When should TouchID/Fingerprint log-in expire? I couldn't find such a standard which mention about TouchID or fingerprint log in expiration date.

Suppose I have an application and allow users to log in using the fingerprint. I would like to know for how long should I allow my user to log in with fingerprint before I required them to enter the password again. For example, allow the user to log in using fingerprint for 3 months and every 3 months user need to re-enter the password.

Is there such a standard specify about the time length? or it can last forever?

Why not treat it the same way as a password? It is just another factor of authentication.

NIST800-63B recommends re-authentication at 30 minutes for inactivity or 12 hours of active use. https://pages.nist.gov/800-63-3/sp800-63b.html .


Why aren't IMSI catchers rendered ineffective by standard MITM defenses? There's been a lot of reporting in the past few years about law enforcement agencies using IMSI catchers (also known as Stingrays after a popular brand of them) to intercept cellular communications.

If I understand correctly, what IMSI catchers do is basically a man-in-the-middle (MITM) attack, by insinuating themselves between cell phones and cell towers.

However, in the context of the Internet, we've known how to defend against MITM attacks for decades (namely, through public-key cryptography).

Why aren't IMSI catchers rendered ineffective by similar defenses employed in cellular networks?

tl;dr - the protocols were developed prior to MITM being perceived as a threat; the deployed infrastructure now serving billions of cell phones worldwide can't easily be changed to add cell tower validation; and governments have no interest in fixing this issue.

Cell phone protocols differ from IP protocols in that they were never a peer-to-peer network of untrusted devices.  The original cell phones were analog, with only a small channel of digital data to carry call information.  These analog protocols were developed in the 1970s when the micro CPUs had almost no power or storage, and the only security thought was to ensure accurate billing.  Also working in the cellular companies' favor, the only equipment authorized to transmit on those frequencies was under full control of the cellular manufacturers; companies like Motorola had a virtual lock on all the equipment on both ends of the call.  The protocol they created was such that the cell phones implicitly trust the cell towers for all operational information:  signal strength measurements (for optimizing battery life), network IDs (for billing and roaming charges), and encryption requirements (which need to be turned off on a per-jurisdiction basis.)  The phone responds with its ID in order to register to receive incoming call information, and the phone company authenticates the ID to ensure proper billing.  But in all this, the phone never authenticates the tower.

Also, all this metadata is exchanged in cleartext.  When digital cellular protocols like GSM arrived, nothing much had changed in the security model.  In the 1990s, the main security threat was eavesdroppers, so laws were passed in the US prohibiting listening in on cell calls.  Digital voice data was easy to encrypt to protect the privacy of the calls, (supposedly a government agency ensured that weak encryption algorithms were selected.)  Otherwise, the existing cellular protocols continued to work without many security issues (security issues primarily being defined by the cellular companies as "people hacking our systems to make free calls".)

Stingrays and other IMSI-catchers violate the cell tower agreements by producing an illegal signal, pretending to be a cell tower.  They forge a signal strength response of "excellent", which causes the phone to not switch towers.  They identify themselves as various common network IDs, so the phones do not switch away to avoid roaming charges.  They control the encryption flag, which will cause a phone to downgrade security either to the least secure algorithm, or disable encryption completely.  As far as a MITM goes, they may pass along the phone call data to a legitimate tower, or they may simply send back an error code the user sees as a call failure.

Nowhere in the protocol designs was a thought given to malicious actors transmitting on their licensed frequencies.  Illegal use of airwaves has long been a felony, and their original approach was legal:  "if someone even tries to spoof a cell phone, we'll have them arrested and locked up for a decade."

But it turns out that not everyone is afraid of committing a crime, least of all police departments armed with warrants and Stingrays.  Private researchers have also exploited loopholes in the law, where they transmit cell tower signals legally on unlicensed frequencies (the ISM band). This same band happens to be allocated for cell use in foreign countries, so a quad-band phone in the US will happily receive the faked signals.


Why am I sometimes spontaneously presented with an SSL certificate from my U-Verse Residential Gateway? Sometimes, we will experience a brief "hiccup" in our AT&T UVerse internet service. When this happens, and a user happens to be surfing the web at the same time, we will suddenly be presented with this:

This will actually come from the website that the user is on, such as Gmail, or any other HTTPS website. When I click "View Certificate:"

Can someone explain to me what is going on here? Is there any explanation for this behavior that isn't nefarious? I mean... I'm often reminded of the quote that one should not attribute to malice what can be written off as incompetence, but... doesn't this look really sketchy? Could I be exposing otherwise encrypted data to AT&T because of this?

The rg is trying to get you to look at a different page by hijacking the one you were headed to.  Similar to the way some WiFi gateways will force a redirect to an auth page by hijaçkong the first thing you try to access on 80 or 443.  Att does this fptr different reasons, like when they were pushing bittorrent users to pages trying to promote paid video and music services.


What does the POST data of HackBar (Firefox add-on) do? What does the POST DATA Feature of Hackbar (Addon of Firefox )do ?

If I am checking for XML XXE vulnerability i use it .But what does it do by POSTing some data ?

If I want to repeat the same thing using Burp Suite ,how do I do this ?

It does exactly what it says, it sends a POST request.

If you check "Enable Post Data", the request method will be changed from GET to POST. All data that you enter in the "Post data" field will be send in the body as POST data. The resulting HTTP request will look like this:

POST /?foo=bar HTTP/1.1
Host: example.com
Connection: close

test1=test&test2=test

Compare this with a GET request:

GET /?foo=bar HTTP/1.1
Host: example.com
Connection: close

You can see that the HTTP method is different, and that a GET method will not send a body.

In Burp, you can either just capture an existing POST request and change it on the fly or send it to the repeater, or you can use "right-click -> Change Request Method" on an existing GET request (or just build the whole request from scratch) to send a POST request.


Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and Tweet buttons. We expect that an average user will "Like" or "Tweet" 3-5 articles each day.

User opens our page, finds an interesting article
User clicks on "Like" button
Facebook asks for credentials in a popup
Popup closes, Likes increment by one
However, if user decided to leave our page and visit his Facebook account - it turns out he is logged in. If he navigates around our page and decides to Like more articles - he doesn't need to type his credentials again because FB session is already in place.

It's fine if user is at home or uses his phone. However, that's a risk for public access computers (school, library). Is there anything I can do to lower the risk? FB session seems to be long-lived. For me it WAS NOT obvious that you will be logged in FB.. Maybe I'm just too old.

Public access computers are typically set to destroy all user activity upon log out, or at least they should be. So don't worry about that so much.

Now for the bulk of your question: You are not responsible for Facebook's actions. You didn't code your api, you don't administer their account sessions. But since you have this knowledge, share it with your users. Next to the "like this page!" button, put a small disclaimer: "clicking this will require you to log into facebook on this computer." Now your users know they've logged in, and they can logout after they finish browsing. If they don't, then that's something they have to deal with. And if they don't understand because they're 10? Well, that's why we have the age limit of 13 for Facebook and other sites that collect data on people ;)


CSRF prevention in PHP Two questions.

Where does one download the PHP version of OWASP's CSRF Guard?  The following URL says to check Git:

https://www.owasp.org/index.php/PHP_CSRF_Guard

All I see on Git however is *.java files and *.js files.  If there are PHP files where in the directory structure are they?
phpBB prevents CSRF by adding two hidden parameters to all forms.  The time and a SHA1 hash of the time, a per-user "form salt", the session identifier and the form name.  Source:

https://github.com/phpbb/phpbb3/blob/c3aa466523e9b074bc4479eccc7b0514972f4b28/phpBB/includes/functions.php#L2544

My question is...  why is anything other than the form salt necessary?  To prevent CSRF all you need is a random string that an attacker can't predict so that they can't send an HTTP request blind and the form salt would do the trick it seems to me.  Hashing that together with everything else just seems unnecessary.

Maybe their motivation is that the form salt could be compromised if someone copy / pasted the HTML contents of the page?  Maybe it's intended to future proof it?  An XSS vulnerability would permanently compromise the CSRF protections if the form salt was used directly whereas with a hash of time and the form salt protects against that scenario.

Also, if the salt was just two characters or so I could understand doing the sha1() hash but a two character long salt is just insecure because all you need to do at that point is send 256**2 blind HTTP requests, each with a different token.  But it's not two characters long either.

Peculiar, but you're not the first person to ask about it, and there's even a suggested implementation for CSRF protection there + the code hosted on github. I can't really vouch for this mechanism though, haven't really inspected it too closely.
Interesting question. It does seem to me that phpbb went a little over-the-top with the implementation, but there's some logic behind it. The salt alone wouldn't be enough, because in the phpbb case, the user_form_salt value is a static per-user value, which doesn't change for that particular user. This means that once this value is known/disclosed (and there are probably many ways in which this value can be leaked or obtained), then all user forms can be compromised. Forever (or more precisely for the duration of this salt, but it doesn't change typically). The method implemented there has the advantage that the value constantly changes, yet it is 'reproducible' by the server for checking without having to store it anywhere. It uses existing stored data + some random elements to generate the CSRF token. I am not too sure but am guessing that using, e.g. hash/HMAC of the time with the some internal (not-exposed) random session variable as key, would achieve the same result.

Lastly, just a short note about your comment regarding XSS and CSRF. You said that

  An XSS vulnerability would permanently compromise the CSRF protections if the form salt was used directly whereas with a hash of time and the form salt protects against that scenario.

Basically, an XSS vulnerability has the potential to compromise ANY CSRF protection. If the attacker is able to execute code with the user session, they have access to all form data, however well protected it may be.


What is the PCI requirement for tracking software installation on workstations? We have a task open right now to implement UAC and matching event log tracking for our devs installing software on their machines. I've been asked whether storing/parsing these logs centrally is a requirement for PCI compliance.

I am but an egg. I've flipped through the PCI-DSS 3.1 document, but found nothing definitive. What should I do?

I agree with Shane Andrie. Dev machines considered in PCI scope is quite scary. I'd rather look in to moving them out of scope irrespectively of logging requirements.

To answer your question: Yes, storing logs centrally is a PCI requirement. Please refer to requirement 10.5 (excl 10.5.5).

10.5.1 Limit viewing of audit trails to those with a job-related need.
10.5.2 Protect audit trail files from unauthorized modifications.
10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter.
10.5.4 Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.


How to use a Blind SQL-i keyword? After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return.

Blind SQL Injection:

[+] Vul [Blind SQL-i]: http:/192.168.1.100/browse.html?user_id=10590'+AND+'1'='1
[+] Keyword: Compassion

How to use the keyword in order to inject successfully?

What the vulnerability scanner tried is to add a condition that is either true for all rows ('1'='1', tautology, added with 10590' AND '1'='1) or false for each row ('1'='0', contradiction, added with 10590' AND '1'='1). If you don’t get a different result for these, it’s probably not vulnerable.

However, that the user_id values 10590 and 10590' AND '1'='1 gives you different results is probably because there is no user with the ID 10590' AND '1'='1.


How can security audits be integrated into an agile project? If we give a security auditing company a working system, and ask them to audit it, and only do that once during a project because it's expensive, this is basically waterfall.

How can security auditing be integrated into an agile project without turning it into a waterfall project, and thereby introducing audit fail risk?

What we want to do is know the detailed security requirements upfront, so that we can create stories for them (and/or integrate them into existing stories), and write automated tests for them which give us some degree of confidence that the security requirements have been fulfilled. This is the agile way.

But the trouble is, if you don't know exactly what the first production deployment is going to look like until soon before deploying to production, because it's an agile project, you can't tell a security auditing company what exactly it's going to look like. So they may tell you "the number of possible vulnerabilities in an arbitrary system is extremely large, so we have to know what it looks like to narrow it down, so come back when you know what it's going to look like, and then we will give you the requirements". In that case, you can't do it in an agile way.

Microsoft's guidelines for Security Development Life-cycle (SDL) for Agile recommends security practices during design, implementation, and release of the project.  Regardless of the development methodology in use,  no line of code should make it into production until it has undergone a security review.  If financial constraints are preventing this level of security review from a professional,  then a security review must be conducted by peers before a release can be finalized.   Finalizing a release can be made into a fun process, I have seen companies host company-wide hack-a-thons and hand out prizes for interesting bugs.

Microsoft has done a lot of work in SDL and Microsoft's security has improved.


Who should I use for auditing/cerifying server software or specific deployment Background: our company provides an online service. The service is provided both to general public, and to enterprise customers. Enterprise customers are signed on as part of sales efforts. We have encountered one customer (in Japan), who requires us to be audited for security. That's pretty much all the have requested, though, i.e. they do not ask for any specific standard, or identified any companies that they would prefer to be used.

Question: considering that I'm completely ignorant in standards in this area, who should I try turning to at all? Is there a good standard of certification of a particular application deployment, that is widely accepted? If I at least knew that, it would probably be easier to Google a company that would do such an audit, but any name suggestions would be also appreciated.

You can get several things, if they need Assurance, you will need to get something along the ISAE3402. If you need pure security, you can hire a company that performs Attack and Penetration testing. There are several companies that perform this service, some more reputable than others. Most of the big 4 (Ernst & Young (<== My shop) , KPMG, PriceWaterhouseCoopers or Deloitte) perform these services and are in general, globally accepted. Consult with your client if they have a preferred company.

Just make sure that your client is clear what they want,  because pure A&P reports are often not accepted for Assurance.


Why do malware creators use such clever technologies for such silly purposes? Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question).

It was a two-stage infection: first an obvious malware went in via Internet Explorer (fully patched, so there probably is some still unknown hole there) and started running and doing silly things like hiding all my files and flashing fake system warning popups asking me to reboot due to a "disk controller malfunction"; this was probably a way to trick me into rebooting to load the actual malware. Then, after this was removed (very easily, a simple Run Registry key), it left a rootkit behind which was absolutely undetectable... but that kept doing silly things too, like hijacking Google searches and launching background iexplore.exe processes which were clearly visible in the Task Manager (wonder what they were doing, though). At last, I was able to get rid of it by rewriting the system drive's MBR and boot sector, where some loader code had been hidden; I still don't know what that was actually loading, though.

What I'm wondering now is: people writing malware are becoming increasingly clever, using more and more advanced stealth techniques... and yet, they keep using these powerful tools to do silly things like showing advertisements, which by now almost everyone recognizes as a sure sign of malware infection (and who ever does click on them, anyway?). If it wasn't for the search hijacking and background iexplore.exe processes, I'd never have guessed a rootkit was still there after the "main" infection... and, if the "main" infection hadn't played aroud with attrib.exe to make me think all my files had disappeared, I would have just not noticed it and it would have been free to load the rootkit upon the next reboot (which, being that a home computer, would for sure have happened in at most a day).

Such a stealth rootkit could have stayed there for a long time, if it didn't make such efforts to show its presence; and it could have done real damage, like installing a keylogger or taking part in a botnet; which it maybe also did, too... but since it was so obvious the machine was infected, I started looking for a way to clean it, and found it (or otherwise I'd have just formatted, which I'm going to do anyway, just to be sure).

So, the question remains: why all of these clever infection and stealth techniques are being wasted on showing useless advertisements?

Various reasons:

Attacker is often not the Developer - Developers of malware sell the packages to anyone - the payload will be then defined by the attacker. Some attackers want to be stealthy - some don't, in fact some delight in being obvious and notorious.

Practice - developing techniques

Apathy/Ignorance - end users are really no good at fixing problems that can't be resolved by clicking on antivirus or malware cleaners.

Money - click-thrus and clickjacking can make good money. Viagra/Cialis spam also makes money. Fake-malware removal tool downloads can make a lot of money.


where can find sample coding for use of Bouncy Castle(java)? I had found bcprov-ext-jdk16-145.jar and bcprov-jdk16-145.zip. I wish to use the IDEA encryption to encrypt XML, but I haven't found any sample of coding in JAVA.

Can anyone tell me how to call the methods in org.bouncycastle.jce.provider.symmetric.* to do the IDEA encryption and decryption or where can find sample code?

BouncyCastle is a standard JCE provider, so most Java crypto code will work just fine. You just need to add the provider to java.security...  security.provider.6=org.bouncycastle.jce.provider.BouncyCastleProvider
I'd recommend using something like OWASP ESAPI instead of using the crypto API directly.


Keep receiving delivery failures for emails im not sending I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different domains that are saying an email I tried to send to them was rejected or couldn't be delivered. But I didn't send any emails to these addresses. The original sender address is never a real email address I have set up. I have looked through my access logs, and no out-going emails were found from my address, and no emails to them in any outbox.

So I'm guessing someone is sending emails pretending to be me. So, can someone advise me as to what the implications are, and (if possible) what i can do to prevent it?

The most likely culprit here is that somebody is spoofing addresses from your domain. There are a few ways that you can help remote network operators identify that the mail was likely spoofed. The main two things you can do is:

Setup Sender Policy Framework (SPF) records to identify which email servers are the only authorized email servers for your domain.
Setup DomainKeys Identified Mail (DKIM) to sign all your outgoing mail so remote email servers can drop mail that either not signed or has a broken signature.

Google Apps makes setting up both things really easy from an administrator standpoint.

Neither SPF or DKIM will prevent people from spoofing email from your domain, but it certainly helps prevent email server operators from processing and delivering any spoofed spammy mail.


Managing/Deploying a code signature certificate - Java Applet I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the certificate, as it is needed by users to verify code signature ?

We can embed it in the JVM, but we could also deploy it via GPO or Public Key Policies in the windows certificate store. What is the best solution ? (keeping in mind revocation or renewal process).

Best way seems to use a code signing certificate from a well-known CA. Since well-known CA certificates are already trusted by Client (browser, OS), there is no need for additional maintenance with this setup.

Java Applet & Web Start - Code Signing states that

  ...Users will be better protected by maintaining up-to-date versions
  of the JRE on their systems, combined with requiring code that is
  signed by a Trusted Certificate Authority (rather than self-signed or
  unsigned code)...

  ...self-signing is primarily of value to developer and intranet
  applications as it also requires managing the keystore for Java...

When using a certificate from CA, renewal poses no problems, we may just sign with renewed certificate. Trusted timestamping, while adding complexity, allows Clients to validate your signature even after your signature expires, given that it had been valid during signing operation (see Signing code for the long haul).

Certificate revocation is checked using Online Certificate Status Protocol (OCSP) at the Client. For details please see Revocation Checking for Java Applications section here.

Nonetheless, there are many large enterprises who manage an in-house CA, primarily for issuing server certificates. If such an infrastructure is already in place, we may assume that internal CA certificates are already being distrubuted to Clients in one way or another, for Clients to be able to trust the servers. If this is the case, issuing code signing certificates from the same CA may not cause additional administrative overhead.


Searching Encrypted Data from Database Suppose I have a table with email is stored in one table.
I have encrypted it using AES-256 and stored the result in DB Column.
For let's say I have one input email and I want to search whether this email exists in DB or not:
Now I see two approaches to it

Encrypt the input and search for the encrypted value.
Use the concept of Blind Index(using HMAC SHA-256) and store it and then for input also create this HMAC and search it.

Which approach is better and why?
For Encrytion we are using Inhouse library which does AES-256 using secret Key/ Salt. Secret key is fetched from AWS KMS(Basically decrypt from AWS KMS)

Perhaps the common two-column approach used for login scenarios may be applicable here.
This is often where users need log in with their email (either because they forgot their username or the site doesn't use them), but their email address is considered confidential data that should not be stored in plaintext.
In this scenario, the database has two columns:

One column containing a peppered hash of the email addresses (such as SHA-256 (email + pepper), where "pepper" is just some secret bytes stored on the server or HSM. The term is taken from like how a "pepper" is used to protect passwords)
One column containing the encrypted email addresses (often encrypted by a standard DEK (data encryption key) via AES-256 with a random-IV-per-entry)

The first column is used to quickly look up user info for login purposes while the second column can be used to retrieve the actual email address whenever needed (e.g., for correspondence purposes).


GPG-encrypted mailing list and other approaches to safe communication What is the best way to communicate privately on a mailing-list?

Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to the point of being useless.

On the other hand, using only one private key of which every member knows the password is unsafe and, ultimately, extremely problematic when one member leaves the ML - you have to change the list's private key, thereby making all previously encrypted messages unreadable.

I've seen there are some implementations of secure ML's, but in my case  I have to use a hosted one (i.e. I cannot choose the ML software).

Any ideas?

When a secret is known by more than two or three people, it is no longer a secret, merely discreet. Any recipient of the mailing-list, by definition, can read all messages, hence he is trusted (in the sense of: he has the power to betray you). This limits your options.

With GnuPG, in your case, you can do any of the following:

Have each recipient own a key pair, as is normal with GnuPG. Each message is encrypted with all users as recipients (the OpenPGP format supports that; size overhead will be a few hundred bytes per recipient, hence tolerable as long as there are less than a few hundred recipients). The mailing-list maintainer regularly sends the list of recipients over the mailing-list itself, so that every user can know the public keys of all recipients.

This method is what maps best on what GnuPG inherently knows how to do. However, it has some drawbacks: size overhead (depending on the number of recipients), complex task for senders (not all GnuPG interfaces make it easy to send an email to dozens of recipients), publication of the list of recipients (every member of the list learns who else is a member).
Do a relay. There again, each recipient owns a key pair. However, messages are sent with a single recipient (e.g. the mailing-list maintainer) who then forwards the message to all recipients. This makes it much easier for the end users, since they just send the messages to the mailing-list maintainer; and each relayed message can be encrypted for a single recipient at a time. This solves the issues of the previous method.

However, it adds a few additional issues: extra latency (each message must wait for the maintainer to process it), increased vulnerability to censorship (the maintainer can block any message), more complex signatures (if the sender signs his message, the maintainer must wrap the signed message within the encryption for everybody else; this is allowed by the file format but some implementation might have some trouble processing that). Also, the maintainer himself has a lot of work or must use some automated tools which may or may not be available to him.
Use a common password. Instead of using asymmetric key pairs, use symmetric encryption with a password that all recipients know. This is decentralized: to add a subscriber, it suffices to give him the password, and every subscriber can do that. The mailing-list itself can be replaced by any medium, even decentralized systems which will support a no-single-point-of-failure mode (for instance, Usenet). This scheme most closely resembles what was used by resistance networks during WWII (see Radio Londres for instance).

The main problem with a common password is what I said at the beginning of this answer: a common password cannot be that secret.

Mixed strategies are possible. For instance, split your subscribers into cells, where the members of each cell know each other (and may share a common password or at least know each other's public keys), and know the public key of two or three people in "adjacent" cells. Messages are then relayed from cell to cell, with nobody knowing the full extent of the network. Such networks have historically proved robust with regards to infiltration and total collapse. See also this novel for an illustration. This might be a bit extreme in your case -- it really depends on your security model. Maybe your situation is not of the life threatening persuasion.


OpenID Connect, OAuth2, and deleted accounts If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 provider to the old account so that the customer does lose their stored information? Do I need to set up some alternate means of authentication at account creation time?

I was thinking that as part of the registration with their original OAuth2 provider (e.g. Facebook), I would request their email address from Facebook and store that. Later, when their Facebook account is deleted, can I just have them re-register, say with Google+, Twitter, LinkedIn, or some other OAuth2 (OpenID Connect) provider that I accept, request the email from that new provider and then simply associate the new account with the old account registered under Facebook? Is this safe from a security standpoint? It depends on the email address really being theirs and that the OAuth2 providers verified that.

I was thinking that as part of the registration with their original OAuth2 provider (e.g. Facebook), I would request their email address

You can try to use the e-mail address as a unique key, and it might mostly work, but it's fraught with problems.

If the user registers with a Google Account or a Yahoo account, the provided E-Mail address will most likely be tied to the account. So when the account gets deleted, the E-Mail address perishes, too.
If a user deletes an account from an identity provider that is also providing the user with his e-mail address (see point 1), then a simple attack becomes possible: Eve can register a new account with the identity provider and reactivate the e-mail address, but now it will belong to Eve instead of the original user.
There is no guarantee that different identity providers will send you the same e-mail address for a given user. In fact, it's rather unlikely. So you won't be able to identify the "same" user based on the e-mail address in the ID token.

If you really need to have a user access his account despite his having deleted the account he usually logs in with, you need to set up an alternative form of authentication before he deletes the account. For example, you could let him link his account with multiple identity providers, provide him with an emergency "access token" that can be used to redeem an account (either directly or by asking for his phone number of an alternative e-mail address), or use any of the security question schemes other sites use.


BouncyCastle and Microsoft Cng ECDH secret key mismatch I'm trying to refactor some client-side code from BouncyCastle to Microsoft Cng. I've figured out how to convert key format(ECC key blobs) between them, but I couldn't calculate the same secret.

Currently, the client uses Org.BouncyCastle.Crypto.Agreement.ECDHBasicAgreement.CalculateAgreement() to calculate the shared secret. The length of the shared secret depends on the curve(e.g, length of shared secrets for SecP224k1 is 28 bytes).

Microsoft Cng(System.Security.Cryptography.ECDiffieHellman) provides several methods: DeriveKeyMaterial, DeriveKeyFromHash. However, none of them returns a result of 28 bytes. DeriveKeyFromHash returns bytes of 16/20/32/48/64 depends on HashAlgorithm, and DeriveKeyMaterial returns the same 32 bytes as DeriveKeyFromHash(SHA256).

Edit: Microsoft Cng's DeriveKey returns Hashed secret.

How to calculate the same secret using Microsoft Cng?

Thanks to @Dave Satchell 's comment.

I go inside to .Net Framework source code. All DeriveKey calls System.Security.Cryptography.NCryptNative.UnsafeNativeMethods.NCryptDeriveKey, which is P/Invoke of ncrypt.dll. You had to pass a key derivation function to NCryptDeriveKey

For anyone who still want to calculate it without BouncyCastle or OpenSSL: I've calculate the shared secret by translating python code.
You may need to implement your own BigInteger or using System.Numerics;
Note: System.Numerics.BigInteger is little endian, and % (mod) works different in C# and Python.


Which method is the best for IDS : heuristic or signature based? In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack.

Problems:

New attack that has been specifically constructed in order to not match existing attack signatures.
The attacker crafting the traffic may have access to the same IDS tools we are using, and may be able to test the attack against them in order to specifically avoid our security measures.

Heuristic detection (Anomaly) based IDS: instead of looking for matches, heuristic intrusion detection looks for behavior that is out of the ordinary. Taking a baseline of the normal traffic and activity taking place on the network.

Problems:

Seeing larger numbers of false positive comparing signature based IDSes.
If the traffic on the network changes from what was present when we took our baseline, the IDS may see this as attack for a legitimate activity that causes unusual traffic patterns.

So in overall, which one should I prefer?

So in overall,which one should I prefer ?

You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives.

Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes with higher false positive rate. You need to look through the logs and decide yourself if this a true positive (i.e. attack) or not. If you are not able to do this then the heuristics will probably be only in the way when accessing harmless sites.

Apart from that heuristics are usually not used alone because they might be able to detect an attack which has no signature but fails to detect attacks which have a signature. Thus they are usually used together with the static signatures.


Dynamic forking of a process in win32 vs modern antiviruses Most tutorials about crypters assume that popular antiviruses don't scan programs executed directly from memory. However from what I've seen, some of them (e.g. Nod32) are able to scan RAM in search for known patterns. This makes me wonder... here's what I know:

[Malicious file] --> [Encrypter] --> [Stub + encrypted malicious file] --> [final executable]

If we run the final executable file, the Stub decrypts the malicious code, loads it to RAM and then executes it. I think that an antivirus program should detect the malicious code while it resides in RAM in an already decrypted form, waiting to be executed. Am I wrong?

You're right; it's possible for an antivirus to pause the proceedings and scan executable code that was loaded into memory. The kernel function to hook would be NtProtectVirtualMemory, which changes the protection on a chunk of memory (whether it can be read, written, or executed). If a process suddenly changed a writable chunk of memory to executable, that would be a perfect opportunity to see what might now be run.

If a process set a page to simultaneously writable and executable (so it could write and then immediately jump), that's already cause for concern before anything is even written, because the existence such a page helps open the door for exploits even in legitimate programs. Alternatively, the antivirus could just take note of such pages and spring into action on the next kernel call the process makes from code residing there.


Storing encryption keys on a server using Node.js and MySQL I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for encryption.

I would like to be able to safely encrypt and decrypt data on the server. Data sent back and forth to the client will be unencrypted, but sent over HTTPS (is this a good idea)?

My Questions:

How should I generate the keys? Should they be random strings?
Where should I store the keys since there is going to be a different key for each message.

Adversary Model
I would like to protect against someone who already has access to my server running the https API (written in Node.js) and has access to my MySQL DB. I would like to project against that person being able to decrypt the encrypted data in that table. So it is important that even if they have lots of encrypted data, and how the encryption works still cannot decrypt the data.

Hopefully I am understanding this properly. Client sends message to server over SSL encrypted connection. Server gets the message and stores it in a database. You are worried that if someone breaks into the server, they can read the database and see all the messages.

So, encryption seems like a natural fit. Encrypt the messages (each with a different key) before storing them in the database. The problem now is, what do to with the keys. You can't just store them on the server as the attacker is on the server. They can easily find the keys, pull the entire database and decrypt everything.

It would appear your best options are storing the keys on a different machine and let that machine do the encryption/decryption. That way the attacker would first have to break into your machine, then into the encryption/decryption machine. Not impossible, but hopefully much harder.

Another option would be some cryptographic hardware. This is beyond my expertise, but companies sell hardware that performs cryptographic operations including key storage, encryption and decryption.

Here is the tricky part. What stops the attacker from querying the other machine or the cryptographic hardware repeatedly until he has decrypted all the messages? You'll have to build some sort of detection on there or something like that.

In short, given your adversary model (attacker with root privileges on the box), the problem is pretty hard. Hopefully one of these two options will be useful to you, or at least generate some other answers.


Sniffing my networks traffic illegal? So this is a pretty straight forward question.

If I setup a free and open wifi access point called "Free&Tots-Secure" then sniff all the traffic of people that connect to it, does that violate the computer fraud and abuse act?

Expanding on the above question, what if I use a tool like ssl stripper to force http traffic only. Does this constitute a breach of the CFAA?

We are assuming the following.

This is an open access point that is setup by me and is tunneling traffic through my actual home internet network.
Does NOT notify users when they connect their data is being captured and inspected.
Is not being used maliciously but only for my own education and advancement of capabilities with real world scenarios.

These types of question has depends answers. The answer varies depending on the policies of owner of open WiFi and plans among other factors.
but This question specially has 2 aspects: (second aspect may be your answer)

First one: connecting people to an open WiFi network, without having the owner's permission and following his/her terms of service is illegal.

Using a neighbor's wireless access point without the neighbour's permission is illegal.

the examples are:

Many U.S. states prohibit unauthorized access to computer networks including open Wi-Fi networks. While interpretations of these laws may vary, some precedents have been set:

2007 - a man in Michigan was fined for using the Wi-Fi hotspot of a local cafe, from his car.
2006 - Illinois man David Kauchak was fined for unauthorized use of a local agency's Wi-Fi access point.
2005 - a Florida man faced felony charges for piggybacking onto a neighbor's Internet connection without their permission.
Similar restrictions on using open Wi-Fi networks exist outside the U.S. as well:
2006 - In Singapore, a teenager received a probationary sentence for wirelessly. accessing a neighbor's Internet connection without their permission.
2005 - In the U.K., Gregory Straszkiewicz was fined and his computer confiscated for using a local resident's Internet service illicitly.

Therefore, as yours rights:Just as entering a home or business without the owner's permission is considered trespassing (even if the doors are unlocked), likewise accessing wireless Internet connections (even open access ones) can be considered an illegal activity. At a minimum, obtain consent from the operator of any Wi-Fi access point before using their service. Read any online Terms of Service documentation carefully when signing on, and contact the owner offline if necessary to ensure compliance.

So if people connect to your open WiFi whiteout your permission they accept the risks and your terms of services by default.

Second one:  if someone provides an open WiFi, specially for malicious proposes in some cases it can considered as crime. since your proposes are not malicious it is better that you consider a terms of service, in order to probable future states.

and also read this news:

Sniffing open WiFi networks is not wiretapping, judge says

Packet-Sniffing Laws Murky as Open Wi-Fi Proliferates

Public Wifi Data = Radio Waves Legally Accessible by Anyone


Setup a quick web site vulnerable to Shellshock bash bug Can anyone let me know the steps to setup a simple Hello World Apache (or other GNU/Linux) website that i can hit over 80 or 443 and exploit any bash CVE vuln; assuming I have a vulnerable bash.

I dont have ssh creds to 100% of the boxes, and the bash (rpm) tests only work with credentialed scans.

I want to hit the URL, scan without any creds and see a positive finding from Nessus. Then patch bash and see that my URL is clean again.

But I need help building a little web site please. Thanks!

Stick the following script in your webserver's /cgi-bin/ directory and chmod it a+x:

#!/bin/bash

echo "Content-Type: text/plain"
echo ""
echo "Bash is here"

Note that this explicitly invokes bash, so systems with an unpatched bash will show as vulnerable even if the system shell is something else.


Sniff wireless (Wi-Fi) trafic with Wireshark I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode.

The test network is a Wi-Fi network protected by WEP (I have the key).

In Wireshark, I only see information packets (Probe requests, beacon frames, etc.), but no "real" traffic, even if I'm using the network with another device connected to the network. Why?

Be sure to have disabled on AP the "client isolation" option. That could be the problem. If you are pretty sure that everything is good set up.

To check this you can do a test without sniffing... just connect two clients to the network using the WEP key you already have and try to communicate between them. A ping is a good test if you have no icmp filter on both devices/pcs . If you can't ping between them, I guess you have that "client isolation" option that is crashing your sniffing tests. If you can ping, then there is no "client isolation" and you must dig into wireshark config to try to setup correctly the WEP key, the channel or whatever.


Can we trust the information displayed by the linux utility commands for a vulnerable machine? After checking a vulnerable linux machine for rootkit and deleting them, we need to get some informations about the process , port ,incoming or outgoing connections... , using some useful commands as ps , netstat , top, lsof ...

Can we trust the information displayed by the linux utility commands?

As the system is compromised, nothing is to be trusted via way of tools. Unless you have the tools validated (e.g. Tripwire FIM), your best bet is to take a similar system, copy over what is necessary, which should run if the systems are similar in architecture, etc. This is not the optimal method though. Because the machine is compromised, depending on your next steps (legal, authorities, etc), you would create a forensic image, then deal with what occurred as you have your copy. Once you have your copy, you need to determine the risk associated with putting the system back online, etc.

If you have determined how an attacker got onto the system, you would need to clean up that 'hole' (vulnerability, misconfiguration) in order to be sure they don't return. Sometimes this can be more time consuming versus installing a clean system. But let's say you need 'that' system. You could reinstall ps with something like: apt-get install --reinstall procps same applies for lsof. You would want to make sure your repos were not changed, and your DNS is not pointing to a non-trusted repo.

For the most part to answer your question: Can we trust the information displayed by the linux utility commands the answer is you absolutely should not. Little on that system should be trusted until a thorough analysis is performed.


What are the security implications of SSH tunneling? We have an internal lan (not connected to internet, all internal ip addresses, behind a firewall, no routing to outside), we also have a machine that sits on the edge of our lan (two nics, one on the internal lan, one on a public lan that can "see" the internet).

I need to see machines on the public lan, from the internal lan, I can SSH to the machine on the edge and tunnel my trafic to see the services that I need on the machine on the public network.

I want to know if this poses any additional security implications?

To be able to run SSH tunneling, you must have an account on the "edge" machine. It is difficult to permit tunneling without giving a complete shell access on that machine. That's a shell as a generic user. Theoretically, Unix-like systems enforce strict security rules with regards to local users, so that giving a shell access to a user is not a big deal. In practice, if your users are potential attackers, this increases the attack surface: you have to worry about what such attackers can do to the edge machine from a shell running on that machine, as opposed to accessing the machine "from the network".

Also, if people from the internal LAN can SSH-connect to the edge machine, they are bound to try it also from the outside (i.e. from their home machine). You may or may not wish to allow that.

The common theme here is that SSH has a kind of all-or-nothing security model: you give access, or not, but it is not easy to enforce a restricted access ("you may connect by SSH on this machine but only to do this or that task"). To make a restricted access, you must set the user shell (at the Unix level) to a specific executable which does the filtering job, such as rssh, but I do not find this to be a really robust solution.


Why would TLSv1.0 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA still be used? First, I may be asking a dumb question. I am trying to learn, so please, take it easy on me.

Second, if this is not the right place for this question, or you can link me elsewhere, please tell me/ do so.

Third, I appreciate anyone who takes the time to answer.

This said, I am utilizing a desktop program (as a customer) which streams real time information and holds sensitive data on it as well, such as account values and account numbers. It does not hold or transmit credit card information.

Occasionally I have Wireshark running and noticed that this program completes its handshake using TLSv1.0 with the cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA. I can't seem to understand why this would be considering what I understand about TLSv1.0 and CBC (but note above, I am new to this). Is this at all, in any manner, appropriate because of its key exchange being ECDHE and encryption cipher of AES 256?

I know this is not PCI-DSS compliant and I know many vendors have completely moved away from TLSv1.0, as in completely disabled. I can only think the reason for this is because the owner of the program does not want to put clients out who may be using old OS that don't have newer cipher suites, but I could be misguided in my understanding of this. The owner recommended specs for OS is Windows 10, but see no issue as to why it would not operate on previous OS versions, including possibly Vista.

Obviously I am being coy about the program as I really have no idea if this poses any risk. Since I am novice, I suspect those who are in charge of the program have a valid reason for using this version of TLS/ Cipher Suite, but I thought I'd ask.

Thanks for taking the time to read.

edit: forgot to mention- Compression Method: null (0) - I have read that this should be set to null, in case this matters.

The used protocol and ciphers depend on the capabilities of both client and server. You don't say what kind of server is involved but usually today's TLS stacks on the client side offer a variety of ciphers and also still support TLS 1.0. If the server cannot do better than TLS 1.0 then this is what is used as the minimal protocol version. The for the cipher: the server picks the one which is both offered by the client and supported on the server. And, while TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA might not be the most modern cipher it is perfectly safe to use today.

Thus, in order to find out who is to blame for TLS 1.0 and for the cipher look closer at the handshake, i.e. look at the ClientHello on what the client offers (as  dave_thompson_085 correctly pointed out: look into the "inner" version and not the record layer version). If the client offers TLS 1.2 and the resulting protocol is only TLS 1.0 then the server is to blame for this and not the client. The same is true for the choice of ciphers, i.e. at the end the server decides what to use.

As to why a server still might support only TLS 1.0: it is probably some older system which does not support newer versions yet. And, since the cost of upgrade is not zero (not only the cost of software but also the cost of testing everything which depends on it and maybe more) the owner decided to not upgrade to a more modern system.


How to protect contact forms against being misused for mass-mailing? A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measures to protect against the form being used as a spamming tool by an automated script that submits it millions of times with different email addresses?

I can think of several approaches, but each one also has a downside or is not very effective.

CAPTCHAs can be broken too easily nowadays and are a hassle for the human submitter.
Rate limiting (only n submits per IP per day) won't help against a distributed script and may hinder proxied users.
Spam detection may generate false positives and if it's resource-intensive will make the site susceptible to DDOS attacks.

Each measure makes it harder/more resource intensive for an attacker though so he might just look elsewhere. How prevalent is comment-form spam? Do I have to worry about it?

You're right that allowing arbitrary, unauthenticated internet users to control both the content and the recipient of email messages sent by your web service (i.e. your website's "contact us" form) is a bad idea, and a potentially attractive target for spammers.

If it is important to you to:

enable the user to specify a recipient for the message; and
send a message to that recipient upon submission of the form,

then I suggest you at least prevent the user controlling the content of the message.

Why not take the sort of approach that GNU Mailman takes when it receives a subscription request? That is, send a confirmation email first, along the lines:

  You, or somebody pretending to be you, submitted a message to use
  using the contact form on our website. This came from [IP ADDRESS] and
  gave your email as the sender's email address. If you made this
  submission, please click [HERE], or reply to this email keeping the
  subject line intact, to confirm your contact form submission, and we
  will read your submission and reply in due course. If you did not send
  us a message via our contact form, please ignore this message.

You could rate-limit this so that it permits no more than one anonymous submission to a given email address per (week|month|year|whatever), with the timer being reset if the user confirms as per the above instructions. That would discourage trolls from using the form to nuisance innocent people by causing them to be sent spurious confirmation messages.

In any case, only once the submitter of the contact form has been verified to have access to the email account submitted, should the contents of the message submitted be made visible to the user of that email account.


Is sending token authentication information via cookie headers secure? I am by no means  a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I have incorporated django-channels, which is a package that gives me the ability to use websockets in my project. Since I have decoupled my front and backends , the basis of authentication I'm using is via tokens (will look into using JWT).

The issue is that with JavaScript , it is not possible to send authentication headers via websocket connection (or so I'm told) , therefore a lot of people are using cookies to send this authentication token instead. Here\s an example snippet of how  I am sending the token from my front end:

 const path = wsStart + 'localhost:8000'+ loc.pathname
    document.cookie = 'authorization=' + token + ';'
    this.socketRef = new WebSocket(path)

Doing this allows me to then extract out the token information through utilizing a customized middleware on my backend:

import re
from channels.db import database_sync_to_async
from django.db import close_old_connections

@database_sync_to_async
def get_user(token_key):
    try:
        return Token.objects.get(key=token_key).user
    except Token.DoesNotExist:
        return AnonymousUser()

class TokenAuthMiddleware:
    """
    Token authorization middleware for Django Channels 2
    see:
    https://channels.readthedocs.io/en/latest/topics/authentication.html#custom-authentication
    """

    def __init__(self, inner):
        self.inner = inner

    def __call__(self, scope):
        return TokenAuthMiddlewareInstance(scope, self)

class TokenAuthMiddlewareInstance:
    def __init__(self, scope, middleware):
        self.middleware = middleware
        self.scope = dict(scope)
        self.inner = self.middleware.inner

    async def __call__(self, receive, send):
        close_old_connections()
        headers = dict(self.scope["headers"])
        print(headers[b"cookie"])
        if b"authorization" in headers[b"cookie"]:
            print('still good here')
            cookies = headers[b"cookie"].decode()
            token_key = re.search("authorization=(.*)(; )?", cookies).group(1)
            if token_key:
                self.scope["user"] = await get_user(token_key)

        inner = self.inner(self.scope)
        return await inner(receive, send)

TokenAuthMiddlewareStack = lambda inner: TokenAuthMiddleware(AuthMiddlewareStack(inner))

However this has raised some form of security red flags (or so I'm told) .

Therefore I wish to extend this questions to the security veterans out there :

Is this methodology of sending token authentication information via cookie headers safe?
Is my implementation of this method safe?
Is there a way to secure this even further?

As you probably know already WebSockets does not implement any authentication or authorization methods by design, so the only possible way is to implement that on your own or use methods provided by frameworks like Django. Implementing secure authentication is hard.

From the technical point of view, you just have no other option but to send the authentication information with Cookies header. The only security requirement that comes in my mind for WebSockets you have to remember is to use secure connection, so "wss://" is a must.

Another thing is how you use the value send by cookie header on the server-side. The values included in cookie headers are considered as not safe as those are under the control of a user (sender). You should validate incoming values if it is not providing any malicious payload (SQL Injection, XSS), that could harm your backend. In your example, you are sending token value to a database so you should be aware of SQL injection (but not only) and provide correct mitigations into DB queries.

For input validation please refer to this OWASP Cheat sheet
For SQL injection mitigation refer to this SQL Injection Cheat Sheet

The next thing is more general, how you use the token. You are passing the token into the database and on behalf of this, you are returning the user. It looks like you are using the token like user ID (I cannot be sure). Using the JWT as an authentication info you should consider a couple of things:

data stored in the token are not changeable, if some data about the user will change, you have to generate a new token

you have to validate the JWT token on every call according to the standard
I would highly recommend to use encrypted JWT tokens, which is more secure but also adds additional overhead on cryptography operations.

You have to take those points into consideration and analyze the pros and cons regards to your use case from the perspective of usability, security, and possibly performance.

In regards JWT please refer to these links:
JWT Authentication Best Practices - please check also the links at the bottom of this article and articles comments.


can anyone with valid ssl certificate do man in middle attack? Suppose I have a valid SSL certificate for my application certified by valid CA and I turn evil.
Now I want to do MITM between A and B. When I'll get a request from A, I'll send my valid SSL certificate to A and then forward A's request to B. Is this possible? I'm talking about a scenario without browsers. i.e when URL bar is not visible to the user. if this is possible then how can I prevent it for my application?

For you to be able to mount a MITM attack between A and B, you would need to have a valid certificate. This certificate needs a few things:

it must be signed by a CA trusted by A
it must be valid (various parameters, including valid time range)
it must have B's DNS name in the Subject's Common Name field, or Subject Alternative Names.

Without all three, the browser (or any other well behaving client) will refuse the connection.
It sounds like you have a certificate for an arbitrary DNS C. This would fail the third requirement, causing it to be rejected.
How to really do a MITM:
You would need to present A with a valid certificate issued to B.
For this to happen, you would need to do one of the following:

get around the CA checks and convince them that you really are B, issuing a valid certificate
have your own CA trusted by A (if you have access to my computer, you could add your own CA certificate to the list of trusted root CAs
break public key cryptography, allowing you to forge certificates


e-tags on sensitive information Suppose we have a big JSON document that only certain users can see, but that rarely changes, but which, if it does change, users expect to see the change quite quickly. It makes sense to use etags for this - it saves the whole document being transferred over the wire if it didn't change, yet sends the document if it has.

One risk seems to be that if multiple people use the same browser window:

Alice signs into the site, and the resource is sent to her with an etag
Alice signs out and goes to get lunch
Bob users her browser to sign in as himself - but he can't view the resource
Bob looks in the browser cache, sees an etag that was stored by the browser, and configures his browser to send that same etag  - now Bob can see the data

I suppose that since Bob is already using Alice's browser instance, he could already see what's in the cache and therefore could read the data anyway.

It seems there is no safe way to use etags (or browser caching in general?) for sensitive information, and we should just store the data in memory with JavaScript. Or are we missing a specific way that it's meant to be used?

Using the etag to get the data

Knowing the etag alone will not help you with getting the secret resrource, assuming the server is properly implemented. The browser will check with the server to see if the etag is valid (using the If-None-Match header).

When Alice makes the request, she will be authenticated so the server should respond with 304 Not Modified, prompting the browser to load the resource from the cache.

But when Bob makes the request he is not authenticated, so the server should respond with 403 Forbidden. The browser will then not load anything from the cache (and if Bob is using a different browser than Alice, there wouldn't be anything to load anyway).

All this rests on the assumption that Cache-Control is set to no-cache (or absent). If not, the browser would load the resource directly from the cache without checking with the server. If Bob and Alice are using the same browser Bob would then get Alice version of the page, even though he is not authenticated.

Stealing the resource from the browser cache

As you point out, instead of just stealing the etag Bob could simply steal the actual resource from the cache.

Modern browsers protect against this in various ways. Unless Alice and Bob are using the same OS user or Bob is root or admin (depending on the OS) this could not be done without leveraging some exploit.

Still, if the resource is really sensitive and you expect your users to access it on computers that are shared with non trustworthy people, you should consider setting Cache-Control: no-store disabling all cache.


Ads embedded in phone apps - what is accessible? Imagine you are developing a "free" app for android & iPhone and want to refinance yourself through using some sketchy ad service. Does an app developer have to worry that the ad content he embeds can access information such as the user's phone number or maybe even his phonebook? Furthermore, is there some danger that the user's phone number can be made public if he clicks on the ad?

Naively I would imagine that all this information is safe on both android and iPhone. Hearing from many stolen phone numbers I was however wondering on what technical ground the access to such private information is "granted"?

I'm happy about general answers or more specific answers just covering one device type.

It actually depends on the implementation.

If the ad service just needs to pull a randomly chosen image from a website query then there is no risk at all there.

If the ad service needs a query to a page which needs to run javascript(Or other type of code execution) then there might be a information leak but ONLY if the app is able to do so for example with androids permission system an app that can only display UIs wont be able to read the phones data.


How to physically destroy an SSD at home? SSDs seem to be notoriously tricky to properly erase (see for example this question and answers here). An easier and potentially safer solution could be to physically destroy the SSD device.

I am looking for a way to physically destroy an SSD device that..

can be done at home / in an office (with limited emissions),
doesn't require any specialised equipment (standard homeworker tools would be ok),
provides at least as much safety of destroying all the data as the current software erasure options.

The goal is not to protect against state-level actors, but to provide secure physical data disposal options for average home users or small/medium sized businesses. And it should be practical (of course we can dispose of an SSD in an industrial furnace, but ... - you get the gist ;)).

This question was once asked and answered for HDDs, but in todays times the more relevant question is likely how to get rid of SSD or M2 drives.

The most practical option for physically destroying an SSD is to simply use a hammer. If you can, open the SSD and locate the data-bearings chips and make sure that each chip is sufficiently destroyed. If this is a service you are offering to businesses, however, beware of legal requirements for both data disposal and recycling, and consider investing in something more robust like a drive crusher.

In order to disassemble an SSD, I recommend following this tutorial. When you have removed the drive from its enclosure, I would simply smash anything and everything on this board. It will be significantly easier to destroy the circuit board this way compared to trying to destroy it while it is still inside its enclosure.


Reverse Proxy SSL container Technically and security wise, can a reverse proxy act as a "container" for SSL certs ? Meaning, for example currently my web server is running on ssl (https). Can I move the SSL cert to the reverse proxy and let it handle SSL connections to the web server. And my web server will revert back to port 80 normal web traffic? thanks

Yes. In fact all big load balancers (eg. F5 Big-IP) work in this mode by default.


When is it appropriate to challenge with a secret word? Lets say a secret word is say, the name of your first pet. Mother's maiden name is also a common one.

When does it make sense to challenge the user with this? Or, what actions should be secured by a secret word?

I'm just not sure I know the security value of a secret work, what its intrinsic value is over a password.

Personally I would never ever use any of those questions to reset a password. You are actually making your password scheme more vulnerable as finding out secret questions with easy to find answers is not  that hard.

Bruce Schneier had an an excellent blog post titled The Curse of the Secret Questions on this:

  The point of all these questions is the same: a backup password. If
  you forget your password, the secret question can verify your identity
  so you can choose another password or have the site e-mail your
  current password to you. It's a great idea from a customer service
  perspective -- a user is less likely to forget his first pet's name
  than some random password -- but terrible for security. The answer to
  the secret question is much easier to guess than a good password, and
  the information is much more public. (I'll bet the name of my family's
  first pet is in some database somewhere.) And even worse, everybody
  seems to use the same series of secret questions. The result is the
  normal security protocol (passwords) falls back to a much less secure
  protocol (secret questions). And the security of the entire system
  suffers.


Is it possible to "close" a port by dos'ing it? If I see port 25 is open, but I dont have access to the program running the smtp server, could It be flooded with enough information to make it unusable (but not affect any other services)?

You could make the program behind the port unusable. If the given program handles the DoS so badly that it actually fully crashes and thus dies, the program will give up the port, and the OS will reclaim it after a moment or two. After that, it's available for use for any application running on the machine. Assuming it has the right priviledge to use that port and so forth.


Is it OK to do a security testing in parallel with a QA testing? This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar situation and the solutions being adopted.

So, I am working as a security engineer with a small start-up. Now, in my previous organization, a typical corporate, I had my boss to take care of doing the convincing etc. with the top level management and getting the things required for us to work smoothly.
However, in my current role, being a start-up, I am the only engineer responsible for the information security of the whole company. Now as overwhelming, as it gets, it is becoming an amazing learning curve for me by the day.
I am picking up different aspects of security as baby steps, one at a time, starting off with the most important assets that need to be protected and that lie at the maximum risk/in the threat zone. I am trying to prioritize stuff and see where a pen test is needed and where is a VA needed.

There are many challenges that I am facing of which I would like to the discuss one below:
Now given the above situation that I am in, one major challenge that I am facing as of now is that I constantly keep pushing by tech leads to make sure that every every new feature that I am supposed to test needs to first get QA verified before I can pick it up for a VA/PT/security testing. The reason being, there have been a couple of instances, where due to an incomplete QA on the feature, my security test cases gave false negatives, as the feature itself was broken contrary to the expectation. Now this is something that the tech leads are not finding convincing enough to allow security testing only after QA approval. They need more examples/test cases to support this Their argument being,

  security test can be done in parallel to QA and that I need not really wait on the QA as it is simply pushing the release date un-necessarily.

Am I right in my argument ? If yes, what else can I possibly do to convince them on my points. If am not right, please help me understand why is my argument incorrect.

I currently work as a developer, with some responsibility for sprint planning etc. so my answer is based mostly from a 'how should testing be accounted for' approach. I'm going to talk about agile here, but the same principal applies.

I can't see anything wrong in principal with testing in parallel to QA, assuming that it's understood that anything which fails QA will need re-testing.

Assuming the business assigns estimates to work (think agile development), dev time, QA time and security testing time should be added together to give the total estimated time for a task to be completed. Without going into too much depth on agile development, the sprint is made up of a number of tasks (cards), which the total estimate for fits into the sprint length.

Once a card is complete, it goes to QA and for security testing. If either of those two steps fail, it will go back in for rework etc.

Now, in an ideal world, all the cards will pass QA and security testing. What actually happens is some cards pass and some will fail (either at QA or security testing). Assuming the business doesn't turn around and just accept the risk, there will be some rework and the card should go back to QA and security.

By running your testing in parallel, you should save some time in the sprint. When cards fail QA, the business needs to understand/accept that the card will require re-testing from QA and security. You may end up spending the full estimated time re-testing, or less/more time. That time then affects the sprint and the release date.

In order to argue either side, you should look at how much rework you usually get. If most of your cards fail QA, then it make sense that you do your security testing once QA has signed off. If most of your cards pass QA, then it makes sense to run your testing in parallel.

I've based this answer off agile, where everything should have an estimate etc. The same principle applies regardless, each stage of development will have a time cost associated with it, even if its not written down anywhere.

My suggestion would be to look at how many cards usually fail QA and work out if it's beneficial to run testing in parallel or not.


Can back doors be reasonably well hidden in end-to-end encrypted communication? Supposing governments can hold secrets and no rogue employees exist, can a back door in an end-to-end communication protocol be kept secret and not be abused by criminals as well, as often supposed?

As this lead to confusion in the comments: This question is not necessarily about a back door to a system or hiding the network traffic of such a back door in end-to-end encrypted protocols but rather surveillance means of governments that could be abused by criminals to gather PII, for example.

Your assumptions are wrong: neither are governments good at keeping secrets nor do they have no rouge employees.

Yet, let‘s assume your assumptions do in fact hold.

How such a back door might look exactly is highly dependent on what protocol you are trying to compromise the secrecy of.

So let’s keep it abstract:

For eavesdropping on end-to-end encrypted channels, there has to be a weak spot in one of the following parts:

The crypto itself.

Using weak cryptographic systems such as the infamously fast Double ROT13 encryption scheme allow for eavesdropping. Yet, everyone implementing it must know about this and everyone sniffing their own network traffic can see it.

There are however more “stealth” ways of using weak cryptography, though crypto systems are usually very thoroughly researched before they go into production. They are also usually open source and well reviewed; anyone can check them out and see wether there is a weak spot - and switch to another product using strong crypto if they do.
The trust model.

For the key exchange to work (and knowing you talk to the person you are supposed to, not e.g. a government as a MITM), you do often have to rely on a third party that vouches for the identity of the counterpart of your conversation. Being it a CA or the web of trust or the apple or Facebook or WhatsApp servers, you do base your trust on something. So this seems like a good point to introduce false keys, MITM’ing all conversations.

The problem here is that most end-to-end encryption capable clients do allow the user to check the key fingerprints in person or over another channel with the entity they are supposed to belong to; Threema even denotes this - and only this - as “green”, where getting the keys from the server alone is just “yellow”, in their trust model. Whatsapp allows that too and warns users when keys change (e.g. when the phone is switched). So this would be easily detectable as well, with the same consequences as in 1. - the users just switch to a different Service wreaking havoc on the services business plan.
The endpoints.

Compromising the endpoints might be the most plausible way of breaking end to end encryption, yet this amounts to a massive undertaking in a broad deployment as a single point of failure does not exist - unlike on the other options.

Now, the real problem is: even if such a back door is implemented, there will be researchers finding it sooner or later. Maybe they will think it’s a bug, not a feature, but it will be found and will be exploited, especially when used in the wild and on a broad basis.

Remember that this technology is neither delivered by only one vendor nor is software bound to laws of a specific country and can be easily reproduced even if forbidden in a country.

Simply put: you cannot have your pie and eat it, too. If you put in a back door, it is there - and others will find it.


Would encryption bypass some firewall rules? Would an encrypted connection be able to bypass a firewall? A firewall is working on layer 1-4 of OSI model, the encryption and decryption is done in presentation layer (layer 7 of the OSI model). Can encryption may bypass a few rules?

Using the OSI model of layers is often a good way to spread confusion; it was not initially meant for TCP/IP, and TCP/IP always had trouble fitting in it.

When data is encrypted, it can no longer be understood by whoever does not know the decryption key. However, firewalls don't look at all the data, and encryption does not encrypt everything, because the packets must still be properly routed.

For instance, if the encryption is SSL, then it goes over a TCP connection. The source and destination addresses and ports, and the TCP management details (SYN and ACK flags, and so on), are not covered by the encryption. Firewalls usually work only on ports and addresses and TCP flags, and thus are not impacted by the SSL encryption; firewalls are not even aware that encryption occurs: for them, the TCP stream contents are "just bytes".

There are security-related systems, though, which are impacted by encryption. For instance, all Deep Packet Inspection systems. They are not "firewalls" in a strict sense, but some people refer to them as such on the basis that they may be integrated into some hardware whose primary job is firewalling. DPI has trouble with encryption. To put things bluntly: an antivirus software running on the entry router of your network will not protect you if you download malware over HTTPS.

VPN can obscure the situation, especially if you want to think in "layers".


resolv.conf: my router acts as a nameserver - a vulnerability? How to change it? I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file:

search localdomain
nameserver {ipofmyrouter}

I guess that these - or at least "nameserver {ipofmyrouter}" - mean that my router somewhat acts as a nameserver(?) Afaik it caches DNS entries.

But isn't that a security vulnerability? Couldn't people change those DNS entry to reroute my traffic for eavesdropping? If so how can I prevent this? Should I disable this DNS functionality and if so how?

Please also consider that I wish to use a VPN and potentially OpenNIC and that I'm still relatively new to GNU+LINUX (and hence IT security) and I'm not sure whether this question would fit better on the unix.stackexchange.

This is not inherently a security problem and rather useful. Some routers do use the information they have at hand to generate domains for your local devices such as tv.lan, router.lan and pc.lan, thus simplifying inter-lan-connections and making them independent from ips (usually assigned via dhcp by the router also).

If an attacker gained access to your router, changing the answers of your routers dns-cache would be possible - but then again, rerouting whatever traffic comes for whatever IP would be, too.

So there is no significant gain in security from disabling your routers DNS (or not using it). It would just make your browsing experience a tiny bit slower.


How to detect malicious fb2 & epub file? Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ?

Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS.
Malicious PDF files via peepdf, pdfid & others.

What is EPUB?

  EPUB is an e-book file format with the extension .epub that can be
  downloaded and read on devices like smartphones, tablets, computers,
  or e-readers.

Can EPUB file contain malicious code?

Yes it can. (You can read this - https://www.baldurbjarnason.com/notes/epub-javascript-security/)

Here is another example of how epub had security flaw in past: XML External Entities

Are epub files often used by malware authors?

No. Compared to PDF and others formats epub is rarely used by attackers.

If you want to detect suspicious content (i.e. JavaScript) manually you can start with any hex editor and then you can write your own yara rules if it's needed. Of course if JavaScript is present that doesn't mean it has to be malicious but it can be a subject of further investigating.

Search in header of file for:

6D 69 6D 65 74 79 70 65 61 70 70 6C 69 63 61 74 69 6F 6E 2F 65 70 75 62

mimetypeapplication/epub

or:

74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74

text/javascript

More about epub/epub2 and epub3 go here - http://epubzone.org/news/epub-3-and-interactivity


Verb for "turning a bug into an attack"? I forget what word it is that refers to the work of turning known bugs into real-world attacks, for example when people string together two separate exploits to break out of the Chrome sandbox. It's not "weaponize", it's not "exploitize", what is it again?

A bug can be seen as a vulnerability which once 'attacked' is being exploited.

If a number of vulnerabilities are exploited by a bad actor together as part of a wider attacker this commonly called a chained exploit.

If you mean about the breaking out of a VM attack then they can be referred to as a "virtual machine escape" exploit.


https security - should password be hashed server-side or client-side? I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.

I am facing a dilemma - I used to think it is safer to make a password hash client-side (using JavaScript) and then just compare it with the hash in DB server-side. But I am not sure this is any better than sending plain-text password over https and then hashing it server-side.

My reasoning is that if attacker can intercept the https traffic (= read plaintext password) he can for example also change the JavaScript so it sends the plaintext password alongside the hashed one - where he can intercept it.

The reason against hashing client-side is just ease of use. If I hash client-side I need to use two separate libraries for hashing. This is not an unsurmountable problem, but it is a nuisance.

Is there a safety gain in using client-side hashing? Why?

Should I also be using challenge-response then?

UPDATE: what interests me the most is this - do these techniques (client-side hashing, request-response) add any significant security gain in case where https is used? If so, why?

If you hash on the client side, the hashed password becomes the actual password (with the hashing algorithm being nothing more than a means to convert a user-held mnemonic to the actual password).

This means that you will be storing the full "plain-text" password (the hash) in the database, and you will have lost all benefit of hashing in the first place.

If you decide to go this route, you might as well forgo any hashing and simply transmit and store the user's raw password (which, incidentally, I wouldn't particularly recommend).


If a login/session cookie is stolen,does changing the password void it? Considering the scenario where a Gmail session/login cookie is hijacked or stolen and it is discovered my means of Gmail last account activity,will changing my password immediately void the cookie or can the attacker still use the same cookie to authenticate?

I am assuming that this is the same for other sites as well such as Yahoo,Facebook given the way they deal with login cookies.

Also,if I have two factor authentication enable,will that help if my login session/cookie is hijacked.

It really depends on how the server is implemented; you cannot count on either behaviour. For some servers, changing the password will invalidate the cookies; for others it will not.

On a typical server, there is a database with a table of users, and another table maintains the mapping of cookie values to user identities. With such a setup, changing the password alters only the first table, and it would take some extra effort from the programmer to also prune out the cookie values from the second table, which map to that user. Programmers are allergic to effort so chances are that in such a site, changing the password does not invalidate the cookie.

But some other sites merge the two tables, so that each user has one active cookie value, in which case voiding it upon password change is quite easy (a few extra characters in the SQL statement); then there is a roughly 50% chance that the programmer thought about it and bothered to add the few extra characters to his SQL statement.

Of course, Gmail cannot be assumed to be really "typical". So anything goes. You might want to try it:

Log in with your Web browser.
Close your Web browser (the process, not just the window).
With another, distinct browser (or from another computer), log in and change your password.
Reopen the first Web browser. See if it is granted access without entering a password.

Then you will know.


Isn't it dangerous to allow users to change email? I am not referring to any specific site in this question . If a site allows users to change email after login can't a hacker by obtaining user password   due to users negligence then change email and then change username and password to gain full access ?

Everything is dangerous, including breathing and eating.  It's all a question of balancing the risks.
You are looking at a case where the username and password of an account got compromised.  At this point the attacker has full access to the account.  What you are now looking at is what recourse a legitimate user has.  How can they reclaim access to their account?
Emails are historically used as a reasonable stop-gap.  If you have access to an email account, you're probably the intended owner of the account.  It is nice because it is automated.  However, if push comes to shove, and you really need to get an account back, the last line of defense is always to contact the company and talk to a real live person.
On the other hand, the need to be able to update credentials is very important.  Many of us nowdays keep an email account from cradle to grave, but it wasn't always that way.  Many people still use an email address provided by their ISP.  If you couldn't change the email address associated with an account, you would be forever bound to an ISP -- quite the conundrum if you were to move to a new state with different ISPs!
So the decision is that the rewards outweigh the risk.  Maintaining a solution for all customers using a service, even as they have to update their contact information, proves more important than the risk of a hacker using this to steal an account away.


ASV scan - What to expect from external scan services? We've been asked to perform a vulnerability scan in our servers which process transactions with payment cards as a requirement for PCI compliance.
PCI DSS mandates this scan must be done by a ASV.

What should i expect from the result of this scan?

What type of scan does this scan correspond to?
Is it like a port scan like nmap scan?
Is it like a network services scan like nessus scan?
It it like a application vulnerability scan?
Is it a pentest?

Does ASV limit its service to only provide a cloud based security tool to identify vulnerabilities on your servers or does ASV help us to fix them?

These are vulnerability scans which are more detailed and have more basic security information than a simple port scan. These are also not as detailed and don't dig nearly as deep as a full penetration test.

The ASV testing company may perform the test in a number of ways and having a portal to request a scan is not a requirement at all.

It could be considered a conflict of interest to have your ASV remediate your issues so this is not normally handled by the same company. The PCI DSS 3.1 mentions organizational independence in section 11.3.1.b of the PCI DSS
https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf

You can learn more about ASV's from the PCI ASV Program Guide.
https://www.pcisecuritystandards.org/pdfs/asv_program_guide_v1.0.pdf


Integrity attacks and encryption at rest The AES-GCM algorithm provides not only confidentiality but also integrity. I understand that integrity is an important part of security in overall, but whenever I think in terms of possible attacks, only attacks against encryption in transit like POODLE.

Is there any good use case for AES-GCM and encription at rest?

Absolutely. Data at rest will presumably eventually be used for something, and you don't want that use being influenced by an attacker. Most attacks on data integrity are the sort of thing that work best if the attacker knows at least the structure of the plaintext and ideally some of the content (which is easy with HTTPS, for example, but possible with many file types that use known offsets or similar).

The ease of such attacks depends on a lot of factors. Do you (the attacker) have write access to the ciphertext at all? Did the adversary use something like a stream cipher (trivial to flip bits in; each change in the ciphertext directly corresponds to a change in the plaintext with no side effects) or a block cipher where, even if you successfully can flip the bits you care about, you'll probably scramble other parts of the file? Can you make your desired change without editing the length of the data (which would probably screw up the decryption)?

Bear in mind that these sorts of attacks also work on data in transit. While exploiting things like padding oracles and similar can result in decrypting the enciphered data, it's often sufficient (or possibly even more useful) for your goal to just change it slightly and send the modified ciphertext on its way.

A few examples:

You have a chance to attack an encrypted file containing a report, memo, or similar. You saw the start of the document in plain text; it started with a sentence like "We have considered the proposal, and won't promote Filipe Rodriques...". You can determine the correct offset into the document, guess at the text encoding, XOR the strings "won't" and "shall", and apply that XOR mask such that it edits the document to now give yourself a promotion.
You're attacking a voting system, where the tabulated (but not-yet reported) results are stored encrypted using 32-bit integers. You know your preferred candidate/position was very likely to lose, and the roughly-expected number of results (based on polling, etc.) and you know the structure of the data in the file (where each candidate's result will be stored). You can't read the results, or set them exactly, but you can flip a few bits of suitably high order (significance) that will probably make your candidate's numbers much greater. (A data-in-transit equivalent might be to flip some moderately large portion of the votes - say, 55%, at random - before they're tabulated, resulting in an outcome that should have skewed away from your preferred candidate instead looking like a surprise win.)
You're attacking a machine with an encrypted file system that you can boot (password-less encryption with the key stored on a hardware module of some kind), and log in a low-privilege user, but can't log in a high-privilege one. The disk encryption should prevent an offline attack, but if you know where /etc/shadow (or equivalent) is, and how it's structured (even though you can't read it), you can plausibly do something like change your user ID to 0 (you know your own ID, you know where in the file and in the file system it will be; you can XOR the relevant bytes with the XOR mask of your current value and the value you want to set, and it'll be set when the machine wakes up). Then, you can boot up and log in your formerly-low-privilege account. Incidentally, this kind of thing is a real risk against disk encryption because there's usually nowhere to store the authentication tag, so most disk encryption lacks strong integrity protection; this is especially one of the weaknesses of password-less disk encryption (such as TPM-only mode).


can someone manipulate what text shows up on the screen when google shows some examples of addresses that are available? I started a new Google account and when I typed in a username/email address that I wanted to create I was told that the email address I had chosen was already in use and I was given an example alternative that was available. The first  username/email I entered into the field was
GrantmetheSerenity. I was given a message that this username was already in use and an example alternative username was given. The first alternative username I was given was grantmetheserenity187@gmail.com.

I thought it was interesting that the numbers 187 would be given in the example alternative username because these numbers are notoriously known for being the police code for a homicide. That being said, this has happened to me many times before ( the numbers 187 appearing in an example alternative username).

The whole reason I created a new account was to try to spot any strange things on my new phone because I believe that I am under surveillance at least part time by an unknown entity.

Can a person or persons manipulate or control what shows up on my screen when I am given an example alternative username after typing one that is already in use? I am using a Samsung Galaxy Express 3 Android smartphone.

Not likely. Under normal circumstances this username is generated on one of Google's servers and transported securely to your client.

Of course if your phone has malware it can show anthing, but in that case it is unlikely that only the seemingly random number is changed.

I think you are the victim of confirmation bias or attribution bias. 187 is just a random number, but you interpret it in such a way as to confirm your suspicions.


Scanning a network via a hardline connection to a wired-switch NIC in promiscuous mode Question from a CEHv9 exam preparation book:

  "When scanning a network via a hardline connection to a wired-switch
  NIC in promiscuous mode, what would be the extent of network traffic
  you would expect to see? A. Entire network B. VLAN you are attached to
  C. All nodes attached to the same port D. None"

I went for B but according to the book it's C and I don't get it. What does that even mean "all nodes attached to the same port".

Explanation to the answer from the book

  Because each switchport is its own collision domain, only nodes that
  reside on the  same switchport will be seen during a scan.

Yes it is answer 'C'. Switches forward traffic based on mac address. So if we have port fa0/1 and port fa0/2 and you are attached to fa0/2 with a MAC of BB:BB:BB:BB:BB:BB and fa0/1 has a mac of all A's. Anything destined for a mac of address of all A's will only be forwarded out port fa0/1 and nowhere else because these messages are Unicast meaning destined for only 1 host. You would however receive the broadcast messages.

Each port on a switch is on its own collision domain. Back in the days of the 'hub', multiple nodes shared the same collision domain and in this case you would be able to listen to all traffic passing through that collision domain.

So the reason it is not B is because traffic is destined for 1 port and 1 port only so you would only receive information from the port you are connected to.

There is something called SPAN (Switched Port Analyzer) from Cisco devices in which you can mirror traffic from a vlan or multiple ports and send it to the port you are connected to thus receiving all of the traffic.


DDOS interrupted by nmap? I discovered one of my machines was under an ssh DDOS attack when I was looking at logs to find out why my disk was slow.  The auth log was about 90M, which is kind of unusual for this machine.
I ran an nmap against one of the IPs (nmap -P0 ).
Once I ran the nmap, the attack stopped from all the IPs.  Now there is just silence.
Has anyone seen this happen before?  If so, what was the cause?
N.B.  This machine is used for testing, and gets rebuilt a lot.  It's running Ubuntu 20.04

That's not a DDoS but a brute force attack. They had a monitor looking for their target (you) investigating them. Once you tried to scan them, they halted in order to avoid further analysis.