What are BitLocker requirements against computer theft? I'm using Windows 10 Pro edition and took the following actions:

I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer.
I've also set a Windows password and I have no guest account on my computer.
I lock my session with Windows + L as soon as I leave my computer unattended.

I've read this as I was wondering about the point of TPM-based BitLocker if the disk gets decrypted automatically at boot time.

My main concern is about random computer loss or theft leading to data unauthorized access, not NSA-proof protection. Do I need to set up or config anything else?

The benefit of having Bitlocker with a TPM in that scenario is that the hard drive is encrypted at rest. If the computer is stolen, for the thief to get any benefit, it would have to be stolen while the computer was turned on, with the password or key entered at boot time. But if the computer was turned off at the time it was stolen, there would be no use sticking in a USB with its own OS on it and trying to read the hard drive, because the hard drive is encrypted. The only other avenues of attack might be for the thief to guess the password, or steal the bootup key (plausible if the rightful owner stored the bootup key on a USB stick in the laptop case), or possibly a direct attack on the TPM hardware.


How to directly connect to devices behind NAT from the internet? We have an IP address on the global internet: "A"

We only have access to "A".

We have a network behind a router that does NAT: 192.168.1.0/24

There is a client behind that NAT: "B"

We don't have access to "B" and the "NAT" router.

Goal: reach the "B" directly with "A".

We cannot use port forwarding or UPnP, etc.

Question: what is the trick to reach "B"? A trick that could be avoided if the router had a stateful firewall, not just NAT!

We are thinking that when "B" browses the web, it will go out to the internet. When it is receiving replies, the router that does the NAT needs to decide which NATed IP did "B" have? (there could be more machines behind the NATed network). For this the NAT router uses the port information too. Maybe if we/they are using UDP, we can try all non-privileged ports with the IP "A" to send a packet to "B"?

The NAT router is just a simply soho router. (original problem: trying to prove that NAT is not a firewall, but we need an evidence for it)

In a simple answer (if I'm understanding this correctly), yes. You can accomplish this by utilizing reverse SSH tunneling.

You'll need to setup the tunnel on "B" first utilizing socks proxying (can be done through Putty), then you'll need to route your traffic through "A" for the requests.

When the responses return, they'll be directed through "A", back to "B"; esentially reaching "B directly with A".

Here are some additional resources for accomplishing this:
http://www.thegeekstuff.com/2013/11/reverse-ssh-tunnel
https://unix.stackexchange.com/questions/46235/how-does-reverse-ssh-tunneling-work


OpenSSL PKCS#7 vs. S/MIME OpenSSL 1.0.1c onwards seems to offer CMS support. I have difficulty understanding the difference between smime and pkcs7. S/MIME specs are layered on PKCS#7 (so says Wikipedia).

Now in openssl I have the following commands:

openssl smime

openssl cms

Are these equivalent commands ? Why then have two implementations ?
When should either be used ?

PKCS#7 is an old standard from RSA Labs, published later on as an "informational RFC". Then, a new versions was produced, as an "Internet standard", i.e. with the seal of approval from the powers-that-be at IETF; a new name was invented for that: CMS. Newer versions were subsequently defined: RFC 3369, RFC 3852, RFC 5652. You can consider CMS and PKCS#7 to both designate the same standard, which has several versions.

CMS (PKCS#7) is a format for applying encryption, signatures and/or integrity checks on arbitrary binary messages (which can be large). It can be nested. It is the basis for some protocols such as time stamping. It is also frequently (ab)used as a container for X.509 certificates: the SignedData type includes a field for a set of signatures (and that set can be empty), and also a field to store arbitrary X.509 certificates which are considered as "potentially useful" for whoever processes the object.

CMS is nominally backward compatible: there are version fields at various places, and a library which understands a version of CMS should be able to process messages from older versions; moreover, such a library should also produce messages which are compatible with other versions, inasmuch as it is feasible given the message contents. See section 5.1 for an example: the "version" fields are set to the minimal values which still make sense given what else is in the structure.

S/MIME is a protocol for doing "secure emails". S/MIME uses CMS for the cryptographic parts; what S/MIME adds over CMS is the following:

Rules for encoding CMS objects (which are binary) into something which can travel unscathed in emails (which are text-based). These rules build on MIME, so basically Base64 with some headers.
Canonicalization rules for signed but not encrypted emails, with "detached signatures". When an email is just signed, and the recipient might not be S/MIME-aware, it is convenient to send the signature as a CMS SignedData object which does not contain the email data itself; the signature is joined to the email as an attachment. It is then important to define exactly how the email contents are to be encoded into a sequence of bytes for the purpose of signature verification (a single mis-encoded bit would imply verification failure).
Restrictions and usage practices on the actual CMS objects: how much nesting is allowed, what types may appear...
Some extra attributes so that a sender may publish, in his signed messages, what kinds of cryptographic algorithms it supports and similar metadata.

In a way, we can think of S/MIME as the glue between CMS and emails.

OpenSSL is a library which implements some protocols, including some versions of PKCS#7 and CMS and S/MIME. The library also comes with command-line tools which expose, as a command-line interface, some functionalities of the library. The tools won't support anything that the library does not implement (the contrary would be surprising, to say the least), but the converse is not true: the library may implement features to which the command-line tools give no easy access, or no access at all.

Generally speaking, the command-line tools are not very "serious". They are convenient for some manual operations or a few scripts, but for robust applications you should use the library directly (it is a C library, but bindings exist for many programming languages).

Among the command line tools are the subcommands pkcs7, cms and smime. Confusingly, the cms command is meant to be used for S/MIME, and supports S/MIME, and turns out to be usable as a "generic" CMS support tool only as a byproduct. The OpenSSL developers created the new command cms in order to support recent versions of S/MIME (and CMS) because they felt that they could not update the smime command without breaking interface compatibility: third-party scripts using openssl smime would have become invalid, if the parameters for that command has been adjusted to account for newer S/MIME versions. So they just created a new command, called cms.

Theoretically, you should use openssl cms for everything related to S/MIME; but since that command gives access to the OpenSSL support code for the "new" versions of S/MIME and CMS, it necessarily allows you to produce S/MIME messages which are perfectly valid but use features that older implementations of S/MIME might not support. This is summarily described in the man page. Extensive tests with other S/MIME implementations (e.g. Thunderbird, Outlook...) are needed to know exactly what you can do with S/MIME without making your emails unreadable by other people.


Is there a downside to using a Ledger Nano S or X as both a crypto wallet and a 2FA key? Newbie question, I guess. I want to get a cold wallet for increased security. I also want to start using hardware 2FA (e.g. for e-mail). I see that Ledger advertises 2FA capabilities ('FIDO U2F') on their Nano range. Is there a downside to e.g. buying a Nano X and using it for these two totally different functionalities? If so, what is a better option?

Short answer: yes and no.

If you're regularly inserting the device into a USB port for non-wallet purposes, it's not quite as "cold" as it would be otherwise, so there's a non-zero hypothetical risk increase, but ...

The frequency with which you have to insert your U2F device should be relatively low for most web applications (you're generally only prompted for the key when you're either logging in from a "new" device, or if you're doing something security-sensitive like changing your password, changing U2F keys, etc.)

A potential compromise: acquire an additional inexpensive U2F key, and use that as your "daily driver" (though it will probably be used much less often than that). This allows you to minimize non-wallet use of the wallet, but still have the wallet available as a second factor in an emergency, etc.


Steganography concept - How to check my implementation? I have written my own software to do Steganography. Basically, I am dividing the message (text) into bits and then hide them into pixels in jpg. After that I am saving the bitmap into .png (because .jpg's conversion may destroy the hidden message).

I would like to test my software. Do you know any framework that may find my text hidden in the image file? Or even if such a framework will be able to detect the fact of hidden message?
I am wondering what is the ideal implementation of steganography for images?
I would like to master it. I have written my code just with my knowledge and my ideas, without looking into any theories. After speaking with my professor, he suggested that others may have implemented the same idea, and there may be some ways to make it better. Does anyone have some suggestions for me? Any name of concepts? Any algorithm names? Any papers?

To test your software you need to be able to recover your hidden message.  The essence of an effective steganographic method is that it be consistently reversible.  You should be able to remove the masking image in your case.

This answer on detecting steganography may provide some insight into testing approaches:

  To detect Steganography it really comes down to statistical analysis
  (not a subject I know very well).    But here are a few pages that may
  help you out.

  Steganography Countermeasures and detection

  Wikipedia page worth a read to cover the basics.

  An Overview of Steganography for the Computer Forensics Examiner - Has
  quite a long list of tools and some other useful information.
  Steganography Detection - Some
  more information about Stegonography.
  Steganography Detection with Stegdetect - Stegdetect is an
  automated tool for detecting steganographic content in images. It is
  capable of detecting several different steganographic methods to embed
  hidden information in JPEG images. Tool hasn't been updated in quite a
  while but it was the best looking free tool I could find with a quick
  search.

SOURCE: https://security.stackexchange.com/a/2145

There are a few common strategies for performing steganography:

Least significant bit insertion
Masking and filtering
Algorithms and transformations: taking advantage of the native format's own compression algorithms

SOURCE: http://www.infosyssec.com/infosyssec/Steganography/techniques.htm

There are several papers on this topic including Hussain, Mehdi, Mureed Hussain, A Survey of Image Steganography Techniques which discusses different techniques and introduces terminology:

  Cover-Image: Original image which is used as a carrier for hidden information.
  Message: Actual information which is used to hide into images. Message could be a plain text or some other image.
  Stego-Image: After embedding message into cover image is known as stego-image.
  Stego-Key: A key is used for embedding or extracting the messages from cover-images and stego-images


Does a dead person's SSN, etc need to be protected? My parents died 10 years ago.  I was the executor.  The final return, etc was filed, no problems. I still have all their tax and financial records, which I'd like to get rid of.  I believe I've extracted anything referring to myself or my siblings.

Question: can I just throw this stuff out without shredding?  There's kind of a lot, so it would be a pain to run it all through our shredder.

(NB: I'm not sure if this is the right venue for questions about paper.  If not, feel free to toss this.)

I think the answer is "no".  You are technically a third party who holds the documents, and the SSA website says you need to retain the records for two years after death, and destroy the records after they are no longer needed.  It doesn't appear to list exceptions to the destruction rule for a deceased persons' records.


Could antivirus programs not just scan all files upon creation? Could antivirus programs not just scan all files as they are created instead of using on access scanning. Would this kind of approach not be much more scure?

No, scanning for viruses only at creation time is not secure for several reasons:

Anti-virus heuristics and signatures update continuously, so something could be missed upon creation but would be caught at execution time.
The anti-virus system might not be loaded when the file is created:

Perhaps A/V was temporarily disabled for some reason
Perhaps it is a removable drive and the file was created elsewhere
Perhaps the system was booted into another operating system

Does "creation time" include modifications?
What about code executed in-line that is never created as a file?

There are also more complicated scenarios.  For example:  You get an encrypted payload (containing the virus).  A/V can't detect this because it cannot decrypt it.  Much later, you have a second file arrive.  This file isn't technically malicious, but it does decrypt the first file, which then runs and infects your system.  This is an increasingly common trick for avoiding detection in both traditional A/V as well as malware sandboxes like FireEye.

A system that hashes files and checks those hashes against an up-to-date file reputation service would only have to scan unknown hashes.  Cloud sandbox systems like Cisco AMP do this.


sudo whitelist just program perl In visudo Ubuntu I whitelist this program

myuser ALL=(root) NOPASSWD:/myuser/program.pl

when I run

sudo /myuser/program.pl

I get prompt to set password. The solution is to add to visudo /usr/bin/perl

myuser ALL=(root) NOPASSWD:/myuser/program.pl,/usr/bin/perl

Now I can run without asking the password.

Here is the problem; when I run my web service system with the user as myuser
the web service can run any commands as /usr/bin/perl for example

/usr/bin/sudo  /usr/bin/perl -e 'system ("cat /etc/shadow");'

Is my assertion correct?
What is the solution to this problem?

To solve this issue you need to modify this line:
myuser ALL=(root) NOPASSWD:/myuser/program.pl,/usr/bin/perl
Into this one:
myuser ALL=(root) NOPASSWD:/usr/bin/perl /myuser/program.pl


Secure TCP traffic for inter process communication I have several processes running on a system that interact with each other by TCP (eg. with the asynchronous messaging protocol by twisted).

process1 <=====> broker <=====> process2

There is one server instance (broker) running on a linux host, that listens to a TCP socket localhost:port. There are also some other processes, running on the same host, which query the broker instance by using the socket via TCP (given by twisted). The broker has access to a hardware security module (HSM).

I'm currently thinking about the security aspects of this design. Would it be possible for an eavesdropper, who has direct physical access to the host, to listen to the TCP traffic between the clients and the broker on this host? Since sometimes sensitive data is being transferred, I want to secure the communication between the processes and broker on the host.

How can this be done? There is always the problem of storing a private secret. For the broker its no problem because it has access to HSM, but for the client-processes which interact with the broker. Its hard to hide a secret for an attacker which has physical access to the host. How can authentication/encryption between processes and broker be realised?

Hope you understand my problem and can help me!

EDIT: SSL/TLS wouldn't be a good approach, since it comes with high overhead and there also exists the problem of secure storage for private secret.

If you want to restrict inter process communication on a machine, I'd suggest doing away with TCP and instead uses Unix domain socket. Unix domain socket can be used exactly the same way as TCP (it's a bidirectional socket), but it creates a socket file instead of listening on a TCP port. You can control permission on the socket file using standard filesystem permissions. Twisted supports Unix domain socket.

If you really have to use TCP, then you can use SSL without encryption. By default, the eNULL cipher and aNULL authentication is not permitted in OpenSSL, but you can explicitly request for it. I personally would not recommend this.

You may also have some luck defining iptable rule that restricts how processes can connect to some TCP port.

On the whole though, trying to defend against someone with unrestricted root/physical access to your machine is a futile effort, and encryption for inter process communication within the same machine is rather silly but it's fairly harmless.


Is Apple Face ID a good security feature? This paper demonstrates how face liveness detection could be easily defeated by virtual models built from your public photos.

If you consider the instagram/snapchat phenomenon where users post selfies and front-facing videos on a daily basis + the rapid improvement of optical sensors (even on the cheapest smartphones), wouldn't be risky to Apple make Face ID a primary authentication method?

All security mechanisms feature a trade-off between usuability and security and I don't think that FaceID will be any different in this regard.

One of Apple's original motivations in introducing TouchID was to get iOS users who had no PIN code set at all, to use some form of security mechanism on their device.  This would obviously only work if the mechanism had good usuability, which TouchID does.

As to the specific threat you mention about creation of models, from technical information revealed by Apple so far, they appear to be using 3D mapping techniques combined with motion detection to identify the user (there has been mention that it won't work when your eyes are closed, for example).

So to copy that a full 3D model of the user would be needed and that model would need to emulate the users liveness to some degree.

So that's obviously a theoretical possibility, but the question is what level of effort would be needed for an attacker to pull this off, and whether that's a reasonable security/usuability trade-off for most iPhone users.

I'd suggest that if we're at "create an accurate 3D animatronic head to crack" that's not an unreasonable level of security for most users, if it has good usability (to quote @avid's rule of security "Security at the expense of usability, comes at the expense of security.")

If however when it's released, it turns out there's some simpler way of faking it out, that might be more of a concern.

Having seen Windows Hello in action, I'll be more interested to see what the False Rejection Rate is like with this.  Hello is great in fairly static settings, but not so good outdoors with things like hats and sunglasses coming into play.


How many characters should a session key be? I have a session key generator that uses only letters and number.  I've looked up how long a session key should be here:

https://www.owasp.org/index.php/Insufficient_Session-ID_Length

and by some forms of logic, it would say 20 characters at 8 bytes each is 160bits... more than enough.  I read somewhere that 80 is the minimum, which would be 10 characters.

But, as I'm only using numbers and letter that means that the possible permutations are log(2, (52 + 10) ^ 20) ~= 119 bits (52 chars + 10 nums).

So given the 128 bit key should take 292 years to guess (cited above), and mine is 9 bits less, it should take 292 / (2^9) = .57 years to guess.. I think.

This is what I think the answer to my question is:

If using all 256 utf-8 characters, 16 characters is enough to get 128 bits (recommended) and 10 is enough to get 80 bits (min).

If only using specific characters use the following function to calculate your bits and increase charCount until it's at the desired strength.  log(2, (useableChars) ^ charCount)

As Peter Harmann says, you really mean log2(x) rather than pow(2, x), besides that your formula is correct. The real error however is that you misinterpret your citation:

  Now assume a 128 bit session identifier that provides 64 bits of entropy. With a very large web site, an attacker might try 10,000 guesses per second with 100,000 valid session identifiers available to be guessed. Given these assumptions, the expected time for an attacker to successfully guess a valid session identifier is greater than 292 years.

You misinterpreted that as 128 bits of entropy, but it's only 64 bits (i.e. it's 64 bits in hexadecimal).


Why was WPS not patched to make it secure? A flaw in WPS is that you can crack each half of the 8 numerical digits independently (2x 4 numerical digits are much easier than 1x 8 numerical digits).

However, since the flaw was discovered, why not apply a patch and only send a response if and only if the client has the whole password right? Implement a time-out and your router is secure for the next 1,000 years.

But why is the hole still open?

Ask the WiFi Alliance.

It's probably the same reason the glaringly-obvious security hole was put in there in the first place.  The people making decisions for WPS standard apparently do not care about security (or are mindbogglingly incompetent).  Any freshman CS student giving it the least bit of thought will know its a mistake to check whether half of a password works and differentiate between which half failed in your response as described in your standard (so you don't even need to do a timing attack to differentiate the two cases).  The only reason it was not immediately obvious to everyone when WPS-enabled routers first came out is that the standard documenting how WPS works is not free ($100) if you aren't a member (and membership costs a company $15k/year).

Granted, I believe many (most?) hardware manufacturers tried to patch WPS by just rate-limiting the number of bad attempts per second -- granted rate-limiting doesn't help much when you only need at most 11000 attempts to break a WPS pin (on average half of that).  At the same time, presumably legitimate users may want to use this WPS feature, so they probably can't rate limit too severely and you can possibly get around the rate-limit by frequently changing your MAC address.  WPS was a bad idea which became much worse with their actual severely flawed implementation.


Optimal variable sizes in the Secure Remote Password protocol I am implementing the Secure Remote Password protocol:

  U = <username>              -->
                                 <--    s = <salt from passwd file>
  a = random()
  A = g^a % N                 -->
                                     v = <stored password verifier>
                                     b = random()
                              <--    B = (v + g^b) % N
  p = <raw password>
  x = SHA(s | SHA(U | ":" | p))

  S = (B - g^x) ^ (a + u * x) % N    S = (A * v^u) ^ b % N
  K = SHA_Interleave(S)              K = SHA_Interleave(S)

What size of numbers should I be setting for all the variables?  RFC 2945 recommended that u be 32-bit but no lower.  N is 4096-bit, g = 2.

My aim is to maximize security without any unnecessary expense.  How big should s, a, b and u be?
Last but not least, what is the optimal length for the session key K, which will be used by an AES cipher?

Edit: SHA_Interleave(S) returns the SHA hash of every other byte concatenated with the SHA hash of the remaining bytes, thus doubling the length pf the result.  Would SHA256 suffice?  What size key am I after for AES?

RFC 5054 has a bit more precise recommendations. To be coherent, one must try to achieve a given "security goal" expressed in bits as a parameter t: namely, that the system is secure against attacks which have a computing power up to 2t elementary operations. The traditional value for t was 80 bits, but advances in technology make available computing power uncomfortably close to that limit. Since cryptographers just love powers of 2, it is now customary to use 128 bits as security goal. Even with an over-optimistic estimate of how long Moore's law will keep on and what it means, 128 bits are still safe for at least the next 40 or 50 years, and beyond that predictions are rather meaningless.

To get t bits of security, you should have the following:

The Diffie-Hellman private elements (here a and b) should have size at least 2t bits (hence 256 bits -- that's what RFC 5054 recommends, by the way).
The involved hash functions should have output size at least 2t bits in all generality, also shorter output size are tolerable in many cases (2t bits of output are about having 2t resistance to collisions, but in many cases collisions are not an issue, we just want 2t resistance to preimages, and for that t output bits suffice).
Symmetric encryption keys and MAC keys should have length at least t bits (and AES can work with 128-bit keys).
Ideally, salts should have length 2t bits so that risks of having a collision (two identical salts for distinct users) are lower than 2-t, but you can have shorter salts because the server can control how many users it may have, and it will certainly be much slower than 2128 (here, we are talking about the computing power of the server, not the computing power of the attacker).
The value u, as an online challenge, should have length t bits, but there again, a shorter value is perfectly tolerable because the size of u can be exploited only in online attacks: with a 32-bit u, an attacker has a 1 in 4 billions chance of pulling off an impersonating attack, but every failure is visible to the client and server. There again, the server will have some trouble serving billions of requests in a short time, and will certainly not do it discretely. Also, the attacker could also try to guess the password itself, under the same online-check conditions, so it is rather meaningless to have a u longer than the expected average password entropy -- and 32 bits of password entropy are already an optimistic figure.
n (the prime number) should be large enough that discrete logarithm modulo n has difficult at least 2t. Such "difficulty" is hard to estimate since it works on costs which are of distinct nature than what is used to, e.g., break symmetric encryption. Nevertheless, there are tentatives. 4096 bits are quite an overkill; I would personally be quite happy with 2048 bits.

SRP results in a shared secret value S, which is then extended into symmetric key material through a Key Derivation Function. SHA_Interleave() is a proposal for such a KDF. In RFC 5054, the KDF defined in TLS is used instead (under the name "pseudorandom function"). For proper data tunneling, you will want four 128-bit symmetric keys: an encryption key and an integrity check key in both directions. If you use a combined encryption-and-integrity mode, then you only need two 128-bit symmetric keys (one in each direction).

This really looks like you are reinventing TLS with SRP, something which is hard to get right at so many levels that you really should use the genuine TLS instead.


Does VPN remote port forwarding compromise the anonymity of the VPN user? An anonymous VPN service will typically assign the same public IP address to many VPN users.  This procedure ensures that a connection cannot be traced back to the VPN subscriber: behind the veil of the VPN’s public IP are perhaps hundreds of potential clients.  This statement assumes the VPN provider does not keep any logs, and assumes the trace occurs after the connection has terminated.  The VPN provider’s entire scope of knowledge is limited to a subscriber’s credentials.

Some VPN providers offer a service known as remote port forwarding.  Some providers claim it is a way to operate a server behind the VPN, or forward traffic for BitTorrent.  The remote port forward will pass inbound connections into the VPN’s public IP onto the VPN subscriber that requested the port forward.  The VPN provider’s scope of knowledge now includes a link tying a specific port to a specific subscriber.

Doesn’t this practice eviscerate the point of a shared-IP system, wherein multiple subscribers are assigned the same public IP to promote anonymity?

This DMCA takedown notice was sent to a popular anonymous VPN service, and their response is indicated at the bottom of the page.  The VPN provider reset port forwards pertaining to this particular notice, while also claiming that nothing could identify a single account.  How can this be true?  A basic tenant of port forwarding is that the port must be unique.  Multiple users cannot share the same port forward rule on the same public IP.  Even if the provider’s port forwarding rule list is “provider wide” as opposed to “server wide,” what are the odds that multiple subscribers happen to be forwarding the same port out of a range of over 65,000 available ports?

Perhaps there is no rule list at all; perhaps the port forward instruction is coming from the subscriber’s client when it connects to the service, and upon disconnect there is no evidence remaining that the port forward existed.  Even if this is true, the purpose of port forwarding is often to engage in serving content.  Web servers, FTP servers, p2p, torrent seeding, etc.  All these activities are typically best served with maximum uptime.  The subscriber is likely not disconnecting their VPN session regularly, instead they are keeping the connection alive as long as possible.  Perhaps for weeks or months at a time.  The VPN provider’s knowledge, while a port-forwarding subscriber is connected, now includes a VPN IP to subscriber IP relationship, due to the port forwarding rule.  This pierces the VPN veil and singles out a specific subscriber (worse – their public IP as well).

How, then, can anonymous VPN providers offer this service and yet promote anonymity?  Is it possible to remain anonymous while utilizing a VPN’s remote port forward service?

VPN providers surely keep track of your connections to their services.
They probably don't track your trafic inside the tunnel, giving you the anonymity.

Remote port forwarding only applies for incoming external connections and therefore doesn't remove your anonymity for your outgoing trafic.

But, if you use remote port forwarding to handle illegal connections (like allowing remote peers to connect to your local, illegal, server/service), then, as the "remote port forwarding" is statically assigned to you, if authorities ask the VPN provider about your informations ("who is using the remote port forwarding XXXX ?"), they will be able to provide them.

Check the privacy policies of your VPN provider to ensure that they will keep your informations private, even if you do illegal stuff. I'm quite sure it will not be the case, as they won't want to endorse your responsibility.


How to trace location where MITM is occurring? My computer has been a target of a Man-in-the-Middle attack.  When I am using the same site for more than 5-10 minutes, occasionally that website gets replaced by a compromised website for a couple hours.  Since I am using HTTPS, I immediately detect the attack, since the certificate is suddenly self-signed-- and I avoid sending sensitive data; however, the attacks have been getting more sophisticated lately.  Furthermore, I need to be able to continue my work-- I need to be able to connect to the original website somehow.

One odd thing is, that this attack is browser-specific.  For example, when eBay.com has been compromised on Firefox, it continues working on Opera.  However, after 5 minutes of working on Opera, it is compromised there too; but switching to IE allows me to continue working for another 15-20 minutes.  It is never compromised when I am accessing it via command line (presumably to prevent me from using tools such as tracert).

I have been able to obtain my system administrator's password, and admittedly it is only a moderately strong password; and, the router allows remote control; so possibly, the router has been hacked.  I can change the router password; but first, I would like to confirm where the attack is coming from.  Because if I don't, and the attacker detects my attempts to thwart him, then he can stop for a time, to make me think I've found where the problem is coming from, when I actually haven't.

Before entering any type of passwords, you need a secure system to safely diagnose what is happening.  If you have another machine or a Live DVD or USB drive of a Linux distribution like Linux Mint or Ubuntu to boot up on your current system, or another system on the same network start there.

This will help determine if you have some sort of malware or backdoor on the system you were experiencing this on.  If you are able to use another known clean/secure system and none of the symptoms occur, then you know your computer is affected locally on the operating system running.  If on the other hand, any system in your network is getting re-routed, then yes, it's possible your router is compromised too.

What are the details of the system you are using?  Is it on a domain with a Windows Server?


Extract cookies from pcap Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files).

I know I can open it in wireshark but it will take a while until I find the domain I am interested into and the cookies (is there a filter I can use ?)

Thanks

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies.

You should be able to match against http.cookie as a string according to the filters protocol reference: http://www.wireshark.org/docs/dfref/h/http.html

Some more general information about filter syntax (including operators) is here:
http://wiki.wireshark.org/DisplayFilters

I'd fire up Wireshark on your pcap and use Find Packet with a known string and then use the right click menus to have Wireshark craft the filter for you (as described some in the manual section 6.2.2. Pop-up menu of the "Packet List" pane at http://www.wireshark.org/docs/wsug_html_chunked/ChWorkDisplayPopUpSection.html

You can then use that filter (copy and paste) in a console with tshark to rapidly search large pcaps or script the searches trivially.


PGP on Dark Net Markets: What threats does it control? Most Dark Net Markets (Agora, Nucleus, etc.) recommend that customers use PGP when communicating with vendors, particularly when sending their address. The vendor's public key is presented publicly on their DNM profile.

What threats does this control? And to what extent? For example:

Compromised marketplace
Compromised seller account

As always in information security, different scenarios and attack vectors must be considered.

New Communication

Encryption with unverified keys taken from the marketplace can definitely not protect against a compromised marketplace -- obviously, in a compromised marketplace, the keys could have been exchanged. You might realize when keys change for the same seller, though. Pretty much the same applies to a compromised seller account, where the key could be changed to one in control of the attacker.

In the end, there is not a lot of protection when the marketplace or an account on there is compromised, especially if you get in touch with the other side for the first time.

It might help, though if there's a problem in-between, during transmission, when the attacker has no control over the listed keys. For example unencrypted data sent by accident or software issues, or other problems with the transport security, when the message's contents are still encrypted themselves.

Old (Earlier) Communication

More important, message encryption will make old communication safer. Whoever gets hold of the encrypted messages because the seller's account or whole marketplace was compromised, will not be able to read the message's plain text. Depending on the security measures taken by the recipient (like offline keys, and passphrases to encrypt the keys), even a compromised or seized computer will not reveal the message's contents.

Adding Signatures

Finally, this might not only help at securing privacy of the communication, but also assure the identities of the communication partners if signatures are used. Given an account is compromised after some time, you would not be able to realize this. If messages are not only encrypted, but also signed, you could realize the sender is somebody else -- everybody could encrypt using your public key, but as long as the real account owner's key was not compromised, they cannot impersonate him.


What can someone do with (non-admin) command prompt on a network? Say that an organization has a closed network - only its own computers can access it. Each of these computers has Windows 10 Enterprise. For obvious reasons, users aren't given administrator privileges. Anyone within the organization can easily get physical access to one of these devices. The organization is large enough (think university or big corporation) that users shouldn't be trusted.

What are the advantages of blocking cmd.exe? That is, what could a user do (bypassing filters, infecting other devices, installing unapproved software, etc.) from a non-elevated Command Prompt that they couldn't do without it?

No network is completely secure, especially if the potential hackers have physical access, but I want to know how much of a difference Command Prompt would make.

I assume that PowerShell and third-party programs like Git Bash would be about the same security-wise, but if there are significant differences, those would be helpful to know.

There's nothing you can do with cmd that you can't do with any other program, except run cmd. This will actually break some malware that specifically tries to invoke cmd without having fallbacks to other shells, but it will also break some legit software that uses functions such as system or otherwise spawns cmd processes. In general, cmd isn't a well-favored target for attack payloads - its scripting language is weak and a hassle to code for, and the much more capable powershell can now be expected on basically all Windows installs - but it is still the default shell and therefore some stuff will use it by default. If the attacker already has the ability to run arbitrary code other than cmd, the presence or absence ability to run cmd itself is mostly irrelevant.

If most software is blocked (even stuff that doesn't need admin) - that is, if software is whitelisted rather than blacklisted - then cmd might make a difference. It facilitates some moderately tricky things like creating symlinks, hardlinks, and junctions (via its mklink built-in), and its scripting language, awful though it is, is better than nothing in the case that powershell, WSH (cscript or wscript), and so on are blocked and so is running arbitrary downloaded, compiled, or remote executables. An attack that wanted to do something like that might fail if the system was sufficiently locked down. However, most of what cmd can do is somewhat redundant (and it can't actually do much). Since some other software (such as explorer, the Windows graphical shell) would presumably still be available, most basic shell operations (navigating the file system, copying/moving/deleting files, launching programs, setting file metadata, accessing environment variables, etc.) would probably be available without cmd, and similarly things like editing files would presumably be available through notepad or some other editor. Running command-line programs (such as reg, the command-line registry utility) doesn't require cmd; they can be invoked (with arbitrary arguments) from within explorer.


Confused about using a password that "would take centuries to break" I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot.

At work (finance company), I was creating a list of bad passwords that users should not be allowed to choose, involving certain cycles or pattern, and the above kind exhibit that trait of containing consecutive numbers sandwiching special characters (repeated certain times, here twice).

Just out of curiosity, I checked this on a very well known website (on its login page), and it stated that this would take centuries to break.

Some more examples in the list which would take years to break, but are highly vulnerable:

1!2@3#4$5%6^
2@3#4$5%6^7&
a!b@c#d$e%f^

Now, I stand confused with the list, should I mark these particular kinds of  passwords as vulnerable and disallow the users going for them, even if they take a very long time to break?

Note 1 - We are considering these vulnerable as many users (and, hence, multiple similar passwords) are following this trend to remember things easily.
Note 2 - We are confused because the security guys are all about increasing the entropy, what they are ignoring is an increased orderliness of similar hashes in the database
There arose a friction between guys as to where we draw a line, defining which password be allowed or disallowed.

Edits:

This website I am talking about, but won't name, on which I tested the password is pretty much known to every ethical/unethical hacker, almost every user here on Stack Exchange and many big/small companies (as they use its services).
We do not store passwords in plain text. We use a nice, not home-brewed, hashing algorithm.
An incident led us to review our password policies, and we created a separate database db-2 on a different machine, wherein we stored simply_hashed_newly_created user's password (no salt, nothing, just hashed_password) without storing who_created, when_created details. We did this for short period only. Any password change too went into this database. While, in our original database db-1 sat secure_salted_passwords.
We kept creating a list L of hashed vulnerable passwords as well, following a pattern, and we were left amused when we matched L & db-2 - we saw multiple groups of similar passwords, with certain patterns. L and db-2 were later erased from the systems.
db-2 was kept on a highly secure machine and was safe, won't disclose the exact details here. We are aware that even air-gaps or electric-sockets aren't secure. Both db-2 and L were destroyed.
Worry not about passwords posted here, as we have already conducted our small experiment, and all those specific set of users have been made to reset their passwords (of course, a new password different from the old one). That's the reason, I came here posting few samples.
And, I have commented here earlier too, that I posted a sample of passwords from the generator's logic which created a very huge list of hashed passwords, which may or may not be in db-2. Again, since all those users have a new password, so no worries, everything is safe and secure.
Since I know the generator's working, I tested few password-samples on a website, and we got confused over which ones to be allowed or disallowed, over what criteria.

Thanks a lot for your answers, accept my gratitude. Based on the answers, for the time being, we have postponed any kind of restriction to be put over password's choice.

The online calculators are basing their results on a particular set of assumptions, ones that might not apply in any one case. There is no basis for trusting the calculators to provide any insight into how an attacker might choose to break the password.

For instance, if I know that you use a pattern, and what that pattern is, then I would adjust my bruteforcing to align with the pattern. There is no way for an online calculator to account for that. There are other similar factors to take into account. "Entropy" is all about ensuring as much randomness as possible. A set pattern has much-reduced randomness, regardless of the characters used.

So, yes, do ban such obvious patterns, if that meets your goal.

I do have concerns about your method of banning these passwords, though. You might be fighting the wrong battle.


Safe ways to store passwords without hashing them I'm working on an email client for Windows, and to send emails, my application needs to have the email address and the password of that email address. When the user gives his password, I store it encrypted. When sending an email, I pass the decrypted password. But there is one problem here: if I just encrypt a password, someone can easily decrypt the password if they have the key and this key is easy to get when decompling my application and finding the key. But I also can't hash the password because I need to pass the password in plain text and I don't want to annoy my users by asking the password every time they start my application.

So how can I store the password safely without hashing it?

Note: I have read this question: Keeping a user's passwords, but can't hash them , but that's for a web application and I have a desktop application so I can't use a server.

If you're talking about a Windows desktop application, you should use the CryptProtectData API, which stores the credentials in protected memory regions and encrypts them with a key that is part of the user profile. This is the standard protection mechanism for Windows applications.

On Linux you could look into using the GNOME keyring or KDE wallet, and OS X has a set of APIs for its keyring too. This would ensure that the security settings for the user's keyring take overriding control - they can decide how often they want to have to re-enter their master key.

Any procedure you choose to obfuscate passwords is an exercise in futility against any half-determined attacker, so at most you're creating an illusion of security. My suggestion is to include a setting that says "remember my password", but warn your users that the password will be stored locally in a reversible format that offers little security, so that they're aware of the issue.


SQL injection with 500 error code? I'm trying to inject SQL into a website. When I write and in the input field the server returns error code 500 and the response delay is 30 seconds.

When I try to add order by or group by the server takes 15 - 30 seconds to respond, and it looks like it's ordering or grouping the result.

So my question is: is this website vulnerable to SQL injection?

It does seem that the website is vulnerable to a special kind of sql injection called blind SQL Injection.
Especially

This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

and

When the database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible.

are probably relevant and enlightening.
Or as a more experienced person than me would put this:

In other words, a lack of a response or a lag in a response can be a response itself. There are tools to make use of this and translate true/false answers into meaningful responses over the course of many requests.
On the other hand, a lag might still just be a lag; this is not guaranteed to be an injection.


What are the risks and benefits of engaging with hackers? Imagine your site was hacked, you have put measures in place to prevent the same hack being successful again using server permission settings but are still unsure what the original exploit was which allowed the hack to take place, and the hacker left their ICQ nickname.

Is there a benefit in getting in touch to ask for details of the original exploit so it can be patched? Presumably they might be helpful or they could try to extort you. Are there any other potential problems with engaging with the hacker to be aware of?

Hacking your server and profiting from it is the cybercriminal's job. Their "job" is unregulated, risky, unstable, without any guarantees, highly competitive, in an environment where they need to be faster than their opponents (not only other criminals, but also sysadmins, antivirus vendors, etc.) and they need to exploit every opportunity they have before it's too late. You are a stranger to them, and you are an opportunity. Why should they help you? They need to make money from you, not lose time and money because of you. That's why you can't expect anything from cybercriminals, and engaging with them will be very dangerous. The only thing you can expect from cybercriminals is other exploit attempts, so engaging with them is only useful for investigation or research purposes (and only professionals and investigators should take these risks).

The only hackers you can expect to help you are ethical hackers. The problem is though: how do you distinguish an ethical hacker from a cybercriminal, or even from a gray-hat hacker? Sometimes it's hard to know what is running through a hacker's mind. Unless you have enough experience and you know what you are doing, if you need help with cybersecurity the safest option is to contact a cybersecurity professional.


Secure way to save password in configuration file I'm developing a desktop application and it required connecting to a remote MySQL database server, currently I save all information (server IP, TCP port, username, password, database name) needed for the connection in a configuration file call app_config.property.
I realize this is not secure way of doing things and I would like to know the most secure and professional way of keeping secure data like this.

I developed it in Java 7.0; my intention is to run it on Windows 7 as well as Ubuntu Linux.

Data stored in a text file stay there in clear format unless you encrypt that file itself.

As the other answerer said, better to store your credentials in the MySQL database itself. Hash and salt your password (and why not using a pepper too?)

Useful links with very good answers:

How to securely hash passwords?
How to store salt?
What is the purpose of a Pepper?

EDIT:

Following your comments:

You either want to do the same thing as Wordpress, Joomla and other famous CMS do: create a separate table where you can store such information.
Or may be you are hosting your web application on a server on which you are limited in order the number of DBs and tables within a DB you are allowed to create: in that case, you  can create a PHP configuration file (instead of a text file) where you store that information and follow the good practices in such situations (such as protecting the folder in which this file is located with an .htaccess file)


Laptop tampering and boot loader I try to find out how far I can secure my laptop from physical access and tampering attempts.

Setup: ThinkPad with Linux installation

What I have done so far:

disk encryption using cryptsetup for everything except /boot
entering UEFI setup menu is protected by supervisor password
all boot devices are disabled except primary SSD with Linux installation
Bottom cover tamper detection is enabled

Due to the disk encryption, it is not possible to access the data without tampering with the device to sniff the password. Implanting a hardware keylogger should be very hard due to Lenovo's bottom cover tamper detection, which warns me when the cover had been removed. Booting a live system to modify the unencrypted /boot partition is not possible because all other boot devices are disabled. Changing the respective settings in UEFI is not possible due to the supervisor password.

But the attacker is able to boot the system until the grub bootloader appears. Does grub offer any possibilities to tamper with the unencrypted /boot partition?

I recommend locking down GRUB and taking away access to the GRUB shell.

GRUB manual: Authentication and authorisation
(Archived here.)

  By default, the boot loader interface is accessible to anyone with physical access to the console: anyone can select and edit any menu entry, and anyone can get direct access to a GRUB shell prompt. For most systems, this is reasonable since anyone with direct physical access has a variety of other ways to gain full access, and requiring authentication at the boot loader level would only serve to make it difficult to recover broken systems.

Otherwise somebody might access the GRUB shell and just use the "chainloader" command to boot into another partition's partition boot record (possibly off of a USB drive).

ArchWiki entry on GRUB
(Archived here.)

  The GRUB's command shell environment can be used to boot operating systems. A common scenario may be to boot Windows / Linux stored on a drive/partition via chainloading.

I haven't tried any of this. But it sounds dangerous enough.


Vulnerability scoring systems Our company is developing a web app that is used for e-commerce. We want to establish a more formal scoring system for any security related issues eventually reported by us or by our clients. The purpose is to prioritize the patch development and in the same time to communicate the severity to the clients.

So far we evaluated the Common Vulnerability Scoring System. It seems simple and accurate (skipping the environmental metrics) and there are online calculators for scoring. Further it is simple to develop our own calculator.

My question is - what are the most popular alternatives of CVSS? What are the pros and cons compared with CVSS? Is there something like a comparison cheat-sheet so that we can easily find our way or we need to make a serious evaluation of several more systems?

Tony Cox and Jeff Lowder have provided some excellent commentary on CVSS (Indeed SIRA includes lots of good discussion). Their goal is  bit broader than yours, but I think that the referenced article provides an index to commentary about CVSS. @Metahuman's post points out that CVSS can be supplemented.

The Department of State's iPost system  found that CVSS scoring over estimated the value of unimportant risks; if I recall correctly they simply cubed the values to emphasize the serious stuff.  State's iPost is the model (albeit a flawed model according to the Department of State Inspector General) for the DHS CAESARS - but both of those are more architectural than your goal.

CVSS is a flawed standard - I know that there are active efforts to revise/reform it.  There is considerable subjectivity in the ratings - I can't find the reference at this moment, but someone ran a test where they gave several experts the same information about a vulnerability and they used the CVSS process but came up with very different answers. But it is a standard. It is an excellent place to start for a project such as yours where you're looking for a reference standard without the effort of creating your own methodology.  You can use CVSS (and CWE) as starting points, and then do what @Colin Cassidy calls "magic maths".

CVSS is system-centric; it ignores architectural security features, and it probably undervalues vulnerabilities where the web/cloud is the delivery vector. I'd want to look at OWASP  and Veris for more statistical information about real world exploits rather than on theoretical models.

I probably wouldn't ignore the environmental metrics; indeed in the medium term, I'd use the components of CVSS to begin to roll your own vulnerability score that is more closely fitted to your needs.


Why does P2P need port forwarding when behind NAT? Correct me if I'm wrong, but for a node to participate in peer-to-peer, if it's behind NAT, it must port forward to be able to connect. Why is the port forwarding necessary? I know there are exceptions to this i.e. NAT traversals, but I'd like to understand the basic problem first. Can anyone explain in very simple terms?

Basically, my question is when and why is port forwarding necessary?

There are 2 main types of NAT, you can have one to one NAT (static NAT) where one internal IP address is translated to one external IP, and you have many to one NAT (hide NAT) where many IP addresses map to a single IP address. In many to one NAT when an internal host connects to an external host the IP information is put into session tables (I'm using this as a generic term to encompass all the tables a firewall may use in this case) so that the firewall knows what to do with return packets.

Things get a bit more complicated for sessions that are initiated by a host outside the firewall. With one to one NAT it's very simple as there's only one place the packet can go, but when there are many hosts behind a single IP address the routing device has no indicator of where an incoming packet should be directed. Port forwarding is one way to solve this problem, a port forward rule will allow the device to do the destination address translation and forward the packet accordingly.

Port translation is not often used as a solution in enterprise networks although I can think of some exceptions to that. Enterprises usually have a block of publicly routeable IPs, so they will set up a one to one NAT when an internal host requires access from an external IP (or just assign the box an external IP in the first place). Port translation is much more of a home broadband solution where your router only has one IP address to use. When you fire up your p2p software externally initiated connections won't be able to reach it unless it there's a port forwarding setup, either manually done but more likely UPnP, where the application tells the router what the port forwarding setup should be.


IP Spoofing: How secure is to control access by user’s public IP address? We have a few Windows server VMs hosted in Amazon cloud. Users need to enter account and password to RDP to the VMs.
The VMs’ RDP EndPoint (IP+Port) is public to the internet.
As an extra security measure, we managed to restrict access to the RDP port (available to public) to specific public IP addresses.

The question is that how easy it is to spoof a public IP address? Can hackers spoof our designated public IP address, so they bypass our Pubic IP address firewalling?
Thank you,

Short Answer
Assuming a TCP connection, it is nearly impossible to spoof a source IP address without control of the network.
Longer Answer
Assuming you are not using any proxies (which can cause issues if you're getting their IP address from a X-FORWARDED-FOR header), and running a service on TCP, it's extremely difficult to spoof a source IP address
To initialize a TCP connection multiple packets have to be sent back and forth between the server and the attacker. If the source address for the initial request is spoofed, then the attacker would be unable to finish opening the connection because the spoofed address is not their address. So when the server sends a packet 'back' to them, it would instead be directed to the real owner of the address and not the attacker.
I would make a diagram on Visio for this, but I am in class, so hopefully a sketch is sufficient.


Cisco FirePOWER estreamer python client SSL Cert issue I'm looking to the use the estreamer python library for Cisco firepower. To achieve this, the configuration document states the following about using clients:

"you need to create a certificate on the Defense Center or managed device for the computer where you want to run the client. You then download the certificate file to the client computer and use it to create a certificate ( server.crt) and RSA key file ( server.key)." Cisco Guide

I generated the pfcs12 file through FirePOWER. I tried the following steps
(source) to create the certificate and RSA key file:

openssl pkcs12 -in filename.pfx -nocerts -out filename.key
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out filename.crt

When I try to run the client, I receive this error

Traceback (most recent call last):
  File "client.py", line 79, in <module>
    sys.exit(main())
  File "client.py", line 49, in main
    basedir + "test.crt", basedir + "test.pem") as ec:
  File "/usr/lib/python2.7/site-packages/estreamer/streamer.py", line 40, in __init__
    raise eStreamerKeyError("Invalid key file or bad passphrase {}".format(cert_path))
estreamer.streamer.eStreamerKeyError: Invalid key file or bad passphrase /home/admin/estreamer-client/test.crt

Am I doing something wrong when generating the cert and key?

It seems that the error message for eStreamerKeyError indicated the .crt file as the source of the issue when it was actually the private key file.

This ended up being the correct command for the private key:

openssl pkcs12 -in test.pkcs12 -out test.pem -nodes

I also had to download the SSL cert:

openssl s_client -showcerts -connect 172.16.10.42:443


How to continue where I left off on reaver? I was attempting to brute-force the WPS PIN on my home router to check the security of my network. Strangely, after three days it still had not finished, I believe this is because my computer was far away from the router while I was performing this attack and set a high wait before each retry.

Command I used:

  reaver -i wlan0mon -b BSSID -d 30 -S -N -vv

I stupidly restarted computer, this wasted three days worth of work because I was using a live USB for Kali, I did not have persistent storage.

Luckily, I wrote the last count and PIN before shutting down:

  Count: 5047 (out of 11000 I think)

  Current PIN it was trying: 50425679

Is it possible to resume where I left off using information above? How would I write the command?

Thank you!

You require the reaver session file for this. I'm assuming you are working on a Linux system (Kali probably), the session file is saved in /usr/local/etc/reaver and named <BSSID>.wpc. Look for the session file to see if it is there. It allows reaver to resume an attack.

If the session file is missing, you can create one manually based on the information you have. In general, WPS PIN attack works in two parts: the first half -- 4 digits, 10,000 combinations -- and the second half -- 3 digits, 1000 combinations. The last digit is simply a checksum and is ignored during brute force. reaver is first trying to bruteforce the first digits. Did that succeed in your case? If it did, then you already know the first half of the PIN.

This session file contains 11,000 keys in two halves:

4 Digits (up to 9998, one on each line)
3 Digits (up to 998, one on each line)

Attack the station again and then quit reaver and open the session file. You need to modify this file such that reaver knows where it left off. Change the first pin on the first line to 50425679 in your case. The next two lines might read 0 and rest are combinations. Save the file and start reaver again. It should now pick up where it left off.

Also see:

https://github.com/shift/reaver-wps/issues/233
https://forums.kali.org/showthread.php?18629-Possible-to-start-reaver-with-a-specific-number


Does the Google Chrome Android Application encrypt data I am working on a packet analysis application for Android, and I am having difficulties analysing data sent to an HTTP website. I was wondering if this is to do with my application, or does the Google Chrome app encrypt the data in any way?

In essence, does the Google Chrome Application encrypt its data?

Normally, it should not. The websites would not know how to decrypt it, so it couldn't. But Chrome for mobile has a compression thingy that is supposed to save on mobile data and I believe that may be encrypted (so it would be encrypted when it is turned on). In that case, the data saving compression feature may be acting as a sort of VPN, encrypting even HTTP up to Google servers.


Securing my web-server / website Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website?  A web link would do.

To get started, you're probably going to want to focus on two things:

Securing your web server
Security your website

That's really two different specialties, and I don't think I'm going to be able to dig up a single document describing both... the ardent security nerd would also point out that this assumes you're working in a secure network with decent physical security, security policies and protections in other arenas.

Securing the Web Server

Hands down, you're best information is going to be web server specific - each one has it's own foibles.  Sight unseen, I'd recommend this:

http://iase.disa.mil/stigs/app_security/web_server/general.html

Yes, it's US DoD specific, but it's got some generally not so bad guidance.

I also really like NIST stuff:

http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf

Securing your website:

Hands down, my favorite site for secure web development is OWASP.

https://www.owasp.org/index.php/Main_Page

The information in this area is dense and there's a lot to take in no matter how you slice it.  There's no one good checklist for web app security - you have to design security in from the start and be prepared to involve security considerations in all parts of development.

What I love about OWASP is their breakdown of specific issues, for example:

https://www.owasp.org/index.php/SQL_injection

Gives you the problem, the threats, the vulnerabilities, examples, and some idea for what to do about it - pretty much everything I need, whether I'm the security analyst or the poor guy trying to fix the problem.


Securely storing an encryption key on AWS Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server?

I am storing encrypted information in a MySQL database and my cryptography key is stored in code. Data is encoded/decoded using this key when saving/retrieving from the database. Obviously, I do not want anyone to have access to this key. If the machine is compromised, so is the source (dang but that's life) and perhaps the MySql database too. Since the source is available, so is the key and the attacker can decrypt the data.

What is the best way to avoid storing the key on the server? I assume it would be storing it on a different server but that seems to pass the ball around a little and not solve the actual problem.

Another question could be 'should I even be using an AWS EC2 server' and how secure are one of these things if all patches are applied.

Does anyone have any insight on this sort of situation? I am a pretty good programmer but not the best versed in security.

It depends on what you mean by "storing", as well as "server".

I'm going to assume for sake of answering that there are two "servers" in use now, both on the AWS cloud:

MySQL server.

Application server (which currently has the code with your cryptography key in it).

The MySQL server has no reason to have the key, ever.

The Application server I assume has to work with the decrypted data.

IF the application server is doing the decrypting itself, it WILL have the key in memory.

You CANNOT know whether that memory was ever saved to disk by AWS, unless you inspect the hardware.

IF the application server does not need to do the decryption itself, then it is possible to have a service that takes the MySQL data and decrypts it, sending the data back to the Application server by some public/private key encryption you're satisfied with.

As always, if the key is on AWS, any AWS employee with sufficient access chooses to, as well as anyone else with sufficient access (vendors, Dell after the container full of hardware is shipped back once it's suffered too many failures, etc. etc. etc.).


Will installing WinZip 22 on a server create a security vulnerability? I've recently requested a WinZip v22 with command line installation on a Windows POC/Dev server that we're using to pilot an application that is written in .Net.

In the application there is functionality that hooks into WinZip using:

ProcessStartInfo("c:\winzip.exe")

When a request was made to install WinZip 22 on the server, an inquiry was made as to whether this would pose a security vulnerability.

I searched CVE Details and Mitre but the  last issue seems to be in 2008.

Thanks in advance for any insight on this.

No if you patch Winzip frequently.

Yes if you don't patch it.

This answer applies to all software on a server not just Winzip.  Only put software on a server that is required in order to reduce risk and attack surface.


Why are weak Cipher Suites still in use by clients, particularly mobile apps? I am examining the collection of cipher suites that some mobile apps use (Client Hello) and I noticed that the majority of them include the TLS_RC4_128_MD5 and TLS_RC4_128_SHA. According to the OWASP Transport Layer Protection Cheat Sheet https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet, RC4 and MD5 are considered weak and shouldn't be used any more. Therefore I am wondering why developers keep using them?

Thank you

Developers aren't deliberately using them.  Developers are developing applications using whatever the defaults for that platform are, and the defaults are now and have always strongly favored "never cause a user to notice something to complain to us about" over "reduce the chance the user gets hacked".

Additionally, older clients and libraries rarely if ever get updated, since they are "no longer supported" despite being in widespread use because OS developers, library developers, device manufacturers, developers, and users are all unwilling to upgrade and/or change defaults.

Java 8 still supports weak suites by default.
IE 11 on Win 7 still supports RC4 by default, while IE 11 on Win 8.1 does not by default.

And so on.


How to block requests in web app when certificate is insecure? I am developing a web app and wanted it to be secure from attacks from the application layer.
Currently, my website is allowing interception from Burpsuite like certificate proxy software. Is there a way to block requests from frontend whenever we run the website on an insecure certificate?
If that is not possible, can I detect an insecure SSL certificate from the frontend using JS?
Thanks

... wanted it to be secure from attacks from the application layer. ... website is allowing introspection from Burpsuite  ...  detect an insecure SSL certificate from the frontend using JS?

Based on your previous question you want to protect your application against reverse engineering and manipulation by the end user itself, i.e. the user controlling the client (browser).
But you cannot use a transport protection (TLS, HTTPS) to protect against manipulations at the endpoint of the communication. You can try to protect against reverse engineering the protocol and manipulating the traffic by a man in the middle proxy, but you cannot protect against somebody intercepting the communication before encryption and after decryption in a manipulated client, since you don't have full control about which clients are used.
Apart from that certificates from Burpsuite are not necessarily insecure. Once the issuing proxy CA is imported as trusted into the browser, the issued certificates are considered as valid and secure as certificates issued by a public CA. Thus basing the protection on the validity or security of the certificate would not protect against the end user itself intercepting the communication.
And even if one manages to get access to the certificate from JS to check if it is exactly the expected one, the code to do this would first need to pass the intercepting proxy and could be manipulated there to disable the checks or simply lie.
In other words: as long as one cannot fully control the client one should never trust the client to behave as expected. Any critical computation should be done at the server, all data sent from the client should be validated and critical state should be held at the server or be protected (like with HMAC) by secrets only known to the server.


Does still make sense to use SHA1? I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying function of my hash-based signature. But I'm not sure if it still makes sense to use SHA1 due to its vulnerabilities. Is there a scenario in which would be acceptable to use SHA1?

My answer would always be "in comparison to what else?"

In this moment, SHA-1 is weaker than SHA-2:

https://en.wikipedia.org/wiki/Secure_Hash_Algorithms

It's got known weaknesses, a smaller number of security bits, increased risk of collisions, and SHA-2 is fairly prolific, has a good performance, and is fairly widely accepted.  So... why not use something better?

There is a reason - compatibility.  There will always be some suitably old technology out there that simply cannot (or has not) been upgraded to use the current recommended best practice.  So the big question is - does your business model benefit more from interoperability, or cryptographic strength?

My not-spending-lots-of-time-doing-math-research answer on SHA-1 vs. SHA-2 would be that it's a no brainer - SHA-2 is better.  But if you told me that your biggest customer has a substantial investment in SHA-1 only technology and can't improve the system... well... I'd probably advise finding a way to limit the scope of where and who you do SHA-1 with, and then make sure you have that customer sign a nice sounding waiver that they understand that you can't be entirely responsible for the risks of using a not-best-practices algorithm.


Are log files executable files? As a beginner in security research project, I came across log injection and my question is itself about log injection files.
Are log injection files executable, if no, how do they execute/run malicious code/files uploaded onto them, if log-injection vulnerability exists?

By reading your question, I think you are talking about log poisoning attacks.

For example, if you have discovered a vulnerability called local file inclusion (LFI), it could be possible to poison the logs that could result in code execution through log poisoning.

Let me give you some more details by showing some (very wrong) code:

<?php
  if (isset($_GET['file'])) {
     include($_GET['file']);
  }
?>

This code file include any file, execute it and display it in the user's browser. Now let's assume for a moment that the PHP open_basedir* is not configured.

https://www.somedomain.tld/index.php?file=contact.php

Now this would load the contact.php file which is located in the same directory as where the web pages served.

Now by changing the filename to something like this:

https://www.somedomain.tld/index.php?file=../../../../../var/log/nginx/access_log

In this scenario, let's assume that the log file is loaded and displayed in the user's browser. In this case it's already bad enough because you can basically load any file that the www-user has read access to.

Log Poisoning

Now let's inject some PHP code in the log file. This can be achieved by doing something like this:

https://www.somedomain.tld/index.php?file=<?php echo phpinfo(); ?>

Since this is an HTTP GET request, this will end up in the log file. This stage is called log file poisoning. Although the above request will most likely display an error, by re-reading the web server's log file, the code will be executed.

Code Execution

Since the web server log file is poisoned with the previously injected PHP code, but loading the web server's log file the following will happen:

PHP reads the log file.
PHP detects the PHP code in the log file.
PHP will parse the PHP code and parse its output to the user's browser, displaying the PHP info.

Where to go from here

Use your imagination where to go from here. Here are few things that come to mind though:

Try exec, passthru to see if you can execute commands (there is a difference beteen code and command execution)
Use the command wget to download a web shell or a reverse shell.

To sum things up:

Log files do not (should not) have the executable bit set.
Read access to log files is enough to execute code after they're poisoned (this requires LFI)
Web server logs are not the only log files that can be poisoned, and email could do the trick too.

= open_basedir is a directory restriction in PHP. When set, only files within the path of the open_basedir can be read.


In the Clark Wilson models, why can't the TPs be executed in parallel? I am studying the Clark-Wilson model, I can't exactly understand why the TPs must be executed in serial, is there a way to execute them in parallel?
What would happen if I did execute them in parallel?

Thanks a lot

-- AscaL

There's no way to execute in parallel in Clark-Wilson because there is no standardized rule for how to handle concurrent access to the same data.  This is a common problem with databases.  For example, what do you do if thread A wants to read data thread B is changing?  Reading over information on database isolation may clarify this for you.  http://en.wikipedia.org/wiki/Isolation_(database_systems) is a pretty good resource.


How to provide user friendly WiFi access to gym members with WPA2 Enterprise? Background

A friend of mine is the owner of a medium sized gym. He wants to provide WiFi to his customers and asked me to come up with a concept and eventually also deploy it. As a computer scientist I have a thorough understanding of information security but no experience in actually deploying a system that is used by many users. Because WiFi is not mission critical to his business that is okay for both of us.

Rationale for WPA2 Enterprise

Our main concern here is Availability: We want to make sure that the WiFi is available to the customers. With a simple captive portal we could not prevent random users from hogging the network bandwidth using MAC spoofing and disconnecting legitimate users in the process. We will make use of IEEE 802.11w to prevent users from being disconnected by some script kiddy using kali.

My Questions

I realize that most businesses like coffeeshops or even big hotels deploy a simple captive portal which is inherently insecure. I guess that is because they have to be compatible with old devices and operating systems. Since our customers will use their somewhat recent smartphone we can safely drop this requirement. How easy is it on current smartphones to connect to a WPA2 network? Is there some kind of auto configuration on android(I know it's super easy on iPhone)? Should I support PEAP, EAP-TTLS or both?
Are there other caveats  when deploying WPA2 Enterprise instead of a captive portal in this environment that I have to be aware of?

You could develop a profile which contains the network key, as far as i am aware this means that the key isnt viewable by the user. This could be downloadable from the gyms website member area.

Maybe using apple configurator for the IOS devices?


NaCl: US Export Regulations I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually).

I'm trying to navigate the labyrinth of US export regualtions - something I never dealt with before.

By now I'm aware that encryption export from the United States is governed by the EAR and BIS. This latter classifies software containing encryption, and assigns each product to an ECCN (export classification control number) category.

I'm not asking for a legal advice here, just how would you tackle it? Does one really need a laywer to categorize the product that uses an opensource crypto library?

UPDATE:
Apache Foundation matrix classifies all their software as ECCN 5D002 and exports it under TSU exception in EAR 740.13(e).
The OpenSSL Software Foundation went the same route.

That said, I now have to figure out whether a closed source software, that uses an open source crypto library, can as well be exported under the EAR 740.13(e) exception or there is another exception, that applies.

Thank you in advance.

I believe that Sodium, as an open source project, qualifies for section (e) of the TSU exemption to export controls: http://www.gpo.gov/fdsys/pkg/CFR-2006-title15-vol2/xml/CFR-2006-title15-vol2-sec740-13.xml

(I'm not a lawyer, but this is what is used by the Apache foundation for cryptography-related code, as I understand it.)


SSL/TLS - Does the client select symmetric key for data encryption? After reading the excellent answers here and documents about how SSL works. I have a doubt about what the function of the ClientKeyExchange step is. In the above linked answer and document it says that the client part of the key is sent encrypted via the server public key.

So does that mean that the client is responsible for selecting the symmetric key that is used to encrypt/decrypt the actual data ?

If so then can the client be trusted enough to generate a strong encryption key ?

What is the role of the server in the symmetric key generation ?

... that the client is responsible for selecting the symmetric key ...

The keys used for symmetric encryption are not created by the client alone.  With RSA key exchange the client creates the pre-master secret and transfers it encrypted with the servers public key to the server. The master secret is then computed based on client and server data. From RFC 5246 (TLS 1.2) section 8.1:

  master_secret = PRF(pre_master_secret, "master secret",
                      ClientHello.random + ServerHello.random)
                      [0..47];

And from this master secret the keys for encryption and MAC and the IV are derived, as specified in section 6.3 "Key Calculation".

For DH key exchange already the pre-master secret is generated by combining information from client and server. Generating master secret from pre-master stays the same.


How secure is NFC on mobile devices? Near field communication is becoming more commonly available in modern mobile devices, such as smartphones and tablets. This functionality can be used to communicate between such devices, or with standalone NFC terminals such as payment points.

What vulnerabilities might this open us up to? What security standards are implemented to prevent eavesdropping? Are there any practical (known) attacks using NFC that are worth knowing about?

Like bluetooth and 802.11, I think we will see eavesdropping used in many attacks.  I suspect that some variant of the classic man-in-the-middle attack will crop up too, despite being mitigated as much as possible in the design of the specifications. Although I don't have practical experience or familiarity with these attacks, I can point you to a few articles that you may want to check out:
Slides: "Practical Experiences with NFC Security
on mobile Phones"
Security in
Near Field Communication
Security Risks of Near Field Communication
A presentation on NFC security at BlackHat USA 2012
Summary of blackhat presentation


Does ASP.NET guarantee the integrity of a page's controls on a post back? Say you have an ASP.NET page that lists the prices for certain items in labels. I know it's cringe-worthy, but say you took the price of the item from the label on the page to determine what the user is charged for their order. Does ASP.NET guarantee in any way that the text in those labels has not been tampered with?

Viewstate is what you're looking for.

It secures the page cryptographically, although it has known limitations that are located elsewhere on this site.

An optional MAC should be enabled for sensitive pages, such as yours, that allows the client to post back prices that are used by the business layer.


How to detect a virus /malware missed by antivirus program I was On FB page,accidentally clicked an ad. Another window opened up and locked the browser with background audio message, purportedly from MS, warning about security compromise on my PC. Unplugged PC, restarted PC, working fine but found that history had been wiped off in  both IE and Firefox. Ran mcaphee, avast, Fortinet and malware bytes , no detection. Is it possible there may still be some virus sitting in the system and evading detection by antivirus programs ?

Just to make sure you're aware, that prompt was most likely only trying to scare you into calling their fake support number. If they wanted to infect you with malware, they wouldn't be wise to announce it to you.

Technically yes, it's possible you could have some malware still on your PC that your software missed. Thing is, it's difficult to prove a negative, so authoritatively proving you're clean is difficult. You'd have to perform very skillful and tedious analysis to find something these scanners missed. If you're truly concerned you may be compromised, format your PC and reinstall your OS.


Email account 'hacked'; do I need to regenerate my server's DKIM _domainkey? I'm just learning about DMARC (DKIM/SPF), so I apologize if my question doesn't make sense.

A few days after I installed a DMARC policy on my server I noticed that the reports from yahoo.com contained thousands of 'validated' sends from my mail server's IP. I also received an email from my VPS host saying that one of the email accounts was compromised. I reset the password on that email account, but a day later I received another report from yahoo.com still showing a thousand valid emails being sent out.

The question I have is...do I need to regenerate a new _domainkey on my server once I've resolved the issues with the 'hacked' account?

For posterity I'll add my own answer to illustrate the procedure I went through.

Step 1) Discover which accounts are sending spam

Log into WHM and go to "Mail Queue Manager". Do searches and view the emails to see which accounts are responsible. If for some reason you don't have access to WHM, chat with your web host to get this information.

Step 2) Change Passwords

Log into cPanel and change the login credentials for the affected accounts. Those affected need to be notified over the phone/in person of their new passwords.

Step 3) Remove backlogged spam messages not yet sent

Initially I had just changed the email passwords but I kept on receiving notifications of failed deliveries, so I figured "something was still sending emails". Turns out there was a backlog dating back four days with spam messages that had not yet been sent. Return to the Mail Queue Manager and delete the spam messages.

Step 4) Run Antivirus/Anti-Malware Scans

Run on all potential entry points...user PCs and the mail server itself.
For the mail server, I'm on CentOS so I could install maldetect
.
For personal PCs/workstations, if you find keyloggers make sure to change the email account's password again after removal of the logger.

Step 5) Keep an eye on the Mail Queue

Since the spam mail was generated in huge amounts, watch the mail queue to see if lots of emails are still being generated (this might be difficult if you have a lot of users).

I'd appreciate any additional tips that I may have missed.


What risks should I be aware of before allowing advertisements being placed on my website? The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.

Does serving advertisements from AdSense, or any of the online marketing companies decrease the safety of my browsing session?
What is the maximum damage a malicious advertisement could do?
Suppose my business model requires serving ads, how can I safely serve advertisements on my site?  What precautions can I take?

Yes.  Serving advertising is opening yourself up to attacks from the marketing company, or any of their middleman, etc.
There are two ways you can serve advertisements.  One way is to put the advertisement in an IFRAME.  The second is to include it inline, via SCRIPT SRC=.

An iframed advertisement is safer: it is walled away from the rest of your page by the same-origin policy.  While the ad can still serve unsavory content, display spoofed content, or try to exploit vulnerabilities in the user's browser (in a drive-by download attack), it cannot tamper with the content on the rest of your site or the user's interaction with your site.  However, because the iframe limits what the ad can do (it cannot look at or interact with the containing page; it cannot do expando ads and the like), advertisers generally pay less for these kinds of ads.

An inline (SCRIPT SRC=) advertisement is a greater danger.  If the ad were malicious, it could completely take over your site: it could steal session cookies, plant a keylogger, steal the user's password, disrupt the site's appearance, grab personal information from the user and forward it off-site, spoof user actions, plant unsavory content on your site, etc.  Therefore, if you use this method of including ads on your site, you are placing total trust in the advertising company and everyone they do business with.
Similarly, you can embed a Flash ad in your web page.  This poses similar risks.

Malicious ads have been seen in the wild.  In 2009, the visitors to the New York Times web page were attacked by a malicious ad that was being served on the NYT pages and that showed a fake A/V alert (technical details and more details); the attacker bought coverage for his/her ad by pretending to be a customer of the NY Times.  Apparently, the FoxNews website has also been attacked by a malicious advertisement, as has MySpace, Excite, Expedia, Rhapsody, MayoClinic, Bing, Yahoo, the London Stock Exchange (details), eBay, Doubleclick, MSN, Spotify, Drudge Report, and undoubtedly others.
There have been some studies of the prevalence of malicious ads.  Dasient estimated that three million malicious advertising impressions were served per day in 2010.
In principle, there are technical defenses.  For instance, Yahoo's AdSafe is a restricted subset of Javascript, designed to allow advertisers to build rich media ads (written in Javascript) that can be embedded directly into the page (via SCRIPT SRC), while maintaining security.  However, AdSafe has not caught on, and advertising networks have been reluctant to adopt technical defenses.  Instead, they rely upon their vetting of their clients -- which can be fairly cursory.  There are also some other approaches that might be applicable, including Google Caja, Microsoft's Web Sandbox, and sandboxed iframes, but I'm not familiar with whether they can be readily applied to typical advertising scenarios.
As a result, if you accept ads, you are taking on a security risk.  In many cases this risk is acceptable, particularly if the revenue stream from ads is significant enough.  But I would generally recommend that, if your site is especially security-sensitive, then you should probably avoid putting ads on your pages.


How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface? This is what I believe to be an interesting challenge :)

A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down abysmally lately. She'd like to know if some of the neighbors are using her wifi network to access the internet but she's not too technically savvy.

I know that the best way to prevent issues would be to change the Router password, but it's a bit of a PITA having to re-configure all wifi devices... and if the uninvited guest broke the password once, they can do it again...

Her wifi router/internet connection is provided by the telco, and remotely managed so she can log-on to their telco account's page and remotely change the router's Wifi password, but doesn't have access to the router status page/config/etc unless she opts out of the telco's remote support and mainteinance service...

So, how could she check if there are guests in the wifi with this restrictions and in the most "point and click way"?

In this case I'd probably use nmap to look for other devices in the network, but I'm not sure if that's the easiest way to do it. I'm not a wifi expert, so I don't know if there are any wifi-scanning utils that can tell us who's talking to the router... Lastly, she's a Windows user as I guess that'll influence the choice of tools available

Any suggestions more than welcome

Regards!!

EDIT: Thanks @GdD for the ping/arp -a suggestion; it looked like a viable option, but I've tried it on my own WIFI network, and I'm not getting the expected resutls.

I do:

>arp -d

>arp -a
No ARP Entries Found.

>ping 192.168.1.255

Pinging 192.168.1.255 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.1.255:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

>arp -a

Interface: 192.168.1.42 --- 0xc
  Internet Address      Physical Address      Type
  192.168.1.1           64-68-xx-xx-xx-xx     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.251           01-00-xx-xx-xx-xx     static
  224.0.0.252           01-00-xx-xx-xx-xx     static
  239.255.255.250       01-00-xx-xx-xx-xx     static

So it'd look like there was no other host on the network, but nmap says otherwise:

>nmap -sn 192.168.1.1/24

Starting Nmap 6.25 ( http://nmap.org ) at 2012-12-02 16:31 Romance Standard Time
Stats: 0:00:15 elapsed; 0 hosts completed (0 up), 42 undergoing ARP Ping Scan
Parallel DNS resolution of 42 hosts. Timing: About 25.00% done; ETC: 16:32 (0:00:42 remaining)
Nmap scan report for 192.168.1.1
Host is up (0.046s latency).
MAC Address: 64:68:xx:xx:xx:xx (Comtrend)
Nmap scan report for 192.168.1.39
Host is up (0.033s latency).
MAC Address: 3C:74:xx:xx:xx:xx (RIM)
Nmap scan report for 192.168.1.40
Host is up (0.098s latency).
MAC Address: 34:51:xx:xx:xx:xx (Apple)
Nmap scan report for 192.168.1.41
Host is up (0.083s latency).
MAC Address: 30:39:xx:xx:xx:xx (Sony Ericsson Mobile Communications AB)
Nmap scan report for 192.168.1.42
Host is up.
Nmap scan report for 192.168.1.43
Host is up (0.092s latency).
MAC Address: F0:A2:xx:xx:xx:xx (Private)
Nmap done: 256 IP addresses (6 hosts up) scanned in 58.20 seconds

I'm sure I'm doing something wrong, or there is some reasonable reason for the arp ping not to work; in any case it looks like the nmap solution is going to be the most reliable one :)

Regards and thanks to all!!!

I'm a bit confused why nmap would not be the weapon of choice, an nmap ping sweep would be my very first step. However, an alternative is you could simply ping the broadcast address and then do an arp -a. If the network is a /24 as most wireless networks are, say 192.168.0.0 with a 255.255.255.0 subnet mask, then pinging 192.168.0.255 will get all the systems on the network to respond and the arp table will show all devices on the network. An arp -a will list all those systems.

Really the best way to go about preventing unauthorized use would be to change the password and change the wireless security to WPA2 instead of WEP or WPA. That will kick any freeloaders off and make it much, much more difficult for anyone to break the key again. There's very good reasons for doing this as it will prevent your relative from being accused of software piracy and having a massive legal headache.


What information is still exposed when visiting an HTTPS website using DNS over TLS? DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more people than ever before, so it seems like we ought to have a question regarding what security, exactly, the protocol provides.

Assume a user visits a website secured using HTTPS; their DNS query is sent to the DNS provider using the DNS-over-TLS protocol.

What information about the user's browsing is in principle available to each of the following, if they cared to access it?

The website
The DNS provider
The user's ISP
An eavesdropper

Which of these parties, if any, could obtain sufficient information to relate the user's browsing to a real-world identity or location?

How does this differ from accessing the same (HTTPS) website over standard (not-over-TLS) DNS?

What information about the user's browsing is in principle available to each of the following, if they cared to access it?

Since your question is asking about DNS over TLS, I'm not going to get into HTTP over SSL.

DNS typically goes over the wire in the clear and the information that can be seen is:

Source IP (user)
Destination IP (DNS server)
Query (e.g. www.example.com)
Response (e.g. 93.184.216.34)

By using DNS over TLS, only the following information would be visible to outsiders:

Source IP (user)
Destination IP (DNS server)

This definitely helps with privacy.  Also, keep in mind that this helps with MITM attacks, since in order to establish a TLS session, you need to exchange certificates, thus allowing the ability to verify the server's identity.

  The website

They will always have access to all of your information for each and every time you visit their site.  Your history will be in their web server logs and will show your IP address (unless you use a VPN).

  The DNS provider

They will see everything that you query and have a record of it if they keep logs, again, ties to your IP (unless you run a VPN).

  The user's ISP

They won't be able to see the queries you are performing, but they can see the sites you are going to, but not what you are doing on them due to HTTPS.  They may be able to tell the site by the destination IP address of your traffic and/or by the server name in the TLS client handshake.  Again, if you use VPN, no one of it is visible to them.

  An eavesdropper

Same as the user's ISP.

  Which of these parties, if any, could obtain sufficient information to relate the user's browsing to a real-world identity or location?

No single party would be able to make that determination.  It would be more likely to be someone obtaining logs from multiple sources in order to figure that out.

  How does this differ from accessing the same (HTTPS) website over standard (not-over-TLS) DNS?

Honestly, I don't feel that there would be much of a difference, since in HTTPS, sniffers can see your destination IP and also most of the time the server name is specified in the TLS handshake.

Hope that answers your questions!