by sending them a link to click in an email (will stop peopble from signing up others).

Both of these will make it a tiny bit more complicating to sign up for your newsletter, so you will have to weigh the pros and the cons yourself to determine if it is worth it.


use custom 'key' for hardware security keys Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (especially in cases when just adding multiple hardware keys is not desired or an option).
I'm currently using an open source hardware device from SoloKeys (https://solokeys.com/). This device also allows interaction via a commandline application (https://github.com/solokeys/solo-python) which would give the possibility to generate a custom digital key to be used on that device (that idea is also used for the DiceKeys, see https://www.crowdsupply.com/dicekeys/dicekeys).
From what I understand this should give the possibility to:

generate a digital key on an airgapped computer
e.g. using dd if=/dev/urandom of=KEYFILE bs=256 count=1
backup that file into a password manager
use that file to generate the key on the hardware security device

In case the hardware device gets lost, it should be trivial to 'regenerate' a new one using a new hardware device and the stored keyfile.
Now my questions are:

how can I do that?
is that considered to be a smart thing to do or do I miss something?

For a key from SoloKeys, you can't do it. All the private keys are generated inside.
Since it is open-sourced, if you modify the source and add your own software interface or even special hardware interface, it is quite doable. But be sure to keep the interface and internal supporting logic at a high security level.


Why don't sites implement a system where a wrong password causes a 3 second delay? I am into bitcoin right now, and the password threats scare me a little...

Not so much for me, because I use LastPass and generate new passwords at 20 characters and it includes symbols, upper and lower case letters as well as numbers.  However, I know that we are nearing a time where 100 billion passwords a second can be attempted as a brute force and I was thinking about the amount of people who use Teddy567 or qwertyqwerty for passwords and I think to make the internet safer we should come up with a way to stop brute force attacks.

So, can you help me to understand why sites can't implement a 3 second delay or hell, even a 1 second delay in any missed password.  This would, in my mind totally end all brute force attacks.  It also would not even be noticeable by humans

Generally locking accounts as proposed by raz is a very bad thing - it leads to helpdesk load, annoyed customers, and is not needed to actually prevent brute force attacks.

Temporary suspensions are used by more and more systems, often some delay that foils brute force, like 5 or 30 minutes, or by using an escalating scale, eg doubling the timeout each failed login attempt.


Cryptographically signing content / download Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server.

I would like to include authenticating these updates before applying them, i.e., that these updates are cryptographically signed.

My suggestion is to use Asymmetric Encryption, this requires distributing the Public Key with the executable running on the client machine. The download server will sign the updates with the private key. This would allow the client machine use the public key to verify the updates.

My questions:

Is this the general standard approach?
Would the public key be generally pushed with the executable running on the client machine or would this just be a look up via some REST API?
Do Apple (or others) implement a similar approach when they verify the downloaded file for when they are applying an update to the IOS platform?
Would I need to include the use of a certificate ?

I am not interested in merits of TLS etc.

Yes, code signing with asymmetric crypto is very common. The exact mechanics vary by OS, but the general principal that the author of the software package, or the central repo / app store, or both, signs every code package with their asymmetric key:

Android code signing system
iOS code signing system
Windows code signing system
Linux (ex.: Red Hat) code signing

The tricky part here is that you need some way for the end-user's device to trust your signing key; simply attaching the public key to the binary doesn't work because an attacker could modify your binary, re-sign it with their own key, and replace your public key with theirs.
Typically this is solved by signing with a certificate that chains to a trusted CA or PGP root key, for example either a publicly-trusted CA, or an internal CA or PGP key that is trusted by your whizpop devices.
You could do as you suggest and have client fetch the public key of the signer via an API, in which case trust in the key will be rooted in the TLS certificate that the API server is using. There are lots of options.

TL;DR
Yes, signing binaries with asymmetric crypto is very common. You'll probably need to do some work to establish trust in the signing key. For inspiration and ideas, see the links to how each OS handles code signing.


Trying to make a Django-based site use HTTPS-only, not sure if it's secure? The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the response I got :)

So I'm trying to do just that. I have a Django/nginx setup that I'm trying to configure for HTTPS-only - it's sort of working, but there are problems. More importantly, I'm sure if it's really secure, despite seeing the https prefix.

I have configured nginx to redirect all http pages to https, and that part works. However... Say I have a page, https://mysite.com/search/, with a search form/button on it. I click the button, Django processes the form, and does a redirect to a results page, which is http://mysite.com/search/results?term="foo".

This URL gets sent to the browser, which sends it back to the nginx server, which does a permanent redirect to an https-prefixed version of the page. (At least I think that's what is happening - certainly IE warns me that I'm going to an insecure page, and then right back to a secure page :)

But is this really secure? Or, at least as much security as a standard HTTPS-only site would have? Is the fact that Django transmits a http-prefix URL, someone compromising security? Yes, as far as I can tell, only pages that have an https-prefix get replied to, but it just doesn't feel right :) Security is funky, as this site can attest to, and I'm worried there's something I'm missing.

Secure your cookies

In settings.py put the lines

SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

and cookies will only be sent via HTTPS connections.   Additionally, you probably also want SESSION_EXPIRE_AT_BROWSER_CLOSE=True.  Note if you are using older versions of django (less than 1.4), there isn't a setting for secure CSRF cookies.  As a quick fix, you can just have CSRF cookie be secure when the session cookie is secure (SESSION_COOKIE_SECURE=True), by editing  django/middleware/csrf.py:

class CsrfViewMiddleware(object):
   ...
   def process_response(self, request, response):
       ...
       response.set_cookie(settings.CSRF_COOKIE_NAME,
            request.META["CSRF_COOKIE"], max_age = 60 * 60 * 24 * 7 * 52,
            domain=settings.CSRF_COOKIE_DOMAIN,
            secure=settings.SESSION_COOKIE_SECURE or None)

Direct HTTP requests to HTTPS in the webserver

Next you want a rewrite rule that redirects http requests to https, e.g., in nginx

server {
   listen 80;
   rewrite ^(.*) https://$host$1 permanent;
}

Django's reverse function and url template tags only return relative links; so if you are on an https page your links will keep you on the https site.

Set OS environmental variable HTTPS to on

Finally, (and my original response excluded this), you need to enable the OS environmental variable HTTPS to 'on' so django will prepend https to fully generated links (e.g., like with HttpRedirectRequests).  If you are using mod_wsgi, you can add the line:

os.environ['HTTPS'] = "on"

to your wsgi script.  If you are using uwsgi, you can add an environmental variable by the command line switch --env HTTPS=on or by adding the line env = HTTPS=on to your uwsgi .ini file.  As a last resort if nothing else works, you could edit your settings file to have the lines import os and os.environ['HTTPS'] = "on", which also should work.

If you are using wsgi, you may want to additionally set the environmental variable wsgi.url_scheme to 'https' by adding this to your settings.py :

os.environ['wsgi.url_scheme'] = 'https'

The wsgi advice courtesy of Vijayendra Bapte's comment.

You can see the need for this environmental variable by reading django/http/__init__.py:

def build_absolute_uri(self, location=None):
    """
    Builds an absolute URI from the location and the variables available in
    this request. If no location is specified, the absolute URI is built on
    ``request.get_full_path()``.
    """
    if not location:
        location = self.get_full_path()
    if not absolute_http_url_re.match(location):
        current_uri = '%s://%s%s' % (self.is_secure() and 'https' or 'http',
                                     self.get_host(), self.path)
        location = urljoin(current_uri, location)
    return iri_to_uri(location)

def is_secure(self):
    return os.environ.get("HTTPS") == "on"

Additional Web Server Things:

Take that guy's advice and turn on HSTS headers in your web server by adding a line to nginx:

add_header Strict-Transport-Security max-age=31536000;

This tells your web browser that your website for the next 10 years will be using HTTPS only.  If there's any Man-in-the-middle attack on any future visit from the same browser (e.g., you log on to a malicious router in a coffee-shop that redirects you to an HTTP version of the page), your browser will remember it is supposed to be HTTPS only and prevent you from inadvertently giving up your information.  But be careful about this, you can't change your mind and later decide part of your domain will be served over HTTP (until the 10 years have passed from when you removed this line).  So plan ahead; e.g., if you believe your application may soon grow in popularity and you'll need to be on a big CDN that doesn't handle HTTPS well at a price you can afford, you may have an issue.

Also make sure you disable weak protocols.  Submit your domain to an SSL Test to check for potential problems (too short key, not using TLSv1.2, using broken protocols, etc.).  E.g., in nginx I use:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";


How to block local ip with Windows Firewall? I want to block a local ip-adress in my network but it doesn't work.
My System is Windows 7 and I have a Webserver running on port 8080.

Let's say I want to block 192.168.178.10. Not just for port 8080 but for all ports on my server.

I did everything in this tutorial: https://www.cm3solutions.com/block-ip-address-ip-range-using-windows-firewall/

On Scope I used the first choice to add a local ip. In this case 192.168.178.10. But I still can access my server from the local ip.

If you want to block access from 192.168.178.10, it should be added to remote IP address instead of the local IP address.


Hiding process from Task Manager What technique is used to hide a process from Task Manager? I'm currently researching ways I can do this in C++. Is this process called hooking?

http://www.codeproject.com/Articles/3978/Trap-CtrlAltDel-Hide-Application-in-Task-List-on-W

The book I am self-studying from: RootKits: Subverting the Windows Kernel

The rootkit replaces the legitimate call to EnumProcesses() with the address of its own implementation. Its implementation calls the original, but before it returns the list, it removes any mention of the processes it has been told to hide.

While the behavior and outcome are similar, I consider hooking to be slightly different, because it can be done legitimately.  Hooking is generally done through an officially supported API, and the OS tracks all such hooks so it can undo them when the hooking process is terminated.  A description of Microsoft's hooking mechanism can be seen here.  Malware instead often directly modifies the memory without notifying the OS.


Rule does not log X-Forwarded-For environment variable The Apache web server is logging X-Forwarded-For environment variable as expected, but I have an Owasp rule where I'm trying to log this environment variable value too but without luck so far.

Here's my rule:

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?i:(?:select \* from|select\*from|load_file|sleep\())" "phase:2,capture,t:none,t:urlDecodeUni,block,deny,status:510,msg:'IP: %{REMOTE_ADDR} %{X-Forwarded-For} SQL injection and other data/structure manipulation attempts',id:'9900002',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.id}-%{rule.msg}',setvar:tx.sql_injection_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:'tx.%{tx.msg}-WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"

Is it possible to log X-Forwarded-For environment variable? If it is possible, which is the correct syntax? because %{X-Forwarded-For} is not working.

You probably want this:

REQUEST_HEADERS:X-Forwarded-For

To me, it seems that X-Forwarded-For is not an environment variable, but a request header.

In some environments, each header is automatically converted to an environment variable, in the form HTTP_X_FORWARDED_FOR. However, it seems that in ModSecurity you can simply retrieve the request header.


Why shouldn't I bring a computer to a key-signing party? I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event:

Things to bring

no computer

What risks does bringing a computer into a key-signing party pose?

Quote from Wikipedia:

  Although PGP keys are generally used with personal computers for
  Internet-related applications, key signing parties themselves
  generally do not involve computers, since that would give
  adversaries increased opportunities for subterfuge. Rather,
  participants write down a string of letters and numbers, called a
  public key fingerprint, which represents their key. The fingerprint is
  created by a cryptographic hash function, which condenses the public
  key down to a string which is shorter and more manageable.
  Participants exchange these fingerprints as they verify each other's
  identification. Then, after the party, they obtain the public keys
  corresponding to the fingerprints they received and digitally sign
  them.

another one from openwest:

  If you bring a computer, please keep it in your bag and powered down
  during the party. This is for security measures to prevent the spread
  of malicious software, the misplacement of private keys, and damaged
  or misplaced equipment.


Is the range of the s2k-count parameter in GPG still adequate? From the manual: the s2k-count parameter specifies how many times the passphrase mangling for symmetric encryption is repeated. This value may range between 1024 and 65011712 inclusive.

Apparently in many linux distributions the default is 65536 (just checked in mine).

Apparently all these values (range and default) were defined several years ago, in a time where computers were much slower. I tried creating an encrypted file using the largest possible value (65011712), and decrypting takes a fraction of a second on my PC anyway. The default value (65536) just looks way too small to me.

So are these values still adequate today, and for how long will they continue to be meaningful before a modification of GPG is needed?

The default today is half the minimum recommendation from 20 years ago.*

The specific key strengthening algorithm used is Salted and Iterated S2K, which combines the input password and the salt and repeats it numerous times, hashing the concatenation. The actual count value you are using is the number of bytes to continue hashing, so the highest possible value hashes only around 65 MB of data. The default of 65536 is indeed fairly low. Each SHA-256 hash block is 64 bytes in size, and PBKDF2 uses the HMAC construction which calls SHA-256 twice for every iteration (processing 128 bytes), so the default strength is equivalent to only 512 invocations of the hash function! Obviously any KDF that uses that few hash iterations is not going to be particularly secure. The maximum value of 65011712 is equivalent to more than 500,000 hash iterations, which is better.

The problem is not only that the value is too low, but that it is not memory-hard. This means that it's very easy to massively parallelize cracking attempts without running into memory limitations. This is the same issue that PBKDF2 has. A proper alternative would be a memory-hard function like Argon2, but GnuPG does not support that. It is unfortunately limited to S2K. You must use a stronger password.

* I am comparing PBKDF2 and S2K. The minimum recommendation of PBKDF2 iterations was 1k in 2000. If each iteration is equivalent to two 64-byte SHA-256 hashes, then we can consider the S2K count divided by 128 to be approximately equal to a single iteration of PBKDF2. As such, 65536 / 128 = 512, about half the recommendation from 2000.


PDF encryption anomaly; version 1.5 using AES I'm not sure if this is the correct forum to ask this question so please accept my apologies in advance if this is the wrong place. (I have already posted this in the Programmers section but I've yet to receive an answer.)

I recently created an encrypted PDF file using PDF Studio 11. The software provides three encryption options:

RC4
128 AES
256 AES

256-bit AES requires the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 be installed.

I created three dummy files:

test1.pdf [encrypted with RC4]
test2.pdf [encrypted with 128]
test3.pdf [encrypted with 256]

When I opened them in a PDF viewer I saw that every single file has the PDF version stated as 1.5.

I double checked this at the command line using qpdf and sure enough it was specified: "PDF Version: 1.5"

I looked at the Adobe PDF Reference, Fourth Edition, version 1.5 and it seems that 1.5 supports only RC4 128-bit encryption.

qpdf indicated the following:

test1.pdf [no mention of encryption, although PDF viewer requires password to open file]
test2.pdf [AESv2]
test3.pdf [AESv3]

The first two test files opened in Evince after inputting the correct password but the third (the one encrypted with 256-bit AES) only opened in the Google Chrome PDF viewer; AFAIK Evince can't open 256-bit AES encrypted files.

The output from qpdf, the available encryption options in PDF Studio, the requirement for the JCE to be installed and the fact that the third file couldn't be opened in Evince all lead me to the conclusion that the file is encrypted with 256-bit AES (or 128-bit AES where applicable).

My questions are:

if the 1.5 standard doesn't support AES then how can the document be encrypted with AES (unless PDF Studio is misreporting the version number)?
if the editor (PDF Studio) is applying proper 256-bit AES and not complying with the 1.5 standard then why not assign it a higher PDF version? (I can't see any benefits in using a lower version number particularly as older software wouldn't be able to open it anyway).
can the PDF metadata be effectively encrypted using AES (presuming AES is being properly applied) when using 1.5?

My understanding is that AES is only implemented in PDF versions 1.6 and 1.7. (I am aware there are shortcomings in Adobe's password handling of 256-bit AES in certain versions but that's a separate matter).

Your understanding about AES is correct, it came into PDF in version 1.6 (see section 3.5 of PDF Reference v1.6 for details). PDF 1.6 and 1.7 (and ISO 32000-1) support AES in 128-bit mode. Adobe's ExtensionLevel 3 for PDF 1.7/ISO 32000-1 introduced AES in 256-bit mode but should be avoided because of weaknesses in the password mechanism. Better support was introduced in ExtensionLevel 8, though that has never been formally published by Adobe.

Starting with PDF 1.4, however, a PDF may specify a file version with the /Version entry in the document catalog (PDF Reference 1.6 section 3.6.1, /Version key). Some writers do use different version #s for the comment and for the /Version entry - to specify that an incremental update to a PDF has added features not supported in PDF version that the PDF originally conformed to. I can't speak specifically to what PDF Studio 11 might be doing, but do be aware that one must check the document catalog for a PDF document version; the higher of the /Version entry (if present) or the version in the %%PDF-x.y comment line is the actual version of the PDF file.


Is this phishing or the real PayPal? This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?

I believe it is legitimate.  If you visit paypal.com, switch to the "Germany - Deutsch" site and check out the links on the resulting site, you can see that, for example, the "Sicherheit" (Google translate as "Security") link points to https://www.paypal-deutschland.de/sicherheit/.

Of course, one could argue that this means very little.

If in doubt, visit paypal.com and use the designated German site which appears to remain on the paypal.com main domain.


Is exposing exception information in web service a security risk? It is a known fact that exposing the exception information to the end user provides security risks since an adversary can user that to figure out how things work internally and attack it. But what about a web service, where that information might be relevant to the developers that consume the API?

On one hand exposing full stacktrace and even the message is risky since it might contain some database information e.g. on the other hand if something goes wrong and the server just says 500 "sorry", then developers would be frustrated. I guess really the proper way is to handle all exceptions you know of in a secure manner, i.e. catch business/validation exceptions and return it back with special error codes and messages (no stacktrace) and for all unknown still make 500 "sorry".

But I would like to here what are the common ways of doing it and which approach should be taken from security point of view.

The API should not expose any internal information, i.e stack traces or similar. As you really noticed they might leak information which might be used to attack the implementation.

Moreover they are usually only relevant for the developer of the API and not the user of the API. These users expect proper error messages anyway and not some strange message where they would need to ask the API developer first what this means and the developer would need to look at the source code. So this might be less a security issue but more a usability problem of the API if you just throw the stack trace to the user instead of something meaningful for the user.


Are cloud-based collaboration tools "safe"? I've tried to bring in collaboration tools at my company such as Evernote, Dropbox, OneNote, GoogleDocs etc. at our company but am finding it tough to get people on board. We use Sharepoint to store documents, mostly Word docs that can be edited by everyone.

The problem is that when you have something to make people aware of (say a hyperlink to a useful blog post) it is a slow process to find the Word doc relating to the subject, open it up, add the link, email everyone to tell them it has been updated... so consequently everybody skips to the email part and the information is lost in everybody's inboxes ("hey didn't I send you a link about that six months ago...or something?").

The reason I cannot get people on board is that Evernote etc. is not backed up locally. Furthermore if CarelessBob deletes all the text and saves, the change is sync'd to everybody and they lose the text too. My boss has seen this happen with Dropbox.

Are these assumptions by them correct? In my experience they are but I'd love to know if there are some tools that mitigate this problem.

EDIT: This has been migrated from superuser to security (not my decision). "safe" is in quotes because I primarily mean from my boss' point of view i.e. will we lose the data. I am not referring to storing business-confidential data in Google Docs, Evernote etc. (though I am aware of companies that do this quite happily). Having said that I welcome any security-focussed responses.

When you use a service provided by another company, you have to be aware that all data you exchange via this service is available to that company. In case of some companies (like Google) analyzing the data stored by their users and mining it for any valuable information is in fact their primary business model.

Evaluate for yourself how sensitive your data is and how much you trust that company to keep your data confidential.

When you want to be sure, you should try to find a product which offers similar functionality but which can be installed on your own server running on your local network. That way you maintain full control of your data and make sure that it never leaves your control.

There is also the problem that an external service might at any time decide to change or stop offering their service. So you shouldn't structure your internal workflow too close around these tools. But that's a topic for a different stackexchange site.


How to encrypt data so only clients can read, but not the server I am building a system where the clients should be able to communicate with each other.
However I want all the data to be hidden from the server where the information is stored in a database.
How can the users invite more users and share the encryption key without that the server also get the key?

First user creates a key (locally on the device) to encrypt the messages (symmetric encryption).
First user invites another user. How can the key be distributed from the first user to the second user without that the server also get this information? Same question goes for user three etc.
The idea is that the second user, after accepting invite, can read all the data that the first user have created and that now user two and three can create new data that user one can read.
I don't want the users having to enter passwords or such things.
The clients cannot communicate directly with each other, it has to go through the server.

I suppose that when the key has been distributed it's quite easy to just store that on the clients and then the key can be used to both decrypt and encrypt the messages. If a client loses the key I suppose that that user needs a new invite to be able to read the data again.
For this system it is not required that the key needs to be changed if someone leaves the group.

Matrix.org have an implementation of the double ratchet algorithm used by signal for end to end encryption and they have an implementation for groups as well.  It is available as a free library (Apache license) on their site with bindings for JavaScript, Python, Java (Android), and Objective-C as well as some others provided by third parties.
https://gitlab.matrix.org/matrix-org/olm


Why do I have to use multiple keys for each direction and purpose? I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. Maybe you could explain me why or even better know about any citable source, which describes the following:

Why don't I use the same key for encryption in both ways?
Why don't I use the same key for encryption and authentication?

It would also be helpful, if anyone could tell me about known attacks, that exploit the mistakes above.

By the way I used this site: Lessons learned and misconceptions regarding encryption and cryptology as the starting point for my research.

In general, you should never use the same key for two different algorithms, because it makes related key attacks possible. That's why best practice is to use a KDF to generate separate keys for encryption and authentication operations. You can, of course, use an authenticated encryption mode, which will avoid the need to use two separate keys.

As to using different keys for different directions in a channel, while reducing your exposure to cryptographic vulnerabilities is certainly a concern, there is a much more fundamental reason: reflection attacks. Unless there is a clearly defined difference between what is a valid message for each of the two parties in a communication, an attacker can simply repeat what you say back to you to cause unexpected behavior. If the same key is used in both directions, what you transmit will pass your own authentication checks for incoming data, and then code that's expecting a guarantee of a secure channel will suddenly be dealing with unexpected invalid input. This can cause crashes or other unexpected behavior.

You can mitigate this at the protocol level by sending a message saying which side of the communication you are, but that adds parsing complexity just to mitigate a vulnerability, and that's really the job of the security layer. Using different keys for both ends of the connection avoids the problem entirely and is usually simpler to implement as well.


Sanitizing USB memory stick by overwriting dummy data I want to sanitize my USB memory stick. By 'sanitizing' I mean I don't want to leave any trace of what I wrote in the USB memory stick.

Since they are made with flash memory and flash memory controllers apply 'wear-levelling' algorithm, I'm wondering whether writing and erasing dummy data over and over again on the stick will do the job for me.

For example, if I have a 16GB stick and a 4GB movie file as dummy data, will writing and erasing this movie file 8 times (so that total of 32GB write happens) make other people impossible to figure out what I have written before?

I'm trying to do this sanitizing work via operating system. So I can't access certain 'reserved' memory space, such as space for firmwares or some other special purposes. But since my previous writes which I want to erase the records of also are done via operating system, I'm guessing that the method I'm asking may be a plausible method.

Short answer is no. This will not guarantee that nothing can be recovered. Simply because the method is slightly crude and would require some miracle for the data you write to drive to match the drive's size itself. Even one file "sexytalkwithmywife.txt" and "bankdetailsforthepast10years.pdf" can be in the span of kB, and you may miss those sectors regardless of how many times you write.

Standard Methods

for windows there are various utilities like this one which will do complete data erasure for drives.

for linux the standard for a long time has been shred, where you would first run fdisk -l and lsblk to figure out exactly which drive you are supposed to wipe (important step, many a cry have happened because people didnt do this) then to do something like this:

shred –vfz –n 6 /dev/sdX

where -vfz is, in order, please tell me how far along you are continually, please dont bother me with permissions, please write zeros on the last pass. n is the number of times to write random data to each bit. and sdX is the drive you identified in the previous step.

Recent Developments

The last i heard the community was still a wash with how to handle this for memory and ssd's since they apply load balancing and trimm support as you say. Kingston came out with a suite of tools for the specific data erasure of these kinds of hardware called Secure Erase, See their article here. But some people (myself included) do not like the idea of a software that specifies only one manufacturer and to my knowledge isn't open source.

Here's the issue, there's no main standard for this yet. Most manufacturers of ssds have applications in firmware that can be called upon for wiping data properly in these devices, which doesn't make things very easy for us. Most of us dont want to go searching around hardware specs to figure out how to do this properly per each individual drive. Unless I've missed more recent developments (a possibility in this area) we may just have to wait for better options for ssd's and the like to be absolutely sure. But for now, i doubt you are dealing with the kind of threats that shred or eraser cant handle.


Assuming that everyone always performs a revocation check, do we still need expiration time in each certificate? I understand that each public key certificate includes an expiration time, and a CRL is issued periodically, listing all currently revoked certificates. However, in class we were told to think about whether or not we still needed expiration time in each certificate assuming a revocation check is always performed. I feel like we would still need an expiration time in each certificate because then, how would we know when a certificate is revoked?

If anyone could help broaden my mindset, it would be much appreciated

Delivering the existing CRLs is a significant cost for the CAs!
Here you can see some information about costs.

  [...] CRL grow to approximately 4.7MB in size from approximately 22KB [...] around 40Gbps of net new traffic across the Internet [...] the traffic to deliver the CRL would have added $400,000USD to Globalsign's monthly bandwidth bill

If certificates would not expire, CRLs would grow forever and never shrink!


Alternative to bcrypt in .NET Core? I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very old or have not undergone review, like those written by Microsoft - so I'd prefer a "worse" algorithm that has MS' backing.

The System.Security.Cryptography namespace has lots of algorithms to choose from.

bcrypt is the preferred password hashing algorithm in the Node ecosystem - it also has various features like the "slowness" and workfactor and handy salting routines. I hope I don't have to give up too much when choosing something else.

I'm not a hashing expert - which is the best alternative password hashing algorithm from that link? (Which will get me as close as possible to what I'm used to with bcrypt.)

The preffered algorithm from that namespace seems to be PasswordDeriveBytes, though this is PBKDF1, which is nowhere as good as Bcrypt and probably should not be used.

PBKDF2 from a different namespace is probably preferable. Just note that the work factor there is linear, not exponential like in BCrypt and should be quite large.

I would consider using Argon2 from LibSodium with a C# wrapper. Libsodium is a reputable and well maintained library focused on ease of use.


PCI compliance can prevent fines? We're working really hard to achieve PCI compliance for a project and will likely be spending hundreds of dollars each month, but I was wondering what if, god forbid, something unlikely happens and there is a breach somehow, do we still pay for the "inquiries" and the exposed card holder data although we were PCI compliant?

I'm just considering the worst case scenario, because if companies like Sony can get hacked then we're a tiny startup afterall.

PCI compliance is not insurance.
It is not a real measure of protection.

I sum up the value of of PCI compliance in my well-known eponymous law, AviD's Law of Compliance:

  PCI compliance reduces the risk of the penalties of non-compliance.

In other words, much like how paying taxes is a requirement but does not necessarily entitle you to any specific government benefit - you have to be compliant. And if you're not, you will have to pay a fine. But this does not necessarily help with preventing breaches or responding to them...

As I answered in Vulnerability scanning applicability for PCI DSS, compliance is not about security.
As the other answers here mentioned, you need to implement security controls and secure features aside from the compliance. If you get breached, you still have fallout from that.

However, being compliant in the event of a breach does mean that you won't be getting a non-compliance fine. (See AviD's law above...) You'll need to pay any other costs, such as damages and repair costs, but at least there won't be a fine (well, at least not from PCI - other laws and regulations may apply).


How do I use nmap NSE script arguments? How can I improve this by passing arguments to http-default-accounts? I feel like I'm doing something wrong. I'm not getting any good results.
# Find vulnerable web logins

# How many random hosts do you want to scan ?

N_HOSTS=5000

nmap\
 -Pn\
 -sS\
 -sV\
 -n\
 -T5\
 -p 8080, 80, 8000\
 --script http-default-accounts\
 --open\
 -oX results.xml\
 -iR $N_HOSTS

Passing arguments to NSE script is very easy once understood properly. Basically it follows the format of lua table. Also, if you get any doubt with your Nmap's options usage you can turn on debug mode using -d<level> flag. Usually -d2 is sufficient for looking at scripts. For the given script http-default-accounts it would be like -

nmap <options> --script http-default-accounts --script-args "http-default-accounts.basepath='/admin', category='web', fingerprintfile=/usr/share/nmap/nselib/data/http-default-accounts-fingerprints.lua"

Notice that I've used script-name.argument format as well as argument format in the arguments. Both of them work same while former is used when different scripts assume same argument variables and you want to give different values.
In the current state, this script does not take multiple basepath or category or fingerprintfile. To master the script argument usage, you can try using the http-form-fuzzer script which can take up nested table of any depth.


Block WireGuard clients' access to specific websites I have installed a WireGuard VPN server on a Raspberry Pi (running Raspbian) using PiVPN and I would like to

either block the VPN clients to access specific websites (i.e. block them access https://www.foo.com and https://www.bar.com) or
let them access them by using their IP and not the Raspberry's.

Furthermore, I am also using the UFW Firewall.

Is there a way to achieve that? Thank you in advance!

I see three ways this could be implemented, but no real "perfect" solution. Here are your options:

Drop requests to these sites at firewall level. This means you have
to block the IPs of these websites, which might be doable for small
sites (with a single IP and no LB or reverse proxy) but very hard /
impossible for big sites. Also you'll have to block all Cloudflare's
site if one of them is it the list... Not a very good option but
once the IPs are blocked in the firewall you know for sure no one
will reach them.
Implement you own DNS server and blacklist the domain names. Since you said you are using a Raspberry, you could look into PiHole which is a DNS server for Raspberry. You'll then have to configure clients to use the Raspberry as their DNS server. This is easier to implement than the first one but it can be bypassed by changing DNS server in Wiregard option for the client.
Redirect all VPN requests through a proxy doing some SSL inspection. VPN clients will have to install the proxy's CA on their device and then you can do some blacklisting on the "Host" header for example.


XSS with URL encoding If a website URL gets encoded then is the website still vulnerable to XSS or no?

For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)%3C%2Fscript%3E does this mean the site is vulnerable to XSS or no?

The answer depends on how the page renders your payload.

If the target is a HTML page and the payload still appears as <script>alert(1)</script>, an XSS will occur, assuming no CSP or Chrome's XSS auditor. However, if the HTML page renders your payload in the URL syntax i.e. %3Cscript%3Ealert(1)%3C%2Fscript%3E, there won't be an XSS. Depending on where the payload is injected in the latter, I would also try special characters like " and ' to try escape the URL context to inject directly into the HTML (url) tag.


If my connection to a website is unencrypted while using Tor is my IP visible? I suppose to those of you with technical expertise in this matter this question might seem obvious, so apologies as I am know nothing of this topic. Also what data would be possibly visible by someone potentially monitoring my connection to such a server?

No, your IP address will not be visible to the website, just the IP of the exit node.

The implication of the unencrypted connection is that your communications with the site can be monitored by the exit node. This could mean stealing credentials, or attempting to fingerprint you via other possibly identifying information (headers, screen resolution, font support, etc.).

They can also manipulate the traffic if they wish to, for example to deliver malware.


With OpenID, should I ever refresh/reauthenticate? I'm using Google OAuth 2.0 to provide logins to my site(a rinkydink internal tool for other devs at my company to use, so security isn't paramount, but there are a few access restrictions) However, once logged in, I don't need to access any additional Google resources -- I just get the user email and consider the user logged in. How is this typically done? The options I see are...

A. Store this login in a cookie and never contact Google again (at least until the cookie times out or the user logs out manually)

B. Have a long-term cookie storing a key (the server stores the OAuth code), and re-authenticate when the user wants to do a sensitive action.

C. Have a long-term cookie storing a key (the server stores the OAuth code), and a short-term session cookie that expires when they close their browser. Whenever they first access the page, I re-authenticate once and give them this session cookie.

Typically with Token Based Authentication you have two types of tokens:

Access Tokens

These are the tokens passed to actually request access to resources. They are short lived.

Refresh Tokens

These are tokens used to get a new access token once it expires. These have long expiration times and are stored securely on a system.

The idea behind this,is that Access Tokens will be used to grant you access to resources. They expire in a short time, so if compromised, access to the system is limited. Refresh Tokens only need to be used when you need a new Access Token, so don't travel over the wire constantly. The emphasis on storing Refresh Tokens securely.

Session Management

There is two method that can be used to store Tokens, Web Storage and Cookies. Of the two, my current preference is with Cookies with the flags HttpOnly and Secure set.


Specifying RSA OAEP label via OpenSSL command line Is there a way to pass the OAEP label to OpenSSL command-line tools?

For a specific example, consider this command for RSA OAEP encryption that does not specify the label:

openssl rsautl -encrypt -oaep -inkey path_to_key.pem

Based on the source it does not appear that such an option exists for rsautl. After some digging however, I discovered that pkeyutl supports the rsa_oaep_label option as a hex string:

openssl pkeyutl -encrypt -inkey path_to_key.pem -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_label:[hex string]


How are Mozilla Firefox passwords encrypted? As far as I know, current versions of Mozilla Firefox store the saved passwords (encrypted with 3DES) to the logins.json file meanwhile the keys are stored in key4.db (or key3.db in older versions).

If one hasn't set up a Master Key for the passwords, the key database file can then be accessed. In the database, I've encountered an entry that does indeed look like the keys.

------------------------------
|    id    | item1 | item2   |
------------------------------
| password |  ...  |  ...    |
------------------------------

So, why possibly are there two 3DES keys in the database? Are they really encryption keys? How can I use them to decrypt the logins.json data? Which keying option is being used?

I have created a visual explanation of the firefox algorithm, not very pretty but I hope it helps.


Still able to recover files after running cipher.exe on windows 7 After running cipher.exe on my entire C: drive, I'm still able to recover deleted files using recuva. In fact, doing a before and after, I see no discernible difference in the files that are able to be recovered after using cipher.
According to the docs,

the cipher /w:c:\test command causes all deallocated space on drive C: to be overwritten.

Any idea why cipher doesn't seem to work as I expect?

Haven't tried, but in NTFS, "deallocated space" and "metadata" is not the same thing. Try to recover a file: is it recoverable, or is it garbage? (I would agree that not deleting the name of a file is still a security risk, and freed files metadata should be considered deallocated space, but maybe Microsoft thinks differently).
Or maybe (please do not be offended, it's a thing that happens to everybody: it happened to me) you copied the example from the docs, and /W:C:\TEST will only erase the unallocated space hanging on the "TEST" node, not the entire drive C: (that would be cipher /W:C:\). Even if the TEST directory does not exist, cipher will still look for it for a long time, given the impression of being doing something while actually it is doing absolutely nothing.
TL;DR use SDelete or the Tools section in Piriform's CCleaner instead of cipher /w. Just in case.


What are the best ways to fake a web server I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to redirect C&C traffic to your own fake web server that can reply in the same way.

Right now I've been using a python library and then manually replying with the HTTP responses but this is time consuming and kludgy.

EDIT: Not necessarily looking for an automated tool, just a faster way of doing it.

I always like netcat for this kind of thing. In this instance you could create a copy of the real response from the C&C server using

nc candcserver.com 80

submit the headers you want to pass on the command line, press enter twice, and save it to a text file, and then serve up the file you just created using

while true; do sudo nc -l 80 < capturedpage.txt; done

and point the app your testing at 127.0.0.1


Why can't PGP/GPG Web-of-Trust be automated? We heard lots of complaints about hard to use crypto tools, and recent ideas of Google how to fix this. I had another idea about this which seems quite obvious, but couldn't find anything about it on the web.

The idea would be to automate the PGP Web-of-Trust by loosening crypto requirements, following the Opportunistic Security idea.

The email client would automatically look up the PGP key of all receivers in key stores (first local, then public keyservers, ideally provided by the receiving email provider) and encrypt the mail with these keys. Ideally, we would use trusted keys by regular PGP standards. However, we would fall back to any suitable key with less trust, down to a complete unknown key if required.

On the sending side, any email client would automatically create a PGP key locally and publish the public key part on the email provider's keyserver. The client obviously needs to provide a way to define/import our own key for advanced users.

By these defaults, we would have more/most emails encrypted, by itself an arguable advantage (to increase surveillance costs).

The only "new" idea here would be to automatically manage trust by exploiting social assumptions. The main assumption would be that two parties continuously exchanging emails somehow know each other and can identify each other by the contents of the mails exchanged. With each email exchange, the email clients of both parties would increase their internal trust score for the other party's key. This internal trust score would be applied like traditional Web-of-Trust confidence levels to build up an automated Web-of-Trust.

We would keep the internal trust score separate from traditional confidence level for two reasons:
1) The internal trust score needs to be very fine-grained in order to allow automated increments and calculation (e. g. 0..1 range with IEEE-754 double precision).
2) Automatically crated trust scores are better than none, but will never reach the explicit confidence levels of the traditional Web-of-Trust.

For me, this seems like a suitable approach for the public part of the key management issue. It does not solve the private part (e. g. getting the private key to all mobile devices). We also inherit all known issues of PGP.

I'm pretty sure I'm missing some major issue here. Thanks for pointing it out to me.

Certificate Authorities

  The email client would automatically look up the PGP key of all receivers in key stores (first local, then public keyservers, ideally provided by the receiving email provider) and encrypt the mail with these keys. Ideally, we would use trusted keys by regular PGP standards. However, we would fall back to any suitable key with less trust, down to a complete unknown key if required.

This is a horribly bad idea. Everyone can generate keys for every mail address. Without any trust path, you have no chance to decide which one is the right key. Instead of further argumentation, have a look at the key server results for president@whitehouse.gov. Don't expect any of them to belong to who they claim to be.

  On the sending side, any email client would automatically create a PGP key locally and publish the public key part on the email provider's keyserver.

Now we're getting on a more reasonable path. But: This somewhat counterfeits the idea behind OpenPGP. Trust is not defined by on which key server is stored, but what keys are trusted. You're looking for a certification authority (yes, in the end pretty much the same thing like X.509 uses). There are already some in the OpenPGP world, have a look at CAcert.

Your provider could also be a certificate authority (to some degree, you're already trusting him anyway). To do so, you would both sign and (fully) trust his certificate authority key, in return he's signing all keys generated for his own users. OpenPGP can do all this out of the box; no need to change it. You just need to make people understand and implement it.

An Automated Web of Trust

  The only "new" idea here would be to automatically manage trust by exploiting social assumptions. The main assumption would be that two parties continuously exchanging emails somehow know each other and can identify each other by the contents of the mails exchanged. With each email exchange, the email clients of both parties would increase their internal trust score for the other party's key. This internal trust score would be applied like traditional Web-of-Trust confidence levels to build up an automated Web-of-Trust.

Now we're getting to a completely different concept, which is already known as certificate pinning (but I haven't heard of it being implemented for OpenPGP).

Yes, this might be reasonable for people you already had contact with. But it makes things much more complicated, especially regarding computation of trust. This would require a probabilistic computation of trust to be able to deal with the large number of rather low trust issued by such a system, like proposed by Maurer et al. in 1996: Modeling a public-key infrastructure; maybe together with automated issuance of trust.

Conclusion

Your first proposal, providers acting as certificate authorities has indeed some charm, is compatible with OpenPGP and rather easy to implement. I'm not sure if Google even has similar plans for its End to End project.

  For me, this seems like a suitable approach for the public part of the key management issue. It does not solve the private part (e. g. getting the private key to all mobile devices). We also inherit all known issues of PGP.

Probabilistic models have already been proposed nearly twenty years ago, there just was nobody to pick them up. If you scroll through the citations for the paper linked above, it even seems quite a bunch of publications claim to have solutions for your proposal. One large problem is, this wouldn't be compatible with OpenPGP (as defined by RFC 4880) any more, and introducing new systems in a way they get acceptance isn't very easy. Furthermore, it's even harder to understand what's going on in probabilistic models.

Another thing is you'd still have to teach people on how to use OpenPGP and understand the Web of Trust concept. This is no technical problem (although it might be more complicated than necessary); there is no plain technical solution for security. Don't just make people assume their communication is secure when they're not able to understand what's going on, bad things happen if people do so, or a horrible bunch of dismissed, non-revoked keys on the key servers.

Further Notes

  The internal trust score needs to be very fine-grained in order to allow automated increments and calculation (e. g. 0..1 range with IEEE-754 double precision).

Off topic regarding what's really discussed in this Q&A, but anyway: this is no reasonable use case for floating-point values. Floating point numbers have high resolution around 0, but this degrades quickly when going towards larger values (I was told you can observe this in Minecraft, where some funny jumps occur when you get near the borders of the world). Why not just map it to the whole 64 bit integer (32 bit probably would be more than fine, too) which occupies the same space, but with a constant resolution of all values. Using floating-point variables you'd have to limit yourself to a very small value range (0..1 would probably be fine, but still then you have to deal with funny effects not too important for probabilistic calculation and waste some memory and computational power.


Can't understand SNORT rule pcre option syntax "?P=name" While trying to understand some SNORT rule lines, I came across the following syntax that I could not figure. Could not find any description in the manual (though admittedly I've not read it all throughly yet).

Two examples with the parts in question highlighted.

From sid:17166
pcre:"/(?P<var>\w+)\x2Ereplace\x28\s*(?P=var)\s*\x2C\s*(?P=var)\s*\x29/";
:      ^^^^^^^^^^^^                  ^^^^^^^^

From sid:29503
pcre:"/removeChild\((?<element>\w{1,20})\).*(?P=element)\.getCharNumAtPosition/smi";
:                   ^^^^^^^^^^^^^^^^^^^^    ^^^^^^^^^^^^

It looks like the "? " part is connected with the latter use of the name as "?P=name". But, it is not consistent (as seen in the two cases above).

References.
sid:17166; reference:bugtraq,36343; reference:cve,2009-3075;
sid:29503; reference:bugtraq,49213; reference:cve,2011-0084; reference:url,osvdb.org/show/osvdb/74581;

(?P<var>\w+)

How to read this expression:

'('        = Open matching group.
'?P<var>'  = call this matching group "var"
'\w+'      = one or more alphanumeric/underscore characters
')'        = close matching group.

Next part is simply asking for the named backreference:

(?P=var)

For the next piece of syntax:

(?<element>\w{1,20})

'('          = open matching group.
'?<element>' = Name this matching group "element"
'\w{1,20}'   = match any alphanumeric or underscore a minimum of once, and a maximum of 20 times.
')'          = close matching group


How can I check whether Notepad++ is using a version of the SciLexer.dll library that was modified by the CIA? I've just read the release notes of Notepad++ 7.3.3 and I've discovered that in the recent Wikileaks revelations about the CIA hacking tools there's something affecting Notepad++. The program itself is fine, but it relies on an external DLL, called SciLexer.dll, of which there exists a version that was modified by the CIA and which enables data collection in the background. In light of this, the newest version of Notepad++ checks the signature of that library, and if it isn't the right one, it simply doesn't start.

My problem is that I'm using a pc where I don't have admin privileges and I can't install/update programs myself, and even asking the IT to do it is long because they are allowed to install only some approved versions, and the entire procedure, due to the usual bureaucratic complicacies, could take weeks or months. So, without being able to install the newest version, how can I check whether my version of SciLexer.dll is good? Is there a direct way to check the certificate (maybe using the CertUtil command)? If not, can I take a SHA-256 hash and verify it against a known good one? And which one?

For example, to have the SHA-256 hash of my file I can open a shell and run this command:

certutil -hashfile "C:\Program Files (x86)\Notepad++\SciLexer.dll" SHA256

And its output is:

SHA256 hash of file SciLexer.dll:
ea 47 f3 18 a8 09 6b 0b 37 f0 cf 04 be 07 76 f0 33 80 27 50 57 a6 cc 10 44 28 df 38 3e d7 69 68
CertUtil: -hashfile command completed successfully.

I currently have Notepad++ v6.6.9 and it's running on Windows 7 64 bit Enterprise.

So, how can I verify whether the library installed on my pc is the original one or not?

From the website of the editor, you can download an archive (zip or 7z) of the version installed on your computer. Check the signature of your archive. Then unpack the archive and compute the checksum of its DLL (using SHA-256 for example) and compare it to the checksum of the installed DLL. Both should be identical.

If the checksum differs, you should post a ticket on your company's helpdesk with your findings. Let the admin find the solution to his issue (replacing the DLL or updating the application).

In the meantime, a portable version of Notepad++ is available on portableapps.com. You should check its DLL too, but you don't need higher privileges to install it.


Docker port forwarding exposure I try docker with a simple webapp :

  docker run -d -v $(pwd):/app -p 8080:80 image_name

I have docker listen on 8080:

  tcp6       0      0 :::8080                 :::*
  LISTEN      13304/docker

So I can test my web app through localhost:8080

I use iptables with UFW and I deny incoming except: 80, 443 and 22

But surprisingly, if I do a netcat from the Internet to my machine on port 8080 I can have access to my web app !!

Docker must do something special because if I start socat like this :

  socat TCP6-LISTEN:8080 TCP4:www.google.fr:80

I see :

  tcp6       0      0 :::8080                 :::*
  LISTEN      11577/socat

But this time I can't connect from the outside ... UFW do the his job ...

Docker was just added his own iptables rules before UFW rules see https://docs.docker.com/articles/networking/ for details.

to avoid the pb I put

DOCKER_OPTS="--ip 127.0.0.1"

in my /etc/default/docker. so I bind only to localhost and it's not reachable from the outside.


Is privacy a part of security? (Bruce Schneier) From this talk: http://vimeo.com/8053634, around 35 minutes he argues that privacy is part of security.

What is your take on that? Are privacy questions on topic on this board?

Yes, privacy is a vital part of security. Privacy is the result of a person having the ability to control information about themselves. That is in general granting to individuals the power to make choices about who they share their information with.

Allowing individuals to have the power to keep issues confidential is critical to their security, because it allows them to deny information to threats.

In security jargon a threat is a person capable to doing damage to a target by theft, destruction, or other means.

For example, if a person is the potential target of a theft or assault, they would be wise to keep their location confidential. They could reduce their risk by not disclosing their possession of items that would attract a thief, like jewelry or large amounts of cash.

A person who might be at risk of discrimination because of their nationality or religion may decide to keep that information private.

There are many good examples of how keeping information private provides reduction of risk (in turn greater security) and those questions are accepted here as long as they related to IT.


How is the iOS KeyChain master key derived? I'm no expert but I'm assuming that on OSX it's derived from the user account password. I'm more than open to the possibility of that being incorrect.

On iOS there is no user account password, only a PIN. Passwords and PINs are both optional, but are they used in generating the Keychain key? If not, is the key just stored somewhere on the device?

Apologies if I've completely misunderstood how this might work.

See these slides for an introduction on data protection on iPhones (presumably, iPads are similar). At the core of the system, there is a device-specific key called the UID-key; it is stored in the CPU itself and each CPU has its own. From that key are derived other keys, including the one used for KeyChain; the user's passcode is also used in the key derivation. The CPU is assumed to be tamper-resistant, which means that you should not be able to extract the UID-key from it. If you access the hardware directly, you can make the CPU use the UID-key, but any brute force attack on the passcode will need to go through the actual CPU.

To sum up, breaking through an iPhone's KeyChain is feasible, but at the cost of an exhaustive search on the PIN code which must use the actual iPhone CPU (so it is not offline). Of course, we are most interested in KeyChain's resistance precisely if the iPhone was stolen, in which case the attacker has access to the hardware.


Why are the following two sets of ciphers "different"? openssl ciphers -v 'ECDH+AESGCM:DH+AESCGM' gives:

ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDH-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDH-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDH-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(128) Mac=AEAD
ECDH-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(128) Mac=AEAD

whereas openssl ciphers -v 'DH+AESGCM:ECDH+AESGCM' gives

DH-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(256) Mac=AEAD
DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(256) Mac=AEAD
DH-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
ADH-AES256-GCM-SHA384   TLSv1.2 Kx=DH       Au=None Enc=AESGCM(256) Mac=AEAD
DH-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(128) Mac=AEAD
DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(128) Mac=AEAD
DH-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
ADH-AES128-GCM-SHA256   TLSv1.2 Kx=DH       Au=None Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDH-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDH-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDH-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(128) Mac=AEAD
ECDH-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(128) Mac=AEAD

Indeed, using the former will make SSLLabs not "find" for example the cipher suite "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)". It does however work with the latter, four cipher suites in total are found:

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)   DH 2048 bits   FS  256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)   DH 2048 bits   FS  128
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS    128

However it seems that in that case the more unsecure ciphers are listed/used first.

How can this be explained?

openssl ciphers -v 'ECDH+AESGCM:DH+AESCGM' gives:
  ...
  whereas openssl ciphers -v 'DH+AESGCM:ECDH+AESGCM' gives
  ...

Both cipher lists have ECDH+AESGCM in common. But the second cipher list has DH+AESGCM whereas the first has DH+AESCGM - i.e. GCM vs. CGM.  There are no DH+AESCGM ciphers thus the first cipher list only contains ECDH+AESGCM.


How does zeroing out/wiping your disk before encrypting it increase op-sec? I'v been doing some research and it seems it is recommended to zero out / wipe / overwrite the disk before full disk encryption.

Why would that be necessary even when encrypting the entire disk?

I think one source of confusion is about the order of operations. This page may help (or not).

Basically, this comes from a situation where the encryption is about to be applied on a complete, logically empty partition. Applying the encryption is easy because you just have to ask the OS to thereafter apply encryption whenever it is going to write something on the disk. However, there is no preparatory step for existing partition contents: these are all unused sectors anyway, so nothing will read them in the course of normal file management.

If the partition contained non-random data, then sectors that have been written to are encrypted and "look random", while sectors that have not been written to yet retain the bytes that were originally there, i.e. the non-random bytes. Observers may then infer which sectors have never been used. Whether this gives them any advantage is anyone's guess, but it seems that it is sufficient for some people to panic a bit and ask for a preparatory wiping.

The point of such a "wiping" is to populate the physical disk with bytes that will be undistinguishable from encryption output, i.e. they must "look random" since encryption output is supposed to en undistinguishable from random bytes. There are two main methods for that:

You overwrite the complete partition with random bytes (e.g. from /dev/urandom) before you apply the encryption.
You overwrite the complete partition with arbitrary data (typically zeros, because /dev/zero is there and just begs to be used) after you enabled encryption, because then the write on the physical medium will be done with encrypted data, that really looks like encrypted data, which was the point.


Problems accessing websites in Netherlands I have problems accessing certain websites in Netherlands, I have tried using several VPN, RDP, SOCK5(Vip72), Epic privacy browser. By the way i am in Asia (Malaysia). I used to be able to access it with VIP72, and changing my mac address with a mac spoofer. But doesn't work anymore for Netherlands, but for other EU countries.

My questions are;

whats the best way to access blocked websites? I read an article here about setting up a vpn on a vps, but I don't think that will do any good.
i also read about 4g/3g mobile data rentals? but is too expensive considering i just need to surf certain websites.

I believe those sites are detecting you have a VPN or proxy in place, and responding accordingly. It haven't anything do to with the country, but the site administrators.

  changing my mac address

This is irrelevant. You MAC address don't leave your local network anyway.

  I read an article here about setting up a vpn on a vps, but I dont think that will do any good

It can work or not, depending on the site administrators. If they detect your IP is from a range used by a VPS company, they can block you. You can rent a VPS on a small, cheap and unknown provider for a month and test. You can find hosting for a dollar a month, so it's worth testing.

You can try any VPN provider too, most of them have a free tier, or a trial period  when you can test the service and cancel without being billed. You can try those too. They are easier than to setup and maintain your own VPN, but are more expensive. On the other hand, maintaining a VPS can be very educative.


Plausible scenario for a PHP session fixation attack with default settings? Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings.

Given session.use_only_cookies's default value is On, an attacker cannot just use a GET request. What are other options? Javascript will require both session.cookie_httponly to be Off and also a working XSS. The only other way I can think of is a script on the site but if we already have a shell, why bother with sessions?

I am not arguing against the use of session_regenerate_id() but an impressive example demonstrating why it's an absolute necessity always helps.

The only other way I can think of is a script on the site but if we already have a shell, why bother with sessions?

You wouldn't. If you have code exec, there are worse things you could do.

But an attacker isn't the only one who can write code. I have seen code similar to this a couple of times in PHP applications:

  session_id([userinput]);

This then introduces a session fixation vulnerability. If session_regenerate_id were used on login, it would at least reduce the impact.

  Javascript will require both session.cookie_httponly to be Off and also a working XSS.

If you have XSS, there are worse things that can happen than session fixation.

But as with the PHP code example above, one could imagine JS code from the application reading a user-supplied value and setting it as cookie. You might also have a limited XSS issue which eg only allows injection in a meta tag, via which you could eg set cookies.


What would it take to scan a PDF for questionable content in addition to malware? My company is trying to implement a new feature on our site to let customers load documents accompanying an order. We know that we will need to perform some kind of malware scan by calling out to a service. However, my boss has also asked for the scan to be performed for questionable content which could wind up on our servers if not caught. The files in question would be PDF format. My gut tells me this is a significant increase in complexity, as the system would need to decipher the content of each PDF file. Is there anything out there that does this today, and what would the system do in order to achieve this?

There are a few frameworks that come to mind for this. Mastiff, Viper, and IRMA. All are meant for reverse engineering, and analyzing malware so any will need some customization to run. For example:

Out of the box install:

client  --> uploads file to system
system  --> system sends it to one of the above
program --> analyzes file creates report

You would need to do something like the following:

client  --> uploads file to system
system  --> system sends it to one of the above
program --> analyzes file if malicious delete/quarantine/etc
program --> analyzes file is not malicious send file to your org

This can be done with some work otherwise this becomes a "vendor" specific question: "What product can..." which is off-topic here.


Security Certificates - Tools to Generate Security Certificates I want to create a self-signed certificate that will be installed as a trusted certificate authority.

I then want to create another two certificates which are signed using the private key of the self-signed certificate.

What tools can I use to do this?

I have used Visual Studio's makecert tools but it is a bit limited in that it does not allow you to specify the organisation name and other details.

What other tools can I use?

openssl is a very good command line tool that I have used to create self signed certificates. This will allow you to specify the values for each and every field in the certificate and it is available for both Linux and Windows.

basically you can create a self signed certificate using openssl in just one command

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out mycrt.pem -days 1000

This command will generate a keypair and a certificate with a validity of 1000 days.

You can become your own CA (of course your certificates will not be recognized/validated by browsers) and use this self signed certificate to sign other certificates for your personal use.This process will involve following steps using openssl.

Generation of CSR- Certificate Signing Request
Signing the request (as a CA) by using your self-signed certificate
import the CA certificate in the browser under trusted CAs.

here is a good tutorial on creating your own CA model.


Security risk of opening port 111 (rpcbind)? As far as I understood rpcbind is used for listing active services, and telling the requesting client where to send the RPC request. If a host listens on port 111, one can use rpcinfo to get program numbers and ports and services running; For example look at below:

root@bt:~# rpcinfo -p x.x.x.x

program    vers   proto     port

100001    2   udp    111  portmapper
100000    3   udp    111  portmapper
100005    3   udp   1048  mountd
100022    1   tcp   1047  nlockmgr
100021    4   udp   1047  nlockmgr
100026    1   tcp   1039  status
100029    1   udp   1039  status
100003    2   tcp   2049  nfs
100003    3   tcp   2049  nfs

What is the security risk of it?

Where we usually need to open port 111 and when can we close it without any other services fail?

If you expose this service to the internet, everybody can query this information without having to authenticate. It can be useful to attackers to know what you have running.

Also, the RPC service has a history of security vulnerabilities. So don't expose it to the world unless you have to.


How to slow down program execution I have a simple executable binary. It takes as input a user supplied string and compares it with a private string using strcmp. How can I slow down the execution of this program such that I can launch a statistical timing attack on the string comparison? Currently the early-exit nature of strcmp is too slight to detect.

Assume I have local privileges, the binary is owned by another user, and the system is ulimit protected against fork bombs.

While I get that I could use the strings command or reverse engineering to get the private string, this is intended as a POC for the feasibility of timing attacks on compiled programs on modern systems.

As long as the binary is linked dynamically, you should be able to LD_PRELOAD it with custom strcmp implementation which you can hack to be more "cooperative" with timing attack.

If the binary is linked statically, you'll have to use some more precise time measurement - perhaps utilise HPET somehow?


Where to store a server side encryption key? I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely store it?

Here are your possibilities, roughly in decreasing order of sophistication.

Use an external Hardware Security Module. There is an entire industry of products designed for offloading security-sensitive operations to external devices. This doesn't solve the problem so much as relocate it, but it relocates it to device that is far more secure, so altogether it's a security win. If you're doing anything high-stakes, then this is almost certainly going to factor into your solution.
Tie the encryption to your hardware. In theory HSMs do precisely this, only we tend to expect a bit more sophistication from an HSM than just hardware-backed crypto. But there are cheaper options available if you don't need the throughput and compliance that a true HSM brings to the table. TPM chips were invented in part for this purpose, and many examples exist showing how to integrate with them. Additionally, dedicated crypto hardware has become fairly inexpensive, and re-purposing devices like Open-Source U2F Keys for this is simpler than it sounds.
Tie the encryption key to your admin login (e.g. encrypt the the encryption key with your admin login). This is only marginally useful as it requires you to be logged in in order to encrypt/decrypt anything. But on the plus side, no one can encrypt/decrypt anything unless you're logged in (i.e. greater control). Much of the secure storage in Windows works like this.
Type in the encryption key when you start up, store it in memory. This protects against offline attacks (unless they capture the key out of RAM, which is tougher to do). Similar to the option above, but also different. However, the server boots into an unusuable state, requiring you to manually supply the key before work can be done.
Store the key on a different server. E.g. put the key on the web server and the encrypted data on the database server. This protects you to some degree because someone would have to know to grab the key as well as the database, and they'd also have to have access to both servers. Not amazingly secure, but an extremely popular option anyway. Most people who think they're doing it right do it this way. If you're considering doing this, then also consider one of the first two options mentioned above.
Store the key elsewhere on the same server. Adds marginal security, but not a whole lot. Most smaller operations do this -- they shouldn't, but they do. Typically because they only have one server and it runs in some cloud somewhere. This is like taping a key to the door instead of leaving it in the lock; guaranteed to stop the most incompetent of attackers.
Store the key in the database. Now you're not even trying. Still, a depressingly popular option.

Many cloud-based KMS solutions (e.g: AWS, GCP, Azure) when used most effectively will bind your encryption to your cloud VMs or environment. The unique identity of your VM is easy for the hypervisor to establish and assert, and the KMS uses the combination of that identity and the permissions you've assigned it to allow access to an HSM-managed encryption key. This is similar to a combination of options 1 and 2, modulated to account for the ephemeral nature of Cloud VMs. These KMS solutions generally also are compatible the platform's other identity mechanisms, effectively tying encryption keys to login keys; a lot like option 3.


Authentication vs. Verification in General and with Biometrics I am reading The Basics of Information Security, 2nd. Ed., Andress, Jason.

He says on p.25, "Identity verification is a step beyond identification, but it is still a step short of authentication, which we will discuss in the next section." He then goes on to mention that even if documents proving who one are presented that that is only "verification" and not "authentication." Okay, but he never discusses "verification" again in detail.

On p.26 he says that, "Authentication is, in an information security sense, the set of methods we use to establish a claim of identity that has been made is correct." Okay great.

On p.31, he says, "When we complete an authentication transaction with a biometric identifier, we are essentially asking the user to provide evidence that he or she is who he or she claims to be; this by definition, verification, and not authentication." Now I am lost.

I have researched more on the difference between "verification" and "authentication," but just don't know where the crucial, and I assume subtle, difference is.

I know that there are two types of biometric authentication, verification that the data matches the data of the person that the presenter says he is, and identification, where an attempted match is tried against all entries in the biometric database.

How can presenting per-enrolled biometric info be anything other than authentication?

Verification is the act of proving your identity. Authentication is the act of proving you are the same person as before, without necessarily knowing who that person is.

re: Biometrics, I think the confusion comes down to the nature of biometrics. A username/password (something you know) says nothing about who you are. The same is true of a hardware token (something you have).

The author of the book you are reading is of the opinion that since biometrics are something you are, they are indistinguishable from a verification event.

This is not always the case for at least two reasons:
1. Presenting your biometric will be compared to the pre-enrolled biometric. This says nothing about who you are, only that you are the same person as was present at enrollment.
2. The data stored for a biometric may be less than that required for a verification event. If the system fails to identify you it can't just go and get extra samples, which you could if you were performing a verification.

Consider the use of biometrics to protect the privacy of data. A system might take a biometric to protect data that you have entered so it is only shown to you when you return. If this system does not tie the biometric to an identity through a verification process, the biometric is just as much an authentication factor as a password issued for the same process.


Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext? Do passwords (or PINs) used for authentication of operators of a cryptographic module have to be protected (encrypted) when entered into the FIPS140-2 defined cryptographic boundary? Are the requirements for entry of PINs and passwords equivalent for all FIPS140-2 security levels?

Yes, authentication data can be entered in plain text. That is, in fact, usually the case: a very common type of authentication is that a human types the password on a keyboard or similar device. In most settings, there would be no way to protect the password: you would need another cryptographic module for that, which in turn you'd want to certify under FIPS 140…

You must take care that the authentication data cannot be leaked at the point of entry. This is embodied in rules about feedback provided to the operator entering the data (§4.3.3):

  Feedback of authentication data to an operator shall be obscured during authentication (e.g., no visible display of characters when entering a password).
  Feedback provided to an operator during an attempted authentication shall not weaken the strength of the authentication mechanism.

The security level does not affect the rules regarding entry of authentication data, nor even the rules about authentication strength (at most 10-6 probability of one random attempt succeeding, at most 10-5 probability of succeeding with random attempts in under 1 minute). The security level only affects what kinds of authorization model the authentication data must be provided for (none at level 1, role-based at level 2, identity-based above that).

There are no additional requirements when initializing the authentication data (as in setting a password).

Once entered into the module, the requirements on authentication data vary depending on the security level (§4.6.1):

Level 1 doesn't put any requirements on authentication data even if it is present.
Level 2 requires that all attempts to access or modify authentication data be logged.
Level 3 requires that authentication data be communicated through a trusted mechanism.

No cryptography is required at any point: the authentication data can be protected by physical means alone. The requirements on stored authentication data are (from §4.3.3):

  Authentication data within a cryptographic module shall be protected against unauthorized disclosure, modification, and substitution.


No SMS Spoofing attack vector in Kali Linux! I just realized that there is no SMS spoofing attack vector included in the latest version of Kali Linux. Is there a work around?

They took it out. You will need to find an old version of the SET kit or an older version of KALI. However the SMS spoofing will fail unless you can find a SMS gateway to use and most will cost money.


How do programs like keepass protect their data even when it's loaded into RAM? After noticing the feature in Keeppass having the option to "Enable in memory protection" I began wondering, how can memory be encrypted and still be useful?

Without going into homomorphic encryption how does the OS actually use APIs to protect memory content? I find the wikipedia artical to be lacking of technical details of how it works. Obviously before something is used it must be decrypted so how does this work?

I believe the answer can be found here, under the 'Process Memory Protection' section.

The first part:

  While KeePass is running, sensitive data (like the hash of the master key and entry passwords) is stored encryptedly in process memory.

This describes the data that is stored in RAM that is encrypted, which it can do, as this data is never displayed in it's raw form to the user.

And the second part relating to your actual passwords and usernames:

  Additionally, KeePass erases all security-critical memory when it's not needed anymore, i.e. it overwrites these memory areas before releasing them (this applies to all security-critical memory, not only the password fields).

This describes that your passwords are not actually encrypted whist in RAM, but are erased and the memory freed as soon as they are no longer required.

It is a little confusing that they say 'In memory protection', because as this documentation proves, this doesn't necessarily mean 'encrypted'.