Is there a way to see what is program is causing RDP attempts on computer One of our servers (running RdpGuard) shows multiple failed attempts from specific users' machines (3 to be exact) and I can't figure out what is causing them.
One user is local and two are remote using VPNs.

Today there's a pattern in the attempts.

The three IPs are 192.168.1.11, 192.168.1.45, and 192.168.1.85

The pattern goes as follows:

Failed attempt from: 192.168.1.48 (remote vpn)
Failed attempt from: 192.168.1.48 (remote vpn)
Failed attempt from: 192.168.1.11 (remote vpn)
Failed attempt from: 192.168.1.11 (remote vpn)
Failed attempt from: 192.168.1.85 (local)
Failed attempt from: 192.168.1.11 (remote vpn)

These attempts happen every ~4-5 minutes in that specific order today.

I've run multiple malware/rootkit/virus scans which returned no results.

UPDATE 1:

The RDP attempts are now coming from random machines inside the local LAN. Servers and workstations are affected.

UPDATE 2:

So after a bit more reading I was able to find out about the netlogon.txt file (on the primary DC). From there I was able to determine the origin and destination of the attempts of all these RDP attempts.
I ran procmon on the origin machine and matched the event from the netlogon file (on the PDC) to the correlating event on the destination machine. I took the source port used which was logged in the event viewer (security) on the destination machine and matched filtered procmon using that port num. That gave me the process/PID of the culprit which was a network management service used by "Advanced Monitoring Agent"/RMM which is an MSP software by solarwinds (I looked up the PID in Task Manager).

So for some reason the MSP agent was trying to RDP using the guest account. I have went ahead and uninstalled it from all the local users machines and servers. I have left it on the users machines at remote sites as there are no attempts coming from them (due to them being in a different subnet I believe). I have also removed the VPN users from the domain and they now access internal files using 2xRDP.

Please check windows security logs and look for login attempts. You can filter by event codes and look for login type 10. This is an RDP login. It could be that some service in some computers might be trying to access the drive with incorrect credentials.


Paypal Account created using my gmail account Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her.

I noticed that, removed the forward and changed the password. Now, I use another gmail account for my paypal account and I never had a paypal account on my hacked gmail account. I logged in and thought that I should add my other gmail account to this paypal account as well.

But, to my surprise, paypal informed me that this email is already used ! I tried to reset the password, to found out that a specific credit card information was requested, after I asked for a password reset. You cannot actually reset the password if you do not provide that information (which of course I don't know).

I also checked my inbox for Paypal emails and I actually found a few of them, some newsletter stuff. I suppose that the attacker forgot to turn them off ? Seems weird indeed.
They actually also have my name on it, though I don't really provide that info on gmail :O

I don't really understand why would somebody want to create a paypal account with another person's email. I don't find any reason for that, but I may be missing something.

Has anything like that happened to anybody else ? Is there a way that you can advice so that I can further check on that and get more information ? I will probably also call paypal.

A couple of clues that comes in my mind:

Is the account active? If yes you should receive payment information from Paypal regularly. This activity would be a good sign to see whether it is your account (you could have forgot) or another person, or a person trying to harm you.
Maybe there is a person with the same name as yours and he accidentally typed your email instead of his?

By the way, contacting PayPal is indeed the good thing to do. They would normally try to be sure that :

They understand the situation and are aware of possible mischief
You own the email address
You are the same/a different person than the other account

You want to :

Check you did not have any money theft
Someone is not trying to impersonate you somewhere (difficult to assess in my opinion)


Is a large encrypted file more secure than a small one? Does encrypting a large file and subsequently having to decrypt a large file make it more secure than a small one when attempting to brute force it?

If you have to brute force a 25GB file and a 250MB file do you have to try to decrypt the whole thing in order to check a given password or is there some short cut allowing brute force attacks to quickly check if the password is valid or not?

If it is slower, is it much slower?

While this of course depends on the encryption method, the usual, short answer is: no, making the file bigger does not make exhaustive search harder.

In general, someone tries an exhaustive search on some key because he is interested in the file contents, meaning that he has context: he already knows the kind of data that he will find. Decrypting only the start of the file is enough to know if he got something that "makes sense" (e.g. a recognizable header for a video file, picture, XML document...) or random junk. This kind of test does not have to be really strict: all the attacker needs is to be able to reject, say 99% of potential keys, and then try to decrypt some more of the file in the 1% of cases where more investigations are needed.

This assumes that the encryption method works in a "streamed" fashion, where the file can be decrypted as the data flows, which is how most encryption systems work in practice, because it is a much desirable feature, especially when handling huge files.

Of course, the right way to defeat exhaustive search is to use a random enough key in the first place. A 128-bit key, generated with a cryptographically secure PRNG, will thwart any exhaustive search, regardless of the encrypted file size. When a cracking attempt is so slow that it does not work in practice, it cannot be made "slower" in any meaningful way: it does not work, and that's the end of it.

If you cannot get a strong key, e.g. because you are doing password-based encryption, and passwords are weak (almost by definition), then you indeed want to make each decryption attempt heavy and slow, so as to try to improve your security situation. But the right method is to do so when transforming the password into a key (something called password hashing), not when applying the key to encrypt the actual data.


Is it secure to choose a password that is a combination of 4 common English words if everyone will do it? According to this article DropBox recommends using four random common words as a password. I think that it is good if only I do it. If everyone does it, the attackers will always make dictionary attack (real dictionary), and it will be very easy to crack (number of common words ^ 4).

So, is it secure or not? When the attacker knows that this is what you are doing?

I work on password research and I have reviewed extensively zxcvbn related papers and those of other researchers in the field.

Yes, the answer referenced by @Arminius is correct in summarizing why this approach aims to improve security without compromising memorability. Please take a look at it.

The core of your question is whether it would be easy to make a dictionary that cracks those passwords with 4 different dictionary words.

It is true that the main argument of the above approaches only addresses the "Bruteforce" threat model, thus calculating the entropy without any consideration for an attacker who has access to the initial dictionary.

Their approach seems to suggest that all that matters is the password "strength" with no regards to how actual attacks are carried out.

Bruce Schneier made an interesting summary of previous commentaries on this.
It becomes more so if, as your premise goes, "everyone is using that scheme" and the attacker knows that.


Integrity of secure WebSocket I'm using a secure WebSocket connection (wss://...) for data transfer to and from a single-page app.

Once a client has been authenticated, should I be passing some sort of authentication token with each message as I would with a typical REST API (something like this)?  Or is it safe to assume the integrity of the connection while it's active?

You'll need authentication if you want to ensure the caller of your REST API is the same as the websocket client, as they're under separate TLS connections.

You don't need to do authentication for the communication of a single websocket connection, as it is under a single TLS connection so the data integrity is ensured by TLS.


Hardening/Security considerations for torrent clients I am running Synology's DSM torrent client on a NAS. As I have to (?) open and forward one UDP port for DHT and another one (UDP/TCP) for data transmission I am exposing myself to threats originating from the internet. If I don't, I circumvent the purpose of a torrent network and become a leecher.

Although I wasn't able to find any exploit that is targeting Synology's Download Manager, I still don't feel reassured that I can feel "safe" (I am patch happy person btw. and keep all my systems up to date). But a NAS, by definition, holds a lot of data and thinking about some ransomware hitting my NAS via this open torrent service makes me shudder.

Unfortunately the Download Manager can't natively be run in another network segment (DMZ) then the other services hosted by the NAS. Even if it could, the process opening the socket would still run on the same physical hardware.

Long story short. How can I harden a torrent client from being exploited? Is there some passive way of sharing data through a relay service so I can keep my ports closed?

The act of port forwarding itself is unlikely to be a major security issue. Risks would come from the fact that the BitTorrent protocol is very complex, and libraries for it are necessarily complex. Any time you have code parsing complex attacker-controlled data structures, you are risking exploitation.
Using a sandbox
Hardening a torrent client can be done using various forms of sandboxing. Different operating systems have different techniques for this, such as AppArmor on Linux systems, Seatbelt on OSX, and AppLocker on Windows. These are all frameworks for limiting the capabilities of individual programs, called Mandatory Access Controls, or MACs. A confined program is called a subject, and resources it wishes to access are called objects. A subject can be restricted to only accessing certain objects (and even then, performing only limited operations on said objects), or objects can be marked as accessible by only certain subjects. This general technique is useful to prevent a compromised application from doing much harm.
Using a seedbox
Another, more complete, solution is to use a seedbox. A seedbox is a remote server running a torrent client. Torrents to be downloaded are uploaded to the server, and when they are completed, they can be downloaded through a direct connection (often http, ftp, sftp, or rsync). Seedboxes provide the ability to continue seeding and leeching even while your computer is off or your network is down, and are not limited by the bandwidth caps imposed by your ISP. However in this case, they also provide the additional benefit of isolating any compromise of the torrent client to the seedbox itself.
Keeping backups
Having all your data on a NAS does open up the risk of ransomware. It is unlikely that an attacker who just wants to distribute such malware would burn a 0day on a fully up to date torrent client. Such attacks are far more advanced. In order to reduce the risk of ransomware in general, though, you should keep most important backups on offline storage. This is important not only to avoid ransomware, but also catastrophic filesystem corruption (which even RAID would not protect against). You should use the 3-2-1 backup rule. This states that you should keep 3 copies of any data you do not want to lose, 2 on different types of storage media, and 1 offsite.


Do network packets capture what gets encrypted in a device? Do network packets capture what gets encrypted in my device before it gets sent to the host? For instance.
In instagram when you log in from a mobile device. You submit a post request. In that post request they have username, password and a parameter called "signed_body" it's value is hashed(encrypted) so each user has a unique signed_body value.

So far I'm sniffing packets from my iOS device. I get packets using wireshark. I have bunch of packets. So I was wondering do these packets have the decrypted signed_body value. GOAL = (If they did, I'd get that value and hash it myself and make calls to instagram server in a accepted format).

Just so people get what signed_body looks like. I'm sniffing HTTP protocols using MiTM Proxy.
Instagram hashes these signed_body to every user and almost every requests so it's unique everytime. So I was assuming that wireshark gives me all the packets in which one them might be the decrypted key

The data is in hex mode.

We can see (in the hexdump) that the POST request payload is urlencoded, and contains two values: signed_body and ig_sig_key_version.  The former contains a string which is composed of 64 characters (which are likely a hex representation of 32 bytes) followed by a dot and a JSON, the later is an integer.  And that is the payload.

TLS transports this payload over an encrypted (and trusted, unless you're in a mitmproxy and you force-trust it) connection.  And that is all that TLS does.  In simple words, you're confusing OSI layers, TLS protects the transport layer but the payload is on application layer.  TLS will transfer any payload in the same way, i.e. had the payload contained clowns= instead of signed_body= TLS would not care at all.

Whatever signed_body is (apart from being a JSON containing your username, password and device info) depends on the instagram app design, yet it definitely is completely unrelated to TLS.  They may or may not use some form of crystallographic hash to generate the first 64 characters from the JSON content plus some random number.  Or (more likely) they use those 64 characters as a CSRF protection token, which is exchanged with the server on each request.


Is there any meaning in only allowing port 80 and 443 today? It's become standard fare for security minded organisations to block everything other than 80 and 443. As a result, more and more applications (other than web browsers) are learning to use these ports for their needs too.

Naturally malicious programs do that too, which then means that to have any real security, firewalls have to actually examine the data stream and block based on application data instead of just ports...

This seems to indicate that port based blocking was a short sighted approach to begin with, kind of like input validation solely on client...

In that case, should we not stop blanket blocking nonstandard ports, and go for more fine grained filtering in the first place...? Or are there other reasons to keep the port-whitelist approach?

Blocking all ports except 80 and 443 can be part of a good defense in depth strategy. If it is your only strategy then you are correct, it will be a flawed one.

A potential exampled layered approach may be

Block all ports at the external firewall minus 80/443
Have an inline IPS (or as part of your firewall) do packet analysis
Sanitize web-app input with a web application firewall
Sanitize db input with a db firewall
Log everything and feed it into a log management system (with alerts)
Backups on everything (whatever your availability strategy may be)
Harden every OS according to whatever baseline/benchmarks you choose (e.g. Org SOP, CIS/DISA STIGS etc)

This is just one very simple example. A good defense in depth strategy has many layers that together build a secure system.


Sanitising a file/folder path from user input I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush.

The scp command below executed on the backup server downloads /var/www/website1/file2 from the main server.

scp backupuser@example.com:website1/file2

I want to make sure that user account can download files only from /var/www. I disabled the absolute path downloads, and now have to filter the path itself.

I started by removing one or more dots from the file path. Tested this approach, and I can no longer manipulate the input and download website1/../../../etc/passwd.
Then I found Alternative ways to exploit this path traversal and added filtering out one or more %, just in case.

Are there any other ways to manipulate the input and get out of the restricted folder that I may be missing and should be aware of?

I'm not sure exactly how you are performing your validation, so I can't give detailed steps.  However, there is a "best practice" here that I can direct you in anyway.
Principle of Least Privileges
Like all things, it's the difference between blacklisting and whitelisting.  The latter is rarely successful.  Whitelisting (or more generally, the Principle of Least Privilege) is always the way to go.  In essence what this means is that you don't want to try to stop the user from using some list of banned characters.  Instead you want to verify that the file/directory that they are actually trying to copy is in the list of permitted files/directories.
Work with the absolute path
They way I do this in similar situations is by taking the user input and "canonicalizing" it - let the OS convert it from a relative path to an absolute path, and then verify that the final, real, absolute path is actually an allowed destination.  Once you have an absolute path, verifying that it is an allowed direction is quite easy.  In the case of linux I would use something like realpath which does exactly that.  I'm not sure if I can guarantee that this approach might not still have edge cases (where realpath ignores an alternate encoding that scp doesn't, potentially leading to a missed exploit), but I suspect the risks will come down substantially.  How to actually implement this kind of check in your particular environment is another matter, and I can't help you with that one.
Small Gotcha
Also, you'll have to watch out for symlinks - if someone accidentally puts a symlink in your application that points to /, then scp will happily follow it and try to copy over your entire filesystem.
Another Approach
Of course all the above could be fixed even more easily by having a process run on the server that packages everything and then moves it off into a /backup directory to be copied out (per the comment from @domen)


Should password hashes be encrypted or HMACed? Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function.

Are there:

tangible security benefits,
precedents, and
respected research

for protecting these hashes from offline attacks by either encrypting the hashes or otherwise applying a secret key to them via, say, an HMAC?

I believe this previous post attempted to ask a similar question, but the question was unclear and treated by most responders as if it asked whether or not passwords themselves should be HMACed instead of being passed through a salted KDF first.

Encryption, or a deterministic MAC, may offer you an extra gain of security on the off-chance that the attacker could grab the database of hashed-and-encrypted passwords but not the encryption/MAC key (which the same server must necessarily know to do his job). Some people call that "pepper" (as a pun with the notion of "salt" -- IT security people are a bunch of joyous fellows). See this previous question on the subject.

Since the scenario is rather restrictive, and using a key implies dealing with key management issues, I would recommend not to bother.


Chaining VPNs to increase privacy? I was wondering if it's possible to chain many VPNs, and if it is, if it increases privacy at all?

My thinking was that each country has data retention laws. If all VPN keep logs (even if most lie about it), they are only required to keep them for a certain period of time.
And by chaining VPNs you would make it harder for authorities to find you because they have to get a court order fom each VPN, right?

So initially they only see the IP of the last VPN. They contact them and ask them for the logs, they refuse until they get a court order. This takes some time, but they get it and contact the VPN. The VPN gives them the logs and now they obtain the IP of the next VPN and so on.

So when they finally reach the last VPN and get that court order for the logs, its data may have already been deleted due to the limited data retention rule.

Does anyone know if this is the case? I've seen this kind of scenario in movies (the chaining thing)

PS: I'm talking about VPNs across different countries. If they are from a single country I guess it would be very easy for the authorities to quickly go through all of them because they control the legal system there.

Remember that VPNs just encrypt your communications between point A and B. In other words, your connection is confidential but not necessarily private.

Assuming that you are using a VPN that has no known vulnerabilities (i.e. logjam) even if you chained VPNs - which would be much effort for little gain - there are a few scenarios where privacy might be compromised (this is not a full list):

You used a payment method and contact info that is linked to you to sign up for the VPN service(s)
Using fake payment and contact info, you used a PC and IP combination that is linked to you to sign up for the VPN service(s) and your ISP logged it.
The target system (i.e. you  remote server A  remote server B  target system) pushes or injects tracking code to your end-point.

Depending on what one would want to be private from, much law-breaking would have to take place (e.g. steal login credentials, hack into someone's wi-fi, pc, or server) to achieve a reasonable high level of anonymity and/or privacy.

Finally, "secrecy", "privacy", and "anonymity" are similar but different concepts. I recommend watching and reading as much as you can by Bruce Schneier to learn more about these concepts.


How can a pdf file have two passwords? I receive emails from my bank with password protected PDF files, and they provide two passwords - either xxxx or yyyy. How is this possible?

Not sure if this is how it is done, but it is one way to do it.
Key A is derived from the first password, and key B is derived from the second password. A random key X is encrypted twice, once with key A and once with key B. Both are stored. The PDF is encrypted with key X.
When the user enters a password, it derives a key from it and tries to decrypt both verisons of X with it. Once X is known, it can be used to decrypt the entire PDF.


How does reuse attack protection (RAP) work? The grsecurity folks just released a test patch for the 4.5 Linux kernel which includes Return Address Reuse Attack Protection or RAP, a protection technique against return-oriented programming (ROP).

Their slides are beyond comprehension for me at this point. Can somebody please explain, in layman's terms, how RAP works and how much protection it provides (is it probabilistic)?

Edit: While the slides led me to believe that RAP stands for "Return Address Protection", Brad Spengler from from the grsecurity team confirmed that it actually for "Reuse Attack Protection" (as also confirmed by Polynomial's answer).

RAP is very similar to a stack canary, except designed to prevent against ROP.

EDIT: After speaking to spender from grsecurity, it turns out that what I'm describing here is a subset of the RAP functionality, specifically the return pointer protection. RAP is actually callled "Reuse Attack Protector", which is designed to protect against all forms of indirect calls. The paper you linked describes some of the functionality within RAP, of which both the return pointer protection and ICFG features are a part of.

We can see the following assembly from the paper:

push %rbx
mov 8(%rsp),%rbx
xor %r12,%rbx
...
xor %r12,%rbx
cmp %rbx,8(%rsp)
jnz .error
pop %rbx
retn
.error:
ud2

The first block there sets up the RAP cookie:

; store the old value of rbx
push %rbx
; read the top value on the stack (the return pointer) and put it in rbx
mov 8(%rsp),%rbx
; xor rbx with a random value stored in r12
; rbx now contains the RAP canary
xor %r12,%rbx

Then, at the end of the function, before the ret:

; xor the RAP canary in rbx with the random value in r12
; this "decrypts" the stack pointer from the RAP canary
xor %r12,%rbx
; compare the top value on the stack (the return pointer)
; with the value decrypted from the RAP canary
cmp %rbx,8(%rsp)
; if the comparison fails, jump to error
jnz .error
; restore the original value of rbx
pop %rbx
; return
retn
.error:
; an error occured, quit the process
ud2

The idea behind ROP is that you would find instructions you want (gadgets) followed by a return instruction. This protection feature re-writes the functions so that the final instruction before each return is always a pop %rbx, and previous instructions are used to validate the RAP canary. This makes it really difficult to find ROP gadgets outside of non-aligned instructions (i.e. gadgets that just happen to exist due to the binary interpretation of instructions outside normal alignment).

The protection can be applied to both usermode and kernel. The cookie value (the value in %r12) is regenerated per task, per syscall, and per iteration in some infinite loops (e.g. event handlers and dispatch loops). The reason for the last one is that infinite loops often use a ret to break out of the loop. (this isn't quite correct).

EDIT: After discussing this more with spender, I'm going to suggest waiting for the explanation to come out. There's a lot of subtlety to how the feature works and I'm not sure I can accurately cover it from the paper and my brief discusson on IRC. Once it's out I'll re-update this answer to give you a better idea of what it does.


Unknown MAC address connected to router I found an unknown MAC address connected to my home router.  How would I figure out what OS the IP or MAC address is running?

As @logicalscope says, you can also look at the MAC lookup chart to find out the manufacturer. This could be spoofed.

You could try to find out the IP address of the device, then you could run nmap against it to see if you can identify the OS.

This could be hidden from you, so an alternative would be to try and connect to it - does it give banners back? Ports 22, 23, 80, 443 etc could be useful starting points here.

Failing that, try forcing it off the network and see if anything breaks :-)


NIST SP 800-90A DRBG, incorrect reult following algorithm, correct result rearranging algorithm steps? I've been starring at this issue for about three days now, and think I need a second set of eyes on the problem. I'm implementing NIST's HASH_DRBG from SP 800-90A Rev. 1, June 2015 (its the latest doc according to NIST Special Publications page). The test vectors are located at CAVP Testing: Random Number Generators.

The problem I am having is I cannot arrive at the test vector result if I follow the algorithm as published. If I move one step down a few slots, then I can arrive at the correct result. Its very unusual, and I'm not sure what I am doing wrong.

The algorithm I am having problem with it Hash_DRBG_Generate Process. Here's the algorithm as a screen capture from section 10.1.1.4 around page 50:

Step 3, Hashgen, produces the pseduo-random bits for the caller. Steps 4-6 then update state for the next call to generate.

If I execute the algorithm exactly as specified, then I return the following bit string to the caller, which is incorrect. Effectively, it uses Current V.

6C58FE76D644750EA5BE880BB1BDD2D54C98139D70BA0F7CA8637EB2527F8BFD223DEB9187976E87
91B706804FB28534D13EC4818FB59DB430C9F04F55AA8549EAD53B39624DAD6CFDAAD99412B8AEB0

If I move Step 3 between Step 6 and Step 7, then I can arrive at the correct result. Effectively, it uses Next V.

56f33d4fdbb9a5b64d26234497e9dcb87798c68d08f7c41199d4bddf97ebbf6cb5550e5d149ff4d5
bd0f05f25a6988c17436396227184af84a564335658e2f8572bea333eee2abff22ffa6de3e22aca2

My questions are pretty crummy:

Am am parsing things incorrectly or doing something obviously wrong?
Why do I need to move Step 3 down to Step 6 and Step 7?
If I have to choose, should I select (a) correct algorithm and incorrect result, or (b) incorrect algorithm and correct result?

Here's the test vector I'm working from. Its the first test vector (COUNT 0) using SHA1 with no predictive resistance. The problem occurs at GENERATE (FIRST CALL). The V value shown, 1658...ed56b, is the value after Steps 4-6 have executed. However, V does not take that value until after Step 3, Hashgen, has executed.

[SHA-1]
[PredictionResistance = False]
[EntropyInputLen = 128]
[NonceLen = 64]
[PersonalizationStringLen = 0]
[AdditionalInputLen = 0]
[ReturnedBitsLen = 640]

COUNT = 0
EntropyInput = 1610b828ccd27de08ceea032a20e9208
Nonce = 492cf1709242f6b5
PersonalizationString =
** INSTANTIATE:
    V = 9e8301725d5f133b4ab7d329fd2f87ae5f89d96a9dd7e2b98beee1c707b8c3fe412d1125b58bae5dc08a11dac3be4a3147347160fef218
    C = e5e12450450efe5fdc777c95b8c23c938fcd592e2d788f12461936e4a16131b1f2d11ce7f0159ee1e635e62f3df8bda4fea077ad5f9d06
    reseed counter = 1
EntropyInputReseed = 72d28c908edaf9a4d1e526d8f2ded544
AdditionalInputReseed =
** RESEED:
    V = 745c659f2944829ca6e209c8ca2dddecf9f1861383e34e94007a3a51b8444fd5ae738e7d9c0d5e69aa97ee16c49cfd2432eb32ba5738fa
    C = a1fc40009357a024d878818cf6f979a88d4cc5d760b308ae1a5b9f067972e6f7cf92ddb129a8d3c1bb0005bcf3f8871fd65e794f1990b7
    reseed counter = 1
AdditionalInput =
** GENERATE (FIRST CALL):
    V = 1658a59fbc9c22c17f5a8b55c1275795873e4beae49657421ad5d95831b736cd7e066c738bcbb343933c411c7c17917593c03a77bed56b
    C = a1fc40009357a024d878818cf6f979a88d4cc5d760b308ae1a5b9f067972e6f7cf92ddb129a8d3c1bb0005bcf3f8871fd65e794f1990b7
    reseed counter = 2
AdditionalInput =
ReturnedBits = 56f33d4fdbb9a5b64d26234497e9dcb87798c68d08f7c41199d4bddf97ebbf6cb5550e5d149ff4d5bd0f05f25a6988c17436396227184af84a564335658e2f8572bea333eee2abff22ffa6de3e22aca2
** GENERATE (SECOND CALL):
    V = b854e5a04ff3c2e657d30ce2b820d13e148b11c245495ff03531785eab2a1dc54d994a5597b15c5b10001f49606c88b4ff0d61acb61820
    C = a1fc40009357a024d878818cf6f979a88d4cc5d760b308ae1a5b9f067972e6f7cf92ddb129a8d3c1bb0005bcf3f8871fd65e794f1990b7
    reseed counter = 3

The answer to this mystery can be found in another NIST document, The
NIST SP 800-90A Deterministic Random Bit Generator Validation System (DRBGVS), p.4:

The Generate random bits, do not print is the 6C58...AEB0 bit string. The second one, Generate random bits, print out is the 56f3...aca2 bit string.


parsing the id-ce-keyUsage extension in X.509 certs I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions.  In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows:

03020106

03 is the tag.  A BIT STRING.  02 is the length.  The value is 0106.  Here's what http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf says about the encoding of bitstring's:

"The initial octet shall encode, as an unsigned binary integer with bit 1 as the least significant bit, the number of
unused bits in the final subsequent octet. The number shall be in the range zero to seven."

Here's the ASN.1 definition for this particular BIT STRING (from http://tools.ietf.org/html/rfc5280#appendix-A.1):

-- key usage extension OID and syntax

id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }

KeyUsage ::= BIT STRING {
     digitalSignature        (0),
     nonRepudiation          (1),  -- recent editions of X.509 have
                                -- renamed this bit to contentCommitment
     keyEncipherment         (2),
     dataEncipherment        (3),
     keyAgreement            (4),
     keyCertSign             (5),
     cRLSign                 (6),
     encipherOnly            (7),
     decipherOnly            (8) }

My question is...  why does the final bitstring have one unused byte?  My expectation would be that it'd have no unused bits since the ASN.1 definition defines values for all eight bits.

In ASN.1, there are two distinct types which are designated by BIT STRING.

If you have this:

Foo ::= BIT STRING

then Foo is a type for a generic string of bits, with an arbitrary length, and arbitrary values for each bit.

On the other hand, with this:

Bar ::= BIT STRING {
    x  (0),
    y  (1),
    z  (2)
}

then Bar is a type for a set of flags, and DER encoding rules state that these should be encoded as if it was a generic BIT STRING, but stopping at the last non-zero bit. Thus, if you want to encode a value of type Bar with the flags x and y set, but not z, then the encoding must be a BIT STRING of length exactly two bits, not three or more. That's what DER mandates; the generic BER rules allow for adding as many extra bits of value zero that you wish. Upon decoding, flags which are beyond the encoded code length are assumed to be cleared.

So, for your BIT STRING: 03 02 01 06 decodes as such:

03: a BIT STRING.
02: the value consists in the next two bytes.
01: first value byte; for a BIT STRING, it means that you shall ignore exactly 1 bit in the last value byte.
06: the bits themselves.

In binary, 06 is 00000110, but the first value byte says that we shall ignore the last bit, to the bytes really encode a string of exactly 7 bits: 0000011.

The last bit of that string is a 1, so this is compatible with the DER rules. When interpreting the bit string as so many individual flags, the two '1' state that flags numbered 5 and 6 are set (that's keyCertSign and cRLSign, respectively, which is typical of CA certificates), while all other flags are cleared, even if their numerical index is larger then the actual encoded bit string.

BER would allow you to encode that KeyUsage value as, for instance:

03 04 05 06 00 00

i.e. a string of 19 bits (three value bytes with bits in them, but the last 5 are ignored). This would still indicate that the keyCertSign and cRLSign flags are set, so the semantics would be identical. However, certificate contents should follow DER, which mandates encoding to the minimal length (trailing zeroes being removed).

This particularity of DER encoding is meant for compatibility with later versions: DER encoding of a set of flags depends on which flags are actually set, not on which flags could have been set -- hence, a later X.509 version could add new possible key usages, without making invalid (i.e. non-DER) certificates which use the previous version.

Really, this would have been much clearer if ASN.1 syntax had not used "BIT STRING" for two distinct purposes. The latter usage (set of flags) should have used an explicit distinct keyword, e.g. "FLAGS".


Command & Control Server List I recently got an email from my ISP saying that they'd detected traffic to a known Command & Control server from my home.  Boo.  I'm sure this probably means one of our computers has some awful virus so I'm about to begin that laborious process.

Is there a list of all known C&C servers published somewhere that I can just add firewall rules for?  Preferably free.  I realize this means computers could still get infected and would just lose the ability to communicate but that seems like a much better alternative than being infected and allowing communication (as alluded to in this question).  Hopefully, this would at least prevent connection long enough for Anti-Virus, OS, etc. to catch up with their definitions (depending how fresh the list is).  Is this even worth it since they're likely pulled down as soon as they're discovered to be hosting malicious services?

Is there a list of all known C&C servers published somewhere that I can just add firewall rules for?

Unfortunately the operators of such botnets and malware have adapted various strategies to work around such blocks.

A complete and always up-to-date list is not possible because these server change frequently either because they got taken down by law enforcement or before they get blocked by too much firewalls. And apart from that some malware also communicates using peer-to-peer structures and don't need central C&C servers. And then there is malware which just gets its commands from twitter feeds or entries on blogging sites.


Can a website see if I'm surfing the web via remote control? I am from Pakistan and Paypal does not work here. I was in contact with a Paypal representative today and he advised me not to access Paypal from Pakistan else they will permanently limit our account.
My business is registered in Dubai but we operate from Pakistan. Accessing our account almost daily is a must and I have been told today not to operate the account from Pakistan.
The only option i have is to access my Paypal account remotely using teamviewer from a PC placed in my Pakistan office.
I am connecting to my PC which is placed in my Dubai office using teamviewer.
Can paypal figure out that i am accessing the account from Pakistan using teamviewer?

No, Paypal should not be able to figure out that you are accessing the account from Pakistan if you are using TeamViewer to access it "from Dubai."
This is provided you do not login to Paypal from Pakistan again, or within a short time period of accessing it "in Dubai."


How to effectively (and reasonably) secure Windows in corporate environment. A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer

Windows XP SP3 - fully patched at the time of compromise
User runs under the "user" privilege and as such should not be able to modify system files
Users computer had on-access virus scan enabled and the definitions were up-to-date
Flash is updated in regular intervals through Group Policy

The user told me that the AV caught something a day previous to them discovering their personal bank account had been drained. They stated that computer was the only computer they've ever used to do online banking. They are not sure whether or not they logged into their web banking after the virus alert, but they did tell me they used the "auto-complete" feature of IE8 to save their credentials for the online banking.

My question is what else could we have done to secure this work machine? We don't have the staff power to effectively implement Software Restrictions and working without Java is not an option either as a lot of their online browsing requires them to use Java. As you can imagine I would like to ensure this never happens again and am open to whatever suggestions you all may have.

Follow a proven hardening standard like NIST for example:
http://csrc.nist.gov/itsec/SP800-68r1.pdf

Implement user awareness security training.  http://www.sans.org/reading_room/whitepapers/awareness/importance-security-awareness-training_33013

Upgrade OS and applications. Although supported until 2014, it is unlikely that there will be another major service pack and several vulnerabilities currently exist that will likely go unpatched.


Is 2FA via mobile phone still a good idea when phones are the most exposed device? Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns:

I travel frequently overseas and lose access to 2FA accounts any time the associated SIM card can't touch a network.
Your phone is inherently your least secured device. I install way more software and download way more files on my phone than anywhere else with much less ability to verify sources or control access. For example, nearly every app requests sweeping permissions to function correctly. Even apps that aren't granted explicit permissions have been found to backdoor those permissions through google services.

I feel like linking my phone to sensitive accounts (such as banking) would actually make them more exposed to attack and more difficult to maintain legitimate access.

Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry especially for non-technical users.

What can be improved? You can use TOTP token using apps like Google Authenticator. This still uses your mobile phone, but it doesn't rely on the phone number, so you can still use OTP even when your phone doesn't have connectivity.

The next step after is to use dedicated hardware token that complies with either U2F or WebAuthn, like RSA token or Yubikey. Website support is fairly limited to some of the major sites, but it's a great alternative when it's available. Google Accounts is also an OAuth provider so you can use it for social network login.


Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched? I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards to:

Ensure the server is secure
Ensure no data was compromised
Ensure no malicious files were uploaded.

The remote code execution vulnerability was particularly bad and allowed any PHP code to be run on the server and output displayed to the user.

The app is hosted on Amazon Lightsail. Would it be helpful to redeploy on a new instance?

The best solution would be to redeploy, but to answer your questions pointwise:

Ensure server is secure : Try and look for any rootkits,processes running that might have been setup to set persistance.
Ensure no data was compromised : Unfortunately, there is not sure way to do this as , data can be ex-filtrated very easily. You should always assume that data could have been ex-filtrated, if it is known that the server was compromised.
Ensure no malicious files were uploaded : This should get covered in the first point itself. If any non-php files remain on your system,it should not cause any problem. All what you can do at this point of time is to manually search for all php files , and decide if its malicious or not.

As you see the above tasks will take a toll !!Hence its recommended that you redeploy the solution!

EDIT 1:
This is only applicable for RCE.
In case of XSS point of view, as long as input is santized nothing needs to be done from server-side


How to securely transfer files from a possibly infected WinXP machine to Linux? There is an old Windows XP installation that was being used without even an antivirus. This WinXP computer has files. These files are important and should be moved to a Linux installation. Given the lack of any security practices on the side of the WinXP owner it seems possible that the data contains malware.

I can now:

Ignore this and simply keep using these files in Linux; after all Linux is supposed to not need AV.

At the very least the files should be scanned to avoid accidental redistribution of malware if they are ever sent to anyone else again
The files contain eg a multitude of .odt / .doc documents - maybe it's a very remote possibility, I don't know, but malicious macros are OS independent?

Install ClamAV on Linux machine, scan the files, remove Clam afterwards.

AFAIK ClamAV is known for its poor detection rate - scanning the files with it is only marginally better than not scanning at all?

Install an AV on the WinXP machine (Panda Free AV still supports WinXP, doesn't it?), scan the files there, only transfer them afterwards.

Which means going online with WinXP once again - this just feels wrong

Any options I overlooked?

I feel stuck. Not sure how to progress.

Note I wouldn't like to manually inspect the files and eg remove any potentially suspicious files like .exe files while leaving safe files like .png files intact. Reason is the data is not mine, I was just asked to transfer it so that someone else may use them.

What is the accepted best practice in a situation like this?

In fact malwares can be present non only in plain files, but also in hidden parts of a file system (hidden files, apparently non allocated blocs, system blocs, etc.)

So, you have two different action here:

select what should be transfered
ensure that what is transfered should not contain malware

For the first part, someone, or a group of persons should identify what files should be transfered. Nothing technical here but still an important part.

For the second part, a good antivirus-antimalware solution should be used. If everything is done correctly, it will not ensure that no malware are present, but it will guarantee that it will not be worse than if the old machine had been correctly secured.

The hard part is that as soon as you mount a possibly infected media on a system you are at risk.

The following is not a magic bullet but just what I would try to use as a less bad way: I know that it can fail, but if the files on the old system have some value, I would accept the risk because I did my best to limit it. Said differently you will have to evaluate to risk/cost ratio of the operation.

Setup a minimal system: the less softvare and services present, the smaller the attack surface. Choose here any (decent) OS provided you are proficient enough with it. If you know many, my preference would be 1:BSD, 2: Linux, 3: Windows (*), because of the increasing complexity of the OS, and the facility to build a really minimal system. If possible the system should allow no remote access at all, and ideally only a command line console should be present (no XWindows if you can avoid it)
install good antimalwares on it. As you want to run it in not daemon mode, it makes sense to install more than one if you can offer it.
from that point on, the system has no reason to be connected to a network, except on a dedicated one for the next step, if you cannot just physically mount a device on it
using a non privileged account, copy all the selected files on a specific point on that system, and disconnect from the old device or system
at that point, the system should be disconnected from any network
pass all the installed antimalware tools on the new files and remove all the infected files unless you can make sure to remove the malwares (still using a non privileged account of course)

At that point, you have a file system that should be as clean as if it had always be installed on a decently protected system, and you should be able to connect it back to your normal network to copy the files on their final target.

(*): I do not know Mac so I cannot say whether they could be a good way here...


What SSH keys should I generate with ssh-keygen to be safe in a quantum computer based world? What SSH keys should I generate with ssh-keygen to be safe in a quantum computer based world?

Quantum computing will make many of the currently hard problems solvable in polinomial time. In the view of the practical IT security, it will essentially mean that it will be able to crack most currently used encryption algorithms, including the ones currently supported by ssh-keygen (openssl).

However,

It is true only for a broad range of problems, and not for all.
Despite the strong development efforts, it is still unclear, if quantum computers will be ever practical reality.
openssl is modular, it can be easily extended with new ciphers, and developing a new cipher for it is much more easier, than cracking it.

No currently used ssh key will be proven safe in the quantum computing world. But it is not a major problem, because this world is currently imaginary.


Metasploit exploit which doesn't require initial user interaction Is it possible to compose an attack vector in such a way that a remote victim will not be required initially to interact with an attacker? That is, if OS is vulnerable then you'll execute the vulnerability successfully without victim perception.

So far in the blogs, articles that I've read, they usually suggest that you create a bait (PDF, Flash Player, etc) then abet the victim to trigger it, but the real life scenario may not work like that.

Enticing someone to click a link or to download a crafted vulnerable file may sound suspicious and shrewd end - user may immediately stop interacting. Aside from all that you will use your credibility.

To do this, you need to attack the services running on a remote machine. There are numerous Metasploit modules that do this, and a nice, curated list can be found on Exploit-DB. The term you are looking for is a "remote exploit".


Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) I am curious of what all the security implications are if I set the following two HTTP response CORS headers;

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false

The only security issues I see are DoS attacks and CSRF attacks.
CSRF attacks can already be achieved with IMG and FORM elements.
DoS attacks related to CORS can be overcome by blocking requests upon the referrer header.

So I'm not sure why it said that only a given set of domains should be given "CORS access".

What are the security implications of adding all domains "CORS access"?

Access-Control-Allow-Origin has a different meaning than simply preventing CSRF: It prevents that the requesting script can get the result of the request.

The same applies to Access-Control-Allow-Credentials. This header allows that the script get the response of a request with credentials. Note that you can't use the wildcard * for Access-Control-Allow-Origin when sending Access-Control-Allow-Credentials: true. but you could just use the value of the Origin request header.

The implication is: What could a script with the contents of your site do?

If the user is logged in, a script can get all the sites that the user can see, parse it and send the (maybe confidential) data back to it's origin.
If you include some kind of anti-CSRF-token in forms/links, they could get the value of the token and do a request with that valid token.
It can act on the page on behalf of the user.

For XSS it depends what you mean with XSS. If you mean with XSS that an other script acts on bealf of a user, then you already allowed that.

So while adding to a remote site only reveals a few informations to the origin site (like the time to load it), the information leak (esp. for users that are logged in) can be much higher.

As a side note: Use the Origin header if present to block requests.


How Google Authenticator in Android mobile identifies this is the right SSH server? I am new to Google Authenticator mechanism. I have gone through the basics of mechanism but I couldn't understood the logic behind it to make a connection to the Linux machine.

I have a Linux machine which has no Internet connectivity and its stored in an internal network where 'n' number of people will access the machine. Here how my mobile exactly identifies my Linux machine IpAddress to sync the seed and counter part to generate the exact secret key.

And one more question is if I have 10 Linux machines and I installed Google Authenticator then how the mobile will identify the exact Linux machine.

I have gone through net and found it's something like KeyURI Format.

KeyURI format: otpauth://TYPE/LABEL?PARAMETERS

Here I didn't find any connection to my server.

Can anyone please explain the process in nook and corner to deep.

Google Authenticator is a offline authenticator. It can both be time-based or event based. Time-based means it will use a Clock to detect the correct code to display.

To prevent desynchronization because the Clocks are imprecise, you simply have a correction factor, so you configure the server to accept a previous code, current code, or a later code.
If a previous code is used, you store "-1" in database. If a later code is used, you store "+1" in a database. And then you decrease or increse the number according to syncronization.
"-1" would then mean you accept the code corresponding to time -2, time -1 and time.
"+2" would then mean you accept the code corresponding to time +1, time +2, and time +3

A important thing is to store the time of the last accepted code, so codes that are equal or previous to the used code cannot be reused.

Since the authenticator is completely time-based, it will mean the same key can be used for unlimited number of servers. Please note that if servers are offline or cannot talk with each other, then a spent code from a machine can be reused at Another machine, provided it hasnt expired in time.

You can also use a Event-based setting, with a counter that Counts up for each display of the code, and then you simply accept all codes that are up to lets say 50 events in future, and then store the Count of the last used code so codes cannot be reused, but then you need one unique key for each machine.

The KeyURI format is to initalize the Google Authenticator, normally you embed the KeyURI in a QR code displayed on screen on account setup, and then you scan it with Google Authenticator to add the seed to Google Authenticator. You simply type a friendly name as "label", for example:
"Server at 192.168.10.3"
And then when you look in Google authenticator, you might see:

542208 (pie of decreasing time)
Server at 192.168.10.3

389578 (pie of decreasing time)
Server at 192.168.10.4

and so on.
Then you know which code you should type in.


Offline phone security How secure is an offline android phone?

Some background.  I want to use an app called Bither on android, which allows me to create a cold wallet on 1 phone and a hot wallet on another phone.

Cold wallet is a wallet which is created on a computer which never connects to the outside world.

Hot wallet is a wallet which is created on a computer which does connect to the outside world.

Assuming that I keep the offline phone in a secure safe, switched off, and only take it out of the safe and switch it on when I want to sign a transaction.

Even if I remove the sim card, is it possible for someone to get access to the data in the offline phone without physically having access to the phone, even if the phone is switched off and the battery is removed?

Removing the SIM alone wouldn't prevent a remote hack if the phone was powered up as WiFi would still be available and therefore an attack vector. However, a phone that is off with no source of power is not remotely hackable. At least there's no demonstrated techniques or even published research that I know of which would make it possible. Without a power source there's no CPU or antenna operation, it's just a sophisticated brick.

The thing is that in order for this cold wallet to be useful it will need to talk to something - as some point you will need to turn this on and connect and then it's just as vulnerable as anything else. Android is designed as a vehicle to get your personal information to the outside world so is chatty by default, however there are some Android ROMs which are designed with security in mind, it would be best if you installed one of those and limited the operation of your cold wallet phone to the bare essentials.


Why is it dangerous for attackers to be able to enumerate all subdomains of a given domain? While it seems like a bad idea for attackers to be able to use DNSSEC to enumerate subdomains, I cannot think of a specific attack that this information enables, which would not be doable without this information.

This isn't about a specific attack. Before an attack, there is usually thorough information gathering about a target. This is where the insecurity exists.

Vulnerable systems on a network are vulnerable whether you have the domain or not. It's a matter of having a list of nodes with often times verbose naming conventions that give away more information then is needed.

It can provide information on network design, location of devices, types of devices, and much more. It doesn't need to be used in a cyber attack either, this type of information could prove valuable in a social engineering attack.

When this type of information used to be widely available, doing a host -l was a standard step in surveying a target. That has since changed and we shouldn't take steps backwards. There is no reason this information should be disclosed to the public internet.


Unable to execute PHP, throws 500 error. Able to upload and execute all others I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5. But when I tried to execute the shell, It shows a 500 error. I am able to view or download all other files such as HTML, JS, JPG etc. On digging further, I found that there is a .htaccess file with the content below. Is there a possibility that PHP is not executing because of the permissions? Is there a way to execute PHP or gain shell using any other ways?

Options -Indexes

<files .htaccess>
  order allow,deny
  deny from all
</files>

#Add all file you want to protect...
<FilesMatch "\.(htaccess|htpasswd|ini|zip|rar|mp3|phps|fla|psd|log|sh|php)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

It is confirmed that the server has PHP Installed and executes PHP on all other directories except uploads folder.

Steps already performed:

Tried uploading shell with different extensions and combination of lower/upper case like PhP, PHp. phtml extension also gets uploaded but same issue of internal server error while executing phtml too.
Checked uploading and viewing HTML on browser, works fine.
Tried with a simple PHP echo. Not working.

If the server is refusing to execute a php script on the uploads folder but runs php scripts elsewhere, it sounds like the server is working as it should. You'll need to use one of those other directories to pop and explore.


Dual control / key encrypting key required? I'm trying to get my head around 3.6.3 and 3.6.2 in the PCI-DSS standard, secure cryptographic key storage and distribution.

Would having two 256 bit key halves stored in separate, isolated locations which are XORed together to create the data encrypting key count? Is a key encrypting key strictly required?

The encryption service would be able to read both halves and assemble the data encrypting key. All administrative access to a given key half will be restricted by RBAC and auditing. Assuming that the keys are from a suitability random data source having one of the key halves wouldn't provide a bit (yes, pun intended) of information as to the actual content of the key.

One of the problems with the PCI DSS is that requirements are either in place or they're not so it's not a risk-based approach. The dual control means no single user has 'the keys to the kingdom' so to speak and the key encrypting key (KEK) prevents the key used for data encryption (let's call it the Data Encryption Key or DEK) from ever being seen in the clear.

The KEK should always be of equal or greater strength than the DEK - I'm not sure the requirements are clear on this though they do recommend you're in line with NIST standards (such as 800-57). I don't think using XOR as a KEK for the DEK would provide this.

Enforcing dual control can be tough - doing it though a service which has access to distributed key parts with separate RBAC is a good idea. Another is having a KEK in an application and DEK encrypted with KEK in a database with RBAC on application and DB systems. MS SQL has a key management system built in using Master Encryption Keys, Data Encryption Keys and certificates to protect keys. StrongAuth have a Lite Encryption Library for doing this also. If you have a QSA, you could ask them how they've seen this implemented in the past.


In a wireless network which is the Radius client, the switch or the wireless access point? I'm sorry if this is a noobish question. If you have some cisco switch connected to d-link wireless access points, which acts as the Radius client?

Whichever is acting as the "Authenticator" (https://en.wikipedia.org/wiki/IEEE_802.1X#Overview).

  The main parts of 802.1x Authentication are:

  A supplicant, a client end user, which wants to be authenticated.
  An authenticator (an access point or a switch), which is a "go between", acting as proxy for the end user, and restricting the end
  user's communication with the authentication server.
  An authentication server (usually a RADIUS server), which decides whether to accept the end user's request for full network access.

https://kb.netgear.com/1209/What-is-802-1x-Security-Authentication-for-Wireless-Networks

From this it looks like you can have the switch authenticate the access point (to prevent someone plugging in a different access point) but that the access point itself could be authenticating the clients too.

The switch would likely only authenticate what is plugged into it and I doubt would be wireless client aware.

See also : Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port?


secure certain data on my webserver I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that info. Some of the data is private, some is public.

I want to keep the private data private as in... If someone breaks into the server I want them to be able to extract encrypted versions, rather than plane text about my users' accounts.

What I've thought about so far is the following.
1. SSL certificate (doesn't really protect the data on the server, but the connection)
2. the data which is market private to be encrypted by a series of algorithms (I would imagine that would be heavy on the server)
3. encrypt the php functions which encodes/decodes the data.

I'm not very well prepared for this tho, so I would like to know what is considered best practice for my situation? Am I overcomplicating the process?

The thing is that the app is not generating any income so I can't afford a sys admin, nor I'm able to look after the traffic 24/7. I'm looking for a solution which will take care on its own. Also I can't spend $$$ on sophisticated software that would do the job. I'm looking to bootstrap the app as much as possible. I can afford the SSL cert but not a 600$ Zend Guard for instance.

PS.
I've used codeigniter so far to write my php code if that matters.

Suggestions?

Most often, these break-ins occur through the application itself. If your encryption is transparent to the app, or to the part of the app through which the break-in occurs (i.e. encryption happens in a function called for any input/output data), then it is not adding any security.

At the same time if your encryption functions are only used explicitly in a few pages, then, say, SQL injection in another form will get the attacker only encrypted data.

In sum, limit the accessibility of unencrypted data throughout your app and check the remaining few places for at least SQL injection (use prepared statements). No need to encrypt the PHP itself - it is not going to help much against a determined attacker.


How can I prove this site has a huge security weakness? Disclaimer: I'm a computer programmer, not a security analyst or anything to do with security. I have zero experience in the world of cryptography, so bear with me please.

Situation: I was given the task to integrate a client's site with a data hosting site. While working on that, I stumbled upon a query that dumps all users' data. To make this query, the user has to 'authenticate' to get a session and use that session code to make this query, which then checks that the user has admin privileges before completing the query and responding.

But still... that seems sort of horrible to me. Especially since this is some of the data that is sent back if the query is successfully run:

"username": "testemail@testemail.blerg",
"firstname": "Test",
"lastname": "Name",
"userpassword": "$1$te000000$qMpAriadAHuRyDkK58YKS0"

There is more data returned that is horrible to expose, but that's not my primary concern.

Clearly no person has ever been named "Test Name", and "testemail.blerg" is not a registered domain, let alone "blerg" being a possible top-level domain. Even if it were, that account has been deleted from the data hosting site and cannot log in. The password that was used is a weak, test-case one, and is not in-use by anyone.

Is is possible for me to brute-force/rainbow-table (while I don't have experience, I know some flash-words :P) or something to get the password from that? What little (I think) I know is that the first part of the userpassword is the MD5 salt, but I don't know anything else.

If anyone can explain how easy it is, I can prove to my boss that this site is completely horrible and convince our client to migrate from this data hosting site.

There is more that I do know about the salting (i.e. how it gets the salt, what language/function it's using, etc), but I'd like to see how easily someone who doesn't have access to that information can figure it out. Another thing for me to go to my boss with, hopefully.

EDIT: There seems to a little confusion related to my intentionally being vague in the description, partially for the purpose of preventing any indication of which CRM this is, for legal/etc reasons. I also realize that my calling it 'data hosting' was potentially misleading, so my bad. Hopefully this clarifies:

The work our team is doing is creating a basic website for a company to show off their products. The only interaction I have with the CRM is:

When a person fills out the Contact Us form, we POST to the CRM a Contacts object with the user's information.
Do a GET on a list of Dealers that sell their products to display.

I started with #2, the GET API call, where I found out that I can query the Users table. I have not created the API, I have only been making requests of it.

The GET call requires a param query= where the value is a SELECT statement in the system's query language, which is then translated to SQL (presumably preventing SQLI attacks, but I don't know how it interprets/translates to SQL, so I'm not touching that with a 10ft pole). By changing SELECT * FROM Dealers; to SELECT * FROM Users; in the query I was able to see every user's data.

The way the CRM handles users is with a portal on their site. A user is created in the portal, where there is an "Is Admin" checkbox. This can be edited at any time through the portal. This is the process to making API requests:

A user makes a request to the CRM, containing the username, for a token.
The token is concatenated with the "secret" access key for that user, the resulting string is MD5 hashed and then sent back to request a session token.
This session token is included with every request, as a querystring param, to "verify" that the request is "authorized".

One of the problems is that if an 'admin' user makes a request of the Users table, the response is a list of every user with the information I listed above as well as the user's "secret" access token (and other information). So it's even worse than just exposing a password, it's practically granting access to anyone by impersonating anyone.

The password format in the userpassword attribute looks like the standard format used by various unix services, such as the default system password service which stores hashed passwords in /etc/shadow. The format is basically:

$ type $ salt $ hash

In your example, the type is 1, which designates an md5 hash. There are other well-known types, such as various sizes of the sha-family hash functions.

Breaking an md5 hash is almost trivial today, even when it's salted, because md5 is so fast. It's not a hash function which is safe to use for hashing passwords; hashcat and other password crackers can literally hash millions or even billions of password candidates per second.

So this data store service isn't just horrible because it sends user password hashes back, it's even more horrible because it actually uses md5 hashes to store passwords.

To prove to your boss that this really isn't secure, you could download hashcat and a few password lists (you can easily find them online), and then run hashcat on a computer with a very powerful GPU on all the passwords you get from the service. Make a note of how many passwords hashcat can crack (without looking at the passwords themselves - they may reveal private information about the people who chose them, and you don't want to actually know their passwords), and inform the people whose passwords were compromised that they need to choose a new password. You'll probably need to get permission to do all this first, because depending on where you live and work, this might actually be considered a malicious attack, or even be illegal.

Aside: If you were stuck on using this service even after voicing your misgivings, I'd suggest that setting up an automated password cracker that runs without human intervention and informs people (by sending them an e-mail) when it manages to crack their password would be a way to protect your users from this kind of bad design. It would help to weed out weak passwords and increase the amount of time needed by a real attacker to crack passwords.

Edit: Zach pointed out that the aside isn't common practice and shouldn't be attempted by someone not able to assess the risks. I fully agree with that. At the very least, if you did something like that, you should have management okay it.

Still, NOT doing this doesn't make the resulting system more secure. It's the equivalent of sticking your head in the sand out of fear that if you actually did something to improve password security, it might backfire on you. We know that people choose bad passwords, and we know that md5 is not a good way to hash passwords. If we can't change these two facts, and we are in a position to weed out weak passwords, then we should probably do it to make our users safer.

One important reason this isn't seen much, or even considered much, is that we usually aren't in a position to implement it. Good systems don't use fast hash functions to hash passwords, and we usually don't get access to the whole hashed password database.


Can I prove the relation between AIK and EK without asking to the TPM 2.0? The Endorsement Key (EK), the Public part, is available directly on the TPM chip, I know that you can generate an AIK key and then sign with that key, the hash must be generated by the TPM.

The idea is to execute remote attestation with the following artifacts:

Endorsment Key (EK)
AIK public Key
Some nonce sent in order to be signed by the private Key from the AIK

In short, no. But, that doesn't mean that asking the TPM to use the EK is difficult -- definitely no more difficult than asking for a quote (the primary part of an attestation).

First, a nitpick: the AIK (attestation identity key) is a key type of the TPM 1.2 (and before). The TPM 2.0 has a similar key type called an AK (attestation key). Though these keys have similar roles, they are not the same. AIKs can only sign a few (3) different structures. AKs will sign anything that was hashed by the TPM, however the TPM will not hash any data that starts with a magic number, such as a quote. This is how TPM 2.0 ensures that the AK cannot be used to sign a fake quote. TPMs can have non-AK signing keys that could sign a fake quote, however.

A quote is just a chunk of data which comes with a signature. If you fully trust a client to send attestation data without a TPM, then you wouldn't have a reason to use a TPM. If you are going to use a TPM, then you want to know that they signature over the quote actually came from a real TPM. Having a signature from an AK is a good way to know trust the quote (because of that hash/magic number thing), but you need to have some sort of proof that the signing key is actually an AK. To do that, you need a way to bind the signing key back to something that only a real TPM can have: an EK certificate signed by the manufacturer of that TPM.

The EK is not a signing key, and so it will never produce a signature. To bind an AK to an EK involves a process that is covered under two processes: MakeCredential and ActivateCredential. MakeCredential can be done by a TPM, but does not have to be. This requires an EK certificate for the TPM in question, and the "name" of the AK. After validating that the EK certificate is valid, you will use the name in a complex process to encrypt a challenge with the public EK. Then you send that data back to the TPM, have it perform ActivateCredential, and if everything is right, return the challenge to you for comparison. Only when you verify that the challenge returned matches the one sent inside the encrypted package can you trust that the key that signed the quote is a real AK, and that the quote is real.


Double hashing passwords between Java microservices to increase security? We have a Java Zuul gateway microservice that runs infront of all of our services. This gateway provides security check for all inbound traffic.

We also have an IAM service that provides login/logout/create user functionalities that sits behind the gateway. These endpoints would take in passwords.

We want to make sure that clear text passwords travel in as small sections of our systems as possible. We can have the gateway hashing the password in a zuul filter and then pass the requests on to IAM. But if someone bypasses the gateway somehow, they can potentially reach the endpoint with a stolen hash and use it to gain access, like a "Pass The Hash" kind of attack. So we would want to rehash the hash that was generated by the gateway and then store the value in database.

The question is, is there any potential problem with double hashing between microservices? To name a specific implementation, let's say BCrypt, would this work?

I do not see a problem with double hashing per se, but there are some trade offs to doing it this way.  First and foremost, if an attacker is able to steal a hashed password as described, there is nothing preventing them from cracking that hash, and just using the password like a regular user.  Secondly, if you need another service to access the IAM service, you would have to perform the same two-step hashing.  Your solution becomes much less flexible at that point.


SSL CipherSuite Choices In SSL/TLS, is the CipherSuite chosen by the server or the client? Also, can the certificate in any way dictate or modify the CipherSuite?

The client sends a list of cipher suites that it supports. The server then chooses the cipher suite that will be used, among those sent by the client. So the server chooses the cipher suite, within the constraints of what the client supports (or is willing to admit that it supports).

Also, the list of supported cipher suite sent by the client is supposed to be ordered by preference; a courteous server should select the suite most preferred by the client, among the set of suites that both client and server support. Not all SSL/TLS servers are courteous.

The certificate impacts the choice. For instance, cipher suites "TLS_RSA_*" assume that the server's public key is of type RSA, and suitable for encryption; they cannot be used if the server's key is not a RSA key, or if the extensions within the certificate (i.e. the "Key Usage" extension) forbid encryption-based key exchange (e.g. a signature-only certificate).


Computers connecting to suspicious websites via squid proxy I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time everyday, where it appears that some of my computers are connecting to some suspicious url using the HEAD method. Could this possibly be malicious? The strange thing is if I directly try to access these urls in my web browser, I get a domain does not exist error message. Below are two entries from the access.log file:

1459622257.968    272 my_ip_address TCP_MISS/503 368 HEAD http://davbktmzjytczu/ - DIRECT/davbktmzjytczu text/html
1459622257.975    276 my_ip_address TCP_MISS/503 368 HEAD http://ogkmqztbntzxcxf/ - DIRECT/ogkmqztbntzxcxf text/html

This is just Google Chrome checking if your ISP is doing DNS hijacking. It checks if these random hostnames will resolve to some valid IP (i.e. hijacked to serve "helpful information", often with ads in it) or will be reported as unresolveable. Nothing to worry about. For more details see Chromes startup random DNS queries ... or Unusual HEAD requests to nonsense URLs from Chrome.


Is it safe to use cheap USB data cables? Websites like Amazon and eBay sell USB data cables for a pittance, often of unknown or dubious provenance.

Should I be wary of using these cables to transfer data to or from my devices?  Is it possible (and plausible) that they have a malicious payload that can compromise the security of the host device?

Do you have reason to expect targeted attacks?

It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons:

That would raise the cost of the cable far above its price, and would be uneconomical even considering the ability to "monetize" a certain amount of random untargeted computers owned by the attack, so there are no good economic reasons for attackers to do this.
We would have noticed such an attack. While most people wouldn't notice, if this was a mass attack, there would reasonably be some detection of that. Malware that tries to randomly hack many, many computers has obvious problems staying undetected for long.

However, if you have some reason to expect targeted, expensive attacks aimed to compromise you by people who have no qualms to perform illegal actions, then it certainly is a possibility that the hardware you receive is "special". However, that's not limited in any way to cheap USB data cables, or USB data cables - reasonably similar attacks would apply for any device you purchase in the same way, from mice/keyboards to laptops or server hardware. How do you know that your computer didn't have a hardware / firmware backdoor installed when you bought it?

If you have reason to expect such risks, you have to treat your USB data cable purchases in a similar manner as all other sensitive hardware; for example, ensure that you buy an item that cannot possibly be "adjusted" especially for you, e.g. random purchase of a generic item from a store shelf instead of a remote order that will be mailed to your address.


Social login - authenticate if email exists or create new user Here's the idea:

I have a website where I offer to users to log-in/sign-up via social networks(in this case Facebook and LinkedIn)
When a user authenticates with either provider I look-up the users in my DB and see if there's already a user that has the same social network ID added to their profile.
If there is - they get logged-in
If there isn't, a new user is registered in my DB.

Now the question is - since I can get the user's email on the social network I can look-up my users based on that as well. Should I proceed and log them in at that point or is that considered a security breach(since depending on the social network you can possibly change your email to one that you don't own, thus breaking into someone else's profile)?

Because they might have already registered an account using the standard registration form and then forgot that they've done that and clicked on the social network login button. Obviously you don't want them to get a new profile(and technically they can't since that email is already used).

Or perhaps if a user with that email already exists, then I can display a message to the user that says something like

  An account with your email already exists. Please log-in with that email and your password using the form below and then add your social network profile in order to be able to log-in with it in the future.

PS: I already asked the same question on webapps.stackexchange.com but it turned out to be the wrong place for it. By looking at the guidelines for questions on this site it seems like it's the appropriate place to ask the question, but if it's not I'd be happy if someone points me in the right direction.

This way once they log-in with their on-site account, they can authenticate with the service again and a connection between their account on the service and their local account would be made, allowing them to log-in with it in the future.

I would strongly suggest independently authenticating every method used. These sites may offer user email information and I think it might be appropriate to use email as a contact method, but I wouldn't use it as a login without the user being able to demonstrate control of both methods that are being combined.

For example, Jane has her Facebook account compromised but was smart enough to use a different password for her email (or perhaps the compromise was through a method that didn't involve a password at all). She might recover that account at a future point, but an attacker could also use it to leverage a takeover of her account on your site.

For this and many other reasons I recommend that if a user is trying to combine multiple access methods, you should properly authenticate with at least one of the old ones and the new one during session where you combine them.


Can hackers detect my operating system? I've seen people demonstrating the use of BackTrack to attack VMs. In one of the components of BackTrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, I would like to know if it is possible for attackers to know that I am using an outdated OS and exploit its vulnerabilities.

Edit: I would also like to know if it should be a concern if attackers know my operating system. I assume that with an antimalware product like MSE with the latest definitions I should be safe.

Edit 2: From what I've gathered, the threat is real. Personally, I will be shutting off my access to the internet for the time being. I will wait a few months or so after April. If things get bad, I will upgrade my OS. The thing about Windows XP is that it is still a very capable OS that many still find comfortable to use.

Yes, this is very possible.

In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating systems fingerprints, nmap can determine with reasonable accuracy what operating system is running on the system.


Remove Password Protection from XLS Document Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) document?  Note that I am not asking for ways in which to crack or brute-force the password.  I know that Excel 2003 uses RC4 for the encryption scheme.  However, it does not store files in the same zip like structure that 2007 and 2010 does.

Additional Updates:  This is for a forgotten "File Open" and not VBA password.  I would be happy to hex edit the file too if I could find the specifications for where the password was stored.  An example used for VBA file removal is listed here, http://gbanik.blogspot.co.uk/2010/08/understanding-excel-file-internals.html, and this is something sort of like what I am looking for except for the "File Open" password.

See this blog post which links to the official documentation. As the blog post explains, it seems that the encryption uses RC4 with a 128-bit key which is derived form the password; BUT (and that's the important point) the derivation truncates the unknown values at some point, down to 40 bits (see section 2.3.6.2). So, for a given document (using the salts and other values which are in the document header), there are only 240 possible RC4 keys, and that's workable with a PC in a fortnight (the blog post states that it could be lowered to "a few minutes" with GPUs, which is a bit exaggerated and unsubstantiated, especially since RC4 does not map well on GPU).

The challenge is finding software which does the exploration, from sources which are sufficiently respectable-looking that you would not fear running it on your PC. The other solution is programming it yourself.

(I had begun something like that at some point, but the file owner suddenly remembered the password and my effort stopped. So I quite believe that it is doable, and not very hard, but I have no code to show.)


How to prove that authentication system works, and that the customer is using the wrong password? Occasionally (though rarely), some of our users say that their password doesn't work: they say that they have typed the correct password but got the 'wrong password' message.

We tell them to use the reset password feature, which they do, but they stay with that feeling that the authentication system sometimes doesn't work.

Our guess is that their password is not what they remember, but since we don't store it in plain text, do we have any way to prove that's the case?

On some occasions we were able to show them that on a certain date they had changed their password and then forgot about it, and they were satisfied. But that's not always the case.

There's not a really quick way to prove this because the hash is designed not to be reversible.

You could take their claimed password, and manually generate the hash as @TechTreeDev suggested. You should be using a salted hash (i.e. BCrypt) so make sure you use the same salt.

If the manually generated hash matches, then you've proved an issue in the login code.
More likely the generated hash will be different, then you've ruled out login code issues, but there still could be an issue with the password setup, or a mistake in your manual generation.

That's pretty much the extent of what you can do to check a single person's password. Beyond that we get into system testing.

If you suspect an intermittent/random chance edge case, you could create a monkey test script to set up passwords and then try them. This approach is probably overkill though.
The best thing is to review your login code and all points that reset the password. The code should be as short and concise as possible. In my experience, the best way to rule out edge case issues is with code review, as such edge cases are often not covered by manual testing.

A few things to specifically look for:

Make sure that maxlength setting is consistent (or better yet, not present) on any password <input>s. You are looking for consistency between password set up and the login form.
Make sure there is no server-side truncation.
Make sure that encoding is consistent. If a non-ASCII character is used in the password, the password setup form and login forms need to behave exactly the same.
Also don't automatically strip anything like whitespace or non-ASCII characters from the password. This is the kind of thing you can easily catch with a code review if your code is concise.

Finally some human tips:

Verify they are using the correct username first.
Check the caps lock setting is correct.
Give the customer support folks a log of every date/time of login or of password reset. If there has been at least one login since the last reset then they know the system worked correctly.

As long as the login code is unchanged, and the hash is unchanged since last success, then you can be reasonably certain that the issue must be a mis-typed password.
Review the UX of the Wrong Password error, providing the user with some simple tips and authoritative explanation of possibilities. This may reduce call-ins to customer service.
It may be helpful to email notify the customer when a password is reset to remind them. (or other family member in case of shared accounts)


How difficult is it to modify AES ciphertext in a meaningful way Say I have the text user:123 encrypted with AES/ECB/PKCS5Padding, resulting in the ciphertext vnjlWxfkYuTK3juNY38NKQ==. How difficult is it to modify the ciphertext in order to get another meaningful 3-digit numerical value? Is it similar in difficulty to brute-forcing the encryption key?

If I just modify one byte of the ciphertext I get garbled data in the entire block, so I need quite an elaborate change to the ciphertext in order to affect just the value part in a meaningful way. Just how elaborate would this change be?

Background:
I come fairly often across cases in which encryption is used as a means to "secretly" transmit data between applications, most of the times using some mode of AES encryption. In most of these cases it is however more critical that the data does not get modified in transit or by the user, as opposed to not being readable.

Example: User X is logged into application A, and goes via a link, with parameters containing the user identity, to application B. The link parameters are AES/ECB encrypted, using a key that is known to both applications. HTTPS is used by both applications, so the threat of the parameters being read by a third party is covered. More important is that the user cannot change their identity and impersonate another user.

I would like to point out this common misconception to the developers and architects of applications A and B, that encryption means that data can't be changed, by showing an attack scenario where the ciphertext is changed, so that upon decryption, valid data is received. This way they can understand better that in such cases an authenticated encryption algorithm is a must.

If the padded plaintext fits into a single block, then editing it in a meaningful way without knowing the key ought to be pretty darn impossible -- in the technical sense that being able to do that (even just some of the time) would count as a full-scale break of AES.

In other words, single-block AES encryption is self-auththenticating to the exact degree that the space of valid plaintexts is small compared to the space of all possible blocks (assuming that the recipient actually verifies that the deciphered block is valid). It does not matter whether the valid plaintexts are mostly similar or look very different; all that counts is only how many of them there are. This is because AES, like any other good block cipher, is supposed to behave like a pseudo-random permutation of the space of all possible blocks.

This of course ignores the possibility of higher-level protocol attacks, such as tricking the recipient into accepting an block that was already encrypted separately (say, for a different run of the protocol).

Once your plaintext is longer than one block, using ECB makes it trivially easy to mix and match between pieces of separately encoded messages at block boundaries. But this is a property of ECB, not of AES in particular. No halfway serious application should use ECB for data that are not strongly known always to fit in a single block.

In your example it sounds like it would be a lot more relevant to attack application A directly than to attack the communication between A and B. For example, if application A runs on a device or account that the user controls, the user could likely modify the data before application A even encrypts them, and/or inspect the (running?) application to extract the key.

Alternatively, it sounds like the protocol you're sketching would likely be vulnerable to replay attacks, without bothering to edit any messages. This means that an attack on the TLS transport (such as by tricking the client end into trusting a CA root that you control) could be escalated into an attack on the authentication part -- i.e. the additional encryption of the credentials may give much less additional security than the designers intend to.


What is currently the best Searchable Encryption (SE) algorithm that works in practice? I'm struggling to find good literature on Searchable Encryption. There are of course a few student papers written in LaTeX using Computer Modern that has some nice Greek soups in them, but none with any actual concrete examples. The same goes for videos on YouTube. The article in Wikipedia is scarce at best.

I have yet to determine which algorithm is currently the best (as of May 2018).

Does anybody know what is currently considered the best algorithm in this field that also works in practice? I would also take literature references.

I was at this talk earlier this year and was impressed by the approach. The product is called EncryptedQuery which attempts to solve the (I assume related) problem of Private Information Retrieval. PIR is probably a stronger requirement than SE since with PIR, even the db server isn't allowed to know what you searched for or which record was returned.

My notes on the talk:

Motivation: cases where you want to keep your data access patterns private.
PIR is intertwined with the problems of Oblivious Transfer and Secure Multiparty Computation.
In 2016 NSA open-sourced a PIR software stack called PIRK
In 2017 PIRK project retired. The company Envieta took up the project and renamed it EncryptedQuery
It uses Paillier encryption, which is homomorphic in the sense that addition in plaintext space becomes multiplication in ciphertext space.

My understanding of the algorithm (probably wrong, though this made sense at the time) is that the requester encrypts a string

encr_req = encr(0 0 0 0 0 1 0 0 0 0 ...}

where say the kth column containing the 1 is the row number that it wants retrieved. Once this string is encrypted, the server doesn't know which column contains the 1.

Then the server iterates over the database doing

sum_i( encr_req[i] * encr(data[i]) )

Because Paillier is homomorphic and all but one of the plaintext values is 0, this is equivalent to

0*data[0] + 0*data[1] + ... + 1*data[k] + 0*data[k+1] + ...

So when you decrypt, you'll have your result.

decr( sum_i( encr_req[i] * encr(data[i]) ) ) = data[k]

Pros:

The server is able to handle retrieving items from the database by ID without knowing which ID was requested.
Bandwidth of the response is low: sum_i( encr_req[i] * encr(data[i]) ) is the width of a single database field.
Can be extended to request multiple items in the same query.

Cons:

Performance: for each request, the server needs to iterate over the entire database, encrypting every entry with the requester's public key.
All rows in the database must have the same bit-width (which you want to keep small for performance reasons on the encryption step).
Number of entries in the database, and their order, must be fixed and known to the requester.
For large or less structured DBs, use a more general (but less secure) Searchable Encryption.

TL;DR I'm not sure this actually answers HelloWorld's question about what's the best searchable encryption :/


Should one encrypt traffic even when using HTTPS? I took a look at google and here and I coudn't find the answer to this question:

Let's say that I have a Webservice and an Android app. They communicate over HTTPS. Should I encrypt traffic or I can assume that the communications are relatively secure?

I'm not considering cert pinning here. In this case, cert pinning use would change the security measures that I should put in place?

Edit 1:

This scenario comes to my mind when considering that an attacker that controls the device running the app (that is fairly easy) can intercept the communication and see every bit of clear information being transmitted.

Scenario: I have a app that can make payments with credit card. Should I rely on TLS to secure the credit card information being sent?

If the communication is happening over HTTPS then it is already encrypted. HTTPS includes the SSL/TLS end-to-end encryption between client and web server.

So in short, no, you do not need to encrypt it any further provided that you implemented HTTPS correctly.

For more details, see this post: How does SSL/TLS work?

UPDATE in response to the update to the question:

If an attacker is in "control of" the user device running your app, security is compromised no matter what way you look at it. Your encryption/security procedures kick in before the sensitive information is being communicated over the network. However, while the user enters, say, his credit card number on his cellphone, it is still in plaintext and vulnerable to the attacker in control.

So yes, you can rely on TLS to secure the credit card information being sent. But there's not much you can do as an app developer against an attacker in control of the device.


Why does MySQLi using question marks (?) instead of the sprintf formatting? As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it

$stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?");
$stmt->bind_param('s', $var);

instead of

$stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = %s", $var);

Were there some complications with using the sprintf formatting, or were there security risks associated with it? Additionally, if you needed to have a question mark in your SQL statement, is there a way to escape it (in sprintf(), you would just do %% instead of %)?

There is no particular standard for what parameterised queries look like, so it could just as well be any syntax. I'm not sure what DB layer you were previously using that preferred %s (but if it's the Python MySQLdb then the reason for that is that it's using its own non-native parameterisation function which actually uses the string format operator to drop the parameters into the query).

PHP's mysqli_prepare is implemented using the libmysql-native parameterisation C function mysql_stmt_prepare and that function decided to use question marks.

  if you needed to have a question mark in your SQL statement, is there a way to escape it

You don't need to escape it: apart from representing a parameter, the only place you can use a question mark in SQL is in a string literal. ? doesn't have special powers in a string literal, so:

SELECT '?' FROM x WHERE x.id=?

selects a literal question mark where the id matches the parameter.