When should you give up on attempting a xss on part of a website? I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?

I have just begun, so what I look for when testing an XSS and determining it's properly sanitized is, when they encode input like (! @ # $ % ^ & * " '( ) > <) with HTML entities, That's really it.

It depends on how you are contracted for the test. If you work on the program anyways, then you can try as long as you feel that it gives you any value.

If you work is restricted by a certain amount of time, then I would say use your gut feeling to judge if this is the best you could spend your time.

I know this is probably not the answer you want to hear, but it really depends on the specific instance, and it's not really possible to make a general statement. Depending on your guidelines for reporting, you might be able to report that you believe that a certain output is not encoded properly, but you did not have enough time to fully develop a Proof-of-Concept.


Is it worth storing email addresses as hashes? If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes.

Is it worth storing email addresses as hashes too?

Generally speaking, you shouldn't ask and hold user data (especially PII) that you don't need, this is even more true now under GDPR (if it applies in your scenario) but it's always been the case in security. The lesser the data, the lesser the risk.

When you hash passwords, you lose knowledge about its plaintext version and the fact that you're asking whether it's worth hashing emails as well as passwords, makes me think that perhaps you don't really need that information in the first place.

That being said, if you do need emails (for other purposes than logging) then you can't hash them as you would lose that information by doing so.
In that case I'd instead recommending encrypting/authenticating your data using AES/HMAC or Chacha20/Poly1305 or similar.

Another approach would be to use PAKE: no emails, no passwords and no need to transfer them over the Internet! An example of this can be SRP or OPAQUE.


TLS 1.2 Missing Finished Message I'm setting up a TLS connection for the purposes of sending secure SIP. The remote gateway (Twilio) doesn't always send a finish message and as such those requests fail. Everything else appears to match between successful and failing messages.

My question is whether I can safely say that this issue is definitely with the remote provider, rather than something that can be fixed on the client side.

Working:

Failing:

Is this perhaps a typical scenario which I am not familiar with, perhaps an attempt to re-use an old session or similar? Any advice would be very much appreciated, i'm really looking for confirmation that I'm reading this correctly.

Thanks for taking a look!

Although I am still interested in any additional information the community can provide I am happy to report that the issue has been mitigated through a client modification.

I'm using OpenSIPs 2.3 which provides TLS via a module tls_mgm. This module has a setting for handshake timeout which defaults to 30 although I am running with 60. The docs state that this value is in seconds however the developers have confirmed that in fact the value is in milliseconds.

Increasing this timeout to 500ms has stopped these issues. My use of a high strength cipher is likely responsible for the upstream device incurring a delay when calculating its handshake key so its reasonable for us to run at this value - you can't put a price on security!


Authentication for Mobile Devices I am looking for ways to Authenticate on a mobile device.

The mobile application is connecting to a WCF Service which in turn connects to a Database. Before the application retrieves any information from the WCF Service I will need it to authenticate against a different server which would use AD Records to confirm the access.

I have found the following MSDN and a previous SO Question but these are both outdated.

If anyone has a more up to date source of information or is able to provide some I would be more then grateful.

This looks like more of a web-programming question than security  question, but my answer is that you would do it similarly to any other authentication request, namely with a username and password as part of the initial web request. You could follow this link on c# mobile authentication, specifically in the context of RESTful services (the answer seems to give starting points for multiple methods though, one of which should be suitable for your application) as a start.


Windows 7 RDP exposed to Internet We are hosting a Windows 7 desktop Pro on a KVM machine, where a legacy software which does not run on a Windows Server 2008-16 is hosted. We are exposing it to Internet as users need to login once in a while via RDP and connect to the machine.

It has a very low intermittent use, but we need to keep the machine live 24x7. Problem is there are several security issues associated and we are not aware of many.

Can someone advise what we will need to be doing?

We are running RDP on a different port. We have FailBan and Firewalling on the Main Server, DDOS is enabled by the Data Center. Windows Firewall is enabled.

But what else do we need to be doing?

I think your safest bet is to provision a TS Gateway server and stand it up in front of your Windows 7 box.

TS Gateway allows for the connection to remote desktop devices over a TCP 443 port connection as opposed to an RDP port directly connected to the internet. I have implemented several of these with my clients and have noticed dramatic decreases in brute force attempts (even on boxes with RDP listening on a non-standard port).

The second option I would recommend would be to put the RDP server behind a VPN connection. Get your employees to VPN into your network, then have them log in to the RDP box.


Weird group name ( 1002) Please forgive me if this is the wrong place to ask this, but I ran ls -l on an ubuntu machine today in /etc and found a few entries like the following middle entry which appears to have spaces in front of the GID.

-rw-r--r-- 1 root root      92 Apr  9 11:10 host.conf
-rw-r--r-- 1 root   1002    25 Aug 13 05:26 hostname
-rw-r--r-- 1 root root     116 Aug 13 05:26 hosts

Tried to run a few different commands to get the group name from the GID like:

getent group %20%201002 | cut -d: -f1

and

getent group \ \ 1002 | cut -d: -f1

But nothing.

Read up a little on Linux GIDs and POSIX says this shouldn't be possible.

Is this something to be concerned about security-wise?

And can someone perhaps offer an explanation?

Google doesn't seem to know anything about this.

Thanks in advance.

That hostname file is owned by group ID 1002, and there is no entry in /etc/group mapping any group name to GID 1002, so ls -l simply shows the group number instead of a name.  And when a bare GID is displayed, unlike a named group, it is right-justified, making it look like it has leading spaces compared to any longer group names.  Here you can see with three files that I created and gave user/group ownerships that would demonstrate this:

$ ls -l foo*
-rw-r--r-- 1 gowenfawr          1002 0 Aug 23 01:29 foo
-rw-r--r-- 1 systemd-resolve nogroup 0 Aug 23 01:30 foo2
-rw-r--r-- 1 gowenfawr       cdrom   0 Aug 23 01:33 foo3
$

There's no particular security concern here, except perhaps that somehow your /etc/hostname file got it's group ownership changed.  You might want to search for any users which belong to that group:

$ awk -F: '$4 == 1002 {print $0}' /etc/passwd

and you might want to search for other files with that group ownership:

$ find /etc -gid 1002 -ls
   136023      4 -rw-r--r-- 1 root   1002    25 Aug 13 05:26 /etc/hostname

If you were to find that, say, /etc/passwd and /etc/shadow were owned by 1002, that would like indicate a serious security concern.

If, as you comment, /etc/resolv.conf and /etc/network/interfaces are also owned by that file, then you almost certainly have a DHCP client or other network manager that is managing those files and setting the group ownership to 1002 when it updates them, likely in response to a configuration file that says to use GID 1002.  A blunt way to check for this would be

$ grep -r 1002 /etc/*

but that may have a false positive or two.  If you find a networky named config file with an entry like "group = 1002" then that's your culprit :)


Extract the content of PKCS7 file in Java I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file.

Anyone know how to do that in java ??

Finally I did it with BouncyCastle library.

PKCS#7 is a complex format, also called CMS. Sun JCE has no direct support to PKCS#7.

This is the code that I used to extract my content:

// Loading the file first
   File f = new File("myFile.p7b");
   byte[] buffer = new byte[(int) f.length()];
   DataInputStream in = new DataInputStream(new FileInputStream(f));
   in.readFully(buffer);
   in.close();

   //Corresponding class of signed_data is CMSSignedData
   CMSSignedData signature = new CMSSignedData(buffer);
   Store cs = signature.getCertificates();
   SignerInformationStore signers = signature.getSignerInfos();
   Collection c = signers.getSigners();
   Iterator it = c.iterator();

   //the following array will contain the content of xml document
   byte[] data = null;

   while (it.hasNext()) {
        SignerInformation signer = (SignerInformation) it.next();
        Collection certCollection = cs.getMatches(signer.getSID());
        Iterator certIt = certCollection.iterator();
        X509CertificateHolder cert = (X509CertificateHolder) certIt.next();

        CMSProcessable sc = signature.getSignedContent();
        data = (byte[]) sc.getContent();
    }

If you want to verify the signature of this PKCS7 file against X509 certificate, you must add the following code to the while loop:

// ************************************************************* //
// ********************* Verify signature ********************** //
//get CA public key
// Create a X509 certificat
CertificateFactory certificatefactory = CertificateFactory.getInstance("X.509");

// Open the certificate file
FileInputStream fileinputstream = new FileInputStream("myCA.cert");

//get CA public key
PublicKey pk = certificatefactory.generateCertificate(fileinputstream).getPublicKey();

X509Certificate myCA = new JcaX509CertificateConverter().setProvider("BC").getCertificate(cert);

myCA.verify(pk);
System.out.println("Verfication done successfully ");


How is HMAC better than MAC? I was recently studying about Message Authentication Code (MAC) and Hashed based Message Authentication Code( HMAC).

What I understood is MAC takes the message and a shared secret key and applies the MAC algorithm and the output is appended with the original message and sent to the server and the server uses the same key, message and applies the MAC algorithm and matches the output of the algorithm with the one appended to the packet received. If both of them matches then the data is not tampered and comes from a good source.

While in the HMAC, the message is hashed using MD5 or SHA algorithms and the output of the hash is appended with the shared key and again hashed and this output is appended with the message and sent to the server and the server also uses the same methods to see if the message is tampered or not.

But how is HMAC better than MAC? it just includes another round of hashing.

HMAC is an implementation of MAC.

MAC is just a name given to tools that authenticate messages.

HMAC is the name of an implementation of a MAC system using hash functions.

So there is no better one since 'a cryptographic hash function is only one of the possible ways to generate a MAC'.

Edit: see also this SO question over on crypto


Are there any exploits that would allow a user to "spoof" a screen capture system? We have a security system installed that takes pictures of the client user's screen and sends them to a server. The pictures are saved until they get to the point where they are old enough to be deleted. It's been useful for an investigative tool when we need to find out if a user has been up to suspicious activity. The majority of our users on our network are standard user accounts with no special access. With our machines being primarily Windows 7.

As an administrator of this system, I was wondering if this can potentially be "spoofed". As in, a user can exploit the client to send pictures of what he/she desires.

Edit : I'm referring to the user being able to exploit the system and send the image they want sent while doing something else. I'm not referring to being able to create a window in full screen mode.

If you're asking if a user could display an arbitrary screen, then yes.  Any software that can display a full-screen image (ie: display an image not in a window, but that displays over the full real-estate of the screen) is capable of spoofing your system.  Most photo editing software can do this, as can pretty much any video playback software, or even web browsers.  I could photoshop up a credibly accurate image of a normal desktop with whatever else I wanted to display. If you are asking if the user could cause the capture system to capture one image while the same user was actually doing something else, then this depends on your image capture software. Without administrator privileges, probably not directly on the workstation.  I would probably have to attack the system by hooking up one of my own computers to the network and intercepting the network requests of the server to the client.  It probably wouldn't be too hard for me, if I had access to your network, to hook up a laptop and sniff your network to find out the protocol your central server is using to request screenshots, and then build some software that responded as if it were one of the workstations and give back an image of my choosing.  Your system needs to do bidirectional authentication with some sort of protocol that is not subject to man-in-the-middle attacks, like SSL.


What is the NIST/FIPS publication process? How long does it usually take for drafts to become final? I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is.
Is it all internal to NIST with just the Public Comment Period being the only transparency we get in the process?

If I'm not mistaken, starting last June, all testing was to go through NIST's Automated Cryptographic Validation Protocol (ACVP).
An overview is available here, and more information is published on GitHub.
I think this provides some transparency into the process, though I'm not sure this is the kind of public/transparency you where asking about.
Cheers,


Where is Bitlocker encryption key stored in USB? I have a USB that contains the Bitlocker key. When I open USB I dont see any files inside. How can I move the Bitlocker key to another USB?

Have you checked hidden files?

"The key will be saved to the USB drive as a hidden file with the .bek file extension. You can see it if you show hidden files."

Source -- https://www.howtogeek.com/262744/HOW-TO-USE-A-USB-KEY-TO-UNLOCK-A-BITLOCKER-ENCRYPTED-PC/

(Doesn't look like this is a duplicate)


Is it okay to keep Windows 7 for gaming only? I have some games which work on Windows only, but I don't want to buy a new Windows, I would rather keep Windows 7 as a second OS for gaming and use Linux or BSD for working, browsing, etc. As far as I know vulnerabilities in multiplayer game clients are very rare, so there is only a very low chance that somebody hacks the system while I am gaming. Some people argue that it is a massive security risk that I keep an EOL OS even though I would not use it for browsing, just for playing the old games I downloaded from safe official sources. I don't agree, because I don't think such a system has a big attack surface, but I am curious what do experts say?

update based on the comments

Looks like game clients are not safe at all:
https://www.networkworld.com/article/2166509/researchers-find-critical-vulnerabilities-in-popular-game-engines.html

Still this is not a Windows 7 related issue, I guess Windows 10 can be hacked through these game vulnerabilities too. So the question remains, for this specific game only usage does Windows 10 give any security advantage over Windows 7 and if so what?

From a general perspective it is safe enough.

I know that many times you will have to run an old OS due to compatibility issues with software, in your case - games. I still practically use XP due to that in some scenarios and I do that in a very safe manner.

In your case things may be easier than average: on the online gaming part you can allow only the ports used by the gaming services/servers and you can secure everything else. You may even close-up browsing-related capabilities completely or block most of the TCP ports with very few exceptions.

In this one should not take game vulnerabilities into account since those are not breaches of the OS, but of the games. On the OS part you should be pretty good overall for many years ahead.

In the specific situation of Windows 7, things are looking good. There are still 2 more years of actual support of it (see the MS descriptions about this) and by the end of this period Windows 7 will already have a low enough coverage not to be a primary target of exploiting anymore.

Even if universal exploits are found (that are cross-versions and affecting any Windows OS) most of them will still be able to be community patched.

So I would not worry. Gaming on Windows 7 will still be good for years and the obvious choice of old enough games. Even if groups like GOG try to make most games work with Windows 10, older ones will work better on older OS'es. For a specific older game, you won't have any advantage whatsoever by using Windows 10 from a security perspective or any other.


Securely access OwnCloud & MediaPortal I have a NAS containing media and user files encrypted on disk. I will be running FreeNAS 9.x as my operation system, OwnCloud and SABnzbd "in jail". OwnCloud will use SSL, of course. I also have a HTPC (Home theater PC) on my network, that runs MediaPortal and will be accessible from the Internet using AMPdroid.

I would like to have everything accessible from the Internet, but in a secure way.

What am I required to do, besides using SSL on OwnCloud?

Keep all software updated. That includes your OSes and Owncloud. If there's a security update for any of the software, install it.
Run everything behind a NAT device, such as a router, and open only necessary ports on the router. You'll have to check the relevant documentation for what ports need to be forwarded, ie. opened on the NAT device. As an additional precaution, if the services allow you to specify ports to run them on, change them from the defaults to prevent automated scripts from attempting to hack your servers from the Internet.
Set strong passwords for all logins to the devices. That means no password reuse and having adequately unpredictable and long passwords. There are good guidelines on the web on how to set good passwords.
If possible, restrict access to all these to the local network only, and use a VPN such as OpenVPN to connect to the network hosting all these servers. That way, you only need to forward the OpenVPN port on your router and you'll be able to connect to these services only after connecting to the VPN.
Do a check on the settings of the server software, and lock down. Disable unnecessary settings such as UPnP.
Enable access logging on the servers and check them regularly for signs of intrusion.


How to setup a Virtual Wireless Router? I need to teach some students about cracking WEP and WPA passwords, as I don't have a real wireless router to use, is there any VM that I could use to simulate a wireless network? Like a Virtual Wireless Router?

I tried to use airbase-ng on my Kali Linux, but it's proven to be kinda confusing (for some reason, other machines can never connect to the network). I also tried to setup a windows machine, but it only allows to share internet with WPA2 (not open network nor WEP)

You can!

Linux has a pretty versatile WiFi driver framework for WiFi cards that do most of the WiFi handling in software (most of the cards these days).

A top of that framework (mac80211) the individual device drivers talk to the cards.

Or, a dummy driver, https://wireless.wiki.kernel.org/en/users/drivers/mac80211_hwsim , talks to an internal virtual card. You can have arbitrarily many of those attached to the same virtual ether for simulation purposes.

You could run a hostapd impending an access point on one of these virtual cards, and simulate arbitrarily many other cards that use that virtual WiFi. Tadah! Wrap all in a script, and deploy to the students' Linux PCs. They all get their own virtual networks simulated on their own PC.


Restrict mobile phones to specific Access Point (WIFI Router) Is it possible to restrict the access of android phones, iphone, and MS phones and tablets to a specific AP?

I want the corporate mobile device to only be able connect to one specific AP (the corporate WIFI LAN) and I don't want the user of the device to be able to change this.  These are not personal devices (not BYOD).

If the question isn't perfectly clear, I mean that the mobile devices listed should only be able to connect to one wifi router and no other wifi router / access point should be connectable to device by any action the end user takes.

I know using Apple Configurator it is possible to set a restriction on managed devices to "Join only Wi-Fi networks installed by a Wi-Fi payload" which effectively limits the SSIDs the device can connect to, and the authentication methods to use.

This comes with the obvious health warning that, if the network the device is restricted to goes down or is unavailable/misconfigured, you will be unable to manage the device.

https://help.apple.com/configurator/mac/2.5/#/apdf01626ea7


gpg --fingerprint prints out completely different fingerprint When displaying the full fingerprint of an OpenPGP key, it get a completely different one compared to the ID.

For this specific key:

$ gpg --list-keys --fingerprint D72AF3448CC2B034
pub   rsa4096 2017-02-09 [SC] [verfällt: 2027-02-07]
      F554 A368 7412 CFFE BDEF  E0A3 12F5 F7B4 2F2B 01E7
uid        [ unbekannt ] OpenVPN - Security Mailing List <security@openvpn.net>
sub   rsa4096 2017-02-09 [E] [verfällt: 2018-03-06]
sub   rsa4096 2017-02-09 [S] [verfällt: 2018-03-06]

For other keys, the fingerprint matches the ID, just as expected:

$ gpg --list-keys --fingerprint 57DB9DAB613B8DA1
pub   rsa4096 2016-08-23 [SC] [verfällt: 2026-08-21]
      7ACD 56B7 4144 925C 6214  3297 57DB 9DAB 613B 8DA1
uid        [ unbekannt ] David Sommerseth (OpenVPN Technologies, Inc) <davids@openvpn.net>
uid        [ unbekannt ] David Sommerseth (OpenVPN Technologies, Inc) <david.sommerseth@openvpn.net>
uid        [ unbekannt ] David Sommerseth (OpenVPN mailing list ID) <openvpn@sf.lists.topphemmelig.net>
sub   rsa4096 2016-08-23 [E] [verfällt: 2026-08-21]
sub   rsa4096 2016-08-23 [S] [verfällt: 2021-08-22]

Is this normal? Can anyone explain to me, why the fingerprint is completely different?

GnuPG generally resolves subkeys to the primary key if a subkey is passed as argument. This might be especially surprising when specifying an encryption subkey: GnuPG resolves the subkey to the primary key, and might actually choose another subkey for encryption (selecting the newest encryption subkey).

For listing a key, this is always performed, for some operations like encryption you can append ! to the subkey's ID (ie. D72AF3448CC2B034) to explicitly select this key and disable the primary key lookup.

To display subkey fingerprints on the command line, apply the --with-subkey-fingerprints option:

$ gpg --list-keys --with-subkey-fingerprints D72AF3448CC2B034
pub   rsa4096/0x12F5F7B42F2B01E7 2017-02-09 [SC] [expires: 2027-02-07]
      F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7
uid            [ unknown] OpenVPN - Security Mailing List <security@openvpn.net>
sub   rsa4096/0xF80E8008F6D9F8D7 2017-02-09 [E] [expires: 2018-03-06]
      E6CAF699521B9B5E57A5C31BF80E8008F6D9F8D7
sub   rsa4096/0xD72AF3448CC2B034 2017-02-09 [S] [expires: 2018-03-06]
      B59606E2D8C6E10B80BE2B31D72AF3448CC2B034


How can I test a domain that I don't own for unencrypted communication vulnerabilities? I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security features like this?

A browser should do it.   If the login page is HTTP rather than HTTPS, then you already have a problem as even if the credentials are supposed to be passed over HTTPS, an active attacker could modify the login page to change the action, or perform other additional malicious actions.

To determine if even in the designed state credentials are being passed in the clear, just view the source of the login page in the browser.  If the login form action is HTTP://, or if the login page is HTTP and the action is relative or schemeless, (relative looks like action="/process-login" and schemeless looks like action="//insecuresite.com/process-login") then credentials are indeed being passed in the clear.

You can also use the "Network" tab (or equivalent) in your chosen browser's developer tools, often accessed via F12 to examine the actual request to determine if it is HTTP or HTTPS.


Exploitation of client_id in OAuth We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get the Authorization code, which in turn is used to get the Authorization token. In the Authorization endpoint, part of its input parameters is the client_id. Its the identifier for the components that wants to access the resources (e.g. mobile app, web app).

In this case, is the client_id stored in the browser? How would we know where it is stored?
What if a user of the web app was able to successfully authenticate then using OAuth, was given authorization to access the APIs via the web app, but after he uses his machine, the next user was able to get hold of the client_id in the browser. Would he/she be able to access the APIs?

I am asking both since we recently subjected our app to penetration testing and the testers had a lot of issues on the client_id. They said this can be guessed via enumeration and when guessed, can be used to access your resources. Also, if stored in the browser (if your app is a web app), and you're using a public computer, other people can get this and use this to access and use the APIs that your web app uses (if they know what their urls are). I'm confused if this are really valid issues.

Where is the client id stored depends on the architecture of your web application. OAuth 2 defines two client types - public client (which cannot keep client credentials secret) and a confidential client (which can keep client credentials secret).

In any case, the client id is not a secret. This is what OAuth specification says about the client id:

  The client identifier is not a secret; it is exposed to the resource
  owner and MUST NOT be used alone for client authentication

When it is a confidential client, then the client secret is used to authenticate the client which must be protected. Public clients are generally not authenticated. Many other aspects are validated (one example is redirect url, check the spec for the specifics).

Can an attacker access your API if they get holder of your client id? No, unless they know your client secret. If it is a public client, even then the attacker still needs to provide valid user credentials to obtain the authorisation code, before they can use it to get the access token. Do check out the Threat Model for OAuth for a detailed overview of the threats.


What is the risk that Windows 8's loopback protection feature protects me from? Windows 8 requires Fiddler to set up an exemption when sending traffic to localhost.

Since this is a default setting (and affects many computers):

What security benefit does this provide
How can I list any exceptions that may be placed on my machine?  (By Fiddler or any other similar software)

Fiddler is a proxy server that runs locally on your machine.  For this to work it needs to use the loopback network interface (localhost).  In Windows 8 has a new runtime that allows for the running of Immersive Apps.  For all Immersive Apps, Win8+ runs them in an AppContainer.  All AppContainers are forbidden to use send network traffic to the localhost.  Fiddler falls into this category of applications, but it is obviously a necessity for it to use the localhost interface.
The exemption that you grant simply tells Win8+, "Hey, this application is cool, let it use the loopback interface to do its job."  And Windows says, "Fine!  But we don't like it."  There is no real security benefit, it's just what needs to happen for Fiddler to work.  Microsoft would probably argue that it's actually more insecure for you to allow Fiddler access to the localhost.
I just realized I didn't quite understand your question.  The loopback interface essentially sends packets to itself.  So the Windows kernel would pick them up and process them as best it can.  An exploited application might not have direct access to the operating system yet.  It could bind to the localhost, send a malicious packet through the interface and exploit the operating system this way.  Here's an example.
This link explains more on Fiddler w/ Win8+
Here's a program to manage your exemptions.


OpenVPN Key Size 1024 vs 2048 and Eavesdrop vs Access? OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size.  I'm trying to determine if it's worth the hassle of manually changing things to a 2048 sized key.  I'm not concerned about anyone eavesdropping on any data being send over the VPN connection, however, I am concerned about someone opening a VPN connection themselves that isn't authorized to do so.  So I'm wondering, does the key size impact only how difficult it is to eavesdrop on an authorized connection, or does it also make a difference in how hard it is to gain access if you're not authorized to do so.

There's a few misconceptions in your question - I'll try to help:

OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size.

Larger RSA key sizes give you better security specifically at authentication and key exchange. And your hardware needs to be very weak not to handle 2048 bit keys. (I will try to find actual data around this, though I'd suggest an old Pentium II would handle an RSA 2048 within reasonable time.)
So my guess is that your hardware will handle RSA/2048 bits just fine.

I'm trying to determine if it's worth the hassle of manually changing things to a 2048 sized key. I'm not concerned about anyone eavesdropping on any data being send over the VPN connection ...

So you don't need a VPN?

I am concerned about someone opening a VPN connection themselves that isn't authorized to do so.

This is a reasonable concern, though not something that relates to your RSA key size directly. Or not at this level. It's far far easier to attack an existing client than to brute force even a relatively short RSA key.


Is "BEGIN PGP SIGNED MESSAGE" optional to include in an armored message? Although it's probably nitpicking, it doesn't look very cosmetically pleasing to put the BEGIN PGP SIGNED MESSAGE at the top of an email, is that header really required to parse the message and verify the signature below it? Can most clients just verify it without including it?

You refer to the marker of a cleartext signed message. If you use cleartext signatures instead of MIME then this marker is needed for the software to find out where the signed message starts. But again, this is only needed if you use cleartext signing.

For more information see Signature Handling in Emails which describes both ways of signing in more detail. GPG Signing: Traditional vs. PGP/Mime contains useful information too including information support for the various kinds of signing in mail clients.


Reverse proxy and corporate PKI Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending)

Currently it is signing them with an own non trustable Bluecoat certificate. So the browser warns you each time

Should I just allow an external software to issue as many trustable certificates as they want?

What are the best practices in this case?

Thank you!

Reverse proxies usually present internal applications to the internet. In these cases you will usually want the certificates to be trusted by a wide range of public computers - which necessitates certificates issued by public CAs such as Verisign etc. These CAs absolutely will not give you a delegated subordinate CA for this purpose.

Wildcard certificates provide similar functionality but are high value targets to attackers - discrete certificates with limited subjects and applications are recommended here. Lets Encrypt can help you do this in a scalable and cost effective way.

If you do not need public trust, I would recommend the same practice but issued from your internal PKI. There are a range of considerations here including making sure your internal PKI's CDP and AIA URLs are available to all validating clients, possibly also through your reverse proxy solution.

I would run a country mile away from issuing CA certificates to reverse or forward proxies in my opinion.


False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com' Every time I log in to Google with the same MacBook I get this email:

New device signed in to
    example@gmail.com
Your Google Account was just signed in to from a new Mac device. You're getting this email to make sure it was you.

What do these emails mean exactly? When does Google send out those emails?

I guess I receive those emails because I use a VPN (always same public IP address) and some privacy plugins in Firefox.

I guess I receive those mails because I use a VPN (always same public IP) and some privacy plugins in Firefox.

Yes, this is likely the reason. You use these plugins in order to prevent that the other side can detect that you are the same user on the same device as the previous time. And that's exactly what the mail from Google says: it detected a login from a new device since it could not detect your device as the one you've used before.

That's actually a common compromise one has to take: if privacy or security goes up the usability often goes down. In this case a useful security feature against misuse of your account (security up) conflicted with a useful privacy feature (privacy up) which caused the usability to go down.


Vulnerabilities common only in mobile solutions? I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier.

I haven't heard of any serious or common problems that concern only mobile browsers.

Please answer if you know one.

Yes.  Mobile browsers are generally at greater security risk than full-sized desktop browsers, for a number of reasons.  Here are some examples:

Tap-jacking. Tap-jacking is more powerful on modern phone browsers (compared to full-size desktop browsers): see this paper.
Phishing and UI spoofing. Mobile phone browsers don't reserve screen real estate for the "browser chrome" and its corresponding security indicators: e.g., the address bar, padlock icons or signs of HTTP/HTTPS/EV-HTTPS, etc.  In particular, web pages can go fullscreen and scroll away the browser chrome, leaving no browser chrome.  Once the web page has done so, a malicious web page could draw a spoofed address bar.  In one user study, almost every single user was fooled by a phishing attack of this sort.  This may pose increased risk: e.g., to phishing, clickjacking, and other social-engineering or human-factors related attacks on the user.
Vulnerable mobile web sites. Many websites offer separate sites specifically for mobile clients.  Those mobile-optimized versions of the site often have vulnerabilities not present in the normal site; see, e.g., this paper for some examples of this (relating to clickjacking).
Webview-related vulnerabilities. Many mobile applications use webviews, to seamlessly embed a web page into the application.  However, at least on Android, if webviews are not used carefully, they can introduce vulnerabilities that allow a malicious website to misuse the application's access to the user's phone and information.  This risk is specific to mobile systems.


Is client side encryption really better than server side? Web application may encrypt all user data at client side to convince users that it can't decrypt them.

When user enters password, it's used to encrypt data in browser and then it's sent to server in encrypted state. Server doesn't know password, encryption key and thus can't decrypt it.

But most of the users aren't able to review code used for encryption. All they can do is to trust it. Client side encryption may give feeling of control but:

Server can send one encryption code to one user and another one to the other
Government organization may urge server-side company so that it will disable encryption for certain users

So is there any benefit in client side encryption from user point of view?

You are correct.  Given your goals, client-side encryption probably doesn't make a lot of sense.  It is not that it is worthless, just that there are some significant pitfalls and the value is limited, so your time would probably be better spent on other measures.  A classic technical reference on this topic is Javascript Cryptography Considered Harmful.

If you're thinking that using client-side cryptography might help perception, even if it doesn't actually improve real security, I don't think that's a very promising angle, either.  The average user is going to have no clue what the phrase "client-side cryptography" means and so I don't think they're going to associate it with warm fuzzy feelings.

I think you are better off taking standard steps to build trust with your users and to improve how you protect your users' data.  Have you moved to sitewide HTTPS?  Do you have a strong, customer-friendly privacy policy?  Are you focused on serving your customers well and making them passionate about your site?


Secure Software: How to ensure caller is authentic? For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service.  On the other hand, legitimate players should of course be permitted access to service.

These illegitimate players are simulated by one means or another, but I would like to focus on when simulated through the use of 3rd-party software which uses 1st-party API's to query or send information to a central server.

I would like to understand how this API must be designed so that a fraudulent (3rd-party) software cannot pretend it is the legitimate (1st-party) software that is already deployed to the end-user.

To be clear, 3rd party software is obtained by a malicious user, in which the 3rd party software has been compiled with the API that communicates to the server.  Since the API is deployed to a legitimate user, the developers of the malicious software simply need to reverse-engineer (perhaps via de-obfuscation) that API and use it.

Is there a way that this API can implement some security protocol so that the illegitimate users cannot access the server at all?

I have thought about requiring some password which is sent to the server to verify the caller, but I cannot see how we can distinguish between genuine users and false users.

This is one of the largest problems online competitive games have to face. Unfortunately, there's no simple solution. The most effective way of detecting bots or malicious users is via behavioral analysis.


How can I get notified about the publishing of ransomware decryption keys My computer had been hijacked by "Cryptolocker" a ransomware you might be well aware of. The nasty ransomware has encrypted most of my documents and video files. I used an anti-malware and removed the ransomware from my PC. But my files are left encrypted. I tried to search for a decryption tool on the net and I found decryption tools for files locked by teslacrypt, criptoXXX etc but not for files locked by cryptolocker. I used those tools and they are not working for me. I wont be paying any ransom to those hackers. Now I guess the only option is to wait until the hackers get caught and the decryption keys get uncovered and published. Now my question is how do I get notified if the decryption keys are uncovered and published. What websites do I need to constantly visit to get notified? By the way do you know any ways to decrypt    files locked by cryptolocker?

Several security companies and also Europol and other policy agencies maintain together the site nomoreransom.org. This site tries to offer a single place for information about current ransomware and also for the current tools which are available to decrypt the data.


Securing an SFTP server I have been asked to secure an SFTP service and running a scan using

nmap.exe --script ssh2-enum-algos <host> -p 22

returns the following:

22/tcp open  ssh
| ssh2-enum-algos:
|   kex_algorithms: (3)
|       diffie-hellman-group14-sha1
|       diffie-hellman-group-exchange-sha1
|       diffie-hellman-group-exchange-sha256
|   server_host_key_algorithms: (2)
|       ssh-dss
|       ssh-rsa
|   encryption_algorithms: (5)
|       aes128-ctr
|       3des-cbc
|       blowfish-cbc
|       arcfour128
|       arcfour
|   mac_algorithms: (7)
|       hmac-md5
|       hmac-sha1
|       hmac-md5-96
|       hmac-sha1-96
|       hmac-sha256
|       hmac-sha2-256
|       hmac-sha256@ssh.com
|   compression_algorithms: (2)
|       none
|_      zlib

Does anyone know of any reason why I shouldn't configure it as follows:

22/tcp open  ssh
| ssh2-enum-algos:
|   kex_algorithms: (1)
|       diffie-hellman-group-exchange-sha256
|   server_host_key_algorithms: (1)
|       ssh-rsa
|   encryption_algorithms: (5)
|       aes128-ctr
|   mac_algorithms: (7)
|       hmac-sha2-256
|       hmac-sha256@ssh.com
|   compression_algorithms: (2)
|       none
|_      zlib

I am expecting someone to point out that some of the above components may be needed for legacy applications or older clients but I don't have enough experience to know which :)

By the way, the SSH connection is managed by the SFTP software ( decompiling the java code revealed it was using Maverick ) and doesn't rely on OpenSSH.

It depends on the users you expect to connect to your server. If you are in control of the clients (you can verify which algorithms do they support and/or update them), your proposed list is security very reasonable (quite much all you excluded have some security weakness).

If you do not have control of the clients, you can still log the supported list of algorithms for some time and verify you will not cut out most of the clients. These days is no reason why an up-to-date client should not support your proposed algorithms so issuing some message "Please, update your client" would make sense.

The backward compatibility is important mostly for the clients, because there are ancient devices running SSH server unable to update their software. But this should not be a problem for SSH clients.


What's the worst someone could do with my phone unlock code? When someone is using my cell phone, I will sometimes give them the PIN number to unlock it so they don't have to ask me. Clearly, I only tell the code to people I trust not to mess up my phone. However, let's say an attacker overhears me telling someone I trust (or the person I trust later turns evil and plots to take over my phone). Either way, the attacker doesn't have physical access to the phone. What can he do? I don't think phones OS' are like laptop and desktop OS' in that the "user password" can also be used to gain remote access, but I'd like to make sure. My phone is a Windows Phone (8.1), but I'd appreciate answers for iOS and Android too.

Short Answer: For Windows phone, Android and iOS he would not be able to do anything. A PIN would only be useful to a attacker physical access or if he had remote access to your phone. If you are the average person and not high up in government you have nothing to worry about.


Using Volatility Framework with Linux memory dumps I am using Volatility Framework 2.2 to anlayze a Linux memory dump.

This memory dump was taken from an Ubuntu 12.04 LTS x86_64 machine with the kernel version 3.5.0-23

I have the profile for it and you can find it at the link below.

http://www.sendspace.com/file/pqyipd

I have placed this zip file in the location: /volatility/plugins/overlays/linux

below is the output of the command:

python vol.py --info | grep Linux

LinuxUbuntu1204x64 - A Profile for Linux Ubuntu1204 x64

now I use this profile to analyze the memory dump:

python vol.py --profile=LinuxUbuntu1204x64 -f mem.dump linux_pslist

and I get a blank output!

$ python vol.py --profile=LinuxUbuntu1204x64 -f mem.dump linux_pslist
Volatile Systems Volatility Framework 2.2
Offset             Name                 Pid             Uid             Start Time
------------------ -------------------- --------------- --------------- ----------

it does not give me the list of processes

I have tried this with another memory dump as well and same output.

I am trying it on a linux memory dump provided in a recent CTF, ebCTF 2013 forensics challenge.

You can find the write up here:

http://blog.lse.epita.fr/articles/59-ebctf-2013-for100.html

I am using the same profile provided by this user however in my case it does not work.

Any idea why would I  get a blank output?

Thanks.

Is your "LinuxUbuntu1204x64" profile also for kernel 3.5.0-23? grepping the memory dump provided by the challenge, indeed, confirms your words that the memory has been probably dumped on a system with 3.5.0-23 kernel:

$ strings ~/Downloads/memory.dump | grep "BOOT_"
    1099:BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    185123:Command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    185205:Kernel command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    195710:[    0.000000] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    221017:ernel command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    236853:[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    260767:Jul 21 21:13:16 eindbazen kernel: [    0.000000] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    262173:Jul 21 21:13:16 eindbazen kernel: [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    360508:Jul 21 21:13:16 eindbazen kernel: [    0.000000] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    806187:Jul 10 20:07:18 eindbazen kernel: [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    806319:Jul 21 21:13:16 eindbazen kernel: [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    806342:Jul 10 20:07:18 eindbazen kernel: [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro
    2524180:bcode_jmp RTC=0x%x, iter=%d, REBOOT_STATUS=0x%x
    2525925:bcode_jmp RTC=0x%x, iter=%d, REBOOT_STATUS=0x%x
    2528767:bcode_jmp RTC=0x%x, iter=%d, REBOOT_STATUS=0x%x
    2566790:bcode_jmp RTC=0x%x, iter=%d, REBOOT_STATUS=0x%x
    2850450:BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic
    2874700:BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic
    2874702:BOOT_IMAGE=/boot/vmlinuz-3.5.0-23-generic root=UUID=d45d9170-0f93-4ff4-b5a5-be89760c0d77 ro

Try /linux/Ubuntu_12.04_x64_3.5.0-23-generic.zip profile from here: http://git.io/volatility-profiles. You may also want to know how to create a profile by visiting the official how-to here. If you come up with some profiles, feel free to shove them into that repo.

Firing up Volatility checked out from SVN (that would be 2.3_beta) works well:

$ python ./vol.py -f ~/Downloads/memory.dump --profile=Linux_Ubuntu_12_04_x64_3_5_0-23-genericx64 linux_pslist
    Volatile Systems Volatility Framework 2.3_beta
    Offset             Name                 Pid             Uid             Gid    DTB                Start Time
    ------------------ -------------------- --------------- --------------- ------ ------------------ ----------
    0xffff88000f9b0000 init                 1               0               0      0x000000000aff1000 2013-07-21 19:19:32 UTC+0000
    0xffff88000f9b1700 kthreadd             2               0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000f9b2e00 ksoftirqd/0          3               0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa48000 migration/0          6               0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa49700 watchdog/0           7               0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa4ae00 cpuset               8               0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa4c500 khelper              9               0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa4dc00 kdevtmpfs            10              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa68000 netns                11              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa69700 sync_supers          12              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa6ae00 bdi-default          13              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa6c500 kintegrityd          14              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fa6dc00 kblockd              15              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fb00000 ata_sff              16              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fb01700 khubd                17              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000fb02e00 md                   18              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000db90000 khungtaskd           21              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000db91700 kswapd0              22              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000db92e00 ksmd                 23              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000db94500 fsnotify_mark        24              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000db95c00 ecryptfs-kthrea      25              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d5f0000 crypto               26              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d7a5c00 kthrotld             35              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d7a2e00 scsi_eh_0            36              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d7a1700 kworker/u:2          37              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d7a0000 scsi_eh_1            38              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d5f5c00 scsi_eh_2            39              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d5f4500 kworker/u:3          40              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000d5f1700 binder               42              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000f011700 deferwq              62              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000f012e00 charger_manager      63              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000f014500 devfreq_wq           64              0               0      ------------------ 2013-07-21 19:19:32 UTC+0000
    0xffff88000ee35c00 jbd2/sda1-8          201             0               0      ------------------ 2013-07-21 19:19:33 UTC+0000
    0xffff88000ee30000 ext4-dio-unwrit      202             0               0      ------------------ 2013-07-21 19:19:33 UTC+0000
    0xffff88000ec7dc00 kworker/0:3          220             0               0      ------------------ 2013-07-21 19:19:35 UTC+0000
    0xffff88000ec78000 upstart-udev-br      288             0               0      0x000000000ada3000 2013-07-21 19:19:37 UTC+0000
    0xffff88000f2ddc00 udevd                332             0               0      0x000000000ef46000 2013-07-21 19:19:37 UTC+0000
    0xffff88000c291700 udevd                496             0               0      0x000000000c2a6000 2013-07-21 19:19:37 UTC+0000
    0xffff88000c292e00 udevd                497             0               0      0x000000000c2c1000 2013-07-21 19:19:37 UTC+0000
    0xffff88000c838000 kpsmoused            546             0               0      ------------------ 2013-07-21 19:19:37 UTC+0000
    0xffff88000c4c9700 upstart-socket-      638             0               0      0x000000000d939000 2013-07-21 19:19:38 UTC+0000
    0xffff88000ee31700 dhclient3            706             0               0      0x000000000f0fb000 2013-07-21 19:19:38 UTC+0000
    0xffff88000c4cc500 rsyslogd             720             101             103    0x000000000c600000 2013-07-21 19:19:38 UTC+0000
    0xffff88000c83ae00 sshd                 729             0               0      0x000000000bbce000 2013-07-21 19:19:38 UTC+0000
    0xffff88000c4cdc00 dbus-daemon          759             102             105    0x000000000c538000 2013-07-21 19:19:38 UTC+0000
    0xffff88000d1aae00 getty                822             0               0      0x000000000c641000 2013-07-21 19:19:38 UTC+0000
    0xffff88000c62c500 getty                827             0               0      0x000000000d98c000 2013-07-21 19:19:38 UTC+0000
    0xffff88000c839700 login                831             0               1000   0x000000000f28d000 2013-07-21 19:19:38 UTC+0000
    0xffff88000c83dc00 getty                832             0               0      0x000000000d9c1000 2013-07-21 19:19:38 UTC+0000
    0xffff88000c4cae00 getty                834             0               0      0x000000000c684000 2013-07-21 19:19:38 UTC+0000
    0xffff88000d0a4500 acpid                837             0               0      0x000000000c315000 2013-07-21 19:19:39 UTC+0000
    0xffff88000c83c500 cron                 839             0               0      0x000000000d9da000 2013-07-21 19:19:39 UTC+0000
    0xffff88000d1a9700 atd                  840             0               0      0x000000000c327000 2013-07-21 19:19:39 UTC+0000
    0xffff88000da11700 login                896             0               1000   0x000000000ae44000 2013-07-21 19:19:39 UTC+0000
    0xffff88000c514500 whoopsie             901             103             106    0x000000000dae3000 2013-07-21 19:19:39 UTC+0000
    0xffff88000bb15c00 bash                 1064            1000            1000   0x000000000c6f0000 2013-07-21 19:19:46 UTC+0000
    0xffff88000af90000 kworker/0:0          1313            0               0      ------------------ 2013-07-21 19:24:35 UTC+0000
    0xffff88000af94500 kworker/0:2          1314            0               0      ------------------ 2013-07-21 19:29:36 UTC+0000
    0xffff88000af91700 kworker/0:1          1315            0               0      ------------------ 2013-07-21 19:34:37 UTC+0000
    0xffff88000af95c00 kworker/0:4          1316            0               0      ------------------ 2013-07-21 19:35:46 UTC+0000
    0xffff88000af92e00 python2              1317            1000            1000   0x000000000c6fb000 2013-07-21 19:36:09 UTC+0000
    0xffff88000d0a5c00 bash                 1454            1000            1000   0x000000000d8c8000 2013-07-21 19:36:23 UTC+0000
    0xffff88000f9b4500 flush-8:0            1552            0               0      ------------------ 2013-07-21 19:36:28 UTC+0000


Diffie-Hellman large prime number weakness. Is this concept valid? If so, how can this be remediated by end-users/admins? So I saw this blog post on “How is NSA breaking so much crypto?”. The basic idea of this blog post is this: There is an inherent weakness in Diffie-Hellman that stems from services using the same large prime number by default. Meaning, if that one default large prime number is not changed, then that becomes a potential weakness since if that default large prime number is hacked and commonly known, access to systems in which that value has not been changed becomes relatively simple.

  For the nerds in the audience, here’s what’s wrong: If a client and
  server are speaking Diffie-Hellman, they first need to agree on a
  large prime number with a particular form. There seemed to be no
  reason why everyone couldn’t just use the same prime, and, in fact,
  many applications tend to use standardized or hard-coded primes. But
  there was a very important detail that got lost in translation between
  the mathematicians and the practitioners: an adversary can perform a
  single enormous computation to “crack” a particular prime, then easily
  break any individual connection that uses that prime.

Okay, I haven’t completely bought the concept here. But assuming this article’s assumptions are true—that usage of similar default prime numbers in various Diffie-Hellman deployments invites an inherent weakness—then my question is this:

If deployment laziness—as marked by providing a default large prime number—is the primary attack surface of a Diffie-Hellman implementation, then what can be done by average end users and systems administrators—if anything—to pre-emptively neutralize this issue?

I might be treading a bit into the deep end of my abilities of understanding the building blocks of encryption, but is the concept of a weakness presented in that article something that would require—for example—certificate authorities to issue new root certificates? And unless that happens, a commonly used default Diffie-Hellman large prime number vulnerability would still be a concern and potential vulnerability?

Or is the whole assumption of that blog post based on a “thruthy” analysis that could be considered to be akin to the panic surrounding Y2K bugs that—while a valid concern on some level—never really manifested itself on a scale large enough to justify the panic associated with the concern?

Don't use any cipher suite involving DH on a prime group smaller than 2048 or even better 3072 bits. That's what you can do as a sysadmin...

The EFF has practical advice : https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH


Password hashes should run md5 thousands of time: really? I skimmed through How Companies Can Beef Up Password Security and I thought that several assertions were completely wrong, in particular:

Cryptographic hash (like md5) with salt are bad.
It isn't uncommon to break/crack unix shadow files.
To make a password hash I should run it over md5 or whatever hundreds or thousands of times.

The article suggests that salted hashes are too easy to break and you'd want to select a password hash because its computationally longer to check passwords so you can not do as many per second.

I think doing 3 is bad for security and 1 is in reality the best option. What do you guys think?

Cryptographic hash (like md5) with salt are bad.

It is not sufficient anymore. The traditional cryptographic hash functions are designed for documents and therefore they are optimized for speed.

But speed is exactly what we don't want for password hashes. Modern graphic cards can do 2,000,000,000 SHA1 or MD5 hashes per second. So brute forcing a 6 character password takes less than 10 minutes.

  It isn't uncommon to break/crack unix shadow files.

That's true for the old hashes used in them.

  To make a password hash I should run it over md5 or whatever hundreds or thousands of times.

While this is am improvement over just using a quick hash function ones, it is not sufficient.

You should use one of the hash crypt algorithms (except for md5crypt): sha256crypt, sha512crypt, bcrypt or scrypt. Those are algorithm that are designed to be relatively slow and not easily implementable on graphic cards to gain a performance boost.

Those algorithm do more than just using the output of one round as input for the next round. The rules of what to use as input vary based on the iteration counter (See the linked specifications). Modern unix operating system use sha512crypt.

scrypt goes one step further than the other algorithms because in addition to scalable CPU usage, scrypt uses a lot of memory. The idea is to make hardware implementations of password crackers a lot more expensive. Such hardware usually has access to up to 1KB of fast memory, but the default parameters of scrypt require 16MB.


PCI Compliance Distibution I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze.

I need to become PCI compliant (the card industry standard for security).

Therefore I have registered with TrustWave TrustKeeper which scans my site for potential security vulnerabilities.

The scan reported plenty of vulnerabilities and I need to upgrade PHP (which I did) and Apache.
The issue is that the Apache version which is recommended is not available for Debian 6.

It's becoming a nightmare to fix all the reported issues.

Are you aware of a Distribution that would be pre-configured to be PCI compliant ?
Some kind of perfect settup with Apache/MySQL/PHP/SSL/eMail: IMAP & SMTP-SSL.

Thanks for your help.

Normally the version of Apache within Debian squeeze should be up-to-date with all security patches. This means that the version itself might run behind but that all security updates have been applied in form of backported fixes (this is often done by Debian).

You should follow a hardening guide as well, most of these Trustwave vulnerability reports solely depend on the advertised HTTP headers. Hardening guides will also help you in making your setup more secure as you expose less information about your setup.


Is rooting an Android phone to install an anti-virus firewall worth it? Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them.

However rooting an Adroid phone is often presented as a security risk.

So:

Why does the anti-virus tells you to root your device if it is a security risk?
Are firewalls for android devices really worth it? I mean which is more secure:

A rooted Android device with a firewall installed.
Or a non rooted one with no Android firewall?

1. Why does the anti-virus tells you to root your device if it is a security risk

Basically, as answered here, rooting allows you to give root permissions (let's say to execute sudo) to some applications. The list of these applications with root permissions could be controlled with 'Superuser' app (integrated in the Settings for Cyanogenmod).

Also, you (a phone owner) now have root privileges. So if you will start installing software from third-party forums, noname markets/stores and will give root permissions to all of this applications, this will be bad, because you should not trust these apps. If you want to give a rooted phone to your grandma, and she does not undestand concepts of rooting/apps/app stores/permissions/etc - do not do it.

Next, if you are still careful, and only gives root permissions to 1-2 applications you and other people trust (like firewall or file manager, downloaded from reputable source), then it's ok. However, if this file manager or other software has vulnerability, some malware could use this vulnerability to get root access through this file manager, which now has root permissions. That is what I see as a risk.

However, unrooted devices could also have vulnerabilities like Stagefright, that allow an attacker to get root access to the phone, since unrooted Andriod still has libraries / system apps running with root permissions. So all you do is an increasing number of potentialy vulnerable apps with root permissions, that could be hacked (if you carefully select what and from where you install).

Most antivirus apps very often really need root permissions to be able to actively manage/block other apps, if they find some suspicious activity in them.

2. Does firewalls for android devices really worth it

It depends on what do you want from the firewall. E.g., I'm concerned about my privacy. And I still want to use some apps. However, these apps sometimes require Internet access, even though their functionality has nothing to do with Internet communication in my eyes (e.g., I do not want a music player to access an Internet, but I still want to use this music player, while PrivacyGuard has no functionality to control Internet access for apps). So I installed an AFWall+ to control which applications have Internet access. For me, it is worth it. I have a Cyanogenmod with root on my phone.

However, I do not have an antivirus. Personally, I do not see a much sense in having it, since I try to install apps only from trusted sources, see also this question

So, if you only give root permissions only to the single firewall from PlayStore, and you believe that this firewall has no serious vulnerabilities, then "A rooted Android device with a firewall" is more secure.


Definitions of computer forensics and information security I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security

What I want to know is:

What is the difference/gap between these two disciplines?
Are they somehow related so if I take any of them I can still go and practice the other field - in case I wanted to change my job field?

I suggest seeing the following "Technical Certification Roadmap"

The answer to your questions are enough to fill a book. The two (infosec and forensics) are like apples and oranges. Both fruits, each different. In forensics, depending on what you are doing, there could be life and liberty at hand if you are performing forensics with the ultimate route being, a court case. In infosec, same applies (slightly): life, privacy. (If you're working at say a SCADA based environment, one mishap could endanger life, if you're working in the medical arena, privacy comes first).

Aside from these two huge gaps, it works best to get a feel for both as they complement one another however, they are both extremely different. The companies hiring for these roles also hugely differ. For example, many huge law firms hire forensics experts for the sake of having talent on-hand to analyze cases, but have no true blue infosec program. Some Fortune N companies hire strong infosec teams and lack/substitute forensics with "incident responders." In forensics, chain of command, evidence, spoilation, etc., come first. In infosec, this is barely an afterthought.

Personally, I feel its best to understand both realms although they in themselves are VERY BROAD fields. Hence me posting the roadmap. The roadmap linked, shows the variations of "infosec" as there are many: application security, network security, infrastructure security, web security, SCADA based security. Same applies for forensics: E-Discovery, Incident Response, Privacy, Legal based (going to a trial).


Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate? There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service to achieve this, as requested in this great question, but rather a method for the achievement of such a service.

For the legal (in most any law system) authentication of text content and its submission time, the owner of the content would need to prove:

that the timestamp itself has not been altered and was accurate to begin with
that the text content linked to the timestamp had not been altered

I'd like to know how to achieve this via programming (not a language-specific solution, but rather the methodology behind the solution).

Can a timestamp be validated to being accurate to the time that the content was really submitted?
Can data be stored in a form that it can be read, but not written to, in a proven way?
Is there another method of achieving this that I haven't specified?

In other words, can I save & store a user's submission in a way that proves that the data has not been altered, and that the timestamp is accurate?

I can't think of any programming method that would make this possible, but I am not the most experienced programmer out there. Based on MidnightLightning's answer to the question I cited, this sort of thing is being done.

Clarification: I'm looking for a method (hashing, encryption, etc) that would allow an average guy like me to achieve the desired effect through programming.

I'm interested in this subject for the purpose of Defensive Publication.

I can set the clock on my computer (server) to any time, and there's no way for software running on it to know that this is the wrong time, so proving a timestamp is difficult.  One approach is that you could produce a hash chain, but this only means that you've hashed things in a certain order, you're still not able to prove at exactly what point you've hashed it.

One approach is to involve a trusted third party -- someone who can sign requests with a timestamp that they certify, and who is not a party to any disputes, and thus should be impartial and not forging timestamps.  This is known as trusted timestamping and even has an RFC.

So the answer is yes, you can do this, but only by involving a 3rd party.


What is the ideal anonymous workstation setup? My goal is to build a perfect stationary workstation from which I can work anonymously.

Most instructions on being anonymous usually involve, at some point, moving around and switching from coffee shop to coffee shop. Is there any way around this?

Currently, my best-possible imagined setup involves tails OS plugged into an android device (anonymous second-hand cash purchase, no cameras) with a pre-paid 3g SIM (anonymous second-hand cash purchase, no cameras) and then everything goes through Tor (because Tails). But I expect that all ISPs are geolocating (via cell towers?) all cellular devices all of the time and storing this data, timestamped, alongside the device ID/SIM numbers and the IP they are allocated.

So if Tor can be compromised via some malicious third party with government-sized resources, perhaps by them owning significant numbers of entry and exit nodes which I unfortunately use simultaniously, allowing them to link end-to-end the original 3g IP with my web activity, then this malicious third party could then query my ISP for the geolocation data associated with the relevant IP address at that specific time and find out where I was.

Over time, they could profile my location and look for patterns. In the case of a stationary workstation, my cover is blown. In the case of a going to a new coffee shop every day, in the case that this malicious third-party has live monitoring of the TOR network and can instantly query the ISP in question, then the could litterally watch you as you work, totally destroying all anonymity.

Now, I am split on whether or not I believe a malicious third party has compromised Tor as such. On one hand, it seems quite doable, many research papers point to entry/exit vulnerabilities, and we have the recently pulled conference talk. On the other hand, Schiener, Snowden, and others still recommend Tails/Tor as sufficient to protect anonymity, and surely they know better than I. But it would be prudent to act in a manner, if possible, which allows me to be wrong without reprocussions.

What is the ideal anonymous workstation setup?

Just some ideas:

Using a radio broadcasting device of any sort will allow signal finding to identify the source location. I would not use a cell phone regardless of its origin.
By implementing a private VPN service prior to entering the TOR network you can shift point of origin and further muddy the path.
Make sure you update Tails to get the fix to the latest compromise. This compromise is just a famous one, there are security holes detected very often. Update Tails regularly.


"holding open" encrypted home with local ssh I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that user logs in (desired behavior). Now, I'd like to be able to run a server using one of these users (data stored therein), and I don't mind logging it in once when the service is started. However, I don't want to leave an open SSH session from another machine to the automated one.

My current strategy is a script that runs a localhost SSH session inside a screen process, which then detaches after logging in. This keeps the user "logged in to herself" as long as that screen process is running. I run this script from outside using SSH, and then drop the remote SSH session, leaving the localhost screen-ed SSH session running, keeping the ecryptfs directory mounted.

What are the security risks of this approach, if any?

If someone gains access to your system by software means while the encrypted filesystem is mounted, they gain access to the filesystem.

If someone gains access to your system by software means while the encrypted filesystem is not mounted, they may still gain access to the filesystem: it depends when you detect the intrusion. If they manage to gain root (and not just access as some other confined system daemon), then they can plant malware that will record the filesystem's password and decryption key the next time you enter the decryption password.

If someone gains access to your system by hardware means while the encrypted filesystem is mounted, they may gain access to the filesystem. For example, they can perform a warm RAM extraction and dump the keys from memory.

So by keeping the directories unencrypted you are increasing the risk window. However, the only way to reduce that risk is to stop operating the server — the server process needs to access its data anyway.

Keeping a Screen process running, as opposed to, say, turning off automatic unmounting, only has a security impact if there is a vulnerability in Screen. Screen is a mature, fairly stable program, so the likelihood that an as yet unknown vulnerability will be discovered in it is rather low. Screen's security relies on file permissions (the ownership of the socket directory), so in any case anything that can affect it is highly likely to be able to affect the service-providing daemon as well.

In practical terms, this approach does not increase the risk beyond that inherent in running the daemon in the first place.


Load balancer haproxy can i configure a load balancer between two nodes by using only two ip adresses. I mean one of the two server will be a load balancer and backend server in the same time

Technically yes. HAproxy doesn't prevent other programs running on the server.

Do understand that there are at least two downsides to this approach:

It reduces the effectiveness of the LB because the LB is serving
additional programs. Arguably you could configure the LB with more
CPU/RAM/IOPS to compensate - but that's extra cost.
The idea of a load balancer / HA proxy (not the same concepts,
though the tech overlaps) is to have at least two FEs behind it.
Both to handle load as well as to handle failures. Again,
theoretically, you could have both FE and BE on the same node as the
Load Balancer - but that only reduces the application robustness as
well as security (an attacker wouldn't need additional effort to get
to the BE if the LB is compromised).

In the end, it is not only  saving-one-IP-address vs design weakness, but also the additional cost of compensating the LB configuration & the additional effort to secure.


Microsoft Word to secure stored data I understand the purpose of Microsoft Word is not to store secret information.
However, I would rather spread my secret information between a Password Manager and a Word document, each of which has separate secure passwords.
Is a password-protected Word document from Office 365 (2020) sufficiently secure to store financial information?
Wikipedia seems to suggest it is, but I'm still someone who doesn't herald Wikipedia's information as gold-standard.
If Word is not secure enough, are there other alternatives that are non-password manager based that would be secure enough?

By default, Microsoft Office 2016* uses AES-256-CBC with 100000 rounds of SHA1 for password verification using a 16 byte salt. AES256 is currently considered the industry standard by many for symmetric encryption. SHA-1 isn't considered a very secure algorithm for password storage since it's a fast algorithm and can be accelerated massively using GPUs. However, since a 100000 iterations are used, this weakness is significantly mitigated (although it still isn'tanywhere near as good as a dedicated password hashing function like bcrypt/argon2), and if you use a strong password, it shouldn't matter either ways. So the cryptography used by Office 2016 is strong enough to be currently uncrackable provided a sufficiently strong password is used.
Does having strong encryption make Office a good choice for storing financial information?
Probably not. Word creates lots of temporary files when it opens a document which probably aren't encrypted. These files will usually be recoverable for some time even after they have been deleted and could easily leak the contents of your file unencrypted.

*Office 2013 uses AES-128 which is also secure


A proposal for effortless two-factor authentication I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before.

Let's say I have an account that I access from my cellphone (or any device). When I send the password, the device will automatically add its own "password", which you can think of as a binary string. But here's the key: the device password will randomly mutate at a fixed rate.

For example, on the day I create a new account, the device will automatically initiate its password to the all 1 vector: 1 1 1 1 1 1 1 1. But when I log in a week later, there is some probability (proportional to the time interval) that each of the entries has changed. Thus the new device password might be 1 1 0 1 1 1 1 0. Two of the bits have decayed. The calculation of the random decay is entirely local to the device.

How is this a form of two-factor authentication? Now let's suppose that a malicious agent tries to log in on a separate device. What device-level password do they use? They can't use the original all 1 vector, because that will give them away. They know the rate of random decay of the password, but the exact bits that are changed is hidden from them. Say they submit 1 0 1 1 0 1 1 1, trying to guess which bits have decayed. The server looks at this password, compares it to the previous password 1 1 0 1 1 1 1 0, and sees that it is impossible for this new password to be valid.

Clearly a much longer key is required, and there are more complicated randomization schemes than just starting from all 1s and decaying randomly. But the idea has a number of advantages:

Effortless to the end user.
Does not invade privacy. Currently, many systems use a "fingerprint" of a person's cell phone, which is information gleaned from any available information on the phone. In addition, a random key is more reliable than a fingerprint.
The decay rate actually provides some traceability, telling authorities when a device was compromised. Imagine a credit card issuer looking at fraudulent charges. If the random passwords diverge by a lot, then the device was compromised a long time ago, otherwise the compromise was recent.

There are some disadvantages as well:

The process does not identify the true account holder. It only raises a flag that there is a malicious agent out there, without alerting anyone as to which is which. Perhaps once such a detection is made, a third authentication factor can be used.
The process is probabilistic. There is no certainty of flagging a malicious agent, only a probability. With proper design, this probability can be made very high.

Essentially, this scheme makes the value of stolen credentials decay very quickly. Let's say a criminal steals your passwords, both the human password, and the device level password. The criminal must use these credentials before you do to get any value from the theft. If you log on first, you send your mutated device password along with your human password, and the thief's stolen credentials are now useless. Even if the thief uses the credentials before you, when you log in next, that will flag the system that there is a problem. The thief's gains are thus significantly limited.

My question is, does anything like this exist? Do you think this is feasible? practical?

Thanks for your input!

No, it won't work. Because of one key factor: probability.

If you throw probability into any system, there's no guarantee that the other side is real, or not. Like you cannot say with certainty that a dice is fair or not by throwing it a few times. You can say that probably the dice is fair after lots of throws. You only have a probability, as you already stated.

Look at the server. It receives a key 0 0 0 0 0 0 0 0. It should not have decayed so fast, right? But every bit have a probability for decaying, not a fixed rate, so it's entirely possible that every single one decayed at the same time. Why not? So how can the server tell that the device was compromised?

If you are willing to go for the probability instead of certainty, you can train a model with all requests for the user: duration, time of the day, type of purchase (in case of a credit card), and block when a sizable change occurs. Credit cards already do that, and that usually works well.

A fixed device key is better than a randomly mutating one. Storing a device key on the Secure Enclave on iPhones or the equivalent on Androids makes the key very difficult to steal (think State-level difficulty). When the application is first installed and the user authenticates itself, generate a token server-side and store it safely on the device. It will be used to generate TOTP tokens and add it with the next authentications automatically, without user intervention.

It basically have the same upsides from your idea: no user interaction needed, it does not fingerprint the phone or invade privacy. Other than that, it is not probabilistic, and identify the true account holder. An attacker would have to steal the device, as extracting the keys from the Secure Processor is very difficult, and maybe cost more than any financial gain it would bring.


Shellshocking Webservers, does anyone know of an attack-vector other than Headers? i've see a lot of different webserver-attacks against cgi-pages, but have seen the malicious payload only in the headers, might it be

User-Agent
Cookies
Referer
Custom-Headers

does anyone know if (or if not)  one might use POST-Vars or other methods to inject the payload?

For Apache, the HTTP protocol is also a vector:

A request like:

GET /some/cgi () {(:);};xxx

Will put () {(:);};xxx in the SERVER_PROTOCOL environment variable.

So, to detect, it's important to look for the () { string anywhere in the request header, not only after a :\s*.

Also, it's conceivable that a base64 user name in a Authorization header end up in an environment variable for some authentication module.

It's conceivable that QUERYSTRING or PATH_INFO be a vector with some web server implementations (not Apache AFAICT).


Is OpenSSL secure enough? We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries.

It appears that OpenSSL has vulnerabilities resolved on a regular basis. This makes me wonder if I should move the SSL layer to a separate Java process / something more proven, that will not have buffer overflow, and other vulnerabilities.

The Oracle Solaris package repo publishes only an out of date release, so compilation from source would be necessary for prompt install.

There would of course be a delay between discovery->release->compilation->distribution to the servers running. And additional administration cost/delay in the event there is a problem with the build.

How effective will prompt updates be against attackers? What kind of work would be necessary for the attacker, once a vulnerability is identified?
Do you recommend an alternative, more secure approach to installing the https layer?
Is there an older, more stable version of OpenSSL that is still maintained, and had a longer time to be proven secure?

Any input would be appreciated, including help with getting this question right.

Edit: A couple clarifications on how a separate library would be introduced, if that was to happen: The separate library would just be an implementation of a proxy https server, in a separate process. This is a brand-new implementation, so we wouldn't be switching, we would instead just 'not use' the Node.JS https server library.

The fact that they are constantly making changes to improve security is a good thing. It means they are keeping up with exploits and patching accordingly. This is the kind of thing you want to see in a security library. Just because a library isn't patched often, doesn't mean that they don't have any problems. It might just mean that they aren't fixing them quickly or often enough.

As for the library itself, it seems fairly widely used, so I think you will be safe using the most recent version of it. Using different libraries seems like it will introduce a lot of complications to your build and upgrade process (which itself can cause security problems), and you probably aren't going to be gaining a lot of security by switching.


Windows - Revoked Binaries I find it hard to believe that the majority of Windows system files aren't signed. I don't know whether my disbelief comes from naivety, or because Windows is used within secure environments worldwide and thus one would expect a certain level of care. (Does signing files show care? Probably not.)

But I imagine this lack of signing is the reason why the revocation status of signed runtime binaries aren't checked. Thus, one could have a signed binary which has been specifically revoked for whatever reason, and Windows doesn't care and will let it run. I have tried to enhance this functionality by using AppLocker.

From the website, Microsoft state (http://technet.microsoft.com/en-us/library/ee619725(v=ws.10).aspx):

  However, if a certificate was allowed and then revoked, there is a 24-hour period before the revocation takes effect.

Whether this statement refers to "allowing" and then "disallowing" an app using AppLocker certificate rules, or the actual revocation status of the AppLocker binary, I'm not sure but I certainly can't get it working.

This commentary leads me to the question: Shouldn't all vital system files be signed and their CRLs checked before execution (along with specified business app binaries)? Are there software products which will enforce these kind of policies?

How do you validate the signature?  If you can compromise the system files, chances are you can also compromise the root public keys being used to validate against and the files would still appear valid.  Signed files only helps if the system is otherwise secure, if the system files themselves are corrupt, that is no longer a true statement and all pretense of security goes out the window.

Now if you are just talking about secure, trusted boot and requiring a signed OS kernel and bootloader at the EFI level, that is supported when using BitLocker, but most systems don't bother to fully support this, so it can't be on by default as most hardware and/or consumers can't or won't make use of it.


ASP.NET Web Forms is not generating a new session ID if a user logs out and logs back in ASP.NET Web Forms is not generating a new session ID if a user logs out and logs back in. Is this a major security risk? We're using SSL.

We should make one thing clear before we move one:

Depending on the setup: Session IDs are not the same as session data

This doesn't mean it's safe, but it also doesn't mean it's unsafe.

Now let's work through the state machine of user sessions throughout the entire transaction and see what happens with the data in the session:

Session begins

Computer navigates to web service, gets session id=X and session data gets stored in DB as id = X, session_data = {"User": null, "IP_address":..., "Mac":..., "Other_device_specific_info":...}

User logs in

User logs in and session data in the database gets updated like UPDATE sessions SET session_data->user = Y WHERE id = X;. The session has been updated to reflect changes and permission changes, but the session ID doesn't need to be updated because it's the same machine, on the same visit.

User does stuff

User does some stuff and the session_data gets updated again, setting other values in it they want to track.

User logs out

Now the user logs out, and the session destroys the data, but keeps the id and makes a new fresh session with that same id because it's the same machine on the same visit and it now looks like id = X, session_data = {"User": null, "IP_address":...} which is identical to the original, non user session.

A different user logs in

Now a different user logs in and we do the same things again.

Eventually the person closes the window/tab

Since the session ID was ephemeral/times out eventually it will get destroyed, and then when that machine visits again it will have a new session ID.

As you can see, as long the back end has been designed correctly, using the same session ID isn't a problem at all. IT(both it and IT) would be a problem if the same session data was reused.

The Bad News

This all assumes that the session data, and id, are tracked correctly and the web service is not vulnerable because of the session ID being associated to the machine and not the user.

Realistically it should change at some point

Things to make sure of

Sessions are set up safely
Session flow makes sense
Session ID != Session data
Session data is stored securely

Extra information

Sessions are really more of a method and guidelines for storing state based information in some place
They can be setup infinitely many safe ways
They can be setup infinitely many unsafe ways
You're really trusting someone else to have done it right when you use their services, so there are no guarantees

Just because a session ID is linked to a machine and not a user, doesn't mean it's been setup wrong. It just means they're probably also tracking what users have used what machines, for how long for metric purposes.

Things to be aware of just in case

You should probably Google these terms just to make sure your setup is safe

Session Fixation
Replay Attacks
MITM attacks
Unsafe connections
Forever Sessions
Ephemeral Sessions
Cookie Session
Database Session
Redis Session
Stateless Web App


ELF so file got flagged as Exploit, how to confirm if this malicious VirusTotal is claiming that file contains exploit: https://www.virustotal.com/#/file/31dd9c543e653c0cacfe152f735573e85b49df519c37a32ff76469d0dee6d63b/relations

How to confirm it is not just false positive? What is possible to do here?

If the file was installed by the OS package manager you can compare the hash and package signature against that of the distribution. Given that it's been flagged as a malicious apk it is likely a bad rule, but if you don't have a trusted source to compare it against you can't really be sure it's not malicious.

Ps. it can still be a malicious library, just one that doesn't have any existing detections or known badness ... ;)


JSON web token vulnerability with HMAC and RSA I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here

Though I understood the nature of the bug and how it can be abused by attackers, I couldn't figure out how to exploit it. I have read many articles about it and came across a URL which can be used to test this vulnerability for educational purposes.  (You can find the two links for testing below.

JSON security

Public key

Does anyone have any thoughts on how I can exploit this?

Finally I bypassed it with custom JWT algorithm, where HMAC accepts public key as its secret key. Which cannot be done in python's pyjwt module or any other language since it is fixed.

Check out POC code here