On File delete, using java File delete method what could be the security issue? In my case, the static code analysis tool shows the issue when it founds the code like this:

boolean status = file.delete();

It issues the security vulnerability saying the validation is required.

On further investigation, I found that Java's file manipulation methods on failure returns a value instead of throwing an exception.

Reference: FIO02-J. Detect and handle file-related errors. But no detailed explanation found considering security Could any one please explain what security risk is with the File delete method?

A failed deletion is a security risk only if all of the following hold:

the target file does exist;
that file contains sensitive data;
the deletion fails for "some reason";
in the assumed attack model, the attacker can at some point access the contents of the file that was deleted, but, for some reason, would not have been able to access these contents if the file was deleted.

(The fourth condition is about an often overlooked feature of file deletion: it does not really delete the data, it just marks the corresponding slots in the physical medium as free to reuse, but the data itself may still linger for unbounded amounts of time.)

Even when there is such a risk, then there is very little that you can do. The deletion failed, so chances are that it will keep on failing; throwing an exception would, at best, prevent the deletion failure from occurring silently. Note that throwing an exception or raising some sort of alert could also help attacks, depending on the context: leaking confidential data is a security issue; killing running applications is also a security issue (if it can be forced from the outside).

It would be wrong to flag any unchecked deletion as "a security issue". At best, it could be flagged as "a bug that might be a security issue (just like any other bug), depending on conditions".


BitFinex unauthorized login A few minutes ago i got an email from the real Bitfinex, saying that a unauthorized login attempt was approved by Bitfinix. Is this the work of a new breach? The IP is located somewhere in Japan.

That email seems legitimate.  You probably have cause for concern.

Contact their customer support as soon as possible.

However, do not click any links in that email. The email might be fake, and could be an attempt to get you to log into a fake version of their site so that they can steal your password.  The general rule is, unless you are expecting an email before you get it, verify that the email is legitimate before clicking on anything.

The next step to take is: change your password everywhere. If someone did log into your account, they probably got your username and password from a site with poor security.  Most people re-use their passwords, so malicious people will get these leaked passwords and try them out on other sites.

I strongly suggest starting to use a password manager to keep your passwords secure, and use random passwords that are different on every site.  If you can, set up 2-factor authentication on all sites, as well.  The time-based tokens (I.e., Google Authenticator) are great.  Better options are U2F devices, where you have to physically plug something into your computer's USB port or set up a Bluetooth connection.  Cell phone text message-based systems are better than nothing, but if someone is targeting you specifically, they can steal your phone number and it could be several hours before you learn that something is wrong.


Can I trust DNS servers? If I use my own VPN and use third party DNS - can I trust it?

For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have order and DNS-hosting have logs), and find out what sites I have visited? Because DNS requests are bypassing the VPN?

And if there is such a risk, how to solve this problem?
Should I use my own DNS server instead of third party for added security?

No, you can't.

It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN.

Second, VPN server knows (in some way) who you are, where are you from and where you want to go. It's the same risk that exit nodes of Tor Network pose.

Anyway, it depends of how paranoid you woke up today.


X509 "Serial Number of certificate" vs serial number attribute in Issuer and Subject? Is the serial number attribute of an X509 certificate Issuer or Subject, as defined in RFC5280, required to be the same as the Serial Number of the issuing or subject certificate? It seems quite potentially confusing to have it otherwise, but I can't find where the relevant specifications define this clearly.

In https://tools.ietf.org/html/rfc5280#section-4.1.2.2, we have

4.1.2.2.  Serial Number

The serial number MUST be a positive integer assigned by the CA to
each certificate.  It MUST be unique for each certificate issued by a
given CA (i.e., the issuer name and serial number identify a unique
certificate).

In https://tools.ietf.org/html/rfc5280#section-4.1.2.4, we have

4.1.2.4.  Issuer
    .
    .
    .
Standard sets of attributes have been defined in the X.500 series of
specifications [X.520].  Implementations of this specification MUST
be prepared to receive the following standard attribute types in
issuer and subject (Section 4.1.2.6) names:

  * country,
  * organization,
  * organizational unit,
  * distinguished name qualifier,
  * state or province name,
  * common name (e.g., "Susan Housley"), and
  * serial number.

In https://tools.ietf.org/html/rfc5280#section-4.1.2.6, we have

4.1.2.6.  Subject
    .
    .
    .
The subject field is defined as the X.501 type Name.  Implementation
requirements for this field are those defined for the issuer field
(Section 4.1.2.4).

In https://www.itu.int/rec/T-REC-X.520-201610-I/en, we have

6.2.9 Serial Number

The Serial Number attribute type specifies an identifier, the serial number of an object.
An attribute value for Serial Number is a printable string.

serialNumber ATTRIBUTE ::= {
    WITH SYNTAX PrintableString(SIZE (1..MAX))
    EQUALITY MATCHING RULE caseIgnoreMatch
    SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
    LDAP-SYNTAX printableString.&id
    LDAP-NAME {"serialNumber"}
    ID id-at-serialNumber }

The serial number of the certificate is not related to the serial numbers of the issuer or the subject - if these have serial numbers at all.


Exploit Stack Based buffer overflow (x64) while controlling rbx register I can control these registers:

(gdb) i r
rax            0x1  1
rbx            0x4141414141414141   4702111234474983745
rcx            0x7ffff760cf90   140737343704976
rdx            0x49526df7d355ee04   5283406224028986884
rsi            0x1  1
rdi            0x7fffffffce00   140737488342528
rbp            0x49526df7d355ee04   0x49526df7d355ee04
rsp            0x49526df7d355ee04   0x49526df7d355ee04
r8             0x49526df7d355ee04   5283406224028986884
r9             0x49526df7d355ee04   5283406224028986884
r10            0x8  8
r11            0x246    582
r12            0x4141414141414141   4702111234474983745
r13            0x4141414141414141   4702111234474983745
r14            0x4141414141414141   4702111234474983745
r15            0x4141414141414141   4702111234474983745
rip            0x7ffff760cbbe   0x7ffff760cbbe <__longjmp+78>
eflags         0x10202  [ IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0  0
es             0x0  0
fs             0x0  0

Can I somehow control rip thought these? Particularly when I control rbx?

All the examples I found were where rbp was controlled and how to do this is clear to me. Described for example here

Update 1:

Maybe that helps, I disassembled the function that is called after I modified the registers:

(gdb) disass png_error
Dump of assembler code for function png_error:
=> 0x00007ffff7bcf280 <+0>: push   %r12
   0x00007ffff7bcf282 <+2>: push   %rbp
   0x00007ffff7bcf283 <+3>: mov    %rsi,%rbp
   0x00007ffff7bcf286 <+6>: push   %rbx
   0x00007ffff7bcf287 <+7>: mov    %rdi,%rbx
   0x00007ffff7bcf28a <+10>:    sub    $0x30,%rsp
   0x00007ffff7bcf28e <+14>:    mov    %fs:0x28,%rax
   0x00007ffff7bcf297 <+23>:    mov    %rax,0x28(%rsp)
   0x00007ffff7bcf29c <+28>:    xor    %eax,%eax
   0x00007ffff7bcf29e <+30>:    test   %rdi,%rdi
   0x00007ffff7bcf2a1 <+33>:    je     0x7ffff7bcf2c6 <png_error+70>
   0x00007ffff7bcf2a3 <+35>:    mov    0x120(%rdi),%rcx
   0x00007ffff7bcf2aa <+42>:    test   $0xc0000,%ecx
   0x00007ffff7bcf2b0 <+48>:    jne    0x7ffff7bcf318 <png_error+152>
   0x00007ffff7bcf2b2 <+50>:    mov    0xc8(%rbx),%rax
   0x00007ffff7bcf2b9 <+57>:    test   %rax,%rax
   0x00007ffff7bcf2bc <+60>:    je     0x7ffff7bcf2c6 <png_error+70>
   0x00007ffff7bcf2be <+62>:    mov    %rbp,%rsi
   0x00007ffff7bcf2c1 <+65>:    mov    %rbx,%rdi
   0x00007ffff7bcf2c4 <+68>:    callq  *%rax

Any ideas how to control rip?

What you can do when you control a register depends on what the attacked code does with that register. So it is hard to make a generic answer.

In the x86-64 ABI, the %rbx register is one of the registers that the callee must preserve, so if a function uses %rbx, it must first save it, and restore it upon exiting. A consequence is that most functions will not use %rbx if they can avoid it. In the 32-bit ABI, the %ebx register is typically used to save the address of the GOT (the base table used to do dynamic linking) so modifying %ebx could possibly allow fiddling with subsequent function calls; but in the 64-bit ABI, PIC code typically uses RIP-relative addressing, which does not use %rbx.

To see what you can do with %rbx in a specific situation, you really have to disassemble the attacked code and see how it uses that register (or not) in the instructions after your alteration.


Is there anyway to prevent from being defeated by a SS7 attack in android? SS7 (Signalling System 7) is used by mobile operators to exchange information.

A flaw in SS7 allow hackers to access any calls and sms.

Is there any way to prevent from being a victim of SS7 from android?

The PSTN is based on trust. If a third-party sends a call to your mobile provider pretending to be another number they don't own, your mobile provider will still happily trust it and forward the call to your mobile as if the call was from the legitimate owner of that number - your mobile has no way to tell whether something fishy is going on, and the mobile provider doesn't necessarily care about that either, though if they wanted they could mitigate at least some issues (like enforcing a whitelist - if the number isn't known to belong to the originating provider, refuse the call).

The only real mitigation is to not trust the mobile network and only use IP-based solutions which employ encryption - if you want to place calls do it either via something like FaceTime, WhatsApp, Facebook, etc - so the mobile network even if compromised wouldn't see much besides encrypted packets. Of course, this breaks down when you actually need to reach the PSTN - you could use a SIP provider (so at least you're protected against your mobile provider being malicious) but this shifts the issue down to the SIP provider where it could just as well be deceived into accepting a call from an impostor.


Security concerns on API I just encountered API which I find pretty vulnerable. Could you clarify if my concerns are wrong?

1)For retrieving user data, API KEY, which is unique for every user i used. This api key is stored in rest url. For example, to request something, request is build /something?api_key=dsfdsf34r3wrwfdew3r3rfw3. Api key is constant for the lifetime of user. It can be retrieved after login. Is it safe to get user data using this key? It seems to me, that if I know some other person's api_key, I can get everything I want about him. And if I make an app, that works with this Api, I can just store these keys and use them anytime I want for whatever purpouses I want. Are these concerns legitimate? Are there other ways to exploit it?

2)Login is just plain text form with fields email and password. I loggined successfully using postman and simple form. Is this form of login is considered safe? How can it be improved?

It seems to me, that if I know some other person's api_key, I can get
  everything I want about him.

The same if you have this person's password. Am I wrong?

  And if I make an app, that works with this Api, I can just store these
  keys and use them anytime I want for whatever purpouses I want.

Yes, you can use the token to do anything that the user have granted to you.
For this reason, do not grant permissions to any app on the internet, like you do not give your password to untrusted people.

  Are there other ways to exploit it?

Depends on a lot of factors. Using open redirectors to steal victim's token, brute forcing the API tokens (a decent API would not permit brute force), etc.

  Is this form of login is considered safe?

If the page is loaded over HTTPS, the form posts the login and password data to another HTTPS page, and the page does not have any XSS or mixed content issues, so is secure "enough".


how to protect from LM hash cracking I have read that modifying the NoLMHash value in the registry can prevent LM hashing, but I still can dump the hash after doing this.

What does this key do? How can I prevent LM password hash dumping in Windows 8 and 7?

The following is purely from memory and I have not checked to be able to provide a reference, but I seem to recall that the NoLMHash registry key prevents generation of LMhashes does not remove them.

The implication being NoLMHash is only 'effective' in a practical sense after an account password change, until then both hash types will persist.


Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request? The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host:

http://r9---sn-4g57kner.gvt1.com

Chrome is not installed on that PC. Neither is there any suspicious process, service or task launched. I checked scheduled tasks, the registry (Run, RunOnce etc.), msconfig and boot-scripts: nothing suspicious. With Microsoft Message Analyzer I figured out the PID and processname, which are the same. The PID leads to svchost.exe (netsvcs). So my question is, how to go on behind svchost or how can I find the origin of that request? (If that is possible). I use Windows 7.

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited for the request, as it was sent, the TCP/IP tab from ProcessExplorer showed me the service wich was trying to establish a connection:
BITS Service (Background Intelligent Transfer Service). I opened cmd and with

BITSAdmin /List [/allusers] [/verbose]

i listed all jobs. And there we have the crux of the matter. All full with jobs from google-update. The files listed for each job pointed to a non-existing google-update.exe. So i think the first answers might is right, that this is not a virus. I don't know why there were 9 google-update jobs and nothing else. I deleted all. Since then the requests are gone.


How to encode a username in PKIX certificate? I was reading through RFC 5280, PKIX Certificate and CRL Profile, Section 4.2.1.6, Subject Alternative Name:

  The subject alternative name extension allows identities to be bound
    to the subject of the certificate.  These identities may be included
    in addition to or in place of the identity in the subject field of
    the certificate.  Defined options include an Internet electronic mail
    address, a DNS name, an IP address, and a Uniform Resource Identifier
    (URI).  Other options exist, including completely local definitions.

Question: how does one encode a username like "john" or "jdoe"? Here are the choices:

 GeneralName ::= CHOICE {
    otherName                       [0]     OtherName,
    rfc822Name                      [1]     IA5String,
    dNSName                         [2]     IA5String,
    x400Address                     [3]     ORAddress,
    directoryName                   [4]     Name,
    ediPartyName                    [5]     EDIPartyName,
    uniformResourceIdentifier       [6]     IA5String,
    iPAddress                       [7]     OCTET STRING,
    registeredID                    [8]     OBJECT IDENTIFIER }

And I'm making a distinction between a PKCS #9 emailAddress ("jdoe@example.com") and a username ("jdoe").

Faced with this question, Microsoft answered the way they are accustomed to: with a Microsoft-specific extension. They defined the User Principal Name, which is actually an OtherName element, the UPN being identified by a Microsoft OID (1.3.6.1.4.1.311.20.2.3) and encoded as an UTF8String (as succinctly specified there). The format of the string mimics that of an email address, in that it consists in an account name and a domain name, joined together with an '@' character.

It is noteworthy that though the UPN looks like an email address, it is not meant to be used for sending emails; and, correspondingly, Microsoft did not use a rfc822name element, because such a name conveys email-based semantics (in particular when the certificate is used with S/MIME) that UPN are not supposed to embody.

The "X.509 way" to encode a name in a certificate, whose format does not match the predefined categories, is to do it along the same lines Microsoft did: use otherName, with an OID of your own, and define your own syntax. Of course, such a name will be usable only by your own software... Although you may decide to reuse the Microsoft UPN format, and thus (possibly) gain some compatibility with Microsoft software (the UPN's goal is to map a certificate onto an Active Directory account).

The really important thing is to determine which software systems will have to deal with your "username". It is useless to encode a username in a certificate if the systems which must decode that username don't know how to do it. For instance, suppose that the username must be used by an Apache-powered Web site, the client certificate being presented at the SSL level. The documentation, in particular the SSLUserName configuration directive, shows us that Apache may be set to use some specific certificate fields as "username", among the exhaustive list of environment variables maintained by the SSL module. If you are in that situation, then you will have to put your "username" in one of these fields, not in some otherName with a syntax of your own.

From looking at these fields, I'd say that your best bet would be "UID". That's one of the components of a Distinguished Name, specified in RFC 4519 under OID 0.9.2342.19200300.100.1.1. It is basically a free-form string, and Apache's mod_ssl knows how to extract it and turn it into a username with:

SSLUserName SSL_CLIENT_S_DN_UID

As a part of a DN, this would go in the subjectDN field directly, not into a Subject Alt Name extension. (This raises the question of why Microsoft did not use that "UID" field for their UPN; my guess is that they wanted at some point to use the complete subjectDN as a path in some LDAP directory, and thus could not add extra fields at will in the DN.)


is there any need to encrypt sensitive images in a database? I have a project that requires users to submit a photo of a driver's license as proof of identity. This image just needs to be seen once by an administrator, and has no use after their id is verified.

This project uses AWS to store data. Data sent to AWS can be encrypted at their level, but I feel like application level encryption could still be useful as well.

But then....if I have my secret key stored in the app as an ENV variable, it's kinda self defeating, isn't it? Is there a better way of doing this? Considering the fact that an admin needs to verify the id, is encryption needed?

In general make two or more encryption operations on the same item(encrypt the same file two times) is a bad idea and is not necessary (check https://crypto.stackexchange.com/), but encrypt confidential information such the images you mention is for example mandatory in Europe due to the GDPR.
If the storage of AWS(or other vendor) offers the service of encryption then is enough on a first stage, however, depending on your application may be a good idea to encrypt on the source but this depends on how is your application build. Just keep in mind that any information that can identify a user or the information is critical needs to be encrypted in some way.


Is it important that every TLS1.2 encrypted message have padding? what if data we are sending is such that
size(data) + size(mac)  =multiple of block size
If this case if possible how the receiver will determine that no padding is present
???

When the size of the data and mac is equal to a multiple of the block size, a complete block of padding is added. So in effect, there no TLS message that is not padded.


Is encrypted data a good random source? Given that someone needs my encryption key to predict the output, can I encrypt arbitrary data (zeroes, system logs, personal photos) with AES and a secure passphrase, and use the result as a RSA/SSH/whatever key as if it was the output of a secure random number generator ?

Secure random data should not be predictable. Since encrypted data can be predicted from input text and encryption key they can never be a secure random source.

Apart from that the whole purpose of encryption is to hide the original content. The primary purpose is not to look like random data. This means you can not use the output from some arbitrary encryption and treat it as pseudorandom data. To do this you would need  algorithms which are specifically designed to produce output which looks statistically random.


Remotely find out what access points a wireless device is searching for When you're connected to a wireless access point (AP) , you usually save the password and enable auto connection when the AP is in range.
When your Wi-Fi is on,  it constantly searches for the saved AP's.  This means that it emits some kind of beam and waits for a response.
So,  how can we remotely know what AP's a random Wi-Fi device is searching for?
I'm a penetester and I recently started a course on wireless devices.
There's a section called evil twin AP that teaches you how to  clone an AP,  disconnect users from the original AP and direct them to your own for mitm.
But with this,  the users device has to be connected to an AP before you can do this.
I want to be able to do it to a random device that is not connected to an AP but has the Wi-Fi on.
The only problem is how to discover the exact AP's (ssid and mac address) that are configured for auto connection.

There's a list of preferred networks (You can add networks manually o save them when you check the "Connect automatically" checkbox).

When a STA (Station/device/laptop/Smartphone) isn't connected to any AP it sends probe requests, looking for AP listed on it's PNL (Preferred network List) if any AP matches with what's on that probe request, it will replay with a probe response and the connection will start.

So, the idea on an evil twin, is to listen to this probe request (This only contain the SSID, not the encryption used) with an antennae on monitor mode, copy the SSID, start virtual access points (Obviously with the SSID you just got) with each authentication (Open, WEP, WPA and WPA2), and see on which it tries to connect. You don't need the MAC address, there's a feature on WiFi called Roaming which lets you connect to different AP (same netwok/SSID), so it's the normal scenario when there are multiple AP with different MAC address.


Q: Need help understanding hacked site that only impacts AT&T LTE users I'm almost certain my (new) client's wordpress site is hacked. The home page is fine, but every subdirectory on the page loads with very sketchy content seemingly injected into the page. But here's the kicker - it ONLY happens for users on AT&T LTE networks. All other network connections are completely unaffected and receive a completely non-hacked site. I have triple checked this. Even Sucuri is seemingly fooled by this (returning completely clean).

Some Details

It happens on every known device, Android, iPhone, iPad, even laptops, so long as they are tethered to an AT&T LTE connection.
If I take the SAME device and connect to WiFi and reload the hacked page, the original, non-hacked content returns.
If I then get off Wifi (and onto AT&T LTE) and reload, and the entire page changes and I receive the hacked page again. All the while the URL stays the same. Verizon is unaffected.

I have access to the site registrar and host and everything seems a-ok in both places. DNS hasn't been changed. Additionally, the index page is fine, so I don't think it's a DNS issue. As I said, I've run sucuri checks (completely clean).

It's hard for me to understand what motivation a hacker would have to only target users on AT&T LTE, let alone how that would be pulled off. I realize that's broad and out of scope, but hopefully this question isn't: Assuming anything is possible, is this a probable hack? How can I determine if this is actually a hack, or something like a sneaky DNS Hijacking or caching issue? If it is hacked, what steps can I take to sniff this out and clean it up?

I'm happy to send the URL to anyone if you want to see for yourself, but not posting here for obvious reasons. I appreciate your help!

UPDATE: I marked an answer below since the answer covered both possibilities well, but for those wondering, this WAS a hack. I cleaned up the entire site systematically (everything but the DB) and the problem went away. Very interesting that the hack fooled Sucuri and all other scanners and only targeted AT&T mobile users.

Is the page server over https? If not it could be AT&T intercepting and injecting ads. See https://www.pcworld.com/article/2976298/websites/att-wi-fi-hotspot-caught-injecting-ads-into-web-pages.html where they are doing it on WiFi hotspots for http and https

As for the scenario were a hacker did this, a number of hackers try and restrict the set of people who see the malicious content to extend the time they are un-detected for. Targeting specific mobile carriers seems like it would not be worth the effort unless the attacker has a grudge against AT&T.


Could see image of previous session after restarting and switching OS (I have GNU/Linux and Microsoft Windows installed.) I played a game on Microsoft Windows, quit the game, restarted the PC, and selected GNU/Linux.

On the login screen, the background image was different, contorted, glitchy (similar to this image, but not as bad). On a closer look, it showed parts of the game I played … on the other OS, before the restart!
I could even "decrypt" some sentences, and various images were clearly recognizable (it might have been a sprite sheet, so technically only one image).

I guess this can be a privacy issue, especially because you’d typically expect that restarting and switching OS should "clear" traces like that (i.e., displayed content).

Is there someone at fault (software/OS or hardware)? Can you prevent this from happening somehow?

EDIT: It happened again (with a different game), and this time I made a photo:

This is almost certainly a hardware fault in the video card; it's possible (but unlikely) that it's a bug in the video driver instead.  The scrambled image you're seeing is leftover data from the game, stored in the video card's memory.  Since you rebooted rather than doing a cold shutdown, the data wasn't lost due to lack of power.  On starting up, Linux asked the video card to use a certain part of its memory to display the screen and provided an image to display, but due to the aforementioned fault, the part of memory displayed was not the part the image was sent to; rather, old data from your game was displayed instead.

Yes, this is theoretically a security issue.  In practice, it's rare enough that an attacker will use something more reliable instead, such as a cold boot attack.


How do routers generally accept AES keys? I'm trying to understand how routers that offer AES encryption manage their symmetric keys.  I thought I'd be able to find some information in the NIAP security targets, but I can't figure it out.  Are these keys self-generated and last for the life of the device?  Are they generated via passphrase?  Some other way?

Long story short, it looks like the document you linked to is referring to the NSA Suite B cryptography standard, RFC 6379.
It links to these two documents, which are monsters. Checking out IPsec, IKE and ISAKMP would be more useful I think, but, if you're looking for the dirty details:

NIST Special Publication 800-56A : https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar2.pdf

NIST Special Publication 800-56B : https://csrc.nist.gov/publications/detail/sp/800-56b/archive/2009-08-28

Briefly, generation of AES keys depends on what AES is being used for. A good example, in the IPsec framework for VPNs, a router uses IKE (Internet Key Exchange) to create an ISAKMP security association (Internet Security Association and Key Management Protocol). IKE negotiates the hash, authentication, diffie-helmen group, lifetime of security of association and, what you're looking for: the encryption. (A nice mnemonic is HAGLE)

(from Cisco)

  security association - Instance of security policy and keying material
  applied to a data flow.

Diffie-helman in IKEv1 or IKEv2 generate the asymmetric keys that protect the negotiation of the symmetric keys that are used for encryption, such as AES, DES(deprecated), or 3DES(legacy), some other symmetric key. IKEv2 can be found in RFC 4306. AES symmmetric keys are used rather than the DH asymmetric keys because symmetric encryption is far more efficient.

(from Cisco)

  Internet Security Association and Key Management Protocol : Internet
  IPsec protocol that negotiates, establishes, modifies, and deletes
  security associations. It also exchanges key generation and
  authentication data (independent of the details of any specific key
  generation technique), key establishment protocol, encryption
  algorithm, or authentication mechanism. Defined in RFC 2408.

It looks like the document you linked to is referring to the same/similar process on page 23 section 5.2.2. NIST Special Publication 80056A. The DH algorithm uses Discrete Logarithm Cryptography. Sounds Suite B to me: RFC 6379.

  “Recommendation for PairWise Key Establishment Schemes Using Discrete Logarithm Cryptography” for elliptic curve based key establishment
  schemes and implementing “NIST curves” P256, P384 and [P521] (as
  defined in FIPS PUB 186 3, “Digital Signature Standard”)

  NIST Special Publication 80056B, 'Recommendation for PairWise Key
  Establishment Schemes Using Integer Factorization Cryptography'for RSA
  based  key establishment schemes]

Where elliptic curve-based key establishment could refer to Diffie-helmen ellipic curve (DHEL), it's groups 19,20 and 24 use elliptic curve.


Why do sites implement locking after three failed password attempts? I know the reasoning behind not letting infinite password attempts - brute force attempts is not a meatspace weakness, but a problem with computer security - but where did they get the number three from?

Isn't denial of service a concern when implementing a lockout policy that is easily activated?

Is there any hard research showing an optimal number or range to choose before locking out an account that balances actual security threat with usability?

Thinking it through, I don't see any measurable security difference between three attempts and 20 attempts with the password complexity generally in use today.

(I know this skirts subjectivity, but I'm looking for measurement based opinions)

Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue.

In brief, there's insufficient research.

In long, here are some of his ideas for less painful account locking:

Don't count duplicate password attempts (they probably thought they mistyped it)
Make the password hint about the primary password, and don't have a (weak) secondary
Allow a trusted party to vouch for the user, so he can change his password.
Lock the account in increasing time increments
Remind the user of password rules.


Is there a spam storm? I realize this is a bit off-topic, but don't know where else to go to ask...

I've gotten an enormous amount of spam in the past 24 hours (hundreds), even after some relatively good spam filters.  Virtually all of this stuff is hokey weight loss schemes, claimed to be forwarded from Beyonce, Pamela Anderson, et al.  The email texts are quite varied, and the included links are to a number of different locations.

Is this something unique to my email address, or is there a general spam "storm" in the works?  (Seems a little like the sort of childish stuff that spammers might do to "get even" for some of the recent policing actions.)

I don't pretend to understand this stuff, but here is some of the header info from a typical spam from today's flood:

Received: from adminteam ([203.123.157.82]) by na3sys009amx187.postini.com ([74.125.148.10]) with SMTP;
    Mon, 01 Apr 2013 10:47:16 CDT
Received: (qmail 3351 by uid 143); Mon, 1 Apr 2013 15:48:00 -0530
From: "No risk Katy Perry Free trials" <penelopetheir@cafb29b24.org>
To: <xxxxxxx@ieee.org>
Subject: Fwd: ..
Date: Mon, 1 Apr 2013 15:19:48 -0530
Message-ID: <005301ce2f1e$7ff59b90$7fe0d2b0$@com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0052_01CE2F1E.7FF59B90"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acjhs69UR3NtbvBhPNkurEv2AtSBlw==
Content-Language: en-us
X-pstn-levels:     (S: 0.00000/66.47495 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-Bayes-Prob: 0.0001 (Score 0, tokens from: @@RPTN)
X-Spam-Score: 2.00 (**) [Tag at 3.80] HK_NAME_FREE,HTML_MESSAGE,SPF(none:0),RBL(rp-grey:1.0)
X-CanIt-Geo: ip=203.123.157.82; country=IN; region=25; city=Chennai; latitude=13.0833; longitude=80.2833; http://maps.google.com/maps?q=13.0833,80.2833&z=6
X-CanItPRO-Stream: 06202139 (inherits from 32_HI_TAG-LO_BLOCK,default)
X-Canit-Stats-ID: Bayes signature not available
X-Scanned-By: IEEE Spam Scanner (https://uce.ieee.org/) on 140.98.193.228

While here is some typical "legitimate" spam (that gets flagged by my mail forwarder):

From: "The New Yorker" <mailer@mail.realviewtechnologies.com>
To: <xxxxxxx@ieee.org>
Subject: ***[Possible UCE]*** =?utf-8?B?QXByaWwgOCwgMjAxMzogSGVucnkgQmxvZGdldDsgdGhlIHJpc2Ugb2YgVmljZSBNZWRpYTsgY29va2luZyBzaG93czsgYW5kIG1vcmUu?=
Date: Mon, 01 Apr 2013 22:31:44 +1000
MIME-Version: 1.0
X-Mailer: MailEnable
X-Priority: 3
Message-ID: <40efcf1c-741e-4e4e-b0ce-90fd5b422bc3.MAI@mail.realviewtechnologies.com>
Content-Type: multipart/alternative;
           boundary="--=_NextPart_01042013103144_006229358"
X-RVID: 101536031
X-pstn-neptune: 28/1/0.04/98
X-pstn-levels:     (S:30.17530/99.90000 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-Bayes-Prob: 0.9919 (Score 2.5, tokens from: @@RPTN)
X-Spam-Flag: YES
X-Spam-Score: 4.00 (****) [Tag at 3.80] HTML_MESSAGE,SPF(softfail:0),RBL(rp-mixed:1.5),Bayes(0.9919:2.5)
X-CanIt-Geo: ip=210.87.32.100; country=AU; region=07; city=Melbourne; latitude=-37.8139; longitude=144.9634; http://maps.google.com/maps?q=-37.8139,144.9634&z=6
X-CanItPRO-Stream: 06202139 (inherits from 32_HI_TAG-LO_BLOCK,default)
X-Canit-Stats-ID: Bayes signature not available
X-Scanned-By: IEEE Spam Scanner (https://uce.ieee.org/) on 140.98.193.228

It's curious that the spam score of this second is twice that of the first, and the Bayes probability (whatever that is) is near certainty, while for the first case it's essentially nil.  Seems like somehow the first case was successfully eluding the spam filter.

(For what it's worth, the flood seems to have stopped.)

Every single day is a spam storm day.

To give you an idea, take a look at these statistics (on 04/02/2013) from Project Honey Pot, which is just one out of many such networks for identifying spammers and spambots:

Or check live statistics for past 10 minutes from UCEPROTECT network. These are some scary statistics, and it does not matter what day of the year you'll be checking them, they will never fall to impress. That said, if it's still not clear by now - this is the onslaught that your spam filters (or anti-spam networks, if you're using any to do the filtering for you) have to deal with on a daily basis.

To answer your question directly:

No, today is not a special or a particularly remarkable day in terms of the number of spam messages or spamming hosts trapped. I've also checked the log files on my own email server, and a few other providers I have access to just to be sure, and I didn't notice any unusual patterns. Results? A few hundred new email harvesters (robotic webpage crawlers trying to collect email addresses), another few hundred spam emails trapped per each user, a few new scam schemes promising millions for a small funds transfer fee (or similar yada yada), dozens of new stealth bots (crawlers that don't identify themselves and disrespect robots.txt configurations) per website I manage trapped, a few new network neighborhoods marked as untrusted for hosting or relaying a lot of unsolicited traffic, and so on, and so on. Nothing unusual really, when compared to any other day of the year.

So why are you receiving more spam than usual?

This part of your question is not so easy to answer as you're not providing enough information. But even if you did, we would probably have to resort to educated guessing at best. Have you published your email address on some publicly available webpage that was picked up by a random email harvester working hard for some spam network? Did any of the recipients of your previous messages get a virus on their computers and was your address collected from their mailing lists? Did you anger a script kiddie that submitted your email address to various spamming hosts? Are you using a generic email address composed of common names and is hosted by a busy provider, some spam bot got lucky, and you later enabled image display in received spam messages which confirmed to that bot that your email address exists and is not filtering its messages as spam? All this and a lot more reasons are all quite possible and also happen each and every day. Again, nothing unusual.

Chances are, you're not even receiving any greater number of unsolicited emails, but have noticed them now more as they found their way into your inbox due to your spam filters not being properly configured, one of your anti-spam networks that your filters depend on being temporarily down or inaccessible, or even your email server being infected with malware that opened it up to this kind of abuse.

EDIT: The headers you're including support one of my speculations that your spam filters might not be properly configured for your specific needs (looks like default settings to me, but is hard to judge by these headers alone). Your mailing system is depending on Google's Postini services to filter unsolicited emails out, which failed to mark Bayesian poisoning type messages out with other filtering methods. In short, messages were written in such a way to avoid detection by spam filter depending on Bayesian probability and other detection methods' sensitivity is set too low. See this answer to one of your previous questions on how Bayesian poisoning works.

Bayesian probability score isn't the only way such messages are filtered out, which is clearly indicated by X-Spam-Score: 2.00 header field value of your first example (a spam message that was not filtered out). To demonstrate this, let's analyze the other values in this message header:

HK_NAME_FREE: Does the sender's name mention free stuff
HTML_MESSAGE: Is message in a HTML format
SPF: Sender Policy Framework
RBL: Real-time Blackhole List

The results of all these methods in your case resulted in a spam score of 2 for the first message, and 4 for the second one. This is significant as it is the value that your system administrator can use to setup Postini services to mark messages as spam earlier than at detected score of 3.8 ([Tag at 3.80] indicates current value) by adjusting sensitivity levels of various spam detection methods. Your anti-spam filtering is also done by using two additional services, one by IEEE UCE/Spam Filtering Service, and the other by CanIt-PRO AntiSpam Software, probably residing on your organisation's mail server and setup by your system administrator. All of these have separate settings and might require a lot of work to set them up to suit your needs better. Consultation with your systems administrator is probably the most proper way forward.

Best of luck ;)


Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States) My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number to the factory. The factory then provides that information to a freight company who will then provides it to a final-mile delivery company.

The final-mile delivery company wants us to provide the customer's email address so they can improve the delivery time frame. Customers are significantly more likely to respond to an email than they are to a phone call. Text messaging isn't, apparently, effective enough either, because there are still land lines in play.

We ship only to the continental United States, so we don't fall immediately under the GDPR umbrella, but my concern is that providing this email address to other businesses in our manufacturing and delivery pipeline will have PCI compliance consequences.

It would be simple if I could just add a disclaimer into our Terms and Conditions that explains that we will give the customer's email address to other entities for the purposes of shipping and delivery, but that information won't be used for marketing purposes, but I'm afraid that there are implications I'm not considering.

Can anyone provide any insights about how I should approach this problem?

my concern is that providing this email address to other businesses in
  our manufacturing and delivery pipeline will have PCI compliance
  consequences.

No, PCI does not care about email address at all.  The only time it's mentioned in the DSS is to state you can't send unencrypted PAN via email.

  Can anyone provide any insights about how I should approach this problem?

If the company has a legitimate business need - if phone-related delays are credible - and your contract with them states they'll only use email for shipping purposes, then it's a reasonable thing to do.  If you don't trust them on either of those points, then you have a problematic relationship with your business partner.

You may also want to get an expert opinion (read: lawyer) about PII laws and what impact they have on the information sharing.  That will probably boil down to making sure the limited use of the PII is contractually stated, but YLMMV (Your Lawyer's Mileage May Vary).


Are there Linux rootkits circulating that directly modify the kernel (without modules)? It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could directly modify memory if the module interface were unavailable. (After all, the loadable module interface is for the good guys.)

So my question is this: is anyone aware of any circulating root kits that directly modify kernel memory, rather than using the module interface?

Yes there is, the suckit rootkit as featured in Phrack is one such example, which modifies the linux kernel via /dev/kmem. Essentially, the goals remain the same - replace entries in the system call table to do what we want them to do. The difference here being that the modification is done via /dev/kmem.

The grsecurity/PaX patches for the kernel include support/configuration for disabling access to /dev/kmem, /dev/mem and /dev/port - see the entry here.

The difference between /dev/mem and /dev/kmem is explained here.

The notable difference between modifying memory this way and loading in a kernel module is the exposure of symbols. Most kernel module rootkits are compiled with static functions so these functions are not exported from the code; however, there are other techniques that might betray the existence of a kernel module (the init function would need to be exportable, for example). A rootkit modifying kernel memory directly would not be visible in a scan of the kernel address space except in what it had changed (i.e. if you know where the syscall table should point to and what it is pointing at, you might detect it, unless the author is sufficiently clever to ensure further reads of /dev/kmem give out the correct addresses).

As to whether a bad guy can directly modify memory - a root process is technically still in userspace; that is to say it is still a part of ring 3 and does not have the ability to escape its virtual memory sandbox. The only memory any ring 3 process can modify is its own virtual address space, which as far as it is concerned is what memory looks like. A ring 3 process must abide by all the rules of marked memory; for example, if a page is marked read only it cannot be modified by a process (the CPU refuses and tells the OS). However, a ring 0 process (cpu supervisor mode) can modify any memory it likes and can go so far as to ask the CPU to ignore the status of memory pages (i.e. you can ignore the fact pages are read only).

So what I'm trying to get at is that a root process does not have implicit access to memory by way of being a root process - it must still ask and gain such access via the kernel. It's just that the kernel will obey blindly. So one solution is to use the PaX patches, making the kernel refuse such requests.


Can Hydra and Crunch be used in combination for HTTP-get-form? I'm trying to recover my router username and password without resetting the router for educational purposes.   I read that Hydra can be used for "brute-forcing" http-get-form authentication that most routers use. They classify bruteforcing as a dictionary/wordlist attack. Bruteforcing is generating every possible combination possible in order to guess the correct password/username. Yes, it can be time consuming and tedious. But given enough time they're always successful.  I know that my password and username aren't all that complex as I don't see much of a reason to make it complex because with all the security measures I put up, no body will bother with my internet. I was reading a thread on Kali and someone asked if Hydra could legitimately "bruteforce" and I'm not sure honestly, but someone suggested using Crunch to feed words (combinations) to Hydra (not creating a massive 500 tb file full of words) and delete the ones not used (or successful). The OP of that thread was unsuccessful and so were many others who attempted to use this method. I know virtually nothing about Hydra. I probably left the password to my router as admin or something similar and the username something like mtndew. Is it possible to combine the two to create a bruteforcing tool for a router user/pass?

Short answer to your question is yes, Hydra and Crunch can be used in combination.

Your statement that "bruteforcing is generating every possible combination in order to guess..." is correct but the term "bruteforcing" is often used in relation to guessing based on a wordlist, so we just have to deal with the impercise term.

On to your goal of recovering your router username and password:

Try several different approaches, one being what you suggest, especially since you think you used a very easy to guess password:  Run Hydra against the http form with a short list of simple passwords, then a longer one, then employ Crunch.  The reason I suggest it is because you are likely to hit your password with one of the wordlists already supplied in Kali.

The other approach is attacking the router by other means besides Hydra as password guessing through a http form is very slow. It will be much faster if you can extract the hash of your password that is stored somewhere in your router and then run a hash cracker against it.  Since you don't have your password, I assume you can't just ssh into your router and look at the passwd file.  So, you will have to resort to researching router vulnerabilities and hoping that a vulnerability has been reported for your brand and version.  I would say that it is worth doing this while Hydra is doing its work.  Wifi Routers are famous for having unpatched vulnerabilities.

For example, read this:
 http://sijmen.ruwhof.net/weblog/268-password-hash-disclosure-in-linksys-smart-wifi-routers

What brand of router are you attacking? Does it have the OEM firmware installed?


When can you not use strcmp? I've read that one shouldn't use strncmp(userSuppliedPassword,origPassword,sizeOfArray) (or String.equals in Java) since one can use a timing attack to guess the password. Rather, one should use a secure string comparison function which will take the same amount of time whether the comparison fails or succeeds.

But as the userSuppliedPassword and origPassword should be hashed (and salted), unless one is already doing something stupid, there seems no way to exploit this attack.

So when is this recommendation true?

As you said, when you use a string comparison function which hasn't been design to resist to timing attacks, then it could be exploited to guess the string with which you compare.

Comparing unencrypted and unhashed strings will indeed leak the original string, be it a password (either stored in a database or hard-coded), a session ID, an email address or a multi-factor authentication token - meaning this attack is not limited to the common sense of "passwords".

If the strings are encrypted and the encryption function is known to the attacker (with the associated keys), then he could guess the encrypted string, then decrypt it to get the original string.

If the strings are hashed and the hash function is known to the attacker (and the associated salt, if there's any), then guessing the hash will be harder and harder each byte (due to the avalanche effect), making it very hard to guess more than the first bytes of the hash, but that may be enough to bruteforce if your original string has not enough entropy.

This recommendation is true when you're comparing any user-supplied string (either you hash it or not) with any type of sensitive data (see above, I personally consider that any information related to one user is sensitive).


What are the requirements for private keys in Diffie-Hellman key exchange algorithm Basically question is:
    If we have pof size 2048 what sizes for private exponents should Alice and Bob choose and why?

IF (that's a big "if") the generator g and the public element from the peer can be assumed to be part of a subgroup of prime order, THEN it suffices for exponents to have size 2t bits, for a "security level" of t bits. In other words, 256 bits are fine.

Now if p is a so-called "strong prime" (i.e. p is prime and (p-1)/2 is also prime), then any integer modulo p (except 0, 1 and p-1) necessarily has order (p-1)/2 or p-1, and a 257-bit exponent is sufficient. In fact, it is overkill because solving discrete logarithm modulo p will be easier than that, academically speaking (but this is all far in the "technologically infeasible" realm anyway).

If you are using Diffie-Hellman with a truly ephemeral DH key pair, to establish a shared secret with a specific peer and never reusing that DH secret for anything else, then you can just assume the DH parameters to be fine, because, by virtue of discarding the private DH key after usage, whatever nasty tricks played by the peer will impact that key exchange only. However, if you plan to reuse the same DH key pair to make of DH instances (e.g. a TLS server with a "DHE_RSA" cipher suite, that renews DH key pairs only when the service is restarted), then you have to be more careful because peers may submit bogus DH public keys to try to extract information from your own DH private key, and use that to attack other connections.


Sandboxing user input html I want to render user uploaded HTML (consisting of possibly many files with images, custom css, custom js, all uploaded in a zip file) for preview purpose. The user that submits the html will be the only one to access it.

I want the user's HTML to be isolated from the rest of my website (no access to javascript, no css inheritance, no access to the server's other files).

I read some information about iframe in another question, and I am considering the use of sandboxed iframe.

I wonder if it's secured enough, or if there are better options.

If you don't trust sandboxed iframes, you could also use separate hostname for each package. E.g configure virtual host with *.previews.specialdomain.tld, and show each preview on different autogenerated hostname. You can then offer link to preview with

<a target="_blank" ...

That way, users will see the preview as a full page instead of iframe, and they get back to your original view after closing that (or by switching to previous tab/window).

Even though Google is convincing author for Caja framework, it seems unlikely they really can prevent all security vulnerabilities and not to break the JS code in some cases.


SELinux: command line tool to look security context (like selabel_lookup(3)) The selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have [1].

Is there a command line utility which looks up security context information for a file from the policy definitions - possibly one that even uses selabel_lookup(3) under the covers?

I can sort of use a reverse grep(1) to search /etc/selinux/targeted/contexts/files/file_contexts.  It looks like entries use extended regular expressions (so egrep rather than grep).  So I'd have to search the keys in file_contexts by iterating over them and applying the key to a regex search against my file name.  That could get time consuming.  For instance, Fedora 23 has 5935 lines in file_contexts, so that could mean 5935 invocations of grep.  I was hoping for a more efficient solution than that.

[1] ls -Z or secon gives current security context for a file, but that may not be the correct context for that file (as outlined in the SELinux policy definition for the system).

It looks like matchpathcon(8) (from the libselinux-utils package) does the trick:

% matchpathcon /tmp
/tmp    system_u:object_r:tmp_t:s0
% matchpathcon /tmp/foobar
/tmp/foobar     <<none>>

I think that should satisfy my needs [1].

You can use matchpathcon to verify existing files' labels:

% matchpathcon -V /tmp
/tmp verified

Although -V is a little confusing for files that have no policy defined:

% matchpathcon -V /tmp/foobar; echo $?
/tmp/foobar has context unconfined_u:object_r:user_tmp_t:s0, should be <<none>>
1

I would think a context value of <<none>> would match any context successfully instead of being flagged as an error.  The current implementation that I tested (libselinux-utils 2.4.4) flags those cases with a non-zero exit code (as shown above).

[1] My actual need is to look up the proper security context of a file in a mounted chroot image of a removable disk and set it to the proper context based on system defined policy - this will ensure the disk gets the proper security labels before being deployed.  I specifically wanted to look up the security context for /tmp in order to apply that context to a custom directory that has /tmp-like semantics.  The custom directory is not (yet) defined in a file_contexts list.


how to load files in TLS PASS Through in Burp Suite? I tried to load .txt files in TLS PASS Through but it is not accepting the file type. I tried with (.txt) and (.csv) .
The reason behind this is when I open a new project in Burp Suite all time it needs to add manually hosts. So how can I add a list of hosts in a single click?

It looks like Burp does not support wildcard URLs in its Load functionality.
If I load this file:
burp_urls.txt
-------------
https://*.google.com
https://portswigger-labs.net
https://example.com

Then I get this:

This is consistent with this Portswigger Support question from January 2021:

This sounds like it could be a feature request for the 'Load' option to respect any regex set within the file being uploaded. If possible, can you send the file or an example to us on support@portswigger.net?

So it sounds like if you want this enhancement, then you should email them and request it :)


Are there problems with reusing strong passwords for private gpg keys I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably a matter for another question).  For convenience, I would like to use the same (strong) password across these three keys.  I think this is OK for the following reasons:

These keys are all subkeys of master keys that are kept offline in a secure location.  They can all be revoked quickly if necessary.
All these subkeys are stored together (I need all of them on all of my devices). As a result, if one is compromised all of them are compromised, and I would revoke all of them (and use a different password for the next generation of keys).

Having said this I am no expert.  Enlightenment one way or the other would be much appreciated.

Edit:

OK password reuse has some obvious implications. For instance if one is compromised, they are all compromised.  As per the comments, more interesting to see would be if there are non intuitive implications.  For instance: Is the password easier to crack if there are 3 keys using vs just the one.

Generally, in terms of security, reusing passwords is not a good idea.

Mind that the revocation is not the only problem if you get compromised. An attacker with access to your previously encrypted messages, by having the key and password, is gonna be able to decrypt them. So, having different passwords makes the attacker's job harder.

Also, making this setup (keeping the keys in the same machines) is not necessarily a good idea. If you can avoid having one of your keys in a machine, do it. Make your attack surface as smaller as possible.


OpenPGP Encryption / Decryption Process Using GnuPG I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the OpenPGP encryption standard.

I have a web application that is situated on 'Server A' where users can submit information via a form. When they submit the form the following encryption process takes place:

Encryption - Server A

Form data is encrypted using the public key of server B
Form data is signed using the private key of server A

Admin users of the website can see the submitted data via another web application situated on 'Server B' where the decryption process takes place:

Decryption - Server B

Form data is verified using the public key of server A
Form data is decrypted using private key of server B

Thanks

The encryption and signature processes which take place on server A and server B protect the form data against unwanted eavesdropping and malicious (or accidental) alteration, from the moment they were encrypted/signed on server A, to the moment they are decrypted/verified on server B. This includes any kind of storage on A or B, and whatever transport medium is used between A and B. But note the following:

The encryption and signature say nothing about the data submitted by the client; as @mikeazo suggests in a comment, the submission process had better be protected as well.
Thanks to the signature, B can be sure that any message it received is "genuine" (it is really as it was when A signed it). However, B cannot know if he got all the messages; signatures say nothing about message which B never saw because the attacker intercepted them before delivery to B.
The signature covers only that which is signed, not any metadata that may be associated with it. For instance, the form data can be verified to relate to a given user only if the name of that user is part of the form data. Otherwise, an attacker would be free to swap encrypted forms around in A's database. Similarly, an attacker hacking is way between A and B could replay old encrypted message, so B cannot be sure that he got "the latest" form data for a given user unless that form data includes some kind of time stamp or sequence number.
Security is only relative to the secrecy of the involved private keys. It takes a bit of faith to believe that an attacker gaining access to A's database will not have access to A's private key.

So while your encryption+signature system does offer some useful guarantees, they may fail to cover everything that envisioned attackers may try. I invite you to formally write down, somewhere, the extent of the powers that you grant to the supposed attackers (that's the "attack model").

Apart from that, using GnuPG is a very good idea, in that using a homemade implementation, or, worse, a homemade protocol, would be a very bad idea.


XSS - any implementations to encode every output received from the server? I was wondering - Say for example you have a legacy application that is XSS vulnerable - are there any (hopefully client side) libraries that can catch and manipulate all outputs that the server returns and potentially encode them? (or any other method than going around every line of code and encoding/decoding the data.

Client side is pure javascript, i'm trying to find "quick" fixes instead of re-writing and changing my client side library to other languages (like angular) that handle those issues automatically.

It depends very much on the client side code as to whether this is possible. For a single page app, where only standard framework code is loaded from the server directly, then client side calls are used to pull any other required data, it's trivial - just hook into the client side calls, and ensure they're parsed correctly before being used on the page.

However, in a lot of older applications, the server provides the data directly, even if it is then shifted into place with client side code. In this case, any client side encoding would only trigger after the content has been put on the page, and, probably, executed.

Example of SPA (pseudocode):

<html>
  <script>
    clientContent = server.load(serverContent);
    encode(clientContent);
    document.body = clientContent; // raw content only included after encoding
  </script>
  <body>
  </body>
</html>

Example of server rendered:

<html>
  <body>
    serverContent // raw content executes here
  </body>
  <script>manipulateBody()</script>
</html>

In terms of methods of encoding, it depends on the context of the vulnerable data - for HTML contexts, look at things like https://stackoverflow.com/a/7124052/6039613 but note that you will need different characters escaping if the XSS vulnerabilities are within script blocks, for example.


Read Write Execute on infected thumb drives There is some debate going on among my peers. With differing opinions regarding risk on infected thumb drive with limiting policies set on it.

Question is Can you still get an infection with read only access, disable write on thumbdrives. How about disable execute access only.

My thoughts is that if you disable write. Higher risk as AV cannot clean the thumbdrives but you can still get an infection from read only drives. Disabling execute reduces the risk but infection can still occur. Plus side is AV can clean/quarantine if required. Read only serve no purpose apart from preventing writing files to the thumbdrives.

Thoughts?

You should also be aware that if the thumb drive is malicious (as opposed to having malware on it) then you should be aware of non-malware attacks that impersonate different types of USB device. It could pretend to be a keyboard and type commands onto your system for example.

If you can reliably prevent execution of any files hosted on the drive, then that would be a reasonably effective solution. Execution prevention of untrusted locations (e.g. Downloads, AppData, etc) is by no means 100%, but it's actually quite effective at tripping up various automated exploits and mass-market attacks.


Stack Overflow is www.doioig.gov/? If not, then could I be infected Great! I made a post recently where I mentioned that my system might be infected. Now something new came up. When I search for Stack Overflow on Google, I see that the URL is www.doioig.gov/. When I click that link, I am taken to a redirect page that says:

  If you are not redirected automatically, please click the link to continue to the U.S. Department of the Interior Office of Inspector General which is actually http://www.doi.gov/oig/index.cfm.

Notice that the names of the URL in search results and hyperlink are different. I searched for a couple of bank sites to see if something similar happens. But nothing like this happened.

Here are my screenshots -

Google is not the DNS.

When you enter "stackoverflow" in Google, you are asking Google to give you links to sites which are "relevant" to that search term -- with a notion of relevance which is never made explicit, but is known to change regularly. For that matter, it seems that the internal algorithms used at Google somehow chose to point at the Office of Inspector General, a US federal agency. It is not specific to you; I get the same result.

This is a reminder that software has bugs. This one is rather harmless. I suppose the people at Google are currently trying to work out why their algorithm does that.


Abnormal SYN traffic from Blackhole DNS servers I have been getting alerts from an anomaly based signatures for abnormally high SYN traffic. The traffic is coming from blackhole DNS servers.
I hadn't had any experience with Blackhole servers prior to this so all of what I know has come from Wikipedia: http://en.wikipedia.org/wiki/Blackhole_server

My question is:

Why would we be seeing SYN traffic from blackhole DNS servers?
    Is trafic being generated because of internal DNS servers inappropriately forwarding traffic out to the wild?

If it's relevant to the question, how do these servers function beyond what is in the wiki article?

Is this a spoofed SYN flood?

At first glance, this may look like an attack. An attacker can initiate a SYN Flood without using his real IP address. An attacker crafts a packet with an origin IP of a known IP such as that of a blackhole dns server. Your server may exhaust resources while attempting to respond with a SYN-ACK packet.

How can I tell

If your server does respond with a SYN-ACK packet, then the original packet is likely spoofed if the server doesn't respond with a final ACK packet.

Why am I seeing TCP traffic for DNS?

Per RFC6305

  A request sent to one of these servers will result in a response being returned to the client.  The response will typically be a UDP datagram, although it's perfectly valid for requests to be made over TCP. In both cases, the source port of packets returning to the site that originated the DNS request will be 53.

Explanations provided by RFC6305

Section 6 of RFC6305 provides further explanations of why you may see this traffic.

  Inbound Traffic from AS112 Servers

  Where firewalls or intrusion detection systems (IDSs) are
  configured    to block traffic received from AS112 servers,
  superficial review of    the traffic may seem alarming to site
  administrators.

  Since requests directed ultimately to AS112 servers are usually
    triggered automatically by applications, review of firewall logs
    may indicate a large number of policy violations occurring over an
    extended period of time.

  Where responses from AS112 servers are blocked by firewalls, hosts
    will often retry, often with a relatively high frequency.  This
    can cause inbound traffic to be misclassified as a denial-of-
    service (DoS) attack.  In some cases, the source ports used by
    individual hosts for successive retries increase in a predictable
    fashion (e.g. monotonically), which can cause the replies from the
    AS112 server to resemble a port scan.

  A site administrator may attempt to perform active measurement of
    the remote host in response to alarms raised by inbound traffic,
    e.g. initiating a port scan in order to gather information about
    the host which is apparently attacking the site.  Such a scan will
    usually result in additional inbound traffic to the site
    performing the measurement, e.g., an apparent flood of ICMP
    messages that may trigger additional firewall alarms and obfuscate
    the process of identifying the originally problematic traffic.


Rights vs permissions vs privileges I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be given or denied access to.

I am considering the most appropriate terminology for these concepts:

system asset/functionality = "right"?
that a user is allowed to access certain asset/functionality = "permission"?

Role Based Access Control is a well defined model, that comes with its own terminology. At minimum, RBAC has the following entities:

A User has one or more Roles.
A Role is a collection of Permissions.

A Permission (or privilege) is the right to perform an Operation (or action) on a Resource (or object).

So, from what you describe in your question, I would say that

your model is not complete yet (operation is missing);
your 'system asset/functionality' is a resource;
"that a user is allowed to access certain asset/functionality" is indeed a Permission


XSS outside of the DOM I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question):

$("<i></i>").html(userInput);

Is it possible for someone to input some string, userInput, such that they successfully execute an XSS attack?

I've tried inputting a script tag with an alert in it, but it doesn't execute. I believe that because the element is outside the DOM XSS won't work, but I couldn't find any resources to confirm this.

Never evaluate untrusted input as HTML. Even if the DOM is disconnected (i.e. not inserted in the document), evaluation of HTML can still cause XSS. Your specific example can be exploited using event attributes:

var userInput = '';
$("").html(userInput);

If you really need to parse untrusted HTML in a browser, use the DOMParser API (with text/html).

Another way to prevent the attack is to use a Content Security Policy Content-Security-Policy with a script-src directive that excludes the 'unsafe-inline' token. CSP is just damage control though, and should not be used as a substitute to proper input sanitization.


Possible Malicious Linux.Xor.DDoS installed I am not an expert in information security. I am running Lubuntu on a laptop. Today, I ran chkrootkit and it printed the following:
INFECTED: Possible Malicious Linux.Xor.DDoS installed
/tmp/clamav-71d2ee99f7e011424ab238571d720a88.tmp

I did run clamscan. This is the first time I have seen this notice. I could not find any other reporting on it. Is this a known false positive, or does it represent a genuine intrusion -- and if it is the latter, is the proper response to just go in and delete that .tmp file?

Probably it's a false positive as the clamav temporary file /tmp/clamav-71d2ee99f7e011424ab238571d720a88.tmp will contains some signature of malware, these signatures can be detected by chkrootkit and flagged as malicious.


SIEM: Correlating remote logons to associate origin and target user How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user.

My use case is to know who actually (personal/identifiable) used a technical account (non personal).

Edit:
Sidenote: Both clients and both users are in the same network and or at least share the same AD forrest or authentication.

SIEM correlation rules generally require matching or corresponding attributes in a log in order to link 2 logs together. So one option may be to match on ip addreses. Perhaps it's a timing rule such that a remote (personal) account logs in and a log shows they are assigned an internal ip. Then the rule says that if within 5 minutes that internal ip logs into another system with a different account (technical) then report it to you. Now you have an alert that correlates the personal account to the technical account.

Example:

Log1: vpn says user1 remoted in from 8.8.8.8 & was assigned ip 10.0.0.1

Log2: Linux server says technicalaccount1 ssh'd I'm from 10.0.0.1

Alert: Linux ssh within 5 minutes after vpn login with matching ips


Is it necessary to update JRE in an Apache Tomcat Server? We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42.

Users have expressed their concerns about Java 7's support/updates being discontinued by oracle in April 2015 and has requested for the environment's Java version to be upgrade to version 8. However, by doing so, we are afraid that the application's behavior might change, as we have observed during coding and testing when one of the developers was using JRE 8 instead of 7. This might also mean that we would need to upgrade the 3rd party libraries we used such as OJDBC and even upgrade the Tomcat version.

My question are:

What are the security concerns if we are to stick with an old JRE version?
What can we do to mitigate the security concerns?
Isn't it the responsibility of the web server's, load balancer's (and such) security features to prevent security issues for the Java versions they supposedly support?

Edit

All of you suggested that it's necessary to upgrade a server's Java version. However, this is a big and very complex application with lots of dependencies; upgrading would mean performing costly regression testing on the whole system. My additional questions are:

Does the risk outweigh the incurred costs? Are the risks that great to justify additional testing and potential re-coding?
How can a malicious attacker exploit an outdated Java version? My understanding is, services/ports that are directly communicating with external users are the only entry point to an internet-base attack (assume no internal attacks). Then, isn't it the job of the Operating System and services to ensure that there are no exploitable bugs?

Given that your system is exposed to the internet, you should do all the tasks you mention in your question. Sooner or later an automated attack against Java 7 will be available, and bots will find your server.


Any historical precedent for Open-Source libs as an attack vector? I'm curious as to whether there are any noteworthy cases historically of people deliberately placing exploits in open-source code libraries used by others, either something relatively obvious with the hope nobody will check, or with something underhanded that's easily exploitable as a back-door?

It seems to me like the rise in the types of developers who blindly glue libraries together would lead to a world where this is much more common, but I'm having trouble identifying any actual cases of it occurring.

It would seem to me that injecting arbitrary unvetted code from untrusted third parties is a pretty high-risk endeavor that startups are throwing around with reckless abandon, so I'm just wondering why I'm not aware of any catastrophes yet.

You're right, deliberate injection isn't common in the open source world, in part because the process makes it expensive, but mostly because it's not necessary.

Most open source projects that gain traction have users who exercise lots of use cases and need careful custodians who respond to problems and know their committers, so arbitrary pull requests from new developers go through a vetting process, and in order to get their code in, participants have to be invested in growing a reputation and building trust. This all makes deliberate injection of vulnerabilities difficult.

And it's not necessary because software is vulnerable by default. From an attacker's perspective, there is no reason to go through a trust charade to inject vulnerabilities, because there are already going to be some in any codebase, you just have to look for them. And because the code is open, you can look for them without anyone knowing you are looking for them.

In the closed source/commercial world, injection is much more common, for instance:

https://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/

For those attackers at that scale it makes sense to build and then sacrifice trust, though that is a very expensive exercise. The infamous case of Dual_EC_DRBG is instructive, because it was an injection in a world that resembled open source in terms of dynamics, with the result that a previously trusted actor (NSA) working in a previously unblemished open process (NIST) has forever sacrificed their own and the process' credibility. Check wikipedia for details.

The model you suggest- third parties utilizing a process that does not require trust to inject attacks or vulnerabilities- accurately describes the delivery model for web malware.

Arbitrary, unauditable, and precisely targeted third party code- layers of javascript, flash, and so forth that delivers ads, captures metrics, provides sharing buttons and does tons of other stuff- are loaded into the browser on behalf of the first party domain the user is visiting, usually with very little to no awareness from the first party or from the user. It's highly risky for users and of course catastrophes happen all the time:

https://www.proofpoint.com/us/threat-insight/post/massive-adgholas-malvertising-campaigns-use-steganography-and-file-whitelisting-to-hide-in-plain-sight


How do you properly make a backdoor shell with netcat using UDP? See the reference image below. When issuing commands to a bash shell via a netcat connecting using UDP only the first character of the command seems to make it to the server. Moreover, after entering the command a second newline is required.

Why does this behavior occur? What is the proper way to create a shell using netcat+udp?

I'm using GNU Netcat 0.7.1 by Giovanni Giacobbi

Have a quick look at a related netcat query on serverfault here - this may help. UDP does not behave as well as TCP.


Is End to End encryption possible for all servers across the whole infrastructure? Running into a possible situation where a client I am working with is requesting that all data that leaves the servers should be encrypted and here, we are talking of hundreds of Linux servers spanning across data centers and also includes public and private cloud offerings.

I understand IPSec based tunnels could have worked had we talked about a handful of servers but here, I have failed at finding a solution that is easy to scale and deploy, something that doesn't warrant changes to applications.

I have looked at tcpcrypt and have searched the web looking for proprietary offerings(TLS based) if they fit the use case - looked at CipherCloud, Safenet and CertesNetworks but I doubt if any of the offerings fit the requirement. Many offerings talk of gateway based encryption but that leaves data over local network unencrypted.

Is there a solution that quite literally fits the task? (or am I trying to bite more than I can chew?)

Just remember the fact that 'end to end' encryption doesn't necessary mean that every single link needs to be encrypted.

E.g. Payment request is encrypted in client browser using app-3 public key. Corresponding private key resides in a HSM.

Client Browser (encrypted payload) -> reverse proxy -> web -> app1 -> app2 -> app3

Payload is decrypted in app3 using HSM. If this is what the client needs to protect, you can literally leave everything in the path in the clear and the data is still safe.

So ask your client where are the important exit points of the data where encryption should be enforced.


How do Windows services access folders encrypted with NTFS EFS If I understood correctly, when I enable NTFS encryption (EFS) for a specific folder in Windows, it uses specific account's user name/password (salted) to create asymmetric keys for data encryption and decryption. If I enable encryption for a certain folder, I presume this means that other system accounts (like LocalSystem or NetworkService) won't be able to access contents of this folder.

How does this work if you enable encryption for the entire drive? I.e. how are Windows services able to use the disk at all in this case?

The reason I am asking is that I would like to enable encryption on a certain folder containing deployed executables for several applications (a service, a gui console, some command line tools, etc.), so I'd like to understand exactly how I will need to configure all this to work.

(Update)

To clarify, we have a server located at a remote location, and we would like to protect our installed software from copying or disassembly. The server is running some services which receive data from devices and store them around, and it has a web app for visualization. Login is protected by a rather strong password, but this doesn't stop anyone from pulling out the disks and making a copy.

If EFS suitable for this? Or should we take a different approach?

Maybe BitLocker instead of EFS?

we have a server located at a remote location [...] stop anyone from pulling out the disks and making a copy.

Well, you could use BitLocker Full-Disk-Encryption and store the decryption key inside the mainboard's TPM chip. And set BitLocker to automatically unlock the volume on boot.
This would mean that a thief would have to steal the WHOLE SERVER and not just pull out a disk.
This BitLocker volume unlocking mode of operation is called TPM only.
Here's a blog article that lists the different modes:
Luis Rocha, Count Upon Security blog, 2014-06-23, BitLocker with TPM in 10 steps.
(Archived here.):

TPM Only: No authentication required for the boot sequence but protects against offline attacks and is the most transparent method to the user.

This would at least make any attempt to get at the key much easier to prevent/detect.


Is there a method of generating site-specific passwords  which can be executed in my own head? I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) without the help of any notes or the like.  If I use really random passwords (generated by a password-generator), I can remember only a few. Many fewer than the number of web accounts I have. Simpler passwords often are easier to guess.

I thought that a compromise might be some easy to learn rules and some secret master-password, to generate a password from the name of the site. Say you have a password for ebay and amazon. This method should generate two different passwords, for 'ebay' and 'amazon'. But I should also be able to do the process in my head, without support from software or even paper and pencil. Commonly used passwords I will remember directly.  But ones seldom used, and forgotten, could be reconstructed with such a method. Does anyone know about such a method?

EDIT: The thing I ask for should improve security, by making different passwords for each site/machine/program, but also keep all of them memorable. A password-safe is nice, but you are even more likely to forget the site passwords, and if you lose your store or it is damaged you have a problem. Also ALL the passwords can be compromised at once! And in the end, my local password-safe is not at hand, if I'm at the machine of a friend.

Intriguing question.  Here's a new, hopefully better, brainstorm.  Caveat emptor.

Generate two good tough random passwords that you commit to memory.

Take the letters of the site name in sequence.  If the letter is a vowel, use the corresponding letter from the first password. Else, if it's a consonant, use the corresponding letter from the second password.

E.g. suppose your passwords are (from apg) hicIrfyic9 and FritwoivAuv0.
For the site stackexchange, the first two letters are a consonant, so you use the "Fr" from the second password.  Next is a vowel, so you use "c" from the first password.  Keep going and you get "FrctwfivA9".

If you really are worried about someone finding several of your passwords and figuring out the pattern, you could add some method to rotate each of the passwords circularly first or something, or shift them thru the alphabet, or whatever, but it is easily possible to get too paranoid and confused....

You would be able to code this up on your regular machines for convenience, having it prompt you for the underlying passwords, but still be able to use it on kiosks, more slowly, from memory.  I'm not convinced this general idea is worth the hassle, but perhaps for some circumstances.


Does Dropbear support SSH key revocation? I'm using Dropbear as an SSH server in my embedded system.

I want to know if Dropbear supports SSH key revocation? If yes, how I can do it?

SSH public key authentication does not support anything like key revocation. The list of "allowed" keys is store in the ~/.ssh/authorized_keys and if you remove the key from there, you revoke the access (if this is what you want to hear).

Revocation list is related to Public Key Infrastructure usually based on the X.509 certificates with certificate authorities, which is really overkill to implement in lightweight Dropbear. SSH keys are standalone cryptographic primitives and they do not use anything like this. There is possibility to use certificates in OpenSSH, but not with Dropbear.


How does duqu delete itself? I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?

how can an executable delete itself while is running?

Windows uses memory mapping to load executables into memory so unfortunately the executable file (unlike in Unix based OSes) cannot just be removed.

Unix is slightly different (since there's some debate on this on the other answer) - however, it still uses mmap() to load executables (you can verify this with strace). It turns out what happens when you overwrite such executables is quite complicated but it comes down to how you do the overwriting. Since Unix uses inodes, as I understand it the reference count to that inode would decrease, but one is held (for the executing program), hence self deletion is possible - the reference for the dentry (disk path) disappears, but not for the mmap().

Windows does not have an inode concept, and so the file must exist whilst the program is running. This is a problem almost anyone who has written an uninstaller will have experienced - or even a temporary utility. The first link I gave you runs through the techniques you can use; these are, briefly:

Batch file to delete the program.
Move the file to nowhere, delayed until reboot (via MoveFileEx)
DELETE_ON_CLOSE via CreateFile.

and several others. I won't spoil the article - and I think I've seen other techniques used as well, so you can take it that there are many ways an executable might self delete.


What are the security implications of pairwise master key caching in Wireless Networks? I'm currently investigating WPA2 enterprise security options, and I'm curious about PMK Caching.  I've found lots of vendor information about it, and understand that the client does not need to reathenticate to the access point during the caching period.  Does anyone know what the likely attack scenarios for this are, and what the real risk is?

With WPA in general, the EAP exchange results in dynamically encrypted session - one that has a different "key" for every client, and every connection, and every re-connection. PMK caching is typically found in networks that have roaming features enabled and time-sensitive applications (e.g., VOIP) - applications that can't risk disconnection because the client has to re-authenticate to the AP every time it roams.

So the risk isn't really very high. The first "phase" of security in a WPA2 Enterprise network is the authentication that occurs with the certificates (hopefully you're using mutual authentication). After a client has successfully authenticated with an AP, the EAP four-way handshake occurs, and the second "phase" of security kicks in. This second "phase" is what's cached by the AP (PMK). Depending on how long you tell your AP software to cache it for, it "forgets" the cached credentials if the client doesn't reconnect to it in the required time frame. It will basically assume the client has found a better AP and remove the cached PMK. If the client reconnects to it after the expiration time frame, it will require the EAP process to occur again, and will cache the credentials again.

As an analogy, it's like an ex-girlfriend (or boyfriend) that found someone better and left. After a certain period of grieving, you forget about them. They realize they never should have left, but if they want to be with you again, they'll have to start all over.

Edit: As for attack scenarios, it's still in a much better place than WPA2-PSK. If an attacker somehow obtains the legitimate client certificates and is able to authenticate to the WPA2-Enterprise wireless network anyway, PMK caching will be the least of an admin's concerns. Not taking into account stolen credentials, an attacker is basically looking at brute-forcing AES - something that's not an option time-wise for most attackers (thousands or millions of years to crack with today's technologies - time calculator here).


Why do login screens hide the password input field until the username is provided? I am noticing a trend in web development where login screens are no longer showing both the username and the password input fields simultaneously. Instead, you are required to type in your username then click a "next" button which will then reveal the password input field. Why is this?

From my experience, I noticed this started a while ago with Yahoo, at least a couple years ago I think, and Gmail too. And now, Apple has followed suit on most of their websites such as iCloud.com, iTunes Connect, and the Apple ID website. However, unlike Gmail, Apple does not check if you have an account before revealing the password field. It literally just unhides the password field.

It appears to be for security purposes, but I am not seeing how. It is interesting that some web developers were attempting to steal credentials recently. On page load Apple's password management solution would autofill credentials, possibly revealing credentials to nefarious websites (or even if not nefarious it still provided user information without explicit consent). This was just recently addressed by no longer autofilling on page load, instead the user must invoke the autofill after clicking into the field. I believe not long after that was addressed, that's when Apple updated their login screens to hide the password input field, which may not be a coincidence. Notably, their implementation breaks autofill of both username and password - on their sites you now have to select the username field, invoke autofill, click the next button, select the password field, invoke autofill, and click the next button to log in - it does not fill in the username and password field upon the first invocation because the password field is not shown until after the username is filled and committed.

Does hiding the password field until the username is committed increase security, and if so, how?

UX Design

First of all it's a good UX design. It decouple Identity (your username) from your Authentication Method (Something you Are, Something You Have, Something you Know) and in the age of different authentications sources (Google, Facebook, OpenID, Internal) it's a sexy way to make them look as one.

Security

Brute Forcing

You increase the number call you need to make to a service, thus increase the time it takes to get a password.

Multi-Auth Sources

As mentioned in the UX portion, we decouple Identity and Auth. This makes it easier to develop 2FA applications which can use multiple patterns.

Separate Identity Source

Maintain a public identity source separate from your authentication. Think about having a Identity Management Server which holds all the information about you, that can be used across your entire business and than allowing different types of people authenticate in different ways.

I'm sure there are more if I sit and think about it.


How can WhatsApp do both targeted advertisement and end-to-end encryption? Recently there have been a lot of news articles which say that Facebook will very soon add advertising to WhatsApp, yet will keep the end-to-end encryption (source):

  [M]essages will remain end-to-end encrypted. There are no plans to change that.

I am trying to understand how advertisement is possible while keeping end-to-end encryption. I understand that there are several options:

Advertisements are not targeted according to words used in messages, just general ads.
It is possible to send additional/duplicate packets with the same information to the server, which also uses "end-to-end encryption". Yet, if that's the case, it's sort of "telling the truth but not all the truth". I find it hard to believe that such a method would be used.

Are there other ways to do both ads and e2e encryption that you can think of?

Your WhatsApp account is linked to your Facebook account. They know lots about you from your Facebook activity, and can use that to direct targeted ads at you on WhatsApp, without knowing anything at all about the content of your WhatsApp messages.