Can AES and SHA-256 outputs with the same inputs be used to break each other? An abstract representation of my question looks like this:

byte[] encrypted = AES.Encrypt(bytesToEncrypt, password);
byte[] hash = SHA256.Hash(password);

If an attacker obtains the values of both encrypted and hash, does that give them an advantage they wouldn't have if they only had one or the other?

This is safe if the password is safe. For example, 16 randomly generated bytes as password are fine, or perhaps a strong password that was run through a good key-derivation function (KDF) such as bcrypt, scrypt or argon2 (the slower the better, then an attacker can only do guesses at a slow rate).

You are giving more information to the attacker, so it is almost inevitable that you give away more information. There are two things I can think of:

Break one, get the other

Your scheme is broken if either someone finds a preimage attack on SHA2, or someone finds some attack in AES that leads to key recovery.

If an attacker only has the hash and not the encrypted contents, they can't use an attack on AES to crack your hash (and vice versa).

Attacks that completely break AES or SHA2 are extremely unlikely, though. Both algorithms are extremely well-studied and cracking usually happens by first degrading an algorithm substantially. If either of those two are broken, we're in pretty big trouble anyway.
Identifying a correct password guess

When cracking your encrypted bytes, an attacker will get random garbage as output upon each incorrect try. If your input (bytesToEncrypt) is also indistinguishable from random (for example if it's a Bitcoin transaction ID), an attacker will never know when they got the correct answer. (Well, perhaps they could check all Bitcoin transactions in history and find a matching one... but you get the idea.)

Now, instead, they can find an input that corresponds to the hash. Once that is found, they know that the answer is right, and they can use it to decrypt the message.

Usually, though, it's possible to check when a decryption is correct, so this is only a small advantage. And this assumes that your password can be guessed in the first place.

As said, both are very unlikely/infeasible. If your password input is secure, e.g. 16 random bytes or a very strong and KDF'd password.

So your scheme is basically safe, but it's only a small part of a larger application. If this is an important application, you should have it reviewed by a professional to be sure it's implemented correctly. (Note: that means paying someone, not just asking on a code review forum or something.)

Also, you call your inputs to AES and SHA2 "password", implying it's user-specified. A KDF is not visible in the code you posted, so you need to add that. Use a slow KDF, such as one based on bcrypt, scrypt or argon2.


Are penetration and vulnerability testing required for PCI compliance? If a company needs to be PCI compliant, are there any fines levied on them if they don't do penetration or vulnerability testing? If yes, is it an automatic fine, or is it only if they are caught?

If you don't provide documentation of your compliance (either an SAQ or your AoC and RoC) to your processor/acquirer, they stop processing transactions for you, which is sort of like a fine in that you start losing money and customers.

To quote the overview to the PCI DSS Self-Assessment Questionnaire (SAQ),

  you may be required to share [your SAQ] with your acquiring bank. Please consult your acquirer for details regarding your particular PCI DSS validation requirements.

DSS requirements 11.3.1 and 11.3.2 require pentests, and according to this article that impacts anyone with SAQ A-EP, C, D-MER, and D-SP.


Way to validate a parent/child relation I have a rest endpoint for example
/user/{userId}/message/{messageId}
I have the possibility to create both ID's as I want.
How can I create messageId and know the message is belong to this user,
without checking in database or any service?
I think about hashing userId and add the hash as prefix of messageId.

Your problem, as I understand it, is that you want to ensure that userID and messageID are an at least plausible pair in your front-end before touching the database.

I think about hashing userId and add the hash as prefix of messageId.

Assuming you mean URLs like /user/uuuuu/message/hhhhhmmmmm, where uuuuu is a user-ID, hhhhh is a hash of that user-ID, and mmmmm is a message-ID, then – even if someone doesn't know what hash algorithm you are using – once they see a valid uuuuu/hhhhh pair, they can spam you with any mmmmm following the hash prefix, and it would look "OK".
What I think you need to do is verify both the user- and message-IDs. In addition, to guard against someone discovering which hash algorithm you are using (and thus being able to generate their own verification strings), you want to include a "secret" that is only known to your back-end.
Creating a URL

For a given user-ID uuuuu and message-ID mmmmm form the string sssssuuuuummmmm, where sssss is a secret string.

Create a hash of sssssuuuuummmmm and call it hhhhh.

The resulting URL is /user/uuuuu/message/mmmmmhhhhh (it doesn't really matter which end you stick the combined hash; I've put it on the end because it feels more natural).

Verifying a URL

When your front-end is given /user/uuuuu/message/mmmmmhhhhh, form sssssuuuuummmmm using the same secret as before.

Hash sssssuuuuummmmm and compare the result with hhhhh from the URL.

If they match, then uuuuu and mmmmm are probably a valid pair of IDs and you can check with the database.

Depending on the level of false-positives you want to have to deal with, the hhhhh can be an abbreviated form of the hash. This answer to the question How much can you truncate a SHA1 hash and be reasonably sure of having an unique ID? on StackOverflow suggests at least 45 bits: 64 for safety. An 8-byte hashlet would be 16 characters of hex, which should be manageable, although for your situation you could go even shorter, at the risk of an occasional unnecessary database access.


Is there any way to protect ourselves from annoying redirects? It is not the first time I have been redirected to a malicious site. I was trying to download a song from a website when I clicked on download and was immediately redirected to a page which says "Your phone has been infected with 28% virus, click here to repair". I was surprised how they knew my phone's exact model no. and literally every site redirects to same malicious site. It was quite frustrating.

It is not possible to completely protect us from this if I am right? But is there any way to at least reduce the redirects because some sites redirect us one after other site to show their same shitty ads.

From the context, I understand you're referring to Chrome mobile.
This version doesn't allow addons, so you can't install any ad-blocker.

The first way to prevent (some) redirects is to browse in Desktop Mode. Many scripts will check if the browser is a mobile one before attempting a redirect.

The second is to block all URLs of malicious scripts from your router. This kinda works like an ad-blocker, but only works if you're connected to your own wifi network.

Finally, it looks like Google is trying to embed this type of security inside Chrome itself (see https://blog.chromium.org/2017/11/expanding-user-protections-on-web.html, thanks to Ajedi32 for the link).

Note: The malicious site knows your phone model because it's really easy to footprint a particular device from a web page (user agent, screen size, ...).
Those are all information your browser normally sends, and nothing to be worried about, unless for some reason you're also trying to stay anonymous.


Would an anti-virus software make any other processes consume more CPU? Would an anti-virus software make any other processes that it scans to consume more CPU?

We recently switched to a new Next-Gen, AI based Anti-Virus software. On couple of our Linux servers that runs Java processes, there has been frequent high spikes in CPU usage recently. Apparently, it is Java that is the highest consumer of CPU while the anti-virus process isn't using a lot. I am pretty sure that it is not the anti-virus behind the higher CPU usage since the these spikes started a couple of days before even the AV software was installed. So, right now, I am in the process on convincing others that it is not the anti-virus (trust me, no one is believing what they see at top -c) . Before I go back to the team, I would like to make sure that when anti-virus scans every single file that gets opened by other processes, the resultant CPU usage would show up against the anti-virus process and not against the process that opens the file. Is this how it will appear in CPU usage stats?

Server run Amazon Linux and the Anti-Virus is Crowdstrike Falcon.

It is difficult to tell with certainty, depends on the AV implementation and how it intercepts resources being used by processes (executable, files, memory).

Because some AVs run with very high privileges (potentially at the kernel level) it is possible that they intercept system calls and libraries to sandwich their scanning code at run time. In this case, there won't be a separate AV process taking up resources, the system will account resource use to the process that is doing the system calls and pulling in the libraries.

... Unless the sandwich code offloads the effort to AV processes. Then we're back to the scenario where it's the AV that takes up scanning resources.

More traditional AVs work on the basis of scrubbing ram and the file system, potentially monitoring new processes, which would have AV pricesses doing most of the work not the work processes.

How can you find out exactly how it is happening? You'll need to dig in a bit, use strace, monitor kernel tasks with perf, monitor process use of resources over time with and without AV, etc.


Django admin site privilege escalation Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a misconfiguration, or rather due to an inherent vulnerability in Django itself?

Here's the PDF.
https://seanmelia.files.wordpress.com/2017/06/django-privilege-escalation-e28093-zero-to-superuser.pdf

I'd also like to note that I'm new to Django and would appreciate knowing any other inherent vulnerabilities you know of.

This was a programming error on the web dev's end. Not a Django vulnerability.

Django vulnerability lists can be found on the Offical CVE site:

https://www.cvedetails.com/vulnerability-list/vendor_id-10199/product_id-18211/Djangoproject-Django.html


How fast can hackers change their IP address? What is the speed and frequency that hackers can bypass rate limiting continuously in a website using login with an SMS OTP? The rate-limiting activates if the same IP address triggers SMS OTP more than x times.

Botnet
If someone has access to a botnet, even a small one, they could change the IP that their actions are coming from several times per minute or flood their actions from a million IPs in any given moment.
Non-botnet
For individuals without a botnet, there are several methods, including resetting their ISP modem, which, in some cases, resets the IP. Turning a phone's airplane mode on/off can also trigger a change in IP (MechMK1 reports this might take as little as 3 seconds to complete).
They could also change between public WiFi networks.
Using a series of VPNs and proxies or VPNs that permit the user to choose the exit node will also work, and services that have different exit nodes can make this switch in seconds. There are also proxy/Tor utilities that can randomise your IP according to a schedule you set. The Janus tool has a default change time of 1 minute, but that can be changed.
Therefore, for any practical case, if the attacker is waiting for the SMS code to come back from your server, then they are only limited by the time it takes to receive the SMS code.


Code signing with MD5 on Windows 8 I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8.

Further investigation showed that the signature was made with MD5.

While it is entirely sensible that Microsoft drops support for MD5, I have been unable to find any references for this fact.

I also seem to remember seeing a notice about Microsoft removing support for MD5 in earlier versions soon, but I haven't been able to find that either.

Am I correct in thinking that MD5 is not supported on Windows 8? Do anyone have a reference for it? Will support for MD5 also be removed in Windows 7 and earlier?

In Windows 7, the requirements for code signing were as follows:

For applications, SHA1 is preferred, MD5 is accepted.
For drivers, SHA1 is required.

In Windows 8, the requirements changed to the following:

For applications, SHA1 is required, and SHA256 is optional.
For drivers, SHA1 is required, and SHA256 is optional.
For cross-compatibility, Microsoft supports dual-signing, in which the payload is signed with both SHA1 and SHA256. On Windows 7, the old SHA1 hash will be checked. On Windows 8, the SHA256 hash will be checked.

It's not known whether this is in response to Flame, or just a standard progression of security technology.

The problem with altering the requirements in Windows 7 is two-fold. First and foremost, there are tens of thousands of existing applications signed using MD5-based certificates. Second, it's a lot of effort to modfiy the kernel, code signing utilities, Visual Studio, etc. to reflect the new requirements. However, Microsoft have (supposedly) taken steps to ensure that no internal code-signing certificates allow MD5, and have revoked offending certificates.


Where should a keystore (.jks) be stored in a repository I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of signing SAML assertions.

For security purposes I would like to refrain from including this Keystore in the same git project as our Java code. This source code is pushed to many different locations for various tools used. (Code review tools, source code scanners) and I don't think anything good can come from having our Keystore file sitting in all these locations.

That leaves me with the question of, where's the best place to include this file in source control? I've done some digging around the internet have yet to find a good answer so here's my thoughts.

Plan A

I plan to place the Keystore file in a private repo that is locked down. This can only be accessed by a very limited audience. The Keystore will be added to the stand-alone component on build as a dependency by the deployment process.

- Pros

Keystore would not be distributed with our source code
Updates to the Keystore in source control could be locked down and carefully monitored

- Cons

Increased complexity for cert management
Keystore will get added to the module in the deploy process anyways, so the security benefit is limited

Plan B

Instead of keeping a static keystore, each time the build process is initiated a new keystore is built with a pseudo random key. The key is then added as part of the zip in our build process. Certs will then needed to be added to the keystore. Most of the instances of this Java module would have unique certificates, so not keeping the static reference would not introduce a large amount of busy work.

- Pros

No static keystore for attackers to take advantage of
Each instance of the keystore has it's own password

- Cons

Increase complexity of build process
If the same cert is used across multiple instances of this module the cert will have to be added to each one.

Which is my better option? Also am I going down the right path with this?

All the organisations I worked in store credentials or equally sensitive info in a well-known location outside the application's deployment directory and is secured per environment. Devs create the files themselves with dev credentials whereas the production ones are created by ops and secured so only the application has access.

If you want the application to run without config after checkout, you can embed some dummy copies that only gets used when the file cannot be found at the well-known location.


How safe are the password prompts of the SafeNet eToken 5110 or similar cryptographic hardware tokens? I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows.

I know that they issue a prompt to manually enter the token's password at each signing attempt (or at each session, if you enable the single logon option).

I wonder:

How safe are those prompts from keylogging or other password interception techniques?

And thus how much would I increase security by really filling those prompts manually vs. automating them with methods such as those listed here ?

I know that by automating the process I would increase the attack surface, by the fact that the password will probably be stored on disk and for sure on various additional memory locations, but I have a feeling that these software password prompts are nonetheless mostly "security theater", and that there are easy ways to intercept the password (and thus have it later entered programmatically by a malicious program) even if manually typed .

Here I assume that the computer where the token will be used will be an up-to-date Windows 10 system reasonably hardened, so for sure at least not running under an administrative account. It certainly won't be fully isolated though (one way or another I'll have to pass the files to be signed to the system).

EDIT:
I realized that this environment description might be too vague, if that's the problem for the time being we can assume instead a fresh Windows 10 installation, running under a limited account, with decent passwords for that and the administrator's account, connected to the internet through a lan and let's say even joined to a domain.
The rest of the lan is not to be considered really safe.
Let's just add that Windows' privacy options have been all set to deny, just to take out the possibility that Windows sends out the password to its servers to "improve typing", which wouldn't surprise me too much.
I'm not concerned about physical attacks here.

I found the eToken 5110's FIPS 140 security policy. I gave it a quick look but I didn't get too much from it, it doesn't seem to be concerned with the part of the password entry from its typing to when it gets sent to the device.

I think (but not 100% sure) that it is a USB CCID device and that it uses the Microsoft Class Drivers for USB CCID Smart Cards, and that this entails that the password entry is handled mostly by the operating system, rather than by code from the vendor (but again not 100% sure).

If a key logger is infecting your machine, any text you type, including the private key you enter to the SafeNet prompt will be stolen as you type it in. You better use an automated entrance of the private key like in this article I wrote. The idea is to use an API call to connect to the hardware token and to sign an .exe with it but instead of using the user interface provided by SafeNet.


Nikto - results differ for IP and hostname I ran a Nikto scan on a machine by hostname

nikto -host https://machine.host.com

it identified a padding vulnerability :

  OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070.asp allowing a cryptographic padding oracle.

When I run Nikto against the IP address, it does not report the padding vulnerability.

I have checked that the hostname resolves to the IP address I am testing, the webserver is only running on 443, so I have a -port switch to use 443. The IP address is internal but  Nikto connects and executes tests successfully.

nikto -host 10.10.10.10 -port 443

My assumption would be that Nikto resolves a hostname then checks the IP, so a scan on the IP or the hostname should yield the same result.

Why are they different?

This vulnerability affects the dotnet framework. Any virtual host that does not have dotnet bindings will not show as vulnerable.

In your case the IP address most likely routes to the default virtual host which unlike the machine virtual host probably does not have any dotnet bindings configured.

That being said you should patch that server as it is a pretty nasty bug.


OpenVPN Why CBC mode is recommended? I just set up my installation of OpenVPN on my server.

I am curious why the OpenVPN manual recommends CBC mode. I heard that CBC is predictable and not secure; is that true?

What you've heard is not accurate.  CBC is secure, if used properly.  OpenVPN does use CBC mode correctly.  Generally speaking, OpenVPN is very well designed, and you shouldn't need to worry about this.  You shouldn't need to change the default settings for cryptographic algorithms.

In fact, CBC mode is the default mode of operation for OpenVPN, so you do not need to change anything; you can just stick with the defaults, and I recommend you do so.

OpenVPN also supports CFB and OFB modes, but those modes have no advantages over CBC mode (and OFB mode has some potential disadvantages).  Therefore, I think OpenVPN's default of CBC is a reasonable and sensible choice.

OpenVPN supports many symmetric-key algorithms.  The default is Blowfish, bu tit also supports DES, 3DES, DESX, RC2, CAST5, AES, CAMELLIA, and SEED.  Blowfish is a fine choice.  AES would be arguably the more conservative, conventional choice, but frankly either Blowfish or AES is fine.  I would definitely avoid single-DES (or anything that is listed as a 40-bit or 64-bit key), and I would try to avoid RC2, CAMELLIA, SEED, CAST5, and DESX if I could -- but this is a detail.  In any case, OpenVPN's defaults are fine, so I suggest you just stick with them, rather than try to tweak them.

A comment for the future: If you want us to comment on a recommendation from someone else, it helps if you can link to the primary source.  (You didn't tell us where you got the recommendation to use CBC mode in OpenVPN.)  This time I was able to work out what you meant, but for the future, this might be helpful if you post other questions.


Keepass client on Android (reliable one) I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox.

As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe to use on mobile phones? Any bad experiences by using such a client?

I've been very happy with KeePassDroid and it does happily sync via dropbox on your android phone. Check out their blog http://blog.keepassdroid.com/2010/06/dropbox-and-keepassdroid.html

keepassdroid is very popular and open source so you are welcome to take a look through the source code. https://github.com/bpellin/keepassdroid

The main thing to keep in mind with keepass is make sure you have that keepass file protected with a strong password!


What is the use of private key of a SSL certificate? I have read a few wrong information about HTTP/SSL (I think) and those information was saying that the private key from a certificate is used for message decryption. I have followed a tutorial on pluralsight and there was explain how the encryption key is generated for a TLS session and the private key of the certificate is not used at all.

And now my question, where is used the private key of a certificate and by who? Is this private key used to confirm that the certificate you send over the internet really belongs to you? And if this is true this check is made by the browser? (client-side, because I am thinking that private key should never be sent over the internet)

Asymmetric private keys have two basic operations: they can Sign a message such that anybody with the corresponding public key can verify that the private-key-holder signed it and it hasn't been tampered with, and they can Decrypt a message that was encrypted using the public key. In addition to the direct usefulness of these operations, the private key can be used to prove ownership of a certificate; the certificate contains a public key, and the private key can (by using either signing or decrypting) prove to a third party that it is your certificate (assuming, of course, that the private key has not been leaked or cracked).

  Is this private key used to confirm that the certificate you send over the internet really belongs to you?

That's definitely one of the things it's used for, yes. That step is important for Authenticating the server in a TLS connection - proving that it's actually the server you mean to talk to - and can also be used to prove a TLS client's identity when client certificates are used (sometimes called mutual TLS).

The private key is also a critical part of the Key Exchange part of a TLS handshake, when the client and server agree on a symmetric public key that they both know, but that an adversary snooping on the connection or even actively tampering with it (as a man-in-the-middle) will not know. For RSA key exchange (common for a long time but somewhat rarer now), the basic procedure is simple; the client generates a random secret, encrypts it with the public key (from the cert), and transmits it. Only the holder of the private key can decrypt it. A more complicated (but more secure) key exchange uses some form of ephemeral Diffie-Hellman key exchange; in this case, the server signs the DH parameters (using its private key), and the client only accepts those parameters if they can be verified using the public key from the certificate. In either case, if the attacker attempts to tamper with the key exchange, the exchange will fail (in one case, neither the attacker nor the server would have the symmetric key that the client is using; in the other case, the client would reject the server's parameters and refuse to derive the symmetric key at all).


How and when should I use OpenSSL for IT Security? How do I understand the output? I'm discovering OpenSSL, and already used it to diagnose a faulty SMTP TLS connection, but I'd like to get a better / full understanding of the tool and how to use it.

  What resources should I use to get started learning this tool?

I'm interested in anything from sample commands, to any guide how to understand and use the output.  I have a basic understanding of TLS,  PKI,  Encryption etc, but given the complexity of this tool, there is so much more to learn!

There is no good documentation on OpenSSL save its source code. Sadly. The best you can do is to gain some understanding of the underlying concepts, and then make some trials with OpenSSL to see how it lives up to them. For SSL/TLS, I suggest reading the TLS 1.0 specification, which is quite readable and includes some schematics on how things go in a TLS handshake.

For the elementary cryptographic algorithms, see the indispensable Handbook of Applied Cryptography, which is freely downloadable. Chapter 13 includes some discussion on the concept of public key certificates.

For X.509 certificates, you first must understand what ASN.1 is about; see ASN.1 Complete, by John Larmouth. The book is freely downloadable (after registration) and is good as long as you do not buy the idea that ASN.1 is great: it is an awful incarnation of what could have been a great solution (the Devil is in the details; in the case of ASN.1, the Devil had enough room to hide an entire legion of demons with him). Once you see what ASN.1 is about, you can try to have a look at the X.509 standard, or at least its Internet profile. It is a deep and dark and complex domain, paved with all the Good Intentions in the world, and as nightmarish as could be imagined by a demented scientist who read too much Lovecraft. All hope abandon ye who enter here. Also, have a look at the X.509 Style Guide.

My trusty friend Google came up with this page which links to some sample code and documentation (as two PDF files) explaining how to use OpenSSL (as a library).


How come MIM is getting through outlook SSl security Hello I am using outlook with ssl security to connect to a mail server but whenever I launch a MIM attack and accept the fake certificate my password is shown. How is this possible? Shouldn't I be connecting securely with ssl where the attackers wont be able to manipulate the certificate?

And if the certificate of outlook is getting faked by MIM over ssl why cant I fake the Facebook cert as well over ssl and reveal the login info?

Is there different types of certificates stronger? or better?

accept the fake certificate

This is the problem. SSL won't protect data against end users who read security alerts about unrecognised certificates and then accept them anyway.

  Is there different types of certificates stronger? or better?

Yes, but that won't help with a MITM gives the user a different certificate and the user accepts it.


Storing database password in application Let's say my application connects to my database. This requires me to have the username and database in my config as follows:

postgresql://scott:tiger@localhost/mydatabase

I have an automated deployment to set this up and I don't want to store the database both in the application and my deployment script. Therefore my options as I see them are:

Make it so postgresql isn't secured with a password and secure another way
Make the deployment script generate a random pass and have it add it to both postgresl and the configuration file

Can anyone help me understand how they would approach this from a security point of view please.

This actually sounds like a pretty decent use case for PostgreSQL's TLS support.  You can configure a trusted client certificate for the application to use with your deployment script and then get the other advantages of not having a shared secret, plus obviously encryption too (unless your app is already CPU bound, in which case selecting the NULL cipher is a possible workaround).  Sometimes adding TLS complicates matters, but it sounds like in this case it might actually simplify them.

http://www.postgresql.org/docs/9.1/static/ssl-tcp.html

TLS session bring-up can add a few milliseconds of latency, but if you're already managing a connection pool, I don't suspect the app would notice.


Someone Copied Our Site Code (Including Analytics) and Put Adult Content on It Someone copied our WordPress based website and put it on another server and added adult content on it. It also includes our Google Analytics code so the traffic to this site also shows on our analytics data.

Please some one suggest how to remove it and why did someone do this?

This site also includes our Google doubleclick code so how can that harm our ad services?

You could write an abuse email (ISP) to the hoster of this copied website (Domain Whois).
The hoster should be aware about legal regulations (Copyright) and should write to the owner to put it offline.

Normally you should follow the steps below:

Write to website owner (Domain owner) to put site down
If you do not get any response contact the ISP of this website and report abuse about it. Be sure to provide your website link, their website link and a description. If you're not sure about the Hosting provider may consult: http://www.whoishostingthis.com
If Page is already listed on search engines contact them to remove this page.
If you do not get any response, contact your lawyer (specialised lawyer)


What is the deal with Valicert SSL root certificates? Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no longer honored, revoked, whatever. I got it from GoDaddy a while back and it cross-certifies to the Valicert root. It just seems to work sometimes and then sometimes I get folks tell me they have problems accessing my site. It is still on the GoDaddy root repository page but it's considered "legacy". I've been round and round with a GoDaddy rep on this and have now wasted 2 hours of my life. I really don't want to replace it if I don't have to. But I also noticed that its no longer being kept in the Windows trusted root cert store, which isn't a good sign. At least on my computer.

The "ValiCert Class 2 Policy Validation Authority" root from 1999, along with about a dozen other roots from ValiCert and other CAs, are being phased out because they're only 1024 bits. 1024-bit RSA is increasingly close to being breakable1, so the community has decided to get rid of them in an orderly manner by 20112 to prevent a major security incident and panic in the coming years.

Mozilla's stated policy was to disable them some time after December 31, 2013, and they have been actively working with the CAs to do so.

In other words, yes, you have to replace it. What's the problem? I realize it's unpleasant3, but you have to renew it annually anyway, and this is less work. Maybe your CA will be willing to compensate you for the inconvenience you've suffered as a predictable consequence of their decision to use an obsolescent technology long after its sell by date.

1 I wouldn't be surprised if certain agencies could factor them -- slowly -- but I might be a little paranoid.
2 Wait, what's today's date again?
3 I remember Heartbleed.


Stations not deauthenticating when using Aircrack-ng I am attempting to conduct a deauthentication attack on a stand alone AP using Aircrack-ng. Im using an ASUS 802.11ac router and using aireplay-ng to send the deauthentication packets.

But when conducting the attack whilst the router has any form of security enabled, WPA/WPA2, the deauthentication packets are sent, but don't seem to be accepted by the AP, meaning the stations stay authenticated.

However, if I take the security off the AP, the attack works successfully and the station is deauthenticated from the AP and a further authentication and association request is sent.

I am fully aware of 802.11w, that protects the management frames and would prevent deauthentication attacks from occurring, but this AP does not support PMF, so I cannot find a reason why the stations are not being deauthenticated when the packets are sent to the AP.

Am I missing something obvious as to why the attack isnt being successful? or does anyone have any further knowledge about WPA/WPA2 that would prevent the attack from working?

I think your issue is still Protected Management Frames which appear mandatory in 802.11ac. See 802.11w protected management frames - Wi-Fi

  but this AP does not support PMF

Specifically:
"The IEEE 802.11w amendment added this functionality to the 802.11 standard and since July 1st 2014, the Wi-Fi Alliance (WFA) made the support of Protected Management Frames (PMF) mandatory to pass 802.11ac or Passpoint aka HotSpot2.0 R2 interoperability certification. So we will see a much greater adoption of this feature in the near future."

Source

I am curious how you know it doesn't support it, is that due to it not referencing it in the admin interface or from the frames it's sending out? You should be able to confirm this by checking the packets coming from the AP and looking for the presence of the bit identifying PMF support.

Also slight technicality but the attack used to work as the wireless clients believed they had been disassociated by the AP, not the other way around.

TL;DR: De-authentication frames are now signed using the wireless key because of something called "PMF" which is mandatory to pass 802.11ac certification. Your AP probably supports PMF without you realising.


What's the state-of-the-art approach to secure a backend API? Scope

Currently we are developing a backend REST API which is consumed by handful of MVC applications. In this case we are talking only about server-server communication and the API won't be consumed by any user directly. The environment is purely on Windows Server and it's to mention that there are no plans at the moment to use active directory.

What is the best way to authenticate a server application (MVC) to the backend API?

Considering everything is done over https, at the moment we considering either
 client certificate or token based authentication (via Basic / Bearer).

With both of those approaches a lot of pros and cons emerge and I really would
 like your help to verify, correct and maybe complement them.

Token-Based Authentication

Scales well in case we decide to use it for other parts aswell
No client certificates (installation, renewal)

Client Certificate Authentication

Wide spread in the enterprise environment
Well established
Manageable amount of clients
Considered by many as one of the securest option
No single point of failure (self hosted identity server)

Conclusion

I am pretty sure I've forgot some important ones and I appreciate any kind of input.

In addition, given the scope above which approach would you opt?

My advice would be to not worry about authentication between the frontend servers and the backend one, but to setup a secure channel between them. From an architectural point of view, this means setting all those servers in the same security zone, and prevent any external access to the backend. From there on, if one front end server submits a requests to the backend, it just passes the user id, and the backend will trust that because the request can only come from a trusted server.

This is common in medium to large computation center: the user authentication is done by the MVC servers or in case of X509 certificate authentication by reverse proxies, and the other servers just trust what has been put in the request by the first server that did the authentication.


Filezilla for macOS - Virus? I'm trying to download FileZilla for my MacBook and I have McAfee installed. When I click on the download button, the antivirus flags it as Artemis!70506fb398e5 so I decided to upload the file to VirusTotal and I get this:

Of course I'm downloading it from:
https://filezilla-project.org/download.php?platform=osx
(the free version)
Does anyone have any idea if this is a false flag or something?

The download is  shown by many scanners as Adware. The download page you use has a small notice below the download

  This installer may include bundled offers. Check below for more options.

Based on this it is likely that the bundled offer is the cause of the warning. If you follow the hint to check below for more options you get to another download page where a different version is offered. This version does not seem to have the Adware problems.


Why is still so easy to send phishing emails? When I first started playing around with how SMTP worked over 20 years ago, I remember being somewhat surprised how easy it was to make an email appear in someone else's mailbox that looked like it came from anyone at all.

These days, SMTP servers do tend to be somewhat stricter about forwarding on emails that are not from addresses they are configured to handle, but the fact remains that, for instance, in my hotmail account, I receive at least once a week an email that purports to be from apple.com or anz.com.au (a local bank) etc. etc., with nothing at all in the email that suggests it did not originate from a mail server owned by said organisation.

The obvious question is why is this still so broken, when it should be so easy to fix? If I browse on the web to https://www.apple.com, I'm given a pretty strong guarantee that what I'm looking at is legitimately owned and/or managed by Apple Corporation, but if I receive an email that says it's from support@apple.com there appears to be no such guarantee at all.

I'm aware there are protocols and standards for signing emails (DKIM etc.) but it seems they're so little used that few popular mail clients even bother to check for them.

Yes DKIM and SPF as you say do go some way in helping fight against spoofing. It's not the clients that tend to ignore the likes of DKIM it's the receiving email server that does not bother to check the result, or fails to adequately act on the result.

I suspect many large email providers would rather accept more spam over loss of legitimate traffic or complicated user configurations. The likes of hotmail I suspect commercially would rather accept the spam.

On the other hand the likes of Apple.com not having suitable DKIM etc is probably because the implementation costs to get this correctly deployed across their infrastructure is too costly and complicated. There is a strong argument that companies should feel morally compelled to ensure their domains, such as Apple, make use of email security controls. But costs will normally outweigh security benefits.


Website Login Security (Secure enough?) I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big application where money is involved.

The site is written in PHP, database is MySql. This is the current login.

First off, I have a 128 sign long salt and session key saved in the local config.
On every site that interacts with sessions (e.g. the user control panel) I have this snippet at the start of the code:

session_start();
if (empty($_SESSION)) {
    session_regenerate_id(true);
}

After that I connect to the database, escape all the strings and read out the data.
After that, I compare the two passwords which got hashed with SHA-512 and the salt from before:

public static function hashValue($str) {
    for ($x = 0; $x < 10000; $x++) {
        $str = hash('sha512', $str . self::$salt);
    }

    return $str;
}

If everything is correct, $_SESSION[$sessionkey] gets set with the user ID from the database (altough the long session key shouldn't be neccessary because the client can't change the $_SESSION vars locally anyway, IIRC. Right?)
If the site is secured (as in, users not logged in don't have access) this code is called to redirect them back to the index if they aren't logged in:

if (!isset($_SESSION[$sessionkey])) {
    header("Location: ?view=default");
    exit;
}

Is this application secure? I've read somewhere that its better to have a randomly generated salt for each user, saved in the database. Is that really neccessary, considering it only really prevents brute forcing a bit better, which shouldnt be a problem with a captcha anyway?

The worst case scenario you have to protect against is an attacker which completely compromises your server and obtains your sourcecode, your config and a dump of your database. Keep that in mind.

This is the scenario in which a salt is supposed to protect your passwords. Remote brute-forcing is not impaired by a salt at all (which is pointless anyway on everything but the most trivial passwords due to limited network bandwidth).

A few problems:

A "salt" which is the same for all passwords is called a pepper and doesn't increase security much when the attacker knows it.
SHA512 is a message digest algorithm, not an algorithm for hashing passwords. The problem with SHA512 is that it is too fast, allowing the attacker to brute-force the stolen password database very quickly. What you want is an intentionally slow algorithm like bcrypt. PHP has a very easy to use default implementation which can automatically generate, store and apply the salt for you.
Long, unique and impossible to guess session IDs are necessary, because when an attacker can guess the session ID of a logged in user they can hijack their session. PHP's session handling system assumes that any request which includes the session ID of a previously authenticated user comes from that authenticated user. In general you should rely on the session IDs which are auto-generated by PHP and only replace them with your own when you are sure you know what you are doing.
Minor point: "After that I connect to the database, escape all the strings and read out the data." Escaping all user inputs with mysqli_real_escape_string would be sufficient in theory, but in practice it is easy to forget about some rare edge-case where user-supplied strings end up in database queries. A better practice is to do all database queries with prepared statements which use the ? placeholder and bind for all variables. In that case the mysqli API does the escaping for you which is far more reliable, especially because it is aware of the context in which the escaped strings will be used. As an additional benefit it also has some performance and readability advantages.


Is there a way to identify the client using SSL Handshake Messages? I have an SSL Server and it can be connected by two types of Clients, one for which Client Authentication is needed and the other for which Client Authentication is not needed.

Is there any mechanism in the SSL Handshake using which I can distinguish between both the clients and decide for which I need to send the certificate request and for which I should not be sending the certificate request?

How do applications commonly deal with such a scenario?

Typically, this scenario is addressed by sending a certificate request anyway and allowing for an empty certificate message (sent by the client) when the certificate is not needed. This is is what mod_ssl's SSLVerifyClient optional does (also the difference between need and want authentication in Java). This is the establish way of dealing with servers for which not all clients may need to present a certificate, and clearly allowed within the TLS specification (Section 7.4.6):

  This is the first message the client can send after receiving a server
  hello done message.  This message is only sent if the server requests
  a certificate.  If no suitable certificate is available, the client
  SHOULD send a certificate message containing no certificates.  That
  is, the certificate_list structure has a length of zero.  If client
  authentication is required by the server for the handshake to
  continue, it may respond with a fatal handshake failure alert.

You might be able to give an hint using the Client Certificate URLs extension, although I don't think this is the intent of this extension (that would be a bit of a trick). I'm not aware of this extension being widely supported, which would certainly cause practical problems if you want to run this on a production system.

If you really don't want the client to be prompted for a certificate in certain cases, what you may be able to do is to use the Server Name Indication (SNI) extension, which is increasingly supported, thereby offering two distinct server configurations depending on which server name the client is requesting. I haven't tried, but I presume that if you configure two distinct virtual hosts with Apache Httpd using SNI, and only one of them is configured to request a client-certificate, you may be able to achieve your goal.

The downside is that you would need to set up two host names for the same server, but that's not as big a deal as other solutions that may require some programming.

For example, even if you assumed that the source IP address was a sufficient discriminator between your two use cases, in Java, you would probably have to implement the server as listening to a plain ServerSocket (not an SSLServerSocket), check from which IP address it's coming from, convert the accepted socket into an SSLSocket in server mode and configure it at the stage (before the handshake has taken place) to request a client certificate or not, and only then trigger the handshake. (I haven't tried any of this, but that would seem a reasonable way to handle such a case.) This would certainly be more complex than creating an SSLServerSocket and accepting pre-configured SSLSockets from it directly. I would imagine that other SSL/TLS stacks (in C or others) wouldn't handle such a case very cleanly either.


Can CSRF protection work even if an XSS vulnerability exists? Need for CSRF protection that withstands an XSS attack

One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform.

If it would be possible to prevent CSRF even if an XSS vulnerability exists, it seems that that would greatly mitigate the damage XSS can do. Because of httpOnly, it may not be possible to steal cookies, which would leave an attacker with phishing attacks, defacement , and reading out data that is accessible to the client.

But OWASP says that it is not possible to prevent CSRF once an XSS vulnerability exists.

Using referrer check for proper CSRF protection?

Shouldn't it be possible to use referrer checks as CSRF protection which work even if an XSS vulnerability exists?

Of course a domain check would not be enough. But wouldn't it work if the exact script is checked?

For example, if a request is sent from http://example.com/add-user.php, it would be required that the referrer is http://example.com/add-user.php.

This still means that an attacker can perform CSRF on that script, if that script contains an XSS vulnerability, but no CSRF attacks on different scripts on the same domain should be possible, as referrers cannot be set via JavaScript.

Referrer checks may not always be practical (for example, because the client doesn't send referrers), but if they are used, could they be used in such a way?
If they can be used like this, are there major downsides to this approach?
If not, could there theoretically be a CSRF protection that works if an XSS vulnerability exists?

No, I don't think so. It could be circumvented by creating an iframe with display: none, containing the page add-users.php. Then all the attacker has to do is to fill in the form fields and submit the form with JavaScript, and the attacker has successfully added a user without the victim's consent or knowledge. Checking the referer header would not stop this, as it would have the correct value.
OWASP has the following to say on using the referer for CSRF protection:

Although it is trivial to spoof the referer header on your own browser, it is impossible to do so in a CSRF attack. Checking the referer is a commonly used method of preventing CSRF on embedded network devices because it does not require a per-user state. This makes a referer a useful method of CSRF prevention when memory is scarce. This method of CSRF mitigation is also commonly used with unauthenticated requests, such as requests made prior to establishing a session state which is required to keep track of a synchronization token.
However, checking the referer is considered to be a weaker from of CSRF protection. For example, open redirect vulnerabilities can be used to exploit GET-based requests that are protected with a referer check and some organizations or browser tools remove referrer headers as a form of data protection. There are also common implementation mistakes with referer checks. For example if the CSRF attack originates from an HTTPS domain then the referer will be omitted. In this case the lack of a referer should be considered to be an attack when the request is performing a state change. Also note that the attacker has limited influence over the referer. For example, if the victim's domain is "site.com" then an attacker have the CSRF exploit originate from "site.com.attacker.com" which may fool a broken referer check implementation. XSS can be used to bypass a referer check.
In short, referer checking is a reasonable form of CSRF intrusion detection and prevention even though it is not a complete protection. Referer checking can detect some attacks but not stop all attacks. For example, if you HTTP referrer is from a different domain and you are expecting requests from your domain only, you can safely block that request.

(On a side note, I would dispute that solving this problem would "greatly mitigate" the damages from XSS. An attacker could still steal passwords, in addition to the other things you list. That is still pretty bad.)


can the iteration number of pbkdf2 be a security flaw? I am now working on a project that involves saving two different pbkdf2 hashes on the server. i was wondering whether there is a mathematical connection between a 1000 iterations hash of a given password, and a 1001 iterations hash of the same password?

The iteration structure of PBKDF2 looks like this (https://tools.ietf.org/html/rfc2898#section-5.2):

U_1 = PRF (P, S || INT (i))
U_2 = PRF (P, U_1)
...
U_{c - 1} = PRF(P, U_{c - 2})
U_c = PRF (P, U_{c-1})

Where:

PRF is the Pseudo Random Function (i.e. the underlying hash function)
P is the password
S is the salt
i is the block number

Given U_{c - 1} and U_c, I could try to find P such that U_c = PRF (P, U_{c-1}) rather than having to iterate 1000 times as you'd normally have to with PBKDF2.

This essentially defeats having multiple iterations in the KDF, reducing the number of calls to the PRF from 1000 times per try to the smallest difference between any two hashes' iteration count.

An improvement if you need multiple PBKDF2 with different iteration count from the same password, is to vary the Salt.


Does the average user really need a password manager? I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account where I don't care if anybody gains access to them and that's why I have them saved in the browser's password manager. For example, I don't care if somebody gains access to my Alfa Romeo forum account or my Deal Extreme account because they can't do me any harm.

Now for my internet banking and main email, it's a different story. I use a strong password for my internet banking which I DON'T recycle and don't have it saved in my browser password managers. For banking transactions I use a hardware token. For my gmail I use a two-step verification with another strong password. To me that sounds like a secure enough method where I'm keeping what's important safe and at the same time I'm not clogging my mind with too many passwords or worrying about what the latest security breach in my password manager would be.

Thanks!

Yes.

The average user should use long random passwords for every site. Passwords should not be repeated, passwords should not follow a discernible pattern. The compromise of any one password (e.g. your Adobe or LinkedIn login) must not be allowed to make it any easier for the attacker to guess your other passwords. These requirements make remembering passwords very nearly impossible. But that's not the primary reason why you should use a password manager.

The primary reason is that it reliably protects you against phishing attacks. A browser-integrated password manager will only fill in a site-specific password if you're actually visiting the correct site. So you won't accidentally type in your Paypal.com password into www.paypal.com.us.cgi-bin.webscr.xzy.ru. This is doubly true for average users, who on the average, rely on the general familiarity of a site to determine whether or not its legitimate (a terribly ineffective heuristic). Since you don't know your password, you can't type it in. Instead, it will only auto-fill if you're at the authentic site.

Use a browser-integrated password manager, don't get phished. It literally is that simple. Phishing is far more prevalent and serious a threat than password disclosure, anyway.


What are the risks of sending sensitive documents that are on physical media and password protected via postal carrier using registered mail? Background
The company I work for is extremely risk averse when it comes to adopting the use of cloud services for improving business flows.

We currently use a very famous search company's business back end for a lot of our infrastructure. That means we automatically get their cloud storage and document sharing services.

The company has a process where they proof digital documents. The documents are created by a third party, burned to a physical CD and sent via registered US mail. This not only slows down the business process, but I feel that this is equally if not more insecure than utilizing the cloud storage service we have access to. For example, if someone with bad intentions got a hold of this physical media they would have all the time in the world to try and crack it or even duplicate it (data application for Law #3 of the 10 Immutable Laws of Security).

Additionally, the files on this disk are probably not being encrypted, but being placed in a password protected zip file.

I am making a comparative write up (with references) on the insecurities of sending these digital documents via the US postal service as opposed to using a cloud sharing option.

Question
What are the risks of sending sensitive digital documents that are on physical media and password protected via postal carrier using registered mail?

This is really just about the risks of sending data on physical media and not about the encryption scheme of the data.

There are always risk, the ones you are asking about have more to do with physical access and physical loss of the media. As many others have mentioned encryption is going to play a big part in helping with your solution.

I'd recommend taking a step back and looking at the specific risks that concern your business and this data in particular then creating security controls & countermeasures to handle each specific risk.

Some businesses may not care if a copy of the data sent is stolen as long as at least one copy arrives within a reasonable time. This is more of an Availability issue.

Some business are ok if any given copy of the data sent never arrives as long as that data cannot be read by anyone outside of their organization. This is more of a Confidentiality issue.

Other businesses are very concerned about the data and transport media they are using being tampered with or modified in some way. This is more of an Integrity issue.

For any given business shipping data for a given project the Confidentiality, Integrity, and Availability needs are all going to be a little different. My point here is that you need to address each of these components of the risk separately.

There are additional variables to each of the following but in general you would be wise to address the following separately:

For confidentiality encryption is going to be the no-brainer. You will want to use very strong encryption and enforce very strict key management.

For availability you may want to ship identical packages via multiple carriers. This is a cost issue more than anything and in most, but not all, countries this one might be easier to solve.

For integrity you may want to consider how you contain the data in transit to prevent tampering. Part of this has to do with which media you use, specifically the size component. This may also affect shipping costs but you can leverage a wide array of physical security mechanisms and anti-tamper mechanisms to prevent tampering. Whether this is the super-cheap "glitter nail-polish" to seal a box method or you end up shipping a small bomb-proof, fire-proof, water-proof safe containing custom-built evidence bags with your signature all over it and cover that with custom hologram seal tape and maybe work 5 other unique things into the packaging (you get the idea).

Now that you've looked at these components separately you can look at the situation again and weigh the value of the data, the costs of potential solutions, and figure out what is the best solution based on your needs.

Do go for maximizing low-cost solutions but avoid low-quality ones. Strong-encryption is a HUGE win. Tamper-proof evidence bags are cheap and if availability is an issue find the cheapest way to ship things. The more cost-efficient your security solution is the longer it will last. Likewise this free's up your budget for other security tasks.

Task specific to your question that I would recommend. Figure out how to make strong encryption super easy for the people using it. Don't just trust the .zip file passwords. Find software where it's a "right-click" or "command-click" and it's encrypted level of ease. Likewise force the people receiving packages to notify you if anything ever arrives which is not encrypted. It may even be worth having the people who encrypt it not be the people who check that it's encrypted and ship it (separation of duties). Again it's really important to keep everything simple and easy if you want your users to do the right thing.


SQL injection filter evasion During manual SQL injection testing I came upon this.

Is there any way to bypass these filters that supposedly prevent a UNION based attack?

<?php
error_reporting(0);
include('db.inc.php');

$id=strtolower($_GET['id']);

$counter = 0;
if(strpos($id,"union")!=false){
    $counter++;
}
if(strpos($id,"select")!=false){
    $counter++;
}

if($counter==2) {
    echo "Go Away Get a Life";
}else{
echo "Query Coming is : ".$id."
";
$query = "SELECT username,password FROM admin WHERE username='".$id."' ORDER BY 1";

$result = mysql_query($query) or die(mysql_error());

while($row = mysql_fetch_array($result)){
    echo "Username : ".$row['username']."
";
    echo "Password : ".$row['password']."
";
}
}
?>

Also, what is the best way to prevent a UNION based SQLi attack?

You can exploit the != comparison of strpos’s return value and false as 0 != false is false:

var_dump(0 != false); // bool(false)

This is due to implicit type conversion to boolean, where 0 is converted to false.

So you only need to ensure one of the strpos returns 0, which means $id has to start with either union or select, for example:

id=union' union select 'foo', 'bar

Since strpos($id,"union") returns 0, strpos($id,"union")!=false is false, $counter gets incremented only once and the query is executed with the injected SQL.


How likely is a collision using MD5 compared to SHA256 (for checking file integrity)? Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives.

I wonder how much safer is the use of the SHA256 hashes for integrity checks?

Note: Consider the file content as random input (no attacks)

Note: Seems to be a simple question (and I read about collisions on wikipedia), yet I have not found an answer on this site

There seems to be some confusion about the capabilities of a collision attack.

Two of the properties a cryptographic hash must have are collision resistance and preimage resistance.

If a hash is collision resistant, it means that an attacker will be unable to find any two inputs that result in the same output. If a hash is preimage resistant, it means an attacker will be unable to find an input that has a specific output. MD5 has been vulnerable to collisions for a great while now, but it is still preimage resistant.

What does this mean for integrity?

If you trust that the party that originally hashed the data to provide you with the integrity check is not malicious, and they did not allow anyone to modify the data beforehand (any part of the data, even if 2 images, videos, or pdfs look identical they can be vastly different), then MD5 should be sufficient to verify integrity, and SHA-256 shouldn't offer much more security (barring any future attacks on MD5's preimage resistance).

If an attacker may have been able to make any modifications to the data (even seemingly benign modifications), then SHA-256 will be more secure, as with MD5 the attacker could have crafted a malicious file with the same hash.

Are these integrity checks useful?

In many cases, not really. If you're downloading the file over HTTPS from the same website providing the hash value, then you're already benefiting from the MAC TLS uses for authenticity checking, so a MitM will be unable to change the file in-transit. If someone is able to modify the file on the site maliciously, they can also modify the hash.

One case where it does make sense to verify an MD5 or SHA-256 hash for a file is if you download the file from a mirror and check the hash against one provided by the original trusted site.


Communicating routed interfaces for Cisco ASA 5506-X Recently our organisation has been supplied a new ASA 5506-X to replace the old good PIX506e for a project.
We have encountered a problem on routed interface on ASA 5506, which is very different from ASA 5505. We could not get the traffic passed from the Outside to the Inside and vice versa. I understand that traffic flow from Inside to Outside is permitted by default.

As the diagram describes, these are the summary:

Inside interface of ASA is configured with 192.10.5.253
Outside interface of ASA is configured with 10.1.150.1
Outside network has 4 VLANS, VLAN10 being the VLAN our workstation is sitting at, which carries IP of 10.1.10.201.
There is a server in client's network, which has the IP of 192.10.5.3.
Basically ASA 5506-X is acting as an router to route traffic between Inside and Outside network.
There is a layer 3 switch in the outside network. Which has the static route to reach 192.10.5.0/24 via the gateway of 10.1.150.1.

ASA 5506-X configuration:

Enabled allow traffic between same interfaces with security level.
ACL permitting ANY ANY ICMP TCP on both Inside and Outside interface.
NAT from outside network to inside network. (its a long list)
Static route to 0.0.0.0/0 via 192.10.5.254(client's device IP) to WAN
Static route to 10.1.0.0/16 network, via the gateway of 10.1.150.254 (VLAN interface IP in inside network layer 3 switch)

What's is working:

Within the outside network, we have a layer 3 Ruggedcom switch. Where we configured inter-VLAN routing in it and it works fine. All 4 VLANs in outside network are able to communicate, and able to ping to 10.1.150.1.
For client's network switch, its just a layer 2 switch and no VLAN segregation.
All end devices can communicate within their own network.
ASA 5506-X can ping to all equipment and all end devices.

What's is not working:

Outside network end devices is unable to ping inside network end devices even with the static route is established.

I did some research and found out that ASA 5506-X does not allow communication between the interfaces? I even specified ACL to allow ANY traffic from source ANY to destination ANY. I am using ASA version 9.6.
What could be going wrong here?

Disclaimer: without you posting your config in here it's quite hard for me to help, however, I will attempt to give you an idea of why this might not be working.
Firstly, as you've stated by design you cannot ping an interface if you come from another interface on the same device, this is a security feature of the ASA and it is fully intended to be like this. This is whats known as a "Distant interface". If you think about it, it is a good thing you cannot ping between interfaces, realistically you wouldn't want such a thing even if you think you do. I would like to add this can not be disabled.

Secondly, without altering your access rules you will not be able to achieve this, there is a simple reason for that. The ASA has something called the Modular Policy Framework this is what is essentially stopping this operation from taking place. By default, the MPF will not inspect ICMP traffic. In essence what this means is you will not be able to ping or traceroute from the inside to the outside. There are two ways you can achieve this:

Inspecting ICMP
Access rule to allow ping replies

By inspecting ICMP traffic this would subsequently allow this function. Alternatively, you can add an access rule to allow the ping replies back in. Ideally, you would want to choose the first one as it is more secure. If you're not inspecting ICMP traffic it is within the realms of possibility for someone to issue an ICMP DoS attack otherwise known as a "Ping flood"
For inspecting ICMP traffic the following is an example of how you would achieve this:
SecSe# config t
SecSe(config)# policy-map global_policy
SecSe(config-pmap)#  class inspection_default
SecSe(config-pmap-c)# inspect icmp

In regards to the second option, a simple access-rule would be sufficient although as I've mentioned this is an ill-advised method:
SecSe# config t
SecSe(config)# access-list OUTSIDE_IN permit icmp any any echo-reply
SecSe(config)# access-group OUTSIDE_IN in interface outside

Thirdly, in regards to your final point, you may have a static route in but it will never work if you don't allow the traffic back in. The problem here is you will need an access rule to allow that traffic into the ASA otherwise it will implicitly drop it as that's how a firewall works.
As I said, for me to help further I will need your configuration but as I've mentioned this is a question which would be better suited on Network Engineering Exchange rather than here.


Is my ssh server safe because I use DenyHosts and don't allow root access? I am by no means an expert in online security so I wanted to outline the steps I am taking to remain as safe as possible yet still make it as easy as possible to gain access to my system from anywhere (within reason).

I have set up an openssh-server on my linux (debian wheezy) PC and enabled port forwarding for port 22. I have also installed the DenyHosts package and set it up with the default parameters (block IP addresses after 10 invalid attempts at the correct username, or 5 invalid username guesses). I have disabled root access directly (ie. attempting to log in as root will fail and after the next attempt your IP will be blocked).

I have allowed only a single user account to be accessible and have used a password that I would consider secure (upper and lower case letters and numbers, nothing obvious or related to me).

Is this a safe setup? Are there any obvious security concerns that I am missing?

I understand that "best practice" is to use a public/private key pair, but I am concerned that this will make it too difficult to log on from a new computer. So suppose I take my laptop (or the device of someone I trust) and use it to log on via putty from the local starbucks or internet cafe. Is this safe, given my current setup? And if not, what would I have to change to make it safe?

I hope these questions aren't too vague. I'm relatively new to this subject.

Security is a relative concept. I cannot say if a certain configuration is safe because there is always a safer practice. As you have mentioned, using a public/private key pair is more secure but you are unwilling to sacrifice convenience for the added security. Ultimately, you need to find a balance between convenience and security that you are comfortable with.

You might want to look into GeoIP filters to limit your SSH logins from a certain country only. This will prevent brute force attempts from other countries.

More information on GeoIP filters here: http://www.axllent.org/docs/view/ssh-geoip/

Another possible measure is to have SSH listen on a non-default port. Most automated scanners will only scan port 22 and thus will not pick up your server if it is running on other ports. However, there are drawbacks to that as well. E.g. certain locations, internet cafes may block these non-default ports.

More information on non default port here: http://major.io/2013/05/14/changing-your-ssh-servers-port-from-the-default-is-it-worth-it/


What are the methods to crack WPA and WPA2? Is there any method other than brute force and dictionary attacks to break WPA and WPA2?

Cracking WPA/WPA2 can be done pretty quickly using the aircrack-ng suite which conveniently come packaged with the Backtrack penetration testing live operating system. Take note that you will need a wireless card that has a compatible chipset.

There are plenty of articles on the internet on cracking WPA/WPA2 key but I've personally found that Youtube videos are the easiest to follow.


Caging unsecure internet facing IOT device Suppose I bought a domotic IOT device which connects to the internet via an ADSL modem and permits access to it via web browser or smartphone app without SSL encryption and several other weaknesses.

I need to use it because it's an essential piece of my home but need to secure it as soon as possible.

Is there any way to put a routing/firewall device in between the IOT device and the Modem such that I can securely authenticate to the routing/firewall device first and from there access the unsecured device.

What is the name of such configuration and how would it work?
Notice a VPN itself is not enough because the smartphone app might not support it.

Are there canned solutions to problems like these? How can one protect essentially vulnerable internet facing devices from Shodan scans without changing the vulnerable devices but essentially wrapping them in a secure environment?

As @AndreBorie says in their comment, a VPN gateway would solve this, assuming that the IoT device doesn't expose other connection methods (e.g. an insecure Bluetooth or Wifi connection of its own).

A VPN gateway works by allowing a device to connect to a network over an encrypted channel over an insecure network (such as the general internet), then decrypting the traffic and forwarding it onto a device which is on a trusted network (your home, in this case). The internal device doesn't know it's connecting to a remote address, and most modern phones support a suitable form of VPN connection, which can forward all traffic through the VPN connection.

Some applications may attempt to detect the presence of a VPN (in particular, things like Netflix which may have distribution restrictions on content), and refuse to run properly when connecting through a VPN, even where this is personally operated. There is also a speed impact from using a VPN, although this depends on the connection to the VPN server, and I have known odd situations where accessing content was quicker through a VPN due to routing misconfigurations.

You would also need to ensure that the router at your home did not open the ports for the device automatically - some uPNP supporting routers allow for devices on the "inside" to open ports without human interaction. If this happened, the VPN would be bypassed, and the device left open to Shodan or similar scans.


How secure is a Mac if it passes Apple Diagnostics? Recently I brought my MacBook Air to a Genius Bar to perform a clean MacOS installation. For security purposes, I asked for a hardware check as well. The Genius Bar technician ran Apple Diagnostics, claiming that the test can check whether the hardware components of my computer have been tampered with.

After the test completed, a list of component information appeared on the technician's iPad (which I didn't read). He scrolled through all of the items and concluded that my computer is secure in terms of hardware modifications.

I would like to ask how secure a Mac is if it passes Apple Diagnostics. As an example, if an attacker disassembled my MacBook Air and inserted a hardware keylogger, I doubt that the hardware test could find it.

Apple Diagnostics is not designed for this purpose, and cannot prove your Mac is secure.
However, you should probably still assume you are safe from such a hardware-based attack.
It is important to note that Apple Diagnostics is a tool focused on testing hardware health, not focused on security assurance. So, we can assume that it isn't looking for things which it doesn't expect (within reason, I'm sure some aftermarket modifications that Apple dislikes would be found and flagged). Anybody with the resources for an attack like you describe — disassembling a MacBook Air, inserting a custom designed keylogger, and reassembling the machine — would have the resources to design it such that Apple Diagnostics wouldn't discover it.
But as the comment above by Stephen Touset points out, unless your threat model includes being targeted by some very well resourced attackers (clandestine services of nation states, elite private offensive security contractors, etc), whose attacks would include having undetected physical access to your computer, the risk of that kind of physical attack is insignificant. A MacBook Air is a particularly challenging target, as the interior of the machine is densely packed, difficult to access without leaving evidence, and generally just inaccessible.
Unless you have sincere, well-founded concern about the machine, hardware will not be the way you are attacked. Your risks are much more likely to be software-based attacks. And if you do have sincere, well-founded concern, then there's no way that a simple hardware diagnostics tool can ever prove the negative. In such a case, your only realistic option is to completely replace the unit with one that can't be linked to you (including being invoiced or delivered in your name or address, or being paid for by any method that can be connected to your identity or address).


File SHA256 checksum failed, but OK on reboot I downloaded the Windows installer (.exe) for ImageMagick via http (both http and ftp downloads are provided here).
Upon executing the file, Windows SmartScreen displays a banner across the screen saying "Running this app might put your PC at risk", so I decide to verify the published SHA256 checksum using the md5deep package.
Turns out the downloaded file doesn't match the published checksum. I then tried downloading the file via FTP. This one worked. No SmartScreen warnings, no checksum errors.
I tried downloading the http version a few more times. Once again, the SmartScreen warning is back and checksum doesn't match.
The strange thing is, upon rebooting Windows, all of the previously corrupted files (the ones downloaded via http) suddenly match the checksum, and also, SmartScreen no longer displays the warning.
What could be causing this?

@ThatGuy Lets start by re-downloading the http and ftp links again now we can upload them to VirusTotal.com while you are uploading the files we should come up with the MD5 hashs of the files, after you have found the MD5s you should Google them to see if anything comes back with the same MD5 you need to Google them with quotes and without. If everything comes back all okay then you have nothing to worry about.

Note that Googling the SHA256 may not return anything which happens alot when you search for them.

Hope that helps.


Is http to https port forwarding a vulnerability? I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant that http or https would work on URLs for that web application.
Recently this was seen as a security risk and http is no longer being advertised. For users this has caused an issue where all the links they had which were originally http no longer work and they are having to update all their links to https.
I can't quite figure out what the vulnerability is, and if someone could shed some knowledge I would really appreciate it.
How I understand it, there are 2 paths http and https. The TMG server essentially acts as the gatekeeper that sits in front of the organisations network and forces all http traffic down the https route instead, so at no point is there any http traffic into the network.
Also, to add plenty of well recognised organisations still use port forwarding, for example Microsoft teams http:// teams.microsoft.com auto redirects to https:// teams.microsoft.com. Unless they are using a different method of redirect that is more secure?
Thanks in advance

I think you mean redirecting, not port forwarding.
Redirecting from http to https is quite common.  This is where the browser initially makes a request to an http URL on port 80, then the web server responds with a 301 or 302 redirect (in the response header) to an https URL, then the browser makes a request to that URL via https on port 443.
security.stackexchange.com is configured this way, as you can see with the following curl command:
curl -v http://security.stackexchange.com/
*   Trying 151.101.65.69...
* TCP_NODELAY set
* Connected to security.stackexchange.com (151.101.65.69) port 80 (#0)
> GET / HTTP/1.1
> Host: security.stackexchange.com
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< cache-control: no-cache, no-store, must-revalidate
< location: https://security.stackexchange.com/
< server: Microsoft-IIS/10.0
< x-flags: AA
< x-aspnet-duration-ms: 0
< x-request-guid: d6473d9f-2d5d-4543-ae86-0dc6bfa61ca1
< x-is-crawler: 1
< x-providence-cookie: 6d0a8faf-a592-61cf-99da-cf1c434e5d5e
< Transfer-Encoding: chunked
< Accept-Ranges: bytes
< Date: Thu, 16 Jul 2020 13:59:30 GMT
< Via: 1.1 varnish
< Connection: keep-alive
< X-Served-By: cache-ewr18134-EWR
< X-Cache: MISS
< X-Cache-Hits: 0
< X-Timer: S1594907971.551606,VS0,VE4
< Vary: Fastly-SSL
< X-DNS-Prefetch-Control: off
< Set-Cookie: prov=6d0a8faf-a592-61cf-99da-cf1c434e5d5e;  domain=.stackexchange.com; ex

Port forwarding would be something entirely different, and would probably not even work.  This would be where the browser makes a request to an http URL on port 80, then a router on the network forwards the request to the web server on port 443.  So, the browser thinks it's making an http request (on port 80), but the server sees an incoming connection on port 443, so it thinks it's an https request.  I don't have a way to test this, but I would think the browser would never send a `client hello' (because it thinks it's making an http request, not an https request) so the server would eventually time-out the connection.


How can you change the plaintext of the given secret message which is in AES-256 CBC Say you have the secret message encrypted with AES-256 in CBC mode

5a04ec902686fb05a6b7a338b6e07760 14c4e6965fc2ed2cd358754494aceffa

where the first 16 Byte is the initial vector, the second 16 Byte is the ciphertext. The plaintext of the secret message above is (ASCII encoded) We're blown. Run

Now my question, how can you change the secret message such that you get the plaintext Meeting tonight! if you decrypt it?

I have tried to find some examples on the internet but I couldn't find any : /

However I could find a model that describes how CBC decryption works:

Our plaintext We're blown. Run is made up of 16 chracters which means we just have one plaintext block. From the model, we also see that the ciphertext is decrypted and XOR'd such that it creates the ciphertext. As it looks like, there are changes required in the initial vector so we get the desired message Meeting tonight!. But how is this done exactly?

You know the IV and the plaintext, as well as the raw cipher output (before the IV is applied). That is all that matters. You can ignore everything else. The only thing you can control is the ciphertext and the IV. So, how do you change the IV to predictably change the plaintext?

Hint: If you have A ⊕ B = C, and you know B and C (and thus can calculate A), what do you do to A, which you have full control over, to predictably change C? Here A is the plaintext before the IV gets applied, B is the IV, and C is the plaintext that you want to change. Note that, if you were doing this to any other block, the IV would instead be replaced with the previous block's ciphertext.


Generating QR-Code for 2fa from google maps api risky? I am currently using 2-factor authentication to tighten security for my login system. I use Google Authenticator to scan a QR Code, which generates a key which I can use to login.

What worries me with my implementation is the way I create my QR Code in PHP using this API:

'https://chart.googleapis.com/chart?chs='.$width.'x'.$height.'&chld='.$level.'|0&cht=qr&chl='.$url_containing_secret.''

Using the maps API seems a bit unsafe since I'm basically sharing my secret through HTTP. Isn't this actually risky? I'm seriously considering creating the QR code using some library instead of an external API.

Am I too paranoid?

I would not be that paranoid but yes, why should somebody know you have generated some access tokens for whatever purposes...

Why you can't use your own generator? It is not something secret. There are tons of implementations on the internet for various languages...

Here is javascript implemenation:

Example:
https://stefansundin.github.io/2fa-qr/

Sources:
https://github.com/stefansundin/2fa-qr/blob/gh-pages/index.html

Here is one in PHP:
https://github.com/chuyskywalker/google-authenticator-qrcode


Pros and cons of password policy filtering common weak passwords? We all know the basics "password rules" when a user register on a website, such as:

more than 8 characters,
must contain an upper case letter,
must contain numbers and so on

Why don't websites filter (as in not accept) well-known weak passwords such as:

123456
qwerty
password

What are the pros and cons of such a method and why is it not widely used?

It's not used widely because if you block 123456, users will use 1234567, you block qwerty they'll use qwertyu. Honestly, "The blacklist approach will be bypassed". And this makes the outcome minimal, to the extent that its not worth implementing.

The approach could be beneficial but when coupled with other types of policies like min-length, uppercase, digits, etc. And you see this type of policy in action when systems prevent you from using your last 'x' passwords or alert you that your password can't contain your username. (And a lot of weak passwords are blocked via length/complexity rules)


Why do syn scans not work over proxy set up through SSH's dynamic port forwarding? I have set up dynamic port forwarding using SSH. Although nmap scans over proxychains return accurate results, a SYN scan does not.

SSH port forwarding and also proxychains forward the payload of TCP connections and not the original raw IP packets. A SYN scan does not create a TCP connection and does not have any application payload so it will not not work with port forwarding or other TCP proxies.


Telnet local privilege escalation exploits possible even when telnet is running under a normal user account? http://www.exploit-db.com/exploits/8055/ says:

  The telnet protocol allows to pass environment variables inside the
  telnet traffic and assign them to the other side of the tcp connection.
  The telnet daemon of FreeBSD 7.0-RELEASE does not check for LD_* (like LD_PRELOAD)
  environment variables prior to executing /bin/login.
  So passing an environment variable with the identifier LD_PRELOAD and
  the value of a precompiled library that is on the filesystem of the
  victims box that includes malicious code is possible.
  When /bin/login is executed with the user id and group id 0 ('root') it preloads
  the library that was set by remote connection through a telnet environment
  definition and executes it.
  It is unlikely that this bug can be exploited remotely but is not impossible.
  An attacker could f.e. upload a malicious library using ftp (including anonymous
   ftp users), nfs, smb or any other (file) transfer protocol.
  One scenario to exploit the bug remotely would be a ftp server running beside
  the telnet daemon serving also anoynmous users with write access. Then the
  attacker would upload the malicious library and defines the LD_PRELOAD
  variable to something similar to /var/ftp/mallib.so to gain remote root access.

So, if I create a new telnet and inetd under a non-super user, is this exploit not working? It seems so as /bin/login must be executed with the user id of root, but I am not sure if /bin/login is always executed as the user id of root...

No. I think the described vulnerability existed because the target telnet daemon ran with root privileges and allowed the client to define LD_PRELOAD= value that would be used when running /bin/login as root.

Setting LD_PRELOAD environment variable for a root process allowed the attacker to point to a specific library (arbitrary code) that would be executed as the root user.

The host operating system knows that LD_PRELOAD must be ignored if a setuid() binary is called .


Is it possible to get Network Domain from Client with PHP or Apache? I'm working on a solution to identify client Network Domain or Workgroup in a private network. Based on it, I must change some access permissions.

I can't do that through IP address because it isn't trustable, only network domain/ workgroup.

For reasons unknown to me I can't have a login screen, access must be automatic and seamless.

Someone know how can I do it?

Sorry to post it here, follow it on the correct place: https://stackoverflow.com/q/31349047/3706998

Not really. You can directly retrieve some agent information and the local IP/hostname but not their workgroup/domain status.

That being said - you could get the hostname and query Active Directory via WMI to see if it is a domain computer, but you can never prove the validity of the hostname.

Another option is that you can authenticate a user against Active Directory/LDAP. You could have a login page that when they authenticate against Active Directory (proving they are a domain user) you let them login.

Also have a look at Authenticating in PHP using LDAP through Active Directory.


Question about hping3, TCP and ngrok I have set up a experimental setup which consists of:

Windows PC with ethernet cable;
Arduino shield (connected to Windows machine with USB) with LTE
connectivity sending data using TCP/IP to ngrok;
VirtualBox with Kali Linux running on same Windows machine mentioned
above;

On Kali Linux there is working Python script for receiving local TCP packets and ngrok TCP tunnel forwarding packets sent from Arduino to my local TCP server. Everything works fine and I'm getting correct data on Python console.

After this I wanted to test my system with DoS attack. On same Kali VirtualBox machine I used tool called hping3. If I type "hping3 -S --flood --rand-source Arduino_shield_IP" connection is dropped and python console doesnt recieve any data until I stop TCP flood. But when I run same python script and ngrok on another laptop, connection isnt dropped when TCP flooding. Why is that? I got devices IP adress using AT commands.

I have to mention that this is a university project and we have a permission to test LTE like this.

From my understanding you saturate the communication path between the VM and the shield when doing the DoS from inside the VM. Since that's the same path you use for your TCP connection it will heavily impact the delivery of data inside TCP connection, i.e. your Python console hangs.

If you do instead the DoS from outside the VM the communication path between the shield and the VM is not affected by the DoS. Additionally I expect that less bandwidth will be used by the DoS since the connection from the different notebook (via LTE?) provides less usable bandwidth than the local connection between VM and shield. This will also take load from the shield.


Can't decrypt captured HTTP connection from WPA Network Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption".

Currently I can only view the following traffic protocols: ICMPv6, ARP, MDNS, IGMPv3, BROWSER, NBNS, DHCP.

I know there are HTTP and HTTPS packets being sent to my router but Wireshark is not showing me these packets.

I am sniffing my wlan0 and I believe I have started my airmon correctly.

Does anyone know why I am unable to sniff HTTP or HTTPS traffic?

With WPA Networks each connection is encrypted with a unique key. The PSK is only there for authentication and encryption of the initial process of key generation for the connection. Because of this you can't decrypt traffic by only knowing the PSK; you also need to capture the 4-Way-Handshake of everyone connected in order to decrypt their traffic.

What you are currently able to decrypt is broadcasted traffic only. This traffic can't be encrypted with the connection specific keys therewith everybody connected to the AP needs to be able to decrypt them. This is why you are able to read these packets content.

Also it's not that easy to usefully sniff encrypted wireless traffic. When you are connected to a WLAN and a packets checksum is bad, your operation system will ask the AP to resend the packet until you receive it in an ideal state. You can't do this when you are passively sniffing the traffic. So it very often happens that you miss some part of or a whole conversation due to incorrectly received packets. You need a good antenna and good signal quality.

// I suggest you to use airdecap-ng to decrypt wireless traffic instead of wireshark.


Do we have to take algorithm substitution attacks seriously? Bruce Schneier's blog drew my attention to algorithm substitution attacks which may leak symmetric keys through IV or padding or other covert channels, encrypted with escrow keys. The major premise is that cryptolibraries (or HSMs, or encryption chips) have been subverted by a "benevolent government agency".

Does this threat warrant extra review of software used in production, including libraries such as OpenSSL/BouncyCastle etc.?

Can we ensure that there are no covert channels in IV or padding by looking at the code?

Cryptology ePrint Archive: Report 2014/438. Security of Symmetric Encryption against Mass Surveillance. Mihir Bellare, Kenneth Paterson and Phillip Rogaway. June 21, 2014.

Yes, we need to take these issues seriously. In fairness, cryptographers have long been aware of such issues, and many protocols and ciphers are designed to at least reduce the scope for covert channels.

In different contexts the substituted algorithm will be more or less apparent:

In the source code the data leakage would be fairly obvious. Usually a field that should be totally random would be leaking key data. I've not done a review of any library myself, but I think it unlikely such code would sit in the official repository.
In compiled code the data leakage is still fairly obvious, but it takes an auditor with more tools and skills to find it. I doubt such code would be in the official version of a binary library (such as Microsoft's SSL) as there's too much chance of getting caught. But it is a way to back-door particular installations, and I expect this happens.
In a black box settings (such as a smart card or TPM) it is virtually impossible to spot the data leakage.

I do think the paper has a good idea: remove all randomness from crypto protocols, and make everything deterministic and stateful. How important is this? Well, considering most desktop operating systems are at massive risk from malware, it's not the number 1 priority.


OAuth 2 state token and protect CSRF We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider.

I am trying to understand how to use the state token passed in with the redirect URL during an OAuth "authorization flow".

How would the state token prevent the attack in the following scenario:

Assumption: The back-end OAuth client(which will service the REST API requests) has a session map of user <-> state token.

Scenario:

Malicious user tries to authenticate with our service.
Our service generates the authentication URL to OAuth provider with the state token. The state token is attached to the malicious user on our server.
The malicious user authenticates himself on the authentication URL and traps the redirect URL request before hitting our server.
Now assume that he manages to force a valid user of our service to navigate to the trapped redirect URL.
The OAuth client(our server) on receiving the redirect URL would validate the state token, this is because:

the OAuth code in URL would successfully exchanged by the OAuth provider with an ID token which matches the identity of the malicious user.
the OAuth client(our server) would compare the state token in the URL with the state token associated with identity carried by the ID token.

Now a valid user would end up operating on the malicious user's account and potentially reveal sensitive information to the malicious user.

How do we protect against such attacks? Or are we missing something in the way we are implementing state token validation.

How do we protect against such attacks?

This is exactly the attack scenario, the state parameter is used to protect against.

  Or are we missing something in the way we are implementing state token validation.

Yes, the key is in the details. From RFC6749:

The client MUST implement CSRF protection for its redirection URI.
This is typically accomplished by requiring any request sent to the
redirection URI endpoint to include **a value that binds the request to
the user-agent's authenticated state** (e.g., a hash of the session
cookie used to authenticate the user-agent).  The client SHOULD
**utilize the "state" request parameter to deliver this value** to the
authorization server when making an authorization request.

Once authorization has been obtained from the end-user, the
authorization server redirects the end-user's user-agent back to the
client with the required binding value contained in the "state"
parameter.  **The binding value enables the client to verify the
validity of the request by matching the binding value to the
user-agent's authenticated state**.  The binding value used for CSRF
protection MUST contain a non-guessable value (as described in
Section 10.10), and the user-agent's authenticated state (e.g.,
session cookie, HTML5 local storage) MUST be kept in a location
accessible only to the client and the user-agent (i.e., protected by
same-origin policy).

So the key is that the state value needs to be bound to the initiator user's session somehow. The RFC gives you a suggestion on how to do this.

  The OAuth client(our server) on receiving the redirect URL would validate the state token, this is because [...]

This is where the state parameter comes in. You do not exchange the access code before validating the state parameter.

You validate the state by making sure it is a value that belongs to the user who initiated this flow. In the situation you described above, this should fail as the state belongs to the attacker and the current requestor is the victim.