DNS flood vs DNS Amplification attack: How is one considered a network/transport layer attack and the other a application layer attack? I am reading a survey on DDoS attacks and they describe how these attacks can be classified by either Network/Transport level attacks and Application level attacks. In their examples, they classify DNS flooding as network/transport and DNS amplification as application level. I am not entirely understanding the difference and in my view, am questioning why DNS amplification is not a network/transport layer attack as well.

From my understanding, in DNS flooding, you have distributed bots flooding UDP queries essentially, overwhelming the bandwidth such that legitimate users cannot send their on requests. In DNS amplification, you are spoofing the victim's IP in a DNS request such that when the response comes in, its a multiple times in size going back to the victim. From what I understand this is not exactly targeting any application (such as HTTP floods) and rather both examples are compromising the network resources rather than a victim's system resources. How exactly is DNS amplification considered an application level attack?

Link to survey: http://d-scholarship.pitt.edu/19225/1/FinalVersion.pdf

Yes, you've understood it correctly (except for a few details, see below) and the authors of the survey you've linked to are wrong. Or at least, if they have even really had some bright idea behind that paragraph, they have failed to present it right.

E.g. there definitely exists an approach to classify DDoS attacks based on the vulnerable protocol layer. In that way, UDP flood is a transport layer attack and DNS amplification is application layer, though from the victim's point of view in both cases it's the network layer which gets congested. The real world applicability of such an approach is questionable at best, but the authors of the survey don't even refer to that, they are more practical (which makes me say they have made a mistake).

One possible reason for that is that the paragraph which discusses DNS amplification refers to some articles dating back to 2004. Since that time, quite a lot of DDoS-related events have happened, so it's probably best to find something more up-to-date to read.

My two cents though:

It's more proper to call that "layers", not "levels";
An attacker doesn't actually need bots to do UDP-based DNS flooding. A couple of servers connected to a network with a good bandwidth and no RPF will do the same trick by spoofing the IP source of the packets;
However, a botnet would be useful if the victim is able to do some DNS-based challenges or to simply quickly truncate the response, forcing the client to retry the DNS request via TCP (yes, DNS can operate via TCP).


SHA256 to text or MD5 I want to decrypt a sha256 to text. Is there a way other than bruteforcing to decrypt sha256? Like if I convert that SHA256 to MD5  and then try decrypting?I know its hard and the possible way for sha256 to text may be bruteforcing. Any other insights are appreciated other than sarcasm. I have considered rainbow table as well. But I dont think it will be effective on this one.

SHA256 and MD5 are hashing algorithms, or "one-way encryption" if you will.

  A hash function is any function that can be used to map digital data of arbitrary size to digital data of fixed size (Wikipedia (Hash function))

So to get the (probable*) plaintext that was hashed, brute-force is the only way.

There are rainbow tables as well as you mentioned but they mostly cover passwords [citation needed].

* Since the hashing algorithms have defined output lengths, the resulting hash may collide with other plaintexts, such as when MD5 was badly broken. More on Wikipedia (MD5: Collision vulnerabilities)


Can a DNS "route" change cause an SSL certificate error? What I mean by "route change":

As a working example, mysite.example.net is set up as:

mysite.example.net.            3600    IN      CNAME   some-other-site.elsewhere.com.
some-other-site.elsewhere.com. 580     IN      A       22.33.11.0

mysite.example.net is then changed to:

mysite.example.net.            3600    IN      CNAME   newsite.differentplace.com.
newsite.differentplace.com.    3600    IN      CNAME   some-other-site.elsewhere.com.
some-other-site.elsewhere.com. 580     IN      A       22.33.11.0

(setting aside the not-best-practice of pointing a CNAME to a CNAME,) The "route" has changed from 2 look-ups to 3.

I am also asking if any number of steps or any kind of change "in the middle" or toward the side of the IP address along the look-up "route" would have any impact on the certificate being verified.

My understanding from the following snip from this question is that as long as all the look-ups originate from the "correct" place (i.e. the CN of the cert matches the first DNS URL queried), there should be no impact on the verification of the certificate. Any number of changes to the look-up chain and any kind of change should not impact the final result of the certificate being valid/verified.

  But a CA can make me trust any server they want!

  Yes, and that is where the trust comes in. You have to trust the CA
  not to make certificates as they please. When organisations like
  Microsoft, Apple and Mozilla trust a CA though, the CA must have
  audits; another organisation checks on them periodically to make sure
  everything is still running according to the rules.

  Issuing a certificate is done if, and only if, the registrant can
  prove they own the domain that the certificate is issued for.

Am I right?

Please don't limit your answers, but specifically, would any other certificates along the way get entangled in the original lookup? (e.g. say newsite.differentplace.com has it's own certificate, would that be used in validation instead of the certificate for mysite.example.net?)

Changes to DNS aliases (CNAME) or IP addresses do not matter at all to certificate validation.
All what matters is that the hostname as seen by the client (for example the name in the URL) matches the subject(s) of the certificate. This name will not change on any changes to the DNS.

Often a DNS CNAME gets confused with a HTTP redirect. In the case of CNAME the name stays the same and thus the CNAME is irrelevant for validating the certificate. In the case of a HTTP redirect the name might change and this is also reflected by the change of the URL as seen in the browser.


How to share CSRF token to client application? I have two different web application. Services web app has REST Services defined. Client web app has JSP pages which makes call to REST services using Ajax to get the data and display in the UI. I want to implement OWASP CSRF Gaurd 3 for my REST services.

How can I get CSRF token value in Client application so that it can pass token value as header and rest services gets validated and executed?

Let me tell my architecture bit clearly.
Services Project - It is a spring/JPA project with REST web services defined. This project requires to be protected with CSRF. Its web context is /Services. So url might be in localhost like http://localhost:8080/Services/RESTSERVICE

Client Project - It is a JSP/Servlet project with jsp/html web pages. This project makes AJAX calls to Services project's REST Services to fetch the data and show it in UI. URL is like http://localhost:8080/Client/index.jsp

Now my doubt is if I implement CSRF Guard in Services Project, Client project required CSRF token to call protected REST Services. How do I get this token value into Client projects jsp pages?

I tried with adding cookie into the response of rest services, but Client javascript is unable to read it so with cookie i was not able to share token to the client. Is there any other approach?
Any help will be appreciated...

Just implement a /token endpoint that provides a CSRF token given a session cookie. Remember, as long as client side JS on a different domain cannot fetch and use this to construct requests (the most client side JS can do is dislpay it in an isolated iframe), CSRF is not possible. Allow the client app to fetch the token via CORS if the domains differ.


Overall Security of Network Time Protocol I am doing some research in order to get an understanding of the security of the Network Time Protocol. In particular, my goal was/is to understand how the protocol is secured and what the issues are.

So far, I understood that there are basically 2 ways to secure NTP, in order to provide authentication (and integrity as well, since a MAC is used): via symmetric cryptography and via public key cryptography. However, for several reasons (that I do not list explicitly for the sake of space), these 2 measurements are often not used and therefore NTP is left unauthenticated. This leads to a series of issues in terms of security.

My question is: in practice, how often is NTP really subject to attack? I know that there is the possibility of both on-path and off-path attacks, and that some of them have been fixed (I mainly refer to the studies done by the Boston University research group). If it was so easy to hack a protocol like NTP, everyone would be messing up with applications relying on time (certificates etc.). From what I read, in general, it seems like in fact there are not so many attacks available on NTP, although most of the times the protocol is not secured. The only exception seems to be DDoS attacks (such as amplification and reflection attacks), for which there are not so many solutions. Did I get this right or am I missing something important from the big picture?

Another question: why only recently some new solutions have been proposed? I am referring mainly to the Network Time Security specification (pdf) to secure NTP, which was also presented at Real World Cryptography Conference 2017 by one of the authors of the IETF draft (Daniel Franke). What I have been wondering is whether this solution would really provide something useful, since people keep using NTP without authentication and they do not seem to worry too much about it.

I hope my question was clear.

For most people in most applications, highly accurate local time is not of the essence. There are two broad categories for the exceptions:

Certificate Authorities, nonrepudiation systems, financial controls and others need to make sure that the time of an event as reflects the real-world time is accurately recorded, assuring integrity, but not to very precise tolerances (outside HFT)
Authentication systems, key exchange mechanisms and other temporary interactions involving authentication are concerned with protecting against replay attacks and use the concept of "now" to achieve this, while not being terribly concerned when "now" really is, only that it's not being replayed from "then".

Even inside these categories, unless there are legal or safety consequences for a lack of accuracy or synchronisation with the outside world, there is either a wide tolerance of drifts/disagreements among parties (eg most authentication survive can survive  of seconds to minutes) or a simple requirement that, while the time is not completely accurate against the outside world, then at least that all parties agree on their own representation of the time (eg all log events exactly 1.522 seconds late are still correctly ordered).

Mostly, attacks require at least the server, if not both ends of the connection to have compromised time, and good monitoring will detect this event if the design does not outright reject it.

My understanding is that for most end users, Denial of Service is the bigger concern. The big guys won't be relying on open NTP across the Internet if they're really serious.


Is knowing the decrypted and encrypted data enough to find the key? Let's say an attacker knows the encrypted content, the decrypted content and the algorithm used: can he get the key that was used to encrypt the content or does it make it easier to find the key out?

I think that this may vary between symmetric and asymmetric encryption and between different algorithms. So how secure is this scenario with different algorithms if the only thing I need to keep secret is the key?

EDIT:

I ask this question because I just read through the SpiderOak FAQ and as far as I understood that, they are neither storing a user's password nor the encryption key which is derivered from the user's password. However, they need to make sure that the user's password is the right one when he's logging in to the web page.

If they don't store the password and don't store the key, the only possibility to check whether the password is right is to decrypt some known encrypted data and check whether the result is the right one.

E.g. when registering they might encrypt the data CHECK and when logging in they might derive a key from the entered password and decrypt the encrypted CHECK and see whether it is CHECK. If not, the key was not right, and thus the password wasn't either.

Is there any other way how they could do it?

What you are referring to is a known-plaintext attack, where you attempt to figure out the key by comparing the encrypted and unencrypted versions of a sample of data.  Fortunately, pretty much all major encryption algorithms in use today, including AES, are not known to be susceptible to this kind of attack.  Knowing what something decrypts to is completely useless as far as figuring out the key goes (unless, perhaps, your approach is to attempt to brute-force the key.)

While Spideroak technically could use the method you describe (i.e, encrypting a known sample file), they actually use a procedure known as hashing according to their website.  Hashing is a very common password storage technique; in fact it is used by nearly all websites that process user logins.  It's is a mathematical process that takes in some data (such as a password) as input, and generates a unique, fixed-length string as output.  It is easy to calculate the hash of some data, but given the hash, it is very hard to figure out what the original data was.  But as long as you provide the same data, the hash will always come out the same.

According to Spideroak, when you create an account, your browser calculates the bcrypt hash of your password and sends the hash to spideroak. Presumably, when you log in, spideroak sends the hash back to your browser, and your browser will take the hash of whatever you typed in to check that it matches.


How to encrypt an entire portable HDD, so that it cannot be read/written without the password for it? I use a portable USB drive (Seagate FreeAgent Go Flex) to keep all my personal stuff, and though the HDD company does offer a password scheme to control access to it, that would work only on windows, as one could easily mount it in Linux and bypass it.

I'm looking for a solution that would encrypt the entire drive, making it impossible to read/write anything without knowing the password. Does anyone know of any security tools (open-source would be the best !!) that would enforce this regardless of the OS being used to mount the HDD ? If not, what alternatives would you suggest to safeguard the data ?

Edit TrueCrypt is now defunct. So this answer requires work...

TrueCrypt is what you're looking for.

Other (paid) solutions include PGP Desktop, and Jetico BestCrypt.


What are the odds of an RSA private key collision? Given the various lengths of RSA key pairs (1024, 2048, 4096) what are the odds of two users having generated the exact same private key?

First, what matters is not having two identical private keys, if either of the prime numbers is the same in the modulus (which is part of the public key), it is easy to quickly recover the full private key.

(Aside -- Brief RSA primer: In RSA for an n-bit private key, the public key is composed of an exponent, typically e=65537 and a modulus, N, which is the product of two n/2-bit prime numbers.  The private key consists of the private exponent d (calculated by d = e-1 mod (p-1)(q-1) which is efficiently found using the extended Euclidean algorithm) and the modulus, N.  The public pair allows encryption of a message, m, into a ciphertext, c, via modular exponentiation: c = me mod N, and the private key allows decryption via m = cd mod N.  This all works due to a fundamental part of number theory -- Euler's theorem and how to calculate totients).

If two moduli share a factor, then you can take the greatest common divisor of the two moduli efficiently (using Euclid's algorithm) and find the shared factor.  Let, the two moduli share a prime factor q, so N1 = p1 q and N2 = p2 q, then gcd(N1, N2) = q.  With the found prime factor, it is trivial to find the other prime factor (p1 = N1/q) and to recreate the private exponent.  A 2012 study looked at 4.7 million distinct RSA moduli and found shared factors in 12720 of them (that is 0.3% of the 4.7 million RSA keys trawled from the web are broken from their analysis).  (The paper also found several other problems with RSA in practice, like shared keys used on seemingly different entities.)

Now, choosing identical prime numbers is extremely low probability if your machine has a high amount of initial entropy and there is no flaw in the random number generation.  Both of these assumptions aren't always true; see the Debian OpenSSL problem keys from 2006-2008 and note that many people create keys for systems on brand new (virtual) machines that haven't had enough time to establish a lot of entropy.

Roughly, the strength of a 1024-bit key relies on the choice of the two 512-bit prime numbers that comprise the modulus.  By the prime number theorem there are roughly (2512/ln 2512 - 2511/ln 2511) ~ 10151 distinct 512 bit prime numbers.  From the birthday paradox, you should expect to have a collision of a prime number showing up more than once with about 50% probability, after generating sqrt(10151) ~ 1075 distinct prime numbers.  That is if some government generated a billion 512-bit prime numbers per second per computer and used a billion computers and had this run for a billion years they would only have generated about 1034 prime numbers, and the probability of a collision with some external key would be essentially zero, the same chance as playing powerball exactly 10 times on consecutive weeks and buying exactly one ticket and winning the jackpot every single time without cheating.  (It doesn't get significant chance of a single prime collision until nearly 1040 = 10000000000000000000000000000000000000000 times more prime numbers are generated).

However, as the 2012 paper shows, this is not true in the real world as RSA keys are generated by flawed methods in practice at a rate of at least 0.3%.


How can we know which debian package correct which CVE We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance :

bind9 1:9.7.3-1~squeeze11 corrects which problem ?

PTS/QA

You go to the package's QA page. For this, you either use the source package name (here "bind9"):

http://packages.qa.debian.org/bind9

Or you use the binary package name (e.g. "bind9-host"):

http://packages.debian.org/bind9-host

If you used the binary one, click on the package in a distro (e.g. oldstable)¹, then on “Developer Information (PTS)” on the “Debian Resources:” box on the right, which redirects you to the QA page.

① This page conveniently has “[ Source: bind9  ]” in the upper-left corner, which tells you the source package name for the binary package. You will need that below.

Once on the QA page, you see the “news” box in the centre of the page. This will have the changelogs for each individual upload. You click on “[2013-08-10] Accepted 1:9.7.3.dfsg-1~squeeze11 in squeeze-security (high) (Salvatore Bonaccorso)” and get redirected here which shows CVE-2013-4854. All changes of prior versions also apply, normally.

Security Tracker

Finally, there's the security tracker where you can search for source package names. (If you have only the binary package name, see above.) Entering “bind9” redirects you to…

https://security-tracker.debian.org/tracker/source-package/bind9

… where you, again, have all the CVEs and DSAs. Clicking one (either of them) will show an overview page where you see which packages fix the problems in which distros.


My local machine was infected with malware from a clients web server I have a client that I developed a new site for, it's not live yet because he wanted me to backup the old site first.  This was a completely custom "directory" type site and the company that built it (in 2003) I think, build every single module for it from scratch.

Naturally I start looking at the vast amount of folders located on the server, and what is inside of those folders. I noticed that there were some random character PHP files, and also random character files with the last part of the file name "php.jpg" and that struck me as odd.

Examining the PHP files it was very easy to figure out what kind of attach it was as the creator of the tool left his signature at the top and bottom of the files.

The image format files are what struck me as interesting, I assume they were put there as a fail-safe so if someone where to notice the infected PHP files, this attacker had a way to restore access by renaming the "image" format files.

So here's where I either got stupid, or just wanted to ensure that these image files might be legit and need to be backed up for the client.  Big mistake.  I opened one file, and Windows 10 Security Center instantly flagged it as an infection.

Here is the event log provided me regarding the threat.

Because it was a shared hosting account, with no Shell access, I wasn't able to install any linux based security tools, (clamav, rkhunter, etc).

What would you have done in this situation? Just back up the entire site, and leave the infections in the backup files, or go through and clean up the hacks?

With my developer hat on:

If the new site is "all new", including the OS, then I would not have investigated the hacked site. I would have chalked it up as a "past event".
If the new site was on the existing, unchanged server, after seeing the evidence of the hack, I would have rebuilt the server from scratch, and not bothered with understanding the details of the hack.
If the new site builds on top of the existing site, I would want to know the nature of the hack to determine how to proceed.

With my InfoSec hat on:

I would want to investigate the hack to see just how far it went and how much sensitive data may have been exposed and what on-going threat exists for the client. But that threat is informed by what data and what impact there would be if this server was hacked.

Short answer: you investigate to understand the scope of the threat and impact. If the scope doesn't matter, then there is no need to investigate (moldy bread is only a problem if you hoped to eat it, not if it is in the compost bin). But I imagine that there are things to be learned about the threats to your client, and I would investigate.

As for "cleaning up the hacks", I'm not sure of the value of doing that, but that depends on what you hope to do with the backup file. I would back up the site and tag it as having malicious files. If you hope to go into the backup files regularly, I might remove the obviously infected files.


Requiring 2 keys to access a content I need to use an external service that can only be accessed by password.

I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do.

Considering this service will only be accessed by a client (that also can't know the whole password), my idea to try to make things a bit harder for a hacker, is to store "half" of the key on the server, and "half" of the key on the client.

I know this also can't be perfect, and that someone who gets full access to the server will be able to find out the password, but it's better than nothing. (Other suggestions are welcomed.)

Considering the password changes from time to time, and that I don't want to change the "server half" of this password, my best idea so far is this:

Generate a random key K and store it on the server
Encrypt password (P) with K, generating E, and give E to the client
Now, everytime the client wants to access the service, it provides E and the server will decrypt E using K.
When the password (P) changes (to P'), I just need to encrypt it with K again and provide the new E' to the client.

Does this seems reasonable? Any other ideas?

I don't understand completely the scenario, could you provide a simple ASCII diagram?

Anyway, I don't really like the idea of giving E to the user since it will be a very hard password to remember, maybe you can do it in the other way, give K to the user (so you can choose it) and store E in the server.

I will edit my response after the scenario clarification :)


Why do the banks all use weaker TLS suites? I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues:

1) They do not offer perfect forward secrecy

2) They are still using RC4

So far, all the ones I've checked (TD, JPMorgan, CIBC, Wells Fargo, Bank of America, ING/Tangerine, RBC) use

TLS_RSA_WITH_RC4_128_SHA

Though actually CitiGroup and Goldman Sachs are using AES in CBC mode with 256 bit keys, instead of RC4, but still, no forward secrecy, and I would think GCM+SHA256 is better than CBC+SHA, even with 128 bit keys vs 256.

On the other hand, google, facebook, linkedin, and bitcoin exchanges/sites do offer perfect forward secrecy (typically with ECDHE), and unanimously use AES in GCM mode with SHA256 and 128 bit keys.

So my question: why have our banks not upgraded their security, especially given recent attacks on RC4 (though they are mostly theoretical, they do point to possible issues, and RC4 is generally considered less secure than AES)? Also, why would they not offer perfect forward secrecy? Is that an oversight on their part, or possibly for regulatory reasons?

I nearly emailed my bank about this today, but figured I'd throw the question up here first. Of course, cyber attacks on banks are all the rage these days - they ought to use the best encryption they can.

I guess the most concise answer to this question is: They are insured.

Currently industry standards don't require PFS and therefore insurances pay even if the bank had no PFS. There was a similar question on 30c3, about why the banks are using Windows XP as their operating system.

Those standards can also be a reason why banks can't implement new methods like PFS as fast as companies like Twitter, when every security measure needs to be audited and certified.

Another point would be that most attacks don't base on breaking the encryption, but on targeting the computer of the user itself.


Javascript Diffie-Hellman and AES protocols I am using the BigInteger Javascript library to create a symmetric key using Diffie-Hellman protocol. I want to create 128,160 or 192-bit keys. After some research, I have found out that I should use Diffle Hellman 2048 bits, but :

What bit-length should be the D-H parameters : p, g, a (and b) ? I am currently using p 2048-bit and a,b 256 bit, is that good ?
At the end of the protocol, I get a BigInteger 2048-bits key, how can I derive a 128, 162 or 192-bit key from it ?

I am also using Stanford Javascript Crypto library to encrypt/decrypt messages using AES-128/160/192. AES takes as argument a key of type bitArray or string.

Once I get a 128-bit BigInteger key, how can I use it with the AES protocol ?

I thought at first to convert the BigInteger key to a string key and then use it with AES but I don't think it's right. Because I don't know how the function sjcl.encrypt(key,message) convert the key when it's a string, if it converts it from a utf8String to a bitArray then the key won't be 128-bit but much more. So I think the best idea would be to convert the BigInteger key to a bitArray key. If so, do you have any idea how to to that ?

Otherwise, if you know a library that would allow me to use the DH protocol and that fit well with the Stanford library ...

Thank you for your help.

EDIT : I am not inventing my own crypto, I am implementing the HCBK protocol, which provides authenticity.

What bit-length should be the D-H parameters : p, g, a (and b) ? I am currently using p 2048-bit and a,b 256 bit, is that good ?

DHKE is based on the discrete logarithm problem (same as DSA and ElGamal), so the size should be fine.

  At the end of the protocol, I get a BigInteger 2048-bits key, how can I derive a 128, 162 or 192-bit key from it ?

I have to admit that I'm not 100% sure. If you want to be safe, hash it and then take 16 or 24 bytes from the output of the hash function. Or see below.

  Once I get a 128-bit BigInteger key, how can I use it with the AES protocol ?

The Stanford Crypto Library actually exports a high-level encrypt function (see sjcl.json.encrypt), which takes as arguments a ciphertext and a password. You could simply pass in the whole 2048-bit key from the previous step as a password. This also handles block modes and generating an IV for you.

Please note (and the only reason I'm answering is to tell you this), that you're doing everything wrong. First of all, you are running your own crypto(-graphic protocol). Diffie-Hellman, in schoolbook mode, isn't safe though. Moreover, JavaScript crypto isn't safe. Secure delivery of script requires HTTPS, and if you have HTTPS, you probably don't need more crypto.

Please read all of the links and think twice, before you run crypto in production.


Different Microsoft-signed excecutables have apparently the same signature! On Windows 10 systems, I found two versions of bootsect.exe (a Microsoft-supplied utility that writes disk boot sector) with different hashes (SHA-1 9b7463c79460a55a36b53bee0889f894b2379ec3 for one 67ea7b4a6d73831600a141f053139b33fe90f1d8 for the other), but on the surface of it the same valid Microsoft signature dated 2015-10-30.

Closer analysis of the property / digital signature tab reveals

same date of signature shown (2015-10-30 03:32:09 UTC after translation from my locale)
same signature shown (serial number, hash, dates..)
different countersignatures:

validity period 2015-10-07 18:17:29 to 2017-01-07 18:17:29 UTC and OU = nCipher DSE ESN:98FD-C61E-E641 for one
validity period 2015-10-07 18:17:40 to 2017-01-07 18:17:40 UTC and OU = nCipher DSE ESN:7D2E-3782-B0F7 for the other (likely related to the timestamping HSM used).

Using a hex editor, I see in particular these differences

at offset 0x148..0x14A (sole difference until after 92% of the file, where signature and countersignature seem to live)

06 33 02 for one
33 DF 01 for the other

a date string with initial length byte, mostly matching date of signature as shown in user interface

20151030033209.248Z for one
20151030033209.24Z for the other

date strings with initial length byte matching countersignature validity period as shown

151007181729Z and 170107181729Z for one
151007181740Z and 170107181740Z for the other

Questions:

Why are they two versions of this utility ?
What are the operational differences between these?
What's the likely reason of difference (1.)?
Would not it be trivial for the signed program to act differently based on that (or the different countersignatures), defeating one of the purpose of the digital signature?
What can be the exact role of the date strings in (2.), and why do they differ in size? Are they supposed to be related to software build, signature date, or countersignature date?
Why do the validity periods in (3.) differ by 11 seconds, when the date strings in (2.) differ only by 8/1000 seconds?
Why is there no century in the internal definition of the validity period? Is that allowed by X.509 or whatever standard defines the (counter)signatures? Is not that a risk that a (counter)signature becomes valid again in year 2116?

Some questions can be answered, other are speculative.

X.509 relies on ASN.1. ASN.1 defines two data types for dates, UTCTime and GeneralizedTime. UTCTime has only two digits for the year, so it is not Y2K-clean; it was defined in the late 1980s out of what can only be described as a consummate lack of foresight. It was temporarily fixed by defining that UTCTime really covers years 1950 to 2049, making the interpretation unambiguous. Dates beyond 2049 shall use GeneralizedTime, which has four year digits and is thus fine until December 31st, 9999.

Therefore, the two-digit years are a symbol of incompetence, but not a security issue stricto sensu.
The GeneralizedTime format (with four digits for the year) can contain fractional seconds, indicated by a dot followed by extra digits. The number of extra digits is theoretically unbounded; however, upon encoding, trailing zeros are supposed to be removed. If you see "20151030033209.248Z" and "20151030033209.24Z", then these dates were measured with (at least) millisecond precision, but in the latter, the number of milliseconds was "240" and the trailing zero has been removed.
Usually, signature and time stamping are done by distinct machines; the time stamping is performed by a dedicated Time Stamping Authority whose job is to maintain an accurate clock. Time stamping is often delayed. In your case, you see that the time stamping occurred four days after the signature.
I find some reports that the two versions of bootsect.exe correspond to two different builds of Windows, called "10.0.10586.0 (th2_release.151029-1700)" and "10.0.10135.0 (winmain_prs.150531-1700)", respectively. According to this site, the latter is an internal Microsoft build that was leaked on June 6th, 2015, but was not meant for release and is thus relatively rare in the wild.

From these information, I infer the following: within the Microsoft build process (which is probably quite intricate), two versions of bootsect.exe were compiled at the same time, differing probably only in the "build number" (I suppose your bytes at offset 0x148 are part of the build number) and signed in short succession (8 milliseconds between the two signatures). The two builds might correspond to a "stable" and a "development" versions with different building options, but integrated within the same compilation process. These two versions were then scheduled for time stamping, which occurs elsewhere, on another machine, with its own queueing. The two time stamps were performed a few days later, with an 11-second delay between the two files -- one has to imagine that the queueing is not fully "in order" and files which where queued in short succession may be handled at different times.

It is improbable that the two files behave differently. The signature uses Authenticode, which covers the complete file except the few fields that cannot be logically part of it, i.e. those for the signature and certificates, and the header checksum. It is possible for a signed executable to inspect its own binary and leverage a one-byte difference in the header to change its behaviour, but this is quite artificial: the code has to do it on purpose. Signatures are supposed to protect against malicious alterations of honest files, not against shifty executables that try to perform underhanded trickeries.

My conclusion is thus that your two bootsect.exe correspond to two distinct builds that happened to be done concurrently within the Microsoft compilation process, and for two versions of the source code that are, in fact, identical, thus leading to the same behaviour. The two files were signed in short succession, time stamped a few days later independently of each other, and one was part of an official release while the other was an internal build that got leaked.


Is it secure to send a RSA-wrapped symmetric key along with the payload it was used to encrypt? Given key K, salt Salt which is 32 randomly generated bytes is used to derive keys EKey and AKey using HKDF-SHA256.

A Ciphertext is produced using AES-256-CBC with key EKey and a random 16-byte iv Iv.

An Hmac is produced using HMAC-256 with key AKey.

This is encoded as the following.

Salt . Iv . Ciphertext . Hmac

My question is, can I RSA encrypt key K and append it to the encoded string such that it remains secure?

Edit 1

I'm not entirely sure how to respond to Rory's comment, so I'll give my best shot.

By secure, I mean being able to transport this payload over the wire without having a third-party (without the corresponding private RSA key) able to decrypt or mutate the payload.

This approach may also be used for data at rest.

Yes, you can send an encryption key with any crypto algorithm as long as you apply the necessary security requirements.

For example; there is a small encryption exponent problem in RSA, to cope with it you have to apply some padding as stated in PKCS#1

note: Storing the RSA private key securely is equal to storing the 'K'?


What are you doing if you notice a MITM attack against a Linux server? I got this question at a job interview, but I did not know the answer. I think they expected some shell command or packages, which can help react to the attack.
Assume that, you are a system admin and you work for the Nokia Networks. This server store customers details and communicate with them when a customer want to report a problem or bug through the global and 2 internal networks. The attackers are using DNS-poison and they can also start the attack from the internal network, but these details were not specified.
I know it could be a linux question, but actually it is connecting to the IT security too.

If you notice that someone is actively man-in-the-middling a server the first thing you should do is inform your incident response/security team.

They should decide on mitigating controls, that's their task. It's highly dependable on what technology is being MiTM and in  what way. It also depends largely on where the MiTM is occuring. Aside from re-adjusting routes to go across another network, there's not much you can do.


Why aren't there large-scale attacks on BIOS and UEFI I was reading the new and I came across this article . I have not spent lots of time reading the paper the article referred to but I pretty much agree with the fact that people rarely update their BIOS and since it does not get updated regularly it must be vulnerable to attacks.

However there is not known similar attacks, at least on large scale in spite of all the sophisticated attacks we hear about these-days. What is the article (and I) missing? what is stopping such attacks from happening?

There are EFI attacks that have wide-scale impact (in the case of the linked document, apparently to all Mac laptops not running a recent system update).  Attacks on firmware have occurred in the wild as well.  In short, such attacks are possible and are probably happening; it just might be that not many people are talking about them.


Kerberos Authorization host/service by host/service basis I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts?  I am currently using LDAP for /etc/passwd /etc/group, providing the userPassword entry as a '!!' to disallow login by default.  And Kerberos is serving up authentication.  It would be nice if all the hosts could use LDAP, while providing lists of users they do not (or do) wish to give authentication via Kerberos.. If this is not possible, how would you recommend I do this?

When I installed the KDC, I was under the impression that the kerberos ACL would allow me to specify where (which services/hosts) specific users could get tickets.

This is more a solution to what I'm trying to accomplish than an answer to the question I asked.  If somebody has a more direct answer to the question asked, please contribute it.

Thanks to the good people at CERN and Ubuntu for getting me on the right track:
http://linux.web.cern.ch/linux/docs/account-mgmt.shtml
https://help.ubuntu.com/community/LDAPClientAuthentication

Apparently the package nss-pam-ldap for using LDAP in the NSSwitch for providing /etc/passwd allows to do some filtering or overriding of values (though I haven't tried this yet).  This could be useful if normally your LDAP users' homedirs are on NFS, but on a specific host, you want them to have local homedirs.

nslcd.conf
    # Set the user homedirectory to /home/$USER
    map    passwd homeDirectory    "/home/$homeDirectory"

Or map to nologin for maintaining correct file permissions on an NFS server (without allowing LDAP users a shell)
# Set the login shell to /sbin/nologin
map    passwd loginShell       "/sbin/nologin"

Some basic filtering
# Only get users from group 1160
filter passwd (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*)(gidNumber=1160))

More stuff can be done with the ldap configuration itself (/etc/ldap.conf or /etc/openldap/ldap.conf), for instance adding a user attribute: host to the LDAP users, where you have a host attribute (with hostname) for each host the user can access, and lines like this:
nss_base_passwd ou=Users,dc=example,dc=com?one?|(host=thehostname)(host=\*)

For more info, just follow the links I posted at the top, and if I have some time to get all this stuff working in a way I appreciate, I'll try to clarify this answer a little bit.

EDIT: the main website for the nss-pam-ldap package is here:arthurdejong.org/nss-pam-ldapd/ it has some documentation for the nsldc.conf file


Disable RC4 ciphers best practice To be compliant with security best practices, we have a requirement to disable RC4 ciphers.

I have investigated a way to achieve this and, found that I can disable it by editing the registry keys.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
“Enabled”=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
“Enabled”=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
“Enabled”=dword:00000000

Also I have found that I can remove the cipher suites that contains RC4 by editing the GPO,  Computer Configuration > Administrative Templates > Network > SSL Configuration Settings,

My question is: What is the best way to remove support for a ciphers.  By deleting all the cipher suites that contain the cipher in the GPO or the only way to remove support for a cipher is via modifying the keys in regedit.

RC4 is an algorythm, not some piece of software. It's the same difference between an idea and a book: you can attempt to suppress a book that carries a specific idea but you cannot suppress the idea itself.

Likewise, you cannot globally disable RC4 with a registry edit. At best, you will instruct software that reads that registry key not to use RC4.

Specifically, what you're doing with this registry entry (the GPO is just a way to propagate a registry edit to a domain) is instruct software that uses the Windows secure channel API for establishing a TLS/SSL connection from using it by default. Software that do not use SChannel or software that do not let the SChannel subsystem auto-negociate an SSL connection will not be affected.

For instance, setting these registry entries will prevent an IIS web server from using the RC4 cipher but will do nothing about a Tomcat server.

Conclusion: it is impossible to globally prevent the use of RC4. You should refocus your question by specifying exactly what software you want to restrict. Such a question would be more suited, however, to serverfault.com or superuser.com


How does the authorization work after authentication using OpenID Connect Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token and ID token). To my understanding, application server now has to contact the auth server to validate these tokens. If tokens are valid, the application server accepts the request. Otherwise, the request is rejected. Is this correct?

The main issue I have with this setup is the requirement to contact auth server for every request. Is there a standard way to avoid this? Is it possible to use a secret key (known to both the auth and application server) to validate a signature - similar to JWT. In this case what is the difference between OpenID Connect + OAuth2 and JWT?

You only send the access token to the application server, the ID token is kept in the client.  And there's no reason why you cannot use a JWT as the access token. In this case, you can check the signature on the application server using the authorization server's public key.


How do attackers gather remote feedback for identifying and exploiting buffer overflows? Local buffer overflows are relatively easy to understand: throw some input at an interface and see if the process fails with a core dump or similar.  However, in my mind, this kind of exploit works well only when the attacker has had unlimited access to test the interfaces and see how their input affects the process.

However, for things like locked-down appliances (firewalls, proxies, etc.), high-end commercial-grade servers, or specialized software where an attacker cannot easily acquire it to play with, how does one successfully gather the feedback necessary to mount an successful attack?

(I realize if the asset is of sufficient value, a motivated attacker will purchase such a specialized device, but I'd like to know -- in theory -- how it might be done without local access.)

Edit: I'm also assuming the attacker does not have access to a generic remote shell.

You mentioned the most common answer in your question - for things like firewalls, proxies, high end servers etc., attackers will acquire them. They may then lease out shells for practicing. The market in this side of things is incredibly professional and well organised, with entire trading platforms set up to manage tiers of researchers and exploiters.

The route when an attacker does not have access is educated trial and error - for example the attacker may know that an appliance is based on a particular OS, so makes some educated guesses at stack sizes etc. to build a remote shell exploit and NOP sled of a size that may work and just try it and see if their exploit code returns a shell.

If at first nothing happens - try again.
If the server fails to respond - they may be close, but causing a problem - try again
If the shell is created - profit!


What is estiamted risk of corrupt public officials accessing survivelance and cloud data in UK? If company Trade Inc setups cloud email and cloud server and also uses mobiles and business broadband, if the owner of the competing company let's say RougeTrade Inc. has friends in UK police, he may get to know what Trade Inc is doing for example:

Log of his company broadband
Metadata of calls and texts from his mobile
Access data and databases stored in cloud

And that's assuming Trade Inc has nothing illegal but values business secrecy a lot because he values his customers and as it's in the trade, the competition can be reckless.

My question is what is the estimated and realistic risk of RougeTrade Inc getting onto the police data? I think that would be the factor of basically having:

Official permission to access this data, so no random person from govt can access it whenever he wants
Audited access who and what and when, so no access can be made without being logged
Protection against rouge suggestion or reason to access this data by the police, which is basically court order

And also there's problem with these two:

Surveillance data
Cloud data

And also assuming that Rouge Inc could be:

Privately owned company
State owned company

I am asking because I am planning a setup for the customer who is not sure whatever he should have Cloud on his own including Email (he has mail there already and it's working OK) or should he move to business Gmail and Public Cloud.

The Trade Inc also processes lot's of confidential documents from customers and collects them into large library. As the security of this data is assured the main problem comes from compromising the cloud itself and basically copying all data with encryption keys.

My fear is that if it's currently small company it may not be taken seriously and there could be several breaches using government agencies as proxies which is not so uncommon after all.

This questing reminds me of one of my most favourite quotes - Quis custodiet ipsos custodes meaning - "Who will guard the guards?" So basically, what I mean to say is, since you're making the assumption that the police have access to all the business data, there is absolutely nothing stopping RogueTrade Inc from acquiring that data via illegal means. The Govt. is run by people, and that makes it vulnerable.

How probable? Or what is the estimated risk? That's a range - all the way from pretty low to extremely high.

My suggestion - use a cloud service from a place that won't leak your information to your police. For example, Nigeria! I doubt Nigeria has great ties with UK, but I may be mistaken. You see what I mean.

There is nothing stopping you from using a cloud provider from overseas, and international law is really messy. Unless Trade Inc. is an extremely big organised-crime or related company that attracts the interest of the feds and Interpol, you should be fine.

But then again, only use a provider that you trust.

I hope this helps!

EDIT: I would also like to add that there are other ways the data might leak. Ever hear of corporate espionage?


Which Master degrees offer the most web application security courses? I need some information about universities that offer Master degree in Information Security with an emphasis on web application security Specifically things like web application penetration, code review course, defending web applications, etc.

I think your best bet is to build your own master's - I don't know of any programs with that specific focus.  My strategy would be to hunt down universities that are strong in both Info Security and Software Engineering, and then work out a program with your adviser that combines the two.

I could be closed minded, but IMO, you're not going to get enough material specifically on web app security to form an entire degree.  You're going to have to branch out either into web app development or general Info Security.  Also, in terms of careers, you probably need more than just web app security and either being a solid web app developer, or an overall InfoSec guy with a strength in web apps will give you a broader base for the job hunt.


Does sslstrip work only on websites which use both HTTP and HTTPS? Does sslstrip attack only work on websites which uses both HTTP and HTTPS? On Quora a commenter says that:

  One thing to note is that, SSL Strip only works on websites which uses
  both HTTP & HTTPS. For example, Ebay, where the main page is over
  HTTP, but then it transfers to HTTPS for the login, purchase & so on.
  In order to defend against these attack, it is advised to use SSL
  throughout the site, in other words to use only HTTPS and not HTTP.
  Another way is using HSTS (Strict Transport Security), this will
  command browser to connect only through HTTPS and never via HTTP.

But I know that Google is not using both HTTP and HTTPS; they are just using HTTPS and also using HSTS header against sslstrip attacks. Does that mean that the comment above is false? I mean is SSLStrip attack still possible against a website that is only using HTTPS?

SSL Strip only works on websites which uses both HTTP & HTTPS.

That's not accurate because it implies turning off HTTP support secures against the attack.

The point is that sslstrip steps in when the user requests a site over plain HTTP first. It's about how the browser attempts to connect to the server, not what the server supports. You're only safe if the browser doesn't attempt a plain HTTP connection at all (because of a HSTS directive it has seen earlier or because the website is in the browser's HSTS preload list).

  I mean is SSLStrip attack still possible against a website that is only using HTTPS?

Yes. Let's say https://yourbank.example/ doesn't serve anything over plain HTTP. Now, I send you a link to http://yourbank.example/ anyway. When your browser attempts the plain request, I use sslstrip to intercept it and respond with a phishing site. As you see, it's irrelevant if the original site would have served any content over plain HTTP because I don't forward the request anyway.


Pronounceable Password Generator I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found it remarkably well to remember. Even after all this time (and I don't have to type that password that often), I can remember and type it without making any mistakes and without having to think about it too much. It is a completely nonsensical sequence of letters, but it basically follows the pattern of alternating between consonants and vowels, which I guess makes it so easy to remember (at least for me).

However, as I already suspected it back then and as is mentioned in this question, generating passwords online might be insecure. But I am not really sure what else to do, as I haven't found something similar which works locally.

So my question is, is there any tool that produces the same kind of passwords in a secure way?

Step 1: Find a large dictionary file

Step 2: Feed that dictionary file into a RNG written in python or any other scripting language.

Step 3: Concatenate four random words in this manner.

Step 4: You got your secure and pronounceable password.

Obligatory XKCD.

See also: Diceware.


JInitiator is obsolete and I should reject it on grounds of security, right? I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as substitute Oracle Forms clients.  JInitiator is an old JRE version put out by Oracle to get around bugs in early versions of the Java browser plugins.  Oracle ended support for it in 2008 and advises against using it.

We keep patching the JRE on the desktop and this disrupts business each time because it blows away required dlls that currently live in the JRE/bin folder.  We have a ready solution to this problem: Oracle forms server can be configured to drop the dlls in another folder.

I wanted confirm my thoughts about JInitiator:  It is an ancient version of the Java browser plugin that probably has many of the same flaws as the current Java browser plugins.  Just because there aren't any CVEs on it doesn't mean it is safe. If it got the same attention the Java plugin is getting it wouldn't stand up.

Thank you for your attention whether you back me up or not.

JInitiator is based on Sun (now Oracle) JVM implementation, so it is a safe bet that every single vulnerability which was in Sun/Oracle JVM before 2008 (when the last JInitiator version was produced) but discovered only afterwards applies to JInitiator. Lack of CVE only comes from disinterest on the part of people who fill CVE (there is no glory in pointing out security flaws in a product which has been discontinued five years ago).

Note that some vulnerabilities are novelties, e.g. the one described on this page uses a feature introduced with Java 7 -- it would not work on JInitiator. You may want to go through this list: vulnerabilities which were discovered after 2008, but impact JRE 1.3 and later, have a high probability of impacting JInitiator as well. You only need to find one working exploit demo to have a convincing case that JInitiator should be rolled out ASAP.


Any security reason to keep PHP short_open_tag off? I recently found a couple of PHP server where short_open_tag is set to off.
I would like to know if there is any security reason to set short_open_tag off.

There are security reasons for never using short tags in your code.

Your code could easily end up on a server with short tags off, through a migration or perhaps some misconfiguration. If you have been using short tags to mark what is PHP code and what is not, suddenly your PHP will be interpreted as content and served as is. That could leak all sorts of secrets.

But does this mean you should turn the feature off? On the one hand, it's a great way of stopping your developers from using them. On the other hand, if you move in code from somewhere else it exposes you to the problem mentioned above.

There is discussion within the PHP community about deprecating short tags.


Asymmetric encryption and signature performed by hand There are some methods of encryption so easy that you can do them be hand,  but is there an easy(ish) method of private & public cryptography and signing that a human can perform it by hand? The human doing the cryptography has paper & pencil.

Edit: Assume that there is no MITM attacks (all the keys that are obtained is legit)

James Ellis at GCHQ came up with a pen-and-pencil example of public key cryptography, something he called "non-private encryption."  He intended it as an illustration of a public key system.

The gist of his system is something like this:  You start by creating a lot of short riddles, each having a unique solution, which could for practical purposes be mathematical equations.  For each of these riddles you create an encryption key.  The intention is that the solution to the riddle is the ID of the key.  The full list of (riddle [ie. key ID] / encryption key) is posted somewhere public.

When someone wants to send you a secret message, they pick a pair at random.  They solve the riddle, to get the key ID.  They can then encrypt the message they only want you to see, by using the key they chose from the list.  So that you can decrypt the message, they note the key ID somewhere in cleartext in the letter head.

The secrecy of this system depends on the number of riddles, and the time it takes to solve each one for the key ID (an attacker with the all key IDs can simply look up the key).  For instance, if you have 10,000 pairs, and each riddle takes a day to solve, it should last about 30 years against a single attacker.

References:

http://cryptocellar.org/cesg/ellis.pdf
Steven Levy: Crypto: Secrecy and Privacy in the New Code War


Is using htmlentities or htmlspecialchars functions enough to block XSS attack I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/htmlspecialchars is related when we embed as attribute value like

<a href="" title="<?php echo htmlentities([XSS_CODE]) ?>">

OR

<img onerror="<?php echo htmlentities([XSS_CODE]) ?>" />

But if I need to show data as content like below.

<?php echo htmlentities([XSS_CODE]) ?>

How it could be insecure. As code will not have trigger/events just like in case of attributes have, This should safe in all cases.

I studied https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet .
Almost all examples for XSS attack/filter bypass not works for given case. I tried hex encoded value of < & > as given in last para of url, But that again failed and displyed simply as data.

I actually have doubt over https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Character_escape_sequences which have some combination which not handled by htmlentities like \x3c, \u003c, %3C. While I myself unable to produce and exploit using them.

I tried example like

$code = "\x3cstrong\x3eHello World\x3\cstrong\x3e";
// OR
$code = "\u003cstrongu003eHello Worldu003c\cstrongu003e";

<?php echo htmlentities($code); ?>

Note : I tried all attacks on Firfox 40 in Ubuntu machine.

htmlentities is the better function to use as it encodes all possible characters.

The only way I can see XSS being achieved in your example is with Internet Explorer if the charset is set to UTF-7.

If your charset is UTF-7 then

+ADw-script+AD4-alert(document.location)+ADw-/script+AD4-

becomes

<script>alert(document.location)</script>

when interpreted by the browser. Additionally, htmlentities does not cause any encoding of the characters.

Bear in mind that only old versions of Internet Explorer will auto detect UTF-7 - it would need to be explicitly set in modern versions (either by the website author or by the attacker using some other vector) - see this answer.


Generate Subject Key Identifier by hand using openssl command sequence When creating a signed certificate I get the lines inside the
certificate that identify the keys used:

  X509v3 extensions:
     X509v3 Subject Key Identifier:
         D8:D7:3F:99:CC:D7:20:AF:62:31:E2:EA:2C:8C:28:8C:B8:2F:0B:96
     X509v3 Authority Key Identifier:
         keyid:D8:D7:3F:99:CC:D7:20:AF:62:31:E2:EA:2C:8C:28:8C:B8:2F:0B:96

Question: Given the CA key and the server key, is there a openssl command sequence with which I can generate the Subject Key Identifier and the Authority Key Identifier by hand?

From http://certificateerror.blogspot.se/2011/02/how-to-validate-subject-key-identifier.html.
Extract SKI from cert:
#!/bin/bash
openssl x509  -noout -in $1 -pubkey  | openssl asn1parse  -strparse 19 -noout -out - | openssl dgst -c -sha1

Extract SKI from key:
#!/bin/bash
openssl rsa -in $1  -pubout | openssl asn1parse -strparse 19 -noout -out - | openssl dgst -c -sha1

openssl x509 -pubout extracts a public key from an x509 document.
openssl asn1parse decodes an ASN.1 object and performs any chosen operations on it.
-strparse 19 skips the first 19 bytes, a magic number. Typically the public keys is in PKCS#1 format. So for an RSA public key of 2048 bits it starts with 4 bytes of SEQUENCE, 2 bytes of SEQUENCE, 11 bytes to store the OID 1.2.840.113549.1.1.1 meaning rsaEncryption, 2 bytes for a NULL terminator on the sequence. That is 19 bytes, which starts the BIT STRING data structure and continues to the end of the data.
openssl dgst produces the digest of the input using the chosen output format and digest algorithm


How is PayPass/payWave secure when PIN is required after presenting the card to the contactless terminal? The popular claim is that a chip-and-PIN payment card is more secure than a card with magnetic strip because the card data is hidden deep inside the chip and the ATM or POS terminal sends the entered PIN into the card for confirmation (or rejection) instead of reading the correct PIN from the card and comparing it with what the user entered. So as the data is not exposed it cannot be copied and this prevents various fraud scenarios.

Now meet PayPass/payWave contactless payment technology which is now embedded into numerous new chip-and-PIN cards. You can briefly touch the terminal with such a card and the field of the terminal induces current in the card circuitry, the card turns on and runs an encrypted radio exchange with the terminal - all in fractions of second. That's all it takes if the purchase sum is small enough (which means under USD 30 in most cases). No problem - the encrypted radio protocol still allows the "is this one correct" validation style exchange.

What happens if the purchase is not "small enough"? Here's a promotional YouTube video that shows what happens. The buyer touches the terminal with his card and takes the card away. The terminal prompts for the PIN. The buyer enters the PIN and the terminal somehow validates it.

How is the PIN validation secure in the scenario when the PIN is being entered when the card is no longer connected to the terminal?

Okay, it could have obtained the PIN from the card when the card was close to the terminal and compare it after the buyer entered his version. But it implies that the card gives the PIN away instead of doing the "is this PIN correct" style validation inside its chip.

The PIN is verified online with the bank - see the footnotes on this page http://www.maestrocard.com/gateway/about/about_maestro_paypass.html.  The card does not tell the reader the PIN number, it tells the reader its identity details (such as card number).  If required (due to high price of transaction), the reader makes a (presumably secure) connection to the bank, prompts the user for their PIN, and does the verification across the network.


Nessus scan reports a Dropbear vulnerability on a machine that does not have dropbear installed Scanning a machine on a local network (it is the only machine scanned, and is running Red Hat Enterprise Linux 7.4) and Nessus reports a vulnerability present in an outdated version of Dropbear SSH installed on the machine. The machine has OpenSSH but not dropbear. Here is the full text of the error:

Dropbear is an SSH client and server application. Versions of Dropbear SSH server prior to 2016.74.0 are potentially vulnerable to the following vulnerabilities :
A format string flaw exists that is triggered as string format specifiers (e.g. %s and %x) are not properly used when handling usernames or host arguments. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7406) - A flaw exists that is triggered during the handling of specially crafted OpenSSH key files that are imported via 'dropbearconvert'. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-7407) - A flaw exists in 'dbclient' that is triggered during the handling of '-m' or '-c' arguments, as used in scripts. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7408) - A flaw exists in 'dbclient' or 'dropbear server' that is triggered when compiling with 'DEBUG_TRACE' and running with '-v'. This may allow a local attacker to gain access to process memory. (CVE-2016-7409)

I have a suspicion that the error is a slight red herring and some other package on the system exposes one of the mentioned vulnerabilities, and the report persists after ensuring all installed packages are up to date. Can anyone shed any light on this and suggest a fix? It is possible that I do have dropbear or something that includes it as part of the RHEL distribution but cannot see it in the package list (using yum) nor is it present in the base RedHat repository.

To help anyone who comes across this with a similar issue:

After attempting to SSH to the machine being scanned with putty, it was clear that the machine refused SSH access due to sshd_config not allowing root access.

The putty event log showed that the server was reporting an outdated dropbear version in the banner message, which is what caused the scanner to raise this error.

You can double check that the scan did actually successfully connect to the machine by checking plugin 19506 and verifying that 'Credentialed checks' reports a success. Also check that the machine you are attempting to connect to is properly configured and allows SSH connections.


Bettercap sniff HTTPS login credentials using proxy I was wondering how I could sniff HTTPS credentials using the Bettercap proxy.

I am using the following command:

bettercap -I wlan0 -T 10.0.0.23 -X  --proxy-https

And when I setup the proxy on my android (In WiFi settings), with the address as 10.0.0.1:8083, I can see when the phone authenticates with my WiFi.

HOWEVER, I can't see any credentials showing up when I log into FaceBook, Instagram etc. In fact, there isn't anything on the terminal except when my device connects to my WiFi.

Am I missing a command line argument?

Bettercap tool using HSTS technique to bypass https sites, and this type of attack work only for sites not listed on the preloaded list.

You can check the list here.

If you are trying to sniff the traffic of facebook or google apps( such as Gmail, Instagram,...) it's didn't work, even if the client uses the application or the browser, because of the preloaded list listed on the browser, and the certificate embedded in the applications.

Try to open facebook on internet explorer, it will work fine because IE browser does not use preloaded list.

You can create an https proxy with SSL root certificate and install this certificate to your phone, then you can decrypt HTTPS traffic.

https://www.trustwave.com/Resources/SpiderLabs-Blog/Intercepting-SSL-And-HTTPS-Traffic-With-mitmproxy-and-SSLsplit/


Can key cipher and TLS cipher differ in OpenVPN? I know how to configure OpenVPN and that there are control and data channels. But I did not yet find a nice overview of the crypto processes and especially how keys and certificates are really used in OpenVPN.

I wonder if it's possible to e.g. have an ECC server key and still enforce an RSA TLS cipher. Does the TLS cipher use the server/client keys or are they only used for authentication and TLS generates random private keys according to the negotiated cipher?

Most of your question should be answered here:
OpenVPN -cipher vs -tls-cipher?

Still, because your question is slightly different focussed, let me provide you a simplified list of steps performed in an OpenVPN connection setup, and which keys are used where:

The client connects to the server.  If tls-auth or tls-crypt is used, this packet and all following control channel packets are authenticated or authenticated-and-encrypted with this key by both parties.
The client and server perform a TLS handshake over the control channel.  Both use the key, cert and ca keys for the TLS authentication.  The server uses the dh parameters if an DH(E) cipher suite is used.  TLS uses one of the cipher suites allowed by the tls-cipher option.
Over the TLS secure channel (which has it's own encryption) OpenVPN performs the OpenVPN key exchange.
The keys resulting from this OpenVPN key exchange are used to encrypt-and-authenticate data channel packets (the actual virtual network packets).  The data channel uses the encryption and authentication methods specified by the cipher and auth options, or a cipher negotiated over the control channel, which is one of the ciphers in the ncp-ciphers option (the latter is OpenVPN 2.4+ only).

This means that the keys in key, cert and ca are used only by TLS, and in the same way that TLS (or, the TLS library) does.  The TLS ciphersuite specifies the authentication type of the server.  So if you only allow RSA cipher suites, the server must have an RSA privkey/cert, but the client may still use a different certificate.


XSS - Bypass this RegExp How could this anti-xss regexp be bypassed: /<(?:\w+)\W+?[\w]/

I am working on it but I can't find a way.

Just to be sure that I have understood it correctly, this regexp search for a pattern with a '<', then one or more characters, then one or more non character and then a character.

Right?

EDIT:
Here is the code:

<?php
$xss = $_POST['xss'];

if (preg_match('/<(?:\w+)\W+?[\w]/', $xss)) {
     echo '
I don\'t think so
';
} else {
    echo $xss;
}

It really depends on how you use this regex. I'll use PHP code as an example:

Unsafe Example: Replace

echo "replaced: " . preg_replace('/<(?:\w+)\W+?[\w]/', '', $_GET['input']);

This would not be safe. Example:

input=<alert('xss');</script>

This is because your regex does what you think it does: it searches for < followed by one or more alphanumeric character, followed by one or more non-alphanumeric characters, and then a single alphanumeric character.

So in the above attack string, <a|a (another example for clarity: <aaa|||z) matches exactly this and will be removed. Thus, the remaining string is


logging available client side cipher suites from Apache tomcat? When planning to remove a cipher suite, is there a way to log what cipher suites are available to the clients that talk to my web server?

The idea is to know in advance that before some cipher is removed,
if I need to install new ones and which ones.

basically I would like to be able to sample out some of the requests coming into an Apache tomcat web server and log the cipher suites supported by the client making the request.

If that is not possible, then would it be possible to know what cipher suite is used in the current HTTPRequest ?

Yes, you can crank up Tomcat logging to include that information using the javax.net.debug system property.  That will allow you to get this sort of output, which includes the cipher suite proposed by the client:

*** ClientHello, TLSv1
RandomCookie:  GMT: 1073239164 bytes = { 10, 80, 71, 86, 124, 135, 104,
151, 72, 153, 70, 28, 97, 232, 160, 217, 146, 178, 87, 255, 122, 147, 83,
197, 60, 187, 227, 76 }
Session ID:  {}
Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,
SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]
Compression Methods:  { 0 }
***

Parsing Tomcat logs is one of those joys that ranks up there with dentistry, but of course it can be done, and will provide you a census of the cipher suites your clients are connecting to you with.

Alternately, running tcpdump (or equivalent) captures with a filter that will capture ClientHello messages will give you a store of raw data to mine. The following filter will capture just the ClientHello messages:

tcpdump -s 0 -w client_hellos.pcap 'port 443 and tcp[((tcp[12:1] & 0xf0)>>2):1] = 0x16 and tcp[((tcp[12:1] & 0xf0)>>2)+1:2] = 0x0301 and tcp[((tcp[12:1] & 0xf0)>>2)+5:1] = 0x01'


Classification of attacks in network specially in Snort IDS What are the main classification of attacks in network and specially in Snort IDS?!
Is it possible to power up the Snort by classifying the attack into for 5 main groups, for example; R2L, U2R etc.
What snort does in detecting the attack?

All snort rules are categorised. Please see here - http://blog.snort.org/2012/03/rule-category-reorganization.html.


Is it possible that my home router is preventing my ARP poisoning attack? As part of a school project I am trying to do a MITM attack on my local network using ARP poisoning. I choose a target and then I send a spoofed ARP packet to it and to the router every 100 milliseconds. The spoofed ARP packets are ARP responses, which are supposed to make the target believe I am the router and make the router believe I am the target. This is supposed to make the router send me anything it wants to send to the target, and make the target send me anything it wants to send to the router.

When I tried it on my school network, I had no problems and everything worked as it should. But when I tried it on my home network, it didn't work. When I checked why, I saw that all of my spoofed ARP packets are getting sent, but only the target is affected by them and sends me its packets. The router continued to send its packet to the target, ignoring my spoofed ARP packets.

Now my question is, is it possible that my router somehow detected my ARP spoofing attack and ignored it? How likely is it that a home router is capable of ignoring an ARP spoofing attack?

Yes.  See this question related to the same subject but confused about the very feature you are questioning.  Is that possible? A router with arpspoof from factory


Site hack with email phishing scam We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a third party IT company looking into it and we can't find out where the breach is.

There seems to be no suspicious access on the database, and none of the website code seems to have been altered.

There are also no new admin users and no unexpected logins from existing user profiles in the logs. We have changed all passwords we can think of but they still seem to be able to get the order details. This guy had the same problem back in April (exactly the same, even the same name used Lucy Whetton) but he hasn't posted what the solution was.

Email phishing scam asking customers for card details

Does anyone have any ideas?

By the way, we have and are contacting all customers immediately to tell them not to respond to these phishing emails.

If you can't find the entry point of the hackers, and a "third party IT company" can't find it either, consider hiring a professional security firm to investigate the attack.

This is not an appropriate forum for product or company recommendations, so please don't ask specifically "who" to hire.

I have found that people who present at security conferences often work for reputable security firms, so you could start your searches there.  Many places have regional conferences which might be better suited to offer you local assistance; there are national conferences, and even international conferences, all of which would provide access to many professionals.

Another approach is to contact your local law enforcement.  While they likely won't have the resources or ability to investigate the hack directly, they may put you in contact with a national law enforcement agency who might have more resources; they might also offer the names of reputable security investigators you could hire.


Can malware spread via bluetooth file transfer in Android? I am aware of some malware that spreads when two devices are paired using Bluetooth; but can malware spread when sending a clean file to someone or receiving it via bluetooth ?

If so, does it need some action from the user to start the malicious code ?

can malware spread when sending a clean file to someone or receiving
it via bluetooth ?

As you mentioned, malware uses pair-wise  communication mechanisms such as Bluetooth to spread. But whether the file you want to send is clean or not does not prevent you (or the destination deice) from being infected because one of the common ways that malware uses to propagate is to   exploit  vulnerabilities  in  the Bluetooth communication stack as you can read further in A Preliminary Investigation of Worm Infections in a Bluetooth Environment

If so, does it need some action from the user to start the malicious
code ?

There is malware that depend upon user interaction for  a successful  infection. We can mention, for instance, the famous Cabir worm that propagates over Bluetooth using  caribe.sis that displays a warning message:

This worm requires the user to click on Yes to get installed successfully. But as I said before, not all worms work need user interaction like this.


How should failures by a single user on a simulated phishing email be measured? I work in the IT Security function of my company as a team lead. We periodically send out phishing emails to all users on company network as a form of continuous education of users on how to spot malicious phishing emails. Our company operates in the regulated financial industry and have a diverse user base  with various levels of technical ability from IT to customer service roles. We work frequently with sensitive customer data and personally identifiable information (PII).

My team does metrics reporting of user performance on these simulated emails. Sometimes end users take multiple ill - advised actions on a single simulated phishing email we sent such as clicking a link, or opening an attachment in the email.

My thinking is that given each bad action potentially represents a different attack vector that can be exploited by a threat agent, each bad action should be counted as a separate failure. After all, clicking on a malicious link in a true phishing email can result in compromise just as easily as opening an infected attachment in such email. The fact that a single user can take multiple bad actions on a single, albeit fake, phishing email seems to highlight how such end users are not really conscious of their actions or skeptical enough, which only emphasizes the value of this reporting methodology in my opinion.

Question

  To most accurately measure end user behavior and where weaknesses may be, should multiple bad actions on an single email be counted as a 1 failure or should each action be counted as a failure on its own?

I think focusing on the result of an individual phishing attempt is missing the forest for the trees. As a pentester, when presenting the results of a phishing campaign, I try to present the results to clients in the context of their training processes. Users who take improper action on phishing emails were not properly trained by the organization.

However with that in mind, as an internal IT team, I think you should focus on the aggregated results of phishing campaigns over time. After clicking the first time, did the user receive additional phishing training? After receiving that training, did the user click a similar phishing email later (with approximately the same detection difficulty)? I think those aggregate metrics are what matter, because ultimately the results should influence a change in training processes within the organization. Furthermore the policy within the organization should clearly define how tests are conducting and what the repercussions are for repeated failures. (And to go back to your original question, I think repeated failures in this case means failures repeated across multiple campaigns after repeated training, not multiple clicks on a single campaign).


IPv4 addresses in different encodings Trying to work out if I should have any security concerns with being able to do the following:

IPv4 addresses can be represented in different ways:

$ ping 0177.1
$ ping 134744072
$ ping 0x8080808
$ ping 010.0x0000008.00000010.8
$ ping 8.0x0000000000000080808

This works on both, Linux and Windows.  I assume that next-generation firewalls are able to detect this and 'block'?

Original reference: https://twitter.com/x0rz/status/928584447292858368?s=03

this is a false premise.

Firewalls work by parsing the IP's provided on there own predictable way.
The underlying protocols only use the Network Bitwise implementation of an IP address (e.a. it uses the 32 or 128 bit representation, for ipv4 and ipv6 respectively).

The underlying libraries that ping uses to make the connect translate the given representation to the expected representation by the system.

This means that there is no difference for the firewall between the IP representations

to illustrate this I ran the ping command with the address you supplied and captured the systemcalls. here is the results for the connect call on linux.

connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0

As you can see only the dotted decimal notation was used for the call.


Looking for signs of forensics - Assuming they didn't do the smart thing I'm getting my hands on a system (one laptop, one hard drive) that were in custody of a LEO for a fairly significant period of time. The laptop runs windows XP professional, with a recovery partition, and the hard drive is a 2.5 inch 40 gb drive that has an NTFS file system

Entirely for academic reasons  i'm thinking of forensically imaging the drives with a forensics fork of DD (i'm thinking if dcfldd) then working off a copy of that.

Considering i have some idea how long the system has been out of our hands, i'm also considering mounting the registry to check for devices that have been plugged into the system during that time (assuming they didn't do everything offline like good pandas) and checking for files that have been modified during that time (is there an easy way to do that?).

Am i missing anything? is there anywhere else i should look?

You could begin taking some look at the Forensic Toolkit to examine the NTFS filesystem.

In the same page there are tools for playing with the trash bin, IE, etc.

About registry, take a look at this and this, you'll find some indication of interesting tools.


Is it possible to auto mount entire truecrypt drive Truecrypt can easily automount if your drive is not entirely encrypted and your data is a standard file.  However I have my entire removable storage encrypted and so to the OS, it is seen as an unformated disk.  Is there anyway to automount said drive?

It is usually possible in this way:

Mark the external drive's Truecrypt partition or drive as a "Favorite".
Open the "Favorite Volumes Organizer".
Check the option "Mount selected volume upon logon" for the Favorite'd encrypted partition or drive.

See the FAQ, section "Can a volume be automatically mounted whenever I log on to Windows?"

However, keep in mind that if your external drive is connected via USB or Firewire, then it may change device path from time to time. This often happens if you connect the drive to another physical port, or you add other removable external drives to the system. In this case I think the auto-mount will fail, until you fix the Favorite setting.

Edit @Yongke Bill Yu: After the belated mention that Truecrypt isn't installed on the host computer, the only possibility is "Traveler Disk". That's basically a disk with an un-encrypted partition with an executable instance of Truecrypt.exe , and another partition which is encrypted. Within the above limitations, the Traveler Disk can actually auto-mount drives via Windows' "autorun.inf" format.


OAuth - What if the refresh token is stolen? It seems I don't quite understand the idea behind the refresh token yet.

Assuming that a short living access token is used. This token might get stolen, allowing the attacker to access the ressource until it experies (maybe 3600 seconds).

But what if he manages to steal the refresh token as well (shouldn't be more difficult as it is not more protected than the access token, right?)? Wont he be able to simply get a new access token with it since no authentication is required for refreshing the access token when someone posesses a refresh token?

TL;DR: Yes refresh tokens are bearer token and so should be protected.

Refresh tokens are powerful because in general they are:

long term: meaning that they have long expiration times
privileged capability: meaning that they allow the bearer to renew their access token.

Refresh tokens are also bearer tokens, which means the service consuming the token will give access to the bearer of the token --  no questions asked. This is similar to access tokens.

So making sure bearer tokens are protected and stored securely is very important. The more critical a token, the better it should be protected.

As an example in OAuth2, implicit flow which is generally used with mobile apps, the client side app has a short lived access token. They are also generally not given a refresh token. Since a client side app can be easily compromised and any data/tokens be compromised, its bearer tokens have limited privilege and lifetime.

In contrast, in OAuth2 authorization code flow which is generally used with server side apps, the server app is given a longer lived access token or/and a refresh token. This is because it is assumed that server side is more trusted and less likely for it to be compromised. Having said that, server side tokens should still be stored securely given their usage pattern.

To summarize, when deciding what kind of tokens  you need, check:
- trust level of your client and the flow most appropriate for that trust level
- protect your tokens!


Alice and Bob authentication and integrity problem Suppose  Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality required); the two parties are sharing a secret w and make use of a hash function H that outputs 40-bit numbers. Each time they use the following (pre-agreed) protocol.

A → B: w{nA}, where nA is a nonce (Alice sends a challenge)

B → A: w{nA+1} (Bob proves he knows the secret, providing response to challenge)

A → B: (F, H(F),w{H(F)}) (Bob, given F, computes H(F) and w{H(F)}, and then compare his results to data actually received)

Can an attacker act in place of Alice and send a file to Bob tricking him into believing that the file is coming from Alice ?

Yes, Mallory, a Man-In-The-Middle could intercept communications as follows, and pretend to be Bob to Alice, and Alice to Bob:

A → M → B: w{nA}

B → M → A: w{nA+1}

A → M → B: (F, H(F), w{H(F)})

Step three requires a hash collision in order to substitute a file - Mallory could have created an evil file, E, and can calculate H(E).

Mallory observes traffic and waits to see a file transfer happen where H(F) = H(E).

Once this happens, Mallory manipulates the traffic so instead of

(F, H(F), w{H(F)})

being sent to Bob,

(E, H(F), w{H(F)})

is sent instead. Note that as H(F) = H(E), w{H(F)} will also equal w{H(E)}.

The protocol can be fixed by the nonce and secret being part of the file transfer stage:

A → B: (nA, F, H(nA | w | F))

Steps one and two are no longer required. As Mallory cannot hash their own file with w, they have no way of detecting a collision.

Of course, Mallory could replace every file transfer F with E in the hope that a hash collision occurs, however Bob would notice that something was amiss.

In order to fix that in the protocol, HMAC(SHA-256) could be used rather than a weak 40 bit hash.


Suricata rule to block particular website question I am writing rule for suricata which is going to block the possibility to enter one of the website for example xyz.com (instead of facebook, because with facebook there are some problems).

I am doing this in the way like this:

drop tcp any any -> any any (msg:"facebook is blocked"; content:"facebook.com"; http_header; nocase; classtype:policy-violation; sid:1;)

What I want to do is to block just the website. And in the way I do now, the rule is also blocking for example the requests to google which contain phrase "facebook".

May anyone advise me how I should change my rule ? I was thinking to limit just to the ip addresses of particular website, but it is not working properly or I do not know how to do it properly in rule. Is enough to change "any" in the beggining of rule for ip address of facebook ? But some servers have more than one IP addresses. How I can get the ip address of facebook inside rule ?

edit:

Also one more question is how I can change the string "abc" for "***" inside the rule ?

Instead of the http_header keyword, use the http_host keyword. It will specifically match against the "Host" header.

For wildcard matching you should have a look at PCRE:
Suricata User Guide » Suricata Rules » Payload keywords » pcre (Perl Compatible Regular Expressions)


Shellshock exploit on Linux Routers/Modems? I am worried about the millions (actually, worried about mine) of routers/modems that run Linux. How exposed are they to Shellshock?

Most Linux-based routers are running an OpenWRT/DD-WRT derivative.  These routers use BusyBox as their shell (Bash is much too heavyweight for the hardware), and consequently are not vulnerable.


Security Measures For Banking Information I am creating a site that will allow users to input their banking account number so I can pay them for their services.  I am far from a security expert and would like some insights into the best practices for encrypting this data.

So far I have gathered that at a bare minimum I should have 256 bit encryption with a salt.  What other measures can I take or would that suffice for enough security measures?

Thanks

You should probably get someone with more security background to actually look over your site to make sure things are properly implemented and to design your security for you.  Building a system that can safely protect banking information requires a lot of different knowledge and, no offense intended, your question itself demonstrates that you likely have very little experience in this regards.

Encryption does not use a salt, it uses an IV.  Salts are used with hashes. Initialization Vectors ensure that different encryptions of the same information result in different cyphertexts (to prevent the same encrypted value from being recognizable as the same). Beyond encryption for the data, you will need a secure account setup, you will need to prevent against sql injection and cross site scripting, you will need to verify a bunch of things about your server environment and the network it is on, you will need to setup intrusion monitoring.

There is a whole slew of things that go well beyond what we can tell you about in sufficient detail on this site in one answer and there are a lot of pitfalls that can occur based on how you write your code specifically.  You really need someone to work with you directly if you are building your own application for this from the ground up.


Is it possible to use a .Net payload with metasploit? I'm not exactly sure how metasploit works when exploiting a target machine, and it has been a while since of played with it, so forgive me.

Instead of using meterpreter as a payload in metasploit, could I write my own .Net based executable that would be dropped on a system after exploitation? Assuming the victim had .Net on their machine of course.

You can do this a few different ways.

First, if your exploit is an EXE-dropping exploit (like psexec), you can set the EXE::Custom advanced option.

Otherwise you can use one of the payloads that allows you to upload (windows/upexec/*) or download (windows/download_exec) a custom executable.


Which symbols can I whitelist to remain safe against SQL injection, XSS, and all other injections attacks? I have an input field in a web that is being saved. This field can be shown in other systems that I do not have control over and that's why I would like to limit what is allowed in this field, although I would like to allow some common special characters for user convenience.

This is what I came up with (I will whitelist only these characters):

Alphanumeric
Space
.,()-:

I would like to check if this is "safe" enough with regards to XSS injection, SQL injection and eventually any other things I did not think about.

P.S. I do know that this is not the right way to prevent an attack but I need this because data use will be out of my control.

tl/dr: You simply can't protect other systems from malicious input.
  Protecting against injection attacks depends too strongly on the way
  in which the data is used.  The best you can do is try to prevent
  obvious malicious payloads from sneaking in, but even your proposed
  white list can leave severe vulnerabilities if the application on the
  other end isn't practicing proper security.

Unfortunately what you are trying to do is nearly impossible, because ultimately securing against injection attacks depends completely on the context (aka how the application is using the data).  To pick one random example, imagine someone reflects your input into an HTML page like this:

<script type="text/javascript">
var dataFromIlyaChernomordik=[DATA];
</script>

Note that the data is injected directly into javascript without any double quotes.  Unfortunately, the data that went into your site is:

eval(String.fromCharCode(97,108,101,114,116,40,39,72,73,39,41))

Which translates into:

eval("alert('HI')")

I'm sure you can see where this is going.  Using only A-Z0-9,.(), combined with a lack of proper input handling at destination, I can now inject arbitrary javascript.  Game over.

So let's get rid of everything but: A-Z0-9-:

Yeah, but that hyphen there - it looks dangerous, and it has a variety of possible meanings in bash.  Is it possible that someone might be using this input to build strings to execute in a command line?  Is it possible they might forget to escape the data properly?  If so, you should ditch the hyphen.  Spaces and a colon also might cause trouble if someone is using your data inside an eval command in a python script.

The point is, anything can be dangerous in the wrong context.  As a result the only way to properly secure a system against malicious user data is to understand the context in which the user input is being used.  The only input that might be safe in an unknown context is an empty string (but man you'll be in trouble if you accidentally use a null character instead of an empty string!)

In essence, you're attempting to build a WAF, and while those can play a role in providing security to web applications (which is already a very specific context - a WAF will by no means protect against everything), anyone who has done enough penetration testing has plenty of stories about circumventing a WAF because of oversights in its rules.

Can you try to filter out the most obvious malicious payloads?  Yes.  Can you stop all dangerous payloads in all contexts?  Definitely not.


Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface.

meterpreter > run getgui -u loneferret -p password

(documentation)

Is there a similar one-command to setup tool for MacOS victims?
I know MacOS doesn't support RDP but maybe some metasploit / evilosx modules to set up a VNC connection?
Or I must do it manually without easy to use scripts?

Q1: Is there a similar one-command to setup tool for MacOS victims? .. or maybe some metasploit / evilosx modules to set up a VNC connection?

You can try to use vnc_login auxiliary scanner to identify if there's available VNC in target and attempt to login with a password or a wordlist:

msf > use auxiliary/scanner/vnc/vnc_login

And/or ard_root_pw to remotely exploit CVE-2017-13872 over 5900 port - if requirements are met:

msf > use auxiliary/scanner/vnc/ard_root_pw

  Some notes by ard_root_pw's author (jgor):

    This extends Rex::Proto::RFB to support usernames, implements authentication security type 30 ("Apple Remote Desktop" / ARD used by macOS), and uses that to add a module to remotely exploit CVE-2017-13872 over 5900/tcp on vulnerable macOS High Sierra hosts that have either Screen Sharing or Remote Management enabled.

  (source)

  Q2: Or I must do it manually without easy to use scripts?

If you already have access (w/ shell or meterpreter) in target, you should consider that Apple includes a VNC Client by default, you can use it with a simple bash script:

echo '#!/usr/bin/env bash' >> /usr/local/bin/vncviewer
echo open vnc://\$1 >> /usr/local/bin/vncviewer
chmod +x /usr/local/bin/vncviewer

After that, simply use: vncviewer [IP]:5901

(source)