Implications of Intel's SGX extension for malware detection and white hat reverse engineering Intel's new SGX extension is concerning.  It allows the programmer to create enclaves in their program where the data is encrypted until it is used.  This is apparently supposed to be used for cloud servers; it is uncertain whether the extension will make it to the desktop.

The concerning part is that the instruction set allows for encryption not only of data but of code as well.  This would effectively defeat any attempts at reverse engineering a program.  Think of the implications of this.  Malware detection techniques will no longer work.  People who want to reverse engineer code for research or cross-compatibility purposes will no longer be able to.  The crackers and the people who want to stifle the free flow of information will have won.  Is this really the future we have to look forward to?

EDIT: To narrow the question down, if code uses SGX instructions, how could it be analyzed?

It is very unlikely that malware authors will be able to SGX. In fact it is very unlikely that most people will be able to use SGX. This is because Intel has implemented strong cryptographic DRM on SGX.

In order to be able to launch an SGX program, it either needs to be signed directly by Intel, or by another local SGX program that is signed by Intel. Intel has not been forthcoming with details about SGX, but it is clear that only “licensed” developers will be able to use it. “To be fully utilized, Intel SGX [requires] additional software capabilities, which will begin to be delivered by the ecosystem later this year.”† “The SGX software stack [...] is being made available on a licensed basis.”‡ “The SDK is not publicly available.”* You can find more information about how the DRM is implemented at https://jbeekman.nl/blog/2015/10/intel-has-full-control-over-sgx/

To answer your narrower question: SGX programs are not encrypted before launch, so it is possible to analyze the code as you would any other binary. However, it is possible for that program to be a small bootstrap program (stage 1) that talks to an external server over the Internet. The external server could send the important code (stage 2) to the stage 1 program after it has verified that the stage 1 program is launched securely. In this case, you won't be able to analyze the stage 2 program.

Also note that--since SGX programs can't make syscalls--in order for Malware to do anything to your system, there needs to be a insecure wrapper program to actually talk to the system. You will be able to analyze this wrapper program using standard techniques.

† http://download.intel.com/newsroom/kits/core/6thgen/pdfs/6th_Gen_Intel_Core-Intel_Xeon_Factsheet.pdf
‡ https://software.intel.com/en-us/forums/intel-isa-extensions/topic/583931
* https://software.intel.com/en-us/forums/intel-trusted-execution-technology-intel-txt/topic/600736


Understanding POST based XSS I have been trying to learn about XSS, more specifically, POST based XSS.
But I am unsure if I actually understand how POST based XSS works.

With a GET, you can do XSS with the URL parameters, but to exploit a POST based XSS, you need to use an HTML form(it can be disguised as link tag or whatever, but, ultimately, it is an HTML form), either on your own website, or on some other website that allows HTML forms to be created, then, inside of the HTML form inputs, you hard-code the exploitable parameters.

You can auto submit the form when someone lands on your website, or the user himself can click some button, maybe there are million different ways.

All in all, is the HTML form part, the main(only?) way to do it?

Thank you!

UPDATE: There is the javascript fetch method that can do POST requests too

UPDATE 2: If I get a user on my website that auto submits an HTML form, why would I need to do the XSS in the first place? I can already execute JS on my own website

That's correct: if you want to exploit a POST-based XSS, you need the user to do a POST request with malicious to the exploited page.

This is most often done by adding a auto-submitting form in a HTML page hosted by the attacker. There are other techniques, like clickjacking, but hosting a HTML page is the easiest way to go.

Using the Fetch API isn't useful, since you would need to be able to run JS on the target site from the victim browser... so you wouldn't need to exploit a XSS at first place.


Under which conditions wouldn't a script tag run I'm trying to understand how XSS works, and I bumped into Google's XSS games (https://xss-game.appspot.com/).

Level 1 is easily solvable with the most common XSS (<script>alert(0)</script>). However, if you try this on level 2 it doesn't work. It is solvable loading an img with the alert code inside an onerror: attribute. However, I'm trying to understand how does it filter the script tags, and after putting them, I see them in the servers response EXACTLY how I entered them (but with no alert message). As I understand it, if the browser sees an <script>alert(0)</script>, it always executes it. All the solutions for XSS that I know of involve filtering the content before displaying it.

So my questions are, how is Google preventing the XSS to work, and under which conditions would a browser see HTML code with <script>alert(0)</script> and not execute it?

Edit: the first question was a duplicate, and the answer is by putting the content inside an innerHTML. However, the second question remains, is there any other way to implement this?

You can find the answer if you peak at the source code.

The


difference between need to know, least privilege and confidential I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing?

In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and also in the index it has in parenthesis (need to know).

I found this site which claims need to know is an extension to least privilege http://simplicable.com/new/principle-of-least-privilege

And I found this practice question

  What is the difference between least privilege and need-to-know?

and the answer given is

  A user should have a need-to-know to access particular resources;
  least privilege should be implemented to ensure she only accesses the
  resources she has a need-to-know.

though I don't follow the reasoning.

Depending on how you look at it, they are shades of the same thing. The confusion comes in when the same terms are used for other things, too.

The principle of "least privilege" states that one should only have access to what they need and nothing more. Extend this idea to "confidentiality of data" and you end up with "need to know".

To put it another way, to keep data confidential, you need to make sure that only those who need access to that data have access, and no one else. Again, it's a form of "need to know" and "least privilege".

I would not say that the 3 ideas are the same idea, but to achieve "confidentiality", you end up needing to employ "least privilege", and by extension, "need to know".

BTW, the quote you have is dealing with the application of "least privilege" as its own idea apart from "need to know", which is valid. Least privilege can be applied to access and capability as well as to the confidentiality of data.


Private and public key need to have same algorithm? The private and the public key from the cert must have the same algorithm, correct?

Yes of course pub / priv are a key pair.
So this code would be legal, to be more flexible (e.g. ECDSA or DSA):

PrivateKey privkey = (PrivateKey) keystore.getKey(keyAlias, passphrase);
Certificate cert = keystore.getCertificate(keyAlias);
KeyFactory keyFactory = KeyFactory.getInstance(privkey.getAlgorithm()); //before: "RSA"
publicKey = keyFactory.generatePublic(keySpec1);`

Normally the private and public key will be generated as a keypair in which they use the algorithm to generate that keypair. so obviously the keys will be mathematically related each other, otherwise it wont.


How can I prevent people from duplicating my barcodes I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates.

I would like to offer a discount card that has a unique barcode for each customer. It is important that customers cannot rescan or duplicate the barcodes because each barcode is a voucher for 5, 10, 20 taxi rides.

How can I prevent people from duplicating my barcodes and reusing already purchased services?

You can't stop duplication of barcodes. What you're describing is a replay attack. The solution to this particular case is to keep a database of issued barcodes and their values. When a barcode is redeemed, the database must invalidate that code.

It works best if this system is online in which codes are atomically applied and cancelled. It is also possible to limit the window during which codes can be re-used in a batch processing based system if the terminals cannot be online, though any use of a code between when it is first redeemed and when that redemption is copied to other systems is a risk.


Why is 0.0.0 an associate of 0.0.0.0? When i redirected a single webpage to an address http://0.0.0, i also found that 0.0.0 is an alias of the network address, but since it is only 3 bytes, this seems to be strange.
Why would chrome and system ping "accept" to use a 3-byte address which then redirect to my network address in-the-browser and get "It works!" because apache took over the my NA also. firefox 8.0 can't handle the same request chrome can and will show up a 400 Bad Request Error status.

I can: ping 0.0.0
I can redirect to 0.0.0.0 using php function header() in chrome with the code 'Location: http://0.0.0'

This is a relic of the original Internet addressing scheme, now retronymed 'classful' and obsolete almost 3 decades. See e.g. https://stackoverflow.com/questions/29285954/wsastringtoaddress-thinks-1-2-3-is-a-valid-ip-address or more officially http://pubs.opengroup.org/onlinepubs/009695399/functions/inet_addr.html . Note that 0.0.0.0 itself, in whatever representation, cannot actually be a host address, but since it is the reserved special value INADDR_ANY some software replaces it with another address like 127.0.0.1 which is routable, or close enough. OTOH you can't get a valid certificate for HTTPS/SSL/TLS for either 0.0.0.0 or 127.0.0.1 from any 'real' CA (more specifically, any CA subject to CABforum rules or trusted by any major browser).

Although this is primarily a programming-for-networking issue, there is a slight security impact in that nowadays 99.99% of systems on the Internet are operated by individuals (cf. Dilbert) with sub-fractional clues how the Internet actually works, so that phishers, scammers, etc. sometimes use these obsolete address formats (especially the single number) in URLs and email addresses to confuse, mislead, and deceive such people.


How does Windows schedule a thread when the thread has no process? I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task Manager or Process Explorer, which display processes.

I know that the total priority of a thread is calculated from two parts:

the process priority, e.g. defined via CreateProcess() (MSDN), parameter dwCreationFlags which takes a Priority
the thread priority, e.g. set via SetThreadPriority() (MSDN)

Now, if the process object containing the priority information was destroyed by the rootkit, wouldn't the Windows kernel fail when trying to calculate the total priority of that hidden rootkit thread?

AFAIK, all threads of a process share same code and data segments. At any moment, a program can ask for its ThreadId and ProcessId. And a process only actually ends when all of its threads do.

But a malware can hide its activity behind a rundll32 process. This is just a system process that is used for example when services are implemented only through a DLL and not through an executable. As you find such processes commonly in task manager list, it is hard to guess where a malicious activity is hidden behind.


OpenSSL encrypting small packets bandwidth overhead I have an c/c++ program used for encrypting data for communicating between two ends. Encryption is done using OpenSSL (0.9.8d-fips, Sep 2006). Think it'll be worthy to mention that I'm not much familiar with using OpenSSL.

The program works fine for larger packets. But the size overhead is very high when encrypting smaller size packets. I've done a test to demonstrate the issue.

+-------------+-----------------+-------------------+
| Input Chars | Encrypted Chars | Input/Encrypted % |
+-------------+-----------------+-------------------+
|           1 |              74 | 1.351351351       |
|           2 |              74 | 2.702702703       |
|           3 |              74 | 4.054054054       |
|           4 |              74 | 5.405405405       |
|           5 |              74 | 6.756756757       |
|           6 |              74 | 8.108108108       |
|           7 |              74 | 9.459459459       |
|           8 |              74 | 10.81081081       |
|           9 |              74 | 12.16216216       |
|          10 |              74 | 13.51351351       |
|          11 |              74 | 14.86486486       |
|          12 |              90 | 13.33333333       |
|          13 |              90 | 14.44444444       |
|          14 |              90 | 15.55555556       |
|          15 |              90 | 16.66666667       |
+-------------+-----------------+-------------------+

The test was done while incrementing the number of input characters from 1 to 10000 . Following graphs illustrate the results more clearly.

Graph 1: Encrypted size vs Input Size

Graph 2: Ratio vs Input size

From the second graph, it's clearly visible that the encryption overhead is very high for smaller inputs (size less than 300bytes).

Is this normal/acceptable? If it is so are there any alternatives (with less overhead). Because the application uses smaller packets heavily (Bundling them together is not an option).

As mentioned above, OpenSSL 0.9.8d is used, which is a bit older version (1.0.1g, April 2014, is available now). Will the problem be fixed if I upgrade it?

- Hello, this is TastyChef hotline, how may I help you ?

- Hello. I am cooking. I need to know how long I should put my food in the oven.

- It depends on what you are cooking, Sir.

- Oh, it is a Miele-Samsung 1200+ oven. Serial number is X67NQ-56D3034.

- Not the oven, Sir.

- Do you think replacing the oven with a 1500+ would change the cooking time ?

- ...

What matters is the protocol you are using, which boils down to the involved algorithms and encoding formats. You have to understand what you are trying to do. Right now, you appear to "use OpenSSL" as a kind of cryptographic seasoning, in the wild hope that sprinkling encryption about will make security somehow happen. It does not happen that way.

They say that software engineering begins with architecture, then analysis, then specification, then (and only then) implementation. If you skip the first three steps, then the fourth will lead to doom.


Outlook email and my ip address If I send someone an email using Outlook online, can the recipient know my IP?
I knew before that it was possible but I was wondering if the email providers like Outlook, Gmail had added some sort of security for that?

An e-mail is nothing but text conforming to the SMTP (Simple Mail Transfer Protocol). When accessed through a web client, it appears formatted, but the its source (underlying raw text) can be displayed (in Outlook Web you can click on the three dots on the right side of an e-mail message and then on View message source).

One of the headers present in the source is the Received header, which says where the e-mail was received from. In theory, this could be your personal IP (or domain, if applicable). However, close inspection of the message source will reveal that with most e-mail sending services (Outlook Web itself for example), the Received headers only mention Microsoft server IPs.

If you were to send it yourself however (e.g. by opening a Telnet session to an Outlook SMTP server and sending an e-mail), your IP would indeed be visible by viewing the message source.


PHP BLENC extension security concern PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the header file), I discover that they are still using MD5 as their password hashing function. Will is cause any vulnerabilities? It is worth to rewrite it by using a modern hashing function such as SHA256? Furthermore, is BLENC safe to use? In other word, can it keep reverse engineering far of my code?

After for little research, I can say this extension is not safe because I can simply extract the main key in clear text format by using any type of HEX editor. Hash function is NOT important any more.

Linux:

Offset: 0x00003158
Using xxd

Windows: Unable to compile but believe the develop team using default password 0123456789abcdef0123456789abcdef

Offset: 0x0000355C
Using Hex Workshop


Reporting SQL injection vulnerability to company that does not care I have just finished building a CMS targeted at a certain industry and built a test site to see how everything works. I wrote a program to check for SQL injection vulnerabilities and the program followed a blog link to an external website.

The program discovered that the external site had a massive vulnerability that left it open to practically anyone who could then access every bit of data on their MySQL Server and run queries etc. The thing is this external site is the brand leader in their industry and do millions upon millions of sales per annum. I have tried contacting them to let them know and even went as far as contacting the company that built their platform but I was pretty much brushed off and haven't heard back from them. Their database would contain the details of hundreds of thousands of customers and all their data. I could easily make myself site admin etc in a few seconds but they won't listen to me even though I have offered to share the vulnerability with them and help in anyway I can.

Is there anything else I can do because it is one of the biggest security risks I have ever personally come across. Is there any other steps I should take to report this?

Check out how Secunia deal with it. Might help you along:

http://secunia.com/community/research/policy/

If no security contact is known for the vendor, an e-mail requesting the security contact e-mail address may initially be sent to certain public e-mail addresses associated with the vendor. It is Secunia policy to never submit vulnerability information via online forms. However, these may be used to request security contact information.

When a security contact or other relevant e-mail address has been identified, a vendor initially receives a mail with vulnerability details along with a preset disclosure date (usually set to a Wednesday two weeks later).

If the vendor does not respond to the initial mail within a week, it is resent.

If no response has been received at the day of the preset disclosure date, the vulnerability information is published immediately without further coordination attempts.

If the vendor responds to either the initial mail or the resent mail, a new disclosure date may be set in case the vendor cannot meet the preset date.

Secunia expects vendors to provide continuous status updates on the progress. If none are provided by default, the vendor will be contacted about once a month with a status update request.

Should a vendor not respond to a status update request, it is resent a week later.

Should the vendor not respond to two consecutive status update requests, a mail is sent to the vendor advising that the vulnerability information will be disclosed a week later if no response is received. Has no response been received by this date, the vulnerability information is immediately published without further coordination attempts.

Eventually, the vulnerability information will be published by Secunia Research when:

a) The preset/agreed disclosure date is reached.

b) The vendor issues a fix and/or security advisory.

c) Information about the same vulnerability is published by a third party.

d) Either a half or full year has passed from the initial contact date (see #10 and #11 for more information).

By default, vulnerabilities are coordinated for no more than 6 months. About one month prior to the ½ year mark, the vendor is informed about a fixed disclosure date set by Secunia Research at the ½ year mark. At that time, a Secunia advisory is published regardless of patch availability.

A vulnerability may in certain cases be coordinated for up to one full year if the vendor is communicating a clear intention to address the vulnerability and can commit to a date within that period and the vulnerability is considered to be complex to address.


Are OpenPGP Robot key signers useful? I've been thinking about building a web-based keysigning robot. Mostly I want to do this to dip my toes back into working with PGP after quite a few years of ignoring it. The robot I have in mind would simply do email verification.

Is this kind of thing useful for building a stronger PGP Web of Trust?

The theory of the Web of Trust is that participants act as local certification authorities, verifying the correspondence between public keys and identities. Guarantees can be obtained from chains of signatures on keys based on the following heuristic: presumably, an attacker could corrupt or deceive some users, but not all. So if you can build many chains of signatures, from a key you trust a priori (your own key) down to the key you want to validate, and all these chains go through distinct intermediate keys, then all the involved presumed manual verification somehow add up: if you have 12 such chains, then, the attacker (who tries to impersonate a user) would have had to bribe or fool at least 12 distinct people to achieve such a picture.

Whether this heuristic validation is sufficient is open to debate (personally I don't find it anywhere near decent, as far as security is concerned). However, the core principle is that any act of key signature contributes to the overall security only insofar as the corresponding identity verification is robust against corruption.

In the case of your robot, the robot would merely verify control of an email address. Unfortunately, emails are not a secure system; in fact, PGP has been invented precisely because emails are not secure. When you use PGP, you assume that possible attackers can read and fake emails at will; that's the very reason why you use PGP. In that context, basing the safety of the key-to-id signatures on emails seems unwise. Or, said otherwise: the contribution of the signatures produced by your robot to the overall "validation guarantee" ought to be considered to be very low. It does not hurt per se, but it won't help a lot.

(Or, rather, it may hurt if people begin to trust such signatures for more than what the actually provide.)


Protecting Session Authentication Tokens I am creating a session authentication token and sending it to the client application. Any user data etc is associated to this token on the database, so the token does not contain any sensitive information.

Is it enough to just create a random token? One kind of attack that occurred to me is just brute-forcing tokens. How can I prevent that? Encrypting the token seems to be just as susceptible to such an attack. Maybe HMAC?

No need for any encryption or HMAC or anything else fancy like that. Some things you need to think about, though:

The protection against brute forcing is entropy. Pick a random number from a large enough space and an attacker would need millenia to guess one right. OWASP recommends at least 128 bits.
Make sure to use a cryptographically secure PRNG go generate the session IDs, so that there is no pattern in the generated session IDs. If you use a bad PRNG an attacker can guess upcoming IDs based on previous IDs.
Since it is not directly related to the generation of tokens I will not go into any length about it, but make sure to think about things such as session fixation, the HTTP-only and secure flags, etc. OWASP has a good cheat sheet.


Relationship of password strength and key strength I have just started educating myself about cryptography, and while it is mostly making sense, a few things are still eluding me. One being:

In systems that take a user's pass-word/-phrase in order to derive the encryption key, what is the relationship between that password's strength and the key's strength? I know password strength matters in authentication; is it a moot point in encryption?

From my understanding, human-created passwords tend to have very low entropy, and that's why keys are derived from them. Assuming then that both the key and algorithm are (relatively) secure, the encryption is (relatively) secure.

But while that 128-bit (or whatever) key may be all fine and dandy, what's to prevent an attacker from running lists of weak passwords through the key derivation function and then attempting to use the produced key to decrypt the message?

My hunch is it has something to do with the computational cost.... but I AM curious if it's just as secure to use the letter "a" as the password as it is to use a super strong password -- i.e. if the derived key will be just as strong regardless of input, does the password's composition matter at all?

Overview

Some examples for review/discussion.
Alternative: local password generated key for internal use in encryption-key access control API.
Entropy and increasing it.

1. Some examples for review/discussion

  In systems that take a user's pass-word/-phrase in order to derive the encryption key, what is the relationship between that password's strength and the key's strength?

This depends entirely on how you use the password to derive the key. If you're just hashing, or even hashing and salting your password, your function might look like this:

generateKey(password, salt) := cryptoHash(password, salt)

If I took a table of the weakest passwords I could probably calculate the potential hashes, and from there I would have the possible encryption keys. Then given a message I could crack it with this function:

crack(message, saltLen, weakPassList):=
    for salt in 0..saltLen:
        for weak in weakPassList:
            let k := generateKey(weak, salt)
            if decrypt(message, k) looks okay:
                return k

This might take a really long time to run based on how big saltLen and weakPassList are; however you could cache the k generated above in a table and just try them out one at a time, to eliminate the factor of experimental key generation.

There are definitely better ways to generate a password, but without a more detailed specification or use case it's difficult to analyze or recommend which method is best.

2. Alternative: local password generated key for internal use in encryption-key access control API.

  I know password strength matters in authentication; is it a moot point in encryption?

I feel like there's no difference unless you are talking about a particular method of key generation or some other specific use case. A key is a key.

Personally I'd go with using the password to generate a local encryption key kLocal, used to obscure a properly generated cryptographic key kMessage that can be used to encrypt messages for sending over non-secure channels.

This way the password is just an access control mechanism to filter users who can type commands into the system, and prevent them from using each other's encryption keys (if they can't get the right kLocal they can't discover the contents of kMessage). This is apt because you can use a secure API with, for example, a leaky bucket, to prevent people from doing password guessing attacks on the local machine.

It's not as straightforward to prevent password-guessing attacks against a ciphertext message that's already been sent out in the open! By making the password-generated kLocal for internal, API-restricted usage only, you bound the attacker's effective computation power, which is a really good thing in software security.

3. Entropy and increasing it.

  From my understanding, human-created passwords tend to have very low entropy, and that's why keys are derived from them.

Be careful! Entropy is just the measure of how unpredictable something is. If I take some values with X amount of entropy, and run them each through some adversary-known function, the results can have no more than X entropy. That is, if the adversary could guess the original values and also knows the function for manipulating/extending them, he'll have just as easy of a time guessing the manipulated/extended values as he would the originals.

You're not increasing the size of the domain unless you add more information; and you're not increasing the entropy unless the information you add has some entropy itself (is somehow unpredictable/secret).


Defense against attacks using dictionaries Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?

Attackers often don't just use dictionaries, but also rules which permute the words in dictionaries.

For instance, a rule could be to substitute certain letters for numbers, which look the same. This would turn Password into P455w0rd.

A rule, which could apply in this case, would be to remove single letters from a word. That means just permutating the password by removing one letter or deliberately misspelling it will give you better chances, but it's not guaranteed.

To specifically answer your question: Yes, it is safer to use non-sense words than to use words in a dictionary.

However, it's not as safe as you can get. An offline password manager can generate truly random passwords for you, and will store them in an encrypted manner. This means that you never have to type in your password, except the master password to unlock the password manager.

To demonstrate this, ask yourself which password you consider safer: YunSuanLin0 or [D@,7##M]enMd*)j5fxG~KQ~?r\<DdV^?


Are CVEs and EDBs normally hard to reproduce? For a while I've played around with reproducing vulnerabilities reported in websites such as Exploit-DB (EDB) as a learning experience. However, I often find cases which I just can't get to work. In these situations, I'm not sure whether I simply don't have enough experience and I'm lacking some technical expertise, or whether the reporter missed information, or whatever.

Are you aware of any white papers or blogs that talk about the difficulty of reproducing vulnerabilities?
Are you aware of any white papers or blogs that teach how troubleshoot (or what to check at least) when a case is not working?

EDIT: I’m looking to read about other’s experiences and relate them to mine. I wanted to write an essay about this topic for a class. So I’m looking for references of other people who have expressed discomfort in the reproduction of vulnerabilities. If this matters, I mainly work with memory error vulnerabilities.

I think it's difficult to talk about "the difficulty of reproducing CVEs" as a single topic since the complexity of the underlying vulnerability varies wildly from one CVE to the next.

Exploiting some CVEs is trivial, just download the exploit code, fire it at the application and presto! You're in. Other vulnerabilities can be much trickier, requiring a very specific environment setup, or a precisely crafted payload, or both.

The general rule for defensive security is "you can't protect what you don't know" and I think the same applies, maybe to a lesser extent, to reproducing vulnerabilities. Looking back at my own experiences, the most frustrating times came when I was working on a technology stack or a vulnerability I didn't understand.

My biggest piece of advice would be for each CVE you're trying to reproduce, take the time to read the white paper and really understand how the attack works. If it's on a technology you're unfamiliar with, take the time to learn that too.


Does SSLv3 uses SHA256 as hashing algorithm? I understand that SSLv3 has multiple cipher suite combinations and for hashing it may use either SHA or MD5. What version of SHA does it exactly use SHA-0 or SHA-1 or SHA-2 (SHA256, SHA512 etc)..

TLS 1.0 (SSLv3 successor) was published in January 1999 (RFC 2246). SHA-2 was first published in FIPS 180-2 in 2001. Thus, there's no way an implementation following just the SSL3 specifications could have supported SHA-2.

The version used by SSLv3 would have been SHA-1, just like TLS 1.0:

SHA
   The Secure Hash Algorithm is defined in FIPS PUB 180-1. It
   produces a 20-byte output. Note that all references to SHA
   actually use the modified SHA-1 algorithm. [SHA]

rfc2246 page 59


Generation of a shared nonce that cannot be pre computed Is there any system out there currently, which can generate a nonce, which all nodes on a distributed network can agree and calculate the same nonce at the same time, but one an attacker cannot pre compute, for example a week in advance, and would only have the correct nonce at the same time as the network.

If this is not currently possible what steps are needed to create such a system?

[Note: This question has been re-posted on crypto.SE.]

Let's break down the problem into two parts:

The first problem is that you want something that looks random to an outside attacker (ie is unpredictable), but can be computed by anybody in the know.

That sounds a lot like a Cryptographically secure pseudorandom number generator (CPRNG) where all nodes use the same seed. Then each hour (or each minute) you could take the next number in the random sequence - ie current_nonce = cprng.getSequence()[ numberOfHoursSinceLaunch() ];.

The problem that needs to be solved is the Key Distribution Problem - or in this case, the Seed Distribution Problem (since the seed is acting as the shared secret).

You could look at Key Agreement Protocols:

  In cryptography, a key-agreement protocol is a protocol whereby two or more parties can agree on a key in such a way that both influence the outcome. ... Protocols that are useful in practice also do not reveal to any eavesdropping party what key has been agreed upon.

Or you could go lower-tech and have an admin place the seed on each node by some secure method (SSH, USB key, etc). Or you could set up a client-authenticated TLS network where each node has a client cert that they can use to request the seed. There are many ways to skin this particular cat.

EDIT in response to re-post on crypto.se:

The second problem is that you want some system where even if a node has all the seeds material, it can not compute the secret until some fixed time in the future. This is actually a commonly asked question on Security.SE and Crypto.SE. The generic name for this is Time-Capsule Cryptography, on a Time-Lock Puzzle. Here is a famous post on the topic. There are solutions to this, but they all have the flavour of "if you run your processor on full, it will take them at least X days to compute the secret. I don't think that is what you want.

A practical solution to this problem would be to give each node a client-SSL cert. Have a master server that generates the nonces, then have the nodes log in to the master using their certs to retrieve the daily nonce.


Is it possible to use WebAuthn for digitally signing documents in the browser? WebAuthn is a relatively new API for authentication, and it uses public key cryptography instead of something like passwords.

I am wondering if it is possible to use the cryptographic part for a different purpose, specifically creating digital signatures of documents in the browser.

The idea is to find a way to have a user sign a document in the browser in a way that the server can't fake or manipulate. So the web application itself must never know the private key that is used for signing, which is the case for WebAuthn as far as I understand.

So if instead of the random challenge that WebAuthn expects I'd send the contents of a document I want the user to sign, I should get back a cryptographically signed hash of my document, if I understand the explanation on MDN correctly.

In the end I should have a digital signature that could be used to prove that this document was signed by a specific private key from a specific hardware token. And neither the web application inside the browser nor the server component ever saw the private key, and can't fake this signature (of course the application could compromise this by switching out the content before signing, but not later).

I couldn't find anything on someone using WebAuthn for this purpose, and anything I could find related to digital signatures in the browser was about stuff like Java applets that is simply not an option today anymore.

Is my idea sound in general? Or am I misunderstanding how WebAuthn works and it's simply not possible to use it in this way? Are there any weaknesses or flaws in this approach that I'm missing?

Yes, this is possible
A security challenge for the Web Authentication API can by any byte array (of at least 16 bytes), and it will be signed by the clients secure private key. It can therefore also be used to sign documents or messages of all types by passing the document as a PublicKeyCredentialRequestOptions.challenge in the call to navigator.credentials.get().
The PublicKeyCredential returned by the call contains a response property, which contains a signature property which is the signature you are looking for.
The example code from developer.mozilla.com slightly modified to fit your use-case:
fetch(/* get file from server */).then(response => response.arrayBuffer()).then(fileFromServer => {
    const options = {
        challenge: fileFromServer,
        rp: {
            name: "Example CORP",
            id  : "login.example.com"
        },
        user: {
            id: userId,
            name: "jdoe@example.com",
            displayName: "John Doe"
        },
        pubKeyCredParams: [
            {
                type: "public-key",
                alg: -7
            }
        ]
    }

    navigator.credentials.get({  publickey: options })
        .then(function (pubKeyCredential) {
            const signature = pubKeyCredential.response.signature

            fetch(/* Send signature to server */)
    }).catch(function (err) {
      // Deal with any error
    })
})


Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice? I don't know why do we authenticate by prompting the user to enter both username and password.
In my mental model, prompting password only suffices.

The reason is as follows:

Assume there are x valid characters to use.

Case 1 (prompting username and password)

Let the length of username and password be n/2 characters each.
Since the username is exposed to the public, the probability of success to break the password is one over x^(n/2).

The username is unique.

Case 2 (prompting password only)

Let the length of the password be n characters.
The probability of success to break the password is one over x^n.

Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?

The password is unique.

I think the issue is in requiring passwords to be unique. If I entered my desired password, and you told me I can't use it, it's already in use, then I know that I can log in to a random persons account with the password that I would have wanted.

So, you need a username, which is unique, and can be known to everyone. Then you have a personal password, which is not necessarily unique, making even harder to guess.

While you are at it, hash and salt that password.


OpenSSL SSL enabled client application, server verification? I am writing an OpenSSL SSL enabled client application which connects to a Google server.  I have the SSL working and I can monitor the traffic and see that it is definitely encrypted.  I am using OpenSSL API function SSL_CTX_load_verify_locations to load a .pem file containing public root certificates to verify that the server is a trusted server...I think!?

I've done LOADS of searching but I can't find a simple description of what I'm meant to do to make sure I am talking to a Google server.  Is using a .pem file with root CA's the correct thing to do?  How do I know I'm talking to Google and not someone else on the trusted list?

Also, am I meant to distribute the .pem file along with the application, or can it be compiled into my application?

Any help greatly appreciated.

The way you check to see if a certificate is valid is by checking the certificate parameters (expiration, subject, etc.) and verifying that the certificate was signed by a trusted authority.

As far as what authority to trust for Google certificates, Google publishes a Frequently Asked Questions document here. If you follow their guidelines you should be fine.


Is it a possible vulnerability / GDPR violation if basic profile of users are enumerable through the URL? If a website uses an auto-incrementing user-id in its url – /users/1, /users/2 to showcase public user profiles (just the name + photo / avatar)  is it considered a possible vulnerability?

From GDPR PII Definition:

  ‘personal data’ means any information relating to an identified or
  identifiable natural person (‘data subject’); an identifiable natural
  person is one who can be identified, directly or indirectly, in
  particular by reference to an identifier such as a name, an
  identification number, location data, an online identifier or to one
  or more factors specific to the physical, physiological, genetic,
  mental, economic, cultural or social identity of that natural person;

Which means, that you should create some kind of notification, that will notify a user that the data he is submitting to the website are publicly accessible. If not, then you violated GDPR.


How does Network Address Translation (NAT) increase firewall effectiveness Truth or bald-faced lie: the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall. Why or why not?

How does Network Address Translation (NAT) increase firewall effectiveness?

I'm not a network person, this answer could probably suffer a lot of (incl. terminology) improvements! Feel free to edit/comment.

NAT is not a security feature originally, but in practice it does implement a form of port blocking which has proved very useful for OSes that are shipped with many open ports and contained implementation mistakes (hi there Windows Vista SMB exploit). NAT is not a security feature. It's designed to permit reuse of IP addresses in order to increase the scalability of networks.

If your home computer is shipped to you by default with open ports for file sharing on the local network, then it having a unique IP address assigned by your ISP allows any script-kiddy or robot to send packets on those ports.

On the other hand, the home computer connected to a NAT-using home router to contact the Internet cannot receive data from arbitrary machines on the Internet. It can be contacted by other machines on the LAN and by servers when there is a NAT traversal rule set up. This happens:

when you initiate a connection to an Internet server, in which case the router will modify the IP in your packet to its own public IP and the port you used to a randomly allocated port. It'll then transfer the traffic receiving on that port to your machine
when you use NAT traversal protocols (e.g. UPnP) to create such a traversing port on-the-fly so that other Internet clients can contact you. This is used in P2P apps of all kinds. Some routers are configured to let local machines create temporary traversal rules on the fly, others are not
when you manually configure your router to permanently forward incoming packets on a specific port to a local machine; usually because you have a server running which you want to be accessible


Similarities among all/most malicious JavaScript I'm working on a web app that notifies users on whether or not the JavaScript that they entered is malicious. I'm using this article (Examples of malicious javascript) for reference.

Is it possible to create an equation with coefficients -coefficients that include occurrences of uncommon characters- that can give a strong indication that a certain piece of code is malicious/benign?

If not, is there another method that I could use?

You are trying to fulfill something impossible. If it is that easy, web malware would be dead few decades ago.

If you want to use mathematical tools to track malicious JavaScript code, you need first to know which features are employed by  JavaScript malware. Once you understood these features, you may guess that it will be impossible to factor anything meaningful in one or several mathematical equations; so let's throw a glance over the employed and common features of JavaScript attacks:

Server side polymorphism

Literally meaning many shapes, polymorphism is a technique used by malware authors to evade signatures based detectors. Polymorphism is qualified as being server sided when the engine which produces several but different copies of the malware is hosted on a compromised web server (Server-Side Polymorphism:
Crime-Ware as a Service Model (CaaS)). simulated metamorphic encryption generator (SMEG) version 1.0 was the first engine developed to implement the notion of polymorphism for computer viruses on the early 1990's (Parallel analysis of polymorphic viral code using automated deduction system)

Code obfuscation

The other common feature you may find in malicious JavaScript code is that obfuscation is always used.  This common factor -obfuscation- does not make even things simpler: because innocuous JavaScript code also uses obfuscation (for instance, some developers for example do not want their personal pretty JavaScript function to be understood by others as you can easily read HTML and JS pages codes). Along with server side polymorphism, code obfuscation is a widely used technique by malware authors to circumvent antivirus scanners. A myriad of techniques could be used to obfuscate JavaScript codes such as string reversing, Unicode and base 64 encoding, string splitting and document object model (DOM) interaction (Malware with your Mocha? Obfuscation and anti-emulation tricks
in malicious JavaScript.).

Code unfolding

Code unfolding is the mechanism with which a new code is introduced at run time. In JavaScript, this is made concrete by invoking functions like document.write() and eval() in order to execute obfuscated portions of code and functions. (Weaknesses in Defenses Against Web-Borne Malware)

Heap spray

This attack targets mainly web browsers. The user controllable data can corrupt the heap by a remote execution code if the miscreant has compromised the user's computer to the point he can have access to this vulnerable memory area (BuBBle: A Javascript Engine Level Countermeasure against Heap-Spraying Attacks)

Drive-by download

Drive-by download attacks consist in downloading and and executing or installing malicious programs without the user's consent. Such attacks occur by exploiting browsers' vulnerabilities, their add-ons or plugins such as ActiveX controls or unpatched useful software such as Acrobat Reader and Adobe Flash Player (Drive-by download attacjs: effect and detection methods, MSc Information Security)

Multi execution paths

It is possible to trigger an action only if certain conditions are fulfilled. Such circumstances could be the arrival of a given date or the existence of a file on the system on which the malware is intended to be executed. An other quick and well known example could be a denial of service attack that must be fired only if the number of the botnet's nodes has reached a certain value. That
is the notion of multi execution paths (Exploring Multiple Execution Paths for Malware Analysis)

Implicit conditionals

This technique is mainly used against dynamic approach detectors. The main idea for this process is to execute a set of instructions by hiding the condition that fires it (Weaknesses in Defenses Against Web-Borne. Malware)

Given these common features and tactics used by JaaScript malware, if you want to detect this type of malware as you asked, you need first to study the state of the art of the methods used to detect that. Various methods have been developed so as to detect web (JavaScript) malware. We can divide them into two main categories as follows:

Machine learning based classifiers

Features:  HTML and JavaScript codes distinguishing features extraction. These features are then evaluated to train a machine learning for classifier generation. The premise of this approach is that malicious webpages are likely to be different from benign ones (Thesis: Effective Analysis, Characterization, and Detection of Malicious Web Pages)
Advantages: Lightweight approach, useful to deal with a bulk of websites analysis.
Drawbacks: Obsolete against obfuscated JavaScript code and totally useless against new malicious code patters or zero attacks.

Dynamic methods

Features: Based on the dynamic behavior analysis, these techniques are implemented using either proxies where a page is rendered to the visitor only after its safety is checked, or a sandboxing environment relying on honeyclients (Same thesis: Effective Analysis, Characterization, and Detection of Malicious Web Pages).
Advantages: Efficient against zero day attacks and obfuscated code.
Drawbacks: Resources and time consuming. Sandboxing environments rely on low interaction honeyclients which themselves are based on virus signatures, and thus suffer from the same disadvantages as the static methods' ones.

What you have tried to do belongs to the first category.

Now, after you are well informed about all this, it can be useful for you to study some available tools dedicated for this purpose in order to implement your own technique. So let me mention you three important tools among so many others:

Zozzle

Zoozle relies on Bayesian classification  abstract syntax tree (AST) . It is legitimately classified as mostly static web malware detector because it embeds another engine that supervises the JavaScript code execution at run time. Its authors claim that it has a very low false positive rate of 0.0003% and is able to process over one megabyte of HTML and
JavaScript code per second. This tool is intended to be used as a browser plugin; its aim is to protect browsers against heap spray attack. It is time to point out how ZOZZLE operates.

How ZOZZLE operates? The following figure summarizes its core (ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection):

Extraction and labeling phase: The classifier needs training data. This data is extracted from obfuscated JavaScript code. Instead of developing an efficient de-obfuscation technique, Compile function interception calls is performed. Compile function is located in jscript.dll library. It is a smart way to obtain plain JavaScript code because it is called each time <SCRIPT> and <IFRAME> tags, or eval() and document.write() functions have been called, which thing defines also the code context. Each code context is saved on the hard drive for further analysis.
Feature selection:  JavaScript AST is used to tag each labeled context code for its safety or malignancy. The features are pre-selected using this formula:

Where:

A: malicious context with feature
B: benign context with feature
C: malicious context without feature
D: benign context without feature
Classification: The Bayesian  classifier is used for classification because even if it seems obsolete, in practice it gives good results and it is not time consuming.

Profiler
Profiler follows the static schema to detect web malware. It combines static features analysis of HTML and JavaScript code, including unified resource locator (URL)s. Then it uses machine learning techniques to teach a classifier that decides if a webpage embeds malicious content or not. Suspicious webpages are not processed by this tool. It rather forwards them to third party
technologies such as Wepawet (Prophiler: A Fast Filter for the Large-Scale Detection of Malicious Web Pages)
SpyProxy

SpyProxy  follows the dynamic analysis principles. It monitors the active content of webpages within a virtual machine before deciding to render them to the visitor or not. The architecture of SpyProxy is illustrated through this figure (SpyProxy: Execution-based Detection of Malicious Web Content):

(a): The proxy performs a static analysis over the requested page. In the case it judges is likely to be malicious, if forwards it to the virtual machine. basically only pages with active
content are forwarded to the virtual machine (VM).
(b): The virtual machine loads the malicious pages to monitor their activities.
(c): Only benign pages are rendered back to the proxy which forwards them in turn to the user's browser.

Iceshield

ICESHIELD performs in-line dynamic code analysis using a set of heuristics to verify attack attempts. Its authors take an inventory of the attacks that usually target the DOM properties of a website that are performed by injecting JavaScript into the website's source code. ICESHIELD supervises the running JavaScript code by predefining a set of rules related to functions calls and
applying heuristics on them in the hope to determinate whether the script is malicious or not (IceShield: Detection and Mitigation of Malicious Websites with a Frozen DOM).


Why does SSL EV certification have a range of encryption (40-128 bit)? I would like to get SSL-EV certification for my company website. After comparing a list of providers, I am confused by their advertisements.

Why do all providers say that their certifications support 40-128 bit encryption? In my mind, it only related to the handshake stage of SSL. It is controlled by Apache/Nginx server. If I only keep 128 bit encryption algorithms in candidate list, there is no way to create a 40 bit SSL connection. What does it matter to the certification?
SSL-EV in GeoTrust has lowest price. Does their certification have lower security or credit comparing to Symantec/Verisign?
My website is located in China. I heard a rumer "Due to US export rules, if out of USA, in SSL handshake stage, the calculated master key is 128 bit, but only 40 bit is encrypted, the other 88 bit is plain text." Is it true?
Is SGC useless? If so, why do the providers still sell them with very high price?

Marketing.  The providers want you to select them because they list something that someone else doesn't list, even though all certs support the same level of encryption as you noted.
Price has nothing to do with security.  In fact, all the SSL certificates depend on the lowest level security of any of them.
No.  The SSL handshake has zero to do with location of either endpoint.
SGC is dead.  My guess is anyone that needs it for some strange reason (really old legacy applications?) are a niche market.  Niche markets have high prices because they can.
You didn't ask this, but why do you care about EV?  Literally the only advantage of EV is that it gives you a green bar in the browser window.  Almost nobody knows what this means.


Banks storing credit card data in plain text? Are the banks authorized to keep plain text hard copies of full credit card data (Primary account number, CVV, Expiry code, Cardholder name)

(Some assumptions here for the lack of references)

According to this Visa page, issuing and acquiring banks are subject to the PCI DSS:

  All entities that store, process, or/and transmit cardholder data,
  such as merchants, service providers (e.g. payment gateways, IPSP,
  processors), issuers and acquirers, must comply with the PCI DSS

As such, they must keep copies of the PAN encrypted.  They may store the expiration date and cardholder name unencrypted.

The DSS prohibits storage (encrypted or unencrypted) of the CVV; however, by definition the issuing bank must know the CVV in order to validate it.  That means that either they store it, or they recalculate it (as per this excellent link that @WhiteWinterWolf provided in the comments).  It would not surprise me if there was some exception to allow the issuing bank to store the CVV, probably encrypted (it's arguably more secure to store many derived values than it is to expose the key to constant use) but that's pure speculation.

Update: @dave_thompson_085 pointed out in the comments that the PCI DSS explicitly permits issuers to store the CVV as per DSS section 3.2:

  It is permissible for issuers and companies that support issuing
  services to store sensitive authentication data if:

  There is a business justification and
  The data is stored securely.

On the other hand, I think it's fair to assume that the acquiring bank is not permitted to store the CVV of cards it processes.  There is no business driver for it and it would be out of line with the DSS's otherwise draconian approach to CVV handling.


Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API? I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token.  However, this feels wrong.  I have not found evidence of anyone else needing this pattern, which is a good sign that I'm missing something.

Details

We are running a typical REST based SOA.  We delegate authentication to Auth0 so that we can support customers with different Identity Providers.  As is, we receive API requests and perform auth based on the access token generated by Auth0.  However, we want to manage detailed API permissions internally and we want greater control over the token's life cycle (ie, forced server side revocation.)

Auth0 does support custom claims, but that would require a very tight coupling between our server and theirs (or our rules in their server.)  Also, that doesn't solve the forced revocation need either.

It seems like this need can be met by exchanging the Auth0 generated access token for a new access token generated by our server, which could inject claims about the user/identity's configured permissions.  This would allow us to control, well anything we want about the token, including revoking it.

Concerns

I keep scouring OIDC and OAuth2 specs, and searching for others with a similar need.  The lack of any hits has me concerned.

Is there a better way to manage authorization internally, while still delegating authentication to a provider like Auth0?

Is there a better way to support token revocation than generating and tracking tokens oneself?  Is it possible to maintain stateless tokens and support revocation at the same time?  (If this is too much for one SE post, then ignore this part.)

Update!

I discovered Token Exchange which looks like what I'm looking for... an OIDC / OAuth2 based version of a Secure Token Service that can exchange tokens from one side of a federated heterogeneous environment for tokens managed by another side of the environment.

So, I'll refine my question:  Based on the use case I've described, is the Token Exchange model appropriate?  If not, what?

I believe the way you describe the problem, keeping the 2 security perimeter and configurations decoupled, is a perfect fit for Token Exchange scenario. Some time has passed since your original post and IdP and API Management solutions have started implementing this functionality (https://www.keycloak.org/docs/latest/securing_apps/#_token-exchange) so I believe you are not the only one requiring this specific pattern.
To answer to your other doubt around stateless token and revocation, you might know already that token revocation is actually a standard (https://tools.ietf.org/html/rfc7009) but that can be implemented only for refresh tokens and by reference token. For by value token this is clearly not possible, but the workaround is obviously to keep the TTL low.


Any reason for a user to use an email scanner if they don't use any offline mail clients? I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware.  Even if they don't use an email application, the rationale is that if their system is infected with malware, the malware might try to use email to perform an undesired function, and the real-time email scanner might catch it.

I've recently been asked by someone who only uses webmail and does not use any email applications if they should run a real-time email scanner.  They use Windows 7 SP1 and use a real-time file system and web traffic scanner (I'll leave out the brand because I don't want to sound like I'm plugging products.)

I have been thinking about the correct recommendation to make, but I want to pose the question to this forum before responding to him.  Is there any reason for him to have a real-time email scanner installed?

A 'mail scanner' is not necessary with most modern webmail providers.

Most modern webmail providers will scan your email and remove any malware.  In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created.

You can test this by sending your user a EICAR test file:

http://www.aleph-tec.com/eicar/

They should get an email, but not the file.  If they do get it test the second line of defense by downloading the attachment.  Hopefully your local Antivirus catches it.


Antivirus necessary in my case? I was wondering if having an antivirus installed is still a necessary thing in 2017 for me, I will explain myself:

I never use my antivirus to scan file that I'm not really sure about (I use a service like VirusTotal for example), the only case is when a file is large.

I have add-on on my web browser to block script and stuff and I  try to avoid unknown links and website.

I'm updating everything (OS,Java,ETC...)

If you think about that having an anti virus doesn't really seems necessary, it's just using a little bit of memory.

I understand that for some people it's useful, but since I'm the only user of my PC.

What do you guys think ?

EDIT:I'm talking about a simple free antivirus like Avast for example.

I spoke to the CTO of Symantec at a conference once who said something that I'll never forget:

  If every user does everything they are supposed to do all the time,
  then you do not need anti-virus.

The question becomes, can you ensure all those conditions? Do you live with others? Are you 100% diligent with your protections?

I'm a security expert and extremely paranoid (my techniques are far beyond yours in terms of what of I do to protect myself) and I'd never run a computer without anti-virus.


NX bit: does it protect the stack? I once heard the NX bit was a panacea, then that it was not.
One detail I've wondered about though:
Does the NX (no execute) bit protect against code inserted into the stack and executed there?
It seems to me that the stack, because it's not the heap, might not be protected by NX usually.
THanks.

The NX bit is a feature of the Memory Management Unit of some CPU (including recent enough x86). It allows to mark each memory page as being "allowed" or "disallowed" for code execution. The MMU is under control of the kernel; the kernel code decides which pages get the execution privilege and which do not. Therefore, whether the stack space is protected against execution depends on the OS. It also depends on a lot of other things:

Though the kernel may apply default values for the page properties, application can request changes. E.g. on Linux systems, the mprotect() system call can be used to enable or disable execution on any page that is under control of the calling process. In particular, any application which contains a JIT compiler (e.g. Web browsers, for efficient Javascript support) must play with mprotect(), because it must generate code (i.e. write bytes into some memory) and then execute the said code.
A mono-threaded application gets its stack in a dedicated area that the kernel knows of; in particular, the stack pages are automatically allocated upon first usage. In a multi-threaded application, things change: each thread has its own stack, which is, from the point of view of the kernel, heap-allocated. Depending on the OS, there may or may not be special support from the kernel for thread stacks.
GCC in particular supports a C language extension called nested functions. Because of the semantics of these functions, the compiled code for a nested function must dynamically produce some executable code on the stack; this is called a trampoline. See this page for some details. The bottom-line is that, for a trampoline to actually work, the stack (or at least the page in which the trampoline resides) must be marked executable.

It so happens that in the ELF file format, which is the format of executable files and DLL on Linux, there is a field which allows to specify whether the stack should be executable or not. When GCC compiles some code which contains a nested function, it sets this flag in the produced binary.

I have made some tests on a fairly recent Linux (Ubuntu 13.10, on 64-bit x86, with NX bit activated). Whether a given page is executable or not can be inferred from the contents of the special file /proc/$$/maps where $$ is the process ID. These tests have shown the following:

By default, the main stack is not executable. The NX bit is set for the stack pages.
If code contains a nested function, the executable is marked with the "executable stack" flag and, indeed, the main stack is now executable.
Thread stacks are created with the same "executable status" as the main stack.
If a "normal" executable, with its main stack non-executable, dynamically loads a DLL (with dlopen()) which contains code for a nested function, then the main stack is automatically switched to executable status.
If a normal multi-threaded executable, with its main stack and all its thread stacks non-executable, dynamically loads a DLL which contains code for the nested function, then the main stack and all the thread stacks are en masse promoted to executable status. Note that this implies that on this Linux system, "something" (probably the kernel, I have not checked) is aware of all the current thread stacks, and can change their mapping rights dynamically.

From all of this we conclude that on at least some recent versions of Linux, the stacks (main and threads) will usually be marked as non-executable (i.e. NX bit set). However, if the executable code of the application, or some executable code somewhere in a DLL loaded by the application, contains a nested function or otherwise advertises a need for an executable stack, then all stacks in the application will be marked as executable (i.e. NX bit not set). In other words, a single loadable plugin or extension for an application may deactivate NX stack protection for all threads of the applications, simply by using a rarely used but legitimate and documented feature of GCC.

There is no need to panic, though, because, as @tylerl points out, protection afforded by the NX bit is not that great. It will make some exploits more awkward for the least competent of attackers; but good attackers will not be impeded. Also, all this talk about NX is about trying to contain damage once a buffer overflow or use-after-free has occurred, and that's arguably a bit late to react.


Read NTFS / EFS encrypted files on iOS with saved certificate I have data saved on old NTFS-format hard disks which were encrypted on Windows machines, using EFS (the native file encryption system built into Windows). I encrypted selected files/folders, only, not the entire drive.

Is there any possibility to read/decrypt these EFS-encrypted files/folders, on iOS? I know iOS can read (but not write) to NTFS drives, but I didn’t know if the read capability also includes access to encrypted files, which is part of NTFS standard. I do not have a Mac, so cannot test this personally.

I have the original EFS encryption certificates saved separately from the encrypted drives and know the password.

EFS uses Alternative Data Streams (ADS), an NTFS feature that some third-party file system drivers have little-if-any support for. Even if the driver supports ADS, no guarantee that it also supports EFS, especially as that would require having somewhere to input the user's key. Each EFS file is encrypted with a unique key, and that key is itself encrypted ("wrapped") with the user keys of every user that has access to the file, and those wrapped keys are stored in ADS of the file; the EFS certs you backed up contain the user key needed to unwrap the file keys.

In theory, there's no reason that you couldn't use an iOS app to decrypt EFS files. First, The app would need to be able to access the hard disk in question (which is not a storage medium that iOS devices usually connect to). Then it would need to know how to access the ADS, how to read the EFS metadata, and how to import the user key (plus you'd need to supply the key and its password). From there, though, EFS uses a well-known (and somewhat outdated by this point) cryptographic cipher suite; an iOS app would have no problems handling it.

I don't know if an app with these capabilities has ever been written. It seems unlikely; iOS is very much not an OS built for this kind of work. Is there some reason you can't just use a Windows (or, next-best, Linux) machine to decrypt the files? On Windows it would be easy (just re-import the cert and user key), and on Linux I'm sure you could find a utility to handle EFS files.


How do I know if is SDA, DDA or CDA? would you please explain me for chip cards (emv), how do I know, based on either BIN (first SIX digits of card numbers) value or based on entire card number if card is SDA, DDA or CDA? I know what it means but without using of POS or ATM I want to check which of those three categories my card number or its BIN number belongs it.

This is not something that's determined by the account number (BIN or otherwise).  Rather, it's determined by the bank that orders the cards and has the chip "personalized" with your account information.  They make the choice as to whether to simply put on a pre-computed signature (SDA), or pay the extra expense for a chip that is capable of calculating one on the fly (DDA).  I believe that all DDA-capable chips can do CDA if the terminal supports it, but I'm not certain on that front.

As for why any bank might issue a SDA card instead of a DDA card, this article from 2008 still rings true:

  The reason comes down to one of cost. A chip card that is capable of performing public key cryptographic processing, and therefore capable of supporting DDA, is relatively more expensive than a chip card that is not capable of performing public key cryptographic processing, and thus only capable of supporting SDA. The cost of issuing chip cards is a significant factor in the business case for a bank. Current indications from the Australian market is that the difference in price between an SDA card and a DDA card is in the range of $0.50 – $1.00.


php's password_hash with system wide salt I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts are even deprecated (from manual page).

  Warning
  The salt option has been deprecated as of PHP 7.0.0. It is now
  preferred to simply use the salt that is generated by default.

Anyway, I still feel like I should add own system wide salt like this:

$system_salt   = 'system_secret_key';
$hash          = password_hash($password.$system_salt, PASSWORD_BCRYPT);

So, if anyone would gain an access to the database, but not the scripts, even after cracking the password, he would only find salted password (or collision) that would not be usable on other sites.

Is this a good approach?
Can this make hashes less secure (easier to crack) as they all will have same sequence of characters (system wide salt) at the end?

There are two main problems with this approach:

Someone trying to bruteforce a single password will still have to go through the same amount of computations, but someone trying to get the password for multiple users will have to compute only one table for all the users on your system.
But the more important problem is that it's a deprecated function, which means that maybe you can't rely on it after a few more updates and thus your code might not run anymore as soon as the function is removed from a future PHP update.


Is it possible to make the back button work if we use one CSRF-token per request? Do we need to compromise on back button navigation if we use one CSRF-token per request instead of one token per session?

(I was successful in using one token per session without any navigation problems but not able to do the same with one CSRF-token per request.)

The solution used in my Web-Applications (JSF) is to tell the browser to make a new GET-Request on browser-back (or reopen tab). This is done with the following HTTP Response Header:

Cache-Control: no-store, no-cache, must-revalidate
Expires: [in the past]

The first line is for HTTP 1.1, the second line is for Proxy-Servers.
This should work (at least) in all major browsers.

For details see this answer over at StackOverflow


Why is the read write speed of a Protected DVD so slow? I got a DVD with copy protection enabled on it, but the problem I am facing is that it loads extremely slow. I have seen such happenings with other kinds of protected DVD's as well.

Can anyone tell me why they are slow in loading as compared to the other DVD's. I know that such kind of DVD's utilize Content Scrambling Systems (CSS) for protection but why is the loading speed compromised?

As with any encryption technique, decrypting will take longer than reading an unencyrpted or less sophisticatedly protected file. There is no exception with dvds. One way to really see the difference is to rip a dvd from two different computers with different processor speeds. You will notice that the computer with the higher speed will rip the dvd faster.


cases where companies suffered losses due to leaks of source code? The damage associated with data breaches apparently caused Equifax to
lose $4 billion in value and Facebook to lose about $50 billion, and even if not every dollar of those losses was due to the breaches, it was a lot.

By contrast, have there been cases where companies were seriously hurt or lost market value because their source code was compromised?  I heard about Windows source code leaking last summer but not about it affecting Microsoft's stock price or even hurting the company.

Maybe the reason is that even if an outsider stole the entire source code, they still wouldn't be able to sell it legally, so it wouldn't represent a competitive threat to the company.  Possibly a thief could use the source code to determine how a competitor is doing something, but that just helps the thief make a product that does the same thing, at the same level of quality; that's not going to steal market share from an entrenched incumbent.  There is the risk of attackers finding security holes in the source code, but they were probably already looking for security holes through reverse engineering anyway.

Regardless of speculation over the reasons, I'm just asking: have companies been hurt by a breach of their product's source code?  How much?

I can think of numerous cases over many years especially in cases of start-ups. The theft of IP (intellectual property) allows other companies to get to market first. You do not hear of these cases because the companies are so small, but the damage is total: companies shut down before they really start.

The same is true in research circles when an academic wants to bring research into the commercial market. There can be massive competition and corporate espionage is very real.

And the source code does not need to be used exactly as it was stolen. Parts of the code can be used, or the code analysed in order to create something better.

You also need to define "harm". Loss in stock price is only one form of harm. Loss of sales is another. Software piracy is another form of harm (sales), depending on how you define it (yes, I am aware that this is a complex issue).

If you think about it another way, every single (valid) software patent case is a form of IP theft that resulted in harm, which resulted in a lawsuit to recover losses.

Examples of "source code leaks" in the InfoSec industry alone:

RSA SecurID token source code leak:
RSA needed to replace all user's physical tokens. So, there's a direct cost. In the community I was in at that time, we all started to seriously look at software tokens instead as a result of this event (Google Authenticator was released the year before). That financial hit would be difficult to quantify.

RSA is an LLC, and not a public company, so there is no stock price to track.

Symantec source code leak:
While the stock price did not take a hit, it shook confidence in the detection engine as hackers could custom design malware that could evade this specific detection engine. This caused a re-write of their code, so there's a direct cost.

There are lots and lots of examples if you know what you are looking for. Including Wiki.


Is it possible to write shellcode in C++? Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of the assembly?

The Linux kernel can be viewed as a kind of ultimate shell code, since it is "injected" on a raw machine (which only has the BIOS code at that point) and then provides a lot of functionality. That kernel is written in C.

If you write shell code in C or C++, you will run into trouble with library calls and linking, which are two facets of the same issue.

Code produced by a C compiler may contain references to other parts of the code, or external functions or variables. For instance, if you access a static variable, even if defined in your own code, then the assembly opcodes will contain a "hole": at the assembly level (that which you obtain with gcc -S, if you use gcc as C compiler), you would see basic "mov" opcodes, and the variable name. When translated into binary, in the object file (the .o or .obj, depending on the platform), the hole is not filled yet, because the actual address of the variable is not known yet; the object file contains a table (the "relocations") which inform the linker of the position of each hole which is to be filled at the linking stage.

The problem, of course, is that you do not have the luxury of a linker when making a shell code. You have to produce a sequence of bytes which is already ready, with no hole to fill, and able to run at whatever address it will be loaded, address which is not necessarily known in advance (thanks, in part, to ASLR). You must write position-independent code. Compilers often offer a command-line flag for that (e.g. -fPIC with gcc) but this is not "true" PIC: that kind of code still has holes to fill by a linker, but this time the dynamic linker; it is PIC only by virtue of the holes having been regrouped in a special table (the GOT, aka "Global Offsets Table"), making the task easier for the dynamic linker.

Unfortunately, C compilers, and C++ compilers even more so, will generate code with holes without your consent. For instance, a typical C compiler will produce code with hidden calls to memcpy() (the standard library function) when dealing with struct values. C++ makes that worse because of all the paraphernalia of C++ features, which are supported by hidden functions and static variables (e.g. the object vtables).

The Linux kernel solves these issues by using the MMU. The boot loading code (which is a piece of hand-written assembly) takes control of the MMU to make sure that the RAM pages where the kernel code is will be seen at a fixed, known address in the address space: the kernel, when compiled, is linked with that explicit assumption; the holes are filled with addresses which are correct only if the kernel is indeed at that exact position in the address space. Playing with the MMU is a kernel privilege, you cannot do that from userland code, let alone from a shell code.

You could envision making your shell code a piece of assembly which is, in fact, a dynamic linker, able to load a piece of binary code produced by a C or C++ compiler, patching it dynamically, i.e. filling the "holes" with the actual loading address. That's what occurs in the exploits provided with metasploit: the exploit itself installs that nifty piece of code, which can then install "payloads" which are generic DLL, written in higher-level languages, up to and including a full VNC server.

However you put it, though, you will have to do some PIC code in manual assembly at some point. Writing your own loader/linker is a great pedagogical exercise, and it can be used to leverage an initial exploit to arbitrary control levels, but at its core, handmade assembly will still be needed.


Should I reply to an email saying that I requested online access to a website? I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a disclaimer saying something like "If you have received this message by mistake, please immediately notify us by replying to the message and delete the original message immediately thereafter."

I'm wondering if I should do this or not? It might be a good idea to reply to them in case someone is trying to hack into one of my accounts. Or someone tried to create an account with my email by mistake. Or it could be that they have a bug in their system so it would be a good idea to let them know. On the other hand, I'm worried that this could be a social engineering attack.

It's likely legitimate - there's little gain in getting you to reply to a spam email. All it reveals is that your email address is active, which isn't a particularly valuable piece of information.

To be safe, what you can do is instead of replying to the email, find the contact information for the alleged sender via a web search, then forward the email to that email address. This will ensure that the email goes to a legitimate party. If you want to hit the middle of the road, you can find out a legitimate email address for them, and check that the email that you received has the same domain - eg they will both end in @example.com. If they do, then replying to the original email will go to them. Be aware that unicode lookalike characters are a real risk with this approach.


What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC? What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)?

Secondly, how can I verify that DANE is configured correctly? Either with a local tool or online tool. And are there known Nmap NSE scripts that perform this check?

DANE allows you (as a domain owner) to specify the possible CA's that are allowed to generate a certificate for your domain. This prevents rogue Ca's to issue a certificate (it will be invalidated by a client that uses DANE to validate the certificate).

From Wikipedia:

  DANE enables the administrator of a domain name to certify the keys used in that domain's TLS clients or servers by storing them in the Domain Name System (DNS). DANE needs the DNS records to be signed with DNSSEC for its security model to work.

Here is an online tool that can validate a DANE implementation: https://dane.sys4.de/common_mistakes


How can we be assure that people with read access to keys, can not also read the ciphertext and vice versa? We have this segregation of duties requirement and don't understand it fully. Is it not always possible, that an employee who is generating keys can also get access to the encrypted messages?

Could a person who creates encryption keys and therefore has access to them, copies or otherwise, use them to decrypt messages? Yes, but only if they also have access to the message storage.

Simply store the encrypted messages in a location not accessible to the key creation people. Give the message reading people access to only the keys they need.

Segregation of duties should also include segregation of access.


Is this authentication and encryption solution secure? I need to communicate over insecure TCP sockets where SSL/TLS is not available. Does the following solution provide a secure means of authentication and encryption?

-

Client sends: username
Server generates a random token (31 bytes).
Server retrieves a password salt and hash (bcrypt) from the database for the given username.
Server encrypts the random token by the password hash.
Client receives: passwordSalt + encryptAes(token, passwordHash)
Client gets the passwordHash by using bcrypt on the password and the received password salt.
Client gets the token by decrypting the encrypted token with the password hash.
Client generates a random 'validation' salt (15 bytes).
Client generates a hash of the token using the validation salt and encrypts it with the token.
Client sends: encryptAes(validationSalt + md5(token + validationSalt), token)
Server gets the hash by decrypting it with the token.
Server compares if the received hash is equal to md5(token). If they are the same, the client has authenticated.
Server generates a hash of the password hash using the validation salt, pads it with 15 random bytes, and encrypts it with the token.
Client receives: encryptAes(randomBytes(15) + md5(passwordHash + validationSalt), token)
Client gets the hash by decrypting it with the token.
Client compares the hash with md5(passwordHash + validationSalt). If they are the same, the server has authenticated.

All data will now be encrypted with the token generated by the server.

-

The server is in Java, the clients are in C++ (UE4).

Public key encryption is currently not available.

-

Is there any flaw or weakness in this solution?

Your solution could be affected by the following concepts:

Do-it-yourself Cryptography

DIY crypto is an anti-pattern of secure software design. Most (>99%) attempts will fail. Nevertheless I respect your try! :-)
For example: Don't reveal the "passwordSalt", if you don't need to. It helps the attacker to crack the challenge. After one request an attacker knows the salt and has a challenge which could be cracked. The security relies only on a strong password. The attacker can crack the password offline. This should not be the case for online services. I rate this as highly insecure.

Perfect Forward Secrecy

The key for the encryption (serverside generated token) should be calculated on both sides (client and server) using Diffie-Hellman Key Exchange or similar. If someone recorded the traffic and gets the user password, he is able to decrypt the token and then decrypt the whole traffic, afterwards.

Steps 13-16 not needed

If the client can decrypt "passwordSalt + encryptAes(token, passwordHash)" successfully, the server had to know "passwordHash", therefore the user password.

This list is not complete, as several other weaknesses could be present.


Please explain Time-step in Time-Based One-Time Password Algorithm I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)

I have no issues with HOTP. But according to RFC6238 in section 4.2, TOTP is defined as
TOTP = HOTP(K, T) where T = (Current Unix time - T0) ÷ X.

I have studied the RFC. I am confused between timestamp and time-step. (timestamp is current unix time I guess) but what is time step?

How does resynchronization occur? It is said like this in the RFC:

  ... If the time step is 30 seconds as recommended, and the validator is set to only accept two time steps backward ...

What does it mean? Does TOTP have Throttling parameter and window size as in HOTP?

Overview. TOTP is pretty simple and is described pretty well in the RFC you linked to again.  You might want to read through the RFC another time: it's all there.  I'm going to summarize the RFC for you, but you could have gotten all of this yourself by reading the RFC.

Time steps. For example, you asked about what is a timestamp vs a time step.  The first two paragraphs of Section 4.2 define these terms.  As it says there, T is the number of time steps between the initial counter time T0 and the current Unix time.  X is the size of the time step, e.g., 30 seconds.  See the third paragraph of Section 4.2 of the RFC for an example.

Resynchronization. Section 6 describes how resynchronization works.  Read that section for details.

For instance, suppose the client thinks that the current time is 10:01:20 (i.e., 1 minute and 20 seconds after 10 o'clock), and the server thinks that the current time is 10:02:07.  In other words, the server's clock will be 47 seconds forward from the client's.  Let's say for simplicity that the initial time is 10:00:00 (in practice it will be much farther back in the past, but I want to keep the numbers small here), and the time step is 30 seconds.  The client will calculate T as the number of time steps from the starting point, i.e., T = floor(80/30) = 2.  The client will generate a one-time password as HOTP(K, 2).  However, the server's time is different, so the server will compute T' = floor(127/30) = 4, and the server will be expecting the one-time password HOTP(K, 4).  The client's password will not match what the server is expecting.

If the client's one-time password does not match HOTP(K, T'), then the server also checks whether it matches HOTP(K, T'-1) and HOTP(K, T'-2).  In our example above, the client's one-time password does match HOTP(K, T'-2), so the server allows the client to log in successfully.  The server can also tell that the client's clock is about 2 time steps behind the server's, so the server can update its records for that client.  When the client next tries to log in, the server will compute T' based upon an adjusted version of its own clock, adjusted for its estimate of the clock skew.

This is pretty straightforward and standard stuff, and is all explained in Section 6.

Discussion and caveats.  What are you using one-time passwords for?  Be warned that they have a number of drawbacks.  Their most severe limitations is that they are not secure against man-in-the-middle attacks, they are not secure against client-side malware, and they are not secure against phishing attacks.

You might want to consider other means of user authentication, and re-consider whether one-time passwords are the best solution to your particular problem.  The method that is best for you will depend upon your particular application.


Credentials using AWS IAM I have a server, which should provide temporary credentials to the client.
The credentials will be transmitted using HTTPS.

The client should be able to upload S3 files, as well as download them.
The concern I have is the following:

I have multiple users accessing ONLY their own directory:
/Users/someUser/myfile.png

You can set policies to allow or deny S3 in general, but you can't grant only the access to a specific path.

Is this secure?

If I understand correctly you are generating IAM logins on your server and providing them to the client for them to access S3 directly.  If that is the case then no; it is not secure as these users would be able to access all of your S3 resources.

You could use bucket policies to set per-user permissions but those would have to be edited/created automatically by your server at the time to IAM logins were created since they ARNs wouldn't be known in advance.

If they are authenticating only to your server and your server is managing the S3 connection then the S3 portion is probably ok and the main concerns would be the security on the server itself.


RSA verification time For a any processor of these or any other processor

armeabi (v7-A, Cortex A8); 2012 TI Sitara XAM3359AZCZ100; 1 x
1000MHz
armeabi (v7-A, Cortex A9); 2012 VIA  WonderMedia 8850; 1 x
1200MHz
amd64; IB+AES (306a9); 2012 Intel Core i5-3210M; 2 x 2500MHz

How can I calculate the time needed for RSA verification ?

in another words

How many clock cycles does RSA1024 with exponent of 65537 need to verify a message ?

Sure Times will be different according to processor, that's why I asked for number of clock cycles

How can I use these tables if they may help ?
http://bench.cr.yp.to/results-sign.html

Performance is more readily benchmarked than computed. Try to arrange to run this command on your systems:

openssl speed rsa2048

This supposes that you can have a Linux-like operating system on your machines. This will give you the number of private-key and public-key operations achieved by OpenSSL (a well-known and widely used cryptographic library) when using a 2048-bit RSA key. On a 3.1 GHz Xeon (E3-1220 V2), I get 27415 public-key operations per second, i.e. about 113000 clock cycles per RSA signature verification.

Of course, CPU brand and architecture will impact such figures; for instance, one may expect a slowdown by a factor of 3 or 4 on a 32-bit CPU like your ARM (my Xeon runs in 64-bit mode, and it helps quite a lot for big integer computations). Not all CPU can issue the same number of instructions per cycle either. However, one should consider that between 100000 and 1 million cycles for a RSA signature verification should be "typical" on modern CPU (for a 1024-bit RSA key, divide these figures by 4).

OpenSSL's benchmark tool is mono-threaded, and RSA computations easily fit in CPU L1 cache, so this scales very well on multicore systems; e.g. my quad-core Xeon can actually do more than 100000 RSA signature verifications per second (not that such abilities are useful on a daily basis, though).


Preventing online voter fraud As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how successful it is this might become a regular feature. Since the proposed prizes will not be insubstantial, naturally we are concerned about voter fraud. How can we detect the usage of proxies, Tor and various other methods that might be used by unscrupulous users looking to game the system? For example, how does https://check.torproject.org work? Are there any ready-made scripts we can use, not just for Tor but in general?

I see that Stack Exchange has held competitions in the past based on online voting, so I am hopeful of getting some good answers here.

Thanks,

Samuel

Voting systems are "gamed" by people voting more times than should be normally allowed (e.g. voting several times). The only way to prevent this is to have a way to identify voters and to prevent multiple votes.

Reliable methods entail authenticating users, e.g. with passwords, but this has two drawbacks, namely that 1. users don't like it, and 2. this does not really solve the problem, but moves it to a prior "registration phase".

Unreliable methods are about heuristically detecting frauds by tracking IP addresses (but this fails with dynamic IP address -- a user can change his IP, and this happens more or less automatically with many ISP -- and also with NAT -- several distinct users sharing the same IP) or with other methods. Simply sending an "has voted" cookie in the user's browser will deter the basic, low-tech wannabe fraudsters; there are more thorough methods, but all of these can be circumvented by a technologically savvy attacker. Tor is a tool which deals with anonymity, a closely related subject, and shows that you are trying to fight a losing battle.

StatckExchange itself faces the same issue, which it calls sock puppets. They finally took a relaxed attitude, with (unpublished) scripts for detecting the most blatant gaming attempts, and mostly ignoring the rest.


security and the well constructed Qt plugin "All you'd have to do is build a plugin and you could completely pwn the software."

I'm building an application using plugins. I think all you have to do is build a plugin and copy it into the correct directory and my main program would happily run it. I'd like the main program to be smart enough to detect unauthorized plugins and reject them. An encrypted signature on each plugin would work well. Has anyone done anything toward a secured, and cross platform, framework for Qt plugins? Or a cross platform library for generating signatures for shared libraries?

I'm aware of how windows does this. Linux not so much. I don't need Mac compatibility.

Thanks for your time!

As suggested by bstpierre, you cannot protect yourself against malicious users since a plugin allows by definition to run arbitrary code.

However, if you want to prevent the abuse case where an innocent user downloads a plugin which seems legit but is not, you can do some signature checking with asymmetric crypto to make sure that this does not happen.

When talking about cross-platformness, have a look at Qt Cryptographic Architecture  (first google hit on "qt crypto"). Seems to me that this is what you're looking for, although I don't have any experience with this framework myself.