Friendly reminders for people who don't lock laptops My bosses have tasked me with coming up with a kind of "friendly reminder" card that we can leave on the desks of folks where we see they've walked away without locking their workstation and we have to lock it.

Has anyone else ever had to do something like this or do you have like a template email you have to send to people? The idea is to educate without coming off as overtly punitive.

Thanks in advance!

Those cards will be seen as punitive no matter how well you phrase them.

There's another way: cards for those who locked their machines!

Punishing behavior you don't want won't always mean that you will get what you do want. You might just get less of that undesired behavior (e.g. people hiding their unlocked machines or other such nonsense).

But if you reward the behavior you want then you will see more of that behavior.

Just a simple card will do, and I'd toss in a small candy or some other small reward.

Say "Thank you!", not "Ya done screwed up!"


Is router pinging local hosts normal functionality? Do router's normally use the ping command to discover local hosts? I ask because while I was at work my firewall on my personal laptop blocked two pings (among other things) and it said they came from the router. Is this normal or evidence of a curious/malicious user (because there are no network admins that might use it)?

Timeframe of Blocked Activity from Router's IP:

Ping @ 12:54 PM

UDP 49538 @ 4:09:17 PM
UDP 60655 @ 4:09:26 PM
UDP 1900  @ 4:09:39 PM
UDP 63266 @ 4:09:40 PM
UDP 51081 @ 4:11:15 PM

Ping @ 6:36:48 PM

UDP 1900 @ 6:39:25 PM
TCP 2869 @ 6:41:02 PM
UDP 49609 @ 6:45:24 PM

If I recall correctly, both pings occurred at about the same time that I brought my laptop out of sleep mode because I only used my laptop for a little bit before I closed it and I only used it a few times.

A router often needs or wants to know what/who is on it's network.  There are several routing protocols that need to know things.
If it is only two then that is strange.  An attacker would likely ping or nmap the whole local network.  A router likely would be doing this on an automated basis.
This might be a better question for https://networkengineering.stackexchange.com/


Does Kismac 0.3.3 (0.3.3) work on Mac OSX 10.8.2 Does Kismac 0.3.3 (0.3.3) built on February 7th work on Mac OSX 10.8.2

It doesn't seem to scan for me.

Both are the latest versions as of today.

Apparently there are some issues with KisMAC on 10.7 and later, so you should grab the r407 nightly build from the wiki.

Also check that your wifi card is supported. The Alfa AWUS036H (RTL8187L USB chipset) is listed as supported, but doesn't actually work on Mac OS 10.6.7 or later. The internal wifi card on MacBooks is also known to work with certain Apple drivers, but I don't know which. I'd suggest looking for a USB wireless dongle that uses the Ralink RT2570 or Ralink RT73 chipset, since they seem to be best supported.


Does portforwarding present a risk to anonymity? AirVPN by default has all ports closed but allows port-forwarding. I think this is required for P2P. Is this a threat to anonymity  (e.g. would the person at the other end of the P2P transmission know who you are) with port-forwarding set up?

I noticed other services such as BTGuard and PrivateInternetAccess don't mention port-forwarding yet are designed for P2P. Is this because all thier ports are opened by default?

Let me ask it this way. If you do the following does it allow people to see your real IP?

  You provide Remote Port Forwarding, what is it? "Remote port
  forwarding" forwards traffic coming from the Internet to our VPN
  server ports to a specified local port of your client.

  By default, your account has no forwarded ports, and this is good as
  long as you don't wish to have a service reachable from the Internet.
  For example, suppose that you want to run a web server behind our VPN,
  or that you wish to receive incoming connections to your BitTorrent
  client in order to improve p2p performance, or to seed a file. Without
  at least one remotely forwarded port, your service could not be
  reached from the outside, because our VPN server would reject the
  proper packets to your service.

  Usually this is a good security measure against attacks, but it
  prevents your services to be reached from the Internet.

  When you remotely forward a port, our servers will open that port
  (TCP, UDP or both, according to your selection) and will properly
  forward incoming packets to you on that port.

  You can forward up to 20 ports simultaneously. You can do that on our
  website. You can't forward ports lower than 2048. You can map a
  remotely forwarded port to a different local port: this is useful for
  a variety of cases, for example when your service listens to a port
  lower than 2048 or when it is already reserved.

  IMPORTANT: do NOT forward on your router the same ports you use on
  your listening services while connected to the VPN. Doing so exposes
  your system to correlation attacks and potentially causes uncencrypted
  packets to be sent outside the tunnel from your client.

That's the worst possible advice; and, doesn't answer what the OP wants to really know.  If you get a standard VPN provider and you attempt to forward your ports via your Internet router, you're leaving yourself completely exposed to "real" malicious attacks; especially if you forward common ports such as port 80, 443, etc; even if they're SSL'ed!  I tested this a few weeks ago.. some very popular VPN services are completely infested with automated vulnerability scanners and respective attacks.

The difference between AirVPN and other VPN providers is that they allow for a much safer way to forward your port (done on their servers instead of on your router); which doesn't completely leave you vulnerable to port-scans and respective attacks.  This is particularly useful for people who host web sites and other Internet services.

So, if you're forwarding ports, you had better do it with a VPN that's setup for doing this.  Most don't advertise this too well; so, you have to specifically ask for ports to be forwarded for you (these accounts are usually referred to as "dedicated" or "private" VPNs.


What are the real world risks of sharing your device and network information with advertisers? I am trying to decide whether to keep this new fitness tracker that I bought for $70.  Great deal - until I found out that I'm paying for it with my personal data.

How risky is is to share MAC address, android ID, IMEI, IMSI, MEID with advertisers?

Can they use it to spam your phone and skew ads and search results? Can health insurance companies use this information to identify and discriminate against me?

Is it worth the arguably $100 value for information that I can never take back without trashing my phone for a new one?

This is typical tracking behavior for most types of Internet advertising. The information you mentioned (IMEI, MEID, etc) can be used to track various things, such as which apps you use on your phone, your geographical location, etc. Given that this is an android phone (apple can be even worse!), Google can link your phone activity to activity you do on other devices, such as your computer or maybe your tablet. It essentially is used to build a profile of who you are in order to target advertising toward you that you may have an interest in.

Chances are, they know you better than you know yourself.


How to fix SSL 2.0 and BEAST on IIS As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs.

I'm using IIS 7.0 with the latest patches, and can't seem to find the answers to these questions:

What is the risk impact of this vulnerability on a site like
http://teammentor.net?
What are the exploit scenarios?
Is there any mitigation (or not) by the use of IIS 7.0?
How do I fix this in IIS 7.0?
Can anything been done at the Application Layer?

For reference here are a couple other security.stackexchange.com questions on this topic:

Next Microsoft Patch Tuesday include BEAST SSL fix
Should I ignore the BEAST SSL exploit and continue to prefer AES?
What ciphers should I use in my web server after I configure my SSL certificate?

In IIS 7 (and 7.5), there are two things to do:

Navigate to: Start > 'gpedit.msc' > Computer Configuration > Admin Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order (in right pane, double click to open). There, copy and paste the following (entries are separated by a single comma, make sure there's no line wrapping):

  TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256

Run the following PowerShell commands as administrator (copy-paste into Notepad, save as 'fix-beast-in-iis.ps1' and run with elevated privileges):

#make TSL 1.2 protocol reg keys
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2"
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"

# Enable TLS 1.2 for client and server SCHANNEL communications
new-itemproperty -path     "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"

# Make and Enable TLS 1.1 for client and server SCHANNEL communications
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1"
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server"
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"

# Disable SSL 2.0 (PCI Compliance)
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" -name Enabled -value 0 -PropertyType "DWord"

Once you've run the script, you can run 'regedit' and make sure the keys in the script were actually created correctly. Then reboot for the change to take effect.

WARNING: Notice I didn't turn off SSL 3.0- the reason for this is due to the fact that, like it or not, there are still people out there using Windows XP with IE 6/7. Without SSL 3.0 enabled, there would be no protocol for those people to fall back on. While you may still not get a perfect on a Qualys SSL Labs scan, the majority of holes should be closed by following the previous steps. If you want absolute PCI compliance, you can copy the lines from the Disable SSL 2.0 section of the Powershell script, paste them at the end of the script and change them to the following:

# Disable SSL 3.0 (PCI Compliance)
md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server"
new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" -name Enabled -value 0 -PropertyType "DWord"

Then, when you run the script, you disable SSL 2.0, SSL 3.0 and enable TLS 1.1 and 1.2.


what are security flaws on providing access to users through a unlisted/private/token/signed URL? Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which are then used to submit sensitive/confidential user information. The reason for using such mechanism is to exempt these user from requiring an account, as they are very unfrequent to the system.
This URL authentication/identification system may resemble mechanisms used to validate or reset user accounts, with the difference that they are available for a longer time span (e.g. one or two weeks).

What are possible security flaws on using this mechanism to grant access to users?
From my understanding, posting confidential information can be secured with SSL, however sharing these links through email is susceptible of someone intercepting the email being able to supplant the user while the link has not expired, which could result in unwanted submitted information to the server. I assume that one way to minimize risks is to enable people using the URL to POST content only, so nobody (not event the same, legitimate user) has access to any data previously submitted through the same link.
So, I assuming that I am not missing anything else, is this authentication design choice justified or it is overall an unrecommended practice?

Update:

The alternative to this is to ask even unfrequent users to create a username/pwd. With this, you make sure that nobody makes undesired requests to your server, and in addition, you can choose to display personal information from the user anytime.

As long as you are not giving access to any information and only allowing for input, there isn't really a downside, but there also really isn't a need.  What are you gaining by sending such a link?  You know nothing more about the user than you did if they just went to your website (other than perhaps that they do have access (either legit or not) to whatever communication mechanism you sent the link to.

This could be done before or after the information is entered and as long as no information is revealed, there is really no apparent security issue since all someone could do is convince you that someone else is actually someone that they aren't if the person they are pretending to be decides to go along with it.

You simply have to make sure that the token is random enough that it can't be guessed by an attacker.  One possible way to do this is use two pieces of information and implement a lock out if too many tokens are tried for a given identifier.


When to perform secure code review? OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help explain if it would make sense to perform secure coding before QA and UAT testing. Questions below:

Wouldn't it waste resources to perform secure code after testing? If remediations are required post secure code review, then the code will require to be QA and UAT tested again to ensure business requirements are met.
Can real-time code secure code review in Visual Studio and Team Foundation Server (TFS) address secure code review requirement or does the codes require to be compiled again and scanned to ensure all vulnerabilities are addressed?

Thanks!

Automated secure code review can be done at anytime, it just might fail on incomplete or broken code.

I like my code reviews like I like my vulnerability scans from Qualys.  As often as possible without disrupting the business (everyday high risk assets, entire business on weekends). Every commit should drive an automated review IMO, and a failure should be an immediate feedback to the developer.

A code review doesn't require compilation of said code. In fact, from a security perspective code can pass a security review even if it can't compile.

It's better to find a problem earlier in the dev cycle and fix it, rather than build on it.


Wireshark reveals suspicious UDP traffic sending to a bogon IP address I am running windows 7, and using Wireshark I can see that my girlfriend's computer is sending UDP traffic to 239.192.152.143 on port 6771.  I looked up info on that IP address, and it says it's part of a reserved IP space, or a "bogon" IP address that should not appear on the internet.

Here is a snippet of some of the data I see that it is sending:

BT-SEARCH * HTTP/1.1
Host: 239.192.152.143:6771
Port: 6881
Infohash: ********************* (censored)
cookie: **** (censored)

What's going on here?

It's multicast traffic used for BT Local Peer Discovery. See https://en.wikipedia.org/wiki/Local_Peer_Discovery.

The Local Peer Discovery protocol is an extension to the BitTorrent file-distribution system. It is designed to support the discovery of local BitTorrent peers, aiming to minimize the traffic through the Internet service provider's (ISP) channel and maximize use of higher-bandwidth local area network (LAN).
Local Peer Discovery is implemented[1] with HTTP-like messages on User Datagram Protocol (UDP) multicast group 239.192.152.143:6771 which is an administratively scoped multicast address. While it is implemented in several clients (µTorrent,[2] BitTorrent/Mainline,[3] MonoTorrent,[4] libtorrent[5] and its derivatives, Transmission 2.0,[6] aria2 [7]) and implementation is very simple, no formal specification had been created as of December, 2009. Alternative multicast protocol extension is published as BEP 26.


Alternatives to SMS as a out-of-band channel I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet )

However, NIST seem to advise against this. If the code for SMS were to expire (say in 20 minutes) would this mitigate the risk of using SMS. Or is SMS frowned upon completely in its current state?

Expiring your SMS token in 20 minutes will not mitigate the attack. Bad actors can either use SS7 routing attacks, or social engineering to gain access to your text messages. The social engineering attacks are much lower tech and easy to do. They essentially involve:

Calling your cell phone provider
Authenticating as you, or just convincing the customer service rep to help them. (See: https://youtu.be/lc7scxvKQOo?t=30s). The recent Equifax breach makes this even easier since bad guys can now answer your security questions as well (in many cases).
Changing the IMEI of your phone to their burner phone (like what happened here: https://carpeaqua.com/2017/07/07/hack-the-planet/).
Initiating password resets (to your email or other services) with text messages, which are now routed to the burner phone.

Once they have gained control and access to a few key accounts (your text messages and your primary email) they have the keys to the kingdom, and can take over - resetting passwords and locking you out of accounts as fast as they can. Typically, it takes people around 1 hour to figure out they got hacked. But, even if you notice in 15 minutes, it's very possible you've already lost control of key accounts, and it will take some time to get back in. During that time, the bad actors are routing around in your personal information collecting data and planning the next move, which includes further locking you out.

For strong, out of band 2FA, very little exceeds the security of time based one-time passwords, which Google authentication Yubikey utilize.

There are a number of libraries you can use to generate the 2FA keys. Here are some examples:

PHP: https://github.com/RobThree/TwoFactorAuth
Python: https://github.com/pyotp/pyotp
JavaScript: https://github.com/jiangts/JS-OTP (caution here. I am hesitant to use client side code to do this authentication. Server side is best.

I'm a little concerned OWASP hasn't updated their list in light of both the NIST recommendations as well as the Equifax breach, which puts people's security questions at risk. Perhaps they have their reasons. Speculating on what those reasons are, it could be that security questions don't have to be answered truthfully. Example: when asked: "What street did you grow up on?" I typically answer with a GUID. This, of course, requires the use of a password manager like LastPass and / or KeePass to keep track. But, security requires effort. Also, social media is a gold mine of security questions and answers. So, perhaps the recommendations don't need to change ... yet.


Tor exit node inside the website server to prevent anything in the clear over the wire? Here's the problem:
Can you trust Tor’s exit nodes?
Excerpt:

Chloe set up a fake website with a Bitcoin theme, downloaded a
complete list of exit nodes and then logged in to the honeypot site
multiple times via Tor, using a different exit node and a unique
password each time.
Crucially the usernames and passwords were sent over regular HTTP
rather than encrypted HTTPS so that when Tor’s layers of encryption
were peeled back they were visible in the stream of traffic.
If the login attempts had gone unobserved and unabused then the total
number of website visits and log in attempts recorded by the honeypot
should have matched the number performed by Chloe exactly.
They didn’t.
After a month of testing there were over 600 unexplained page visits,
12 failed log-in attempts and 16 successful ones that hadn’t come from
Chloe.
The passwords were not stored anywhere and were far too difficult to
guess so if they were indeed stolen, they were stolen by somebody
snooping on-the-wire.

Eventually your network traffic leaves Tor’s safe embrace via an exit node – a gateway computer that decrypts your traffic so it can rejoin the regular internet before it arrives at its final destination.

Anyone can set up an exit node and because it’s the place where
traffic is decrypted, anyone who runs an exit node can read the
traffic passing through it.
people are using Tor in the mistaken belief that it was an end-to-end
encryption tool.
It is many things, but it isn’t that.

MY QUESTION IS:  Why not set up the Darknet servers as exit nodes with their web sites at address 127.0.0.1 so there is no "in the clear" traffic over the wire at all?

There are three general end-to-end encryption techniques for servers using Tor.
HTTPS
When connecting to a website using HTTPS, Tor does provide end-to-end encryption. This is explained beautifully on the EFF's Tor and HTTPS demo page. When you are using HTTPS, the exit node is not privy to any data going through it because the session key for the traffic is shared only between the client's browser and the destination website's server.

An example of this would be the https://duckduckgo.com/, the DuckDuckGo domain. The session key is known only to your browser and the DDG server. Reading the traffic requires breaking TLS.
Hidden services
This seems to actually be what you are describing. Rather than setting up a website on an exit node (which is public), a website can be created on a server which runs Tor and which is accessible via a particular onion address, allowing the server to be provided with the same anonymity that the client gets. A hidden service is accessible only via its onion name, and the location of the hidden service is hidden from both the client and any other adversaries who may want to pinpoint it. When using a hidden service, traffic never leaves the Tor network.
Connecting to a hidden service involves the client creating a three-hop circuit as normal, but additionally involves the hidden service creating its own three-hop circuit. The client and server agree on a rendezvous point where the third hop in each circuit meet up and exchange data. This allows the traffic to be end-to-end encrypted, even if the hidden service does not provide HTTPS (non-EV certificates are currently not supported for .onion domains). The encryption is provided by the Tor protocol itself, with a key being shared by the client and the server's Tor process.
An example of this is the https://3g2upl4pq6kufc4m.onion/, the DuckDuckGo onion domain. Even without HTTPS, traffic to that site is encrypted by the Tor protocol. There are no exit nodes involved in connecting to a hidden service because no traffic ever exits the network.
Hidden services are now frequently referred to as "onion services". Additionally, a new version of hidden services, version three, has been rolled out. It features a new protocol and longer domain names. The general concept behind v3 hidden services is the same as for v2.
Pinned exit nodes
There is an open proposal to implement pinned exit nodes. This involves a server sending an HTTP header which specifies a particular exit node which the client should from then on use when connecting to the website. It allows websites to run their own trusted exits. The motivation for the proposal is to mitigate man-in-the-middle attacks and promote end-to-end encryption:

Similar to the now-obsolete concept of exit enclaves, this proposal
enables web services to express that Tor clients should prefer a
predefined set of exit relays when connecting to the service.  We
encourage sensitive sites to set up their own exit relays and have
Tor clients prefer these relays, thus greatly mitigating the risk of
man-in-the-middle attacks.

Pinned exit nodes have not yet been implemented.


Access via http to other protocols and ports! Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall.

We know that he has developed an application (Console mmc.exe but using HTML) in his server that open other protocols via HTTP.

He showed me his PC's desktop and I see that he access to other protocols via browser by using a converter that he wrote and published on the internet Hosted on IIS in his VPX

Is this possible and how?

Very possible. This is why a firewall alone is not total security. For instance, if you allow port 80, but do not enforce only HTTP on port 80, then the port could be used for any type of traffic (ssh, irc, etc). All you need is a server on the other side of the firewall to re-route the traffic to the expected port on another server, or process the traffic itself.

Ports do not limit the traffic to a certain protocol, they only provide convenience to standardization for expectations.


Is a USB dongle with an active 3/4G data SIM trackable? Let's say I buy a second-hand USB dongle and put in a pre-paid and unregistered data SIM card. At the time of the purchase of both items, my face was covered, I paid cash and I live 500 miles from the purchase location.

I stick the dongle into my laptop that runs a Linux live operating system. Once in a while, I go to a certain website where my IP is revealed. My adversary is a government agency with massive resources. How accurately can they locate me?

As far as  I understand, the IMEI of the device and SIM info will be broadcast to the Internet provider.  Also, with cellular triangulation they will be able to pinpoint to an area. I understand that I can be located to some extent, but to what extent? How close can they get? Within 1 mile? within 100 meters? within 10 meters?

Cellular location without GPS can vary dramatically depending upon many factors. The general working guideline is 1000 feet.

High density areas with micro cells can go much smaller, and low density areas can be miles.


Usability of a found OTP Token for my own system I found a one-time-password token and am unable to find out who it belongs to or where it has been used.

It seems to be manufactured by a company called "ActivIdentity" (now "HID") and called the "keychain"-model. This is what it looks like:

It requested a PIN (which I obviously not know), and after I tried several random numbers it locked completely. Looking at the online manual for users of the token, the token must be given to the user's company's IT-administrator to be reinitialized, which I of course don't have. As far as I could find out, one possibility for the administrator would be to initialize it with the "ActivIdentity AAA-Server", which I also don't have.

Now I hope to be able to use it for my own systems (e.g. authentication for my ssh-access on my own server). In order to do this, I need to initialize it.

Is there any known way to initialize the key with software available to private users?
Is there any know possibility to use this for already available online services?

No.

In order to validate the token, you need some software and/or hardware and/or an online account. You may also need a key which might have been configured locally.


Is NSA disclosure of CRYPT32 vulnerability a charitable public service? News coverage of this makes it sound like the NSA is mending fences and helping us all out, kindly and heroically.

I have nothing against the NSA but isn't it more likely an adversary has been exploiting the vulnerability and they are disclosing it to mitigate that entity's effectiveness?

Still a public service perhaps but without the warm and fuzzy feelings in the news.

The mission of the NSA is both to help the USA. In some cases this might mean to keep a bug secret in order to use it against adversaries. In other cases keeping a bug secret means too much risk that USA companies and citizens are attacked by adversaries using this bug. Thus it is not about being nice or not but disclosing a bug or not is based on weighing the chances vs. the risks.


Should I sandbox web application? Let's say that I'm building a web application that I will host on my server.

Should I sandbox it in order to protect my server?

Note

I just learned that there might be more to sandboxing your web application than restricting the permissions of the user running it when I read those 2 posts :

https://learnbchs.org/pledge.html
http://eigenstate.org/notes/seccomp

It is an established method for improving security to give application only the privileges they are expected to need. This way the impact of a potential security issue is limited. Sandboxing  using pledge, seccomp or similar technologies is one way to limit the privileges an application might abuse but it is not the only way. Typical other technologies are different users for different tasks, SELinux, containers, virtual machines etc.

These technologies differ in the overhead, the protection they offer, how hard they are to use etc. If any of these technologies are used and which one(s) therefore depends on the actual requirements, i.e. typically a balance between the required security, the needed performance and the amount of money available to implement and run it.

For the usual web application sandboxing all the application using seccomp or pledge is in my opinion not that easy. A better and easier separation is probably offered in this case with containers or virtual machines. Also, running known to be problematic steps like image processing in a restricted setup (process with different user, sandbox, container, VM...) separated from the rest of the application will increase the security.

Thus in summary: yes you should probably restrict your web application on the server side to limit the impact of a potential security problem. But if you use process based sandboxing using pledge or seccomp or if you use different technologies or if you combine multiple technologies depends on the actual requirements (security, performance) and limits (money and time available for development and maintenance).


SSRF Through Image Url I am currently studying regarding SSRF. I noticed that an injection vector where SSRF might be present is always parameters that is related to url (Importing image using URL, others). I have encountered a couple of endpoints where request body contains url which is used to import image from the webserver. Something like this:
...&imageUrl=https://companyX.com/image/3123123

I was able to change the imageURL into my own url and upload my own image from my own web server. Is this normally considered as a vulnerability? Or is this just an indicator that a SSRF might be present?

Many websites implement the ability to fetch remote resources that are requested by a user. The presence of this feature alone does not automatically imply that a vulnerability exists. However, it is easy to implement this type of feature insecurely, so it may be worth looking into it during a test.
While you seem to be able to change the URL to your own server, there doesn't seem to be much impact to that (it's not clear from the question alone whether the image is actually downloaded by the server or just used on the frontend). SSRF typically has the most impact when it can be used to hit services that are not normally publicly available, so you would likely need to abuse SSRF for this purpose in order to have it considered an impactful vulnerability.


How vulnerable is connecting Android App to PHP API with prewritten queries I have built a PHP API which queries data from some tables in an online SQL database.
The credentials with which it connects to the database are saved in another file, and are loaded at start. The user with those credentials has SELECT priviledge only. The Android app just connects to the link and gets the data, so the API has no input at all. The queries are prewritten in the PHP script. The data in the database is all public, so if something else that's not in the script is read that's not so much of a problem.

How vulnerable is this setup to SQL Injection? (or other threats)

If there's no user input used to construct the queries, there's no threat of SQL injection.

This is a reasonably good way to go about allowing an Android app to get data from a shared database. The primary thing to think about are denial of service attacks - can one user make repeated calls to the endpoint that bring down the service (and potentially other apps or parts of the app that share the same infrastructure)? Appropriate use of caching and IP throttling will mitigate this for the most part, and monitoring that alerts you when there's an issue will allow you to deal with the rest as needed.

The only other thing I can think are standard generic web application attacks like having debug information turned on (leaking db credentials, filenames, etc. on errors), slowloris, and so on, but these aren't specific to your situation.


Recent hack appends to all javascript files I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it redirects to other websites with promotions. Using find ./ -name "*.js" | xargs grep "adabefbccdbe()" from public_html directory (where adabefbccdbe() is the name of the redirect function) I can detect all of the files that were affected and remove the code. I have issued a support ticket to my hosting provider. When I sftp to my server I can see that all of the files were edited on april 20th, it affected javascript files for wordpress, magento and static websites, however it only affected 7 out of 10 websites on the server.

My question is is there a way to see who and how was able to edit these files? And what can I do to make sure that this would not happen again?

There is a canonical question entitled "How do I deal with a compromised server?". Since you are on a shared host, there are some limitations to what you can do. I still strongly recommend you to read the full accepted answer.

Below I will discuss how this applies to your situation (i.e. on a shared hosting). Quotes are from the mentioned answer.

1. Take your site down.

  Whatever other problems you have, leaving the system connected to the web will only allow the attack to continue.

You can not know for sure that you have removed all infections. At this very moment you might unkowingly be spreading malware to your users!

2. Damage control.

  Change all your passwords for all accounts on all computers that are on the same network as the compromised systems.

  Check your other systems. Pay special attention to other Internet facing services, and to those that hold financial or other commercially sensitive data.

  If the system holds anyone's personal data, immediately inform the person responsible for data protection (if that's not you) and URGE a full disclosure.

3. Try to figure out what happend.

If you just put your site back up as it were, the same thing will just happend again. You need to try to understand what went wrong.

With shared hosting this can be hard, since it is possible that the hackers used an exploit in the server software itself or in some other persons account. You will need to contact your hosting provider and get them to help you with this. It can not be taken for granted that they will cooperate. If they do not, I recommend you to read your contract and possibly contact a lawyer to find out what rights you have.

However, you can examine some things on your own - namely your own site. Go through all the software you run (WordPress, Magento etc). Are you running the latest versions? Are you running any plugins? Are there any known security holes in the versions or plugins you are running? Especially WordPress plugins are frequent offenders when it comes to security.

There is some limited forensics you can do on your own. If you have backups, compare them to see what files have been changed at what time. The injected JavaScript you discovered might not be the only thing the attackers changed. There might have been multiple changes at multiple times (possibly by multiple attackers), so you can not know for sure that the date when the JavaScript files were changed was the date of the initial breach.

Especially if you run a lot of your own code, you might want to do a more detailed pentest to find any vulnerabilities.

4. Consider new hosting.

Especially if the breach was "their fault" or they did not help you to determine the cause of the breach, it might be time to move to new hosting. As others have mentioned, a VPS is more secure but can also require more effort on your part to run.

5. Get your site back up again.

Restore static files from a backup before the breach. Reinstall all software, and only use the latest versions. So dont just copy paste the files from your old vulnerable WordPress installation back up to the server from a backup.

And obviously, fix any problems discovered during step #3.


Rainbow tables (MD5 and SHA-1) with all 8 char combinations Can someone tell me the what length passwords have been hashed, in every possible combination, in rainbow tables?  In MD5 and SHA1.  Including all characters (letters upper and lower case, numbers and symbols).  In other words, is there a table that has every possible combination of 8 characters?  How about 9?

It's doubtful that a rainbow table containing every combination of 8-character passwords exists, because the size of such a rainbow table would be enormous.

Assume (conservatively) that there are 80 different characters that can be used in passwords (i.e. 26 uppercase letters, 26 lowercase letters, 10 digits, and 18 symbols).  This means that there are 1.67*10^15 different combinations of 8-character passwords (80^8).  A SHA1 hash is 160 bits, or 8 bytes.  So, for each password combination, 8 bytes would need to be stored in a SHA1 rainbow table.  So, the total number of bytes that the rainbow table would consume is 1.34*10^16 (8 * 1.67*10^15).  That's over 13,000 terabytes.

You can do similar calculations to estimate how many bytes would be consumed by rainbow tables containing shorter length passwords of every combination:

8 characters: 13,421 TB
7 characters: 167 TB
6 characters: 2.1 TB
5 characters: 26 GB
4 characters: 327 MB


Is CSRF still a relevant attack vector? CSRF was part of older OWASP TOP 10 lists but has been retired "as many frameworks include CSRF defenses, it was found in only 5% of applications".
But even without frameworks doing CSRF defense, I've got the feeling that modern browsers already mitigate the problem. Cookies and headers needed for authentication are not sent by default in cross site requests.

For instance, if an XMLHttpRequest should send cookies, the withcredentials-flag has to be set. And even then, the target server has to implement a CORS header for the request to be successful. At least in Chrome.

So I now wonder, which browsers already implement those counter measures and if they are enough as defense or if we still have to implement CSRF mitigations in our applications.

... if an XMLHttpRequest should send cookies, the withcredentials-flag has to be set. And even then, the target server has to implement a CORS header for the request to be successful. ...  which browsers already implement those counter measures and if they are enough as defense or if we still have to implement CSRF mitigations in our applications.

CORS for XHR is not a new mitigation and it even isn't a mitigation against previously working attacks at all. When XMLHttpRequest was designed no cross-origin requests were possible at all. And only with the introduction of CORS this restrictions was changed and replaced with cross-origin requests controlled by a CORS policy. Thus, all the old browsers which did not implement CORS were not affected by CSRF via XHR in the first place.

Nevertheless, CSRF is still a problem and can still be used the same way as it could in the past. XHR is not needed as a vector for CSRF attacks at all and it did not work in the past anyway. Instead cross-site image includes, cross-site form submits or similar can be used, which still automatically send the necessary credentials and cookies cross-site.  The new samesite attribute for cookies can be used to prevent this but it has to be explicitly set by the application and not all browsers support it yet.

Therefore proper CSRF protection is still needed today.

What happens if CSRF protection is not properly implement can be seen for example by recent news like Hackers Launching Massive Cyber Attack Against 800,000 DrayTek Routers by Exploiting zero-day Vulnerability.


Strength of WEP, WPA and WPA 2 PSK I know there are three method for wifi security. What are the relative strengths of the password encryption in WEP, WPA and WPA2 PSK?

The schemes you mention are protocols for securing 802.11x traffic over wireless networks. They don't mandate how the AP password is encrypted or hashed during storage. However, the security of the protocol does rely on making the key secure.

WEP relies on a broken RC4 implementation and has severe flaws in various aspects of its protocol which make breaking WEP near-trivial. Anyone with a laptop and a $20 wifi antenna can send special de-auth packets, which cause legitimate clients to re-authenticate to the AP. The attacker can then capture the initialization vectors from these re-authentication packets and use them to crack the WEP key in minutes. Due to the severity of the break, WEP is now considered deprecated. See this question for more details on WEP security.
WPA improves upon this, by combining RC4 with TKIP, which helps defend against the IV-based attacks found in WEP. It also improves upon the old handshake mechanism, to make it more resistant to de-auth attacks. Whilst this makes a large improvement, vulnerabilities were found in the way that the protocol worked, allowing an attacker to break TKIP keys in about 15-20 minutes. You can read more about the attack at this other question.
WPA2 closes holes in WPA, and introduces an enhanced version of TKIP, as well as CCMP. The standard also bring support for AES, which provides even further security benefits. At current there are no known generic attacks against WPA2.


SSL cert for securing on-premises IIS web application We have a customer, let's call them ABC123 Ltd,  who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so currently just runs over HTTP.

They now want to implement a web application that will be hosted on-premises under IIS. They will be communicating with this web application using an Android app on tablets, via an IP address and port (the customer has a static external IP).

To secure this traffic using HTTPS what sort of SSL cert is required? As I understand it SSL certs can only be applied to domains, but the domain is hosted by someone else.

We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so currently just runs over HTTP.

Just because it's an information site does not mean it shouldn't be using HTTPS.  There are security and privacy reasons to do so, but there are other reasons as well, including getting referral information from HTTPS pages and not being penalized in Google search results.

  They now want to implement a web application that will be hosted on-premises under IIS. They will be communicating with this web application using an Android app on tablets, via an IP address and port (the customer has a static external IP).

Using an IP makes life more complicated.  As you've seen, it's not a common setup to run TLS without a hostname.  It also reduces operational flexibility - it's much easier to switch traffic to a different server when using DNS, which is something you'd want to do while recovering from a machine failure, or while rolling out a new machine, or doing a canary, or for overriding the app to talk to a development server, or any number of other things.

Since they've already got a domain, they can tack on a subdomain to that if they want, or use a new one for internal traffic.  If you're concerned about making internal IP addresses visible (but not visitable) externally through DNS records, you can add the record only to the LAN DNS server.

Since you control the clients, you may also consider using client certificates to control access to the service.


Does setting a user password on Windows XP help protect against remote exploits compared to no password? In a typical home user situation with a PC connected to the internet via a router, suppose we are not concerned with protecting the machine from people with physical access. Does setting a password on a Windows XP user account help secure the machine from remote exploits? (compared to a passwordless account).

With no password set at all, remote desktop access is (should) not be possible. Are there other attack vectors where having a password reduces risk? In short, what is more secure?

No, there is no additional protection against remote exploits, but you should always set an account password wherever humanly possible, for a whole host of reasons not related to remote code execution bugs.

Remote exploits usually result in code execution, and that code would run under the privilege level of the user that was running the exploited service or application. As such, the password mechanism is entirely bypassed.

This is especially the case for services running under dedicated service accounts, such as NETWORK SERVICE, LOCAL SERVICE, or SYSTEM, which don't technically have passwords in the first place - they have NTLM hashes with random values, and login is disabled for them.

The only protection I can see is in a scenario where a low-privilege user (e.g. a limited or guest account) runs an application that is open to the network, and that application is exploited. From there, a passwordless account is a target for horizontal privilege escalation, or vertical privilege escalation if the account runs as administrator.

All in all, I would suggest that a password is always set on all user accounts, but not for remote exploitation protection reasons. There are so many other reasons to set a password.


One-Time Pad authentication & Information-theoretic security I'm trying to create a "Information Theoretically Secure" cryptosystem, inspired on the One-Time Pad.
Now I'm facing the obstacle of authentication...
How good is this solution (that uses the "Encrypt than MAC" method)? And can this benefit of the "Information Theoretic Security" provided by the OTP?

|| = concatenation

OTPKey = (OTPKeyPartForThePlaintext || OTPKeyPartForTheDigest)
ciphertext = (plaintext XOR OTPKeyPartForThePlaintext)
digest = sha256(OTPKey || ciphertext)
encryptedDigest = (digest XOR OTPKeyPartForTheDigest)
message = (ciphertext || encryptedDigest)

Thank you :)

Author is correct:

  I've already thought about this solution but I think it is vulnerable to known-plaintext attacks... If the plaintext is known, Mallory can hash it and obtain the digest. With (plaintext || digest) he can obtain the whole OTPKey and send to Bob the message he wants.

If Alice sends:

{plaintext} {sha256 of plaintext}
XOR {OTP keystream}

Mallory can intercept this and (knowing the plaintext) calculate

 {ciphertext}
 XOR {plaintext} {sha256 of plaintext}

in order to obtain {OTP keystream}, which allows them to calculate:

 {modified evil message} {sha256 of modified evil message}
 XOR {OTP keystream}

and replace the message with this crafted one.

See the answer to this question: Unconditionally Secure Authentication


iOS/Android authentication and security Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?

Each user will have their own private database on the cloud.  He will have his local couchdb on iOS/Android.  My iOS/Android app will replicate between mobile and the cloud.  Users can also access their data on the cloud from the web.  I am using CouchDB authentication and there is no middle tier.  When a user sign up for a new account, I will create a new database in the cloud with his account name.  I compared Iris Couch and Cloudant and and chose Iris Couch because Cloudant doesn't give me admin privilege to achieve this.

My questions:

Is it a good idea or possible for the iOS/Android/Web client to have admin privilege to create a new database when they sign up for a new user account?  I could hard code the admin username and password on the iOS/Android clients but that feels very wrong.  For the web client, I won't have the option to hard code the admin password at all.  Alternatively, I can setup a new machine in the cloud to monitor _users database changes and create new databases accordingly.
Shall I use the user's credential to replicate between mobile and cloud?
I am using Iris Couch for hosting.  What is the best way to integrate Facebook authentication into my authentication model?  I saw this plugin but does it require my own hosting and making changes to the server?

https://github.com/sander/CouchDB-Facebook-Authentication

Out of curiosity, I also look at Cloudant hosting.  But it doesn't look like I can create CouchDB users and support my database-per-user model.  I don't have admin access to _user database.

No.  You shouldn't hardcode admin credentials into the client code.  Have you considered running a server whose public interface has exactly one operation it supports (create_new_user)?  Or implementing a stored procedure in the database to support this operation (if CouchDB supports stored procedures)?
I don't understand what you are asking here.  Maybe more explanation is needed?
I don't know.

P.S. Since you have 3 questions, I suggest asking them separately.  I think you are more likely to get useful responses that way.


Can virtualization protect me from an infected BIOS? As you know, there are attacks on the firmware of BIOS and HDD. What if I used some kind of VMS, maybe VirtualBox? Will this protect me from an already infected BIOS (and by that, I mean, no one can steal my RSA private keys)? What if I can use the VM from Tails OS that does not touch the HDD? Will that protect me from infected BIOS and HDD so no one will be able to steal my keys using the infected HDD or BIOS?

Virtualization does not protect you when the host system is compromised.

An attacker who controls the host system, controls the execution of the hypervisor which means they control everything which happens in the virtual machine.

In theory... In practice, virtualization is an uncommon scenario for typical malware targets, so you will encounter few malware which contains a payload to attack virtual machines running on the host (although this isn't unheard of).


Is there any way to link two different IPs to eachother by identifying the router they came from? I suspect that an individual is masking his identity when accessing my site by power cycling his modem so his ISP assigns him new IPs.

Is there any way that I could take two different IPs that I suspect of being used by that person and get more information about them such that I can link them to each other?

Obviously they would have the same ISP and be associated with the same rough region, but this obviously isn't sufficient to make a positive ID.

Is there any way to get more specific and somehow link back to the router or anything like that?

Usually, the assigned IPs are in a small pool.

So you'd get 192.168.0.1, 192.168.0.37, 192.168.0.144.

There are several techniques of browser fingerprinting (you can check the EFF site for that). At the lowest level you check the user-agent. Other methods employ Javascript, Java, and Flash.

You could try to set up your website to distribute cookies and see whether they come back to you. Or you could look into supercookies.

More sneakily, you can supply some link to a site external to yours, for example a CDN link to jQuery. Most CDNs allow relaxed syntax for requesting resources, so you can ask, say,

...library.js?v=17a4&os=win7

and it won't appear suspicious. The library.js file will be downloaded and executed from a site that you do not control. Seems legit.

But what you'll be really doing is set up things so that page processing won't proceed until the library is loaded. And that version number is only sent to guys from that specific network. And in the rest of the page you have another resource that needs loading.

Unless the guy also clears the cache, the next time your page loads it won't even ask for that library, or it will satisfy itself with a 304 Not Modified. So an unknown new guy will take say 400 milliseconds from HTML request to tracking resource. A guy with primed cache, even with different IP, will take 150 milliseconds. And you can set up more than one script with this trick.

You know that the guy is the same as before, because no other guy got that specific fake version number '17a4'.

Similarly, you can have several random thumbnails in one page and see whether the client is requesting them all. If some of them aren't requested (which means the client has them in cache), you can look into a database to whom you served that particular, unique combination of thumbnails (or fake ads, for that matter).

In Javascript you can also access local browser storage; you can use that to store what amounts to a "cookie" that will survive cache clearing (but not local storage clearing).


Tamper with post data before it is sent I am currently doing some pentesting for my work (not my job role but i always wanted to learn). I am trying to modify post and get data as it is sent (intercept, tamper), the web app I am trying to modify appears to be some kind of MVC which means I cannot see some of the data unless I am monitoring the traffic (cannot just inspect element).

I am using Kali Linux, I do also have a windows machine which has hackfox on it but sadly this is an alpha build and it does not function with the hackfox application.

currently using webscarab to monitor the traffic.

You're so very close to the name of the Firefox/Iceweasel plugin you need with your question title!

Tamperdata: https://addons.mozilla.org/en-us/firefox/addon/tamper-data/

You could also use one of the Web proxies shipped with Kali, OWASP-ZAP or Burp Suite. You may want to gloss over the manuals for these, but in general you start them up, aim your Firefox/Iceweasel connection at their listening port (typically 127.0.0.1 : 8080) and then they can intercept your traffic and allow you to change post data before it fires.


How to erase as much as possible an SSD without ATA Secure Erase? The question is almost completely answered. However, more details are still needed. See Update 2 down here.

I've learnt that the ATA Secure Erase is uncorrectly implemented in SSDs (sources are down here), but I'm still willing to find a way to erase as much as I can on them.

What I intend to wipe is the whole SDD, which includes:

The cells that users may access
Bad/unmapped/corrupted sectors
The over-provisioned space
The trimmed cells
The Device Configuration Overlay (DCO)
The Host Protected Area (HPA)
And everything I've forgot

I know that encryption is the best way to simulate a limited "Secure Erase", but before doing that for my new datas, I want to at least make a single pass in order to wipe as much as I can of the old ones.

As I know so far:

ATA Secure Erase: Not reliable, still wipe correctly HPA or DCO ?
dban: Do not erase remapped sectors, nor HPA or DCO
nwipe: Same problems as dban since it's a fork
dd: Same as dban and nwipe, but also blocks everytime it meets a bad sector
shred: Recommended for files, works like dban, may have issues with SSDs
badblocks -w : Should check every sectors destructively, is it correctly implemented for SSDs ?

For now, the best I can do is a badblock -w.

So the question is: What tools can I use in order to erase data as much as possible on an SSD ?

The idea is, based on information I may not know -yet- but you do, to find the most suitable tool listed here, or any other tools not listed here.

Also, anything that may lead to correctly access or/then then delete an SDD's DCO or HPA is ok too.   ->   This was almost completely answered by @guest, but see update 2.

Same goes for remapped/bad/unnmapped sectors, trimmed cells and over-provisioned space.

Destroying the drive is not an option.

Sources:

http://cseweb.ucsd.edu/~swanson/papers/Fast2011SecErase.pdf
http://nvsl.ucsd.edu/index.php?path=projects/sanitize

Update:
badblocks -w may not be reliable (https://lime-technology.com/forum/index.php?topic=23792.0), but I need to dig that up more, unless someone provide an answer here first, which I'm also interested in.

Update 2:

Now, the remaining thing I need to know is: Does the implementation of DCO and HPA respective erasure and disabling is effective -and not badly done like it is for ATA secure erase- ?
Furthermore, a naive question here: Does disabling the HPA means this latter will get erased too ?

PS: Sorry if I don't answer right away, I'm working and travelling around the world -thus making this post related- and I often face time-squeezing business.
But, I will definitely answer back for sure.

I don't know why you say that SSDs implement ATA Security Erase improperly. Modern ones implement it using SED (which uses an encryption key known to the drive and stored in non-volatile memory for all your data, allowing it to simply erase the key to instantly render data unreadable), while others mark all sectors for being TRIMed, which should effectively wipe the data when the garbage collector gets to them. I'm sure there are some out there which improperly implement it (it's not particularly uncommon), but the same applies to hard drives.

It is true that external USB SSDs and HDDs often have problems with ATA Security Erase, but this is due to problems with USB interfaces not playing nicely with the ATA standard. Additionally, USB flash drives (I wouldn't call those "SSDs") don't implement ATA Security Erase, due to having extremely simple firmware and very low-end microcontrollers (compared to SSDs and HDDs, which have very powerful processors, often dual core, sometimes even quad). An SSD is a full computer connected an FTL and an array of flash chips. A flash drive is a microcontroller with flash memory built in.

As for wiping with userspace tools, none of those will affect the DCO, and none of those will directly affect the overprovisioning space. Only using ATA Security Erase will you be able to erase all of that. It's designed to wipe reallocated sectors (as long as they are not too badly damaged), as well as the HPA. The DCO is just configuration data, so it won't contain anything now that it didn't contain when you got it from the store. If you really want to erase it, you can reset it to factory defaults using the Linux hdparm tool, which has a command to restore the DCO.

Note that badblocks -w writes a predictable pattern, and some SSDs will detect this and compress it, resulting in not actually writing the entire thing to the drive. For data destruction purposes, this is next to useless. You will need to write a random pattern to prevent this.

Just use ATA Security Erase. If you know for a fact that your specific SSD firmware has a buggy implementation, and you can't upgrade your firmware to fix it, then use hdparm to send the TRIM command to all sectors, and use dd (or a similar command like ddrescue or dcfldd) to write random data to your drive, and do this several times. Doing it several times is needed not because there is a way to recover deleted data, but because the overprovisioning space cannot be written to in one pass.

You won't be able to wipe completely damaged sectors. If the drive detects that a sector is taking longer than normal to return data, the data being returned doesn't match the internal checksum, or it has to retry too often, then it'll move it to a known-good sector and mark it as bad. It'll do the same if a sector has simply been written to more than a certain number of times (as they fail after a rather predictable number of erase cycles, often around 2000). The drive can be coaxed into manually marking the sector as good again in order to wipe it or put data onto it (which ATA Security Erase does, and which hdparm can do), but that's only if it was marked bad while it was merely losing health. If the sector was so badly damaged that it cannot return any data, and writes stall indefinitely/fail completely, then there's nothing you or the drive can do. The sector is unreachable without you (or an advanced forensic investigator) examining it physically. You can determine if there are any damaged sectors by using the smartmontools package:

# find out how many sectors are reallocated, and how many reallocations occurred
smartctl -a /dev/sda | grep -i reallocated

An example, if you cannot use ATA Security Erase, to wipe /dev/sda as securely as possible:

# find our max sectors (geometry = 91201/255/63, sectors = 1465149168, start = 0)
hdparm -g /dev/sda

# disable the HPA
hdparm -N p1465149168 /dev/sda

# trim every sector in the drive, from 0 to the max
hdparm --trim-sector-ranges 0:1465149168 /dev/sda

# create a crypt device with a random key, and overwrite it a few times
cryptsetup open -M plain -c aes -d /dev/urandom /dev/sda wipe
for i in {0..6}; do dcfldd bs=256k pattern=0$i of=/dev/mapper/wipe; sync; done
cryptsetup close wipe

# restore DCO to factory defaults (this can mess up the SSD, so do it last)
hdparm --dco-restore /dev/sda

But I would still recommend you use ATA Security Erase instead, if you can:

# initiate an ATA Security Erase which can't be disabled until it completes
hdparm --security-set-pass NULL /dev/sda
hdparm --security-erase-enhanced NULL /dev/sda

And next time, encrypt your data!


Is an open source web application server publishing it's version at a public endpoint a security issue? If an open source web application is publishing the version via a public, non-access controlled API/Header, is it considered a security issue?

The premise of the question is that, if a particular version had a vulnerability which was fixed in a later release, attackers could target the vulnerable version if it is public.

This is similar to other web servers (like nginx, express) etc setting a header like X-Powered-By: Express/1.0.

It's generally considered an unnecessary risk, yes. There is no need to make things easy for the automated vuln scanners or worms, much less an intelligent attackers. Legit users have no use for the information, developers / sysadmins can examine the server or connect to some internal-only diagnostic page with more info, and you'll save a smidgen of bandwidth to boot.


What if internal certificate details like CN, Serial Number, validity, CA etc. are shared to external parties from my intranet site? If by mistake I have shared the details like Common Name, Serial number, etc.. of the certificate of my intranet site/server that is not exposed to the internet will it help attackers exploit the system?

Those is publicly available information. They are contained in the certificate and you "leak" them to all clients.

What exactly are you concerned about?

Your certificate is meant to be public.

Edit for the edited question:

Yes, those things can make the life of an attacker easier.

the CN can leak the naming scheme for the network
the CA can leak information on how it can be breached or impersonated
the validity gives a rough time slot for when it will most likely be rolled over.

Yet, for all these informations to be useful, an external attacker would need to have access to your internal network.

Other security measures should prohibit this - and if the attacker has access, the data is again more or less public.

The biggest "leak" from my point of view is the naming scheme of the intranet. That makes the discovery process easier for an attacker.

Yet, nothing to freak out about - especially since the client will probably dispose of the information more or less instantly.


Is using 100,000 iterations of sha256 good enough for password storage? I am creating a web app, and I was wondering if it would be secure to use 100,000 iterations of sha256 for storing passwords? I know that there are algorithms such as scrypt and bcrypt, however, I was wondering if it would be feasible to use 100,000 iterations of sha256 for password storage.

I am a complete newbie, and help would be much appreciated.

To answer the title: no.

Your question's premise is incorrect in the first place. Repeated iterations of SHA256 is not a suitable algorithm for password storage.

You should use Argon2 if your language has an available binding. If you're using PHP you can use the inbuilt password_hash function with the PASSWORD_ARGON2I flag. For .NET applications there's a fully managed implementation available. There's a binding available for Java too. There's a fantastic article from Paragon about storing passwords safely, which has example code for a bunch of languages.

If you absolutely cannot use Argon2, although I see no reason why you couldn't (there are bindings for almost every language now!), then you should use scrypt, bcrypt, or PBKDF2-SHA256, in that order of preference. Again almost every language has bindings or libraries for these.


Can anyone suggest good open source tools for scanning source code for vulnerabilities? I'm particularly looking ones which detect vulnerabilities in C/C++ code.  I've seen a bunch of proprietary tools but no open source ones.

David Wheeler of FlawFinder has a great list of (30) OSS/FS & (14) Proprietary static analysis tools:

http://www.dwheeler.com/flawfinder/#othertools


Did The Wire invent the "Jump 5" cipher? N.B. Asking this here instead of Movies.SE because I'm wanting to know about the cipher itself and any history, which this site is more suitable for.
In S01E05 of The Wire, at around 45:00, it's revealed that:

 the gang that the cops are after encrypt their phone numbers by using a substitution cipher based on the layout of a T9 mobile phone keypad.

In more detail:

Each digit of the number, with the exception of 5 and 0, is replaced with the corresponding digit on the other side of the 5 key ("jump the five''); 5 and 0 are exchanged. Thus, 555-867-5309 becomes 000-243-0751. Devise a one-line statement to encrypt and decrypt numbers encoded in this way.

In the show, this cipher was chosen because it has to be both secure but simple enough for low-level dealers to understand. Is this something that was ever used as a real-life cipher, or anything similar to it, or was it just something devised by the writers?

This is simply a number pad implementation of the plain old original scytale. Using the number 5 key on the pad instead of a rod.
It's a basic substitution cipher.
Was the TV show the first to use the number pad in this way? I cannot answer that. I doubt it.


How does this site uniquely identify a device? First try clicking on the blue button here.

Then if you have a VPN start it up, open the terminal and curl the same link. In the response, you will see that the button is now disabled. The server identified you as having clicked the link already even tho the HTTP headers are mostly different and so is the IP address. Besides, there is no fingerprinting of the device since in with CURL no dependencies are loaded.

How is this even possible?

I can not reproduce any of the behaviour you describe, so this post will be a bit more theoretical in nature.

The ability that you are perplexed by seems to be the ability to recognice the source of a HTTP request even when a VPN is used and a no-features user agent like CURL is used. That would indeed be perplexing.

The super cookies or fingerprinting methods we know of all relies on some kind of feature (like HSTS, Flash, or JavaScript to report screen size or installed fonts). CURL does not support any of those featers, it does not even parse the response for you. So still being able to identify the user would indeed be magic, or at the very least a sign of a faulty VPN.

However, the test you describe in your question does not demonstrate the proposed ability. There are a large number of alternative explanations that you have not yet ruled out. Just to name a few:

The IP of well known VPN:s are listed and blocked.
The IP of the VPN is in a blocked geolocation.
The button is activated by JavaScript, that CURL will not run.
The behaviour is just random.

The test I would do would be to use CURL (with the exact same request) and a VPN for both the first and second attempt, but with different exit nodes, i.e. different IP's. If repeated tests of that kind shoved that some kind of super cookie worked I would indeed be perplexed, but not until then.


Find and kill process that create malicious connections State      Recv-Q Send-Q        Local Address:Port            Peer Address:Port
FIN-WAIT-1 0      3640        my.public.ip.xx:https          xxx.xx.xxx.xx:56206
SYN-SENT   0      1           my.public.ip.xx:55380          suspicious.ip1:9001     users:(("zpanel-cgi",4274,3))
FIN-WAIT-1 0      178         my.public.ip.xx:https          xxx.xx.xxx.xx6:56204
FIN-WAIT-1 0      3640        my.public.ip.xx:https          xxx.xx.xxx.xx:3275
ESTAB      0      304         my.public.ip.xx:ssh            my.local.ip.x:32806    users:(("sshd",13981,3))
FIN-WAIT-1 0      178         my.public.ip.xx:https          xxx.xx.xxx.xx:3263
SYN-SENT   0      1           my.public.ip.xx:42411          suspicious.ip2:whois    users:(("whois",14681,175))
FIN-WAIT-1 0      70          my.public.ip.xx:https          xxx.xx.xxx.xx:56198
ESTAB      0      0           my.public.ip.xx:http           xxx.xx.xxx.xx:7497     users:(("apache2",14594,88))

Hi,
So my server was compromised a while ago and i am trying to rectify the issues.

My server is running Ubuntu 12.04. As you can see from the log above (resulted from command ss -tp), there are two  connections which are aliens (both username cannot be found in the file /etc/passwd

Currently I am using ufw to block all weird incomming/outgoing connections.
My question is how can I fully clear these connections and their parent process/users ?

Nuke it from orbit.  It's the only way to be sure.

Seriously, if you're certain your server has been compromised, the only certain way to clean it up is to wipe it clean and rebuild, this time making sure that whatever vulnerability was used isn't present.

Sure, you could spend time playing whack-a-mole, but how can you be sure that you've removed a file, when the attacker could have patched rm and ls to lie to you?  Replaced ps and top with versions that won't list the attacker's bot?  Replaced ufw to let their connections through without telling you?


Undeletable logging or file-writing I want to log or write files automatically to a un-deletable storage device.

Even if the attacker had offline access to the storage device he/she shouldn't be able to delete the files or logs.

If the data is destroyed or changed I should be able to know.

I'm thinking of physical devices like EEPROM.

The traditional term for this sort of device is WORM drive, where WORM stands for "Write Once, Read Many."  A number of tape-like devices are still available and in use today.  More modern equivalents are DVD-R, CD-R, and specially protected Flash drives.  There are also vendors who have created magnetic (e.g., traditional disk drive) technologies which are write-only, such as GreenTec's WORMdisk.

EEPROM is unlikely to work for you because of the relatively small size and slow speeds.


How to get a 'million rounds of PKCS#8 + PBKDF2' with OpenSSL? I posted this question Is a passphrase-protected SSH private key susceptible to a dictionary attack? a few days back.

An excerpt from the final answer:

  With PKCS#8 + PBKDF2 and one million rounds (OpenSSL would need some
  coaxing to produce that), you gain 20 bits (because 220 is
  approximately equal to one million).

  ...

  The openssl command-line tool does not allow choosing the number of
  iterations -- but OpenSSL, the library, supports it (and so does
  OpenSSH, since OpenSSH uses OpenSSL). Producing the encrypted key file
  would require some programming (calling the library with the
  appropriate parameters).

Now, does anyone know of any pre-existing utility that can accomplish the above? If not, can somebody write such a program and make it publicly available for the good of all... as I'm sure others would find it useful too?

(I am completely new to security, cryptography, key formats and related topics, and am not at all familiar with the source code of OpenSSL, and so, won't be able to make OpenSSL do things that it's not already doing.)

Simplest method is still to patch OpenSSL, namely the command-line tool (not the library). Walk-through (assuming a Linux host):

Download the OpenSSL source code. Take the latest, which the page shows in red (right now, version 1.0.1g).

Unpack it in some directory:

cd /tmp
tar xvzf ~/Downloads/openssl-1.0.1g.tar.gz

Edit the source file /tmp/openssl-1.0.1g/apps/pkcs8.c: search the string "iter" until you want to find these lines:

            else if (!strcmp (*args, "-noiter"))
                    iter = 1;
            else if (!strcmp (*args, "-nocrypt"))
                    nocrypt = 1;

That's line 158 in version 1.0.1g. Edit these lines so that they look like this:

            else if (!strcmp (*args, "-noiter"))
                    iter = 1;
            else if (!strcmp (*args, "-iter"))
                    {
                    if (!args[1]) goto bad;
                    iter = atoi(*(++args));
                    if (iter <= 0) goto bad;
                    }
            else if (!strcmp (*args, "-nocrypt"))
                    nocrypt = 1;

In other words, just add the 6 lines which handle a new command-line argument called "-iter". Save the file.

Then compile the code:

cd /tmp/openssl-1.0.1g
./config --prefix=$HOME/local
make
make test
make install

And voilà! You have a brand new openssl command-line tool and library in the local subdirectory of your home directory (you can put it anywhere you wish with the --prefix option, but writing in your home directory does not need root access and won't interfere with your OS-provided tools). The command-line tool command pkcs8 now has a -iter option which can be use to select the number of iterations:

$HOME/local/bin/openssl genrsa -out rsaraw.pem 2048
$HOME/local/bin/openssl pkcs8 -topk8 -v2 aes128 -iter 1000000 -in rsaraw.pem -out rsapk8.pem

The resulting file can be used with a completely standard OpenSSL or OpenSSH, because the library has always supported PBKDF2 with one million iterations. Here we are just patching the command-line tool to be able to set that iteration count. A look at the resulting object will show that the iteration count was indeed taken into account:

openssl asn1parse -i -in rsapk8.pem

will show something which begins with:

  0:d=0  hl=4 l=1312 cons: SEQUENCE
  4:d=1  hl=2 l=  74 cons:  SEQUENCE
  6:d=2  hl=2 l=   9 prim:   OBJECT            :PBES2
 17:d=2  hl=2 l=  61 cons:   SEQUENCE
 19:d=3  hl=2 l=  28 cons:    SEQUENCE
 21:d=4  hl=2 l=   9 prim:     OBJECT            :PBKDF2
 32:d=4  hl=2 l=  15 cons:     SEQUENCE
 34:d=5  hl=2 l=   8 prim:      OCTET STRING      [HEX DUMP]:A4E21F4F210DEB6F
 44:d=5  hl=2 l=   3 prim:      INTEGER           :0F4240
 49:d=3  hl=2 l=  29 cons:    SEQUENCE
 51:d=4  hl=2 l=   9 prim:     OBJECT            :aes-128-cbc
 62:d=4  hl=2 l=  16 prim:     OCTET STRING      [HEX DUMP]:DAA184B3F6CC303B6A40A131E5C8C451
 80:d=1  hl=4 l=1232 prim:  OCTET STRING      [HEX DUMP]:2C15CF37D5ACC537AA92B
 (...)

See the "0F4240" ? That's one million, in hexadecimal.

The patch is trivial; I will try to submit it to the OpenSSL maintainers.


Bad planning causing weak passwords The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account with a password, so that all programs they register for (now and in the future) will be billed to it. Since everyone is in such a rush I'm sure there's tons of weak passwords. Is this a viable target for an attacker? What could be done differently? Promoting to "register quickly!" is a real bad idea I realized.

There are two strong options:

Strong password requirements. This negates the problem, by forcing the user to use a strong password. It will, however, reduce conversion rates if people get frustrated.
Single sign-on. This involves using a 3rd party service (e.g. Facebook, Twitter, Google, OpenID, etc.) as a login service, meaning you don't actually need to create a new account.

Since the competition is being ran from Facebook, I think a single sign-on is the best choice.

However, please make sure that you're requesting the absolute minimum number of privileges necessary from the user's account. Whenever I use an app that wants to use my Twitter or Facebook account, and it says "Can post Tweets for you" or "Can see your liked pages" when all I want to do is post a comment, I don't bother. It's an unnecessary intrusion.


VPN data encryption from VPN server to destination When we connect to a VPN server, all data that we send and receive are in encrypted form. But when data is sent from the VPN server to the destination, is the data encrypted?
If not then any hacker can sniff the packet and see the details.
Example: connecting to HTTP website using VPN.
So are we compromising privacy using VPN?

But when data is sent from the VPN server to the destination is data encrypted?  ... So are we compromising with privacy using VPN?

A VPN does not compromise your privacy. Instead it reduces the privacy problems (as long as one can trust the VPN provider) but it does not fully solve these.
VPN is used to tunnel through untrusted (privacy implicating) networks and then come out with a different IP address than your original external IP. Nothing more is done. Thus if you don't trust your ISP or your local WiFi Hotspot a VPN will help to tunnel through these. If you want to hide your original IP address from the final server a VPN will help in doing this. But that's all. VPN does not make magically the connection to the final server secure - unless the VPN ends exactly at the server (usually not).


SSL warnings while using Origin Certificate on my VPS I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077.

My URL is like this: https://socket.mydomain.com/

I am getting warning "There are issues with the site's certificate chain (net::ERR_CERT_AUTHORITY_INVALID)." whenever I visit above URL, why? Remember that I am not using old versions of browsers. Tell me what I am doing wrong?

CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not for general usage.

Reference: Introducing CloudFlare Origin CA

If you want a free, publicly trusted certificate, check out Let's Encrypt. (It's a legitimate and widely-used CA.  It's a non-profit founded by the EFF, Mozilla, and several universities and Internet companies.)


Can voice chat be spied? I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but transmitting data.

Comparing with http, is there something like https for voice chat to avoid any possible spying in the middle? Is it practical to encrypt voice data?

At the annual IEEE Security & Privacy conference in 2011, White et al. presented some very involved research on reconstructing encrypted VoIP sessions. The image below shows the overall architecture of the authors' approach.

Although it works only for variable bitrate codecs (most common VoIP codecs are constant bitrate, e.g. G.711), the results are impressive. For details, have a look at the paper.

.


Is there any authentication system whose protocol always notifies the "target account" of impersonation? There are many forms of impersonation:

Sudo in *nix
Application impersonation (send as in Exchange)
Any privileged user (helpdesk) logging in as a user so to not disclose the password
RunAs Administrator in Windows

I'm looking for an authentication system, that itself, defines a sequence of steps to:

Log all valid impersonation attempts
Ensures the display those attempts to the account owner
The account owner either passively accepts, or marks them as suspicious.

In a sense this could be codified as an RFC, similar to how spam UCE is reported, or DMARC reporting.

My goal is to port this logic into a proprietary authentication system, keep the logging format the same, and if possible, track and update the disposition of each attempt.

I'm not trying to rework the wheel here, and think some prior work should exist.

The problem here is that all forms of impersonation are carried out for different reasons:

sudo is normally used to allow a low privilege user to carry out tasks normally requiring higher level privileges
Exchange impersonation can be used to allow any users of any privilege level to send messages as another user, but without allowing other functions of the account
Helpdesk impersonation tends to allow high privilege users (IT staff) to take on the role of lower privilege users (everyone else) for specific purposes (in this case, "privilege" relates only to the system access - not the company hierarchy). However, it can also be used to allow for activity monitoring where there is a suspicion of wrong doing by an employee, for example.
RunAs is essentially the same as sudo in this context

As a result, they all have differing requirements for logging and notification:

sudo: should log the actual user account, and the activities performed
Exchange: probably need to log the original user, but the activities are logged as part of normal usage, and since permission is normally granted by the legitimate user, may have an implicit "this action was performed by the main account holder" status, even if an impersonating user actually performed it. Consider a secretary sending a letter on behalf of a manager - the manager is usually considered to be the "sender", even if they didn't press "send" themselves.
Helpdesk: the impersonation should be logged, but it can be difficult/impossible to log the specific activities performed. For example, they might just be showing a user how to find a dialog within a complex system, where the only method of logging would be noting where mouse clicks were, and potentially taking screenshots at those moments. If the employee is being investigated, notifying them may compromise the investigation.

Due to this problem, it's not really a topic which lends itself to standardization in an RFC - there would be so many exclusions and exceptions that it would be almost worthless, and virtually impossible to build an inter-operable system.

The steps you've outlined wouldn't work for some of the examples you have either:

sudo - who would you notify? The root account? How does anyone access it? Through sudo, in a lot of modern systems!
Exchange - one common use is for people to be able to respond to emails whilst the email recipient is on leave. If they had to get approval for each attempt, that use case falls down. It would be fine for other use cases, such as having one person prepare emails on behalf of another.
Helpdesk - one common use case is to sort issues with logging into accounts. If a user can't log in, they can't accept the impersonation as valid until the issue is


Why does Google Authenticator have different codes on different devices? I just recovered from a headache after realizing the code given by Google Authenticator on my new phone is different than the one on my old phone. Given how it works I thought they would be the same on both phones. How is it possible they aren't? Dropbox needed the code from my old phone even though I got it to give me the QR code to scan into Google Authenticator on my new phone (I think this is a bug in Droboxes design).

You said, you got a new QR setup code? This invalidates the old one, at least with Google itself.

You should have kept the orginal QR setup code somewhere and used that to set up the Google Authenticator app on the new phone too. Then I would expect the display codes the same.

I have done like this on my various accounts with 2FA, and now have setup Google Authenticator on my 3rd phone without any access problems. I do not use Dropbox specifically however.


Create a snort rule that will alert on traffic on ports 443 & 447 Using the learning platform, the subject is snort rules.

Question is:

  Create a snort rule that will alert on traffic with destination ports
  443 and 447.

My attempts:

alert tcp any any -> any 443 447 ( msg:"Sample alert";  sid:1; rev:1; )

alert tcp udp any any -> any 443 447 ( msg:"Sample alert"; sid:1; rev:1; )

My answer is wrong and I cant see why. Any pointers would be very much appreciated.

I had to solve this exact case for Immersive Labs! This is the rule you are looking for:

alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1000001; rev:1; )

Also, I noticed your sid:1. All sid up to 1,000,000 are reserved. So your sid must be at least 1000001.

Note: there must not be any spaces in between each port in the list.


2FA: Difference between Storing Backup Codes & Secret Key First of all, the secret key in discuss is defined as when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually enter into your TOTP-generating device/app.

Some services provide one-time use backup codes for two-factor authentication, for the sake if you lose your code generating device, but some don't provide backup codes. For those services who don't provide backup codes, I tend to store their secret key.

My question is, is it safe to store those secret keys the same way one store backup codes? Is there any differences?

I believe the secret key displayed on screen for user to manually enter are already included in the QR code, and it can be used to entered into any 2FA apps, to make different apps on different devices to generate the same TOTP codes. Please correct me if I am wrong about this.

Yes, anyone who has the secret key can use it to generate one-time passwords for your account. It should be treated in the same way as a password for a site that doesn't have 2FA. It's more secure mostly because the user doesn't get to choose it, and so can't use a weak password or a password they've used on another site.

In particular, I would advise against storing 2FA secret keys in the same place as you store passwords. If you do, then anyone who compromises that store has got both factors. If you use a password manager for your passwords, use a different program for your 2FA codes.


How to securely store and use session IDs I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each).
Given that the session ID is generated with enough entropy and that the session ID is then given to the user via SSL and a Secure, HttpOnly cookie, these are the options I came up with for storing the session ID:

Just store the session ID in plain text in the database or file system

Pros: fast, easy
Cons: any compromised backup or unauthorised access to the database gives access to all active sessions

Give both a session ID and a session key to the user and hash the session key before storing them into the database

Pros: secure both if the user compromises the server and the database
Cons: possibly slow (IIRC cryptographically safe hashing functions are intended to be slow) for something that needs to occur at every request

Create a signed JWT token over that session ID with a secret stored on the server

Pros: probably faster than hashing, bigger tokens (as in length)
Cons: not secure if both the server and database are compromised

What the recommended way to manage and most importantly store sessions?

I think your threat model about a compromised server is a little odd, though I certainly don't fault you for being concerned about leaving secrets and sessions exposed like that. The thing is, if your server and/or database are compromised, sessions will probably be the least of your concerns; the attacker can already view and manipulate all of your data (assuming it's not encrypted with the key stored out of reach). At this point, sessions/secrets may only be marginally useful to the attacker for maintaining access in case they lose their access to the compromised server/database. There's nothing wrong with trying to practice defense in depth and mitigate this threat, but there's definitely a point in which you have to trust something on the server, else you will never get anything done.
My recommendation is to find a framework or library that fits your needs, and most importantly, has already implemented session management securely. Even for someone already well versed in security, there are serious pitfalls that must be avoided when implementing something like this from scratch; it's often better to use a proven implementation.
As pointed out by @JohnWu in the comments, sessions of the length you mention are usually an illusion (although, nothing stops someone from doing it). Typically, sessions have an expiration date, but are continuously refreshed and extended as the user interacts with the service. There is a common paradigm of using both access and refresh tokens (often with JWT) where the access token is short lived, and must be periodically replaced by using the refresh token.


Certificate verification fails for self-signed certificate I'm trying to use a service that uses a self-signed cert.

Download the cert:

# printf QUIT | openssl s_client -connect my-server.net:443 -showcerts 2>/dev/null >  my-server.net.crt

Check that it's self signed (issuer and subject are the same):

# openssl x509 -subject -issuer -noout -in my-server.net.crt
subject=O = Acme Co, CN = Controller Fake Certificate
issuer=O = Acme Co, CN = Controller Fake Certificate

Try to use it with curl's --cacert option:

# curl https://my-server.net  --cacert my-server.net.crt
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I don't understand why curl cannot verify the cert.

From the comments:

  Is this really a CA certificate, i.e. has it basic constrains CA true? ... – Steffen Ullrich
  @SteffenUllrich you're right it has: CA:FALSE – little-dude

Signing a certificate requires that the issuer certificate must have the correct flags so that signing is actually allowed. To correctly sign a certificate the issuer certificate need to have the basic constraints CA set to true. This is true both when signing another certificate as for signing the same certificate (i.e. self-signed). It looks like the certificate had not the correct CA:true flag in the case here.

Moreover, the --cacert option is like its name says only for CA certificates and not for arbitrary certificates. For example if you have the leaf-certificates of a site  you cannot just add is as trusted with --cacert since it is (usually) not a CA certificate. It will simply be ignored when reading the certificates from the given file.


Hooking into firefox memory I am trying to learn how to hook into the browser memory. The Frida tool is a good start to this. My goal is to extract the client-random, server-random and symmetric session keys established at the end of a TLS handshake. By setting the SSLKEYLOGFILE environment I can extract the client-random and the master key, however it does not output the server-random key.

After going through the source code for Firefox, this can be fixed easily by printing out the server-random key in the function static void ssl3_RecordKeyLog(sslSocket *ss) at <firefox src/security/nss/lib/ssl/ssl3conn.c>

However, this is not a viable solution in my project as it makes deploy-ability poor, i.e. compiling Firefox every time there is a new update is generally not good practice to make changes to browser code and redistribute it.

Is there a better way to do this? More specifically, are any of these two options viable? I do not have much knowledge on the architecture of the browser.

A. Using native C++ calls in a Firefox extension to call this function/any function from the file src/security/nss/lib/ssl/ssl3conn.c.
B. Use a browser hook to call my own code every time this function is called in the browser.

Context: Using the three value of server random, client random and master secret, I want to generate the keyblock which is further used to generate encryption keys used in a TLS session.

I am aware wireshark has this feature, and with minimal change I can output the keys, but I would not like to use wireshark as it is would consume more resources on the host computer for a simple process like key generation.

I can write my own libpcap code to parse through traffic, but I would like to keep this as the last option.

You may want to try this with frida:

import frida
import sys

session = frida.attach("firefox.exe")
script = session.create_script("""
"use strict";
const PR_Read = Module.findExportByName("nss3.dll", "PR_Read");

Interceptor.attach(PR_Read, {
    onEnter: function (args) {
        let length = args[2].toInt32();
        let buffer = Memory.readByteArray(args[1], length - 1);
        console.log(buffer);
    }
});
""")

script.load()
sys.stdin.read()

Note that I haven't tried this code, but as you seem to have managed to get the client-random and the master key, with PR_Write (which is what firefox outputs), you probably will get the server random with PR_Read (which is what the server responds).

Sources:

https://wiremask.eu/articles/hooking-firefox-with-frida/
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/PR_Read
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/PR_Write

How I found that:

looked at the page you linked.
found that the way to get what firefox output is using PR_Write
looked at what the function is on MDN
guessed that if there's a write, there might be a read
searched PR_Read on MDN
found it has the same signature as PR_Write
replaced PR_Write with PR_Read
if the signature was different, I might have had to change some more things around (like the args[])


SQL Injection with long data type All the examples of an SQL injections that I've seen have a user controlled string variable that was directly used to construct the SQL query but, I was wondering if it's possible to perform an SQL injection provided that the variable userNumber is a long and is user-controlled in the following query.
sqlQuery='SELECT * FROM custTable WHERE UserNumber=' + UserNumber;

I understand that using a parameterized query is the best option to prevent an SQL injection attack but I'm asking this out of curiosity.

The result will rely mostly on how your backend (application code not DB) behaves.
If the application cast()  or rejects everything but longs  (or ints or whatever numeric types) there is simply no chance you can conduct a successful injection.
If your application doesn't sanitize user input your example could be SQL injectable:
sqlQuery='SELECT * FROM custTable WHERE UserNumber=' + 22 UNION SELECT ...;