CertGetCertificateChain doesn't recognise revoked certificate if the reason is "unspecified" In my program I use CertGetCertificateChain to investigate the validity of certificates.
If in my test PKI I revoke a certificate and specify the reason "unspecified", the error code in the last parameter pChainContext->TrustStatus.dwErrorStatus is zero, meaning no error, the certificate is not considered revoked. However, in the Windows Event Log I can see the following entry:

So, the revocation and its reason got detected correctly, however CertGetCertificateChain doesn't let me know about it.
If I revoke the certificate with any other reason (e.g. "cessation of operation"), CertGetCertificateChain correctly returns pChainContext->TrustStatus.dwErrorStatus == 4 which means CERT_TRUST_IS_REVOKED and in the Windows Event Log I can see this:

So my question is: Is this behavior of CertGetCertificateChain correct?
I spent some time researching this and I found this document. In section 6.3.2 (a) it says:

reasons_mask:  This variable contains the set of revocation
reasons supported by the CRLs and delta CRLs processed so
far.  The legal members of the set are the possible
revocation reason values minus unspecified: keyCompromise,
cACompromise, affiliationChanged, superseded,
cessationOfOperation, certificateHold, privilegeWithdrawn,
and aACompromise.  The special value all-reasons is used to
denote the set of all legal members.  This variable is
initialized to the empty set.

(emphasis is mine)
On the other hand, right in the next paragraph 6.3.2 (b) it says:

cert_status:  This variable contains the status of the
certificate.  This variable may be assigned one of the
following values: unspecified, keyCompromise, cACompromise,
affiliationChanged, superseded, cessationOfOperation,
certificateHold, removeFromCRL, privilegeWithdrawn,
aACompromise, the special value UNREVOKED, or the special
value UNDETERMINED.  This variable is initialized to the
special value UNREVOKED.

I really have no idea how to interpret this. Does it mean that the described algorithm must not consider the "unspecified" reason as revoked because it's not set in the mask? If so, this would mean that CertGetCertificateChain behaves correctly. But then some followup questions arise: Shouldn't there be some big, all capital, blinking warning along the lines of
"If you revoke a certificate, NEVER EVER choose "unspecified" as reason because otherwise it won't be considered revoked."?
But maybe I'm not reading this correctly, so here are some other blind guesses of mine why CertGetCertificateChain doesn't work like expected:

Maybe I need to configure my CRL to support the "unspecified" reason. But I don't see where I can configure that.
Do I have to pass some extra flags to CertGetCertificateChain to make it consider the "unspecified" reason? I cannot see any flags that sound suitable...
Am I trying to solve a not existing problem? Maybe literally nobody uses the "unspecified" reason and that's why I find so little information about it?

Can anyone shed some light on this?

I have literally zero experience with certificate revocation lists, so I may be technically incorrect in some places. This answer is purely based on what I understand from reading the relevant parts of RFC5280.

So my question is: Is this behavior of CertGetCertificateChain correct?

Apparently, yes.
The main reason is simply that you are not supposed to set the reason in the CRL to unspecified. Section 5.3.1 of the RFC says:

however, the reason code CRL entry extension SHOULD be absent instead of using the unspecified (0) reasonCode value.

Concerning your confusion with two apparently contradictory paragraphs of section 6.3.2... these are actually referring to two separate variables used in the CRL processing algorithm:reasons_mask and cert_status.
The reasons_mask variable is meant to contain supported revocation reasons of the CRLs processed so far, and therefore is largely irrelevant to whether the algorithm considers a certificate as revoked or not. If I understood correctly, this variable is used to ensure that in case a CRL has the the onlySomeReasons flag set (which means the CRL only contains revocations for the reasons it specifies), the algorithm will check other CRLs from the certificate issuer to cover other revocation reasons.
The cert_status variable is the one relevant to your question. This variable is intialized to UNREVOKED. When a certificate is checked against a CRL, if an entry is found that matches the certificate issuer and serial number, then cert_status is set using the following rules (from the RFC):

(1) If the reason code CRL entry extension is present, set the cert_status variable to the value of the reason code CRL extension.
(2) If the reason code CRL entry extension is not present, set the cert_status variable to the value unspecified.

So if the reason code CRL entry extension is present, then cert_status is supposed to to be set to the reason which corresponds to the reason code given. However, the unspecified reason code is not valid, so, in your case, Microsoft's implementation probably just leaves cert_status to whatever it already is (in this case UNREVOKED). This results in CertGetCertificateChain considering the certificate valid.


Should I publish IP addresses that try to brute force my private web server? Ethically and legally, am I allowed to publish IP addresses that tried to brute force my LAMP server? It's a personal website/blog that gets brute forced a lot and I would like to publish them to my website to make an interesting post.

I would just go through the logs and find the IP addresses that tried to attack me. From time to time I report them to https://www.abuseipdb.com/ .

Legally?  That depends on the laws of your jurisdiction, and is off-topic for this site.

Ethically?  Consider: most of these attacks aren't being performed by computers owned by the attacker.  They're being performed by home routers, security cameras, refrigerators, and the occasional compromised server.  Most of the IP addresses attacking you are owned by people who wouldn't know what an "IP address" was if it bit them, and would react with total confusion if you told them their FitBit or garage-door opener was attacking other peoples' computers.


Protecting master password in memory Assuming I want to enter master password only one time at the start of the program, how is this master password usually protected in memory after that? Is the encryption key after being derived from password encrypted again? If yes, by what? Is it store in multiple parts and pieced together only before being used?

How is this sort of stuff usually done? Is it even worth the effort?

I think that having sensitive data (whether it is the password, or derived key, etc) in memory is not something that most systems deal with.

That being said, here are several possible mitigation methods for protecting private data in-memory. This could apply to a variety of subjects, Server, Mobile or Desktop. The principals are the same. I'm also not sure which attack vectors you are most interested in. (virus, physical attacks)

An obvious first step would be to disable swap which is a feature that takes less used 'pages' of memory and writes them to a space on the hard disk. It would be fragmented, but quite possible for the attacker to get data with this method.

It is possible that some OSes provide a means to store specially marked memory that is forbidden from being stored in swap. I've never researched it though, and I am sure it is more complex than your typical runtime variable. If you did it this way, you would no longer need to disable swap on the whole machine taking the performance hit associated.

@Stephane comments that Windows has an option called CryptProtectMemory which encrypts the memory. I think this is clever as that way only the key would have to be forbidden from swap, instead of each individual piece of sensitive information.
As for the Memory itself (swapped or not), if you are logged in as root or as the same user account the process is running under, there is a means to dump all memory for that given process. Many of the high-level programming languages provide this functionality internally with the same user account conditions.

Android solves this problem by providing each app with their own user account in the OS, which gives many additional benefits.
Server environments often have services segregated into alternate user accounts to help contain potential breaches, both from a memory and from a file-system storage perspective. (never run a public-facing service as root!)
In a traditional desktop environment, there's not much you could do to secure processes running in the same user account.

The last possibility would be a special hardware module (either to store the data, or an encryption key for the data) which is separated from the main operating system. I would suggest taking a brief look at Trusted Execution Environment (TEE) and/or Secure Element (SE). See Android Keystore System.

There is also the more extreme method of using a completely separate (small) computer, i.e. Raspberry PI.

Related: https://security.stackexchange.com/a/36636
Specifically to your example of a Master Password, you could of course not store the overall master password, but just final password that was extracted from the store. This way the user has to re-enter the Master Password when visiting a new site.


How does Putty derive the encryption key in its .ppk format? I have been doing some reading on the mechanics of managing RSA key pairs, during which I learned that OpenSSL by default derives the encryption key by using MD5 on the passphrase (bad!) without any key stretching (worse!):

  But how do you get from the passphrase to the AES encryption key? I
  couldn’t find it documented anywhere, so I had to dig through the
  OpenSSL source to find it:

  Append the first 8 bytes of the IV to the passphrase, without a
  separator (serves as a salt).
  Take the MD5 hash of the resulting
  string (once).

  That's it.

The author of the quoted blog post goes on to explain how OpenSSL supports the PKCS#8 format (about which I know precisely nothing), offering protection against brute-forcing encrypted private keys that have fallen into the wrong hands through key stretching (PBKDF2).

However, my own valuable private keys are stored in Putty's own .PPK format which raises the question: how well are they protected against this sort of offline brute-force attack?

Gotta love open source!  The following code is from the stable Putty-0.63 release.

sshpubk.c

/*
 * Decrypt the private blob.
 */
if (cipher) {
unsigned char key[40];
SHA_State s;

if (!passphrase)
    goto error;
if (private_blob_len % cipherblk)
    goto error;

SHA_Init(&s);
SHA_Bytes(&s, "\0\0\0\0", 4);
SHA_Bytes(&s, passphrase, passlen);
SHA_Final(&s, key + 0);
SHA_Init(&s);
SHA_Bytes(&s, "\0\0\0\1", 4);
SHA_Bytes(&s, passphrase, passlen);
SHA_Final(&s, key + 20);
aes256_decrypt_pubkey(key, private_blob, private_blob_len);
}

Your password is hashed twice using SHA1 with "\0\0\0\0" and "\0\0\0\1" as separate salts.  The resulting hashes are concatenated to form the AES 256-bit key.  I am not completely up on all the current password attacks, and while I don't believe this is the best password hashing scheme it's not the worst.  Yes, SHA1 was recently deemed not secure, but I don't believe that this scheme would be trivial to break.

Something to remember about password guessing is that the attacker has to know when there is a success.   In this case the private key bytes themselves are encrypted with a key generated from a password.  So for each password attempt the attacker needs to do an AES 256-bit decrypt in addition to the hashing.  There is an integrity check for the entire keyfile.  For the PuTTY key-file we have the following HMAC:

    SHA_State s;
    unsigned char mackey[20];
    char header[] = "putty-private-key-file-mac-key";

    SHA_Init(&s);
    SHA_Bytes(&s, header, sizeof(header)-1);
    if (cipher && passphrase)
    SHA_Bytes(&s, passphrase, passlen);
    SHA_Final(&s, mackey);

    hmac_sha1_simple(mackey, 20, macdata, maclen, binary);

    smemclr(mackey, sizeof(mackey));
    smemclr(&s, sizeof(s));

Now after already performing 2 hashes and 1 AES decrypt the attacker now has to perform another SHA1 hash and a keyed SHA1 HMAC.  Just to verify if one guess was correct.  If it wasn't a PuTTY keyfile then the following else occurs:

else {
        SHA_Simple(macdata, maclen, binary);
    }

Obviously not as secure as using a PuTTY keyfile, but that would still total 3 hashings, 1 AES decrypt... and a partridge in a pear tree.


Decrypting .P7M File with Key (.pem) using OpenSSL My knownledge about security is limited so I need some help here.

The Question

  I want to Decrypt a .P7M file using its private key (.pem). I would prefer to use OpenSSL for this.

Tried so far

OpenSSL smime -decrypt -in "Secret.p7m" -inkey "Key.pem" > Result.txt

Error

unable to load signing key file
7548:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib
.c:701:Expecting: ANY PRIVATE KEY
error in smime**The P7M File**

  Content-Type: application/pkcs7-mime; name="smime.p7m";
  smime-type=enveloped-data Content-Transfer-Encoding: base64
  Content-Disposition: attachment; filename="smime.p7m"
  Content-Description: S/MIME Encrypted Message

  BLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLABLA

Your decryption command is correct.

It seems there's something wrong with your key file. Does it really start with -----BEGIN RSA PRIVATE KEY----- and end with -----END RSA PRIVATE KEY----- (mind the exact number of dashes)? Or is it perhaps DER encoded which requires you to add -keyform DER your decryption command line?

BTW: You can check the integrity of the key itself with openssl rsa -in Key.pem


This issue has been fixed in the latest release (2.3.3.1).

The challenge sent was not the one displayed.

In the future, please take the time to send us a bug report on github: https://github.com/lgandx/Responder

We'll fix it asap.

Thanks!


What effect on internet crime did the more recent developments in encryption have? I'm doing a presentation on the effect of encryption on internet enabled/based crime, what would people say is the largest development in encryption of say the last 5-10 years what and what kind of enabling effect did it have?

Largest development in cryptography (at least breaking it) would be specialized hardware, there are countless examples of hardware specifically designed to test hashes at a speed that is unattainable with general-use hardware including variations designed to calculate bcrypt hashes, which ironically was created to beat specialized hardware in the first place.

Specialized hardware is the reason that we cannot rely on password hashing techniques that don't require a significant work factor to calculate using as many resources as possible in a way that doesn't promote parallelism.  The newest up and coming password hashing technique is scrypt, which heavily uses RAM and many randomly placed accesses to large arrays of random information which is by far the toughest resource to run in parallel.

As hardware becomes faster still and the cost of hardware becoming less of a barrier with the advent of renting specialized hardware for a cheap fee, I suspect that the future of password hashing will only become more dependent on counteracting the specialized resources of adversaries while still providing an hashing technique that doesn't put a toll on general-use server hardware.


What are the possible security settings of an iPhone iOS for the maximum possible security? Imagine a nation-state is after you. Is there a list of recommended security settings for the iPhone to give a critical/maximum possible level of local security?

You want a hardened phone? And you have a state sponsored actor after you? You should not be on the internet. Stop using the iPhone, use cheap burners. Because really - there's no way to be sure, not in Apple's ecosystem.

If you choose to disregard the above statement, your best options are to set it up the same way you would to improve your privacy (note the word improve instead of ensure) -

Disable script execution
Don't download any applications
Don't use any Google or Apple services (@Andre Borie's comment)
Don't sign in, disable Siri
Browse only in private mode (heh, placebo)
Figure out if you can get a version of The Tor Project's browser onto your device
Wipe it regularly
Don't add any contacts, not any that can be traced back to you
Never take photos or screenshots. Of anything.
Enable the passcode and set it to wipe the device on 10 failed attempts.
Don't use the fingerprint service.

But really, If you have a government after you, get off the grid.


How good is validating source with request.referer than checksum? I have 2 portals(both are under my control & domain names are different)

In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.

Link which will be hit in 1st portal to log into 2nd portal looks like below(Its a GET)

https://SecondPortalDomain/someServlet?param1=base64Encoded

This URL has problems like it can be cached and bookmarked. Also, if a User doesn't get authenticated to my 1st Portal, but hits above URL directly then also he can login (against my wish).

So, am thinking of putting a check using Referer. If source URL is so and so then only allow to login.

How strong is using Referer compared to validating checksum between source and target? Referer is a client-controlled value and can thus be spoofed to something entirely different or even removed. But, even a checksum value can be studied and spoofed.

You're right that the referrer header can easily be spoofed or be completely missing. There are browser plugins that block the sending of the referrer, so if you add a check on the referrer, you would be stopping users with those plugins from using your site.

A better option would be for the first portal to generate a long random token for each user, and somehow share that token with the second portal. Then portal 1 shows the user a link that includes the token as a parameter, for example https://SecondPortalDomain/someServlet?token=13a82b00-b17e-11e2-9e96-0800200c9a66. You have plenty of options for how the portals could share the token - for example they might share a database, or portal 1 could send it to portal 2 via SOAP or a RESTful post.

If this option doesn't work for you, then another alternative would be to do something time based. Portal 1 could encrypt the current time and use it as the token in a link to portal 2. Then portal 2 would decrypt it, and check whether the time from the token was within the last 10 minutes (or whatever tolerance you want).


What can cause a changed ssh fingerprint? What are the possible causes of a changed ssh fingerprint?

Some context: after finding a sensitive vulnerability in a governmental system and disclosing it to them, something happened which I don't remember happening before. When connecting to the VPS I used to verify the vulnerability, my ssh client complained about the key; the fingerprint did not match the one saved. I verified the one saved was still there, and after immediately rebooting the VPS it matched again.

What are the chances this is due to malicious interference?

The correct assumption in this case is that you are connecting to a different server.

Maybe a MitM attack or
maybe your DNS is spoofed or
maybe your data center has just removed your machine for a second because they got a call from the government and you are accidentally trying to connect to their "server unreachable" catchall machine or
maybe your server has crashed under the sudden load and the aforementioned holds or ...

There are plenty of reasons you might be connecting to the wrong machine and you should definitely not proceed.
There are a couple of harmless reasons as well, false positives that make people sometimes connect anyway.
False positives I can think of right now:

The server has removed an old ciphersuite which it doesn't want to support anymore.
The server IP has changed and you have "CheckHostIP yes" in your config (default on many systems).
You have connected to the same server using a different hostname (think about something like gitlab) since the default ciphersuites have changed. (This is really obscure but I have run into it.)
The server has multiple SSH servers installed, and you're connecting to the same machine running a different SSH server (e.g., due to improperly configured startup behavior), which has its own separate keys.

Do note that as described here public key authentication prevents MitM attacks. It does of course not prevent you from simply logging into the wrong machine and then typing in your sudo password. So caution is still required.


How to find the vulnerability of my server after attack? A few days ago, my company server was attacked by hackers who wiped the whole database in /var/lib/mysql/ folder.

Fortunately, I was able to restore everything from backups, but I'm not able to find the location of a security breach.

I found a bunch of .exe files in /var/lib/mysql/ folder which in my opinion definitely should not be there. The hack took place on 29 Nov, so I think the files responsible are ending with "exp.exe" and "401hk.exe" which when opened contained following line:

http://104.223.17.73:4568/401hk.exe

Is it possible that hackers wrote executables into the /tmp folder and moved those files to /var/lib/mysql where they executed the attack remotely?

It is critical to me to find the vulnerability to prevent such attacks from happening.

So far i checked all the access logs, run LYNIS security audit - found nothing critical, ran an rootkit check - found nothing.

Maybe someone has experience with a similar attack?

I'd strongly recommend imaging your disk and then wiping it securely and re-building the server. Ensure the compromised server is disconnected from the network immediately to stop any compromise spreading. Work on the disk image not the compromised server if you want to check the possible source and extent of the compromise.

Don't rely on restoring data to overwrite a virus or backdoor - you need to securely wipe the disk and rebuild the server. Scan and check backups as well before using them.

Presumably you have anti-virus running on the server? If you have then either it's not updating regularly, it's a zero day virus, or a direct hack that gained access to some level of interactive login. If you haven't install one and scan the image/disk - it may tell you what is going on. Scan all backups too.

If someone malicious has gained access to your server then, with sufficient permissions, they could move files wherever they wanted to. A full forensic investigation is needed to find out the cause and extent of your compromise.

You can start by checking access logs for interactive logins - tie up recent login access with specific accounts and check with the account owners to discount those logins - or not!

You can't trust timestamps on files - they can be changed easily. Do you have any intrusion detection system with file integrity checks? What does that system say about changed files and dates?

There are so many steps to take to try to track this down but if you're not prepared for a breach then it's very likely you'll not find the source of the issue easily if at all.

Also consider what data was in the database in terms of sensitivity and confidentiality. It's possible that the compromise has leaked some, or all, of the data from your database - if someone can wipe it they can almost certainly transfer the data out of the network (depending on your firewall egress rules).

Finally don't forget to check all servers and devices that this server has access too i.e. can connect to from services or accounts on this server - the compromise may have spread.

There's plenty of information on line on how to investigate breaches to find possible causes and how to clear up - don't just restore some data and hope for the best though if you don't know precisely how the compromise occurred and what damage/changes has taken place.


Is the content of my RAM kept if the OS is shut down but the PC is still running? I just asked myself if the content of my RAM is kept when I shut down the OS but the PC is still running. For example when I do apply updates they sometimes require a reboot. Is the informaiton that is stored in the RAM kept after the reboot?

Main RAM is DRAM: it keeps its contents as long as it is regularly refreshed, and the refresh is done automatically by the hardware. Thus, as first-level approximation, RAM contents are preserved across a reboot.

However, there are various ways by which the RAM contents from before the reboot may not live long:

During a reboot, control is passed to the BIOS. The BIOS may perform a quick on-boot "RAM test" which involves writing and re-reading the complete RAM contents. Whether the BIOS does that depends on both its brand, and its configuration. If it does, then the data contents are lost.
The OS, right after boot, considers that the previous RAM contents, if any, are to be ignored. From its point of view, the RAM is "free", and the OS will begin to use the RAM for its own usages. In particular, RAM will be used as a cache for disk access, so all bytes read from disk after boot will go through RAM until it is filled up. Such RAM usage, mechanically, destroys the information which was there before.
In any case, when an application asks the OS to provide some RAM, the OS takes care to zeroize the contents of that RAM. Even if old data lingers from the previous boot, applications won't see it. If you want to inspect scraps of data from before the last boot, you will need to do it with some kernel-level tricks.

In other words, previous RAM contents may linger, but the whole of the system is designed to ignore such data, so you won't easily observe it.

When DRAM ceases to be refreshed, in particular when it is unpowered, it loses its contents in a matter of seconds or, at most, minutes (this depends a lot on the chip details and the temperature; see this answer for some pointers on that subject).

Cold boot attacks are attacks that try to plunder data from RAM after a power-down or reboot. The attacker tries not to let the normal OS boot up, as this process will necessarily use a substantial amount of RAM and thereby destroy its previous contents.


How to secure a local socket? I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C).

My issue is that anyone can open a connection to my service if they know which port it is using. The applications have no credentials and just run in the Android sandbox.

What methods can I use to at least try and prevent bad app from accessing this service? as its on local host ssl does not seem relevant?

Both apps are compiled so I could share a secret key between them, but the Android apps could be decompiled.

How can you normally secure client/server connections on the same machine?

This feels like an instance of the XY Problem.

The short answer is:

Your external applications Bind to your Service.
This requires permission from the user, set with the permission tag.
You use this secured channel to establish authorization (e.g., share a secret key for use in a symmetric key scheme).

In general, this is how you provide information from an app, and then control access to that information.

The longer answer:

You're using the socket to communicate information from your Service to other applications, but this isn't really the "Android-y" way of doing things. Android has a system for inter-process communication using something called Intents. That's getting a bit away from the security-specific question though, so if you're hung up on the Android docs, feel free to ask on StackOverflow!

The upshot is that this system of Intents and Permissions is Android's tool for limiting app access. Note that this differs from the traditional desktop model (which is based on users, rather than applications), because mobile development is aimed at a single-user use case.


Secure Ids in Browser We frequently need to send entity ids to the client side.

How could we protect this data (especially ids)?

Even if we encrypt using same key every time, it can be identified by analysis.

For example, if I encrypt id "1" to let's say "ae!" (using any algorithm), that same id can be used later on as well.

So should we use session id as key to send data to client side (this will validate data only up-to session is active)? Or could we randomly append a string to id "1", encrypt it and then send to client side (this also can be sent any next time)?

Or is there any other way?

What is best practice for this type of security take care?

I am using .Net MVC C#. But I think question is irrelevant of platform.

Let's take an example.

In the following link id is given in datasource, which is plain text, so any person with technical knowledge can modify it (using developer console of browser).

So IMHO it should be encrypted, to make it unchangeable (because the changed value is not acceptable due to encryption).

https://docs.telerik.com/kendo-ui/api/javascript/ui/grid/configuration/editable

You can use an hash of the ids. For example, in pseudo-code,

sha2(entry_id || delimiter || user_id)

will do what you want:

all the users will see the same content on the same id,
not the users, not even potentially cooperating different users will be able to identify the entities by their hashes.
however, all the user will see the same entity behind the same hash.

The disadvantage of the method is that you need a backend storage for the per-user hash keys - the users will refer the entities only by their hash, and not even you will be able to decode out the entity from them.

You may get increased security by binding the hash to the session instead of the user:

sha2(entry_id || delimiter || session_id)

This will increase security (not even the user will be able to identify the entities between their sessions), and you will need to store the hashes only until session timeout. However, the user will be unable to produce a client-side entity storage (what may be also an advantage, too).


Client VPN, inside a corp network We have a set of people who need to do a proof of concept for 9 weeks. To do that, they need to VPN to a well known IT company environment.
However, they want to be able to install the IT company's VPN client (which is simply Cisco anyconnect) onto their corporate VDI to do it.
It works, though we had to whitelist the ip's of those using the app on the proxy at our edge. It also means they lose connection to our network once connected to the other company's network.
I need to know what the risks are here as there's a trade off between project timeline, time to set up a dedicated concentrator and resource to do that work. (The IP white list for users would be removed after 9 weeks this ensuring they couldn't use the VPN again)
(Fyi there is a clientless VPN that uses port 443 but apparently it's 'slow')
Can you help?

In my opinion, risks are low in this case, unless we start making suspicions on the people involved in the project about insider trading.
I see a potential risk in information exfiltration made by a rogue project member that leverages the VPN's encrypted traffic to access some resource at the IT company (e.g. storage) to later retrieve it (probably the employee will be able to access the same VPN from home).
But since the people on the project are limited in number, it's not my choice to make suspects upon them. Maybe they are trusted enough.
Or if the VPN, as in my comment, also allows for Internet access, different evil may happen. Suppose none of the users are insider traders (rogue), if the VPN allows for internet you are at minimum giving up on antivirus protection from proxy, unless the IT company protects the VPN with a restrictive proxy/filter. This is why you should talk with WellKnown LLC to make sure they block general internet access, of course unless it's really really fundamental for the project.
As you said, you are using Cisco AnyConnect. That is a tool widely used on the market, and as any tool, it shall be installed from trusted source and by verifying the author's digital signature, which is something Windows is good at.
The risk of the AnyConnect binary to be tampered with is negligible unless the company is enough high-profile. By the way, Govern... (I mean, determined-attacker)-level attacks are often out of the scope of this board because it's basically not possible to defend from a determined attacker with unlimited budget forever. AnyConnect needs Admin privileges and can modify system settings, so that's a tool sensitive enough to use care when being installed on corporate machines.
As a side note, stating that "I don't trust Cisco's AnyConnect because it could do malicious stuff" is like refusing to install MS Windows itself after not having verified its source code (which is the reason why Chinese government owns its customized and vetted MS Windows version: protect from potential US tampering).


My server is used for DDoS attacks I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user?

What logs should I look to, is there any settings I can modify so such things can't happen again in future.

Thanks

First of all were you sure it was your client and that your system has not been compromised ?
Backup your logs
Contact the police if necessary
How was the DDoS done ?

Make sure your firewall is up and scan your own host with nmap to look for ports that should not be open.

If your client can only use PHP or Shell scripts, you can limit the time and memory his scripts can use. This makes it harder, but not impossible to do an attack.

If your system is compromised you can NOT TRUST it anymore! Rootkits can hide a lot, including feeding you wrong statistics in top or disk usage !

EDIT

If it is a VPS I suspect you got an IP from the destination it has been attacking ? If not ask for the IP.

If you are using NAT then ask them to send you the port range from where the attack occurred. So you can identify the VPS that has been causing trouble.


Timing Safe String Comparison - Avoiding Length Leak Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm not sure about is how we can make it safe if the strings are different lengths (arbitrary).

One string will be deemed as "known", and the other as "unknown". We'll assume that an attacker only has control of the "unknown" value. Ideally, this function should leak no information about the length of the known string.

A trivial implementation, such as:

// returns 1 is same, 0 otherwise
int timing_safe_compare(char *known, size_t known_len, char *unknown, size_t unknown_len) {
    // Safe since all strings **will** be null terminated
    size_t mod_len = known_len + 1;
    size_t i;
    int result = 0;

    result = known_len - unknown_len;
    for (i = 0; i < unknown_len; i++) {
        result |= known[i % mod_len] ^ unknown[i];
    }

    return result == 0 ? 1 : 0;
}

The problem here though is that there may be cache information leak.

For example, a word size in x64 is 64 bits. So we can fit 8 characters in a single register. If the known value is a string that's 7 characters or less (since we add 1 to the known_len), the comparison never requires another load operation for the known string, even though the unknown string will.

In other words, if the size of the unknown string differs from the known string by one or more word boundaries, the total amount of "work" being done may change.

My first instinct would be to only compare strings of equal sizes, but then length information would be leaked (as execution would follow several different branches).

So, this leaves two questions:

Is this small difference enough to be concerned about?
Can this sort of difference be prevented without leaking information about the known size at all?

Being able to process strings of arbitrary length without leaking information on their length seems to be very hard (i.e. I don't see how to do it) because of caches. A very long string, by definition, will take a lot of room, and thus reading the string will incur interaction with the caches. Accessing the string from RAM will trigger cache misses, and also evict other data elements from the caches, impacting the future behaviour of the application code. A cache miss costs dozens or even hundreds of clock cycles: it is at least ten times more visible, from the outside, than a branch misprediction. If you worry about branches, then you should worry a lot more about caches.

However, we can cheat with padding. Assume that you could arrange for the two strings you want to compare to be written at the start of two big, equal-sized buffers full of zeros; also, we suppose that a byte of value 0 cannot appear in a normal string (e.g. these are C strings). Then all you need is to make a leak-free comparison of the two buffers, who have the same length. The buffer length will leak, but it is a fixed, constant and publicly known parameter, so that's not a problem.

This does not solves the problem; it moves it. Now, you have to make sure that whatever produced the strings could write them in the buffers without leaking size information. Generally speaking, you no longer have strings. You have binary values of a given fixed length that you copy with a big memcpy(); these values just happen to have a string interpretation in which the bytes are considered to be characters, up to the first byte of value zero.

From a higher point of view, having a "safe string comparison function" is like bringing a bucket aboard the Titanic. If your code is handling secret data, then everything you do with the data is potentially subject to timing attacks. In general, your application can be of two sorts:

If the only secret part is a single cryptographic element and everything else is public, then using a few leak-free primitives makes sense, and will improve overall security. A classic example is a Certification Authority, where the only secret part is the CA private key; as long as the signature algorithm does not leak secrets, the whole system is robust against timing attacks. Similarly, a Web site which does password-based authentication but otherwise contains only public data will be fine.
If the secrecy is spread throughout the system, such as a Web site which does password-based authentication to give access to some confidential data, then concentrating on the string comparison misses the point. The whole server code must be made leak-free, and that is a considerably more difficult endeavour (and we don't really know how to do it).

In any case, trying to protect any given piece of code against side-channel attacks becomes harder when the language is more "high-level". A language such as PHP, with its automatic memory management (the garbage collector) and string management (string are values just like integers) will not help at all. That's the reason why low-level primitives implemented in C (such as a leak-free string comparison function) must be provided, but the issue is much larger and encompasses a lot of PHP code as well.


SVN Password Requirements Is there a general rule of thumb when it comes to administrating SVN user passwords, should it be necessary that they must meet complexity requirements?

Presumably you are using svn to keep source code or configuration data or something similar, and having an unauthorized modification would be bad. Passwords are just one layer of security in protecting from an unauthorized modification.

So the rule of thumb would be to have "good" passwords. I personally dislike "complexity requirements", as most people doing this ignore that it's about entropy and not complexity:

Why do password strength requirements exist?
XKCD #936: Short complex password, or long dictionary passphrase?

But if your svn repository is susceptible to a brute force attack (eg, on the internet) you probably don't want your users to have passwords like "1234" or "password".

In addition to that though, you should consider:

Putting the svn behind a firewall, accessible only to internal network
Using SSH keys for authentication instead of passwords
Having branch permissions and a code review process to prevent unwanted changes from getting in the mainline / "trunk" source code


Why do login forms still use 'name = "pass"' or similar? Given that there are many password sniffing MitM scripts out there that comb traffic for key-phrases like "pass" and "password".

Why do manufacturers keep the same variable names and make it easy for the attackers?

Surely the manufacturers (of routers, etc...) could use the variable "pass" in the source code but change it to some randomised string specific to that device on release, thus making it nearly impossible to single out the password without manually combing through a large file of captured packets.

Autofill. Most browsers now have password managers, which are arguably more secure than remembering your password as they allow you to have different passwords that are illegible for each site. How can a user remember that their Facebook password is "a!34-tU62-He4M", and their google password "e4T?-y5Bf-6gR6". Compound that with the number of accounts people have and it becomes insane. Now, if all a user needs to remember is their master password, and provided the passwords are stored securely, they can have unique passwords for each site that are secure.

Password managers can only work if they know what the input is. A field named "x1" means nothing to a password manager, and it won't capture or fill in data to it. A field however named "password" will be flagged.


How can a major UK website detect usage of a UK VPN on an incognito tab outside the UK? This applies to any country, but here's some context:

Website: BBC iPlayer (a major UK streaming website, registration mandatory)
Server: Linode, London data centre
VPN: SoftEther on HTTPS port 443
Country of stay: South Africa

This is a standard situation for residents of country X visiting country Y to try to gain access to a service geo-restricted to country X.

What APIs could be exposing the South African location?
I say location as context broader than IP addresses should be considered. The following spring to mind:

Cached HTML5 geolocation API
Cookies on third party websites exposing the client once in South Africa when not using the VPN and a timeout realising the flight time to get from country Y's capital city back to country X's is too short
Installation of the country X website's iOS/Android app revealing GPS location combined with the "flying time" methodology in point 2
The website having knowledge that certain IP blocks are from "eyeball" networks (the major ISPs... i.e. ALLOW) and others are from "content" networks (the major cloud providers... i.e. VPN i.e. BLOCK)
WebRTC revealing a private 10.10.0.2 IP which is a typical VPN IP allocation although I can easily change such a DHCP setting on the server
Ping packets (or an HTML5 simulation of such) revealing 300ms latency to an IP claiming to be from city X, when the provider's streaming server is also in city X

Are there any approaches I may have missed?

Your first three explanations, from the perspective of a webadmin, seem a bit too cumbersome to be worth the bother.

Have you tried looking into WebRTC leaks? They're a popular vector for deanonymizing VPN users. Either disable WebRTC in your browser's about:config (or equivalent), or setup a firewall to exclusively allow network access through the VPN tunnel. For example, CDNs are based on location, so leakage could give your true location away.

It's also possible to detect VPNs in general based on their reverse DNS. VPN providers usually have a set of hostnames that turn up upon an rDNS query that can be used to detect VPN usage (and even the exact provider).


How are biometrics tougher to crack than a pin? When I hear that bio-metrics are tougher to crack, it's left ambiguous as to whether they refer to the term 'hack' as simply getting through the system by guessing the password or mimicking the person. So in terms of technical hacking techniques you use such as SQL injection or something similar where you have absolutely no idea what the password is, where do bio-metrics trump (because at the end of the day you are still entering the correct combination of 1s ans 0s to gain access)?

The issue with the biometrics is that the data being generated depends heavily on the sensor used to capture the data. I have biometrics recorded on my iPhone, my Android and my bank. As all three uses different sensors, the data they all have on record is wildly different.

Even if someone steals the data from one of my phones, that data cannot be used to attack my bank, for example. The sensor used on the ATM is different, and the binary data cannot be used to reconstruct my fingerprints. Even if I reuse my fingers on all three services.

On the other hand, if I reuse my PIN on all three, and one leaks, the same PIN can be used for attacking all my phones.

The main vulnerability of biometrics is that they cannot be revoked. If someone manages to grab a high quality picture of my fingerprint, they can make a model of my finger and maybe unlock my devices and my account, and I cannot revoke my fingerprint and issue another.


OID for creation date/time (X509 certificate field) X509 certificates used in PKI{X} have notBefore and notAfter dates. I'd like to stamp a certificate with a creation stamp, and the stamp is distinct from notBefore and notAfter.

Is there an OID for a creation date/time?

I looked through X.520 and did not see a similar OID. The description OID is already being used in this particular PKI.

Nothing that is recognized and interpreted by TLS clients -- the reason being such a field is entirely irrelevant. There's no action to take based on what such a field would contain, so nothing would have a reason to even read it.

But if you want to record that information for your own bookkeeping, then just embed the information somewhere where it won't break anything. The nsComment field is a good example. Or you could create your own OID. There's no harm in that as long as you don't re-use someone else's prefix.


Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA? In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's all done on one machine.

KeePass has some plugins that facilitate this:

http://keepass.info/plugins.html#keeotp
http://keepass.info/plugins.html#traytotp

There are also tons of browser plugins that faciliate this, which seem even more insecure in my opinion and there is even a HTML5 version.

Yes. Concept of two factors is to authenticate using any combination of the below methods

Something you know (password)
Something you have (OTP token with secret)
Something you are - Fingerprint, retina , palm scan etc...

If you hide both of them under third password (or even without password), you are weakening the whole concept. If the attacker can get through this single password, he got complete access (that would not happened with proper 2FA).

But people are lazy and therefore these plugins exists. The need to use 2FA might be also triggered by some security policy and the users might not see the benefit of it.


Nmap with snmp-brute script freezes at 33.33% I'm currently undergoing a penetration testing course where I discover the basics and I have a task where I need to perform SNMP enumeration on a target.

My working environment is as follows :
Host : Windows 10 (64-bit)
Oracle VM VirutalBox machines :

Kali Linux 2019.4 (64-bit) : attacker machine, 4GB of RAM, 4 vCPUs, fully up-to-date, NAT network 10.10.10.0/24 with address 10.10.10.11
Windows Server 2012R2 (64-bit) : target machine, 5GB of RAM, 2 vCPUs, fully up-to-date, same NAT network 10.10.10.0/24 with address 10.10.10.12

Edit : The 2 machines can ping each other.

On the target machine, SNMP service has been activated via the "Add roles and features" window and configured to have a basic "public" community string and to allow SNMP packets from any host.

The problem :

I need to use the following command : nmap -sU -p 161 --script=snmp-brute 10.10.10.12 on Kali Linux to brute-force the community string of the target machine.

But when I do so, UDP scan goes on without a problem, but the NSE script just freezes at 33.33%. If I use combination CTRL+X (found it accidentally, didn't know it was a thing) (edit : if I get a status line by pressing any key) I get the following information :

Stats: 12:26:31 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 33.33% done; ETC: 04:57 (24:53:00 remaining)

and the "time remaining" keeps on rising.

If I increase debugging level to 2 with d, I get these similar packets forever :

NSOCK INFO [47243.1930s] nsock_pcap_read_packet(): Pcap read request from IOD #2  EID 262533
NSOCK INFO [47243.4940s] nsock_trace_handler_callback(): Callback: READ-PCAP TIMEOUT for EID 262533

Edit : Just to be sure that it has nothing to do with Windows Firewall on the target machine, I deactivated it. Nothing changed.

Can someone please shed some light on this problem for me ?
Thank you very much

Don't specify UDP port as you can see in this example:
https://nmap.org/nsedoc/scripts/snmp-brute.html


Understand what to protect with JWT So I have written a dummy application, a login form written in angular2, this posts the username and password to a rest API, if the credentials are correct, the API returns a JWT (encoded in the JWT are various permissions).The JWT is saved in the local browser storage.

This works absolutely fine, the JWT stored in local storage (as per the guides I have read online) and can be accessed to anyone with a bit of browser knowledge (inspect element, view resources etc), and once you access the JWT token, it can easily be decrypted without the use of a key.

In my angular2 application, it decodes the key, if they key contains "value1 = True" it allows the user to a certain part of the website, if the key value is false, it returns the user to the home page with a access denied message. Again works fine in my test setup.

As the key is only stored locally, I can create a JWT anywhere, paste it into my browsers local storage with the correct credentials, and then I can access the restricted areas of the website.

Have a I missed anything, as this really doesn't seem secure? Lets say my app was online at mynewapp.com and the area mynewapp.com/private was protected with this JWT authentication, the application checked for a valid JWT, if a valid JWT token is found, it inspects the token, to see if it contains the relevent permissions to access this area, if it doesn't, whats to stop the person behind the browser modifying the contents of the browsers local storage, to manipulate the data to access this forbidden area.

The only way I can think of is to:

If JWT exists, perform API call to REST server, if the user with the JWT has permission to access the requested area, return true and allow the request to continue inside Angular

Else, REST Api returns false and user is not allowed any further.

If JWTs are used for authorization or authentication, they should be either signed or encrypted (which depends on your exact use case).  If you have one auth resource and multiple other resources that want to consume the JWT, signing with a private key (in the auth resource), verifying with a public key (in the other resources) is a good pattern.  If you have multiple servers all serving as auth endpoints and as resources, a shared encryption key can work well, as the token can be created and encrypted, then decrypted when it needs to be verified.

A JWT contains claims, but those claims, as you surmise, should not be manipulatable on the local side.

The folks at Auth0 (disclaimer: no relation to Auth0 at all) have a bunch more info about standard JWT signing algorithms.

One note - restrictions in Angular2 (like all client side pages) are only suitable for end user convenience - for example, hiding pages they can't access so they don't get confused.  You should NEVER count on these, as any restrictions in Angular2/JS can be trivially bypassed.  Before any restricted data is retrieved or restricted operations are performed, user authorization checks should be done on the SERVER.  In fact, authorization checks should be done for every operation - you never trust the client, ever.


Shared folders in Windows to/from unsecured PC on the same network I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors.

I have a Windows 7 laptop with a fresh OS install and only a few programs installed. I'm using it as a dedicated computer for running a laser cutter. Both the laser cutter and the laptop are in the garage. The laptop user has no password, so anyone with physical access can boot it up and get into an admin-enabled user unrestricted. The laser cutter software, unfortunately, only works when run as administrator, so the user must be able to run programs as administrator.

Both computers are on the same home network, and in the same Workgroup.

I have a network-shared folder on each computer to allow me to easily send files to the laptop for use on the laser cutter without needing to go back and forth with a thumb drive. The idea is I can drop a file in the shared folder on my desktop PC, walk over to the laptop, and grab the file.

I want to have acquaintances from my local area be able to bring their own files, usually on thumb drive, and use them in the laser cutter.

I am not concerned if I have to nuke the laptop and install the OS again if it gets infected, but I am worried that an infection on the laptop could spread to my desktop through the shared folders. Is this something I need to worry about? Are there any other vectors whereby malware on the laptop could infect my desktop (without user action on the desktop, such as running an .exe from the shared folder)?

First, this assumption is highly optimistic:

  It's password-protected and I'm not concerned about it being physically accessed by bad actors.

You should. As soon as an evil guy has physical access to a machine, many things can happen:

at the simplest level, just boot from a CD or an USB key (UBCD or UBCD4WIN are great for that). That is normally enough to by-pass any password protection (and IMHO much simpler than attacking the desktop from the laptop)
at more complex levels are malware hardware devices such as a physical keyloggers (password is know next time you enter it), or USB devices simulating a keyboard

But your actual question is about what could happend to your desktop if malware are installed on the unprotected laptop.

This part highly depends on how your system is configured. The default installations assume that the local network is secured, and it is common for guest accesses to be allowed. That is not enough to execute something but that means that it is possible to read files from the computer - you know whether private information can be present, I do not.

Another possible way is more like social engineering. It consists of letting innocent looking files (images, videos, music) containing an infected payload targetted at common media readers in places where they could not notice them as suspect. As your main destop can read from the laptop, it would be possible that you inadvertantly load the malware on the desktop.

And as soon as it is on you local netword, it can spy all network traffic, perform Man In the Middle attacks through ARP cache poisoning (pretend to be your router for example), and various other network attacks. Not speaking for possible exploits in the OS itself on any service running on it.

TL/DR: The real problem here is the exposition of the desktop. Common security practices recommend that the higher is the exposition, the higher should be the security: only required services and applications, strong passwords and often changed. And if physical access is possible, no USB ports, no bootable device and a consistent control of all physical devices before use. And of course a physical lock to prevent box opening.

That being said, the security level must accomodate to the actual risk, and only you can know whether the cost (money and time) for securing that is worth it.


Getting strange texts to an iPhone #PWD123456#00X My dad is getting strange SMS texts to his iPhone 4

Some examples:

#PWD123456#WHL003=2308480298
#PWD123456#WHL004=2398480389
#PWD123456#WHL002
#PWD123456#WHL002
#PWD123456#STATUS?
#PWD123456#OUT1=ON

Googling reveals this GSM-Auto Controller user manual (PDF).This document discusses how the codes above can be used to reprogram GSM SIM cards. Is this a real danger for iPhones? Is there anything that he should be concerned about with these?

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices.
The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch.
I'll try to translate the commands for you

#PWD123456 : Use the password 123456, which is the default
password for this device. We all know how common it is for people to
leave the default passwords.

#WHL004=2398480389 : Add the number 2398480389 to the list of white-listed numbers.

#STATUS : You're basically asking the unit to give you all the information about it. A real device would have responded to the attacker with an SMS containing information about the whitelist, the status of the system, the mode of operation, and other information. Basically the device will send you all the information you need to continue the attack.

#OUT1=ON : As with any simple-to-use microcontroller, usually users will use the first ports for their outputs. Here the attacker is attempting to switch on the port #1. This could be a garage door, for example.

Another possiblity
There's a high probability that this is not an attack, this is very likely just someone testing his new Wafer GSM-AUTO device and mistakenly typed the wrong number. Hey, it could be one of your dad's friends (If your dad's name starts with "A", that's even more likely).


Are future TLS versions going to prevent traffic inspection? Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that receives the HTTPS connections and forge a on-the-fly certificates for the destination using that root CA. So, for this TLS traffic inspection you need to control both the endpoints and the network. Some network devices such as IPSs, proxies and DLPs implement this.

Traffic inspection has a business case: organizations may want to protect themselves against information leaks and malware communicating using these encrypted channels. If traffic inspection was not possible, organization would have a hole that would be exploited by attackers.

However, I'm not sure about the future and what is the trend. I have read about certificate pinning for example that tries to avoid traffic inspection to some point.

Are future versions of TLS going to avoid traffic inspection?

Nowadays all HTTPS traffic could be inspected using this mechanism? Including Google, Apple, Microsoft...

TLS by itself protects the sniffing and modification of traffic between two endpoints, i.e. client and server. TLS interception just makes two TLS connections where only one was, i.e. client to interception device and interception device to server. This will still work with future TLS versions.

TLS interception is only possible if the validation of the endpoints does not detect the interception (or explicitly allows it). How the validation of the endpoint is done is not part of the TLS protocol itself and thus changes to the TLS protocol will not affect this part. Thus the current mechanisms for SSL interception by using a trusted proxy CA will still work as does SSL pinning if interception should not be allowed. Note that today's browsers will ignore pinning if the certificate is signed by an explicitly added CA, which means that pinning will be ignored when legal TLS interception is used. But this again is an issue of validating the certificate and is unrelated to the TLS version.


How safe is Tor from MITM/snooping attacks? I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1.

Now, this works for me, but I have some friends who need a SOCKS proxy for similar purposes. I can't give them my SSH access, for reasons beyond my control. The only alternative I can think of (besides those china tunneling sites) is Tor, because it sets up a SOCKS5 proxy on port 9150.

However, I'm not sure how safe Tor is from snooping and other MITM attacks. I don't care about the anonymity provided by tor — we're using it for the purpose of having a tunnel, not for the anonymity.

However, I wonder how secure it is to use Tor for normal traffic. Cookies/login information probably could be stolen by a snooper, and there could be other types of MITM attacks as well. I don't understand Tor well enough to figure this out myself.

How safe is Tor from these attacks? Is there any way (connecting to a trusted node/etc) to create a relatively safe Tor proxy?

1. For example the HTTP proxy eats websocket connections, while the SOCKS proxy lets them through unmolested.

Tor isn't safe from man-in-the-middle attacks.

The unsafe component are the Tor exit nodes. These make the actual, unencrypted request and therefore can read and modify your traffic. Tor provides anonymity by not letting them know where the request came from, but the actual traffic between the exit node and the Internet is not different from normal traffic, as you can see in this picture (via):

Regarding the second question: Yes, it is technically possible to choose exit nodes. I haven't done this before, but you should be able to read up on this topic by yourself. This should allow you to (if possible) run your own exit node, or choose one that you trust.


How does FireEye HX work? Can someone please expand on how FireEye HX works, what does it do exactly? Here is the site info: https://www.fireeye.com/products/hx-endpoint-security-products.html, but it's written in such an empty language that should get a reward for saying something without saying anything.

Is it monitoring the incoming/outgoing connections? Is it looking for connection patterns?

Thanks

PS. There is no FireEye tag and I am not too sure what tags would be best for my post. I used threats & insider-threats for now.

Update: Found this thread: https://community.spiceworks.com/topic/444856-has-anyone-used-fireeye-malware-protection-system

its a security product that installs agents on endpoint to watch for any suspicious execution activity and alert you on it.

it can be used to push Indicators of compromise that are not covered yet by an anti-virus or an IPS.


(ctrl + alt + del) on Windows 8/8.1/10 After seeing this answer I wondered, how is this done in newer versions of windows, where [ctrl + alt + del] is no longer required for login?

Was this feature just removed, or is it somehow implemented differently (perhaps that any key is now a secure attention key)?

No, the SAK is still Ctrl+Alt+Del, and it never went anywhere. (It never was a technical requirement for logging in, merely a policy decision.)

On "consumer" versions of Windows, the SAK (Secure attention key) requirement was disabled for convenience, although can still be enabled via Group Policy, or even via control userpasswords2. Server editions still have it enabled.

The SAK still remains useful – when logged in, you can press it to get the "Windows Security" screen, change your password, or start Task Manager. So it can still be used to manually verify the login screen, even when Windows does not require it.

You cannot make every key be a SAK, because that would make it impossible for other programs to react to keypresses (which is the whole point of a SAK).


Routing traffic through compromised host I have a shell in a remote machine. I want to route my traffic in a dynamic way, so that can access say https://www.google.com via the IP address of the previously mentioned compromised machine.

I know you can route traffic to the internal network and access machines that otherwise have no connection to the outside. However, I want to know how one can use a compromised host as a proxy bounce of sorts.

Below is a rough sketch of how I want my traffic to go. ip* represents the visible public IP address.

Attacker machine[ip1] -> Victim machine[ip2] -> Outside network[ip2]

I suppose you are looking for something called "pivoting". At least if you want to utilize the compromized host to further look into the attached network. There are quite a lot of ways to do it. One of them would be metasploit for example and you can read about it here.

Other options include using SSH to forward your requests (see SSH-Portforwarding) but that only applies if SSH is present and only in a limited number of cases this is really useful. If you really do want to connect to a number of remote hosts through that machine I suggest either use metasploits routing or utilize a proxy server that you put on the server via your already existing shell.


ISO Standard Security Field What is the ISO standard that helps entities to implement security processes, concepts in the application security field ?

You are looking for the ISO/IEC 27034-1:2011. The target audience is:

The following audiences will benefit from ISO/IEC 27034 while carrying out their designated organizational roles:
a) managers;
b) provisioning and operation teams;
c) acquisition personnel;
d) suppliers; and
e) auditors

To understand what this norm is actually for, read the following quote:

The purpose of ISO/IEC 27034 is to assist organizations in integrating security seamlessly throughout the life cycle of their applications by:
a) providing concepts, principles, frameworks, components and processes;
b) providing process-oriented mechanisms for establishing security requirements, assessing security risks, assigning a Targeted Level of Trust and selecting corresponding security controls and verification measures;
c) providing guidelines for establishing acceptance criteria to organizations outsourcing the development or operation of applications, and for organizations purchasing from third-party applications;
d) providing process-oriented mechanisms for determining, generating and collecting the evidence needed to demonstrate that their applications can be used securely under a defined environment;
e) supporting the general concepts specified in ISO/IEC 27001 and assisting with the satisfactory implementation of information security based on a risk management approach; and
f) providing a framework that helps to implement the security controls specified in ISO/IEC 27002 and other standards.
ISO/IEC 27034:
a) applies to the underlying software of an application and to contributing factors that impact its security, such as data, technology, application development life cycle processes, supporting processes and actors; and
b) applies to all sizes and all types of organizations (e.g. commercial enterprises, government agencies, non-profit organizations) exposed to risks associated with applications.

But:

ISO/IEC 27034does not:
a) provide guidelines for physical and network security;
b) provide controls or measurements; or
c) provide secure coding specifications for any programming language.

All controls can be found in ISO/IEC 27002 and other standards. Read more towards that in ISO/IEC 27000 and 27001.
All quotes are taken from: ISO/IEC 27034-1:2011(en)
Information technology — Security techniques — Application security.


Information Security Risk Analytics The company where I work at is evaluating different risk analytics solutions to purchase, but one of the security guys introduced the idea to actually build our own internal platform/engine.

I have done lots of research to understand it better, but I am still confused. How would one go about developing its own platform that would receive data feeds, correlate/analyze and then produced actionable alerts/risk scores/reports? What I am really struggling with is how does it know if one risk is greater than the other?

Do you have to create your own algorithm? Is there a framework that organizations use to build it? Or does a database do the heavy lifting?

I am sorry for all the questions, it is just that I am with the compliance department and never had a chance to work with the risk analytics solutions.

Thank you so much!

You should look into different SIEM solutions (If the company has necessary budget to integrate SIEM Solutions) & then see what risks are worth solving & prioritizing. If not, more traditional practices which is:

To determine the attack surface
Then determine the threats which could be possible to the organization
And then having a penetration test, a vulnerability assessment
Hence, defining what are the potential risks & if these risks mean any threat to your specific organization.

I suggest you go through these frameworks which handles risks in-depth:

  but one of the security guys introduced the idea to actually build our own internal platform/engine.

This might be possible if your company has prioritized what risks are most grave for them. In generic terms, one could use NIST as well. That's just an example. If the company is more into Application Security, I would suggest WASC or OWASP.

For OWASP, a Risk Rating Methodology does specify what risks are grave in nature (generically) which means these threats were to be solved in priority.


How to rate a CVSS score for a vulnerability on an identity provider I'm having difficulty to rate a CVSS for an Identity Provider.
Imagine you have a vulnerability where you can bypass an authentication mechanism.

How would you rate :

Confidentiality (C)
Integrity (I)
Availability (A)

as you don't with which system it will be connected?

The scope is changing, but I can't just assume the worst scenario. It will just raise the score unnecessarily.

Edit: For adding clarity, let's says you can bypass easily the second factor, but you still need the login/password.

I would rate this :
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:N (I set C/I/A to None as this is the question here).

As you need to know the login/password for a user, I set Privileges Required (PR) to High, but this could also be Low as he's not admin of the IdP but only act as a standard user.

  Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.

I'm not a super expert on CVSS calculation, but I'll post an answer and see if I get corrections in comments.

I think you evaluate the impact on the affected component component itself, regardless of what else is connected to / relying on it (that's what the "Scope" CVSS metric is for).

From the CVSSv3.1 spec:

  2.3.Impact Metrics

  The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Let's take a look at the Impact Metric definitions according to the NVD CVSSv3 Calculator.

  Confidentiality Impact (C)

  This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

If this vulnerability allows you to gain unauthorized information from the identity provider component? Then this is certainly yes.

If not, then it really comes down to whether it's a "predictable reasonable final outcome" that Service Provider (SP) / Relying Party (RP) is going to have a confidentiality issue due to a failure of the IdP's authentication.

Kinda unclear to me also.

  Integrity Impact (I)

  This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

If this vulnerability lets you bypass the authentication mechanism, then information from the identity provider is no longer trustworthy. Almost certainly High (I:H).

  Availability Impact (A)

  This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the impacted component, this metric refers to the loss of availability of the impacted component itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of an impacted component.

Can this vulnerability be used to crash the identity provider, or otherwise cause it to be unavailable for legitimate users? Will it predictably cause availability issues in the SPs / RPs that rely on it?

In the end, I'm not sure that I have answered your question at all haha.


i have a school laptop can the school see my history if i use a vpn? i have a vpn, can the school still see what i search? and when in turn it on i can go on sites that been blocked. i haven tried inappropriate sites but game sites work and social media sites which the school also blocked.

The only thing that the VPN does is connect you to the school's network through the internet.  If there is software on the laptop that reports your searches, the network connection will not change that.  That software may not report until you connect via the VPN, but even if that's the case it will report when you connect to the school's network.

Without knowing what software is on the laptop and the parameters that are set for it, the question is difficult to answer.  So I'll make some assumptions.  Assuming that there is software on the laptop that monitors on and reports your search history at all times, then the answer is yes, the school will be able to find out what you search.  If there isn't some kind of monitoring software or the monitoring software is not set to monitor searches, then the answer is no, but not due to the presence of your VPN.

Generally assume that no reasonable expectation of privacy exists on a computer that you did not pay for.  In other words, if you don't own it, assume that the owner can and will see everything you do on it.


What can my university see if they have my MAC address? When I first got to my university I had to provide my MAC address to get access to the internet. What I want to know is what information can they get from having my MAC address linked to my name. I use Private Internet Access as my VPN and have Zenmate for Chrome. When I'm plugged in to their network can they see what I search just by my MAC address?

They're requesting your MAC address because they're using MAC filtering to control access to the WiFi network.   That does not in and of itself constitute the ability to see what you're doing when you're on the school's network, and certainly not when you're at home.

If this is the only requirement, and they are not also requiring you to install things (monitoring software, root certificates) then it gives them no ability at all to see what happens when you're at home, or on any network other than theirs, and even on their network, they will only have the ability to see unencrypted traffic.


What is the current state of author recognition software and what can be done about it? I'm curious what the current state of author recognition software is, i.e. software that detects the author of a certain anonymous text based on a certain pool of texts obtained from elsewhere. This could identify people in dangerous positions like critics of a government or whistle blowers even if they have been totally careful in terms of security otherwise.

I found this question but it is quite old now: https://softwareengineering.stackexchange.com/questions/203133/how-advanced-are-author-recognition-methods

Some articles (Software Helps Identify Anonymous Writers or Helps Them Stay That Way and The Analysis Software That Wrecked J.K. Rowling’s Anonymity) are also old but portray a more scary world than the stackexchange answer.

I imagine recent years with machine learning becoming far more popular and powerful have done a lot to make software like this much more reliable than back in 2013.

So how reliable is this nowadays and what would be appropriate measures to take against it?

So how reliable is this nowadays ...

Without looking at recent papers but just based on how machine learning works in general: there is no generic authorship detection method which fits all possible use cases. Instead what is possible depends a lot on the specific use case and on the available data.

If the use case is to determine the author from a group of 10 possible authors and you have sufficient training material the detection is to be expected very reliable. If you want to detect instead who of 100000 people was the author I expect it to be impossible even with sufficient training material. But you might at least be able to narrow down the field of potential suspects to a few 1000. Only, in many cases you will not have enough training material even for this.

On the other hand if the author has a very unique style of writing it makes it again easier to detect it. Or in other words: it is far easier to associate some good written essay with J.K.Rowling than the usual average quality essay with some specific 14 year old kid.

It also depends on the kinds of text: a book is different from an article in the newspaper is different from an email is different from a twitter message. Not only the length differ but also the amount of time which was used to improve and tailor the wording and style. It is probably easier to detect authorship of books than of emails since the authors unique style is more clearly reflected within the book.

I'm at least familiar with recent research where machine learning was used to determine if a specific email was authored by the claimed sender in order to detect sender spoofing or account takeover. In this case even with a large corpus of previous mails the false positive rate was very high.

  ... what would be appropriate measures to take against it?

Again this depends on the use case. But similar to transferring the style of images or of music or creating deepfakes it is possible to use style transfer with texts in order to hide the real author or even fake a specific author. And of course making only few data available for training helps a lot too.

Anyway, I think in most cases authorship attribution will not be done based on the writing style but on the contents of the text. Especially in case of government critics or whistleblowers these texts usually contain information only few know in this detail - because otherwise these texts would usually not be seen much as a problem. Thus the focus of investigation will be to find out who has this particular knowledge or had access to specific leaked information.


Where and How is data stored in a session? Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored?

If I store an object of a class, in wich way is it stored? Like $_SESSION['kart'] = new Kart(10). Could someone get the information stored in that class? How?

Could the legitimate owner of that session modify the value of the field "foo"?

And, could someone change the value of the field "foo" in an already created session of other user?

This depends on the webserver used. If we take PHP on Unix as an example it may store the session on the filesystem in the /tmp folder. It creates a file here with the name of the users session ID prefixed with sess_ (Example: /tmp/sess_9gk8f055hd61qll6a8pjpje2n2).The contents of the session can be optionally encrypted before being placed on the browser. For Apache sessions (not necessarily PHP) you may use the mod_session_crypto module (Read more here).

The owner of the session can not change the session variables as he feels like unless the application allows him to do it. The application logic has to provide means to change the session in order for the user to change the variables.

The session object is never transmitted to the client and only a reference to the session (e.g. PHPSESSID) is passed to the client. The session ID should have high entropy and minimum 16 bytes of length in order to be very hard to guess. See OWASP Top 10 - Broken authentication and session management for more information about that. Also see this OWASP Cheat sheet for specific information on how to secure sessions.

Attacks against session storage:

If there exists a flaw like for example LFI (Local File Inclusion) it may be possible for an attacker to read their own and other users session objects by including the file on the file system. For example if the following example worked I could possibly read my own session data:

http://<victim>/?page=../../../../../../../../tmp/sess_<my sessionid>


Development of ISO27001 ISMS before production I would like to ask if it is efficient and correct to design the ISO27001 ISMS for a company/organisation that is not yet in fully operational mode - e.g. their online architecture of their system is not finalised yet and undergoes several changes on a weekly basis.

I understand that as part of risk assessment a penetration testing exercise needs to be conducted and if the system is not final then there is no meaning doing a penetration testing exercise. However, you can implement other non-technical security controls.

Information security should be considered in every aspect of the organization's design, development, and implementation. If the organization isn't fully stood up, it's the perfect time to prime the pump and get security integrated from the ground up.

Bottom Line
This will help them make smart choices when it's still easy to make adjustments. It's much harder to retro-fit security.


Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret? I am a newbie in the security field, so sorry for the naive question.

In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret pretty easy?

As a prephase:

I am implementing initial security for my small casino, and consider using SSL channel for client - server interactions during the game. What stops me is that I am going to support game observers, who will only track the game state. So if observer becomes attacker, he will effectively know encrypted message, original message and encryption algorithm, effectively leaving nothing out of SSL security.

No, it is not true.

Being able to recover the key, while knowing the original message (the "plaintext") and the encrypted message (the "ciphertext") and the algorithm, is called a known plaintext attack. If the attacker not only knows the plaintext and the ciphertext, but actually gets to choose either, then this becomes a Chosen-Plaintext Attack or a Chosen-Ciphertext Attack. Good encryption algorithms are supposed to resist such things; meaning that if a known/chosen plaintext/ciphertext attack applies, even if it requires ludicrous amounts of known plaintext (e.g. some trillions of terabytes), then this counts as a "break" and the algorithm is said to be "weak" or "broken", at least in an academic way.

We have several encryption algorithms (e.g. the AES) for which no such attack is known, and that's not for lack of searching for such attacks. So these algorithms are deemed "secure".


How secure is the traffic with Sql Server Management Studio? I was just using Sql Server Management Studio on my WiFi, and I was actually wondering how secure the traffic/database communication is.  Is traffic from querying secure, or is it easily sniffed for passwords and sensitive data?

By default the database communications are unencrypted and vulnerable to sniffing.  To utilize encryption, you need to configure the SQL server with a certificate and then configure the client to take advantage of it.  There's a pretty simple walkthrough for the process here


Webmail host knows my password I forgot the password to a webmail account and they didn't have an automated password recovery process.  So I had to chat with their support and they asked a few verification questions then proceeded to tell me my password.

If they know my password doesn't this mean one of two things?

The passwords are stored in clear text and they can just look them up or
they have some kind of two-way hash and can decrypt the password.  How else could they have known what my password was?

This is a large national ISP and it makes me very uncomfortable knowing they can look up my password whenever they want.  Can someone confirm that this is a big security issue and they should not be doing this.

Thanks

CHANGE YOUR PASSWORD  it has been compromised.

Politely inform this service provider that this is a very serious vulnerability.  Passwords must be reset,  and must never be stored in a recoverable format.  Further more this is the type of vulnerability is inexcusable,  use another service ASAP.  Tell them that you are no longer using their service out of very serious security concerns.   If they made this mistake,  just think of the other festering security problems.


Store a text in encrypted form and use in powershell script without compromising it to other users? I want to encrypt a text which I want to use in different PowerShell script without compromising its security as other user will be using scripts that will contain that text. Basically I want to conceal that text from everybody and use it without any hassle to all PowerShell scripts that are using that particular text.

Please visit this link for more details as I asked this question to stackoverflow and they suggested me to ask here.

Original Question Please Open this for more info.

If you need access to the plain text, this is impossible.

The best you can do is to obfuscate the text, e.g. to make it harder for someone to get at it, but as stated in the original question, even if you encrypt the text, you'll need to store the decryption key somewhere, so this just adds one more complication to a determined attacker.

It will be the same with all other ideas you think up to protect the text - it can't be done, whether you use Powershell scripts or something else.


Weird attack making my server CPU super high I noticed that my server CPU is super high and the reason is grep "A" command

After a deep look, that what I've found in my active internet connections list (netstat -tupn)

   tcp        0      0 138.xxx.140.xxx:60752    198.1.158.134:80        ESTABLISHED 1583/grep "A"

I've killed the task by calling sudo kill -9 1583 then the same IP address made the following connection with a different command

tcp        0      0 138.xxx.140.xxx:32956    198.1.158.134:8000      ESTABLISHED 13139/id

by calling lsof I found the process name is bkhcdgfdv with these lines

bkhcdgfdv 14771 14825             root    5r      REG              253,1  4516064      57220 /usr/sbin/php-fpm7.1
bkhcdgfdv 14771 14826             root  cwd       DIR              253,1     4096          2 /
bkhcdgfdv 14771 14826             root  rtd       DIR              253,1     4096          2 /
bkhcdgfdv 14771 14826             root  txt       REG              253,1   625878       2100 /usr/bin/bkhcdgfdva
bkhcdgfdv 14771 14826             root    0u      CHR                1,3      0t0          6 /dev/null
bkhcdgfdv 14771 14826             root    1u      CHR                1,3      0t0          6 /dev/null
bkhcdgfdv 14771 14826             root    2u      CHR                1,3      0t0          6 /dev/null
bkhcdgfdv 14771 14826             root    3u     IPv4             309207      0t0        TCP MY_HOSTNAME:32982->198.1.158.134:8000 (ESTABLISHED)

Question: What kind of attack is this and how do I stop it?

Just based on the limited details This looks like it could've be a bitcoin miner disguised as the grep command. Deleting or killing it won't help because that is just the payload.

You need to look at your Apache access logs , ssh logs, etc and figure out how the attacker got onto your system (eg unpatched vulnerability? Default password ?) then close that gap. Also what backdoors or webshells or reverse shells has the attacker left behind already ? If you can't find them the attacker will likely just return and do it all over again.

Safest bet if you have poor logging or no clue how or when this happened is to rebuild the system and ensure everything is patched and all default password changed.


How secure is loging into internet banking via an https library? My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not.

I would like the server to log in and scrape using Beautifulsoup  and then logout automatically once a day.

If I store my username and password on the server and not in a file and only allow SSH login: would this be a secure enough way to go about this?

edit

let me clarify, i will store the username and password salted and hashed, but the decryption key i will store in the servers memcache  and no were on file, then i manually export this key to memory on each machine reboot. also login will only be via a key

Through your comment, you asked about the safety of storing and retrieving your credentials that way, but also if it is enough secure to use them after to log in automatically to your bank account.

For the first part, you need to assess yourself the security of your server first and since you want retrieve the credentials using SSH, may be you need to throw a glance on how to secure an SSH server from AskUbuntu website. But the idea of hashing and salting your password is an interesting thing you did, and there are so many questions about this subject on this website such as this one: Why are salted hashes more secure for password storage?

For using BeautifulSoup for automatic login, it is quite the same as when you use Mechanize, selenium or other similar libraries because all of them rely after all on using class httplib.HTTPSConnection and as you can read from that link:

  Note: HTTPS support is only available if the socket module was
  compiled with SSL support.

And I suppose you know how to use it in Python, for example:

>>> import httplib
>>> connectme = httplib.HTTPSConnection("mail.yahoo.com")
>>> connectme.request("GET", "/")
>>> response = connectme.getresponse()
>>> print response.status, response.reason
200 OK


Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at.

I have read multiple times that reverse proxying is recommended without much substantiation. Typically moreso with tomcat and apache.

I understand some of the advantages generally with reverse proxying; you are moving some of the request validation and filtering north of the application but I was wondering if there was a more in depth explanation to this, specific to Java?

I've googled this a bit and not come up with anything detailed or compelling.

I assume that tomcat receives the HTTP request rather than passing it direct to the application.

To clarify: Reading the answer below, Im not asking why proxies are commonly used or how to configure them but the security benefits they would provide when running on the same server as the application (excluding segmentation etc..).

Focusing solely on the (claimed) security benefits. There are multiple elements to this. I'll address each in turn.

Robustness against attacks that utilise malformed requests. The thinking here is that the reverse proxy does a better job of rejecting malformed requests and therefore does a better job of defending against attacks that depend on the server incorrectly handling the invalid request. In my opinion (as a Tomcat committer) I do not support this view in the case of Tomcat. Where it could apply is if you are using something (doesn't have to be Java based) that isn't intended to be internet facing to host your service. Then fronting with a reverse proxy makes sense.

Simpler TLS configuration. Certainly true historically when certificate authorities tended to provide certifications only in PEM form the conversion process to a Java KeyStore was not well documented. There have been improvements across the board on this. Certificate authorities are providing Java KeyStore specific instructions, Java itself is moving away from KeyStores to PKCS12 and Tomcat can use certificates in PEM format (the same format httpd uses). In my view this point doesn't carry much weight these days.

The reverse proxy offers more configuration options. This is generally true. If you need to block a header, integrate with an external authentication and authorisation system, modify a response then while you can do all of the above with Tomcat, you will need to write some code to do some of these things in Tomcat that you can do with configuration in the reverse proxy. How important this is to you will depend on what it is you are trying to achieve. One benefit I have seen is that when a new vulnerability emerges, you can often configure the reverse proxy to block the attack (e.g. with modrewrite) more easily than Tomcat.

The counter argument is that by adding a reverse proxy you are increasing the attack surface. Now you need to worry about vulnerabilities in the reverse proxy as well as your Java component.

You also need to ensure that the reverse proxy is configured correctly - especially if the reverse proxy is terminating https and then using http to the back-end. You need to be very careful to ensure that the back-end knows which requests were received (by the reverse proxy) over https and which over http otherwise you'll open yourself up to a bunch of potential vulnerabilities such as leaking secure session IDs over http.

Generally, it is probably more important to stick to what you know. If you are an experienced httpd administrator who is happy setting up httpd instances securely then you are more likely to end up with a secure configuration if you proxy through httpd rather than try and configure something you don't know. Likewise, an experienced Tomcat administrator is likely to end up with a better result with just Tomcat rather than adding an unfamiliar reverse proxy.

Overall, I suspect that the non-security arguments for using a reverse proxy (load-balancing, exposing multiple services through a single hostname) are likely to drive the decision whether or not to use one.