How disable Java in Chrome 23? Well in case someone doesn't know yet... there is a new Java zero day.

I'm trying to disable it on Chrome but I can't find any option. Google searches says that the option for deactivate it is on chrome://plugins however I don't see such option there.

If you can't disable java from chrome://plugins, you can use the -disable-java startup switch. Example:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -disable-java

Navigating to http://java.com/en/download/help/testvm.xml after a restart of the browser should give the message:

  No working Java was detected on your system. Install Java by clicking
  the button below.

You can read about other switches in The Power User’s Guide to Google Chrome.

To improve security for the future, not just react to public exploits, you might also want to go to chrome://chrome/settings/content and check Click to play on the Plug-ins:

This will wait for your click in order to run the plug-in therefore limiting your exposure.

And this should protect you from more than just Java vulnerabilities:

Secunia PSI/VIM for notification of updates, vulnerabilities and automatic updates
Microsoft EMET for preventing stack overflows and similar
BufferZone for protection from drive-by installers
iCore Virtual Accounts for times when you need to walk the dark side of the net on a production machine


Security issues related to public keys and SSH Do I have to mind something specific when using public keys and SSH? Well of course, I have to keep my private key secret (and therefore I should choose a strong pass phrase). But is there something else? When running ssh-keygen is it a good idea to use the default options? The 2048bits are a good choice? I read somewhere that 4096 would be recommendable nowadays. Can I use a better random generator (e.g. user input)? Do I have to renew my key pair regularly just for the case that somebody else stole it without my knowledge? In what cases a validity interval should be used?

These are many questions, but I don think it would be usefull to split them up into several questions. I'm interested in the question what to look for, when dealing with SSH/public keys (also if there are aspects I haven't mentioned yet).

Related questions:

RSA vs. DSA for SSH authentication keys
What methods are available for securing SSH?

You should trust the default options of ssh-keygen and not try to fiddle with random sources and so on. These are delicate matters. You can rely on the OpenSSH developers for having done things correctly -- you can rely because you already rely on them for having done a proper, leak-free implementation of the OpenSSH protocol, something which is far from easy.

For RSA, DSA, ElGamal, Diffie-Hellman, and similar algorithms, 2048-bit keys are enough. Estimating the strength of such algorithms in a meaningful way is not easy, because the best known attack algorithms rely on an awful lot of raw CPU power but also memory, storage, data bandwidth, and applicability of parallel computing of linear algebra on huge spare matrices. So such estimates must guess how future computing architectures and envisioned specialized circuits will fare against a number of more-or-less orthogonal scales, and the whole thing is more about divination than scientific prediction. Nevertheless, some have tried to establish guidelines, see this site for a compendium of existing rulesets that have been published. For instance, NIST states that 2048-bit RSA or DSA keys are fine until at least year 2030; note that the same NIST says that 1024-bit RSA keys should not be used beyond 2010, and yet we are now in 2012 and nobody still knows how to actually crack a 1024-bit RSA key (current record is for a 768-bit RSA key).

You are right in protecting your private key storage. This does not necessarily calls for a passphrase, though: in some contexts, the private key may reside in a desktop systems which is physically protected, and that could be deemed secure enough. Yet, strong passphrases are a nice reflex to have, and I can only encourage them.

As for key renewal, I would rather advise against it. Key renewal is a relatively complex operation because you have to transport the public keys to all relevant places (the .ssh/authorized_keys on the servers to which you want to connect); if you forget one, then you will have to engage in a recovery procedure later on, and recovery procedures are, by definition, breaches of security. Controlled breaches, but breaches nonetheless. So you should renew your key only insofar as it helps you sleep at night, but key renewal is likely to be overdone. Remember that if an attacker can obtain your private key once, then he can plant his own public key in all the servers himself: changing your key will not stop him. So key renewal has relatively little impact on security anyway.


Can a website identify me if I go in privacy mode with a different IP ? Or should I use a different computer? Assume I am a regular user of website A that forbids multiple accounts. I assume it can identify me with cookies and IP. So if I use a VPN, then open a private tab in my browser, can it still identify me ? The cookies sent to the website will have nothing to do with the old cookies right ? So is this as efficient as using another computer with another connection ?

You can not be sure for that without testing because such websites combine more than one technique to identify their users. For example if you use the same computer with a reliable VPN, you still may be identified if the website in question relies for example on browser fingerprinting and/or operating system fingerprinting identification techniques.

Some websites can identify you even if you use Tor browser, VPN ... etc (after suspicion of bad behaviors a user may perform) as they analyze the way how you write.


"Malformed URL" string when trying to inject SQL I'm trying to check if a particular form of a web app belonging to a bug bounty project is vulnerable to SQL injection.
After inserting a malformed URL, I get this message on my browser: "Malformed URL".

Given this message obtained on the browser, is the web app in your opinion vulnerable to SQL injection?

No, it's not an indication of a successful SQL injection. Literally the error means that your request doesn't conform to the Uniform Resource Identifier (URI) standard syntax (RFC 3986, 3.):

     foo://example.com:8042/over/there?name=ferret#nose
     \_/   \______________/\_________/ \_________/ \__/
      |           |            |            |        |
   scheme     authority       path        query   fragment

It's unclear what is giving the error.

If it's your browser, the request doesn't even reach the server. In HTTP(S) the server sees the authority part on the Host: header and the path and query parts in the (GET / POST) request.
If the request actually goes to the server and the server is unable to handle it, the server would probably response with the 400 Bad Request error, instead.
Some web application firewall (WAF) could respond with a Malformed URL error, but it's more likely to give 403 Forbidden without revealing the attacker what's the exact security rule that was fired.
You could even be behind a proxy / NGFW / UTM that blocks malformed request from leaving your network. Such an appliance would probably show the error directly to you.

In any case this doesn't look like you have succeed at all. Also, organizations having bug bounty programs have probably already fixed the most obvious vulnerabilities. You would need to come up with something a lot more sophisticated. Frankly, if you were capable of that, you wouldn't be asking this question here.


Should I change to VeraCrypt on win7 SSD from TrueCrypt 7.1a? Is still safe for me to use TrueCrypt or should I change to VeraCrypt as the last update boot won`t take long anymore.
Any backdoors to decrypt TrueCrypt?

NO. It is NOT safe to use Truecrypt, which was last updated 4 years ago.

Two CVE's exist but there could be more because Truecrupt is no longer in the interest of security researchers anymore.


Best Practice: frequency to change IPSec pre-shared key Is there any Best Practice as far as changing IPSec pre-shared keys for security purposes? Obviously, larger companies would have a issue changing these and then pushing the new key out to the user machines. Any thoughts?

Changing the key will give you any benefit only if all following properties are met:

The old key has somehow leaked and an evil-minded outsider knows it.
Whatever method used to leak the old key will not be easily and promptly reproduced by that outsider.
The aforementioned outsider has not completely plundered your data, installed malware and backdoors on your machines, and generally plunged your network into utter chaos, making the point moot.

Now that we have computers and networks, these three properties are only very rarely met together. The habit of changing keys regularly comes from older times, before computers, and in military contexts. Armies know that they must deal with, at any time, a number of infiltrated agents; such agents can deal some harm, but need time and continued presence of that; and cryptographic algorithms from the 1930s were invariably somewhat weak, making gradual leaks unavoidable. In an army from that era, changing keys on a weekly or daily basis made a lot of sense. In 2014 with computers and networks, much less so. Algorithms and protocols used in IPsec can encrypt thousands of terabytes without leaking anything about the key; and if an intruder learns the key then he will enact his mischiefs in a matter of seconds, not weeks. We can thus say that changing pre-shared keys for IPsec is mostly useless.

You may still need to change keys, as a "best practice", not to prevent or contain attacks, but to ease the qualms of people who still think with a 1930s' mindset, and believe that "security" is some sort of commodity that you can obtain in bulk and accumulate through best practices. Since there is no real scientific base for a key renewal frequency, every organization that publishes "best practices" tends to make its own mix, with frequencies typically ranging between "once per week" and "every three months".

Making sure that each clients for your VPN has his own pre-shared key, distinct from other clients, is another matter. That is very useful, because it allows you to basically evict any client without having to trust him for no longer using his key, and without redistributing a new key to all other clients. So don't renew keys on a regular basis; instead, make sure that each client has its own key. This will be a lot more useful for security.


Wireless network risks? What are the security risks associated with installing a Wi-Fi (802.11) network in-comparison to a wired network for internet connection?

This kind of depends on how strong you want your network security policy to be.

Lets point out the main good and bad things about a WiFi network:

Good:

Convenient for the office workers to work from anywhere in the office
No need for cables and switches (This saves money and time)
Keep better track of your users and have more control straight from the AP control panel

Bad:

Using cables a hacker will have to come into your office and plug his hacking device into the network while on WiFi he can do this from standing a few meters away from your office or maybe even on a different floor.
Can be easy hackable or social engineered since people do not understand how important a WiFi password can be.
On a WiFi it is very hard to set up vlans and so if all devices are connected to the same AP an attacker can find all of them and preform attacks on each node.

In conclusion:

While WiFi might be a good solution for the IT team, security wise, having a WiFi network that is poorly configured(Which is the usual case) is a bad idea if it is not necessary and should be avoided.


LAMP MailServer without SSL... so what's the problem? I want to set up a MailServer on Ubuntu for my website, and access the email from my POP3 client without enabling SSL encryption (I suppose the SSL is used to encrypt the password?).

My questions are:

What is possible for a "bad actor" to do in such a scenario?
I once read that all data on the internet is encrypted in some way or the other... so why does SSL make such a big difference?

Note: The reason I want to do it without SSL is that I want to use GMail as my POP3 client, and it refuses to read a self-signed SSL cert. I don't want to go through the hassles or pay up for a commercial SSL cert.

Update: I'm aware of free certs. via StartSSL, but it seems a lot of hassle to set up... apparently worth the hassle though.

1) Using POP3 unencrypted opens you up to all sorts of exploits.  Typically, you aren't going to be so concerned about someone intercepting your mail, or more importantly your login credentials, via the open internet.  The folks who do this would have to have access to internet exchanges,  ISP routers, . It can happen, but it's not that common.

What does happen frequently is the unencrypted credentials are observed over a local network, either by legitimate access to or hacking the router/switch, or observing WiFi traffic.  For example, intrusion detection systems like snort are often configured by default to alert on this and show the administrator your username/password.  In an environment with questionable privacy on their local network, e.g. a coffeeshop, or within a corporate environment.

Thus it is possible for a bad actor to eavesdrop on the mail stream, as well as simply recover your login/password and login as you.  They can then try this password/username combination on other sites, or send password resets to other sites like Facebook and then sign into your e-mail for the reset.  So, it exposes you to quite some area of vulnerability.

Note that SSL over POP3 (POP3S) encrypts not just the password exchange, but all the data therein to prevent snooping on what your mail contents are.

2)  It is not.  If you send out data unencrypted over the internet, it remains unencrypted end to end -- including within both end's local/perimeter networks before the packet reaches its internal destination.  This means that anyone in between the route the packets take has access to the information contained within. SSL removes this vulnerability by applying a layer of encryption, so only the ends that are communicating may see the information.

The internet was not designed for security, it was designed for speed and resilience.  Then, it became like the Wild West for hackers, so layers of security like SSL were added to help make it more secure. Without SSL or other encryption enabled,  you're much more susceptible to attacks which are very old, well known and don't have to be very sophisticated.


E2E Encryption in a LAN I'm looking to protect data in transit around the LAN from file servers both Linux and Windows based. I think the correct solution is IPSEC as I want a blanket solution for both types of operating system rather than lots of individual application layer solutions all differing from each other and having higher support overheads. I'm guessing to get a desktop PC to talk to the file server I will need to setup a new vpn style connection (possibly pushed out via Active Directory) and on the server have samba listening on the IPSEC tunnel. Is this achievable with multiple desktops or will this only work for 1 at a time?

IPSEC will work for multiple concurrent desktops.

Your scenario needs some consideration though. VPNs are used when the networks between endpoints are considered public/untrusted. LANs, in general (even after considering VXLANs) are considered already private in the sense that eavesdropping is not considered a big enough threat.

However, if you still consider it a threat, you might consider "detecting and isolating eavesdroppers" using Network Access Control solutions. Do keep in mind that in modern switched LANs, it is not easy for one node on a LAN to listen-in on traffic between any other nodes (barring broadcast traffic). If you consider the network administrator as a threat (they could set up SPAN ports to sniff traffic), that's an exception with its own implications.

So you might want to carefully check whether your threats are real or imaginary - since managing a large multi-node VPN is not a trivial effort. VPNs need both Authentication and Encryption to stay secure. Encryption relatively simpler in the sense that you can set it one time and leave it alone for a long time. Authentication on the other hand, means that you need your endpoint identities to be managed regularly.


Is the concept of Authenticated Anonymity possible? Or is authentication essentially incompatible with anonymity?

If we have the idea that authentication is proving that someone is who they say they are and anonymity is essentially having an unknown identity, could you have a system that could authenticate you but that you could still use anonymously?

Would adding a 3rd party service to the mix change the answer?

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national.

A person may well have multiple identities. For example, people with dual citizenship have two passports and what they do with one is somewhat decoupled with what they do with the other.

Multiple identities are the basis of anonymity. Indeed, as soon as you interact with anyone else in any way, this creates an identity: you're the person who did this thing at that time. Anonymity is not a lack of identity, but a lack of a link between a certain identity and any other identity that you may have.

Coming back to authentication, it is a link between two identities: the person who did that thing at this time is the same person who owns these credentials. Phrased this way, authentication is exactly contradictory with anonymity. However, there are many situations where it is useful to have partial authentication or partial anonymity.

An obvious solution to partial anonymity is to have a trusted third party as an intermediary. I'm using one right now: you know me by my Stack Exchange account, and you can use this identity to authenticate my Stack Exchange activity. Stack Exchange knows me by an identity with an OpenID provider, but isn't telling you. My OpenID provider in turn knows some things about me, but they only know the name on my passport if I've been telling them. There is a chain of links between identities (which could be traced all the way to, say, my home address via ISP logs), but you need the collaboration of multiple parties to resolve the chain.

How satisfactory such situations are depends on how the identification linkage chain is set up and what parties you're prepared to trust. Having identification linkage chains that are practically impossible to trace is the basis of anonymity systems such as TOR.

Going in another direction, authentication is very often used for authorization. I may use this account because I am the account owner. I may enter this building because I am an employee. An authorization system can be set up to decouple the action that is being authorized from the identity that led to the authorization. A well-known example is voting systems: they have both strong authorization requirements (only registered voters may vote, and only once per election) and strong anonymity requirements (even I cannot prove who I voted for, at least not if I want my vote to be counted). In traditional voting systems, anonymity is ensured by stepping into a booth to put a standardized piece of paper in an opaque envelope. Anonymity is ensured by observers who control that everyone steps into the booth and by rules that make non-anonymous ballots void.


Does using NAT-T for L2TP / IPsec VPN pose a realistic security risk? I'm working on upgrading an old Windows RAS server that hosts PPTP VPN.  I want to move to a L2TP/IPsec VPN.

Due to the firewall appliance we use, the VPN server has to be behind a NAT.  This means in order for L2TP/IPsec to work, I need to enable/configure NAT-T on the client and server.

However, NAT-T functionality is disabled in Windows versions following XP SP2.  This is apparently due to security concerns from Microsoft.  It seems to indicate traffic sent using NAT-T can end up being sent to an incorrect destination.

IPSec NAT-T is not recommended for Windows Server 2003 computers that are behind network address translators

There is some further discussion of the security impact here, with no real conclusion on benefit vs. risk.

NAT Traversal (NAT-T) Security Issues

My questions:

Is using L2TP/IPsec VPN over NAT-T actually insecure, or is this only a theoretical risk?
Is there any reason to NOT use L2TP/IPsec+NAT-T as a replacement for a PPTP VPN?

Is using L2TP/IPsec VPN over NAT-T actually insecure, or is this only
  a theoretical risk?

Microsoft says Yes and No:

Yes in case this scenario applies on you:

  A network address translator is configured to map IKE and IPSec NAT-T traffic to a server on a NAT-configured network. (This server is
  Server 1.) The network address translator mappings are the ones that
  we recommend in this article.
  A client from outside the NAT-configured network uses IPSec NAT-T to establish bidirectional security associations with Server 1. (This
  client is Client 1.)
  A client on the NAT-configured network uses IPSec NAT-T to establish bidirectional security associations with Client 1. (This
  client is Client 2.)
  A condition occurs that causes Client 1 to reestablish the security associations with Client 2 because of the static network address
  translator mappings that map IKE and IPSec NAT-T traffic to Server 1.
  This condition may cause the IPSec security association negotiation
  traffic that is sent by Client 1 and that is destined for Client 2 to
  be misrouted to Server 1

  Although this is an uncommon situation, the default behavior on
  Windows XP SP2-based computers prevents any IPSec NAT-T-based security
  associations to servers that are located behind a network address
  translator to make sure that this situation never occurs.

Note that this recommendation still exist in recent Mircrosoft Windows operating system versions ( Windows 7, 8, 10)

No, in case you are sure this scenarion does not apply in your case.

  Is there any reason to NOT use L2TP/IPsec+NAT-T as a replacement for a
  PPTP VPN?

If you choose IPSec tunneling it means need to protect the confidentiality and integrity of the data but also  assure the authenticity of the sender. Combining this with NAT protocol is somehow contradicting your goal as the NAT may forward the responses/requests to the wrong IP address.

An other technical problem is that:

  NAT isn’t able to use the port numbers in TCP and UDP headers to
  multiplex packets to multiple internal computers when those headers
  have been encrypted by ESP


Preserving anonymity with ring 0 malware infected PC I am attempting to determine whether it would be possible to maintain your anonymity while using an internet-connected PC infected with ring 0 malware. The threat model assumes the adversary is willing to purchase zero-day exploits and craft malware specifically targeting the victim in question.
Furthermore, I am assuming my adversary is capable of performing a virtual machine escape, which has previously been done on Qubes OS. My threat model assumes ring 0 access to my physical hardware.
Here are the current threats I have considered along with potential solutions:
Threat #1
The malware simply pings a server controlled by the adversary to leak the victim's real IP address.
Potential solution:
The device will exclusively be connected via Ethernet to a router which routes all traffic through Tor. This router will be configured to disable all remote access (i.e. SSH).
Threat #2
The malware reads the hardware's MAC address, serial number, or other unique identifiers that tie it to a specific purchase, which could then lead to the victim's identity.
Potential solution: Anonymously purchase the hardware (i.e. use cash to buy a laptop found on craigslist) and never connect to any WiFi network (to ensure the MAC address is not associated with your identity).
Threat #3
The malware scans for nearby WiFi networks to attempt to estimate the victim's location by using a combination of the global maps of wireless access points and the WiFi signal's strength.
Potential solution: Physically remove any WiFi adapters from the device and exclusively use an Ethernet connection.
Threat #4
The malware uses the victim's camera or microphone to record them, potentially allowing the adversary to uncover the victim's identity.
Potential solution: Physically remove any cameras or microphones from the device.
Notes
The victim will operate under the assumption that their device has been infected with malware. Naturally, if the victim uses the device to log in to their personal Facebook account, their identity will be compromised.
Question
Are the solutions I presented adequate, and are there other de-anonymization tactics I have not considered? In short, is it possible maintain your anonymity while using a ring 0 malware infected PC?

With Ring 0 (kernel) malware anonymity can be preserved
You just need to make sure you are under control of Ring -1 before you get infected by using a Type 1 hypervisor (one that runs underneath the operating system's kernel), and that the Virtual Machine that receives the attack is completely isolated from anything that can leak any identifying information.
One desktop operating system that is specifically designed to prevent those attacks is Qubes OS, which integrates seamlessly the windows of different Linux virtual machines running on top of the Xen hypervisor (Type 1). One of the included Linux distributions inside Qubes is Whonix, which is designed specifically for anonymity, and it is run on two separate virtual machines: the workstation, which is the one that has the Tor browser, and the gateway, which provides the workstation with access to the Tor network only in order to prevent leaks.
As a bonus, Qubes comes with disposable virtual machines out of the box, which prevent a successful attacker from gaining persistence by destroying the virtual machine once you have finished using it.
Note: for virtual machine isolation to work properly, hardware Virtual Machine extensions and I/O MMU virtualization should be enabled at BIOS level, the CPU should not be vulnerable to speculative execution exploits (or at least have it completely disabled) and the laptop should have ECC memory in order to prevent Row hammer attacks.

With Ring -1 (hypervisor) malware, maybe...
Aside from the potential solutions you mentioned, the following measures could make it feasible:

If the threat is an authoritarian nation-state, while buying that laptop all identifying clothes should be avoided, the face and all identifying marks (scars, tattoos...) should be covered (covid mask + sunglasses, helmet, long sleeves...), the hair should be dyed or not visible, the means of transport should not have an identifying plate (bike, electric scooter...), no devices with radios should be worn to the meeting point and talking should be avoided. The laptop and BIOS clock battery should be both removed immediately (or in an unidentifying place) until the webcam, microphone and all the radios are removed from it (Bluetooth too).

With the laptop still switched off and with the batteries out (with an EEPROM Programmer) the BIOS firmware should be replaced with an open source firmware (Coreboot, Libreboot, Oreboot...) image modified in order to have ALL internal device controller's (SATA, USB bus...) names and serial numbers changed/translated into fake ones to the OS. Of course, the laptop should be compatible with your firmware of choice and the patch should be developed, but achieving that is far less work than programming a secure OS or hypervisor from scratch. The patch should also address other hardware deanonymization methods, like the ones listed on the Whonix Wiki:

The gateway's MAC address should be faked too and, to prevent traffic correlation attacks, it should run a Tor relay and/or use/be a Tor bridge with a pluggable transport that randomly pads the frames (like obfs4). It should also use a different OS with a different kernel (BSD...), a different Instruction Set Architecture than the laptop (ARM, PowerPC, MIPS, SPARC...) -and preferably a different open source firmware too- to prevent the malware from exploiting the same vulnerabilities on the gateway.

All human interaction should be kept unidentifiable.

With Ring -2 (firmware) malware, I don't think so.


Is it possible to have a man in the middle attack by using two different HTTPS connections? Is it possible to have a man in the middle attack that works like this:

(Assuming they are on the same network)

The attacker gets sets up a man in the middle attack with ARP poisoning or somthing with the gateway and the victim.
The victim wants to have a https connection to https://www.example.com
The attacker sets up an https connection with the https://www.example.com for the victim.
The attacker sets up a bogus https connection between himself and the victim and forges https certificates so there are two different https connections.

Now the attacker should have complete control over what the victim does without setting off browser warnings like sslstrip would.

Whats to stop an attacker from doing an attack like this?

The attacker [...] forges https certificates so there are two different https connections.
Whats to stop an attacker from doing an attack like this?

Browers have lists of trusted root CAs. For a browser to accept an HTTPS certificate, the certificate must be signed in a chain that traces back to a trusted root CA. The attacker is not supposed to be able to get a certificate for www.example.com without proving that he/she controls www.example.com. Such checks are done by asking the person requesting a certificate to modify DNS records or configure the HTTP server to serve a specific file containing a unique identifier.


Disadvantages of disabling RC4 in SSL/TLS Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.

Disabling RC4 completely would be great in an ideal world, but unfortunately we don't live in an ideal world. If you do disable it, certain mobile and embedded devices may not be able to communicate with you. Keep in mind that IE on Windows XP can only use RC4 because the underlying cryptographic API (CAPI) on the system doesn't have AES.

As for the risk, the RC4 bias attacks are generally considered to be relatively infeasible due to the requirements - somewhere in the order of a few billion requests. While this is clearly not good, it's also very hard to do anything practical with.

I would currently, as of May 2015, recommend the following:

Enable TLS 1.2 with AES-GCM, ChaCha20-Poly1305, AES-CBC, and RC4 cipher suites.
Enable TLS 1.1 with AES-CBC and RC4 cipher suites.
Enable TLS 1.0 with RC4 cipher suites (avoid CBC block ciphers in TLS 1.0 due to BEAST)
Disable SSLv3 and earlier.
Configure your cipher suite order preferences to have the AES-GCM and ChaCha20-Poly1305 suites at the top.
Prefer cipher suites with DHE / ECDHE key exchange over RSA / DSA key exchange to promote ephemeral key exchange.

Note that this is subject to change - you should check for up-to-date information in future.

In such a configuration, all but the very oldest browsers (i.e. anything post-90s) should work just fine, and modern browsers will use the strongest possible protocol and ciphers.


How are private keys kept private? This may sound like a stupid question but seriously how are private keys kept private?

If you're someone like Google you have some huge number of servers to which the public can establish secure connections.

The *.google.com private key is required in establishing every one of those connections.

Servers are presumably reaching the end of their life all the time and being disposed of (leading to the potential risk of leakage at that point of anything on them).

Modern data centers require very small numbers of people yet companies like Google are so huge that there's still a significant number of people with physical access to the servers.

These servers sit behind firewalls and run highly secured OSes but both routers and OSes may suffer zero-day exploits.

So it's fairly obvious that private keys can't be stored on a per server basis or on OS images retrieved on boot up (even if encrypted) or on per server smart cards.

Presumably companies don't discuss this too openly but are there any good overviews of how things work?

Is there some hardened bunker somewhere where just the initial asymmetric key element of establishing every connection is handled?

Presumably actually you need such bunkers per data center - I guess you don't want to lose an entire data center due to a losing your link to a remote key handling site.

Even duplicating the key across data centers sounds highly risky considering the value of a key like that for *.google.com.

Am I missing something that makes key handling like this not quite so hard as it sounds to someone trying to think it through from scratch?

Firstly, often encryption is terminated at the perimeter by infrastructure which is dedicated to offloading SSL decryption. It makes it much easier to manage when you only have maintain a high degree of key security for a small (proportionally) group of servers which are dedicated to the role. The rest of your regular application servers can operate like normal without worrying about handling these keys.

Secondly, their keys would almost certainly be stored via a Hardware Security Module (HSM). These are dedicated hardware devices with a processor designed for maintaining security and being efficient at performing cryptography.

Finally, Google has its own intermediate CA certificate which it can use to sign its own leaf certificates. This allows them to use certificates with a far shorter expiry than normal, which somewhat reduces the risk of a key being compromised. The actual CA key can be kept locked away in an air gapped bunker and only accessed when it needs to sign a short term leaf certificate.

Remembering also that a CA doesn't need the leaf private key to sign a certificate, they could generate a private key which never leaves a HSM onsite at a remote data centre, then send the public key/CSR to the CA to be signed. They might even generate a unique private key for every single HSM device, that way a key never has to leave the device which generated it.

For example here's a print screen of a current Google certificate:

You'll notice that the certificate is only valid for 3 months, which is significantly shorter than most.

Edit: Google actually describes their policies in detail here.

  In the Google PKI, a Subscriber is an individual or an organization
  capable of using, and authorized to use, the Private Key that
  corresponds to the Public Key listed in a Certificate

...

  The Google Internet Authority servers are located inside of a locked
  cabinet or cage area in a locked server room. Access to the server
  room is controlled by badge readers. The private keys for the Google
  Internet Authority are stored in hardware security modules that are
  FIPS 140-2 Level 2 that are physically tamper-evident and
  tamper-resistant.

...

  Subscriber Key Pairs are generated (i) by the Subscriber by software
  supplied by their device/operating system, or (ii) by an authorized
  member of Google’s Information Security Team.

...

  Subscribers provide their public key to Google for certification
  through a PKCS#10 Certificate Signing Request. The preferred transfer
  method for sending this information is HTTP over Secure Sockets Layer
  (SSL).

Basically that's exactly how a regular CA works, except it's all conducted internally within Google.


Does a public key stay the same when a certificate is renewed? So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.

The rationale for this lay in the fact that we were told that renewing the server certificate kept the same public key. As such, the certificate on the server could be renewed when it expired, and that such renewal would have no impact on the app.

IOW, I wouldn't need to update the app with a new certificate.

Note the certificates in question are signed by a public CA (Digicert).

Currently we get around the issue by pinning to the intermediate certificate that signed the leaf certificate (longer shelf life). Equally obviously, that's somewhat less secure than pinning to the leaf.

However, I've run across some comments that imply that renewing a leaf certificate creates a new public key. Particularly if that renewal is done by generating a new CSR.

So which is it?

Or to restate the question:

When I've installed certificates on a server, I've typically done so by creating a renewal CSR and giving it to the CA. When the CA gives me a new (renewed) certificate and I install it, will it have the same public key as the old certificate?

If the answer is always: yes, then I'm good. If the answer is no, then I need to do something else.

And if the answer is a definitive "maybe", then I'm pretty much in the same boat as a no.

I've typically done so by creating a renewal CSR and giving it to the CA. When the CA gives me a new (renewed) certificate and I install it, will it have the same public key as the old certificate?

The CA copies the public key from the CSR to the Certificate. When you create the CSR it is up to you what key you put in it. You can choose to use the same key as last time, you can chooose to use a freshly generated key, you can choose to use a key you just pulled out of your cold storage vault, it's all up to you.

  Currently we get around the issue by pinning to the intermediate certificate that signed the leaf certificate (longer shelf life).

This is a bad idea. There is no gaurantee that future cerfificates will be issued from the same intermediate cert.

  So I'm implementing certificate pinning

I strongly suggest the following.

Only pin the end entity key, don't try to pin the whole chain. You have no idea whether future certificates will be issued by the same root and intermediate keys.
Make sure you have spare keys that will be recognised by your client, having your application recognise only a single key leaves you up shit creek without a paddle if that key is compromised. Your spare keys should be kept in cold storage and ideally should include a selection of types/strengths in case you need to move to stronger keys in the future.


New user with Chinese name appeared on MacOS. Hacker? I'm the only user on my personal laptop (MacBook Pro) running macOS Sierra. I discovered today that a suspicious user with a Chinese name appeared next to mine in the finder. Please see the attached picture below:

I googled for "Linchengzhang" but nothing turned up. What's scary is that's a lot of "auth" files furthest down the file tree. However I have no idea what this really means.

Furthermore, I've not downloaded any programs recently, nor used Xcode in a very long time (Xcode is actually broken for me at the moment).

I only use this laptop for occasional surfing on the web (no shady sites) and couple of programming projects now and then and additionally use Avast.

The only thing I found related to this (very closely) is this thread: link. However, the original poster claims it has to do with some cryptocurrency. I've never mined/bought/traded cryptocurrencies, so I don't think it has to do with that.

Any help would be greatly appreciated, I don't know if my computer (and/or passwords?) are compromised.

I would doubt that's a hacker as the most successful attacks are through social engineering schemes. Few "completely technical" attacks are successful. There's always a flavor of inadvertence by the user and a bit of information security malpractice when attacks are successful.

Now, the account you're showing could be five things.

You let another person use your Mac and that person created an account to separate his/her archives from yours.
You hired a local IT technician who created an account to troubleshoot your Mac.
You rely on cloud managed services, e.g. Azure uses ADAL token (jwt) authentication with an implementation specifically on objective-c (XCode is a dependecy)
The network services at your job rely on Cloud SaaS (Software as a Service) solutions such as Microsoft Office Subscriptions (among other types of software) that uses ADAL token-based authentication.
Some programs create accounts. You may have installed a program which created an account as part of the installation process and such program last used token-based authentication on October 23 2018 at 18:47.


If a remote user types in a password in a LogMeIn session, can the controlled computer extract the characters? Assume I have root/administrator access to a given computer which is currently being controlled via LogMeIn from an outside location.  I see a password being typed into a browser (as little black dots).  Is there any way to extract the content of the password?  The question is OS-neutral though I expect that some answers will be OS-dependent.  I am most interested in Linux and Windows, though OSX or "other" would also be useful to know.

It is theoretically possible to intercept any event on a computer that you have full rights on. In practice, the difficulty of intercepting will depend on the way the input comes into your computer and whether the software handling that input actively seeks to prevent that interception (think about gaming anti-cheating software).

A password typed and sent via a browser can be intercepted by using a web proxy. If SSL is in use then you have to trust the fake certificates generated by the proxy. You can use Burp Free Edition and install it's certificate.

For passwords inputted into simple software, you could also find the password in memory and write a program that reads it from memory. To find the exact memory address, you first have to input a test pattern and find it in memory. An easier way is to dump all the memory, parse the strings and look for your test pattern and remember the strings in the vicinity. Then dump the memory with the real password and look between the strings you noted at the previous step. In Linux it is easier because you have /proc/<pid>/mem for the memory content of any process and the strings command is built-in.


Does Amazon S3 deletion "shred" your object I believe Amazon states that all deletions of objects are irreversible. But for security reasons, how "shreded" is such deletion? For example, supposing a hack to Amazon S3, could anyone recover your deleted data?

Part of the answer depends on which region your data is stored in and if there are any government restrictions that may require them to retain data for any given time period.
https://aws.amazon.com/agreement/

Likewise, if you are talking about data which has versioning enabled your deletes may be possible to be restored by your own team.
https://aws.amazon.com/s3/faqs/

Note: AWS has an option to encrypt data stored at rest on S3 so if you want a compensating control that may be very helpful but also note that the metadata, like filenames, is still not encrypted.

https://aws.amazon.com/s3/faqs/

Since you are talking about attackers hacking Amazon one must assume that attackers who got access to AWS may be able to access the underlying computing infrastructure which may potentially contain access to backup systems or more direct access to the physical media that Amazon uses for S3. Note: Amazon does not publish their internal backup information (maybe they use Glacier?) but their durability guarantee would imply that this data is likely backed up in some fashion and may potentially be restored in the event of a catastrophic filesystem replication failure. Therefore in theory, yes it's likely that an attacker could potentially access potential copies of data that the user thinks is deleted. Whether or not this is even an issue would depend on how Amazon secures any backup or redundant copies they may or may not have.

Important note: Any vendor that claims to "shred" data may only be doing this on their production system and may or may not be "shredding" copies of that data that may exist in their backups or in related data that exists in their logs. This applies to a huge variety of vendors and isn't cloud or AWS specific at all.

More importantly, if you need additional security controls it would be wise to implement additional controls in your environment. This is true in both cloud and non-cloud deployments and really isn't an issue unique to Amazon S3.

Security on computational cloud platforms is different than traditional corporate environments but a lot of the traditional security controls can still be put in place, architects just need to be more mindful of these decisions when working in these environments.

Amazon also has a dedicated Privacy site which is worth looking at:
https://aws.amazon.com/compliance/data-privacy-faq/

Finally, Amazon is a US-based company and the US government has approached many ISP's with National Security Letters requesting that they retain data. I am not aware of any such letter being issued to Amazon but it's possible that any or all service providers are being asked to retain certain types of data. If so, then the location where the data is being retained could also be attacked.
https://en.wikipedia.org/wiki/National_security_letter

End of device life, data is securely destroyed:
https://d0.awsstatic.com/whitepapers/compliance/AWS_Risk_and_Compliance_Whitepaper.pdf

The following reference to data being securely wiped between uses seems to currently apply to EBS ( S3 is not explicitly listed as I write this so I wouldn't assume it applies to S3 ).
https://d0.awsstatic.com/whitepapers/compliance/AWS_Risk_and_Compliance_Whitepaper.pdf


Star property in read/write access The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?

Append should not allow you to delete the original content, so where this works is in environments where the original is the core, and any additions are read with the original in mind.

Write access may let you delete the original, so you could replace data with something new. This may not be the behaviour you want.


Should I update my openSSL package? This link talks about the new patches to be released by OpenSSL Foundation very soon.

It says:

  In a mailing list note published last night, Matt Caswell of the
  OpenSSL Project Team announced that OpenSSL versions 1.0.2a, 1.0.1m,
  1.0.0r, and 0.9.8zf will be released Thursday.

Does it mean that all the 1.0.0, 1.0.2 and 0.9.8 versions has to be updated? Our openssl version is 1.0.1. Should I wait for 1.0.1m to be released and apply the patch?

[root@merc07 ~]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
[root@merc07 ~]#

Yes.  You should always run the latest version of code (assuming it doesn't break a critical system supported by an earlier version, in which case... good luck!).


What does Jingwang do and how is it distributed? A month ago, the Open Technology Fund, which is some kind of anti-cyber-censorship project funded by the US government, posted a forensic study of a Chinese app called "Jingwang" or "Net Guard". A week ago, a question about Jingwang was posted here, linking to the study, and became a "hot network question" on Stack Exchange (that's how I got here).

This app has been mentioned in western media for months, as a surveillance tool being employed in Xinjiang. Last week's question says police were stopping people on the streets and demanding that they install the app on their phones.

Back in April, a Chinese member of Quora tried to find the app on the Chinese Internet. The closest he came, was a PC program of the same name, for blocking pornography.

Appendix 1 of the American forensic report says the app can be obtained by scanning a QR code on "the main JingWang website", and provides the QR code and the URL.

I would like to know answers to questions like:

Is this thing real? What does it actually do? Can you download it from outside China? (I haven't dared try.) Is it distributed in an unusual way (compared to other apps in China), or is it just that it has become a civic duty to install it on your phone?

From reading the OTF - Jingwang Report Final (pdf)

  The QR code (see image below) seems to be the initial point of download and installation of the
  application, whose app_name (净网卫士) roughly translates to Net Guard. The QR code
  decodes to an URL
  (hxxp://47.93.5.238:8081/APP/GA_AJ_JK/GA_AJ_JK_GXH.apk?AJLY=650102000000) which
  points to will perform a download of the APK file. Directing a phone to this link triggers a
  download of an APK named GA_AJ_JK_GXH.apk.

If you had a vpn in china you might be able to pull it from there.


DDoS -- null route everything not approved Is it possible to create a route on your internet router which routes traffic unknown to null. So you basically dont even let traffic route into your firewall unless its approved? Can this help detour the ICMP pings which take down your circit?

The problem with some kind of DDoS attacks isn't what happens to traffic. The problem is the existence of the traffic itself on the link. At some point, your link will just be too full for your router to be able to handle the requests (dropping or null-routing). You see, it doesn't matter what the server/router/firewall is doing, the hose is just too congested.

You defend against this kind of DDoS either by having more links than your attackers can fill (using big service providers like CloudFlare or Akamai, they take the hit for you) or just take your connection/server down.


Is the 64-bits length of the original string padded as well in the MD5 hashfunction? So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars.

The binary equivalant of 56 is 00111000, which is 64 - 8 short of 64 bits. How are the remaining bits filled? Are they padded as well?

This is what happens when padding the string:

  The message is "padded" (extended) so that its length (in bits) is
     congruent to 448, modulo 512. That is, the message is extended so
     that it is just 64 bits shy of being a multiple of 512 bits long.
     Padding is always performed, even if the length of the message is
     already congruent to 448, modulo 512.

  Padding is performed as follows: a single "1" bit is appended to the
     message, and then "0" bits are appended so that the length in bits of
     the padded message becomes congruent to 448, modulo 512. In all, at
     least one bit and at most 512 bits are appended.

from here.

However, in the same document, no clarification is given on the remaining 'empty' bits (512 - 56 * 8 - 8):

  A 64-bit representation of b (the length of the message before the
     padding bits were added) is appended to the result of the previous
     step. In the unlikely event that b is greater than 2^64, then only
     the low-order 64 bits of b are used. (These bits are appended as two
     32-bit words and appended low-order word first in accordance with the
     previous conventions.)

  At this point the resulting message (after padding with bits and with
     b) has a length that is an exact multiple of 512 bits. Equivalently,
     this message has a length that is an exact multiple of 16 (32-bit)
     words. Let M[0 ... N-1] denote the words of the resulting message,
     where N is a multiple of 16.

I hope my question is understood?

My guess is that 64 - bits(00111000) 0's are padded in front of the 64bit representation of the length.

In decimal, 1234, 01234, 0000000001234, and so on all represent the same number. The unique ten-digit representation of that number is 0000001234.

Likewise, the unique 64-digit base-2 representation of 56 (decimal) is 0000000000000000000000000000000000000000000000000000000000111000. So your guess is correct.

But you've made two other errors. First, at least one bit of padding is always added. Your message is 448 bits long, so 512 bits of padding must be added to made its length congruent to 448 (mod 512). Second, the 64-bit length is the length in bits, not bytes. So in all, your 448-bit message is followed by 10000...0000111000000, for a total length of 1024 bits.


JavaScript variable evasion when quote is escaped, but not newline I'm searching a way to properly evade from a JavaScript variable to perform  XSS. A normal user input will give var a='user input'.

a isn't eval anywhere and is not usable. Howewer, I've find something interesting. An input like %0a%0dalert(1);// will render as:

var a='
alert(1);//'

My browser is warning me about an illegal token error. This is normal, and due to var a not being closed.

Is there a way to get this to work? Executing the alert function ignoring the previous error. ' is escaped as \' and \ as \\.
Others basics HTML characters are also encoded in a normal manner (&quot; &lt; &gt; &amp;)

To cause injection in this context you need to either:

Close the script tag:

e.g.

</script><script>alert('xss');

OR close the single quote string context:

e.g.

'; alert('xss');

However, as the first option would result in &lt;, etc, and the second option would result in \' characters being output (and not possible to escape \ either because of \\), I would say XSS isn't possible in this case.

The only hope is that if the charset is UTF-7 or could be changed to such for UTF-7 XSS.

The only security flaw here otherwise is that an attacker could maybe cause a Denial of Service by preventing other JavaScript code running and preventing the application from functioning as intended.


Wireless Positioning System (WPS) works without Internet? As I understood it (correct me if mistaken); Wifi Positioning System has a network of routers of some sort, and when I plug in my new device, by using existing devices whose locations are known, they can locate my new router.

I have few questions about this;

How do they collect my info? Do they ask for permission? Can they use my device for determining the location of other devices? Does my router/device send any data about location or do they only use my signal power?
Secondly, if my router works in an intranet, without Internet connection, can they still locate my router? If not, can I some how use my router for GPS purposses without having any GPS devices?

This may seem of topic but, my questions are security related in a way... I want to use location services locally without an Internet connection and hopefully without sending data to other devices.

So several companies have a database of Wireless Access Points (Google, Apple, Skyhook).

In terms of how the data is collected, I don't believe that any of the companies have made official statements on the matter, but there's a couple of likely avenues.

First one point is that your wireless Access Point broadcasts it's BSSID address into, likely public, areas like the street outside your door.  It's fundamentally legal (AFAIK) for someone to pick up wireless signals in a public area.  So it's not your location that's been directly gathered, it's the location of a device in a public area together with the signal strength and BSSID address of your Access point

War-Driving.  Google in particular is known to have used this technique, when they equipped their street view cars with wi-fi detection capabilities.  This would allow them to assemble a large database.
Mobile Devices.  Both Google and Apple (and other mobile device manufacturers) have huge numbers of mobile devices with GPS and Wi-Fi.  If those devices report back Access Points that they have seen in a specific location, then it would be easy for those companies to assemble this information into a database.

In terms of your devices Internet connection, it doesn't really matter as it's not your device that is sending them information, it's other devices that "see" your device in passing.


Cross-language primitives against string comparison timing attacks? Related, not a duplicate: Timing Safe String Comparison - Avoiding Length Leak

I know about cache misses, let's assume we fit in a cache line swimmingly.
Thomas' excellent answer doesn't talk about jitter except that introduced by GC, nor does it touch upon asynchronous execution.
We can assume a low-level implementation (assembler, C, F77, Forth) that can be used in any higher-level language (e.g. Python)

Please correct me if I'm mistaken:

We are talking about comparing two strings of unequal length. The first one is chosen by Eve, the second belongs to Alice. Alice wants to prevent Eve from learning length and/or content of the second string.
No existing mainstream programming language has constant-time string comparison routines in its standard library.
To avoid leaking length information, do we

precompute hash of Victoria'sAlice's secret (hash function itself must be not vulnerable to timing attacks)
compute hash of Eve's evil string
compare hashes (equal-length strings by definition of the hash function) in constant time

or

simply compare Eve's string byte by byte to Alice's secret, incrementing a counter (or two counters, one each for matching and not matching bytes?) until the end of Eve's string?

Is introduction of cryptographically random jitter a valid defense-in-depth measure? (Please assume this happens across a LAN at a quiet time when natural timing noise is at a minimum).
Is asynchronous execution of comparisons (with some hard realtime guarantees) a viable defense? (Yeah, I know another side channel may be leaking)

What I'm not soliciting:

language/product recommendations
answers 'it depends on your threat model' (my threat is hiding in another server across the room, with an unlimited number of tries)

Community wiki for further information on the subject:

In Ruby, you can use Rack::Utils.secure_compare or ActiveSupport::SecurityUtils.secure_compare. Source: http://codahale.com/a-lesson-in-timing-attacks/ via https://github.com/thoughtbot/til/blob/master/security/constant-time-comparison.md
https://crypto.stackexchange.com/questions/5529/stopping-timing-attacks-on-aes-why-is-it-important-to-prevent-the-os-from-inter and DJB's 2004 paper.


How are spoofed packets detected? My assumption:

When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops the packet.

My question:

What happens if the source IP of a spoofed packet belongs to a real and online host? Are there any other ways to detect a spoofed packet?

While I am sure there are, in fact, firewalls that may do that, I am not off-hand aware of any that operate this way. There are packet spoofing detection mechanisms, although they tend to act a little different.
Bogon Filters
A bogon is defined as bogus IP address. Specifically, it is the list of all IP addresses that have not been allocated by IANA, by a delegated RIR. The best way to get this list is for your firewall to support subscribing to a bogon service. If you enable bogon filtering on your firewall it also tends to also include ingress packets where the source address is listed as an RFC 1918 address.
It is also customary to block using the same rule, or locally edit your bogon list, to include your local allocation. It is generally considered unlikely that your internal IP addresses will be seen on the ingress port of your firewall. An exception to this would be any equipment of yours that exists outside your firewall. This would most likely include packet shapers, routers, or other infrastructure equipment, but in some cases other equipment may purposely be left external. Make sure to exclude those from the bogon list.
MAC Limiting
For devices like border firewalls we generally have a really good idea what physical devices are able to directly communicate with them. This should, again, be infrastructure devices like packet shapers, routers, etc. If you have a DMZ then you may also see those devices in there depending on your architecture. In this case we can enumerate the MAC addresses that should be able to talk directly to the firewall and deny any that aren't on that list. Incidentally, this also helps catch systems that end up on this network segment that shouldn't.
For firewalls that may be deployed for departments, or in a transparent/bridge mode within a network for segmenting a subset of hosts, building these lists can be a lot harder.
TTL Analysis
Between two hosts the number of hops generally remains constant, or changes very little, between packets. As such if the TTL dramatically changes from one packet to another this could easily be a spoof attempt. This does require keeping more state information, and is not fool-proof since the route could change, but is often indicative enough.
Route Checking
If you have multiple active uplinks then you can also verify that the packet is coming in on the correct interface. There exists a standard for this called Reverse Path Forwarding (RPF). In short every time a packet is received on an interface the router checks its routing tables and determines if that is the correct interface for that source address. That is, if the routing tables say that packets destined for 144.152.10.0/24 are transmitted over interface ge-0/0/18 and it receives a packet from 144.152.10.5 on interface ge-0/0/20 then it is probably spoofed and should be dropped.


What are the Netscape Cert Type attributes? Why/when are they needed? What are the  Netscape Cert Type attributes in a X.509 Certificate and how are they different with the X509v3 extensions?
Example:
There is the Client/Server Extended Key Usage (X.509) but there is also NetscapeCertType for SSL client and SSL server.
Similar for CA vs Basic Constraints.
So what are these attributes?

The Netscape extensions were defined by Netscape during Days of Yore -- around 1996 or so. Netscape did that because the "official" extensions were missing, ill-defined, or found to be lacking some way or another by the Netscape developers.

Old Netscape versions (when it was called Navigator and Communicator) used these extensions, so you had to include them in your SSL server certificate for proper operations. Newer versions and derivatives (including Firefox and the AOL Web browser) simply ignore them if present, and there is little reason to use them anymore.


Is this VPN customer service info correct? I have recently started using a VPN. I visited dnsleak.com and dnsleaktest.com and was informed by both of these sites that my DNS was leaking. Indeed, I could see in the list of servers, that a couple were associated with my ISP.

dnsleaktest.com claims:

  The owners of the servers above have the ability to associate your personal IP address with the names of all the sites you connect to and
  store this data indefinitely. This does not mean that they do log or
  store it indefinitely but they may and you need to trust whatever
  their policy says.
  If you are connected to a VPN service and ANY of the servers listed above are not provided by the VPN service then you have a DNS
  leak and are choosing to trust the owners of the above servers with
  your private data.

I contacted the VPN provider about this issue. I was told they do not currently provide their own standalone DNS addresses. I was provided with addresses to use instead. These are OpenDNS addresses. I then asked them to confirm whether using these OpenDNS addresses would ensure a secure and encrypted connection and use of DNS.

The VPN provider replied:

  Using these third party DNS addresses over the VPN connection, still encrypts your requests, by sending them to the VPN server, where
  they are then passed to the DNS resolving service, thus making your
  connection secure.

Using the provided DNS addresses, only OpenDNS related addresses come up when testing on the two afformentioned sites.

My question is: Are they correct in telling me that my DNS queries are being encrypted by the VPN service(assuming the VPN does indeed work!), and are therefore secure and private?

Something about this claim didn't feel quite right..
Another couple of questions that occur to me regarding this:

Can a DNS service, unrelated to the VPN provider really deal with an encrypted DNS request?
Does the DNS request really go through the VPN BEFORE the DNS service?

Your DNS queries will not be visible to your ISP or anyone watching your ISP connection (assuming you are routing all your traffic through your VPN), but will be visible (but not traceable to you, unless you are the only user of that VPN) from the VPN exit point to the OpenDNS provider.

Note that if the VPN provider logs traffic, those logs would be visible to anyone who can compel the VPN provider to turn them over and the DNS requests would be visible then.

And, of course, everything you do will be visible to your VPN, unless you use further encryption. For example, even if you are using a VPN, always use HTTPS where available.


Is a TPM module insecure if not soldered to the board? I am looking into Bitlocker for my headless Microserver N54l with windows server 2016 on it. I saw that the n54l has no TPM module, but I can buy one and plug it to the board. I am interested in it solely for the purpose of using auto unlock.

In the TPM specs (Infineon) it clearly states that the TPM chip has to be physically fixed to the mainboard.

Doesn't it renders it's security features useless if it is on a seperate module which is plugged into the board ?

I am under the impression that with a tpm (and autounlock) one can only gain access if he has the windows account credentials or the encryption key ?

However i think that might not be true.

Btw I am not using a microsoft account on the server so my keys should not be uploaded to microsoft as far as I can tell.

What do you think ?

The purpose of TPM is to protect the encryption keys used to encrypt disks with BitLocker.

If you can remove a TPM, as-well-as the disks, then you may be handing the key over with the lock, though in the case of a micro server, I suspect you're more at risk of someone stealing the whole server.

It sounds from your post like you're not planning to implement BitLocker's PBA features, so it may be worth asking yourself which problem are you trying to solve by implementing BitLocker.


How does Yandex Alpha sign me in automatically? I downloaded the new Yandex Alpha browser. When installing, I chose not to make it the default browser and not to send anonymous usage statistics. I never got a prompt whether I wanted to import passwords, history or anything else - these two questions were the only ones I had to answer. I didn't have any version of Yandex browser or Yandex Alpha browser installed before.

Now when I first opened the browser, I came to a page with my most visited webpages, which was imported from Chrome - okay, I'm fine with that, although it would've been nice if they would've asked me whether I wanted that or not. But more importantly I noticed that when I opened a StackExchange site, I was already logged in. The same with Facebook and other sites. How's that possible? Could Yandex Alpha steal the PHPSESSID cookie and is that enough?

My Facebook password has not been saved in any of the browsers I have installed. Also, Facebook is supposed to give me a notification when I log in from an unknown location, which normally also happens if I use another browser. But with Yandex Alpha I did not get such a notification.

Does this point to a security problem? Doesn't this mean that any program can steal my session from my browser and pretend to be me on whatever website?

Yandex Alpha automatically imports data from several other browsers whilst installing. More docs on it here.

In the case of Chrome it automatically imports:

Browsing history
Favorites/Bookmarks
Saved passwords
Search engines
Cookies
Extensions
Advanced settings

As you see in this list it automatically imports your cookie store from Chrome so this definitely explains the fact your sessions could be persisted across to the Yandex Alpha browser.

If you wish to not have the import saved down there should be an option to decline the import after the installation has finished. In your case in doesn't seem to have given that option and any reason I could give on that would be speculation.

In terms of whether its a security risk is down to how much you trust the application to have access to these things and not do anything funny with them.


Where can I find vendor neutral info and best practices on MFA using mobile? I am looking for above information from both developer and architect perspectives.

You may want to try reading the SANS Reading Room white papers related to such topic. Many authors list different tools that focus on the objective.


Firewall egress filtering by domain In our production environment, we are connecting to a few core external service providers though their APIs, and are required to have all other services blocked (PCI DSS).

We currently have a firewall which supports egress filtering by ip address so all non-essential addresses are blocked based on statically-created firewall rules (deny all, allow 1.2.3.4:443 etc)

So far all is good, now here is the problem, one of our service providers (a big bank) is moving to an edge/cdn hosted API for one of it's services and the ip of the services IS going to change several times per day.

I have read other articles about egress filtering:
Firewall egress filtering / quick whitelisting

...as well as possibly using scripts to modify an iptables based firewall based on a DNS query.
https://stackoverflow.com/questions/14096966/can-iptables-allow-dns-queries-only-for-a-certain-domain-name

...but these solutions seem hacky

Are there firewalls we can use that have domain based rules, instead of IP based so our API requests continue to arrive un-interrupted yet we continue to block all other outbound connections?

Are there firewalls we can use that have domain based rules, instead
  of IP based so our API requests continue to arrive un-interrupted yet
  we continue to block all other outbound connections?

Yes, although usually through a proxy functionality rather than a traditional firewall rule sense.

For example, the Check Point URL Filtering Software Blade allows you to restrict outgoing HTTP and HTTPS connections based on the DNS name they request access to - e.g., either a GET http://example.com/ HTTP/1.0 or a CONNECT example.com HTTP/1.1 would only succeed if a rule exists permitting access to example.com.

The proxy aspect is a result of the problem space.  Reverse DNS cannot be trusted in any way, shape, or form, so the firewall can't just reverse the IP the client wants to connect to and decide based on that.  It has to be handed a name by the client, and to make its decision based on that.  HTTP-style proxies work fine for this because, even when it's for an encrypted connection, the client hands the name over to the proxy before the connection can be made.

The problem with this approach is that it effectively bases security upon the result of DNS queries against remote domains.  Reverse DNS can never be trusted because anyone can put any name in for an IP they own.  But even forward DNS lacks the security required - you can safely assume that a moderately motivated attacker can manage to spoof or poison DNS if it allows them to exfiltrate PCI data from your datacenter.

(That does not mean you couldn't get this blessed by a QSA - it's a reasonable compensating control.  I just don't want you to think it's fully secure!)

I approached the same problem - for the same reasons as you - over a year ago, and concluded that the "secure" method would require that something more than DNS to vouch for remote sites, and that the SSL certificate was a reasonable thing to pin the security upon.  I ended up implementing such a proxy and using it for my purposes; the answer mr.spuratic provided promises to do the same thing (the only reason I haven't accepted it yet is because I feel the need to test it first).


How do applications such as password managers check leaked credentials and how can I get more results? I have been using LastPass for a while and I have just seen an option to generate an exposure report. By its output, I assume it checks various sources containing credentials dumps from hacked web applications for matches to my username / e-mail.

The output looks like the following:

{date 1}
somedomain.com

{date 2}
some collection name

{date 3}
Unknown source

I am curious about how such applications work behind the scene. Also, is there a way to find out more about my exposed e-mail in such dumps (i.e. more sources).

I see that haveibeenpwned.com lists many breaches, so I could consume their API to validate against my known hostnames. As a side note, somedomain.com is not listed by Pwned websites.

Question: How do applications such as password managers check leaked credentials and how can I get more results?

Different password managers will do it differently. LastPass does not disclose how their exposure emails are generated, although there was speculation by users that they combed through the leaked dump known as "Collection 1" and just notified everyone who had an account on any of the domains listed.

Firefox has incorporated HIBP in their browser. 1Password is also using that service.

HIBP has become the primary method to check for these things.

The core idea is to get one's hands on breach databases and password dumps and do the correlation. You could comb through hacker sites, Pastebin (or equivalent), news reports, etc. And once you do that, it will already be in HIBP. I am unaware of any other service that does this for you or is as trusted as HIBP.

Having a secret, proprietary service for this makes no sense. The more that people submit breaches and databases to a central service means that more people can be notified. HIBP has become that public service.

I know this sounds like an ad for HIBP, but I have no affiliation with the service. I am truly unaware of any other more reliable or complete way to do what they do.

Google announced a Password Checkup Tool in 2019 that looks like a beta tool for now. As of this writing, they keep a static list of breaches that they check. They do not disclose how it works (likely because they are not finished and they were racing Firefox to include it in a browser). It is supposed to be baked into Chrome, but it's experiencing bugs. It's experimental at the moment (chrome://flags/#password-leak-detection). Time will tell if they, too, end up using HIBP.


I just discovered that my sysadmin created a loophole that gives me root access. What should I do? At our company the Linux system administration is handled by the security team.  The guy assigned to my project has been a great big pain, and has seemed to me at several points to be of questionable competence.  (Maybe he's qualified to be a junior sysadmin, but not a security expert who also handles Linux system administration.  Perhaps he's good with other aspects of security or something I'm not aware of, but he's said things that make me question his competence in this particular role.)

He locks things down in ways that make my job very difficult, and without any good reasons that I can see or that he can explain to me.   (E.g. I can't use chown or chgrp on files I own, and he claims that giving me that ability would be a security hole.) If I trusted his general competence more I would assume that he simply understands things I don't understand.

One thing that is a thorn in my side is that I have to use sudo before drush (a script used for command line access to Drupal servers) and this breaks drush's ability to communicate with other servers, since it's not running under my credentials and therefore the use of ssh keys is screwed up.

It occurred to me, though, that since

drush can run arbitrary command aliases
drush is running with root privileges

I can now run arbitrary code on that box.  I tested with an alias to whoami and it returned root, so it appears that I do in fact now have the ability to gain root privileges.

What should I do?

Although (in effect) he gave me root access, I think actually using it would be a really bad idea.  (Although it's really tempting: I might actually be able to get some work done now!)

Is it my responsibility to do more than report this problem?  And to whom???

Am I responsible to report (what I think may be) the problem behind the problem?  In other words, his lack of suitability for this particular role?  Although I'd really like to not have him on my project I don't want to cost him his job.

Or is there something else I should do that I'm not even thinking of?

UPDATE: I should have mentioned that this sysadmin is on vacation today, so I can't report it to him until Monday at the earliest.  I don't know if this changes anything, or suggests a need to report to someone today?

Although it depends on the local policy of your organization, the usual setup is that you should report the issue; actually, make it a must since your sudo call with whoami was logged (sudo keeps logs by default) and this proves that you were aware of the issue. You have crossed the threshold, now you must go to the end of it.

If you consider that the hole is an honest mistake, then you should report to the sysadmin himself. On the other hand, if you have rational reasons to believe that the sysadmin has planted a hole intentionally, then you should report the issue to his manager.

Either way, the sysadmin will hate you for that.


Could overlapping SHA256 hash begin to loop at some point? I have a system that needs to send a key to the user. This key is used for validation after work and needs to be shown that we do not change it mid-work so we send to the user in the middle of work a hash using SHA256 and after the work is done we send the real key and the hashed key so he could check if the key was the same.

The original key is a string made of 32 hexadecimal numbers between 0x00 and 0xff so keys are like this:

key:        6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
hashed_key: e0bc614e4fd035a488619799853b075143deea596c477b8dc077e309c0fe42e9

key:        d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
hashed_key: d8bdf9a0cb27a193a1127de2924b6e5a9e4c2d3b3fe42e935e160c011f3df1fc

This will need a maximum of 2 * 10^77 hashes to crack using brute force and it is unlikely someone has enough HD space to create a database for all possible keys

The key we build is probably a hash of something else, for instance in the examples they are hashes to 1 and 2 respectively but they could be for any other string, we use some complex and random numbers (true random) to generate new secure hashes that are very unlikely to repeat.

What would happen if we keep on applying SHA256 over and over? at some point it would circle around?

And given we have a fixed length key to be hashed, would be easier to break? Is there any other method more efficient for this than brute force?

This system works with money (gambling) and we had some problems with "lucky streaks" so I'm trying to understand was it really luck? or someone cracked our system?

EDIT cpast clarification

Computers can't build actual random sequences, given you have the initial values you could recreate any sequence, this is what we use to ensure provability. Every user have at all times 3 server keys and 2 client keys:

server keys

the old key, used on previous run, revealed and presented alongside with equivalent hash
the current key, used on current run, concealed and only hash presented
the next key, used on next run, concealed and only hash presented

client keys

the old key, used on previous run
the current key, being used

In any given run the winning number is found using a function that calculates a number from a hash generated with this funcion hmac(server_key, current_bet_index + client_key)

When the user changes the client_key, the server key is also changed to the next one, and the old one is revealed giving the user a chance to check old bets.

My best understanding of your question is:

Given a hash, from a known hashing function, if I apply the hash to itself any number of times, shall I ever receive the same number again?

In that case the answer is "Possibly in a very,very,very,very long time depending on exactly what algorithm you use and how you use it."

A word about multi-hashing

At any rate, in a password context (which I realize is not your context) you wouldn't want to simply apply the same hash again and again blindly without understanding some deeper ramifications. In the case of passwords, you want to a iterative hashing solution that adds work to slow down crackers.

https://stackoverflow.com/questions/348109/is-double-hashing-a-password-less-secure-than-just-hashing-it-once

My advice to you

For the purposes of a card game it might make more sense to simply encrypt the clients cards, send them to the server, and send the results back to the user. In your system (as I understand it) logic pertaining to the win state is conducted in the client, which can be manipulated.

Instead, just ensure that there a secure connection between the client and the server, and do all the logic on the server side. Perhaps convoluted hashing set ups for online betting like this were made before the ubiquitous use of https.

What I think you are trying to do

I think the reason you providing the client the hash is so that you can provide some form of assurance that the game isn't rigged. You are trying to implement something like the below:

http://cseweb.ucsd.edu/~aauyoung/projects/cse207project.pdf

However, to accomplish this for a game like poker, you will have to develop a complex and will audited cryptographic system, which (while assuring the fairness of the game to a theorist) might do little to assure fairness to non technical user.

If you provide provide more information about what you are attempting to do, I'll do my best to update the answer.


SSH and PCI on Insecure, Dirty Side Does current PCI code require SSH connections be restricted to enumerated (specific) client IP addresses on the unsecure, dirty side? Isn't that outside the scope of the PCI code?

Does current PCI code require SSH connections be restricted to
enumerated (specific) client IP addresses on the unsecure, dirty side?

Not really.  PCI dictates that there should be firewall rules in place to limit access, but if you can justify an any -> 22/ssh rule, then you've satisfied PCI.

Isn't that outside the scope of the PCI code?

Well, requiring firewall controls is within PCI scope; see §1.2 and §1.2.1 specifically.  Interpreting whether the rules you've implemented are secure or insecure is up to the QSA; if you permit protocols like FTP or Telnet which are unencrypted, you need to show compensating controls.  But there's no blanket prohibition of any -> rules, which seems to be what you're asking about.
This of course assumes that the device falls within scope, e.g., is part of or connected to your CDE.  It sounds from your comments as if the device is completely disjointed from the CDE, in which case DSS doesn't apply.  If you're trying to determine if something is in scope or not, I recommend the Guidance for PCI DSS Scoping and Network Segmentation


How to check hardware integrity? When we download an ISO or any file we can hash it to ensure that the downloaded file has not been tempered i.e integrity of that file is preserved.

But when I am buying a hardware device (monitor, HDD, keyboard, etc) from the market, how can I be sure that it has not been tampered with by the reseller or any malicious employee of the manufacturer?

How can we ensure the integrity of the hardware device I am buying?

Tamper-resistance

The world of FIPS 140-2 certified cryptographic hardware has a similar requirement at levels 2 and 3

Devices certified to FIPS 140-2 Level 2 are required to "show evidence of tampering", which is usually accomplished by putting stickers similar to the usual "Warranty-void if removed" type stickers over screw holes and seams, but the FIPS 140-2 version of these stickers are serial numbered and like explode ink and change colours when you remove them. They are not fool-proof though and can be removed with a lot of skill and patience.
Devices certified to FIPS 140-2 Level 3 are required to have "strong enclosures and tamper-detection/response circuitry that zeroes all [cryptographic keys] when the removable covers/doors of the [device] are opened."

You tend to see this on high end servers intended for performing cryptography (ie HSMs) which run in the $1,000 - $10,000 USD range. I have never heard of this kind of tamper-evidence / tamper-resistance on consumer devices like HDDs and keyboards, but I suppose it could exist if there's a market for it?

Hardware fingerprinting

Probably well beyond the scope of your question, but it reminds me of the field of study around Physically Unclonable Functions (PUFs) -- they are essentially hardware hash functions in the sense that they will always give the same output to the same input, but their behaviour is very hard to characterize or duplicate. These are usually complex crystals where you measure a laser's optical path, or complex electrical circuits where you measure precise latency and resistance from input pins to output pins. They are mainly used for uniqueness -- each device has a unique fingerprint -- but they also match your question that their signature will change after physical tamepring (I've heard of PUFs being built in to device casings to detect if the seal has been broken, for example).

Now, you're asking if this can be done with arbitrary consumer-grade computer parts, say a Western Digital hard drive.

**Here begins wild speculation:** Whether you can take an existing circuit and characterize its latency and resistance as a PUF, or whether you would need to build a PUF into the circuit I don't know, I'm not enough of a PUF expert. Either way, for this to work, I presume the manufacturer would need to put each device on a very high-precision machine as it comes off the assembly line, publish the results. Then you would need to buy the same testing machine, test your new hard drive, and compare the results to the published results for the serial number of your device. You couldn't build the testing device into the HDD (or even ship it in the same box) because then the attacker could just reprogram that to always display the correct result.

Bottom-line: I have never heard of the kind of tamper-resistance that you're talking about for consumer devices. In theory it's possible, but would probably significantly increase the cost of the device.

A reasonable middle-ground for the amateur tin-foil-hattist is to only buy electronics in-person off the shelf from reputable big-box stores, and never order them online where they will be shipped across the country (and possibly across international borders) with your name on the box.


network icon on lock screen, group policy In an office setting, where it is an open space design, should I ensure that the laptop has 'Do not display network selection UI', enabled? Why or why not

This generally depends on how many networks will be available in that open space design, and if they're open to anyone or protected.

As you mentioned that it is a laptop, is it going to be taken outside of the office? If so, it might make it difficult to log back into unless you're using cached credentials (if it's connected to a DC).

I would recommend user education over locking everything down - advise users that unless they're using a VPN, then any traffic going over a network that isn't yours specifically is open to being intercepted.

In short: I wouldn't, but it entirely depends on if these laptops are being taken out of the office, and if there are non-work networks that are open and available, and if education for security isn't being done in your workplace.


Is it possible to run out Public-Key servers' storage by sending them countless valid Public-Keys? Public-Key servers should accept valid Public-Keys.

And they either cannot refuse to accept massive keys from a single IP, or from zombies, or from a hacked qualified key server via sync requests.

Generating some kinds of public key is quite quick, i.e., Ed25519: high-speed high-security signatures specifies:

  Very fast signing. The software takes only 87548 cycles to sign a message. A quad-core 2.4GHz Westmere signs 109000 messages per second.
  Fast key generation. Key generation is almost as fast as signing. There is a slight penalty for key generation to obtain a secure random number from the operating system; /dev/urandom under Linux costs about 6000 cycles.

Is it possible attack key servers with massive valid but frivolous Public-Keys continually, so that they cannot continue to work properly?

Either they go offline, or refuse to accept new public keys, or ban certain kinds of key generating algorithms, or delete all keys uploaded in a certain time, or requires registration or CAPTCHA.

And most importantly, how is Public-key Server system designed to be away from this kind of attack?

Edit: In 2014, Werner Koch submitted an I-D for use of Ed25519 in OpenPGP. I have no idea if it is accepted in OpenPGP, but ECC is supported.

As statistics from https://sks-keyservers.net/status/key_development.php says, there are 4.5 Million OpenPGP keys in total, though some sources claims more. Less than 1 thousand keys are added daily, with a maximum exception to be 40 thousand per day.

Since generating Ed25519 public keys is pretty easy, and the amount of public keys is rather small (I had expected it to be trillions in amount and pega-bytes to occupy), to double the keys in one day might not be a joke.

Even if the servers discard keys to avoid garbage outnumber good keys (I wonder if that is the case when negative amount of daily keys added occurs to the statistic), it means some good keys are discarded, too. And you can always perform a distributed attack at any time.

I have no idea if this conclusion applies to all ECC curves. Neither do I have any idea if RSA do, too, by generating weak keys (it doesn't matter even if they are easy to break). But I do wonder how PGP servers survived, as I am rather juvenile in this field.

This question really just boils down to, "Should you put rate-limits on a public-facing endpoint that accepts and records uploaded data from untrusted users?", to which the answer is virtually always "yes". There's nothing specific in this question that fundamentally ties it to public certificates.


Is it correct to consider audits as exclusively "detective" in nature? I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me.  The instructor was discussing access control administration areas and began categorizing certain things as "preventative" and "detective".  For example, data encryption: preventative... data integrity checks: detective... backup power systems: preventative... user training: preventative AND detective....

When the topic came to audits, he labelled them as "detective". To a certain extent, I understand why this would be this way -- since we're looking for vulnerabilities, if we find them... we're detecting them.

At the same time though, I can't help but wonder if audits can also be considered as preventative in nature -- because we're looking for vulnerabilities ahead of time in an effort to prevent them from being exploited later.

What are your thoughts? Perhaps I'm over-thinking this?

Much like recursion, to properly understand audits we must first understand the scope and usage of audits. Audits are used to determine compliance against a benchmark. Without said benchmark, then the auditor has nothing to measure against. In some cases your benchmark may be a deeply technical document describing programming practices or operating system configurations. In other cases your benchmark may be as loose as "follow best practices as determined by $RANDOM_DEPT".

Thinking of them in this light, using your labels, audits should be classified strictly as 'detective'. So, this means that 'preventative' measures would be the benchmarks/standards/policies/whatever.

Consider the following:

  In order to avoid unauthorized access
  by ex-employees all accounts are
  disabled upon separation.

In this scenario the policy to disable accounts is your preventative measure. During the course of an audit, your auditor would attempt to determine whether or not the policy is followed.


Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home? At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by this certificate.

I have no real issue with this practice as it's their network and equipment.

Recently, there has been a decision made to switch from Citrix to VPN for remote access. As part of the VPN configuration, my employer installs the self-signed root certificate into the trusted certificate store.

I am concerned that this at least potentially gives certain personnel within the firm the ability to decrypt encrypted traffic from my home computer. The certificate is a PKS#7 certificate signed by and issued to the same entity.

There has been no transparency into this process and it feels very shady to me. I asked about any potential security issues this could effect but was told that since the certificate is issued by a "trusted source" my concerns are unfounded. I am not a security guy but claiming this is issued by a "trusted source" seems like a stretch.

My question to you is, is this normal or acceptable practice and is there anything that I should be concerned about?

I don't like the idea of someone even having the potential to snoop my family's internet traffic without disclosure nor policy.

Am I being unreasonable?

Thank you in advance.

This is not a strictly a legal or technical question, but rather an opinion question - "is it acceptable?"  Is it acceptable to you?

You bring up a perfectly reasonable technical point though - in that a root cert in your system store allows the controller of that cert to potentially impersonate and intercept any of your SSL/TLS traffic via MitM techniques.

From a practical standpoint, I'd say it should fall under your company's BYoD policies.  You could request a corp-owned laptop for home use, and only use it for VPN access.  Or, you could not install the VPN client on your hom machine over your concerns.  Your employer can't require you to use your own, personal machine, but their policies probably do cover things like if you are going to use a personal machine on work resources, you must do X, Y, or Z to secure them.  And installing a root cert for VPN access would probably fall under those conditions.

Ultimately, the decision is up to you.  If you feel the potential risk is greater than you are comfortable with, I'd either: request a corp machine for VPN use only at home, acquire an other home machine, isolate it from the rest of your network and install the VPN on that, or go without VPN access at home.  Or perhaps you could spin up a "work-only" VM on one of your home machines with free VirtualBox or VMWare player, and install the VPN in to that?

I agree the "no transparency" and "feels very shady" bits are worrisome, but in most cases, I'd attribute that to apathy rather than malicious intent.  Most folks wouldn't even know what a root cert is, or why installing them on your company's say-so might not be a great idea.  The company probably isn't hiding some nefarious scheme, but the IT folks just want to solve the problem of "get folks access from home" and here is how they did it.

Conclusion: are you being unreasonable? No. But you are making more work for yourself, and that's a reasonable thing if you have concerns.  I doubt you have any particular leg to stand on to push back, aside from simply not using/installing the VPN


Security issues in a Dotnet Web application I was required to fix three low risk security issues of a Web Application on a Windows 2003 server, NetFramework 2.0, IIS/6.0.

It is tracert-able. That may assist for crackers to know network topologies of the institute and the University.
Suggestion >> ICMP packets should be blocked for both of inbound and outbound direction.

contains visible Front Page where direct description of the version information of ‘server extensions’, authorizing programs (admin.exe, author.exe etc), and URLs of displaying program (shtml.exe) etc. That may help crackers effective attacks for the server and so on.
Suggestions >> those files should be deleted, if you could, or if you need those files, give appropriate attributes or access protection.

In HTTP service, response header and/or Web contents contains IP address information of the internal network. Those may help effective attack to the internal network.

I don’t know exactly where to look and what to do to fix the issues. Firewall? IIS?

1) To restrict ICMP messages:

Open Windows Firewall, and click the Advanced tab.

In ICMP, click Settings.

In the ICMP Settings dialog box, do the following:
To block an ICMP message (prevent the ICMP message from passing through Windows Firewall), clear the check box next to the ICMP message and then click OK.

Note: If you check the 'Allow incoming echo request' box you will not be able to ping your server.
2) Find those files on the server (do a search) and either delete the files or change the permissions. You can change the permissions of a file by right clicking on it and then going into properties.
3) Depending on your version of IIS, you can follow one of these instruction sets: http://support.microsoft.com/kb/218180