Encrypt-function inside PHP code that you have to publish If you write a PHP application, where you have to deliver the compiled code to the customer, how could you include a functionality to send encrypted data from that application to others, and include those needed keys inside the code, so the customer cannot reverse engineer it so easily?

Just including the keys in the code and compile it with ionCube doesen't seem the best solution for this:

  How secure is ionCube compiled code? ... not secure enough

With the standard engine, you can't. There are a number of code obfuscator available as well as several PHP code protection tool but none will offer you good protection against an attacker who knows what he's doing.

There is one additional issue that I read in your description of your problem: you seem to want to protect passwords or other secret data using code obfuscation. If that is indeed the case, then stop right there: there is NO way to protect such data from someone with a debugger if you follow that path. All you can do is slow down a potential attacker so your only hope is that the data you want to protect is not worth the time spent retrieving it.

If you really must provide robust data security in your application, you'll need to find another model (which will depend on what you're doing, exactly).


Folder AES Encryption I am new to this field and I watched many simulation of AES. I'm curious on how exactly AES encrypts/decrypts OS folders?

AES is a standard for encrypting/decrypting data. It doesn't specify how folders and files will be represented after encrypting them, so different crypto software may represent folders differently and is entirely up to the software you use to decide how to do it.

One method of how a crypto software will represent folders inside a single encrypted file would be a file achiever i.e. tarball format (.tar), it could also be combined with gzip to compress the archive before encrypting it.

I'm not saying crypto software does this, just that this is ONE method for how a crypto software 'could' represent files/folders if that what you're asking and has nothing to do with AES itself.


Client certificate common name? Subject alternative name? For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) before clients can post some data.

There is much less information about client certificates. Besides documentations, there are best practices. I would like to know, how to set common name and subject alternative names for clients, as they won't have a domain name and a fix IP address.

Do I simply tell the server to ignore a mismatch? Can I use a wild card only CN (CN=*)? I also would like the cert to identify specific client. Server needs to be able to tell apart client 1 from client 2, etc...

Thanks!

What is used as subject in the client certificate depends on the context. If humans should be identified commonly an email address or a name is used. If machines should be identified typically the hostname of the machine is used. In the latter case it is probably best to use a subject alternative name (and maybe CN too) since a CN by itself does not express the type of the subject (i.e. DNS name, IP address, URL...).


Court order and domain + hosting privacy I'm receiving legal threats from a law firm that wants me to remove information from my website that one of their clients are unhappy with. Specifically they threaten me with a court order forcing me to remove the contents should I not comply.

But... they don't know who I am because:

1) I got WhoIs Guard protection on the affected domain

2) The real registration details are incomplete and do not point towards my identity

3) The website is hosted on a dedicated server (no shared resources on that IP)

4) Nothing on the website points to me. Not even an email (I use a contact form)

5) I'm not a company or legal entity. Just a dude with a website.

Now, my real identity is linked to:

1) The NameCheap user account (that's where I purchased the domain) and credit card transaction for the purchase

2) The Amazon AWS hosting account and my credit card details

Now, I'm not a terrorist and have not broken any laws - just dealing with a disgruntled company that's unhappy with a product review they claim is "defamatory" (it's a pretty harsh review) - but I'm stubborn and don't want these jokers to dictate what I post on my website.

With a court order - should they obtain one - what's the risk of either NameCheap or AWS disclosing my identity through user account details or credit card payments?

I'm not a lawyer, nor do I play one on TV. (you might want to consult a real one who specializes in this type of thing)

It seems to me that if you are just reviewing a product and giving your honest opinion then that is freedom of speech.

HOWEVER, if they have the resources and the will to do so, they can easily make at least some part of your life difficult, possibly threatening your host to the point where they play it safe and you get the shaft.

That being said, a third options comes to mind where you comply with what they ask (take down the content) and then you replace it with a new review that includes parts of the original review in addition to the reason why the original is no longer hosted on your site. Also you can perhaps have the original review posted on some other, much larger, site that is not your own and has a fair history of standing up for itself and its users successfully.

Posting that the reason your review is no longer visible on your site is because of legal action is something that they cannot complain about (because they literally caused it) and it also can serve as an even worse review than the first one (although I haven't read the first review).

I have not even mentioned your anonymity, because you have already gotten the notice by some method or another, so that means that there is a trail of breadcrumbs back to you already. However long it is, it exists. I personally would not rely on anonymity at this point at all if I were you, mostly because they might not know who you are now, but legal action could perhaps get them that information in the future.

PS: Good job for having a site popular enough to get the attention of the company you gave a bad review to in the first place.

EDIT:

To more specifically address your online anonymity, because it appears that this is the prime purpose of your question. I personally always go by the general idea that unless you took specific measures to be anonymous from the beginning (and at every step of the way) you are not anonymous while online (at all). And even then, if you have gone to great lengths, there is still little or no way to know if you truly are anonymous until someone looks hard enough to find you.


How would two people with burner phones communicate? According to Edward Snowden in this tweet...

  Phones used in real-world ops are disposed on a per-action, or per-call basis. Lifetimes of minutes, hours. Not days.

Let's imagine for a moment that I'm Jason Bourne. I've stopped by the kiosk in Waterloo Station and picked up a PAYG mobile phone. Presumably I've used fake ID.

At the same time, my counterparty Jack Bauer is picking up a prepaid phone from a similar kiosk at Los Angeles International Airport.

How do I actually place a call to him, given that both of us have new phone numbers?

Burner phone numbers as an OTP 'equivalent'

You can think of the "identities" of those phones (phone number, SIM, phone itself/IMEI) as an equivalent of one-time pad encryption - you exchange the phone numbers (multiple) over a secure channel - e.g., when meeting in person; and then they're secure and provide no useful information (for network/metadata analysis) as long as you discard them after a single use.

In your proposed scenario, Jack would have picked up a bunch of prepaid phone cards and given you the list of those numbers. Afterwards, if you'd need to contact him, you would call the first number on the list, have your conversation, and after that you could both discard the phones. If you'd expect a future call, then you'd turn on the phones corresponding to the second item on your lists.


Is there a standard, storage algorithm or protocol for fingerprints? What are the generic conventions and standards for storing and identifying biometric fingerprints out there?

Are there some RFC documents for that?

As a sub-question: suppose I want to preserve my own fingerprint on some digital media - is there a public format to do this?

Superficially, I know the market has both simple technologies that only take fingers' photos, and more sophisticated technologies as Apple's TouchID, as well as biometric databases of states and police.

Therefore, any related information will be helpful!

AFIS is the name of rhe Automated Fingerprint Identification Service, and NIST is the federal agency responsible for technical standards. Search Google for "site:nist.gov afis" and you'll find this link: http://www.nist.gov/oles/afis_interoperability.cfm

From it, it's evident that law enforcement agencies are still struggling to create interoperable systems, which strongly suggests that specific standards you are looking for are still fairly rudimentary. But it also lists progress that's been made.


The way to determine IV for AES encryption, possible security problems with this approach I am trying to make a folder encryption with maximum automation (except password input).
Inside a bash script I do the following:

echo $RANDOM | md5sum | cut -d' ' -f1 > iv

and then using it:

openssl aes-128-cbc -md sha256 -iv $(cat iv) -in folder.7z -out folder.7z.enc

Assuming that echo $RANDOM returns good random value, then I use md5sum on that value, and md5sum has collision weaknesses, so I assume that there is some security problem with that, but this is the way I found of how to produce a correct iv string for openssl. Can someone point what exactly can be a problem with this approach, and may be give an advice how to produce a pseudo-random iv in a better way?

Assuming that echo $RANDOM returns good random value…

It does not. $RANDOM in bash is implemented using a LCRNG with 32 bits of state and a 15-bit output.


If ssl certs authenticate the servers ip address, how come I can't find a whitelisted ip address in any secure certs or am i looking in wrong place? UPDATE This question is illogical. Https does not authenticate the IP address I was wrong.

I guess my question (should have been) how can I verify the server's IP from the cert? I thought that was an important part of it.

;; ANSWER SECTION:
www.kiwibank.co.nz. 60  IN  CNAME   static.kbprod.cloud.
static.kbprod.cloud.    60  IN  A   54.192.135.164
static.kbprod.cloud.    60  IN  A   54.192.135.228
static.kbprod.cloud.    60  IN  A   54.192.135.182
static.kbprod.cloud.    60  IN  A   54.192.135.28
static.kbprod.cloud.    60  IN  A   54.192.135.17
static.kbprod.cloud.    60  IN  A   54.192.135.117
static.kbprod.cloud.    60  IN  A   54.192.135.110
static.kbprod.cloud.    60  IN  A   54.192.135.169

One of the main benefits of ssl/https is the verification of the ip address of the server in question.

I think there is a misunderstanding.

SSL as commonly used does not verify the IP address. Instead it gets verified that the name in certificates subject matches the expected domain (not IP). This check protects against man in the middle attacks where the attacker tries to intercept the traffic by using a publicly trusted certificate issued for a different domain.

Thus, HTTPS does not validate that the IP is correct. But it validates that it is connected to the expected server, no matter what the IP was.
This way HTTPS protects against IP spoofing attacks - and this is maybe where you got the idea from that HTTPS checks the IP address. For more information on this see Preventing a spoofing man in the middle attack?
.


What's the next step if an organization doesn't respond to warnings of a potential data breach? I've recently started getting a rash of junk mail to a particular email address. I give out unique addresses to all organizations I deal with, so I know exactly who has this address on file. The emails are not of a marketing nature (mostly phishing/work-from-home scams), so to me it appears that someone may have compromised at least a list of this organization's customer email addresses.

My attempts to inform the organization (an online retailer) that there may be a problem via all the channels I've been able to find have so far not elicited a response. I'm continuing to try, but if ultimately I can't get anyone at the organization to even acknowledge that I'm contacting them, what would be the next step to make sure someone is looking (or has looked) at this?

The next steps would depend on the type of organization they are. I will only list examples in my answer as a complete answer is impractical.

Health Care Organization

If this organization works with patient health information (PHI) then you can file a complaint with Department of Health and Human Services as described on their website.

Retail Merchant Accepting Credit Cards

If this merchant accepts any credit cards, they are subject to PCI requirements. Violations of PCI standards can be reported to the payment cards brands, per PCI council guidance.


what is a resource in UMA (OAuth2)? I'm currently having a look at OAuth and UMA and I often read about resource and resource server.
But I'm still unsure what exactly a resource can or can't represent.
Most of the time in the examples, API Endpoints or assets like images etc. are resources. "Things" that are exposed to the public and can be directly requested.

But in OAuth2/UMA is a resource a technical term or is it just conceptual?
Example:
my API provides a GET Method /User/GetUser/1

So is my API Endpoint or the actual user the resource?

if it is the API endpoint, is protecting the user "inside" my API out of OAuth2/UMA's scope?

In both OAuth and UMA, a protected resource is conceptual, though ultimately based on the notion of the "web resource" primitive in web architecture. The user (resource owner) is not the resource. The digital data or other "stuff" the resource owner wants to control access to is the resource.

Many OAuth deployers talk about everything at a resource server as "the protected resource" (PR), so a whole API tends to be thought of as one resource. UMA was specifically designed to enable multiple protected resources (and for each of those to be able to have different scopes as warranted), to allow for use cases such as files and folders vs. just API endpoints. So things are more flexible (and therefore complex) in UMA, out of the box.

The UMA Implementer's Guide has a section called Considerations Regarding Resource Server Permission Requests with some examples of scopes that, in passing, may suggest additional types of protected resources to you.

This section in the UMA FedAuthz spec discusses how it's the resource server's job to design protected-resource boundaries: "The resource server defines the boundaries of resources and the scopes available to each resource, and interprets how clients' resource requests map to permission requests, by virtue of being the publisher of the API being protected and using the protection API to communicate to the authorization server."

An example I deal with frequently is a consumer (or clinical) IoT device. The question that arises is: Should the whole device (basically its entire API) be one resource? Or, how should resources within it be broken down? For example, each set of "live"/streaming data coming off the device might be one resource the user will want to control. Sets of historical data already stored in the cloud might be other resources. Device functions (pan camera, turn device off/on, whatever) might be another single resource, controllable through scopes.

Some of the boundary design considerations here have to do with usability. (Perhaps similar to the process of choosing Google Apps Share button dropdown items!...)

Some background about definitions: OAuth (IETF RFC 6749) informally defines a protected resource as an access-restricted resource. UMA2 adopts OAuth terminology along with a few enhancements; its Federated Authorization spec also formally defines how to effect resource protection: "Protection of a resource at the authorization server begins on successful [resource] registration and ends on successful deregistration."

I hope this helps!


Isolating database? Is it possible? I have been assigned CTF project for IT Security for my final year project in school.

We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they would have to compromise the database by dumping the entire database. Now the problem is that, with this vulnerability, there is also a way for the user to access the other database that are also residing on the same server(The database which our CTF application require to use).

My current solution is run a VMWARE machine to host the database and sql injection flag there. I'm planning to use ubuntu, is it a good choice for such purpose? I'm not sure if there is any better solution for it, if you have one please help..

No you do not want to store the data used for your CTF on the same machine you are running your CTF project from. Your machines where you store your data should be separate from your other CTF applications.

You wouldn't be the first CTF to get owned, so better be safe than sorry.


Is PCI DSS Require a dedicated syslog server - collecting only PCI systems logs,, or centrally syslog server is OK for PCI dss? Is PCI DSS Require a dedicated syslog server - collecting only PCI systems logs,  or centrally syslog server is OK for PCI dss?

The PCI Requirement 10 doesn't mention the need for a syslog server dedicated only to PCI systems. All the PCI_compliant companies that I've worked, they had only one syslog system (usually a SIEM solution).

If you had two or three log repositories it can become complicated to analyse and correlate events in case of an incident. For example, if someone attacks a non-PCI server and later escalate the attack to a PCI-scope server, it is better to have all the logs in one single repository.

Keep in mind that your syslog server will become on the PCI scope, so it will need to meet all the PCI requirements.

If you want to read more about the PCI Requirement 10 (which talks about monitoring), take a look on this blog: https://www.pcicomplianceguide.org/security-logging-and-monitoring-pci-dss-requirement-10-why-all-the-fuss/


Should I escape numbers in Django? Should I escape numbers in django to prevent XSS attacks ?
The numbers are stored in db and of "decimal,float,..." type.
Should I escape these values or is it useless to prevent XSS attacks ?

I'm not sure how you would be able to do XSS based purely on numeric values. However a good approach is to always escape input variables and check them for type. For instance if a user is required to input a number, he might also insert a string which could cause an exception in your program. This is something you need to take into account. Note that client side validation is useless (so checking with JavaScript or a dropdown list with only numbers is not going to help you perform secure input validation).

So in Python you can do:

   try:
       float(variable)
       "do database logic"
   except:
       print "not valid."


Is there a way to process a credit card transaction asychronously and be PCI compliant? If I had to store credit card details temporarily to shove it to the processor using an asychronous worker, I know that that information must be encrypted.

To get it to the worker, however, it must be stored at least in RAM. How is it possible to do this but remain PCI compliant? This states:

  3.2.2 Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions.

Or is it impossible to be PCI compliant and use asynchronous workers?

RAM is volatile and is not considered storage for PCI-DSS purposes - so long as the device that contains the RAM is otherwise PCI-DSS compliant.

In a similar fashion, temporary storage of the CVC/CVV on disc is not considered "storage" if the storage is highly volatile. For example, the operating system's swap space.


Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network? We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network?

Reference: https://docs.microsoft.com/en-us/windows/desktop/fileio/microsoft-smb-protocol-authentication

An exploit is making use of a vulnerability to perform an unintended action.
So an exploit may execute code without going through an authentication flow or a variety of other actions. This is why regular patching and not using software that is no longer supported is so important.

Authentication is only useful if the software does not have vulnerabilities that bypass it - with SMBv1 this would be the popular eternal blue.

As for your particular issue there are a couple versions of SMB if you are on version 1 then you are going to need a few extra security controls to address your requirement to use an outdated protocol.

It would be worth costing up an upgrade of your systems and compare it to potential losses or costs for the additional controls.

Note its important to understand that being just within your own network is not a satisfactory control for outdated SMBv1 as seen with latest Upnp issue making the rounds


System time and certificates Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate isn't valid.

If I have a valid certificate which is ok for a time period that had already passed and I'm able to change the system time, what would happen? Would it work ok? Would there be a warning anyway?

Explanations would be welcomed.

Verification of certificates entails checking several dates with regards to "the current time" as known by the system which does the verification (i.e. your desktop or laptop). In particular, your system will try to obtain fresh revocation information (the CRL). If your system clock is off, it will not consider whatever CRL it can download as "fresh"; it may spew out scary warnings, in particular if it sees a CRL "from the future".

Also, in SSL/TLS, the client and the server inform each other of their notion of the current time. There again, discrepancies could be warned upon.

To sum up, changing your clock to accept a certificate which has expired may "work", but not "work well". This, of course, depends on the leniency of your browser with regards to certificate validation, so the best course of action for your particular problem is to test it. Create your own CA, issue a server certificate with an expiry date on the past, install your CA as a trusted CA in your browser, set the clock back, connect to a test server which uses your expired test certificate, and see what happens. Anyway, this would hardly be a reasonable setup for production uses (asking your customers to set their clock back is kind of, let's say, commercially suboptimal).


How to ban IP address behind NAT I am creating WebSocket server with rust and tokio and I want to prevent DDos attacks and spams.
So I thought of creating HashMap and inserting IP address for 1 hour which i suspect is trying to do spamming or DDos Attack but will this also ban other innocent users for 1 hour sharing same NAT network with attacker ?
If I ban IP address and port combination, will the attacker just use other port?

but will this also ban other innocent users for 1 hour sharing same
NAT network with attacker ?

If you ban an address, you ban everyone using that address. So yes, you could end up incidentally banning a lot of users, especially on large NAT'ed networks (e.g. mobile carrier-grade NAT).

If I ban IP address and port combination, will the attacker just use
other port?

Typically, the client's OS networking stack will use a new, random source port for every connection. So an attacker probably wouldn't even need to try to bypass this restriction.


Cross-signing certificates for Windows Driver Signing For testing purposes I want to test cross-signing certificates for Windows driver signing. I understand the general concept: Two root CAs, one root CA cross-signs the other root CA's public key.

However, I couldn't find any information on how to cross-sign the root CA's public key exactly. When I simply sign the public key with the cross-certificate in OpenSSL, the cross-certificate is presented as the root certificate. Should it be like that? If not, does anybody what commands can be used to cross-sign a root CA's public key?

Cross-certification in Windows is done via certreq.exe tool:

certreq -policy <policy.inf> <certtocrosssign.cer> <outreq.csr>

where <policy.inf> is INF file that defines cross-certificate contents and constratints. <certtocrosssign.cer> is a path to a certificate file you are cross-signing. And the last parameter <outreq.csr> is the path to cross-certificate request. Before executing the command, make sure that you have a certificate with Qualified Subordination (1.3.6.1.4.1.311.10.3.10) EKU. This key is used to sign request.

  When I simply sign the public key with the cross-certificate in OpenSSL, the cross-certificate is presented as the root certificate.

no, cross-certificate is not root certificate (Subject and Issuer doesn't match). Issuer is the CA used to sign the request and Subject is the subject of CA you are certifying.

For more details, please refer to Microsoft whitepaper on cross-certification. Unfortunately, Microsoft removed it from their servers and you can get a copy from non-Microsoft web sites. For example, a copy downloadable from my personal weblog: 34 PKI & ADCS Whitepapers You Must Read. The document is called [Win2k3] Planning and Implementing Cross-Certification and Qualified Subordination Using Windows Server 2003.


Is there a file system that doesn't support encryption? I would prefer that no one, even me, could encrypt my files. I have no use for it, and don't want it.

Is there a way to permanently disable any sort of encryption at the OS level?

If not, is this a possible improvement that a future file system could incorporate? Or is it fundamentally impossible to prevent?

No, that's impossible, unless you change the definition of a file.

A file is arbitrary data. Arbitrary data can be encrypted data.

Even if we only allow structured data, structured data can - if we assume no space constraints - be abused to store all arbitrary data* (citation needed). Which brings us to the starting point.

You can have partial success, if we introduce restrictions. An example would be if you don't want files to be encrypted after writing them, you can use a write once (or even write only) system. Or if you want to fight ransomware attacks, you could have a filesystem that preserves original copies of modified files for a certain amount of time.

*For example a restrictive text format that only allows the words "Fizz" and "Buzz" can represent all binary data by replacing 0 with "Fizz" and 1 with "Buzz".


Do Meltdown and Spectre affect other Intel products such as SSDs? I've found a good deal on an Intel SSD but I don't want to worry about the security hole or the loss of performance from patching it.

No, those types of hardware should be fine. It is somewhat unlikely that the microprocessors on such devices are even capable of speculative execution (for Spectre) or are vulnerable to the particular pipeline bug that gives us Meltdown. Even if the microprocessors were vulnerable, though, the code they are running is generally fully trusted, whereas Spectre and Meltdown require that the processor run untrusted code (such as in a browser's JS engine, an operating system's least-privileged/non-supervisor ring/mode, or a hypervisor's guest OS) on the same CPU where the data the attacker wants to steal is handled. No untrusted code execution on the microcontrollers probably * means no way to steal data from them, and thus no need to patch them against issues like this.

* There is a way to attack some devices with Spectre-vulnerable processors over the network, without running local code on the devices themselves. However, it is unlikely this attack could be carried out by untrusted code on a computer, and fully-trusted code can read anything it wants to off the disk anyhow.


Can we determine if a device providing a hash was tampered with to produce falsified hashes? I'm doing a tiny bit of research and am wondering if there are any methods currently known for securing a sender such that it can be conclusively determined that a file has not been tampered with after it was created. I don't work in cryptography and only have a passing knowledge of the topics but I'm well aware of the hashing algorithms. My question is more about verifying that someone hasn't attacked and manipulated the system that performs the hash. We trust the hash that is provided to us but how can we verify the provider of the hash wasn't corrupted?

For example, assume a device takes a photo or video and automatically hashes (and possibly digitally signs?) the image or video produced, so that a recipient can hash the received image and verify the hash matches the one produced by the device. Consider a scenario where someone records an image with this device but wants to provide a falsified image after the fact. Is it possible to prevent them from doing so? i.e. do we have a method to prove that person A tampered with the image and/or the device after the fact, and that the image absolutely should no longer be trusted?

Normal hashing methods act as integrity checks for checking if a file is corrupt. In this context corrupt does not mean tampered with, but that something got lost in transit. It's totally possible for an attacker to change the hash on a compromised device.

To add to Douglas's solution to use an external log server: A solution to this is to use an HMAC. Here you create a hash with a secret. If both parties share the secret and the secret is now known to the attacker, you can detect if the file has been tampered with. However, if the device is compromised the attacker might got a hold of the secret, which would destroy this security layer. The same goes for signing with a secret key.

https://en.wikipedia.org/wiki/Hash-based_message_authentication_code

If you can make it expensive you can start thinking about an HSM, which is a device created for the task you are describing. From Wikipedia:

  HSMs may possess controls that provide tamper evidence such as logging
  and alerting and tamper resistance such as deleting keys upon tamper
  detection.

https://en.wikipedia.org/wiki/Hardware_security_module


How to verify a server key exchange packet I have a problem between two ends of an SSL connection. The server sends ServerKeyExchange and the client says the server key exchange packet is not signed correctly, so I want to check the signature myself.
The packets I have contain:

Client:
    ClientHello -> client random
Server:
    ServerHello -> server random
    ServerKeyExchange -> EC Diffie-Hellman Server Parameters
        Signature Hash Algorithm: SHA256,ECDSA

My attempt:
To get the hash I use

sha256(client_random + server_random + server_params[:signature_index])

I extracted the server certificate and it has signature algorithm "sha256ECDSA".
I think I need to take the signature of the parameters, decrypt it using the server public key and compare to the hash.
The openssl command line either does not offer to decrypt ECDSA or I have not found how to do so.
How can verify the signature using command line tools or the least amount of code I can?

First, signing and verifying are NOT 'encrypting' and 'decrypting' the hash. That harmful trope is almost partly true for RSA but not really, and it is 100% totally wrong for DSA and ECDSA. See
Trying to understand RSA and it's terminology?
Public key authentication: what gets signed?
Is encrypting data with a private key dangerous?
If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?
Understanding digitial certifications
Digital Signature and Verification?
With GPG, can you "decrypt" a file that hasn’t been encrypted?
https://crypto.stackexchange.com/questions/15997/is-rsa-encryption-the-same-as-signature-generation

Also, the signature algorithm field in the certificate is irrelevant; that's the algorithm for the signature of the certificate by the CA, and not the signature on the data by the EE (here the server) using the certified key.

Those said, what is signed is the two random values, plus the encoded form of server-params.

Here's an example. I captured a (test) handshake in Wireshark and here I export the ServerKeyExchange message to temp3.raw:

I also exported the client and server hello nonces to temp1.raw and temp2.raw respectively, and the subjectPublicKeyInfo from the cert to tempk.raw and converted to PEM form (which OpenSSL prefers) with openssl pkey -pubin -inform der <tempk.raw >tempk.pem. Now:

$ xxd temp1.raw
0000000: ead0 1445 aec2 291d e316 8f77 b75c e0ec  ...E..)....w.\..
0000010: 696c ced0 9d45 65b3 78bd d6f8 5e11 287e  il...Ee.x...^.(~
$ xxd temp2.raw
0000000: 5834 4f06 be02 498d cba5 16b0 80bd d5f3  X4O...I.........
0000010: 4a0c 1476 d085 8c57 6fbf 5485 47cd 3937  J..v...Wo.T.G.97
$ xxd temp3.raw
0000000: 0c00 0091 0300 1741 04da 0889 2ed6 bdd0  .......A........
0000010: d140 30e8 417a 7d15 9d46 55b5 6eed 4fde  .@0.Az}..FU.n.O.
0000020: 814c a7aa fd1d 6617 2835 75c4 12d4 a2a4  .L....f.(5u.....
0000030: 213e 6141 112c fb8d 620b 21f9 e27f ea54  !>aA.,..b.!....T
0000040: 53ec 9ec1 bbbc b3df 2f06 0300 4830 4602  S......./...H0F.
0000050: 2100 fd47 429f 478b 3bd4 c8d4 ce4a 9e4c  !..GB.G.;....J.L
0000060: f6e0 c957 bf83 017d 0812 bb4a 8fda de06  ...W...}...J....
0000070: ddc0 0221 00e3 05b1 3046 3c32 a387 012f  ...!....0F<2.../
0000080: d149 e810 b423 b45c cce1 e4e9 62ce bd6a  .I...#.\....b..j
0000090: a4a0 b6d2 a3                             .....

This ServerKeyExchange consists of the handshake message header (4 bytes), the encoded curve_name and pubkey value here totalling 3+1+65=69 bytes, 2 bytes signature and hash identifiers (TLSv1.2 only, for earlier see the RFCs) here 06 03 meaning SHA512 ECDSA, 2 bytes length, and 72 bytes actual signature. I construct the input and separate the signature, and use OpenSSL commandline to (hash&)verify:

$ (cat temp[12].raw;dd if=temp3.raw bs=1 skip=4 count=69 status=none) >temp.dat
$ dd if=temp3.raw bs=1 skip=77 count=72 status=none >temp.sig
$ openssl sha512 <temp.dat -verify tempk.pem -signature temp.sig
Verified OK


What purpose serve port 1900 in home router Why would home router have port 1900/tcp (upnp) open? What kind of purpose would that serve for the operator (service provider)?

I searched info about it and found this an article saying:

  Security vulnerabilities in UPnP continue to crop up and continue to
  put millions of home networking devices at risk for compromise.

It serves the ISP no purpose at all. It is a convenience feature for home users.

UPnP allows services to automatically open ports on routers to allow traffic. A common example is for a media server.

However, UPnP, as others have said, has no authorisation on it, if you allow UPnP, anything with access to the UPnP port can open other ports at will.

For this reason, routers are meant to ensure that it is only available from the internal network and not from outside. Unfortunately, not all routers have been successful in ensuring this which is where the main vulnerabilities come from. The remainder of the vulnerabilities are if you get a rogue service running on your local network, it has more opportunity to open some ports.

If you don't need it, turn it off.


What are attacks against hash collision resistance property? From the definition, a collision would mean you would have to find any two arbitrary x and y such that h(x) = h(y) where h is some cryptographic hash function. This is different from a second pre-image which means you have to find some y such that given some specific x, h(y) = h(x) (where x != y). The key difference being that x is fixed upfront.

I can make many cases why weak second pre-image resistance can hurt you (e.g. replace a known-to-be-good hash of a message/file with a malicious message/file that has the same hash), but I can't immediately come up with an attack where a collision would help you much. What are some real-world or theoretical attack vectors where abusing a weak collision resistant hash could cause harm?

Hash collision in a signature is for example a problem in document signing if the attacker can provide both signed documents. Just imagine a case where somebody orders you to do some work and the conditions are inside a signed document. Once you are ready they present you with a different version of the document which contains a lower pay for you but which still matches the signature.


Updating privacy/security-concerned applications Lets say we have a decentralized open source p2p chat client meant for secure communication. The main attack vector seems to be the (centralized) update mechanism. What methods and/or techniques can be used to minimize attacks during the update process. In the end a malicious developer can always introduce malicious code, so the best we can do is minimize those chances.

Some issues I have been thinking about just to get the ball rolling (but don't feel forced to answer those or limit yourself to those):

Should auto updates be used? And should they be applied instantly or is it worth it to wait a fixed amount of time allowing it to be pulled back in the case of a hack (coming at the cost of security bugs being out in the open for x days)?
Is a simple https connection (with pinned certificate?) be enough to prevent MITM attacks on the download file or should additional things be checked like a checksum downloaded from a different server maybe?
Can any steps be taken against for example the government (the only party that can legally do so) seizing the server and uploading a new version? (I was thinking along the lines of some kind of system where the file needs to be hosted in different jurisdictions or something)
Are there maybe ways to require at least n of m parties (developers) to sign the new version?

Whatever your strategy, I think the first step is to sign your patches. No matter how many MITM there are, if the users can check your signature in a way they trust that will already provide a massive amount of certainty.

HTTPS is good, but it doesn't really do as much as the signature on your patch, HTTPS will make MITM more difficult, but not impossible.

If you open up auto-updates (configurable, of course), that means you also open up an attack vector. Depending on your philosophy, you can either choose to minimise the attack vectors to highten certainty, or you might feel that getting the security updates in your patches out wide and quick justify the increase in complexity.

You can also look into ways of providing out-of-band checksums, e.g. on external domains or over SMS. It is a lot harder to MITM your domain and your modem number than it is to MITM just your domain. Users that want certainty could use these checksums to see if the program they are running is the right one or if the patch they're accepting is valid. If any of the checksums disagree with another, that's a sign something fishy is going on.

As for the protection of patches within your server, taken far enough you are actually trying to protect against "authorised" intrusions and you want this protection to be verifiable by your users. This is quite a tricky thing to do.

If your project is open-source, you might look into deterministic builds, which Tor tries to do. This way a user could inspect the code (but no one does), and compare their build with yours. Might be lots of work and/or incompatible with your current platform.

If you persue using multiple keyholders or servers you might end up chin-deep in Byzantine fault tolerance, which you and your users might find an enjoyable endeavor, or you might find it to be difficult and tedious to work with.

Whatever you choose to do here, just try to keep it simple. As per AviD's law:

  Security at the expense of usability comes at the expense of security.


OpenVAS: This CPE does not appear in the CPE dictionary but is referenced by one or more CVE Any ideas on what may be causing this message to appear when following the link from "Detected Applications"?

  This CPE does not appear in the CPE dictionary but is referenced by
  one or more CVE.

This happens even when following (for example): cpe:/o:microsoft:windows. I think the CPE dictionary hasn't been set properly, but I'm struggling to diagnose why this may be.

Thanks

I encountered this same issue using OpenVAS on Kali Linux from behind a firewall that doesn't allow the rsync protocol outbound. Most of the OpenVAS updates use HTTPS, but one of its databases can only be updated via the rsync protocol.

Look at any firewall logs from between your OpenVAS system and the internet to confirm there are rsync connections being dropped, and if so open it temporarily while running OpenVAS updates.


Facebook data visibility to admin staff I recently had a conversation with a friend in which I told him that everything written on Facebook can be seen by the Facebook admin staff. As a software engineer and database administrator I know that if one user's data can be displayed to another user on a website, then that data can likewise be displayed to other admin staff. Of course this excludes data that is stored but never displayed - such as hashed passwords. Anyway, as far as I know, Facebook currently uses MySQL to hold their indexes and Apache Cassandra to hold the data for these indexes.

Can someone point me to an article that either shows that Facebook admins can read user's data at will, or that admins of this particular combination of database software can read all data stored within. I would like to be able to demonstrate this to someone who is unfamiliar with databases.

p.s. I realize that Facebook is huge and therefore the chances of any admin having the inclination to read my data are low, nevertheless, this question is about possibility, not probability.

Technically speaking, you are correct. Your Facebook data isn't encrypted and can be read by anyone with direct access to Facebook's database infrastructure.

Facebook's Data Use Policy, emphasis my own.

  We use the information we receive about you in connection with the services and features we provide to you and other users like your friends, our partners, the advertisers that purchase ads on the site, and the developers that build the games, applications, and websites you use. For example, in addition to helping people see and find things that you do and share, we may use the information we receive about you:
  as part of our efforts to keep Facebook products, services and integrations safe and secure;
  to protect Facebook's or others' rights or property;
  to provide you with location features and services, like telling you and your friends when something is going on nearby;
  to measure or understand the effectiveness of ads you and others see, including to deliver relevant ads to you:

  to make suggestions to you and other users on Facebook, such as: suggesting that your friend use our contact importer because you found friends using it, suggesting that another user add you as a friend because the user imported the same email address as you did, or suggesting that your friend tag you in a picture they have uploaded with you in it; and
  for internal operations, including troubleshooting, data analysis, testing, research and service improvement.

IANAL, but the bolded part suggest that by using Facebook, you are giving Facebook permission to analyze  your information.

It is very likely though that Facebook has internal policies regarding staff access to such information. Also, given the sheer size of Facebook's data, it is unlikely that a human employee will sit at a desk and read your personal information. Any analysis done by Facebook will most likely be done by computers and algorithms.


Does the WP(Write Protect) pin of a USB flash memory controller prevent tampering with its firmware? Does WP(Write Protect) pin of a USB flash memory controller prevent tampering with its firmware?

I want to have an USB stick that I can make it read-only and insert it in any untrusted PC without risking a silent BadUSB infection.

I was thinking about finding an USB stick that has this WP pin in its controller and DIY mod an external switch to it for Write-Protection.

If you have any other simple/cheap solutions to have a 32-/64gb device that can be Write-Protected, please let me know.

No.
The firmware, kind of a little OS running on the USB drive, is a mediator between the OS where the device is plugged in and the NAND flash.
If you make the device write protected it means the firmware now tells the PC that it can't write to the device.
This can't be circumvented by a well behaving OS, the USB stick will just block writes. But since the firmware has bugs too malware still could work around that and write to the device possibly updating the firmware itself. On the next "boot" (unplug/plug) of the device the malicious firmware can be loaded.
For real write protection you need to block writes at the NAND layer. This has a WP pin which needs to be pulled to ground (check the data sheet of the chip to be really sure).
To my knowledge no USB device with WP switch does that. You can check yourself by testing the voltage of the WP pin.
When you manually pull the WP pin to ground the flash is write protected but the firmware won't know about it. Hence you still can  "write" to the device but you can't read the file back or on the next "boot" the file will be gone.


Patch Advisory Board - feasibility of implementation I'm working for a public sector organisation (around 6000 staff) with a mixed IT skill set. We're looking at setting up a patch advisory board to assist in server patching.

The plan is to have a team from different areas of the business (Apps, DBs, infrastructure, etc) to review each patch and then approve whether they're installed on any of our 1100 servers. Typically the patches reviewed will be from below.

https://portal.msrc.microsoft.com/en-us/security-guidance

My questions are:

How feasible is this approach given the work, effort and time involved to regularly understand dozens of patches and then decide whether to apply them?
Given that we don't fully understand our own servers and the patches, reviewing each patch doesn't guarantee success.
How many of you use a patch advisory board in your current work place?

As opposed to just applying critical and security patches on dev and test before moving to production

Thanks

We have a similar problem.  Thousands of servers, tens of thousands of users, thousands of applications.  No one knows anything.  We don't have thousands of mirrored dev and test servers: most of our servers are primaries.

Change Advisory Boards are great good practice and a great way to spend hours of effort.  They reduce your risk, specifically reduces the risk of "oh dear we didn't expect that I will resign".

What we found was that 99% of security patches just worked.  There were some MS ones that borked the OS, but as we typically wait two weeks after release before deploying the patches that's sufficient time for news to leak about a broken patch.

Now our approach is: just apply the security patches.  Some high status operational systems get a test first and we do a test on a small sample of servers just to be sure, but our goal and our policy is "everything gets patched".

This is similar to vulnerability management. Rather than employ a team of vulnerability researchers to determine if a vulnerability should be remediated, we just remediate everything except the major categories we have decided to accept: weak SSL cyphers on internal systems springs to mind.

There is a chance that a patch breaks a system but we found we could not completely mitigate that so we patch and be damned and then restore from snapshot. That means our engineers can do productive and useful work and only have to deal with the occasional exception. We can't test all patches on all systems on all possible paths of execution, so even if we do test it's only "does the patch install, is the light still green".


Employer wants me to install root certificate to work remotely - privacy concerns? My new employer wants me to install a root certificate on my computer as trusted in order to work remotely. I believe it is to use Cisco AnyConnect vpn. I don't really have a clear understanding of how they work so I wanted to come here to get some advice. It seems like they could monitor my web traffic by having me install this root certificate is that correct? If they could gather information on my browsing habits or what I'm doing in my spare time I would rather get a new computer dedicated solely for work.

I'm just not sure if a trusted root certificate can be abused in this way.

Edit: This is on my own personal home computer, not a work computer. I want to ensure my employer cannot view my personal files or my internet browsing habits.

According to the instructions, they want me to install a trusted root certificate from them (the employer). They say I may have warnings when I am installing it but to just disregard it.

From what I gather it seems like the root certificate is to access the vpn. My apologies if this doesn't make sense, I don't know much about it myself and it was very difficult finding information on google to determine if trusted root certificates can be exploited or whether it is ok to install it on your personal computer.

The root certificate information appears to be associated with the vpn information in the manual so I assumed it was required to authorize you to access the company website/servers through AnyConnect.

My goal is that when I am not connected to AnyConnect, my employer can't see what websites I visit. I would also not want them to see what files I have on my PC at any time (whether I'm connected to AnyConnect or not). Basically I don't have a problem with my employer monitoring what websites I go to when I'm using anyconnect, but in my private time I don't want them having access to that because it's private.

Thank you for the advice on getting a new machine. Hopefully their monitoring only extends to the PC with the trusted certificate and not the wireless network it is on.

Edit 2:
Thank you for the answers everyone. From what I gather from all the combined answers is that when connected to the vpn the company can view my internet traffic. When I'm not connected to the vpn, they generally do not, unless they wanted to be sneaky (unlikely but a possibility nonetheless). I think that in this case it would seem the safest option is to purchase a separate work pc. Thank you for all of your help!

Installing a root certificate on your machine will make your machine implicitly trust certificates signed by that root CA.  If you don't understand what that means, you should read up on the basics of certificates and TLS.

  It seems like they could monitor my web traffic by having me install this root certificate is that correct?

When you communicate with their VPN, they will be able to decrypt that traffic.  That's kind of the whole point.  Otherwise you will not be able to communicate with them.  If you are going through their VPN out to the internet your traffic will likely be going through a proxy.  Because you trust their root certificate you are treating them as a certificate authority (CA), that proxy can issue certificates for any domain you are connecting with.  So you will see a green lock or whatnot on your browser but if you were to look at the certificate chain it would show the company as the authority.  For example, when I am at work, when I look at the certificate chain for this site, it has been issued by my company's CA.  This is really a legitimate thing for the company to do.  You are on their network and they have every reason to need see what you are doing on it.

When you are not on the VPN, you will still trust their CA but you will not be forced through their proxy to the internet.  So when you go to google, you will see that their cert is issued by some other CA that you trust and not the company's CA.  The company cannot decrypt this traffic.  However, if they really wanted to, it's possible to set up a fake site using their certificates and through various means trick you into thinking it was really google (for example) and see what you are searching for.  Unless this is a shady company, I would think such a scenario would be unlikely.

If they have you install special software on this machine, however, they could monitor all your activities and/or remotely control your computer.


How to verify Diffie Hellman uses a "Safe" prime I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange.  I interpret this as unsafe, e.g. not a Safe prime. For additional context, the pen tester referenced this security advisory.

I would like to verify this finding. Specifically, I am seeking the "know-how" to classify the prime as safe or unsafe. This does not necessarily have to be from an intellectual perspective, a third party resource would be just fine.  I tried using SSL labs, which checks if you used a common prime, but not if it's an unsafe prime.

How can I assess whether my site's Diffie Hellman prime is safe or unsafe?

openssl dhparam has a -check argument you can use. But the current version of openssl is incorrect and is too strict. As evidence, the DHE groups from RFC 7919 which are the only groups you can use for DHE with TLS 1.3 do not pass this check, even though they are safe to use.

The "unsafe" group params are those generated by openssl dhparam -dsaparam. They are supposedly actually safe to use as long as your TLS server has SSL_OP_SINGLE_DH_USE set (as the security advisory you linked says). With OpenSSL 1.1.1, this option is always on and does nothing (compare the manual for 1.1.0 and 1.1.1).

You can read the code invoked when you run dhparam, dhparam -dsaparam and dhparam -check. Just don't ask me to explain why the code does what it does.

On Security Stack Exchange, people can read man pages and browse code on Github, but not necessarily really understand the math. If you want someone to explain the math to you, you should ask on Cryptography Stack Exchange. But here is an answer that might be enough to satisfy you.

What you should do: either replace the DH group your webserver uses with one generated by openssl dhparam 2048 or use the values from RFC 7919.

To answer the question "how did the pentester know?", the pentester likely ran something like this:

#!/bin/bash
set -e
rm -f dh.pcapng
sudo tcpdump -w dh.pcapng &
sleep 2
echo "Q" | openssl s_client -cipher 'EDH' -servername $1 -connect $1:443
sleep 2
sudo killall tcpdump
sleep 2
printf "asn1=SEQUENCE:seq_sect\n[seq_sect]\nfield1=INTEGER:0x" >dh.cnf
tshark -r dh.pcapng -2 -R ssl.handshake.p -T fields -e ssl.handshake.p | sed -e 's/://g' >>dh.cnf
printf "\nfield2=INTEGER:0x" >>dh.cnf
tshark -r dh.pcapng -2 -R ssl.handshake.g -T fields -e ssl.handshake.g | sed -e 's/://g' >>dh.cnf
openssl asn1parse -genconf dh.cnf -noout -out dh.der
openssl dhparam -check -noout -inform DER -in dh.der

with a domain name as argument (put that into a file called dh.sh, then run bash dh.sh www.example.com with your domain).


What cookie attacks are possible between computers in related DNS domains (*.example.com)? Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.

Example

Suppose a user has the following cookie set at secure.example.com:

 authCookie = SomeSessionToken (Scope example.com, Secure, HTTPOnly)

Then the user goes to a blog.example.com that is compromised (perhaps in another tab).  It sets a non HTTPOnly cookie like this:

 authCookie = AlternateSessionToken (Scope example.com, Secure, not-HTTPOnly)

Would the next request to secure.example.com use the alternate credentials?

Is this scenario possible?
--Will the browser set two different cookies(with the same name) for two respective servers?

--Or the authCookie gets overwritten?

Summary. Yes, this is possible.  It's not a browser bug.  It is part of the as-designed functionality of cookies.  There is no browser that is safe from this.  Cookies are ancient technology and their security model is only loosely-integrated with the rest of the web.  The details are messy and ugly.

The gory details

The site blog.example.com can set cookies with scope blog.example.com or with scope example.com.  Cookies with the latter scope will be sent back to secure.example.com, if the user visits secure.example.com.

If the site secure.example.com sets a cookie with scope example.com, then the site blog.example.com can overwrite that cookie arbitrarily.  Whenever browsers see a cookie with the same name and scope as one that's already in the cookie jar, they discard the old cookie value and overwrite it with the new cookie.  Thus, blog.example.com can overwrite any cookie whose scope is example.com.

Worse still, one cookie can shadow a cookie with another scope.  Suppose secure.example.com sets a cookie with scope secure.example.com and name SESSIONID.  Next suppose blog.example.com sets a cookie with scope example.com and the same name.  Finally, suppose the user visits the site secure.example.com.  What happens?   It is ugly: the browser sends both cookies, in some undefined order, and the server has no reliable way to tell which cookie value came from which site.  So, the server can detect that it is in a confusing situation, but has no good way to unconfuse itself.  Worse, some web application frameworks may conceal the confusion from application code, using one of the cookie values and silently ignoring the other.  This can lead to something that behaves effectively like blog.example.com overwrote the cookie from secure.example.com, in a situation where no one would reasonably expect that it might be able to.

(As a side note, the secure flag does not prevent a cookie from being overwritten.  In fact, a HTTP site can overwrite a cookie with a secure flag, as long as the domain names are related appropriately.  The secure flag provides confidentiality protection but not integrity protection.)

Finally, there is one other way to delete cookies: a malicious site can set lots of cookies, overflowing the fixed limit on the number of cookies that the browser will store.  The result is that the browser "forgets" older cookies from other sites.  This allows blog.example.com to delete all of the cookies set by secure.example.com (regardless of their scope), and then set a new cookie with scope example.com that will be sent back to secure.example.com -- which has much the same effect as overwriting an existing cookie.  This may be what you were thinking of when you mentioned "cookie jar overflow".

Discussion

It's messy.  Sad to say, this is just how cookies work on the Internet.  If you want to avoid it, the simplest defense is to use a new second-level domain for untrusted sites.  There's probably a better defense that doesn't restrict the naming of your sites, but I don't know what it is.

As a general note, for questions like these about how the web works, I highly recommend the browser security handbook.  It is packed with nuggets.  In this case, you might want to read its material on the same-origin policy for cookies.


How to prevent proxy server from HTTPS packet inspection? Proxy servers often inspect HTTPS packets. They decrypt client's HTTPS traffic, inspect them, encrypt them again and send it to destination server.

The proxy server injects its own CA certificate to client's PC to snoop their encrypted internet traffic. So basically there is no point left to send/receive packets over secured sockets because in anyway they will be decrypted and read in the middle.

It also means that that proxy server can perform Man-In-The-Middle attacks and invade privacy of clients.

How can this be prevented and block that proxy server to inject those certificates to client's PCs?

Basically I want that proxy server to become useless each time I send/receive HTTPS traffic. That injected certificate is the key hole for that proxy.

The only thing I can think of is to create an SSH tunnel through the proxy server. Some proxies might allow this, others don't. So this is not a solution for all type of proxy servers.

For example:

Configure the SSH daemon to run on TCP port 443 and perform a reload the service.
Configure Putty to use a session to your home machine or VPS. Make sure to use 443 as the port.

Configure Putty to connect using the proxy server, it is required to know these settings.

Now configure a Tunnel, this is required to route all your internet traffic through the tunnel. Let's use port 8080 to bind to your local machine. Make sure the radio buttons look like the image below and click "Add".

Now configure your browser to use the local proxy server that is listening on TCP/8080. All HTTP traffic will now be forwarded through the tunnel, bypassing the inspection. However, they might see that SSH traffic is being transmitted.

NOTE:
In cases where group policies are enforced and the proxy server settings cannot be modified, it is recommended to download (or bring a USB stick) a portable version of Firefox.


Check the certification chain with ocsp I have an architecture with a root ca and a sub ca like this:

root ca > sub ca > server <----------> external client

The root ca delivers a certificate for the sub ca.
The sub ca delivers a certificate for the internal server.

So I have two ocsp responders: one in the root ca and another in the sub ca.

My goal is to check the certification chain with ocsp from the external client.

I use the command:

openssl ocsp -issuer sub-ca.crt -CAfile sub-ca-and-ca_mere.crt -cert interne.crt -url http://ipa-ca.sub.cedricdomaine.fr/ca/ocsp

sub-ca.crt is the certificate for the sub ca.

sub-ca-and-ca_mere is the concatenation of sub ca certificate and root ca both.

interne.crt is the certificate for the server.

I wonder which url to use after the option -url because i have two ocsp responder: the sub ca's one or the root ca's one?

I've had the same question myself and by research as well as by practical tests I found out, that the openssl ocsp command is not able to verify complete certificate chains.

You can only verify one "step" at once, so you would need to issue

openssl ocsp -issuer sub-ca.crt -CAfile sub-ca-and-ca_mere.crt -cert interne.crt -url http://ipa-ca.sub.cedricdomaine.fr/ca/ocsp

to verify the validity of the server certificate and something line

openssl ocsp -issuer root-ca.crt -CAfile root-ca.crt -cert sub-ca.crt -url http://ipa-ca.root.cedricdomaine.fr/ca/ocsp

to verify the validity of the sub-ca certificate.

A "clever" client (browser, e. g.) however should probably do it the same way, sending multiple requests to multiple OCSP responders along the chain, given the corresponding responder URL is mentioned in each certificate.


Is information disclosure in a form of a server header a real vulnerability? I have seen in many places that people say that headers of the following types is a vulnerability:

Server:Microsoft-IIS/7.5
X-AspNet-Version:4.0.30319
X-Powered-By:ASP.NET

I can see that this gives the attacker additional information so that he can verify the known bugs on these platforms and then abuse them. But it seems to me that removing these headers can only protect you against very simple script kiddies and any serious attacks would uncover this information rather easily. E.g.

There has to be a way in which IIS responds differently or fails differently when intricate random garbage is sent to it compared to other servers
A list of known vulnerabilities in ASP.NET can be tried one by one to see if any apply + the same point as above applies to ASP.NET itself
Some other similar manipulations

So all in all it seems that any serious adversary would really be able to uncover  that information rather simply.

And after all will removing the headers give you any benefits apart from very simple protection from script kiddies who will first target the sites that have the vulnerability like in a popular quote:

  “You don’t have to run faster than the bear to get away. You just have to run faster than the guy next to you.”

P.S. You probably have much more serious issues if this information disclosure can lead to a real vulnerability.

P.P.S. There is no point to have this headers anyway since it will even benefit performance (quite negligibly though), so it's a good idea to get rid of them, but I am still curious about the whole "security" argument here

OWASP defines Information Leakage as a vulnerability, so the debate is really on whether or not the specific version information should be classified as "Information Leakage".

As @Oasiscircle mentions, this information can be used as a starting point for attackers who know of specific vulnerabilities associated with specific versions.  We know attackers use botnets to scan servers looking for version fingerprints, and they use this information to maintain databases of application versions and server addresses.  Shodan provides a widely used database of this info.  When a new exploit is introduced that targets a specific version, or if an attacker develops a 0day exploit against a version, these attackers do a simple select of their databases and strike quickly, hoping to catch some of these machines before they're patched.

Does that make knowing a specific version number a vulnerability?  Not directly, but it puts you in the cross-hairs of a field of snipers, each with a hair trigger and the motivation to strike first.  I'll leave it to you to determine for yourself if you consider that a vulnerability.


How to Prevent CSRF in Ruby on Rails How can I prevent CSRF in Ruby on Rails programming ? Is it possible to avoid overload on the application loading on net ?

Ruby on Rails basically makes use of a Security Token, which if also a recommended way of preventing CSFR attacks, to prevent CSRF attacks.

You must include a security token using: protect_from_forgery in your requests and MUST verify it on the server. This will automatically include a security token in all forms and Ajax requests generated by Rails. If the security token doesn't match what was expected, the session will be reset.

Source: Ruby on Rails Security Guide.


How can I mitigate the threat that DPAPick poses to my DPAPI protected data? The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).

DPAPick was presented at BlackHat DC 2010 and WOOT'10, with a focus on recovering past passwords and encrypted file system certificates. The presentation abstract claims decryption of all DPAPI encrypted data. Since it is an offline attack Windows registry access controls are also ineffective.

What are the limitations on DPAPick's effectiveness and how can its blindspots and weaknesses be exploited to better protect data I am storing on workstations for my applications?

@nealmcb asked me (Thanks!) about this and this is indeed a great question that is not covered in our paper. I agree that we are not giving enough advice about how to deal with DPAPI security. I will fix this by writing a blog post but in the meantime here is an overview of what you can do:

Overall DPAPI is a blackbox API that allows you to tie any secret data, such as the firefox passwords database, to a windows account password. To decrypt any DPAPI secret you need a hash of the user password (in SHA1 (16_LE) not NTLM though).

So in an offline attack setting an attacker first needs to brute force (or guess) the user password to get this hash, so a "strong" password is definitely the first good line of defense. But remember that we have rainbow tables for NTLM so DPAPI security is also affected by this.

Disk encryption such as bitlocker and truecrypt are a good first line of defense against this because  the attacker obviously needs to decrypt the hard drive before attempting to recover the DPAPI data.

What is not a good idea is believing that EFS will solve the problem, because the certificates needed to decrypt the file are encrypted with a "DPAPI" like system. So once the user password is known, all the attacker has to do is first decrypt the EFS files by recovering the certificate and then decrypt the DPAPI data.

I hope this clarifies the situation. For the CREDHIST problem, I am thinking of writing a tool that clears it (at least the first N old passwords).

Let me know if you have other questions


How worried should I be about getting hacked with PoisonTap? I just heard of PoisonTap today. Here is a short description from a TechCrunch article:

PoisonTap connects to the USB port and announces itself not as a USB
device, but an Ethernet interface. The computer, glad to switch over
from battery-sucking Wi-Fi, sends a DHCP request, asking to be
assigned an IP. PoisonTap responds, but in doing so makes it appear
that a huge range of IPs are not in fact out there on servers but
locally connected on the LAN, through this faux wired connection.

And

you don’t even have to be there: pre-loaded items like analytics and
ads will be active, and as soon as one of them sends an HTTP request —
BAM, PoisonTap responds with a barrage of data-caching malicious
iframes for the top million Alexa sites. And those iframes, equipped
with back doors, stick around until someone clears them out.

This sounds quite worrisome, yet I did not hear too much about it yet.
So my main question is:
How vulnerable are people to the PoisonTap hack?
It seems like the following points would be relevant:

Is the general population at risk, or only a very specific subset (OS, browser?)
What exactly is at risk, your data, your gmail account ...?
Is it something that most people can pull off, or does it depend on specific hardware and a high level of skill?
Is there something that one can do easily, without closing all browsers or turning off the PC each time when you walk to a different room to ask a short question. (Is locking it sufficient?)

And of course, if it is as bad as it seems: can we expect updates soon that would make it safer to go to the toilet again?

First the attacker needs to have physical access to the machine in order to plug the device into the USB port. This means any kind of full remote exploit is not possible. It does work though if the computer screen is locked with a password or similar. Note that the physical access does not need to be direct, i.e. it can also be some gullible user plugging a donated USB stick into the system.

Then the device announces itself as a USB ethernet device. This means that the computer will try to add PoisonTap as a network device to the system and get an IP address from it using DHCP. The DHCP response will return an IP address with a /1 subnet so that most IPv4 traffic is sent to the device. From then on the attacker has the same access to the device like a router: in fact the device works as a router for the attacked computer. This means that any traffic can be easily sniffed and modified but that encrypted connections are still protected against decryption and modifications get detected. This means for example that access of gmail over https (the usual way) will not be compromised.

At the end it is just another way for a local attacker. The impact of the attack is comparable to redirecting someone's traffic via ARP or DHCP spoofing, hijacking the local router or a rogue access point. Not more can be done as with these attacks but also nothing less. It looks like that the software comes with some nice attacks which modify unencrypted HTTP connections to access different sites in order to poison the browsers cache with heavily used scripts (like a poisoned google analytics etc). Since many sites include such third party code and such code gets access to the full page a poisoned code can extract lots of useful information. But again, this works only for HTTP not HTTPS.

  Is the general population at risk, or only a very specific subset (os,browser?)

Most current systems are at risk but the attacker needs physical access.

  What exactly is at risk, your data, your gmail account ...?

Sniffing and modification of unencrypted connections. Gmail usually is encrypted and thus not affected.

  Is it something that most people can pull off, or does it depend on specific hardware and a high level of skill?

It needs special hardware and software but the hardware is cheap and the software released. It needs about the same level of experience as attacks like ARP or DHCP spoofing, i.e. script kiddies could do it.

  Is there something that one can do easily, without closing all browsers or turning off the pc each time when you walk to a different room to ask a short question. (Is locking it sufficient?)

The usual protections against other USB based attacks still work, i.e. disable USB or restrict the kind of devices. But note that if the device has an ethernet port you could mount a similar attack through this since any kind of wired connections is preferred to wireless by most systems.


Does bugzilla.mozilla.org's "new" password requirements make sense for that type of account/service? I just tried to add some details to a bug I have reported at bugzilla.mozilla.org (BMO) but wasn't let in because my password had been nullified. Now they want me to create a new password meeting certain requirements, listed here

https://wiki.mozilla.org/BMO/UserGuide/Passwords

must be at least 12 characters in length
must not contain parts of your email address, or your real name
must be complex, which means:
    must be a passphrase of at least four words
    OR
    must contain a mixture of letters and symbols, containing characters from 3 out of the following 4 character classes:
    lowercase letters, uppercase letters, numbers, and other symbols

I decided to not update my password, and, as a consequence, stop using their service/provide BMO with bug reports, because the password they require won't be easy to memorise and I think this is unnecessary complex for a bug reporting service. My current password is 9 characters, contains upper- and lowercase letter, numbers as well as special characters. That is complex enough for my purpose.

So my question is: are there any objective reasons for such a complex password for something like BMO? What is the worst thing that can happen if someone cracks an outside users password there?

Finally some personal remarks about this issue: personally I am not too found of the thought of a password manager in the cloud (which is was BMO recommends). That type of single-point-of-failure is, IMHO, problematic. Even if CIA/NSA or similar might not target me specifically, they most likely might target someone else using the same service and if they manage to break it, all my secrets come as a free bonus for them.

Storing sensitive data locally and have good backup solution seems much safer for the occasional hacking attempt from a jealous partner or someone trying to commit credit card fraud (if some state sponsored agency targets me specifically I am screwed anyway, either by using a secret subpoena, technically circumvent my protection or simply threat me with a big enough stick).

So my question is: are there any objective reasons for such a complex password for something like BMO? What is the worst thing that can happen if someone cracks an outside users password there?

Remember that the bug tracker may contain information pertaining to 0-days in the software, or other serious security bugs. Not all users have access to this information, but some do.

Such information may impact a large number of users should it become publicly known.

It's easier and better to enforce password policies for all users, and not depending on group. Many password hashing schemes will hide the complexity of the passwords, which means that it is only verifiable when actually changing the password.

  because the password they require won't be easy to memorise

I memorize exactly three passwords: my computer account password, my remote access password and my password manager passphrase. The rest is stored in password managers (Lastpass and KeePass). This is suggested by the user guide you point to. This makes it easy to use unique passwords for each service, and you don't have to remember anything.

In addition, they do allow passphrases, which is easier to memorize. Four random words is certainly possible to remember, if you desire.

  Finally some personal remarks about this issue: personally I am not too found of the thought of a password manager in the cloud (which is was BMO recommends).

They recommend a password manager. They don't mention a specific one, and does not mention cloud based at all. You should probably read the page you linked once more, as you infer things that is not stated there.

In addition it should be noted that Lastpass uses your passphrase as an encryption key for your data, so an attack against a different user may not yield your passwords.


User identity anonymization I want to do an anonymization for user data in my simple system. Each user have two files, for example <id-number>-1.json and <id-number>-2.json.

I want to store them in some repository of all users files (the repository is secured). I want to move the files to this repository and anonymize the user ID number (without the option to receive the ID by the file name), and I want to make the new file names with different hash function so no one will be able to understand that these two files are connected to one user.

The goals:

To be able to access both files by the user ID.
Other people seeing even one file name will not be able to identify the owner user.
Other people seeing both file names will not be able to know that they are owns by the same user.

I thought about some solutions for this situation:

First file: SHA512(<id-number><40-characters-suffix1>), Second File: SHA512(<id-number><40-characters-suffix2>)
First file: multiple times AES(<constant-long-string>, <id-number-as-key>), Second File: multiple times AES(<other-constant-long-string>, <id-number-as-key>)

Which way is better to use? There are another better way to do that?

I'd go with the first system, there's no significant difference from the AES one; but still you need to consider other, possibly unrelated factors.

UPDATE: on second thoughts, you might want to use PKDBF2 as a "hash", in order to mitigate the chances of a successful bruteforcing.

Brute force attack

If the suffixes are known, or in general there is a known mapping between user ID and hash, then an attacker could simply enumerate all possible IDs.

For example, the attacker knows that IDs start at 1 and are at most 100,000; even using a CPU- and memory- hard algorithm, generating the hashes for all possible user-IDs and storing them into a database wouldn't take more than a few days. Using SHA1 or AES, it's a matter of minutes, perhaps even seconds. Afterwards, to know what ID hides behind a given hash, it's just a matter of looking for that hash in the list.

You might want to consider replacing sequential IDs with random ones (which can be a pain in the nether regions; and you need to handle the case where a random newId collides with a yet-to-be-replaced oldId). At that point the "possible IDs" are no longer one hundred thousand (from 1 to 100,000) but several billion trillions (from 0x00000000000000000000000000000000 to 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF). Bruteforcing will now take an impossible amount of time, and/or an impossibly large database to hold the hashes.

Correlations

Consider the possibility of non-trivial correlations between file1 and file2. While a trivial correlation would be both files containing a unique identifier, or worse still, a copy of the user ID, there might be information in both files that could allow determining the user ID, or the link between paired files; for example, a timestamp, or a invertible UUID for some resource.

This issue might extend to metadata such as mtime, or inode number, or position in the directory listing; two files created within the same second, or stored one after the other, could be tracked to the same user, even if one can't backcalculate the user ID.

You should consider archiving the files in a 2- or 3-deep structure, i.e.

/rootdir/ae/02/47/ae0247f19a8b52f.json

and using a non-atime-updating filesystem; and/or when you do change or create or delete a file, touch the whole branch (here ae, ae/02, ae/02/47 and ae/02/47/ae0247f19a8b52f.json) to a fixed datetime, such as midnight January 1st, 1970.

Initialising the repo

When transferring the files to the repository, you might want to first produce a list:

 000001-1.json      aae3799a82b9fb8ccd34c1d5aa6565b2
 000001-2.json      539c50984894084b3e3b1047eee187ae
 ...

Then you scramble the list. Once done this, for each pair on the list you move e.g. 000001-2.json to repositoryRoot/53/9c/50/539c50984894084b3e3b1047eee187ae. This way, there will be no correlation between the inodes, filesystem position or disk physical position of 000001-1.json and 000001-2.json.

Be warned that on most filesystems, this approach will appreciably increase the time required to do the copying.

Emails as IDs

This does not look very promising security-wise, because emails are often guessable and/or recycled. Much would depend on what exactly is stored on those JSON files and what the attack scenario actually is (the two cases of a hacker gaining access to a repository of embarrassing information and attempting to blackmail the owners - thus requiring to work back from the JSON to the email - and someone trying to acquire the information of a victim whose email is known, are to be handled very differently).

One possibility could be having an anonymisation table kept outside the repository:

ID                   RandomToken
lserni@gmail.com     5231b225ea0dbcced14c993523af4986
....                 ....

At that point you could use token as the "secret" password.


Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used? Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com.   SSL is always required.

According to how SiteMinder cookies are described here, one of those domains would be the associated "master cookie" domain, and others would redirect to that domain in case of an authentication failure.

How things currently work

To prevent clickjacking, the login page for auth.com has the NoFrames script and a frames buster script implemented for older browers.
After the client logs into site1.com or site2.com, AJAX kicks in and does some operations (polling etc).  During this time, Javascript may get a an error saying that the session is invalid.  This error occurs while using AJAX.  (if it occurred while browsing, there would be a redirection and this entire question doesn't apply)
At this point I can either refresh the page and redirect, or tell the user to login again at auth.com, but then I lose my in-memory application state.

A new/seamless approach for the end-user

As a workaround I'm considering using Javascript to create an iFrame to auth.com/RefreshOnly (iFrames okay) POSTing my session data.  Auth.com/RefreshOnly will see the cookie for its domain and, if it chooses, redirect to my origin site1.com, instructing it to update my current cookie.... all within a hidden iFrame.

Question

Is this limited usage of iFrame permissible in an IDP/authentication provider? (not exclusive to Siteminder)

It seems to me that what you are proposing does not violate the normal workflow.  You are making a request from the asserting party (site1 or site2, AP) to the service provider (auth-SP) which in turn is making a request to the identify provider (IdP).

It is also fairly common to implement this approach when a site accepts credit cards but doesn't want to accept the PCI regulatory burdens.  A company like Cybersource serves as the SP and accepts user input in an iframe within the AP web page. As far as PCI (Payment Card Industry in case the acronym is obscure...) is concerned, it's no problem.

I'm not sure how the confirmation number is returned to the AP, but that doesn't much matter.


Should a website limit characters that can be entered in its fields? I got into a (somewhat heated) discussion with my colleague today about what characters our application should accept. This was prompted by the discovery that you can enter anything in the search box and the application will dutifully perform a search by that string. However this applies equally to all the textboxes in the application, not just the search box.

My colleague is of the opinion that the best practice (from a security viewpoint) is to limit the allowed characters to some letters, digits, and a subset of symbols. This prevents the user entering all kinds of unprintable Unicode control characters and whatnotelse.

I on the other hand am of the opinion that this will only annoy the users and not offer any additional security. I think that the best practice is to make your application accept anything, and then use the proper encoding functions (and parametrized queries if they are available) to make sure that the entered string passes through unmodified and is displayed/used as entered. If the user enters garbage, he will see garbage, but the system will work correctly.

What is the industry best practice here?

Added: It seems that I've not been very clear. The question is about server side, and the assumption is that all the proper encodings/escapings are in place when using the string (e.g. using parameters for SQL, HtmlEncode for outputting to HTML, etc). Given all that, does it still make sense to limit allowed characters which arrive from the client?

You shouldn't trust the client. Writing Javascript to stop characters being entered does not stop anyone from submitting them to your search.

Your search routine should remove characters it doesn't support, and when printing that back out, it should show what it actually accepted, not what was submitted.

For general purpose fields in a form, consider adding client-side validation for a more pleasant user experience; I'd rather know before I hit submit that you're not going to accept non-digits in the Phone Number field. But if I go around your Javascript checks and submit the form anyway, the back-end server should outright reject my invalid data; don't leave it to just the Javascript to sanitise input.

Also, while it's OK for most fields to accept anything the user can enter and repeat it back elsewhere, it must be escaped properly to prevent cross-site scripting (e.g. so the user can't set their name as <script src="...">). Some fields have additional concerns; for example, if you allow users to pick a unique username, Unicode equivalence could allow them to choose a unique encoding for their name that nonetheless appears identical to another user's name, allowing impersonation. Normalisation is not enough, because some characters look like other characters, still allowing impersonation. Read  Unicode security considerations for more on this.

Edit: Your colleague still has a point. The server-side does not live in isolation. If it accept inputs from a user and then shows some of those inputs to other users at a later time, it's not enough that the server-side is bulletproof against dodgy inputs. There's a whole category of security issues that happen client-side, because the server-side stored data exactly as-is and blindly handed it out to other clients (who are then attacked or fooled by it). Yes, server-side needs to restrict input characters, if they'll exploit or fool your users when handed back out again.

Recommended reading:

Unicode security FAQ
UTR #36: Unicode security considerations
UTS #39: Unicode security mechanisms (especially mixed-script detection)


Adding 65K buffer to protect from buffer overflows? If you had a very complex and important function in C that you wanted to protect, would it be worth it to put a 65K buffer at the top of the stack to protect from buffer overflows? You would put your important buffers below the 65K buffer so that the stack looks like this:

[Saved EIP] // higher adddresses
[   ...   ]
[   65K   ]
[   ...   ] // other stack variables and buffers

This way if there was a buffer overflow below the 65K, it would overflow into the 65K buffer and would not reach the stack variables.

Is this a feasible defence against buffer overflows?

No. Most likely, you got that 64k limit from the Heartbleed bug, hovewer it is purely because in HTTPS Heartbeats the length field was 16 bits long. It doesn't mean that in your case your software will not have a buffer overflow reaching far further. So while yeah, this could add a tiny bit of security, you must always assume that buffer overflows can affect your whole address space, both after the buffer and even before it.


How to prevent USB Block Policy to be circumvented? I know that I can disable USB devices using group policy for the computers of my company. What I want to achieve is allow users to use the USB port only for charging their phones, connect their mouse and keyboard but NOT allow file sharing from removable media to computer (and vice versa).

So my question is how do I ensure that this policy works if:

Some of the users have laptops, and in some cases, they work from home and are not connected to the domain
Some of the users are local admins to their computer

This is one of those "I want to install a lock that will keep out all burglars" type of questions. The short answer is that you can install policies that will keep most of your honest users honest, but you cannot guarantee 100% compliance.

Your end goal (I assume) is not just to prevent USB drives, but to prevent unauthorized data copying. You will not be 100% successful at blocking USB drives, especially because those users with admin rights will be able to modify any policies put in place. But even if you prevented data copying via USB drives, these machines have network connections, no?


What can my ISP see in their log files if I use Google DNS? For example, if I use my ISP DNS and open this page they will see:

https://security.stackexchange.com/questions/ask

It would show up in their logs for sure.

But if I use Google DNS, then what EXACTLY can they see?

Do they log this as:

http://204.93.58.117/questions/ask

or just:

http://204.93.58.117/

I'm asking this because my government seems to monitor too much. I know about VPN
but I don't use VPN all the time. I simply want to know what can ISP log when I'm
not using VPN, only Google public DNS.

Short answer: they are only able to log the hosts you visit (e.g. security.stackexchange.com, google.com, etc) and not the full address (e.g. https://stackexchange.com/login). If you access unencrypted webpages (http instead of https), they are able to see everything. ISP are not known to log unencrypted webpages en masse, but I wouldn't not be surprised if the NSA or china logs this kind of meta information.

Long answer:
Since DNS traffic is not encrypted, your ISP could see every host you visit (it does not matter if you use Google's DNS or theirs). If you visit https://security.stackexchange.com/questions/ask (note the s after http), your ISP will see that you visited security.stackexchange.com and that you used HTTPS. If you use HTTP, the will see everything (the content of the webpage, url, and sometimes even cookies. Note that security.stackexchange.com will always redirect you to their HTTPS version. This means your ISP will only see that you were redirected to the encrypted version. If you are not on the https version, you're being MITM'd. You should then use a VPN).

If you request http://security.stackexchange.com/questions/ask (as you have originally asked), your ISP will also be able to tell that you requested the very page since it is not encrypted. It does not matter that Stack Exchange is redirecting you to the encrypted version because the you have already access the unencrypted version once. Make sure you always use https when possible.

If you access google via 216.58.192.110 (one of their IPs), your ISP will still be able to see that you visited 216.58.192.110. Since your ISP is also probably running a DNS server, they could also check where 216.58.192.110 resolved to (which will probably return google). They could also check that by hand, but this would take more time.

The only way to protect you from these attacks is if you use a VPN. Note that by using a VPN you simply shift the trust to someone else. If you use a public VPN, there are many more parties who can monitor your traffic: the VPN provider (their server might log everything you do), the server host, and the government the server is located in.


Get security certificate for secure Laptops etc I am learning a bit about IT-Security and I wonder if there is a concept where you can get certificates for a specific device that approves the device is safe and not compromised.

Lets say you want to use you own Laptop at work but they need to be sure your Laptop is not compromised. So you go somewhere to a trusted authority and they check your device and create some kind of certificate with all information according to this inspection, like the date and maybe a metric for how safe it is etc. Then you can show this certificate your boss that your laptop has been checked for viruses and vulnerabilities.

I tried to google it but I dont know if it exists or what to google for. Maybe you can give me some keywords to look for.

Certificates like that only exist at the point of device manufacture. If you were to walk in, get it inspected and certified, then as soon as you walk out the door, the certificate is useless for determining if it is still fine. It only certifies the state of the device at the point in time of the inspection.

What is done instead is to run agents on the device that provide live updates on whether the device is fine or not. That agent can then talk to the network and the network can allow the device on the network. This is a form of Network Access Control. This can be done for employer-owned devices and is also used to allow BYOD devices onto an employer's network.

There are different ways of doing this, too. Either by enforcing a certain level of security on the device (by doing it) or by verifying what has been done and notifying the network as to the level of security that the device has. Different parts of the network can allow different levels of security, for instance.