How do credit cards with chip+pin securely allow recurring transactions? In Europe most cards use a chip+pin system to secure the card information. You put the card in te machine and enter a PIN number to decrypt the card information which is stored on the chip. Theoretically this is more secure as the credit card number alone is not enough to make transactions: you still need the PIN.

How does this work swirly when you want to set up a recurring transaction eg. your phone bill? I presume that you do not give your pin to the phone company.

There is a difference between using your CC on a machine (ATM, PoS) and online.

On a machine you will be identified by the CC number and PIN. If you are using card with a magnetic strip - it can be easily cloned. If you are using chip card, then it's safer, because machines can not read the chip, they can only interact with it and ask it to verify if the pin is correct or not and the chip will answer only "yes" or "no". In essence chip is like a little computer, that is specifically designed to be tamper proof (even on physical level - it's encased in a special epoxy and disassembling it without breaking something is quite difficult).

When shopping online PIN is not used for indentification. Other pieces of information are used to verify that you are who you are, like the numbers on the back of the credit card, your full name, billing address, phone number, email address.


Should I consider my Google Storage identifier as a secret? Google Storage URLs look like this:

gs://pubsite_prod_rev_0282398762349676320630463/data.bin

Accessing content at that URL requires authentication.
That being said, should I consider the 0282398762349676320630463 part as a secret?

If not secret, for simplicity reasons I will write that URL in our publicly visible export script. The pubsite_prod_rev and data.bin parts of the URL are not things I consider as secrets, so I am only concerned with that long sequence of numbers.

That answer really comes down to whether or not you are happy showing off where your data is stored.

If the project is a commercial grade product then, personally, I would advise that you don't make it visible to the public. Afterall, people may be more prone to attempt hacking into the account as you are giving quite a bit of information away. Basically you are sharing your documents ID with them, which doesn't sound like a good thing to do regardless of the case.

To be honest, there probably isn't a right or wrong answer in that sense, rather one of ethics.


February 7th 2013 Facebook integration error implications What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday?  I was astonished to see site after site being redirected to a Facebook error page last evening (US time).  What do we know and what can we surmise about this event?

Intuitively the actions I saw yesterday seem to have bypassed fundamental security features of modern browsers/web servers/DNS.  What do the results of the error tell us?

/EDIT UPDATE/
To be clear most users like myself were not using nor had ever used Facebook Single Sign On on the pages that were affected.

From what I can tell from that article it was an error with the Facebook "Connect" API.

This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this.

It doesn't "bypass fundamental security features" because the site owners willing placed a link to Facebook on their site. They trust Facebook to behave, and they didn't.

Now that I think about it, it's kind of dishonest that this article used the word "hijack" in the headline. It doesn't sound like a security issue at all. The headline may as well have said "Facebook connect was down. Had an error." Please fill me in if I'm misunderstanding.

EDIT: It did not require a button click as I had inferred. Here is the javascript clusterfuck that sites embed for Facebook Connect: http://connect.facebook.net/en_US/all.js


Is it safe to login to PayPal in apps How is it safe to use PayPal in an app where the app itself presents the PayPal login prompting email and password? How does PayPal even accept this risk?

As an example, the coffee ordering app "Hey You" presents the PayPal login screen in the app itself. This isn't the first time I have seen this, just the most recent.

PayPal's main appeal is that I don't have to trust every newbie developer with something to sell with my credit card details. But if I don't trust someone with my credit card details, why should I trust them with my PayPal credentials?

--

I get PayPal on the web. I am a lot more comfortable logging into PayPal in my browser, when my browser URL shows that I have been directed to https://www.paypal.com.

I can understand your confusion so I will clarify somethings:

Ignoring that there can be a phishing scam here, the developer is probably using PayPal's API and so the developer does not see your credentials. All he sees is if the transaction to his account from yours was completed or not.
Since the API is being used PayPal encrypts all the traffic between their servers and the client and so when logging in with them even on the worst app ever your login data will be encrypted and so that is not something to worry about.
PayPal will never ever let anyone touch your private bank info or password and so that is not something you have to worry about at all.

More about there API can be found here: https://developer.paypal.com/docs/faq/


Is it possible to use pass, the command line PW manager, without leaking details? Does it matter? I'm familiar with password managers like KeePass, and that there are a variety of interfaces for them. However, I've decided that I rather like the charm of pass. It's command-line oriented, and generally just really good. I can use git to make sure that I sync my PW store across my different machines.
However, if you follow any kind of scheme that makes it evident what these are for, e.g.
internet/stackexchange/wayne@example.com

Then even if an attacker doesn't compromise your GPG key, just getting access to your computer will give them a list of every single account that you have. Obviously you could stick your account names in the file, so you just have:
internet/stackexchange.txt

And then you have maybe a bunch of different username/passwords in there. But at that point you're kind of getting to the point where you may as well just use a KeePass file.
Are there any ways to use pass without leaking site and username/email addresses? Or if an attacker can access this information, should you just assume that they've already pwned you enough to know it?

Or if an attacker can access this information, should you just assume that they've already pwned you enough to know it?

I think you already got the idea here. If you can't trust your own machine, it doesn't matter how the password manager is implemented, you're already screwed.
You can add a second layer of authentication in various ways. On local machine, you can use full disk encryption to protect against someone swiping your information off stolen machine. If you're syncing your pass password files, make sure you set the sync permissions is private. If you don't trust your syncing service, then you can add another layer of encryption that encrypts metadata like ecryptfs or sync a disk image.


Security of assets/media on s3 I got my application written in Flask (Python 3.6) and running on EB.

I need to implement content editor which will allow to upload files on server and I would like to store them on s3. Most of uploaded files will be available on after login in my app.

Question is how to handle security of such files?

Should I use my application as middleware and check if user is logged and if so, then download file from S3 in my backend and return it to user as standard Flask response?

Or better idea is to generate presigned urls with expiration date?

Problem with presigned urls is that I will lose browser-side caching for my files, which I would like to keep (most of files are images, so it's unnecessary to redownload it every time).

Also second problem is that this url is not bind in any way with user logged in my app, so basically this presigned url can be used by anyone until it expires.

Right now I got legacy code implemented in first way:

Facebook does something similar to the "presigned URL" - their image CDN doesn't check for authentication, nor is it on the same domain so it can't even get the Facebook session cookie if it wanted to - instead they use the URL as a key (the URL is only ever shown to the authenticated user). It seems to be working out just fine for them so I don't see any issue with using that approach in your project.


Port Knocking using only Iptables/netfilter I am using the following iptables rules for port knocking. Everything works well, but it open the port for just a second and then close it. So how to improve this script to accept connection for a 30 seconds for example ?

#!/bin/sh

iptables -F
iptables -X
iptables -Z

iptables -N STATE0
iptables -A STATE0 -p udp --dport 12345 -m recent --name KNOCK1 --set -j DROP
iptables -A STATE0 -j DROP

iptables -N STATE1
iptables -A STATE1 -m recent --name KNOCK1 --remove
iptables -A STATE1 -p udp --dport 23456 -m recent --name KNOCK2 --set -j DROP
iptables -A STATE1 -j STATE0

iptables -N STATE2
iptables -A STATE2 -m recent --name KNOCK2 --remove
iptables -A STATE2 -p udp --dport 34567 -m recent --name KNOCK3 --set -j DROP
iptables -A STATE2 -j STATE0

iptables -N STATE3
iptables -A STATE3 -m recent --name KNOCK3 --remove
iptables -A STATE3 -p tcp --dport 22 -j ACCEPT
iptables -A STATE3 -j STATE0

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -m recent --name KNOCK3 --rcheck -j STATE3
iptables -A INPUT -m recent --name KNOCK2 --rcheck -j STATE2
iptables -A INPUT -m recent --name KNOCK1 --rcheck -j STATE1
iptables -A INPUT -j STATE0

It looks like you are using this howto. You may want to look at this howto instead. The key issue here is that you're using the --set parameter in conjunction with -m recent, whereas the linked howto is using --rcheck.  With --rcheck, you can specify the --seconds parameter to specify a length of time. It would probably be a good idea to review the parameters for the recent patch


Why doesn't a device with x509/PKCS#11 and U2F exist? I've been looking for a device, smartcard or USB that does two things:

provide storage to a private digital signature key (used with in a standard x509 certificate) for signing documents
provide U2F credentials for authentication with web applications.
optional: NFC or a way to use it from mobile device

I've found only one vague reference that a yubikey could do both (but it's not fips140-2 certified). Why are the other players in the field not developing devices with both functionalities? Gemalto, nitrokey, etc.

Is there some fundamental incompatibility with "old" PKI smartcards and U2F ? Both do similar operations at their core.

The Yubikey Neo can do all three things you need.
The standard Yubikey (non NFC) is, according to the website, in the process of beeing FIPS 140-2 certified.

An overview of certified U2F tokens can be found on the fidoalliance website

Generally speaking, U2F is a rather new standard, and the mainstream crypto token producers like Gemalto or SafeNet haven't quite jumped on that train yet. Technically, there is nothing that prevents a token from living in the PKCS#11 and U2F world at the same time.


How to verify DNSKEY by using its corresponding DS A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.

The digest is calculated by concatenating the canonical form of the fully qualified owner name of the DNSKEY RR with the DNSKEY RDATA, and then applying the digest algorithm.

 digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);

  "|" denotes concatenation

 DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key.

The following example shows a DNSKEY RR and its corresponding DS RR.

   dskey.example.com. 86400 IN DNSKEY 256 3 5 ( AQOeiiR0GOMYkDshWoSKz9Xz
                                         fwJr1AYtsmx3TGkJaNXVbfi/
                                         2pHm822aJ5iI9BMzNXxeYCmZ
                                         DRD99WYwYqUSdjMmmAphXdvx
                                         egXd/M5+X7OrzKBaMbCVdFLU
                                         Uh6DhweJBjEVv5f2wwjM9Xzc
                                         nOf+EPbtG9DMBmADjFDc2w/r
                                         ljwvFw==
                                         ) ;  key id = 60485
   dskey.example.com. 86400 IN DS 60485 5 1 ( 2BB183AF5F22588179A53B0A
                                          98631FAD1A292118 )

Can anyone explain to me how should generate DS based on DNSKEY? My specific question is how I should concatenate and generate "DNSKEY RDATA"? Thanks in advance.

According to the information on this page:

Effectively, the digest is calculated over the following fields,
concatenated:
DNSKEY owner name: se. (0x 02736500)
Flags: 257  (0x0101)
Protocol: 3
(0x03) Algorithm: 5  (0x05) Public Key: Aw……
The first four fields, in hex are as follows: 02736500 0101 03 05,

My question was how one can calculate the value for DNSKEY Domain Name (in this case se.). The concept which I didn't know was "wire format". Fortunately Roy Arends from Nominet, UK, explained to me clearly what it is:

A domain name, in "wireformat" is a set of labels, where each label is preceded by a length value and ends with the empty label (value 0x00)
For "se." the wire format is: 02 (length of "se") then 73 65 (hexadecimal representation of the ascii values for "s" and "e", followed by the empty label (value 00): 0x 02 73 65 00
For root (".") the value is just 00 so that would be 0x00
For "dnssec-tools.org": "dnssec-tools" is 12 characters long, so the length value is: 0c then the ascii representation of dnssec-tools in hex: 64 6e 73 73 65 63 2d 74 6f 6f 6c 73 "org" is 3 characters long, so the length value is: 03 then the ascii representation of org in hex: 6f 72 67 followed by the empty label: 00
all in all: "dnssec-tools.org." is
0x0c646e737365632d746f6f6c73036f726700

Thanks agian Roy.


How can Google know that a Microsoft e-mail account is "not safe"? Recently, I was forced to log in to my Gmail account with a browser to keep using it.
Then, Gmail noted that the "alternate e-mail address", my 1999 Hotmail one, which I had long ago associated with my Gmail account (in 2004), has been "detected as not secure". I forget the exact phrasing. Something about it being detected as not secure.
I'm 100% sure that I have never used the password for that Hotmail account anywhere else, and that it has not leaked, and that the account was not compromised.
However, I was still locked out of it, since approx. 2014, when Microsoft started demanding that you enter a phone number to access the account, refusing to let me dismiss it. So I was (and remain) "essentially" locked out of it.
Is it possible that, somehow, Gmail could detect this from a third-party service? What else could they mean by "detected as not secure"? Some guesses:

Maybe they have some means of checking the age of the account, and just assume that since it was registered in 1999, it must be abandoned?
Maybe it's listed in some kind of leak database, even though any password there would not be usable to log in since I never used the password elsewhere and have not been so careless as to leak it.
They are just making random nonsense up because it's a competitor's address.

Google is not going to reveal security algorithms to the public, so any guesses here are speculation.
My main guess is that Google sent 1 or more notifications to your alternate address, then decided it was abandoned because one or more of the following happened:

The notification was actionable, but you ignored it.  Possibly this could have been an e-mail asking you to reconfirm your account.
The notification was never opened (this is detectable, but not reliable).
Microsoft rejected Google's notification e-mail.  This could happen if the mailbox was full or if Microsoft blocked the account from receiving mail due to it being abandoned.


Verify whether the IP address is SQL Server Is a network scan the only way to know if an IP address is a SQL server? How can I verify this 100%?

The IP address is just a location identifier of a machine- it does not discriminate as to the type of service running on the machine nor does the IP directly indicate the type of machine. This is like giving someone a street address- it could be a business, a house, even a Post Office Box, but you generally have no way of knowing until you see it in person or learn more about it (P.O. Box is generally pretty obvious).

You could have a dedicated machine running mySQL or some other flavor of a SQL service as a database and have that be its only job, but this doesn't mean that the IP is and forever will be a SQL server.

A way to aid in determining the machine's role is by running a full port scan to determine the open ports on the machine. Something like nmap -sU -sT -p- <target_ip> would produce a full port-scan. Once you discovered the open ports (let's say you find 3306 open, which is the known default of the MySQL service) then you can perform further enumeration and determine the services running behind these ports.

As it was mentioned in this post, it is important to note, however, that just because a port associated with a specific service responds to the scan (either open, closed, filtered, etc.), it does not mean that the associated service is the actual service running. This is where further enumeration and even interaction is needed to know with certain what service you are dealing with.


Security questions - SSL secured payment iframe on an SSL secured site Sorry if this has been answered before, I couldn't really find this exact example and I wanted to get a clearer answer for a client.

I understand that an iframe with a https payment portal on a http (non secure) embedding site isn't safe.

If the site with the embed is https, and the payment portal embedded with an iframe is https, is that secure or would it be better to just forgo the iframe and link directly to the portal off site? And if so, why?

Thanks in advance :)

Embedding and SSL frame in and HTTP page is only unsafe if the host page is MITM’d and replaced with a phishing host and phishing frame. This is the only danger. The same origin policy protects everything else so long as they are on different origins (I assume they are because why else would you not have SSL on this page?).

Against a passive attacker, this is safe. If they are actively modifying your traffic and change the frame SRC URL all bets are off. The content of the original page is of course safe still but it’s very hard to know what the actual location of an iframe is as a user.


Why are my emails going to spam? I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer agent (Postfix).

Now I have set up:

DKIM
DMARC
SPF

All pass in GMail when I send the mail, but still the mails send by me are flagged as spam by GMail spam filter. What am I doing wrong?

Also I am using GNUMail to send emails via this command:

echo "anything" | mail -s "subject" anything@gmail.com

Unfortunately, .tk is one of the TLDs that are notoriously associated with certain threat actors and are used by malware to establish C2 channels (malware home-calling).

SNORT and Suricata (two most widely-used opensource IDS/IPS solutions) even have detection rules written for .tk, .pw and .ru URLs, it would generate an alert for the SOC analysts every time a hit is recorded against them in the network.

I'd suggest using a purchased domain name to get past the email filters.  GL!

BONUS: You might want to check your URL/domain names at https://www.urlvoid.com to see if they're marked malicious or suspicious by security vendors/spam databases.


Reply to SSL Handshake Request with a 302 Response Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad?

I would like to immediately redirect to a different site upon receiving the https request.  Will the browser allow that?

If I understand you correctly, you want to send a 302 response before the handshake is finished. A browser won't allow this for security reasons. Identifying the server by its server certificate is a crucial part of the SSL handshake - before this is completed, the browser cannot be sure that he is talking to the correct server.

That's why the answer is "no". The handshake must be finished before the browser will accept any content coming from the server. Otherwise it would be severely broken.

In case I misunderstood you and you want to send the 302 immediately after the handshake is finished, I see no problem here. The server can answer the request with any Response Code - if it happens to be 302, that's perfectly fine.


How to access or scan a specific computer in a different network I want to scan the ports of my neighbor's computer. I know the global IP address. However I can scan only the router, not the computer in the network. Is it possible to scan a computer in a different network just by knowing the router IP?

Your neighbour  router is acting as a firewall¹

This is actually a side effect of NAT: the router is blocking the connections from the outside to the intranet.² In order to interact with a computer in the intranet from the outside,³ the appropriate port needs to have been open in the router to that computer. And you will only be able to interact through that port.⁴

Given your description, the internal network is not accessible from the outside, so there's no forwarding of packets from the internet onto it.

Thus, the only way to scan a computer in the internal network would be to jump into a host directly connected to the internal. This could be either the router itself or any computer on the intranet that is accessible from the external network. And it could both be an unintended access (like exploiting a vulnerability on one of those computers) or an allowed one (like publishing a ssh server or VPN endpoint).

¹ Albeit a very basic one
² There are loads of vulnerable systems not exploitable because of this. If the network is changed to implement IPv6, they may become exposed though.
³ I am exclusively taking into account remote-initiated connections, not eg. the interaction with an internal browser of the requested web server. Nonetheless, having an internal user to connect to you (be that opening a website that runs a browser exploits to directly tricking the user to run a remote shell) is a potential concern.
⁴ There are some cases where more ports may be dynamically opened, like with routers that inspect FTP.


Help! Ransomware encrypted my files. What do I do now? I just discovered that my files have been encrypted by ransomware.

Can I get my files back? How?
Should I pay the ransom?
What should I do so that this never happens again?

Can I get my files back? How?

Maybe.

If you have backups, you can restore your files from there. Just make sure to completely reinstall your operating system first, i.e. "nuke from orbit", to remove the malware first. If you don't do that, you will just get infected again.

If you don't have backups, things get trickier. Some ransomware has been beaten and its encryption can be reversed. Others have not. To find out if you are lucky, you can use a decryptor (e.g. The No More Ransom Project, Kaspersky's No Ransom). They offer a service that helps you identify what strain of ransomware you have, and let you know if there is a tool to decrypt your files.

If you are unlucky and your ransomware is not on the list, you can backup the encrypted files on an external drive (with nothing else on it, it might get infected, too) in the hope of a future cure. But there is a real risk that your files are just irreversibly gone.

  Should I pay the ransom?

I wouldn't.

First of all, there is no guarantee that you will get your files back - there is no honor among thieves. Some forms of ransomware don't even bother to encrypt the files - it just replaces it with random junk to make it look encrypted. Obviously, paying in a situation like that does not help.

Second, you will be financing organized crime and creating incentives to create ransomware in the first place.

  What should I do so that this never happens again?

Apart from general good computer hygiene (don't download strange stuff, keep things updated, etc.) there is one killer solution to the ransomware problem: Make frequent external backups.


Can we verify that an app store ships the same code I have been shown? When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security they promise.

Now that I have decided which to use and installed the app from an app store, I have been asking myself: even if I had checked the source code (I'll admit I have just been assuming that someone did), how could I know that that is what I installed?

I see at least two potential attack vectors:

The app provider can ship different code than what they publish (e.g. via Github).
The app store owner (i.e. Google, Apple, ...) can change the shipped code.

I estimate that as little as one or two extra (or missing) lines can render even the most solid setup completely open to attack without the user being the wiser.

So, is there a way (preferably an automated one) to verify that the apk I downloaded from the app store matches the code I can see elsewhere?

Here is an idea of how you could verify the integrity of source code in a binary package:

Download the apk from a distributer, such as Google Play, and store the apk locally. Then compile the source code into an apk to create a sort-of identical version of the app.

Then do a binary comparison of 2 apk files and look for any differences and note their location. Then, disssemble both items with a tool such as IDA Pro and mnually check what the differences in the code are.

You can expect some differences, because the signing certificates wont match, but the underlying code should be the same, if not identical.

As an example, you might see that google version of the app has several functions that are not present in source, which can indicate some modifications to the original source.


Keyboards that do not retain heat to prevent thermal imaging of key presses? Some of you may be aware of the Flir One Pro that turns your smartphone into a thermal imaging camera.

This can easily be used irresponsibly:

  If we can get you out the room in under 60 seconds (and) get your keyboard, I can figure out your password to your computer ... some devices are so strong that the thermal print can be detected more than a minute later and even have a way to detect the order in which numbers were typed. (source)

Just wondering if there is any effort in curbing this behavior by using low specific heat materials when making such keyboards. For example, keyboards made of a micro lattice structure like inflated foam or something that wicks heat rapidly.

I suspect that you are over-complicating this issue.

In public areas, there are much easier ways to capture the information and we already have advice to customers such as wiping your hand over the keypad after use - this also ensures that fingerprints are obscured.

In private, secure areas - for example in high security use - we would expect physical controls to help prevent access and all non-approved devices are likely to be banned - windows may also have protective screens.

So I very much doubt that the cost and complexity of such a solution would be worthwhile to anyone.


CSRF Guard: Injects token in POST Request? I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's why CSRF guard throwing an exception: Token is missing in the request.

My question here is:

CSRF Guard injects token into POST request or not? If YES then what I have to look for to make it work.
Do I have to change my POST requests to make it work with CSRF guard? (Save the token into hidden fields and use it for POST requests.)

Please let me know your points if you know about it. Thanks.

Generally, you would indeed creating a hidden field in your forms for the CSRF token when you're POSTing.
From the documentation, it should look something like this:
<input type="hidden" name="<csrf:token-name/>" value="<csrf:token-value/>"/>
Additionally, in order to work for post requests, the inject-into-forms property must be true, like you see in the example:

<init-param>
    <param-name>inject-into-forms</param-name>
    <param-value>true</param-value>
</init-param>

In fact, disabling this parameter is particularly discouraged, because of the sensitivity of many POST requests.


Why encrypt data in memory? I saw that KeePass not only encrypts its password-database-file, it also can encrypt the passwords it holds in memory. This is just an example. I thinking of a new project dealing with sensitve / personal data and now I ask myself if I should encrypt the data hold in memory, too. This project would be implemented with Java SE and an additional android application. There will be no data stored in the cloud or on a server in this special case. Data from android will be imported by the Java SE Desktop application via cable connection.

But why is this necessary at all? Don't modern operating systems work with virtual memory management so that it is not possible for user-space / user-mode processes to access other processes memory?

Is it just another defense line if there is an OS vulnerability making foreign memory access possible? In that case I think it would be much easier to steal the data file and use a key-logger to catch the password the user enters instead of stealing the data through memory access.

In a perfect world, you are right: there should be no point in keeping data encrypted in RAM. The OS should keep strong separation between processes, clear RAM when it is reallocated to another process, and, if the attack model allows for an attacker stealing the device afterwards and doing some harddisk analysis, encrypt the swap (or use no swap at all, which may make more sense for a device with Flash-based storage).

In a realistic world, where operating systems and system administration are human endeavours and thus inherently non-perfect, you might want to add some safeguards, including keeping data encrypted in RAM and instructing the OS not to write data in swap space (on Unix-like systems, this is done with mlock()). Still, this encrypt-in-RAM things is more a psychological ritual than a true defense; its main virtue is in making the developer feel better.

Don't bother with doing that in Java, anyway. The garbage collector will copy objects in RAM transparently (this is part of the most efficient GC algorithms and you cannot prevent it) so no level of encryption by your application will guarantee that no clear version of the keys exist in RAM at any time.


How to securely set a cookie on another subdomain? I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches:

hub sets the cookie on example.com This works, but the cookie propagates to other subdomains. Also a risky subdomain like lab could set the cookie.
learn provides a setCookie controller. Hub returns a redirect (or possibly a different mechanism) to learn/setCookie?session=123 This works, but any domain (even evil.com) can use the controller.
The setCookie controller could verify Origin and only allow hub. I'm not quite sure what the usability and security consequences of this are.
hub contacts learn direct with server-to-server authentication and get's a one-time token. hub then sends a redirect to the user's browser to learn/setCookie?token=token (thanks to Fire Quacker)

Any suggestions about this would be most appreciated.

Use an iframe that loads a simple page hosted on learn.example.com that listens for JS message events to pass info between domains. You can trust message.origin, which makes it easy to filter with the JS. It basically subscribes a message event and when one happens, ask if the sender is on the list, and if so, sets the cookie. 3 simple steps.

This actually rides on top of a lot of other battle-tested techs like SOP, CSP (optional), and sandboxing. This leaves a lot less to the imagination and doesn't require extra server handling, provisioning, configuration, patching, testing, etc.


Reverse Engineering - .zip file decryption if I have similarly encrypted .zip files and I have password to one of them Is this possible to somehow reverse engineer password to .zip file if I have 2 similarly encrypted .zip archives, both need 20-sign password (that has big and small letters and numbers) so Brute Force is impossible to execute when I have speed of 14k passwords per second. I have 20-sign key to one of the archives. Is it possible to understand how they are encrypted and by somehow using reverse engineering decrypt the one that I don't have key to? I'm very new here so I have literally no idea where to start. Cheers.

As I lack 50 reputation to comment and the question is rather simple, I'll answer directly by assuming some details:

Assuming ZIP-encryption utilizes a proper encryption algorithm, no. Even if two files are similarily (whatever that means. I just assume similar passwords) encrypted, you won't be successful.

Reverse engineering is the wrong term here. You can actually look up how encryption is done by reading the code of an open-source ZIP software or looking up the algorithm in general.

Following the Kerckhoff principle, the security of the algorithm is not determined by the secrecy of the algorithm itself, but the keys being used. No key, no decryption.

In addition, the keys being actually used are probably very different from each other, even if the password are similar, as functions like PBKDF or various cryptographic Hashfunctions are used to derive encryption keys from a password.

Hash("Hey, welcome to Stack Exchange!") is very different from Hash("Hey, welcome to Stack Exchange.").


Is it possible to have a RESTful API that is encrypted without TLS? I was wondering if it was possible to implement a server that only has encrypted data and authorization (so without TLS that requires also authenticating the certificate). Similar to SSH but works with mobile app development platforms (iOS/Android/React Native/etc).

Edit:
We do not want to have to manually install keys on each client, nor to run a custom certificate authority (CA).  And most devices will be running on private LAN using reserved IP addresses, so standard CA's will not issue certificates because that is no longer allowed for reserved IP addresses.  This is essentially the emerging IoT issue of having encrypted data transfers over private networks.  But it appears that the common mobile platforms MUST use SSL/TLS to get encryption.  SSH would be fine, except that there do not appear to be good solutions available for mobile platforms like React Native, Nativescript, Ionic, etc.

Yes it is possible. But why would you do that?

All mobile platforms supports TLS, why reinvent the wheel?

Encryption is very hard to get right, and easy to get wrong. If you can invent a better encryption than the guys that write TLS software, you wouldn't be asking this question.


Protecting a jar file from being used by unauthorized parties I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me.

To achieve this, I have obfuscated the code before packaging it in the jar which provides some security against reverse engineering the logic by an unauthorized user.

Now I want to make sure that no unauthorized person is able to use the jar even if they get access to it. Currently, I am planning to have a root CA in my jar and issue certificates from the same CA to all the authorized consumers. Authorized users will pass this certificate in the code and it would be trusted using chain of command of certificates. Unauthorized parties wouldn't be able to use the jar since they wouldn't have these certs.

Is there any better way of doing this? Is there any problem with this solution?

if you ship a program (which includes JAR files) you effectively loose control. This program can be copied, analyzed, modified etc. The only thing you can do is to make such things harder by obfuscating code or similar techniques. How hard you need to make it depends on the value of the things you need to protect.

If you cannot risk a disclosure of your secret business logic or if you cannot risk that this logic gets modified then don't include it into the program. Instead you might have some kind of online API and the application needs to contact your server with the data and get the result back - and all the critical parts are kept outside your program and fully within your control.


Which encryption algorithm is used in password protected *.pfx/PKCS 12 certificates? As the title says, I can't find any resources on which encryption algorithm is used in *.pfx/PKCS 12 certificates that are password protected.

All the specs for the PKCS#12 format are defined in RFC7292.

The short summary is that a .p12 file (and I assume also Microsoft's older PFX format, but I've never worked with them) is just a container format that specifies the structure of this file, but says nothing about what kind of data should go into it.

To use a very bad analogy, the spec for Microsoft Excel's .xlsx format specifies the structure of an Excel save file, but does not tell you anything about what data or formulas it is allowed to contain; that is controlled by which version of Excel you're running.

If you were to pop open a .p12 in a hex editor, you would find that one of the fields in the header is AlgorithmIdentifier: _____ where the program that created the .p12 records A) which encryption algorithm was used to encrypt the data, and B) which hash algorithm was use to turn the password into a key. As far as I know, there is no definitive list of what is allowed here; the program creating the .p12 can use any AlgorithmIdentifier it wants, including making up one.

For example, if I was writing software to read and write password-protected .p12 files, I could set AlgorithmIdentifier: AES256WithPBKDF2 and that would be fine. But I could also set AlgorithmIdentifier: MikesCipherWithCatDoodles, and as long the software at the other end known what to do with that, it's still fine.

TL;DR: The PKCS#12 format only specifies the structure of the file, it does not list which algorithms are legal, so the actual encryption algorithm used will depend on which software was used to create the .p12 file.

If you want to know which algorithms are used to protect your .p12 files, look up documentation on the software you are using to read / write them.


Resources for physical security questions What are good resources for the physical security questions that IT organizations face?  Like best practices for locks and seals on servers and kiosks, personnel access mechanisms and policies, disaster recovery plans.

I'm looking for conferences, journals, books, blogs, etc.

Check out The Core Group http://enterthecore.net/

They offer training sessions at the Black Hat conference (and other conferences):
"PHYSICAL PENETRATION TESTING"
https://www.blackhat.com/html/bh-us-11/training/core-pentest-intro.html
https://www.blackhat.com/html/bh-us-11/training/core-pentest-advanced.html

  Those who attend this session will leave with a full awareness of how to best protect buildings and grounds from unauthorized access, as well as how to compromise most existing physical security in order to gain access themselves. Attendees will not only learn how to distinguish good locks and access control from poor ones, but will also become well-versed in picking and bypassing many of the most common locks used in North America in order to assess their own company's security posture or to augment their career as a penetration tester

Videos by Deviant Ollam:  http://deviating.net/lockpicking/videos.html
(and his book: http://www.amazon.com/Practical-Lock-Picking-Physical-Penetration/dp/1597496111/)


Failed Login attemps, Bruteforce Got around 60 failed Login attemps today. And there are more and more.

So yeah, Server is secured with an 4096-Bit SSH-Key (with passphrase).
The Server has Fail2ban installed, and Root login disabled.

Oct 23 23:42:30 **** sshd[9726]: Received disconnect from ***: 11:  [preauth]

Oct 24 17:15:13 *** sshd[10386]: Bad protocol version identification '\026\003\001' from **** port 34017

Oct 24 03:57:30 * sshd[9929]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Oct 24 03:57:32 * sshd[9929]: Failed password for root from * port 58904 ssh2
Oct 24 03:57:32 * unix_chkpwd[9932]: password check failed for user (root)

Oct 24 03:57:35 ** sshd[9929]: PAM 1 more authentication failure; logname                                                                              = uid=0 euid=0 tty=ssh ruser= rhost=*  user=root

Oct 23 14:59:16 * sshd[9389]: reverse mapping checking getaddrinfo for s                                                                              aargo.com.mx [*] failed - POSSIBLE BREAK-IN ATTEMPT!

vps330608 sshd[8993]: Received disconnect from **: 11: Bye Bye [preauth]
vps330608 sshd[10393]: Received disconnect from **: 11: Closed due to user request. [preauth]

The Brute-Force Attack is still running... Over 400 Lines at /var/log/secure
Fail2Ban still banning Ip-Adresses. Most of IP's are from Italy / France. Server located in France.

Any worries?

Regards

Any worries?

Well, It can be. Depends on how open the IP of the server is for ssh logins.
Is it available for the whole internet?

If yes it is highly vulnerable to attacks, It can be an easy victim of DDoS(or even DoS) attack. As port 22 to this IP(which is public) is open, Anybody can reach you with spoofed or even non spoofed sources.

  The Server has Fail2ban installed, and Root login disabled.

fail2ban only checks for wrong passwords, retries et al. So any body can send a flood of SYN packets to your IP and your server may get overwhelmed with those SYNs and sending them SYN/ACKs back to non-existent sources.

Some easy solutions would be:

Block them early in your network, Block them using a firewall or an inline device which can block requests from unwanted sources.
Use IPtables, Block(drop, do not reject) them using IPtables on your server itself.
If its used inside your network only bring it on a private IP

Hope this helps!


Penetration Testing Silverlight Applications What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file upload, user input fields and database connectivity (with and without ORM).

If you are code reviewing then I would recommend that you use Microsoft Visual Studio Unit Tests (See http://silverlight.codeplex.com/ and http://weblogs.asp.net/scottgu/archive/2008/04/02/unit-testing-with-silverlight.aspx) or Nant to test the code. It is would be the most effective way to do these type of tests.

If you don’t have access to the source code and need to do external/blind tests then you should cover the following above normal web application testing.

Coverage

In Silverlight there are typically 3 areas that need to be tested over and above a normal web application:

Deep linking
Isolated Storage
Back-end services

Deep Linking

Test for flaws in flow particularly authorization and data input.

Allows direct access to a page within Silverlight and could allow bypassing security such as authorization if authorization checks are only done at specific points.

For example: An application only checks authorisation on or just after the login screen, but application is deep linked to allow direct access to data read/write.

Isolated Storage

Same as any data storage tests however the special note is that it is client-side storage.

Questions such as:

What can be stored in isolated storage?
What can be overridden in isolated storage? For example, had the application stored files that can be overridden by the user?
How is that presented back to the user?

Backend Services

In web application usage cases Silverlight will commonly form the top tier / front-end and a backend web service will be responsible for some sort of data handling / storage.

Because Silverlight is a client-side technology web services if they exist are exposed to the client to, which is different to the usual server-side web application which may not need to expose these at all.

Web services should be aggressively tested using automated and manual tools. The normal tests of content type, size constraints, and performance are important. Also some fuzzing would also be good.  This all falls back to the generic web services testing is not Silverlight specific.

Tools

First Floor's Silverlight Spy can aid in investigating the isolated storage issues:
http://firstfloorsoftware.com/silverlightspy/download-silverlight-spy/

It is also sometimes helpful to review the xbap code of the app using ILSpy or .Net Reflector:
http://wiki.sharpdevelop.net/ILSpy.ashx

Try these for web services:

Are there any tools for automated penetration testing of Silverlight applications?

https://www.owasp.org/index.php/Fuzzing

Hope this helps.


Did I just get hacked? Yesterday I was on a call with some friends on the discord when suddenly the sound of the windows was silenced and my cursor started to move robotically, as if I was fighting a tug of war with someone who moved the mouse in the opposite direction to me.
At the same time I restarted my computer, and when I started windows my cursor started to move by itself, closing several programs that I had opened at startup. I disconnected the computer from the internet and restarted the modem, and right after that everything went back to normal.
Did I just got hacked? I don't remember downloading any suspicious files in the past few days that could give that kind of access to someone.
I scanned with several antivirus but nothing was found, I checked files that were starting up with the system and the only suspicious thing I found was a trace of a free vpn that I had downloaded a few weeks ago, in addition the malwarebytes program accused trojans on my uTorrent but from what i searched i noticed that it was a common thing to happen.

Yeah, it sounds like you were hacked. Your mouse cursor isn't supposed to have a life of its own beyond your control! It sounds like someone was using a Remote Access Tool (RAT) on your computer. That is very bad, and you should assume they have full control of everything on your computer.
The fact that the symptons disappeared when you reconnected does not mean you are now safe. Things may be done to your system without you noticing it, or maybe the attacker will take control again later. Don't just assume that the problem is solved because you can no longer see it.
You need to do a complete reinstall of your system. Do not connect to the internet before that is done. You can read more here: Help! My home PC has been infected by a virus! What do I do now?


A "new domain registration" spam? About 6 days ago I purchased a new domain under .org TLD from a local registrar.

Few days later, I have received this strange message (which BTW fell to
Gmail spam bin), which looks like some kind of phishing to me.

Following is the e-mail contents (redacted the hashes in "unsubscribe"
links and my domain for "example.org"):

Congratulations on your purchase of example.org

You MUST have accurate and updated contact information. Providing false or =
inaccurate contact information=20
can be grounds for the cancellation of your domain name registration as =
required by ICANN (More info below)=2E

You can also protect your brand by registering all related domain =
extensions (ie: .com,.net,.org...) before someone else does=2E

Check your your complimentary domain availability report now just click =
the link below:
http://www.namelock.org/?domain=3Dexample.org (Click on the link or copy & =
paste into your browser)

Key Domain Resources:

- For Domain Registration FAQ's: =
http://newregistrationhelp.com/knowledgebase.php
- For Domain Availability Report: =
http://www.namelock.org/?domain=3Dexample.org (Click on the link or copy & =
paste into your browser)
- For ICann Guidelines: http://www.icann.org/whois/wdrp-registrant-faq.htm

Sincerely,

Sophia Newman=20
Support Team @ NewRegistrationHelp.com

Please do not reply to this email. This email was sent from a =
notification-only address=2E
For customer service inquiries, please visit NewRegistrationHelp.com =
NewRegistrationHelp.com
1, Avenue Marronniers
Saint Ouen, Paris 93400
 All rights reserved - Copyright 2013=2E

If you prefer not to receive additional emails please unsubscribe now You =
are receiving this message because you recently made a domain name =
purchase. We hope you find these communications valuable however, if you =
would prefer to no longer receive emails from us, please copy and paste =
the following URL in your browser to unsubscribe: =
http://smtp235.newregistrationhelp.com/u.aspx?some/aZ09hashes

Not that it would be the traditional phishing in the sense that it would directly ask for credentials like "you need to reset your password" stuff,
but there definitely is something funky about it:

it knows my domain name
it came few days after registering
it uses phrase "You MUST" in the first paragraph (trying to FUD me?)
it's from a completely different entity than any of those I know are
involved (me, the local registrar, .org manager...?)

First explanation that came into my mind is that somebody has a list of
.org domains (that probably once existed?) and keeps polling DNSes to find
out when they were registered, then stealing e-mails from whois.

So is this some known / common kind of spamming/phishing technique?  Should
I act upon that?  Does this "incident" speak against my registrar's credibility?

Edit just to finish the story with full irony:

Next to this message, there were two messages from a legitimate "registrar
B" which I did not finish registration with that day:  A lost activation mail,
and a humble request for feed-back and offer to help with finishing the registration.  Later I have reported and explained this to them.

So it came it to my mind that while this kind of crap may not be particularly
dangerous, it seems to be quite successful in poisoning spam filters,
making words like "registration" and "domain" effective V-words.

At the end of the day, it's not me being "phiscked", it's the poor other
"registrar B" being "bayescked".

Get used to these.  You will get them regularly.  A lot of overpriced registrars make a living going around sending out e-mails and even snail mail like this to try to get website owners to pay for services from them.  The services are generally legitimate but overpriced and often sent prior to actually being needed.

They are correct that you must keep your WHOIS information accurate and up to date or you could technically lose your domain, but that's something you have to communicate to the registrar you use, not some random third party registrar that you aren't involved with.

If a third party registrar contacts you about your domain, just ignore it.  Google properly sorted it as SPAM.


How would an attacker know what version of tor/TAILS I'm using? Everytime a new version of TAILS comes out, it's recommended to download and install immediately because of known vulnerabilities with the last one.

Since no relay except the middle relay knows the origin of the traffic and since scanning using something like nmap won't show tor on the client system, how would an attacker know what version of tor or TAILS you are using and so what exploits to use?

If there are differences between the two, please include it in the answers.

Theoretically, if you visit a website in the Tor Browser, the User Agent will tell the web server the version of your browser. If different versions of TAILS have different versions of the Tor Browser, being based on different versions of Firefox, you could fingerprint it that way. But this is very limited, and hit-and-miss. You'd end up with a string like this:

Mozilla/5.0 (X11; Linux i686 on x86_64; rv:10.0) Gecko/20100101 Firefox/10.0

Could you reasonably say from that "Someone is definitely using a year-old version of TAILS"? Nope.

That said, do you have to know the exact version of the OS to run an exploit? Nope. If I see a browser running Chrome 64, there's probably a few exploits I can run, as long as it's older than Chrome 67.

For the super-paranoid (rightly or otherwise), you can spoof your user agent. You could even impersonate a Netscape Navigator browser, if you wanted.


Can session/cookie request token be sent via url? What are the security concerns if a session token is sent via url over https?

After authentication a rest api sends a unique session token that is used to validate subsequent requests. It is typically sent via https POST. Is there a security concern for sending the token in a url parameter via GET?

Logging complete url requests could be a potential security concern.

The TLS will make sure it is encrypted in transit, so it will be protected against MITM attacks. But there are other reasons why this is a bad idea.

The token will be exposed in a lot of places. Server logs is a big issue, as you mention. Suddenly you will have to treat all your logs from where you terminate TLS and downstreams as security critical. Another issue is having the token exposed in the users browsing history, or even worse if they share an URL on social media. For an API that might be less of a issue, but if I had a penny for every time I have seen people expose authentication tokens when posting questions in support forums...

I understand why this might be a tempting design, but I strongly recommend that you just use a cookie or an Authorization header instead.


Google Hangout Dialler exposes user ID Recently, I got in touch with an online supplier of commodity service. Since they are located in location out of country of my residence I used GoogleTalk's IP phone service ‘Hangout Dialler’ as it’s much cheaper than calling from my android device via mobile service provider.

After couple of days I received a +1 invite from the supplier.

I am wondering how this is possible. I did not call the Hangout id of the person as I didn’t know if he has a Gmail account and his id. I in fact called on his mobile number. (In case you wondering and although it’s not linked to the issue above I use Orbut (encrypted communication) on my phone.

Only thing I can think of is the person probably uses Android too and somehow my paid Google Hangout Dialler call exposed my Gmail id to the stranger.

This shouldn’t be case thought as other people who I know and use the say way to call them internationally, get to see a +### number.

This information could be revealed if you use caller ID and your Google account is configured to allow others to find your profile if they have your phone number.

First, note that even though you're calling through hangouts, caller ID information for your phone can still be sent by Google if you have a Google Voice account or your phone number is verified with Google. From Google's support pages:

  Show Google Voice number to call recipients

  When you make a call using Hangouts and have a Google Voice number, the recipient will see the call coming from your Google Voice phone number. You can see the phone number that will be shown to recipients when you open the Dialer tab > Dial Pad Dial pad icon.

  Show verified phone number to call recipients

  If you don't have a Google Voice number, you can turn on Outbound Caller ID on your Android device so your verified phone number shows to the recipient. Your calls from Hangouts will show your verified phone number when you make the calls on your Android or iOS device. When Outbound Caller ID is turned on, you can see the phone number that will be shown to recipients when you open the Dialer tab > Dial Pad Dial pad icon.

So with this feature enabled, people you call will have your phone number. Using that information, the supplier in question may have been able to look up your Google+ profile if you have the "Help people who have your number connect with you across Google services." setting checked on the Phone section of your Google Account Settings page.

Again, from Google's help pages:

  You can change your settings to help people who have your phone number find and connect with you on Google services, like Hangouts or Google+.

  To use these settings, make sure your My Account "Phone" page shows your current phone number.

  Help others connect with you on Google using your number

  You can make it easy for people who have your phone number to get in touch with you across Google services. For example, friends can send you a message or photo without having your email address or other contact information.

  To help people get in touch by using your phone number, follow these steps:

  Go to the My Account "Phone" page.
  Next to "Help people who have your number connect with you across Google services," check the box.


Explanation of the authentication procedure when using signed certificates I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT.

On my device side, I have a device certificate ( deviceCert.crt ) and the device certificate private key ( deviceCert.key ) , and also the root CA certificate from Amazon (root-CA.crt)

The device certificate is of course already registered on the AWS cloud.

I realize when using an MQTT client on the device that it requires the device to contain both the device certificate and the device private key during authentication.

Why isn't the private key enough to have on the device? My guess was that the device would sign something with the device private key , and on the server end, it would use the public key from the device certificate (already stored there) to verify the signature.

Or does the device send the device certificate to the server and the server compares it with the one it has stored?

What happens exactly here?

Two things are happening here. One is the identification, and the other is authentication.

Identification: your IoT device states who it is. This is basically a claim. This is done by sending over the certificate. The server makes sure it is an identity that actually exists by checking if the certificate was signed by a trusted root (probably one of Amazon's own). Once the server confirms the identity exists it wants proof in the form of authentication.

Authentication: your device proves it is who it claims to be by signing some data that can be verified by the public key contained in the certificate it presented earlier.

Onto your questions.

  Why isn't the private key enough to have on the device?

If only this is done, the server has no way of knowing which public key to use for verification. It has to look up the public key somehow. There are various ways to do this, for instance, SSH can work without certificates. In TLS, it works by presenting a client certificate to the server, which contains this public key.

  Or does the device send the device certificate to the server and the server compares it with the one it has stored?

Yes, the device sends over the certificate, but the server doesn't compare it to a stored version. It checks the trust chain.

You can check out the full flow in Wireshark. I built a sample app with certificate authentication. It works over HTTPS but the process is the same on the TLS level. Here is the post accompanying that repository.


where is data that was not completely received and can it be recovered? when a server is receiving data from another computer, lets say that that data transmission was incomplete, and half of the file was sent. now where is this stored on a computer and is it stored on the main storage. basically what i want to ask is: are data packets stored individually on a computer one by one or all together? and can this data be recovered and viewed? according to my limited knowledge using a packet capture software the protocol it says that is being used is: tcp.so will a person trying to recover suffer from desynchronisation

There is no single way these data will be handeled, i.e. it depends on the application receiving the data:

If you have for example a web application with some way to upload data these data will probably be accumulated first into some temporary file on disk in some default or configuration dependent folder. Of course "on disk"  might also be a RAM disk in which case the data are only in memory. But, if the connection closes (i.e. upload aborted) the data will usually deleted in which case they might still remain as bytes in some free space on the disk. And, some web applications might also accumulate the data just in memory, i.e. nothing gets written on disk.
If you have an FTP server instead and upload a file it gets usually transferred directly on the place where the client wants it to be, i.e. no temporary file and no cleanup. But of course, details vary by FTP server implementation.
With rsync you get again usually temporary files which usually get cleaned up on connection close.
... and different behavior for different applications

What is common for all storage done at the application level is that not the packets but the data will be stored, since a TCP based application has no idea of packet boundaries. This can be different with UDP based applications since with UDP a packet boundary is a message boundary (ignoring fragmented packets). But, UDP is usually not used for file transfer.


What does it mean to be FIPS 140-2 compliant? We have a product that uses Apache HTTPD, Tomcat, and MongoDB. It uses OpenSSL for HTTPS connection and Bouncy Castle library for the encryption of data in the database.

What does it mean to be FIPS 140-2 compliant?

Is it enough to use FIPS 140-2 algorithms? Or should we get FIPS 140-2 approval?

Should we receive the FIPS 140-2 approval for each component?

Or enough to receive it for OpenSSL?
Or should we receive the approval for each library that handles cryptography?

What happens if we update a library? E.g. we upgrade OpenSSL or Bouncy Castle.

Should we receive the approval once again?

What does it mean to be FIPS 140-2 compliant?

It is a security standard provided by the US Government and a requirement when working with the government. Products that meet the standard are certified and audited to meet certain requirements, partially which crypto libraries they use. Devices that have this standard are not guaranteed to be bug-free but have some level of the audit to them.

Is it enough to use FIPS 140-2 algorithms?

It means that your library has the potential to meet the standard if configured correctly. And can make audits easier as you can point to compliant libraries.

Or should we get a FIPS 140-2 approval?
Who is your customer base? Does this base need the standard, or would it allow you to move into new desired markets? Notice Windows support the standard, but it is not enabled by default. FIPS tends to add restrictions to your design choices and recommend older, more battle-tested algorithms, so using it will limit your ability to use newer major break-through if needed or desired.

Should we receive the FIPS 140-2 approval for each component?
Or enough to receive it for OpenSSL? Or should we receive the approval
for each library that handles cryptography?

The process will vary on the product created and usage. It's best to talk with the audit company about that. Many should be able to give you an idea of the process before you need to pay them.

What happens if we update a library? E.g., we upgrade OpenSSL or Bouncy
Castle.

Update or changes to the product may require recertification, and best to talk to the auditor.

Should we receive the approval once again?

Not sure what ask is here, but I would get if required, or you feel it would increase a goal enough to justify time/expense. In general, audits are not fun.


Is it posible recover file from an encrypted home directory with a forensic tool? Lately I have done forensic analysis on my computer(with photorec) to see how many deleted files I can recover. During the analysis I recover some photos and videos of my different partitions: Windows, Linux (user with not encrypted home directory), but I didn't recover any file of my user with encrypted home directory. I probably did not do the analysis well? or probably the files were overwritten. But my main theory is that I can not recover those files because they are encrypted, that's why I'm making this question, it's posible recover files from and encrypted home directory.

I encrypted my home directory with ecryptfs

Short answer: probably not. The longer answer requires some background.

To simplify heavily, a file system has two components:

The actual file data. These are simply blobs of data without names or types or anything attached to them. They are placed end-to-end but typically aligned to start at the boundaries of "blocks" of storage, so a file that's not an integer multiple of the block size will have some unused space at the end before the next file starts (this is part of why Windows' file properties window will sometimes report different values for "file size" and "size on disk").
The file system directory (sometimes called an "allocation table" or "file table" or similar). This is not the same as the "directories" (or "folders") in the file system - you can build a really primitive file system without that kind of directories being represented at all, or even existing, but you cannot avoid having the file system directory. The directory is stored at a known location and records the name (and sometimes the path) of each file, the blocks of the storage where the file's data is found, and various file metadata (size, timestamps, access permissions, etc.). Many file systems, where directories/folders also can have metadata, store records for each directory - as well as for each file - in the file system directory table. This directory also typically stores file system metadata, such as how much total free space there is, lists of blocks of free space, and so on.

When you "delete" a file, all that is actually happening (most of the time), is that the file's record is removed from the directory table (and various cleanup, like the file's blocks being added back to the list of free blocks and the file's size being added to the total free space). Critically, the file's data is unaffected (until some other file overwrites it). Thus, file undelete utilities basically do the following to try and find deleted files:

Check the start of each "unused" block for data. If there's data - that is, if it's not all null bytes - check for the "magic number" (or string) that most file types have at their beginning, which indicate what kind of file it is. (For example, all Windows executable files start with "MZ", all Zip archives - including things like .APK files - start with "PKZIP", etc.)
If it finds the start of a file format that it recognizes, the tool checks the rest of the block (and sequential ones, if needed) to verify that all the data makes sense. Determining the end of the file can be tricky; if there's a bunch of null bytes starting somewhere in a block and ending at a block boundary, then the file probably ended right before those byes, but the data between the end of the file and the block boundary might be old, partially-overwritten data instead. Files can also be "fragmented" across non-contiguous blocks, in which case the recovery tool might be able to recognize the start of the file but not the rest of it.

Essentially, the tool tries to find files that it can recognize by their data alone. This poses an obvious problem when trying to recover encrypted files: the output of any decent cipher is indistinguishable from random noise, so nothing is going to be recognizable! Depending on exactly how the file system encryption works, it might be possible to guess where files start and end, but recognizing the individual files is going to be impossible without knowing the algorithm and the key they were encrypted with.

Now, if you happen to know the key and algorithm used for at least some of the encrypted data, you could decrypt that data and see if the recovery tool can recognize it. There might be tools that can do that for encryptfs, if you supply them with the key. A run-of-the-mill tool won't cut it, though.


Is it OK to set SSL fullchain to service Imagine service with SSL-server authentication. There are 3 certificates in chain:

Root CA certificate;
Intermediate CA certificate;
Host certificate.

Is it ok to put all 3 certificates (fullchain) to clients when they're connected?
What arguments are to put only 2 and 3? AFAIK, in this case root certificate will be added to chain from local root certifiate storage (don't matter what the storage is).

Pointless, but not dangerous

In order to understand the answer to the problem, we need to understand how certificates work. When a program encounters a certificate and it wants to verify the authenticity of it, it looks at the certificate itself, as well as the Issuer of that certificate (aka. the one who signed it).

That process is repeated until either:

A trust anchor is found (Success)
A validation error occurs (Failure)
A certificate is missing (Failure)
The top is reached an no trust anchor is found (Failure)

This means, if I have a certificate "Leaf", signed by "Branch", signed by "Root", then I need to verify three certificates. In order for this process to succeed, a trust anchor needs to be found. 99% of the time this will be "Root". Since I already need to be aware of "Root", there is no need for the certificate chain to include "Root".

Some examples to illustrate

Leaf + Branch are sent

This is the typical scenario. A client would first verify "Leaf", then verify "Branch" and finally search for "Root" in its own trust store. If "Root" is found, then "Leaf" is a trusted certificate (assuming all other data is valid). If "Root" is not found in the trust store, then the certificate is not trusted.

Leaf + Branch + Root are sent

This is what you referred to as the "fullchain" scenario. Verification works the exact same way. If "Root" is found in the trust store, then "Leaf" will be trusted. If it is not found, then it will not be trusted.

Leaf + Root are sent

This scenario is most likely a configuration error. When "Leaf" is being verified, the program would then attempt to verify "Branch". Since this certificate is missing, the verification fails, even though "Leaf" is valid. The fact that "Root" exists doesn't matter to the verification process, as the link between "Leaf" and "Root" can't be established.

Leaf is sent

This scenario is also a configuration error, but a far more common one than above. The outcome is the same nonetheless, since "Leaf" depends on "Branch", which is missing.

Summary

You can send the full certificate chain or omit the root certificate. It has no security implications, although sending the root certificate is pointless and just wastes bandwidth.


Which shell is more secure, mksh or bash? Which shell is more secure, mksh or bash?

There has been some discussion pointing into the direction, that mksh is more secure.

How to come to that conclusion? By looking which code was more audited and which not? Have there been any professional comparisons of either shell or comparisons of the two?

(Asking from perspective of someone who writes shell scripts that parse untrusted input.)

I am asking from perspective of someone who writes shell scripts that parse untrusted input

I would not recommend any of these shells to parse untrusted input, because it is far to easy to make errors with the shell syntax which can cause unwanted command execution. This is not a  problem how secure the implementation of the shell itself is, but how hard it is for the developer of the shell to securely handle untrusted data - and bash and (m)ksh do not differ much in this case.

Have a look instead at languages like Perl, which offer a taint mode to handle untrusted data. This way you are forced to sanitize the data before you can run commands with it, which makes it much safer.


How to secure REST API for parameter manipulation? I am developing secure payment APIs, i want to avoid manipulation of API parameters and fired same API again. For example, following is the API call

https://api.payment.com/wallet/transfer?from_account=123&to_account=456&amount=100

Once this API call is executed, someone with enough knowledge can execute the same API call by modifying any of the three parameters to his/her own advantage. I have thought of issuing a temporary token (transaction token) for each transaction. But this also doesn't sounds like enough.

Can anyone suggest the best way to achieve this?

Your request, at least how you describe it, isn't authenticated. This means that anyone at any time can send such a request and trigger a transaction.

I assume that TLS is a given, as you are using HTTPS in your example URL. This is of course a must have.

You need to implement the following mechanisms to protect your API against this problem:

Authentication: You should authenticate the user sending the request. There are many different authentication protocols available and the right choice depends on your architecture. It can be something straight forward like basic authentication or something more complex like a token based OAuth implementation.
CSRF Preotection: Again, I don't know your application architecture, but in case you have a web-frontend that triggers the API calls, CSRF might become an issue. In this case you must also ensure that CSRF protection is in place to avoid missuse.
Replay Protection: After implementing 1. and 2., you have to evaluate, if there is still a risk of replay attacks. If that's the case, you have to implement a scheme that ensures that a duplicate gets detected (e.g. every request has a random id that gets tracked).


What can happen if someone gets a hold of a scan of someone else's passport? Or: "Do I need to be concerned about emailing people scans of my passport if they want to verify my identity?"

Is there anything anyone can do with the information on the main page of the passport that could be used to hurt the owner in the short or long term?

If someone gets a scan of your passport they could use it for identity theft. People want a scan of your passport to verify your identity. A scammer could use it for the same purpose if they have other useful information like your address, and government IDs such as social security number.

A copy of your passport has useful data for an attacker, like your birth date and place of birth. Place of birth is often offered as an option for security questions for banking or password recovery. And of course there's your picture as well. So if an identity thief got a copy of your passport they would have a some useful data on you right away.

That being said it's sometimes unavoidable to give out a copy of your passport or other identity documents. It may be a requirement for a job, for example. The best you can do is offer more secure ways to send the data (faxing, snail mail, hand delivery, etc), and be vigilant for identity theft. Don't use anything available on your passport as security questions either.


Is applying AES multiple times safer? The KeePass security help page talks about preventing dictionary attacks

  To generate the final 256-bit key that is used for the block cipher, KeePass first hashes the user's password using SHA-256, encrypts the result N times using the Advanced Encryption Standard (AES) algorithm (called key transformation rounds from on now), and then hashes it again using SHA-256. For AES, a random 256-bit key is used, which is stored in the database file. As the AES transformations aren't pre-computable (key is random), an attacker has to perform all the encryptions, too, otherwise he cannot try and see if the current key is correct.

The "security against dictionary attacks" apparently lies in the time needed for the N encryption rounds. Now the question:

Is the time needed to compute N iterations of AES really N times the time needed for a single AES encryption, or is there a known, more efficient scheme to compute AES^N(cleartext)?

Performing AES multiple times is not useful. Breaking AES would take infinity if you use a proper key. What KeePass is doing here is making the key derivation from password slower so that a bruteforce attack would take a very long time because for each password the key needs to be re-computed (it's what PBKDF2, Scrypt and Bcrypt try to tackle).

While this may slow down dictionary attacks it won't prevent them. Preventing dictionary attacks can only be done by using long enough, random passwords.

As far as I know (I might be wrong since I'm not a cryptographer), there should not be a faster  way to compute AES^N more efficiently than N iterations of AES. The primary reason they are using this algorithm is because it's just really hard (impossible) to make computations more efficient and thus makes it less susceptible to brute-force.

I hope Thomas Pornin will be able to give you more insight on this one.


Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted? I have a very elementary understanding about encryption so this question may have false assumptions,

Lets take an encryption algorithm that is impractical to break through bruteforce with today's hardware, assuming that moore's law is and will be valid in the near future, can we predict to some extent when will the computing power necessary to make the algorithm widely obsolete achieved?

Given the constraints in your question, yes, it can be predicted.

For symmetric-key encryption algorithms, the answer is "never".

Assuming Moore's Law is valid for the next century (an extremely optimistic assumption -- such a computer would be drawing much of the energy output of the Sun to power itself) and that current computers can test a million keys a second (a reasonable assumption), a computer in 2114 will be able to test 7.3*10^25 keys/sec.  At that rate, it will take approximately 146,000 years to brute-force a 128-bit symmetric cypher (the minimum considered "secure" right now).

Asymmetric cyphers are a different matter.  Since they depend on certain mathematical operations (eg. computing discrete logs or factoring numbers into large primes) being difficult, they're vulnerable to improvements in the algorithms for performing those operations.  Improvements in computing power are relatively easy to predict; mathematical breakthroughs are rather less so.


Queues for Mobile Web Application Security Architecture? Dear Security Mavens (of which I am not),

Your thoughts & suggestions regarding an application architecture for a mobile web application (e.g., HTML5 with Sencha Touch) are invited & welcomed.

To what degree would/does the use of queues (e.g., Amazon AWS' SQS) increase/decrease/have no effect on mobile web app security?

What do you think of this approach?

A user (say on an iPhone or Droid) uses their smartphone browser (e.g., Mobile Safari on the iPhone) to access a mobile web application via SSL.
The application on the server side of the URL does virtually no processing...except to accept JSON messages from the MWA (Mobile Web App)...INSERT those messages into one queue (AWS SQS)...monitor a second AWS SQS queue for a resulting message...which the Server-side app basically only returns to the MWA.
The "real" work of the App is done...on yet-another-server which is taking messages from the first queue...doing all the processing...formatting a response...and PUSHING the response (a JSON Object) onto the the second queue.

The thought process here is: the bad guys can't gain access to the processes running on the server doing the "real" work...which is also where the application's databases would be kept.

BECAUSE I haven't found this application architecture approach discussed in any of the threads (at least, not in a form that I recognize the architecture), I wonder if there are well-known issues (at least, well-known for security pros, such as yourselves) which render the approach un-attractive?

What do you think? Would this approach impeded the bad-guys? Naively fall into a well-known bad-guy exploit? Or...what?

Many, many thanks in advance for your comments and suggestions!

This basic concept is pretty standard for web applications, with Presentation Servers in the DMZ talking to Application Servers inside the network that then request data from Database Servers.

Or sometimes there are just two layers, but they are segregated by firewalls or routers with access control lists.

The communications may be by message passing, queues or direct connection.


Could there be any implementations where the pw is truncated after "space" A good human memorable password could be:

My 1st passw%%%%%!!!!!rd

But could there be any password storing implementations that cut off the password after the first space, so the password will be only:

My

Question: Did anyone seen such a bad thing?

Question: Did anyone seen such a bad thing?

Not exactly this, but worse things. There were versions of Windows95/ME which only verified that much characters from the password as the user entered, i.e. for connecting to a share protected with "secret" it was enough to enter "s". See MS00-072.

Also it is not uncommon that passwords get silently cut at 8 characters or similar. And if an implementation removes white-space from beginning and end that might easily go wrong and remove everything after the first white-space.


Using VPN and hidding this fact from ISP. My ISP blocked a bunch of networks I need to access. I installed VPS (unix box) outside of my ISP's network and I now can build VPN between my home router and VPS, but I want to hide this fact from my ISP.

Here are several approaches and their weaknesses, could you please check my thoughts?

VPNs that work over IP. Their protocols are easy to detect (one needs to check "protocol" field in IP header), although my ISP will not be able to decrypt data, it will know for sure I am using VPN.

PPTP: Uses GRE
IPSec: Uses ESP header

Looks like I need application level VPN that will work over TCP and use well-known port to resemble valid traffic. I know 2 of them:

OpenVPN: TLS based, so I can use TCP mode and port 443 and make my ISP believe that I am using HTTPS. But my ISP may try to open website and quickly find that it is not website actually. To fight that, I can use destination nat on VPS to change dest. port for any IP except mine and launch webserver on this port. So, any access to MY_VPS:443 from anywhere will look like regular website. But for me it will act as VPN. I see one trouble here: keeping permanent connection with website may be suspicious for my ISP. I can create website that uses websockets, comet or some other technology to keep permanent connection (for webchat for example) and tell my ISP that this is the reason I have permanent connection.
SSH Tunneling. I do not need to DNAT anything here: my ISP connects to OpenSSH running on my VPS and sees "login:" prompt which is absolutelly legal. I can tell that I am sitting on my remote box via SSH all hight long:) However, traffic patterns differ a lot for character-based SSH (when I simply type commands) and for using it as VPN when I download large files (small HTTP request followed by huge HTTP response). My ISP may use this information. I can try to tell that I am downloading backups from my server via SCP or SFTP. I can also say that I am running X11 client there (ssh X11 forwarding) but it could be treated as kind of VPN. Patterns could be an issue for OpenVPN also, but there I can say that my website has a lot of data to download.

Which one is better? Is it possible for my ISP to use some DPI to find that I am using connection as VPN?

I recently ran into a similar situation.  An internet connection I was legally making use of was using deep packet inspection to prevent the use of SSH Tunnels or VPN.

To get around this I setup an instance of ShadowSocks with SSH Tunneling through it (example).

Shadowsocks - obfuscates the content of the connection making it much harder for deep packet inspection to identify the type of traffic (though not impossible).

SSH - provides much better security than Shadowsocks as well as provides a means for tunneling other types of traffic through it.


How secure is iOS Touch ID? I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". Now, with iOS8, Touch ID is being offered to apps as a way for users to authenticate.

But... it seems to me that this is far less secure than what many apps currently have. It effectively says that you can use the device passcode instead of an app password (which is stored in the keychain). Since most users only set up device pass codes with four digits, you only need to try up to 9999 numbers, and then you can get into not just the device, but apps such as banking as well (if they use the Touch ID API).

Also, if the device is stolen and jailbroken, with only a four digit passcode, can a hacker get hold of the keychain items for all my apps? This seems like a big risk.

Am I missing something?

Wouldn't it be better if TouchID's "fallback" was a strong password, instead of a four digit code?

This is not the case. iOS 8 allows the use of touch ID for apps but the "fallback" for the touch ID in terms of apps are the actual app password. the 4 digit code is only used if touch ID fails to unlock your phone

on a side note, certain apps such as banking can almost definitely chose not to allow touch ID for the app itself or even high-risk functions inside the app e.g financial transactions.


What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows? MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed.

Based on this and this KB article the EKU section of the certificate should contain "Client Authentication" or "Microsoft smart card".

I believe I found the OID of the EKU section here

OID=1.3.6.1.5.5.7.3.2       ; XCN_OID_PKIX_KP_CLIENT_AUTH  Client Authentication (KB291010)

I also found a list of possible OIDs here

 OID=1.3.6.1.4.1.311.20.2.2  ; XCN_OID_KP_SMARTCARD_LOGON

What are the requirements for SmartCard encryption with Windows?

Many of the requirements are listed in this KB article
  http://support.microsoft.com/kb/281245

The smart card certificate has specific format requirements:

The CRL Distribution Point (CDP) location (where CRL is the Certification Revocation List) must be populated, online, and available.

For example:

CRL Distribution Point
Distribution Point Name:
Full Name: URL=http://server1.name.com/CertEnroll/caname.crl

Key Usage = Digital Signature

Basic Constraints [Subject Type=End Entity, Path Length Constraint=None] (Optional)

Enhanced Key Usage =

Client Authentication (1.3.6.1.5.5.7.3.2)
(The client authentication OID) is only required if a certificate is used for SSL authentication.)

Smart Card Logon (1.3.6.1.4.1.311.20.2.2)

Subject Alternative Name = Other Name: Principal Name= (UPN). For example:

UPN = user1@name.com

The UPN OtherName OID is : "1.3.6.1.4.1.311.20.2.3"

The UPN OtherName value: Must be ASN1-encoded UTF8 string

Subject = Distinguished name of user. This field is a mandatory extension, but the population of this field is optional.


DNS leak with proxychains and firefox When using firefox with proxychains -

(default configuration file with tor:
 socks4 127.0.0.1 9050)

and checking on dnsleaktest.com, the original lookup returns the proxied IP, but when performing an extended search it shows the original IP/location. Does this leak occur only when using firefox ? I've tried checking the tick box: Proxy DNS when using socks v5, but that doesn't help. For example, if I were to use an application to send packets to a certain IP with proxychains, would the DNS also be leaked ?  How easy would it be to trace back the default tor proxy ?

(default configuration file with tor:  socks4 127.0.0.1 9050)

Although Socks4a does, plain Socks4 does not support resolving names (i.e. DNS) at all using the Socks tunnel and it does not help if you tick a Socks5 related checkbox for this. You need to configure a Socks5 proxy instead and then tick this checkbox for resolving hostnames inside the tunnel.

  For example, if I were to use an application to send packets to a certain IP with proxychains, would the DNS also be leaked ?

An application which is not aware of the tunnel will in most cases use the local resolver library to do DNS lookups and thus probably bypass the proxy for DNS lookups (i.e. leak). Applications which are aware of the Socks5 proxy and support the feature  of Socks5 to do the DNS lookup will not leak.


Security review: is this PHP mcrypt wrapper class safe? Update (6 February 2015):
  It seems like the class in question has actually updated as a response to the answers here (through an issue, now closed, raised on github).

I was looking for an easy to use library for encrypting files in PHP. PHP provides encryption functionality through the mcrypt library. Yet, there is a lot of configuration options and choices, enough of them to make a lot of mistakes.

So, instead of making those mistakes ourself, I searched for a drop in class (open source license, no framework constraints) which has already figured out how to apply the functionality securely. There is a lot of examples out there, but I cannot seem to find any code which has been reviewed by anyone with any background knowledge on this.

The best candidate I have found so far is on github: Pixelfck/SymmetricEncryption
The code seems pretty well written, the class is quite compact and well commented, so that is at least a good sign. Yet I don't think ourselves qualified to judge the security part of it.

Could anyone with more background on this read through the code and see if there are any issues?

Bounty update

I've quite some questions I hope to see answered (don't hesitate to pick the code apart even more):

First: the class includes two 'userland-implementations' of cryptographic functions:

PBKDF2: RFC 2898
HKDF (but only the 'expand' step): RFC 5869

Are those two implementations actually correct?

Second: some 'odd' things I spotted:

The HKDF 'extract' step has been replaced by the use of PBKDF2, is this an accepted idea for the intended use?
The number of rounds used for PBKDF2 is added (unencrypted) to the output of the encrypted data and used without/before being authentication by the hmac. isn't this a risk?
PBKDF2 is limited to a single 'block' only, isn't this contrary to how PBKDF2 is intended to function?

Third: some 'minor' questions:

Is 2^12 (= 4096) indeed an acceptable minimum number of rounds for PBKDF2 when used in this fashion?
Is 128 bits of salt for PBKDF2 indeed enough 'with safety margin to spare'?
The hmac key is 256 bits long, is this enough in this case?

Maybe I'm just worrying too much about this, but I would rather not use a third-party library that is flawed.

No, this is not secure.

The HMAC check is vulnerable to timing attacks. Since the author uses a standard string comparison, the check stops as soon as one character from the provided HMAC doesn't match the corresponding character from the expected HMAC. So the longer the common prefix, the longer the check takes. By carefully observing those time differences, an attacker may be able to reconstruct the expected HMAC and “forge” arbitrary data. This is a well-known error.
The length parameter of strlen() and substr() refers to characters rather than bytes in some PHP setups, which will break critical functionalities of the library. For example, the popular “mbstring” extension provides encoding-aware implementations of strlen() and substr(). In this case, multiple bytes may be counted as a single multi-byte character.
Encryption together with compression is known to be problematic in certain scenarios (see the CRIME and BREACH attack against SSL/TLS). The compression feature is turned off by default, though.
The cipher configuration is arcane. For example, the desired length of the PBKDF2 output is specified indirectly through the PBKDF2_BLOCK_COUNT constant which is the minimum multiple of the hash function output required for the target length. This creates a huge risk of user mistakes, especially when the library is marketed as an easy alternative to Mcrypt.
The author confuses the block size of AES with its various key sizes. MCRYPT_RIJNDAEL_128 is not AES-128. The numbers of the MCRYPT_RIJNDAEL_* constants refer to the block size of the Rijndael algorithm, whereas the numbers of the AES variants refer to different key lengths. AES is Rijndael with a block size of 128 bits and a key size of 128 bits, 192 bits or 256 bits. So to get AES in PHP, you use MCRYPT_RIJNDAEL_128 and a key string with either 16, 24 or 32 bytes. The library uses a 32-byte key by default, which means it employs AES-256, not AES-128.
The key derivation looks rather odd: Both the encryption key and the HMAC key are based on the same output of the PBKDF2 function. The only reason why they're different is because the literal strings "EncryptionKey" and "AuthenticationKey" are mixed into the HKDF call. This isn't necessarily wrong. In fact, the RFC specifically supports an extra input parameter. But it might be safer and more robust to generate enough key material for both applications and then split it.

The main problem, however, is that the library relies heavily on home-grown implementations when it should use standard solutions. For example, combining encryption and authentication should be done with AES-GCM. The PHP OpenSSL extension also provides a complete PBKDF2 implementation.


Is it possible for a file that is non-executable and read-only to run malicious code? On a POSIX system, is there a possibility for a file which is non-executable and read-only (aka with a mode 444) to run malicious code on a machine?

If so, can you explain how it would do so?

Yes, something just has to execute it. The X flag hints to the shell that it can be directly executed, but that doesn't stop other programs from executing it if they know how.

For example, if you have a file a.sh which is not executable to the shell, you can execute it by calling bash a.sh (which tells bash explicitly to execute it). If you have a non-executable file a.py, you can execute it by calling python a.py. I'd imagine there's also a way to tell the OS to execute a binary ELF file, but I don't know the command off hand.

There are also a whole class of things which don't require you to do anything in particular to make it execute malicious code. PDFs and Adobe Flash files in particular have had some well-known holes which allowed the simple act of reading a file to execute malicious code. There are also some files which, in specific places, and be auto-executed (especially on Windows). Also, if the file is compressed, it may contain a buffer-overflow virus for the decompressor. The file also may be even more malicious, taking advantage of a yet-unknown bug in the file system or something else really low-level.

Bottom line: the only way to guarantee something won't infect your computer is to never do anything with anything.