Attack Vectors for Purely Static Website (HTML and CSS) I am sorry if this is a too trivial question, but once I was told that only a fool is sure of anything: as I am not sure about this question, I am willing to risk my neck by asking it anyway, all in the name of learning and keeping my stuff secure.

Here it goes; background information:

I want to build a website which does not need any fancy functionality. There are no login forms and it is purely written in HTML and CSS. In fact there is not even input fields; just a 'Who we are', 'What we do' and how to 'Contact us' kind of thing.

Question:

Should I be worried that there might be some way of exploiting this site somehow?

Let's look at the technology stack of a dynamic website:

Your code, in whatever language you chose, e.g. PHP or ASP.NET
The script engine, e.g. PHP engine or .NET CLR
The web server, e.g. Apache or IIS
System services, e.g. SSH and FTP
The operating system
If you're on a VPS, the virtualisation technology that hosts your instance, e.g. VMware.
The hardware
The network infrastructure, e.g. switches, DNS provider, etc.

Now compare that to the technology stack of a static website:

Web server
System services
Operating system
Virtualisation technology if any.
Hardware
Network infrastructure

So, you've removed the top two layers of the technology stack by going for static. It is true that a large percentage of attacks are focused at the web application code and engine, but you still have a number of attack vectors to worry about.

Off the top of my head, here are a few:

Service passwords (e.g. SSH, FTP, RDP) for the server.
Web server vulnerabilities.
Service vulnerabilities.
OS vulnerabilities.
Virtualisation software (hosting management) passwords.
Domain provider account passwords.
Network infrastructure misconfiguration.


MAC-address restricted port forwarding I have an ASUS RT-AC68U router and would like to set up port forwarding, but I would like to restrict which MAC addresses can connect through that port.

My use case is that I'll have a live camera, and I want to connect to it remotely, but I only want myself and one other person to have access to it. Strong Username/Password are possible, but I want a layer of security on top of that, I want to limit it to pre-approved devices.

Is this possible? If not, is there something else I can use, such as a MAC-restricted VPN?
If it is possible, is it the best way to achieve this?

The issue you will have here has to do with L2 and L3 boundaries, and how MAC addresses are exposed.

When a L2 packet is handled by a L3 gateway, especially one which applies NAT to it, this will cause the packet to be re-transmitted by the l3 gateway rather than forwarded as is. This means that to the public world IE your remote location you will see the ASUS router as the sources and destination of the conversation, and the remote endpoint will not know what is behind the ASUS router. This is contrary to a L2 only network in which the logic is much simpler, the MAC address is compared with an ARP table, or list of ports and the MAC addresses associated with that port. The ARP table is populated by the conversations a network client makes when interrogating the network when first connected. The switches then effectively replicate the data packet and forward it to the destination port until it arrives.

The best you can do is restrict it to a remote IP, or you could layer on some security higher in the network stack, like in the session, or the application itself.

The problem with MAC addresses, is that they are readily forged. It's just security through obscurity because guessing which MAC to use wouldn't be trivial. Typically people use SSL keys or other harder to impersonate unique identifying mechanisms to ensure good security. For example, you could have a VPN which only allowed members to connect if they had a correct SSL private key which was authorized.

On a semi-related note - I highly recommend getting a Dropcam for watching a baby at home. It handles the security issue well and gives great HD quality.


What email addresses are treated as trusted? Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider anyone can controls that email address to be the owner of the domain live.fi.

How do I obtain a list of email addresses that are considered "trusted"?  Or, in other words, if I want to allow untrusted users to obtain email addresses at my domain, which email addresses do I need to prevent them from obtaining?  Where do I get a list of all of those special email addresses that might be trusted by someone?  Of course, there are many certificate authorities, so at a minimum, this list would need to include the union of everything that is trusted by any certificate authority anywhere.

I know RFC 2142 lists some reserved email addresses, but it looks like this is not enough: some certificate authorities trust additional email addresses that are not on this list.

Related but not the same: While searching the Internet for lists of reserved usernames and lists of usernames to block, I found the following additional resources: Is there a list of common usernames to reserve in a new system?, shouldbee's list, kwappa's list.

It's a rather short list:
‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’

Now that's the fixed and static list. But: contact info from WHOIS is also legal.

From the CAB-Forums' Baseline requirements, page 17:

  11.1.1 Authorization by Domain Name Registrant
  For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL confirm that, as of the date the
  Certificate was issued, the Applicant (or the Applicant’s Parent Company, Subsidiary Company, or Affiliate,
  collectively referred to as “Applicant” for the purposes of this section) either is the Domain Name Registrant or has
  control over the FQDN by: [...]

  Communicating directly with the Domain Name Registrant using the contact information listed in the
  WHOIS record’s “registrant”, “technical”, or “administrative” field;
  Communicating with the Domain’s administrator using an email address created by pre-pending ‘admin’,
  ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ in the local part, followed by the at-sign (“@”),
  followed by the Domain Name, which may be formed by pruning zero or more components from the
  requested FQDN;

Edit 2015-03-21: Entrust blog. Here's a nice blog entry with some backstory.
Bruce Morton, Entrust Identity ON Blog, 2015-03-20, What Happened with Live.fi? (Archived here.)

Interesting quote here:

  The attack we are talking about has been performed before in 2009. It was done to the RapidSSL CA where they provided fourteen email addresses for the subscriber to choose from. In this case the attack was also done against another Microsoft domain login.live.com where the subscriber registered sslcertificate@live.com, then requested the certificate using the email address they controlled. This created a security furor to limit the email addresses.

Edit 2015-03-24: WHOIS The "Baseline Requirements" also allow E-mail addresses from WHOIS records. I have updated this above.


Vim Modeline Vulnerabilities I use vim and have a use case for modelines.  A modeline means that vim will parse a textfile for lines like:

# vim: set someoption=somevalue

and will then set those options.  This is awesome if I'm the person writing the modelines, but it also might break down the assumption that I can open untrusted text files with my text editor with no harm.

Assume that I'm running an updated version of vim.  Assume that I don't mind if someone can set annoying options that make things look bad (eg, messing with the tabwidth).  What could a malicious text file do?

Thanks!

Although in theory modelines shouldn't allow you to do anything bad, sanitizing modeline functions input is hard. There have been several security issues in the past that allowed arbitrary command execution or DoS attacks. To cite a few past vulnerabilities I could find:

CVE-2002-1377 allowed an attacker to execute an arbitrary command
CVE-2005-2368: arbitrary command execution using glob and expand functions
2007 (couldn't find a CVE number): DoS through the spell checker
CVE-2007-2438: shell command execution through writefile, feedkeys and system
CVE-2016-1248: arbitrary code execution again using filetype, syntax and keymap
CVE-2019-12735: one more arbitrary code execution, by breaking out of the sandbox

While I believe they have all been fixed, new vulnerabilities keep popping up and it is likely that similar vulnerabilities will be found in the future, which is why distros disable modelines by default (at least Debian and SuSE do).


Is it common practice for companies to MITM HTTPS traffic? My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft.

It would appear that this policy also performs a man in the middle attack on HTTPS traffic. What this practically means for me is visiting "https://google.com" will give me a certificate error. Upon inspection of the certificate it is signed by my company's (self-signed) certificate.

To me this is hurting security in one area to help it in another. Is this common practice in big companies? Can someone point me to an ISO standard?

Is this common practice in big companies?

Yes. The feature is available in most enterprise firewalls and also several firewalls for smaller companies. It is even available in the free web proxy Squid. And several personal firewalls have implemented it too.

As more and more sites, (both harmless and harmful), move to https://, expect that the usage of SSL interception will increase too, because nobody likes to have a firewall which fails to protect a system because it is blind regarding encrypted traffic.

  Can someone point me to an ISO standard?

SSL interception just makes use of the existing SSL and PKI standards. There is no need to have a new standard which defines how SSL interception works.

As for the Cyber Security Standards: I'm not aware of any which explicitly require SSL interception, but I don't have much knowledge of these kind of standards. But even if it is not explicitly required it might be implicitly expected that you either block access to a SSL site or do SSL interception when the standard demands traffic monitoring.

  will give me a certificate error.

SSL interception needs you to trust the intercepting CA. In most companies these CA certificates are centrally managed and installed on all computers, but if you use a browser like Firefox it might not help because Firefox has its own CA store and does not use the systems CA store.

  To me this is hurting security in one area to help it in another.

Yes, it is breaking end-to-end encryption to detect malware and data leakage which use encrypted connections. But since the breakage of end-to-end encryption is done in full control of the company and you still have encryption to the outside world this is a trade off most companies are willing to take.

But note that in the past bugs were detected in several SSL interception products (like same CA between different companies, no revocation checks...) which additionally weakened the security.


Can strangers use Wifi to dial calls from my phone? I watched an old episode of The Real Hustler in which they demonstrated how strangers can use some devices to force your Bluetooth-enabled mobile phone to call a premium rate telephone number. The victim's phone gets charged and the owner of the premium rate number gets the money. This TV show may have aired before wifi was common, so they did not mention problems with wifi. Assuming I have Bluetooth turned off, can attackers achieve the same thing using wifi? If so, would this only work when the phone is connected to a public wifi access point or could it also work while the wifi is not connected to anything?

In general, no.  To a large extent, Bluetooth can be though of as a wireless replacement for the cables connecting your headset, keyboard, etc. to your phone; the hypothetical device involved works by imitating the phone keypad.  Wifi is strictly a replacement for your network cable; your phone does not accept user-interface input from it.

That said, it's possible that specific smartphones have security vulnerabilities that permit a webpage or other network-delivered content to force the phone to dial a premium-rate number.


SSH like promiscuity for HTTPS I want to build something, but I haven't seen it before.  Maybe you have?

I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB).  The microcomputer would be an open Access Point (not necessarily connected to the internet)

Clients could connect to the AP and see the app.  Think of a clickwrap EULA on a wifi AP, but it did useful and nice things for you.  An app.

The App needs secure communication.  If I use HTTPS, then I'd need an SSL cert.  For what domain name?  And one for each microcomputer?  I couldn't share them or they'd be "compromised" and revoked?  That doesn't seem to work or scale.  Users are trained to not accept self-signed certs.  It's horrible UX to work against and undo that training.

Really, I just need what SSH has:

Setup a new server with SSH, it makes it's own keys.
ssh to a new server and get a new fingerprint: "This is new, accept?"
ssh to a known server with a different fingerprint: "Something is wrong!"

This question talked about DANE/RFC 6698.  But that requires DNS (and a connection to the internet), and doesn't seem to be supported by browsers.

I just want it to be as good as ssh.  I don't need centralized identity.  Future versions would manage identity by sharing fingerprints between clients.

In step step 2 "new fingerprints", modern browsers show a scary warning. For early adopters that's fine as a start. But for regular users, I'd prefer not to scare/untrain them. What I really want is a keyring like known_hosts.

Is anyone thinking about that for HTTPS and browsers?

Thanks!

What you describe is https with self-signed certificates, i.e.

  Setup a new server with SSH, it makes it's own keys.

Setup a https server with a self-signed certificate.

  ssh to a new server and get a new fingerprint: "This is new, accept?"

Connect to the new server with the browser. You get a warning but can tell he browser to add an exception.

  ssh to a known server with a different fingerprint: "Something is wrong!"

Connect again with the browser. It will tell you that something is wrong because the exception does not match any more. If you've used HSTS then you would not even have an option to override.

In both case the second step is the critical one, i.e. you should only accept the certificate from the server if you've verified the fingerprint and you've got the correct fingerprint in a secure way (maybe while setting up the server).


How to fix CSRF vulnerability alert on a website with no user authentication, If it is caused by an external Mailchimp signup form embed A Website with no authentication has an mailchimp signup form embed. Vulnerability tools are reporting CSRF issues on the hosted website. Who can become victim in this case and how to prevent it and eliminate the security alert? Is this something mailchimp need to provide a fix for?

One of the pre-requisites for a successful CSRF attack is that the user should be authenticated already. From your question, it doesn't seem like the user is authenticated on that page.

In CSRF you forge an authenticated users request to submit some form data to make state change in the application.

There is a special case of CSRF on login pages, which is Login CSRF. In this, you make the user login with your own credentials to track the users activities. Suppose you are trying to attack an e-commerce application, you can make the user to login using your own dummy username and password. When the user later on pays for something online, they may unknowingly add their credit card to your/attacker's account. This case may be applicable to you.

In any case, the fix should be at 'mailchimps' end as they are the ones validating login info. Hence, embedding and validating the CSRF token should be performed by them.

It would be helpful to answer more accurately if you can provide details on the features that your application provides.


What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS? I've been learning about PGP, and I asked myself, "Why?"

For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used?

I can understand that its possible for an encryption method to become compromised, and it could be seen as a means to avoid disaster if a backdoor to SSL/TLS was released. PGP is also more decentralized, which could be attractive to some.

SSL/TLS protects the email from tampering or eavesdropping as it transits between your computer and Google's server, and possibly during further relays to eventual recipient.  And that's all it does.

PGP does far more.  If you're sending a signed email, the recipient can verify that the email was sent by you, and that it was not tampered with at any point between when you wrote it and when they received it.  If you're sending an encrypted email, you know that nobody but the intended recipient can read it -- not Google, not the NSA, nobody. That's why it's called "End to End Encryption".

However, the email metadata (from, to, subject, timstamps) is still sent in clear, and PGP can't help with that. So in general, it's best to send PGP-encrypted emails via TLS-secured connections.


Windows netsh pivoting I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. However this is quite inefficient as it is one port at a time. And each remote host requires its own local listening port.

I have tried to research other ways to use netsh in a more dynamic fashion however I have not found anything.

What is the most simplistic way to achieve dynamic port forwarding on a remote windows box?

netsh interface portproxy add v4tov4 listenport=<LPORT> listenaddress=0.0.0.0 connectport=<RPORT> connectaddress=<RHOST>

If using metasploit is the best option I'm open to that. However if this can be done with powershell that is preferable.

So deploying metasploit would be one option as you've mentioned however if you want a more Powershell route could look at using nishang which provides modules like powerpreter to help with pivoting on a network once you've compromised a single host.


Battling Malware without spending money Our environment consists of about 80 users running Windows 7. Previous to me showing up as a full time IT employee, the company had contracted an outsource IT solution. As part of their set up, they gave every user full administrative access to their local machine, disabled UAC (their reason: "because those pop up windows are annoying"), and disabled the Windows firewall on all the machines (their reason: "because we have a gateway firewall"). As you can guess, they were eventually fired.

All of our users' computers have Trend Micro OfficeScan for Virus and Malware protection, which is doing a terrible job even though they're all up do date with their definitions. Users are constantly getting infected with malware, which eventually leads to us spending time reimaging their machines.

My boss's solution to the problem is this: http://www.barracudanetworks.com/ns/products/web-filter-features.php. The system he wants, with licensing, will cost about $7000. However, we already have a SonicWall NSA device that boasts a lot of the same features that still isn't getting the job done.

So here's my question: Is tightening up the security on the machines going to be good enough to back me up when I talk my boss out of spending the money? My thoughts are we move everyone to non administrative accounts (they don't need admin privileges to carry out their jobs, so it should be a non issue), we turn on Windows firewall on each computer (If we were to get a self replicating virus or malware outbreak right now, we'd be screwed), and we turn on UAC (will this matter if they're non admin accounts?). I've recently implemented a WSUS server and we're keeping everyone up to date with security patches through it (I can't even count the number of computers that had updates turned off...). My plan is if people don't have admin privileges and their computers are up-to-date, we can greatly cut down the amount of malware.

I've still got lots to learn when it comes to protecting an entire network. So please, if I'm overlooking something or if I'm not on the right track or if I could change a few things, I would love your input. I just want to get them out of the awful habit of throwing money at problems and hoping it fixes it.

Update: I've marked an answer as complete, but I think it'd be of great benefit if people continued to share their insights and ideas. I now have a solid plan of action that'll keep me busy for a little bit.

The sad truth is that tightening your network will make you unpopular at your workplace. That said, many sys-admins would rather be unpopular knowing they have a safe(r) network than popular and spending all their time cleaning malware.

Some cheap and effective ways to eradicate malware

take away local admin, like you're planning to do (I can't stress this enough)
Update web browsers / Flash / Java / PDF Software via GPO and WSUS. Web browsers and PDF's are two big targets for malware.
You could run No Script to avoid drive-by downloads if you wanted to
Update your machines with WSUS (like you're currently doing)
Block .exe / .bat / .vbs / .sh attachment file extensions from entering via e-mail
Beef up your anti-spam on your mail server (if applicable - vamsoft ORF is a great MS Exchange anti-spam that costs about $160 USD)
EDUCATE YOUR USERS - Conduct a few lunch and learns and let your users know what a suspicious e-mail looks like, that they shouldn't click links in e-mails from recipients they don't know, safe web browsing practices, etc
Block any outgoing traffic on port 25 from every machine in your network except your mail server(s). This will prevent you from getting blacklisted.
Stay up-to-date on malware and read RSS feeds to read up on malware. Stay pro-active and block outgoing traffic on any known ports used by malware in an attempt to block infected computers with communicating with C&C machines.

I hope these tips help. It's important to note that you'll inevitably get some malware that slips through the cracks (zero days are a bugger), but you'll find that good practice can go a long way toward keeping a clean network.


How are private and public keys different? While reading about DKIM I saw that the sender's private key is used to encrypt a hash, later decrypted by the recipient using the sender's public key.

This is exactly the other way compared to encrypting a message.

Since both private and public keys can be used to encrypt a message (a mail or a hash for the two cases above), how different are they?

Why cannot they be used interchangeably?
Is the encrypting algorithm different depending on which key is used (and - presumably - the strength of the generated cryptotext is different?)

Public and private key in a key pair are distinct aspects of an underlying mathematical structure.

Let's take some examples:

In RSA, the public key consists in a big composite integer n (called the modulus), and a (usually short) odd integer (the "public exponent"). The private key is, ultimately, the knowledge of the prime factors of n. In practice, n = pq for two big primes p and q, and the private key is p and q.
In ECDSA, we operate over an elliptic curve, which is a weird mathematical animal that contains "points". A curve is a group of a certain size q. The private key x is a non-zero integer modulo q (that is, an integer between 1 and q-1); the public key is a point on the curve, which happens to be the result of applying the group law x-1 times on a conventional, fixed point (called the "generator").

In both cases, there is a strong mathematical relation between the private and public key, but they still are very distinct things. Also, the structure on which asymmetric cryptography works depends on the algorithm, and there is quite some variety.

Last but not least, DKIM is not about encryption. It is a mechanism that uses signatures. You apparently stumbled upon one of the many texts that purport to explain signatures as "encrypting the hash". Be aware that all these explanations are both confusing and wrong.


How to i disguise my phone as a tablet/computer? Where I work, the wifi blocks phones. So currently, when I use my phone to help me complete my work it uses almost all of my "data". I can't afford a tablet or a larger data package.

Is there any way to disguise my phone as a tablet/computer? I've looked online but there doesn't seem to be any solution as of yet. I have an Android phone running Marshmallow.

More manageable than link layer addresses is filtering on browser user agent, or something like p0f IIRC. You don't specify how/what is blocked. If it is browsing, go to about:config in firefox/similar, and create a new key called general.useragent.override . Try a value like 'Mozilla/1.0' - other user agent strings can be found with google. If it is something like p0f (passive OS fingerprinting) it can't be easily bypassed on a phone. Perhaps OpenVPN. If it is mac address you will need to root your phone (perhaps towelroot), install supersu, and either change it with ifconfig $radio hw ether 00:de:ad:be:ef:00 or some app from the play store. That is a mess. Don't root your device unless you are ok with a voided warranty.


"Fingerprinting" and human error Pretend for a moment I am investigating an attack.  I find errors in the attack method (mistakes made by the human attacking my network/computer).  I compile a database of these "mistakes" treating them like a fingerprint.  I then look through sites like security.stackexchange.com comparing the mistakes to questions asked/answered.  How many positives would you feel I need before I have a strong lead on a suspect?  Keep in mind I can cross reference to other sites.  How many cross referenced sites would I be expected to use before I have sufficient cause to call someone a suspect?  This is an opinion, so the question might be closed.  However, this is also a viable though inexact technique.  I'm also considering that many "attacks" are cookbook techniques.  In being used over and over, the first person to figure out the technique made the mistake, and everyone else is just reproducing it at some level.

Essentially you want to apply a Bayesian analysis to a corpus of work, to state something about the likelihood that you would believe an exemplar to be a member of the set constructed by your suspect. That analysis is well-known (and there's a whole statistics stackexchange site, too). You need about as big a corpus of suspect and non-suspect material as a decent spam filter uses.


Trailcams and disabling them I'm using trailcams (10) for security in my yard. I'm dealing with vandals destroying my trees and set up trailcams to catch the person. For almost 3 months they have been cutting my trees but somehow getting by all 10 of my cameras. They show me checking on the trees then hours later the next frame will be the trees damaged. Nothing inbetween. How is it possible that they can damage my trees But not be on the cameras?
Frustrated gardener over here

It would be very difficult to bypass a motion-sensitive cameras unless the attacker is dedicated and at least moderately knowledgeable. Some motion-activated cameras simply use fuzzy comparison of a frame with a few previous frames, and initiate recording if the sum of differences reaches a certain threshold. Very slowly placing a lens cover or other obstruction in front of the camera could blind it, and it would not begin recording because the movements are too gradual for it to count them as motion. The obstruction could then be slowly removed afterwards. The same could be accomplished by using a slowly-intensifying light source (even one not in the visible spectrum) to saturate its sensors. Depending on exactly how it detects motion, this could take anywhere from minutes to hours.
Other motion-sensitive cameras use more traditional motion detection, for example with microwaves (this is how automatic doors detect motion) or infrared lasers.  In those cases, certain materials are "invisible" to the camera due to the way they reflect radiation. This is more likely to be used if you are protecting something of extremely high value against a very sophisticated organization. It's quite unlikely that a vandal who has something against your trees will be using those techniques.
Finally, if they are IP cameras that are insecurely configured or connected to a network, any recording made by them could be paused or altered by a hacker. While this is not particularly difficult as most IP cameras are remarkably insecure, it's still not a likely attack vector in your case. To make it more difficult anyway, you should ensure that the cameras are not exposed to the outside internet, that their firmware is up-to-date, and that they are not using default admin credentials.
The real solution
So what should you do? The answer is actually pretty obvious. Set your cameras to record 24/7 rather than when motion is detected. You will need a larger storage medium or you will need to reduce video quality or framerate, but it will defeat all but the most sophisticated attackers. This will protect from any evasion of the flimsy motion-detection features in most cameras.


Is it okay to only provide clickjacking protection on the login page? I have a question about Clickjacking.

The question is quite simple.  Imagine a login flow like this:

You visit the application login page, eg https://example.com/login.html. There is no Clickjacking protection (i.e. the X-Frame-Options header) on this page.
This page redirects you to the SSO page to actually login, e.g. https://sso.service.com and the actual credentials are entered here.  Clickjacking protection is enabled here.
After logging in you are redirected back to the site, https://example.com/home.html.  There is no clickjacking protection anywhere on the site.

My question is: if I have protection on the login/SSO page alone and don't have protection in any other page of the application, is my application still vulnerable to Clickjacking?

The answer is simple and straight-forward:

Having clickjacking protection only on the login page only protects the login page.  The rest of your site is still vulnerable

It sounds like you have a bit of a misunderstanding, and are hoping that because the login page is clickjacking-protected, someone can't use clickjacking to attack your site.  Unfortunately that is not the case.  Clickjacking (typically) relies upon using the credentials of an already-logged in user.  As a result, there is no need to target the login page with clickjacking.  Rather, you target any other page that has a sensitive action.

In fact, the login page is probably low on the list of pages that need clickjacking protection.  The reason is because you can't use clickjacking to enter a password, nor would an attacker know the user's password to log them in even if it was possible.  It might be possible to use clickjacking on a login page to login a user if the browser stores the password and suggests it automatically, and then follow that up with a clickjacking attack on another action on the site, therefore building up an exploit from multiple clickjacking attacks.  In general though, using clickjacking against a login page is probably not an interesting target in-and-of itself.

As a result, you pretty much have things backward: if you had everything but your login page protected from clickjacking, you'd probably be fine.  If you only have your login page protected from clickjacking, then your clickjacking protection is useless.


How exploitable is a machine with a vulnerable library if it is not open to the internet? Say I have a vulnerable library on a test machine, is it possible for an attacker to use that vulnerability to exploit the system and maybe the network, if the machine is not open to the internet?

This question is best answered from a threat modeling perspective.

First you have to take a look at the interfaces your potential attackers are using. You ruled out access via the internet and you used the tag "air-gap", so I assume no network access in general. This leaves local access to the system like a logged in user or an external medium (e.g. a usb stick) that is inserted into the system and is accessed by the OS.

Next you have to look at the functionality of your vulnerable library. The scenarios depend on your actual situation, so I just give you two possible examples.

If the vulnerable library is part of a local tool or service that a local user can interact with - especially if it runs with high privileges like system or root - you are looking at a potential privilege escalation.
If the vulnerable library is part of the software that accesses the external medium, a malware exploiting the flaw can potentially run code on the system, depending on the type of vulnerability.

So yes, there are several scenarios including the ones I mentioned above. It depends on the types of attackers you face, their access to the system and what kind of library and vulnerability you are talking about. If you are actually not in an air-gap scenario and have the system exposed on a local network, remote attacks over this networks are also possible, if the library is used directly or even indirectly by a service listening on this network.


Recover password that contains known phrase I want to recover a long password with hashcat. The password contains a phrase and between the words are special character sequences. These sequences are limited (< 4) and unknown. But the set of characters to pick from is known and small (< 6).

Example Phrase: Barbara walks the dog
Special Characters: $%-"
Possible Password: Barbara%walks$$%the$dog

I tried to generate all the passwords with regex but that file grew too big. How do I achieve this with hashcat e.g. their rule system?

Mask attack seems to be a good solution.

Generate a .hcmask file with the following lines:

$%-",Barbara?1walks?1the?1dog
$%-",Barbara?1walks?1the?1?1dog
...

And so on, where each line is has differences places for the special characters (?1).

Since you know the phrase, and because the set of characters is small, the total number of lines should be very low.


Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed? Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users.

Can this malicious user crack these passwords?

My understanding is that MD5 and SHA-1 are not safe anymore as GPU assisted password recovery tools can calculate billions of these hashes per second per GPU.

What about SHA-256 or SHA-512? Are they safe currently? What about in a few years?

The question doesn't state how many rounds of hashing are performed. And the whole answer hinges on that point.

All hash functions are unsafe if you use only one iteration. The hash function, whether it is SHA-1, or one of the SHA-2 family, should be repeated thousands of times. I would consider 10,000 iterations the minimum, and 100,000 iterations is not unreasonable, given the low cost of powerful hardware.

Short passwords are also unsafe. 8 characters should be the minimum, even for low value targets (because users reuse the same password for multiple applications).

With a $150 graphics card, you can perform 680 million SHA-1 hash computations per second. If you use only one round of hashing, all 6-character passwords can be tested in a little over 15 minutes (that's assuming all 94 printable ASCII characters are used). Each additional character multiplies the time by 94, so 7 characters requires one day, 8 characters requires 103 days on this setup. Remember, this scenario is a 14-year-old using his GPU, not an organized criminal with real money.

Now consider the effect of performing multiple iterations. If 1,000 iterations of hashing are performed, the 6-character password space takes almost 12 days instead of 15 minutes. A 7-character space takes 3 years. If 20,000 iterations are used, those numbers go up to 8 months and 60 years, respectively. At this point, even short passwords cannot be exhaustively searched; the attacker has to fall back to a dictionary of "most likely" passwords.


How WEP/WPA authentication works in a WiFi environment? I'm looking on a clear schema that would explain how a computer connect to an WiFi access point (WEP or WPA in any version (1,2)).

The basic schema would be :

Computer looks which AP are available
If one known is found, asks the AP for connecting to it
AP answer by asking the password
Computer sends the password
If the password sent by the Computer is correct, AP grants access and give Computer an IP for this network.

This is a simple workflow, but I'm lacking information regarding :

How the Computer identify the AP. Like if this AP hardware has changed but not the name, will it still be considered by the Computer as the same AP or a new one ?
how the password is sent from the Computer to the AP. I seriously doubt it's sent in clear because that would mean that anyone listening could get the password. Is the AP sending the request for the password with it's public key, and the Computer returning the password encrypted using this public key ? is it something else ?

To be clearer, what I'm looking is an explained tutorial/howto on how the establishing connection between an WiFi hotspot and a user is made, including the type of encryption (if there is) prior the authentication (WEP/WPA) (some kind of HTTPS for WiFi to avoid sniffing?).

Thank you for helping me :)

The 802.1x protocol is built on multiple steps.

The supplicant (entity who wants to connect) identify the Access point by its SSID as it would do for any wireless network. Be noted that 802.1x also work on traditional wired networks. For what we know, this can be any hardware that provides this SSID, it can be changed, maybe spoofed.

When you are connected to the LAN/WAN, you can begin to authenticate. You can do this by negotiating with an authenticator (usually the AP itself, or an Ethernet switch). Until you are correctly authenticated, this authenticator will act as a barrier and deny you all traffic to any destination.

There are many mode of authentication available EAP, Radius and many mode for each. All provide many way to exchange keys and way to ensure confidentiality or not. But basically, until you forwarded the required information to the authenticator and it got a positive authentication validation from the authentication server, the switch will remain blocked.

For what I know, you can use a wide range of tools not to send clear text credentials: server certificates (public key encryption), client certificates etc. It kind of share properties with SSL authentication scheme. If you change AP, you will have to do the authentication again. There are possibilities to activate a Fast-roaming protocol by I do not know enough of it to talk about.


is having a `set-cookie: sessionid=xxxxxxx` in every response considered bad practice? My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ends. I can see the purpose of this: By setting the expire time, the time when the browser should drop the cookie can well be controlled, and set to an up to date value every request made.

Two things:

A security expert told me, that this is at least "un-normal" behaviour, normally the sessionid cookie should be set on login only, and the server would then just invalidate the cookie if it's no longer valid
My current configuration is SESSION_EXPIRE_AT_BROWSER_CLOSE=True (https://docs.djangoproject.com/en/2.2/ref/settings/#std:setting-SESSION_EXPIRE_AT_BROWSER_CLOSE), so, the expire is no more a thing, right, and in theory, setting the cookie after login only would be ok.

But, I from my side see no downside on setting the header on every response - I mean, I pass the sessionid on to the server with every request already, and it just kinda returns it (with up to date expires)...?

The Django default is secure.

Changing the way Django sessions work in a way that is not through a supported setting would be less secure, because if you replace django sessions with your own sessions module (or monkeypatch some code in Django's session module) you rely on yourself for security instead of relying on the Django community for security.

Your site should also be HTTPS-only and if so set SESSION_COOKIE_SECURE to True.


Understanding SSL certificate signing I am trying to understand how SSL certificate and signing and the chain of trust works.

I know about root CAs and that they are used to sign intermediate CAs that sign the end certificates that are issued to a website. I also understand how the chain of trust works and that because a ceritifcate signed for X.com is signed by the intermediate certificate that issued it which is signed by the root CA, I can be assured that I am connecting to X.com.

My question is, how long does this chain extend? Can't I use X.com to sign a certificate for another domain, say Y.com. If no, why not? If yes, I don't see the purpose of signing.

In order to be accepted as an issuer for other certificates, a CA certificate must be marked as such: they must contain a Basic Constraints extension with the cA flag set to TRUE. If a client (e.g. a Web browser) sees a purported server certificate chain, with the "X.com" certificate, not marked as a CA, used as an intermediate CA, then the client will reject the chain, in application of the standard certificate validation algorithm, in section 6.1.4, step (k):

  (k)  If certificate i is a version 3 certificate, verify that the
       basicConstraints extension is present and that cA is set to
       TRUE.  (If certificate i is a version 1 or version 2
       certificate, then the application MUST either verify that
       certificate i is a CA certificate through out-of-band means
       or reject the certificate.  Conforming implementations may
       choose to reject all version 1 and version 2 intermediate
       certificates.)

Note the comments about "version 1" and "version 2" certificates. Modern X.509 certificates are "version 3" (their version field contains 2, not 0 or 1). Previous versions for the X.509 format did not have room for extensions, so no Basic Constraints. The glaring vulnerability that you feared, with any certificate owner being able to act as a CA, was, well, glaring indeed. But it took several years for people to catch up.

Fortunately, all current implementations of SSL consider v1 and v2 certificates as "definitely non-CA", just like v3 certificate which lack a Basic Constraints extension.

On a similar vein, Internet Explorer, up to circa 2003 (if I remember correctly), did not check the cA flag... and it was indeed a serious problem, which was promptly fixed when discovered. It says quite a lot about X.509 that nobody had actually tested that for quite some time, because IE already had SSL support back in 1996 and v3 certificates were standardized in early 1999 (so, as is typical for Web thing, they were already deployed at that time, and the standard was more of a documentation of existing practice than anything else).

As for your specific question: how long does this chain extend ? There is no intrinsic limit, in the X.509 standard, about chain length, as long as all certificates in the chain are duly marked as CA (except possibly the last one) and have proper signatures and all the fields in certificates match up as they should. However, certification is trust delegation and trust dilutes very fast when delegated too much. Thus, overly long chains are a strong indication that the whole PKI process has gone bad.

Also, long chains may hit internal limits in some implementations. Chain building (the operation which prepares potential chains to be validated) can become expensive (with specially crafted certificates, it can have factorial cost for a given chain length), so implementations must include some guarding mechanism, which often is an internal maximum chain length. Practically encountered chains have length 2 to 4 certificates (i.e. one root, three intermediate CA at most, and then the end-entity certificate). My own code tends to reject chains beyond 8 certificates, and that arbitrary limit has never been, in my experience, an issue.


Can MITM attacks now decrypt SSL & TLS traffic with POODLE vulnerability? After the POODLE vulnerability was publicized, can MITM attacks now see https traffic? Previously only http websites showed info when sniffed, but now, what about https websites?

Short version: No. While POODLE can be used with MitM to decrypt some HTTPS traffic in specific scenarios, it requires special effort / software (not just Wireshark) and is not going to be usable against up-to-date HTTPS (or any other kind of TLS traffic).

POODLE (Padding Oracle On Downgraded Legacy Encryption) is an attack that can leak data from certain encrypted connections. As with most SSL/TLS attacks, it requires a large number of requests sending the same data; the attacker can generally only decrypt one byte at a time from a specific message that the client (or server) sends repeatedly.

Conditions required for POODLE attacks:

Victim is using a block cipher (this is common) in CBC mode (this used to be common but is getting less so).

Counter-based block cipher modes (such as the popular Galois/Counter Mode "GCM") are not vulnerable.
Stream ciphers are not vulnerable to POODLE in particular, although they may have their own vulnerabilities (the old RC4 cipher, once popular in SSL, has its own weaknesses and is disabled in all modern clients and servers).

Victim is using SSL protocol version 3.0, or using TLS 1.0 with a lazy implementation which doesn't validate the padding correctly.

The entire SSL protocol including version 3.0 is long deprecated. TLS 1.0 is also now deprecated, and the specific vulnerable implementations were patched years ago.
The "Downgraded Legacy Encryption" part refers to tricking the client and server into each thinking the other only supports old protocols; this doesn't work if they either already know that the other supports newer protocols, or if they just refuse to ever use the old and insecure ones.

Victim is either constantly sending the same message, or can be forced (by the attacker) into doing so.

This is often the case with web browsers (if the attacker controls content running in the victim's browser, such as from the user visiting an unsecured web page) but not so much with other HTTPS clients and quite rare with SSL/TLS connections used for anything other than HTTPS.

Attacker has an active man-in-the-middle (MitM) position between the victim client and server, with the ability intercept and modify traffic in real time.
Attacker has the time to force the victim to send hundreds of messages for every byte the attacker wants to decrypt.

Mind you, the attacker usually only bothers stealing a small amount of data, such as a session token from a cookie, so this isn't as many requests as you might think.

You definitely cannot just fire up Wireshark and watch TLS (or even SSL) data get decrypted in real time using POODLE. You can't even decrypt the traffic (using POODLE) from a bunch of passive captures; the attacker needs to actively tamper with each message before letting the server see it. In the right scenario, an attacker can decrypt SSL (or, rarely, TLS) traffic using POODLE, but it requires tools specially written for that purpose, and it requires both the client and the server to support using outdated protocol versions.


Single Sign On vs NT Authentication I did some Googling on this and I can't seem to find a direct answer.

What is the difference between SSO and NT Authentication?

Is SSO a type of NT Authentication? Are they related at all?

I'm a developer just trying to expand my knowledge in other areas so if this is a crazy question you know why.

SSO refers to a type of user experience, not a technology.  SSO is short for "single sign on" and refers to any scenario where a user signs on only once and can access multiple applications that are otherwise independent.

Examples of SSO systems include

Any social login, e.g. when you use Facebook or Google to sign on to StackExchange.
Intranet applications (e.g. your HR web site) that authenticate employees based on NT authentication
Sites using OAuth, which was originally developed for Twitter
Sites using SAML, which is a somewhat older standard
Any .NET site participating in Federated Identity

NT authentication does not have to participate in an SSO.  A standalone Windows computer may also authenticate you using NT authentication.  But in many cases (e.g. within your corporate network), that same authentication mechanism can be utilized by other applications to recognize you, so that once you are signed on to your computer, you are automatically able to use those applications.


Automatic redirection to another website As soon as I open a webpage, I am redirected to another site. I have an antivirus on my PC, but it has not been able to do anything to stop this. I have reseted my browser settings (Chrome) and checked for any malicious extensions also, but no avail. There is nothing there. I have checked my boot-log files, but have found nothing malicious.

I am either taken to this link:
https://apply.standardchartered.co.in/credit-card?selectedCardId=5&se=VCommission_CC_Mailers&cp=Platinum_june&ag=32178&kd=rx_mailer_TBWA

Or to that link:

http://indianews.com-3v3v86d2ck76zvhihg7mm669k4znsfoct.pw/index2.html?voluumdata=vid..00000003-5908-4abf-8000-000000000000__vpid..875e1800-6a65-11e5-8bf7-68951d3e011c__caid..220bd123-58b3-475b-95ad-6a591acd71f6__rt..R__lid..e84c87f6-7600-461e-9f5d-1c4ff52dce63__oid1..e5caf233-f36c-40b7-9b0a-8cadf6a9be48__var1..10%5C_%5C36691656%5C_%5C6e08080b-c59f-418a-87b9-aeb7bdb3bf7a__var2..354802__var3..aedge__rd..srv2trking%5C.%5Ccom__aid..__sid..&clickid=10_36691656_6e08080b-c59f-418a-87b9-aeb7bdb3bf7a&siteid=354802&source=aedge

How can I resolve this problem?

It seems you have adware installed. It usually comes with installing unlicensed commercial software products.  I'd suggest getting the trial version of a product such as kaspersky or nod32 and run a scan when in safe mode as it is more likely that the adware doesn't launch.

If the adware is still in place use the(rescue) live CDs of the above products.


Use USB TRNG as source of randomness for OpenSSL key generation I have an idquantique TRNG (USB).
On my Debian machine, I can easily create a file on my disk coming from that TRNG filled with some random content.

Is it possible to make OpenSSL and GnuPG (for key generation for instance) use the output of that TRNG as source of randomness?

Even better: make these tools making a "mix" of their original randomness source (/dev/random I suppose) and the TRNG source?

I can't fully trust this TRNG (especially because the drivers for it aren't open-sourced).

The purpose behind the last idea is to try to make the randomness better in the best case (where my TRNG is really a true RNG and doesn't have any kind of backdoors) or stay with the quality of /dev/random randomness if the TRNG has some backdoor (repeating patterns, ...) making its output predictable.

Use /dev/[u]random by both feeding it with the entropy of the hardware random number generator and also using it with whatever consumer of random bits you want to use (also OpenSSL will rely on those interfaces). The easy way is simply piping the input to /dev/random, but this will not increase the entropy counter (the driver will have to register as an entropy source to do so).

The kernel will mix entropy from different sources: interrupts because of keyboard and mouse input, network and hard drive timing, ... If you add your hardware random number generator, you will result in a mix of entropy from all of those sources. In the end, any random number with a constant number added up will still remain random, so even if the hardware random number generator is fully predetermined, it will not break the random number generator.

At least, as soon as enough entropy from other sources was added: the only time it might result in guessable random numbers is immediately after the random number pool does not have sufficient entropy from other sources.

I strongly recommend viewing the half-hour lecture The plain simple reality of entropy -- Or how I learned to stop worrying and love urandom held at Chaos Communication Congress 2015, which has a very good explanation of how random number generators mix different sources of entropy. It also explains why you shouldn't care too much of /dev/random and its random bit counter, and use /dev/urandom instead.


aircrack-ng under Win7 -- possible? What needs to be installed to get the full aircrack-ng suite (or the closest possible equivalent) working under Win7?

Should you use VirtualPC, VirtualBox, or VMware Workstation for this?

Should you buy something? Pretend you already have two USB WiFi cards (or one USB and one internal) that are monitor and frame injection capable. Even if this isn't possible with off-the-shelf Atheros radios, then what is the second best option?

What are the steps one needs to follow to make this toolchain capable under Win7?

This is the setup I use for wireless engagements these days.

Windows 7/8 Host OS
VMWare Workstation 9
Lubuntu 12.10 Guest OS

Then add two wireless USB cards (at least one of which with 5GHz cover).  At the moment I tend to use an alfa card with external antenna for the 2.4GHz coverage and a D-Link DWA-160 for the 5GHz piece.  The USB passthrough from VMWare workstation has been reliable in my experience, although it's sometimes a little random as to whether VMWare will grab a USB device as you connect it to the physical port or whether you need to manually connection it through VM--> Removable devices.

As to whether you could use other virtualization platforms, I don't see any specific reason why not, I'd say that the key point would be the quality of the USB passthrough.

As an aside for the host system piece I'm looking at using a Thinkpad Twist to make use of a tablet form-factor which would run the VMWare setup ok. At the moment the touch drivers seem a bit flaky but I imagine that'll clear up.

To cover android as it gets a mention in comments, at the moment it is possible to get monitor mode but only with very specific hardware and the software is a bit limited. Details on the Android PCAP page.  Outside of that there are a number of reasonable stumbler clients for android now, which are useful for tracking down APs that are broadcasting and also for gathering wireless data without toting a laptop around.


PCI Compliance - Service Provider vs Merchant We will be providing a service to a client, where the end user logged on to our system can submit their payment information to Authorize .Net.

I need help figuring out if we as a service provider need to be PCI Compliant.

We will either select the Accept Hosted option or Accept.js option (SAQ A or SAQ A-EP solutions.)

But I also found out here: Understanding PCI Compliance, that PCI Valdiation requirements depend on the number of transactions as well, so does that fall on the merchant(the client) or us as service provider?

We will just route the payment information to Authorize .Net, and we will only keep the last four of card number/ bank account and the transaction ID if available.

So my question really is, whether

Only we need to be PCI Compliant
Only the merchant needs to be PCI Compliant
We both need to get the same level of compliance
We will need to get different levels of compliance

I couldn't really find any thing that differentiates Service Providers and Merchants, so not sure what needs to be done in this case.

Note: We will use the Merchant provided credentials while making calls to the Authorize .Net API.

Welcome to the strange world of PCI DSS compliance.

The merchant has a contractual relationship with its acquiring/merchant bank (aka acquirer) to comply with PCI DSS. How the merchant demonstrates its compliance with PCI DSS is up to the acquirer, it is based on card brand (Mastercard, AmEx, Visa, Discover, JCB) rules and is dependent on the number of transactions a merchant processes a year. The merchant will either need to provide a self-assessment questionnaire (SAQ) or have an on-site audit from an assessor (QSA) ending with a report on compliance (RoC).

Part of the merchant's compliance requirement is the compliance of its service providers (aka you) - this is PCI DSS requirement 12.8. In their contract with you, they should ask you to comply with the requirements of PCI DSS.

Together you will agree which of the 300 or so PCI DSS requirements are appropriate for you to comply with. And, based on your question, it would probably be those contained in SAQ A or SAQ A-EP.

If the merchant is being asked for a self-assessment questionnaire by their acquirer, they
have two option:

1. Ask you  to self-assess

Based on what you’d agreed with the merchant, you would complete the relative SAQ and give it to them. They may also ask you to have an external assessment - this is between you and the merchant.

You asked if you'd both use the same form of assessment and the answer is probably no. I'm going to speculate that the merchant is outsourcing everything to you, so they will probably complete SAQ-A for their acquirer. However, because you are hosting their website you may (as you say) need to fulfil the requirements in SAQ A or SAQ A-EP depending on which Authorize.net service is selected.

(Technically a service provider can only complete SAQ-D but what you would do if you had agreed with your merchant that the requirements in SAQ A-EP were the appropriate ones would be to complete "SAQ-D for Service Providers" (it is different to the merchant SAQ-D) marking all of the requirements that are not included in SAQ A-EP as "Not Applicable" - this approach is described in PCI SSC FAQ 1331.)

2. Be part of their assessment

Let's say you don't want to provide any evidence in the form of an SAQ or RoC to your merchant customer. The merchant would then have to include you in the scope of their self-assessment. So they would "visit" you and assess whether you were complying with all the relevant requirements. The merchant would then complete the relative SAQ and send it to their acquirer, you would not have to do anything. In this case the merchant would complete either SAQ A or SAQ A-EP for their acquirer.

If you - as a service provider - get fed up of people assessing you, you could have your own external assessment by a QSA, get your own RoC and then just give it to any merchant that asks.

There's one more wrinkle. Some card brands (notably Visa) maintain a list of service providers. If you want to get on their list you would have to enter a contract with the card brand directly which would require you to comply with PCI DSS. This would require you to send evidence of your compliance directly to the card brand, and then the card brand would determine whether an SAQ or RoC was applicable based on the number of transactions you process across all the merchants you are a service provider for.

I know, this is initially confusing but I hope that is useful.


If an XML document is not validated as "Well Formed" or checked against a schema, what are the risks? When processing an XML document in my application, what are the risks?  E.g. if it is not "Well Formed" or is not checked against a schema.

Even if you have a "Well Formed" XML document, that does not prevents from attack - injection not always breaks XML document. To prevent XML injection attacks following measures should help:

check for valid XML Schema Definition;
validate/sanitize input;
check and enforce encoding;

For my answer completeness I want to add several useful links:

Testing for XML Injection (OWASP-DV-008)
WASC: XML Injection
WASC: XPath Injection
IBM: Avoid the dangers of XPath injection


Are password-guessing attacks a real threat? There are tons of questions, answers, articles, papers, cartoons etc. on the subject of how to choose a password in such a way that it's difficult to guess or crack with a dictionary-based attack.

I don't understand why a system would allow me to try that kind of attack in the first place, so I'm wondering what it is that I am missing about that type of attack - or any other type of attack that entails trying gazillions of different passwords until one works.

Why would anyone want a system to allow hundreds or even millions of login attempts with the same username and different passwords in a relatively short amount of time? I appreciate to be given some slack if I can't remember my password or if I miss the right key when I type it, but I don't need - nor want - to be allowed to try and fail 100 times with the same username, and at full speed.

In other words, how difficult would it be to design a system such that after a failed login attempt the next one cannot take place before an amount of time is elapsed that is proportional to the number of failed logins for that username? I'm thinking tenths of seconds or something like one more second per each failed attempt, which would not impact a real user's attempts but in my understanding would severely limit the feasibility of dictionary attacks.

In general, except a few niches that I can imagine to exist, wouldn't it be relatively trivial and harmless for the vast majority of systems to make this kind of attacks unfeasible?

Depends what you're defending against, really.

Trying to log into a web application, attempts should indeed be restricted in some way. IP rate restriction is a good start, username level rate restriction is better, combining the two is even better. However, imagine that I have a long list of usernames and passwords from a previous unrelated breach. If I have access to a botnet (go on the darknet and browse for a few minutes - you can buy access for a while) and a little bit of programming knowledge, I can easily set up a situation where each IP address tries a single username with a single password, then waits for a while before trying a different username and password. Given enough machines, I'd be fairly confident of getting a hit with a handful of common passwords and a reasonably large list of usernames.
If the passwords are all strong, though, it'll take me a lot longer, meaning there is a much greater chance of someone noticing the attack.

Trying to break accounts following a breach. In this case, any systems you have in place for restricting the speed of attack are bypassed. I have a copy of the password hashes, so I can throw them into my password cracking rig and wait for a while. The common passwords will again be the first to break, with the really strong ones taking ages (these are big ages. Think geological ages, rather than waiting for a pizza delivery ages).
In this case, I don't care about your restrictions. I might have got the breach data without you noticing, in which case, I can just log in with the passwords I find and clear out whatever is of value in those accounts. Or you might have spotted that I got your data, in which case I'm racing against the legitimate owners to log in first. Either way, it only takes me a single try to get in if I am going to.

In case 1, it adds complexity to the attack, but also adds complexity to the authentication method. Sadly, complexity in code tends to increase the number of issues, so you would want to be sure it didn't have unwanted side effects, like timing attacks, or DoS potential (imagine that I have a shared IP, such as a mobile provider might use, and I cause it to be blocked for a peak use period).
In case 2, it is irrelevent. Doesn't matter to me. Never see it.
As with everything in security, it's a matter of balancing risks. If you have high value accounts, it is worth putting more hoops to jump through, but you should be able to afford a very strict testing process. If you have low value accounts, it might be safer to live with that risk, in order to prevent other attack vectors from working.


security metrics on softwares developed Thinking about software security metrics currently I've thought about the following software security metrics:

number/type of CWE detected by developers (bug reporting)
number/type of CWE detected by static analysis
number/type of warning at compile time (i.e: from stack protector / fortify source )
number/type of (presumed) memory leaks (running software under valgrind or whatever)
number/type of unsafe function calls (sprintf instead of sNprintf)

Now the questions:

What other security metrics on software do you suggest ?
Is there a state-of-the art reference on this topic ?

I was able to found only security metrics on IT but not on softwares (software development).

The goals is to measure and have an overview on how bad/good are the softwares developed and measure where increase/decrease effort on secure software development practices or how/where security process needs some changes.

Say all the metrics you listed in your question report zero.  Does that mean your software is secure?  Does finding 0 bugs mean there are no bugs?

The reason you're having a hard time finding software-only metrics is because software doesn't exist in a vacuum.  Here's a  question that's just as difficult:  How much is a piece of software worth?

There are several questions I'd ask if someone just handed me a report with the metrics you listed here.

What security policies are your metrics being weighed against?  As much as I despise the topic (BOOOOORING!!!!) security in any organization--and therefore its software--need to be based on sound security policy.  And concentrating on software alone as you want to do in your question is sidestepping a piece it shouldn't be sidestepping.  And please note that policies can determine how severe certain bugs are in comparison to each other.

That said:

OWASP has a presentation here that may interest you.

Warnings from the presentation:
Software Security Metrics

Metrics are context sensitive and environment-dependent
Architecture dependent
Aggregation may not lead to strength

Here are a few metrics they list:

Size and complexity
Weakness/LOC (CWE)
Weakness (severity,type) over time (CVSSv2, CWE)
Cost per defect
Attack surface (# of interfaces)
Layers of security
Design Flaws (CWE)

And this paper, while not a one stop reference, does present a method of weighting specific kinds of security flaws, which could be used to develop a scoring system that you can apply to developers/applications.

And lastly, a very important statistic that I think you should consider are the number of false positives, both by testing tools AND by human testers.

And then there's CVSS.


When using LUKS, which parts of the hard disk are not encrypted? Due to stories like the following: https://hackerone.com/news/pink-panther (forced at airport customs to decrypt laptop) being more and more frequent, I thought of the following. What if you simply travel with a laptop where you encrypted the unencrypted parts in a LUKS FDE setup via a script and a live cd. Your entire hard drive should look like random data and you'd have plausible deniability that you wiped your hard drive prior to travelling. Upon arriving at your destination, you simply boot your live cd, download your script from a server and decrypt /boot and your boot loader to have a working laptop again. Now I was wondering, how much would my script need to encrypt, i.e what parts in a standard FDE setup with LUKS are not encrypted.

So I use standard LUKS with a 512 MB ext2 /boot partition:

  $ sudo fdisk -l /dev/sdd

  Disk /dev/sdd: 238.5 GiB, 256060514304 bytes, 500118192 sectors
  Units: sectors of 1 * 512 = 512 bytes
  Sector size (logical/physical): 512 bytes / 4096 bytes
  I/O size (minimum/optimal): 4096 bytes / 4096 bytes
  Disklabel type: dos
  Disk identifier: 0x0de4d334

  Device     Boot   Start       End   Sectors  Size Id Type
  /dev/sdd1  *       2048   1050623   1048576  512M 83 Linux
  /dev/sdd2       1050624 500118191 499067568  238G bf Solaris

The /dev/sdd2 partition is completely encrypted with AES/LUKS and should therefore be indistinguishable from random data. Would it suffice to have a script encrypt sector 0 up to 1050624 in this case? Or is my setup leaking data in other places about it being more than just random data? End of a partition at the end of the disk maybe? Should I encrypt the first 50 MB of /dev/sdd2 too?

As you said the boot partition is not encrypted at all, because dm-crypt + LUKS does not support it.

As second point a typical encrypted partition under dm-crypt + LUKS setup is the sum of the encrypted data and a partition header (containing the master key, all the keyslots, and some encryption parameters).

This header has a well know structure so, even all the partition is full of random data, the partition header leaks the presence of such encryption.
You can easily backup it on a remote website and overwrite it on the disk with random data and later put it back at its original place.

yOu can even get all the parameters for your encryption and feed with all the data the dmsetup command to decrypt your partition without using cryptsetup or luks.

I'm not aware of other possible leaks.

More info about the header format: https://code.google.com/p/cryptsetup/wiki/Specification or see Question 6.12 here: https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions#6._Backup_and_Data_Recovery

    Refers to LUKS On-Disk Format Specification Version 1.2.1
LUKS header:
offset  length  name             data type  description
0x0000   0x06   magic            byte[]     'L','U','K','S', 0xba, 0xbe
     0      6
0x0006   0x02   version          uint16_t   LUKS version
     6      3
0x0008   0x20   cipher-name      char[]     cipher name spec.
     8     32
0x0028   0x20   cipher-mode      char[]     cipher mode spec.
    40     32
0x0048   0x20   hash-spec        char[]     hash spec.
    72     32
0x0068   0x04   payload-offset   uint32_t   bulk data offset in sectors
   104      4                               (512 bytes per sector)
0x006c   0x04   key-bytes        uint32_t   number of bytes in key
   108      4
0x0070   0x14   mk-digest        byte[]     master key checksum
   112     20                               calculated with PBKDF2
0x0084   0x20   mk-digest-salt   byte[]     salt for PBKDF2 when
   132     32                               calculating mk-digest
0x00a4   0x04   mk-digest-iter   uint32_t   iteration count for PBKDF2
   164      4                               when calculating mk-digest
0x00a8   0x28   uuid             char[]     partition UUID
   168     40
0x00d0   0x30   key-slot-0       key slot   key slot 0
   208     48
0x0100   0x30   key-slot-1       key slot   key slot 1
   256     48
0x0130   0x30   key-slot-2       key slot   key slot 2
   304     48
0x0160   0x30   key-slot-3       key slot   key slot 3
   352     48
0x0190   0x30   key-slot-4       key slot   key slot 4
   400     48
0x01c0   0x30   key-slot-5       key slot   key slot 5
   448     48
0x01f0   0x30   key-slot-6       key slot   key slot 6
   496     48
0x0220   0x30   key-slot-7       key slot   key slot 7
   544     48

Key slot:
offset  length  name                  data type  description
0x0000   0x04   active                uint32_t   key slot enabled/disabled
     0      4
0x0004   0x04   iterations            uint32_t   PBKDF2 iteration count
     4      4
0x0008   0x20   salt                  byte[]     PBKDF2 salt
     8     32
0x0028   0x04   key-material-offset   uint32_t   key start sector
    40      4                                    (512 bytes/sector)
0x002c   0x04   stripes               uint32_t   number of anti-forensic
    44      4                                    stripes


pkcs11 with remote HSM Seeking assistance on using PKCS11 with a remote HSM.
I have a small linux host with an HSM card installed.  The HSM has libraries and utility scripts provided to interact with it, on that host.  These include a pkcs11 utility.  What I can’t grasp is how to access this remotely.  I get that pkcs11 provides an API.
But I don’t get how to use it as part of a bigger PKI infrastructure.  If on another linux host I used openssl (or other pki toolkit) to sign a certificate request, I need access to the private key - stored on my host with its HSM.  How do I do that?
The openssl command has some component using pkcs11 like “… -engine pkcs11 -keyform engine -keyfile "pkcs11:model=PKCS … serial=xxxxx ;token= xxxxx UserPIN= xxx …” and so on.  That is obviously not contacting a network service.  So how can a remote HSM that provides a signing key be reached in this case?
Am I getting the sense of this wrong?  Does the whole CSR file need to be sent over to the HSM host and submitted to be signed?  For example using ssh to that host and passing the CSR to a script there that then runs the pkcs11 library functions to return a cert and then provide it to the ssh based request?
I’m missing some details about how this all works.  Assistance appreciated.  Thank you.

As you correctly state the PKCS#11 standard defines an API called Cryptoki. OpenSSL allows to use an engine that connects to a DLL/SO implementing this API ("Cryptoki library"). It's the nature of DLL/SO that this needs to be done locally. The Cryptoki library then talks to the "cryptographic token", which is an HSM in your case.
You should, therefore, look at the documentation of the Cryptoki library of your HSM how to specify a remote HSM instead of a local one. This is beyond the standard and vendor specific.
But every vendor provides this functionality. However, it also requires some daemon on the server where the HSM is installed to accept incoming connections from remote libraries. Usually, vendors sell PCI cards that you can use locally and network appliances that you can use remotely.
An option could be PKCS#11 forwarding. You might have a look at https://p11-glue.github.io/p11-glue/p11-kit/manual/remoting.html but I have never use that tool.


If rowhammer only results in capacitor discharge, how can it flip 0 to 1? In rowhammer, why will changing the voltage on one row cause the other row to open/close? Is it related to induction?

How can it change bits from 0 to 1? I understand from 1 to 0 - voltage discharge, but how can it cause cells to charge?

EDIT: This what I understood reading the rowhammer research document:

Discharge of cells happen when turning the bitlines on and off many times.
So changing the voltage on the bitlines so many times, causes some electrical current on the next bit line (because of  current induction)
Which will open a cell's transistor's gate,
making it connect to the ram buffer,
which will cause the cell to discharge (cells always discharge when reading)

They didn't specifically say that in the article, but that's what I understood.

If that so, how can cells be charged?
Is it possible that the induction is so "strong" it can fully charge a cell, and not just open the transistor gate, or did I get it completely wrong?

Rowhammer only works by accelerating the discharge of capacitors.
Cells don't get charged by rowhammer, only discharged. The reason you may see a logical 0 change to a logical 1 is that modern DRAM memory uses a technique called scrambling, where a small 32-bit seed is used to power an LFSR stream cipher to encrypt memory. This encryption is not designed to be cryptographically secure. It is designed only to help reduce the electrical stress on a module if it experiences huge bursts of sequential 1s or 0s. The scrambling results in any physical bit having a roughly 50% chance of being represented as the inverse logical bit, so you see logical 0s become 1s.
It's not only memory scrambling which causes this disconnect between a physical bit and a logical bit. Some cells represent a logical 1 when they are charged, whereas others are the other way around. These are referred to as true-cells and anti-cells, respectively. The majority of DRAM is composed of true-cells. That is, capacitor discharge results in a 1 becoming a 0. It's only after memory scrambling, as described above, that this can result in seemingly random bitflips on the application level.
If rowhammer were capable of charging a discharged capacitor, we would be in a far worse situation than we are now. Because a DRAM refresh results in checking a capacitor's value and re-charging it if it was charged but leaving it alone if it is discharged, refresh-based mitigations can only protect from excessive rowhammer-induced discharge. Most extant mitigations currently rely on either increasing refresh rate (e.g. going from 64ms to 32ms intervals), or detecting excessive row activations and directly refreshing adjacent rows that may become unstable as a result (e.g. TRR and pTRR).note
The original paper gave three different mechanisms of action:

Electromagnetic coupling - Each capacitor has its own access transistor. When this transistor is triggered, it discharges the capacitor and reads out the value to the row buffer. Changing the voltage of one wordline can induce noise in nearby wordlines, temporarily activating access transistors on that line for short periods of time, facilitating leakage of their capacitors.

Bridge formation - Conductive channels can be formed between unrelated wires or capacitors. Toggling a wordline rapidly can increase the rate of leakage between bridged cells, resulting in charged capacitors discharging more quickly, potentially fast enough to corrupt them.

Hot-carrier injection - While this is not particularly relevant for short-term rowhammer attacks, it has been found that toggling a wordline for hundreds of hours can permanently damage it. This can alter the characteristics of access transistors and capacitors to increase leakiness.


Should LastPass use the YubiKey public identifier as a secret key? I've just picked up a YubiKey.

However, the demo Yubico redirect you to is served over plain HTTP, over which each OTP you generate during the demo is POSTed, enabling you to verify that your key is working properly. The first group of characters of each OTP is a static public identifier of the key.

As services such as LastPass use the static identifier in order to encrypt your password vault for offline use, is it a good choice for LastPass to use the public identifier since Yubico treat this as public knowledge?

No, this is insecure as the public identity is not considered a secret. This is backed up by the fact Yubico send the identifier over HTTP. If this is known to be used for a LastPass account, a MITM could capture the extra offline encryption key as used by LastPass.

Although there is a chance that it has been leaked over the internet, as the master password is also required to unlock the local password vault, the risk is low.

The YubiKey Personalization Tool can be used to configure a new public identity in the case that it has been leaked.


Is knowing 'a' encrypted with 'b' and 'b' encrypted with 'a' a possible threat? Excuse me for question name, but I couldn't find any other suitable title.

I want to validate client connecting to the server. My algorithm looks like that:

Clients sends his login - plaintext
Server sends random big integer AES encrypted with password corresponding to the login
Client decrypt number using his password and sends his password encrypted with the same number for confirmation
Server decrypts password using the same number and checks if it's valid.

Possible eavesdropper might know the password encrypted with integer and the same number encrypted with his password, and here is my question. Is that a possible threat? Is it possible to find password or the number?

What may I do to improve this solution?

Unfortunately you are doing it wrong by rolling your own cryptopgrahy scheme.

  What may I do to improve this solution?

Do not roll your own scheme. Stick to the tried and tested solution for authentication. Use TLS/SSL to encrypt the traffic from the client to your server. Use a strong password hashing algorithm like PBKDF2, bcrypt or scrypt to hash the password for storage on the server.


Encrypting sensitive data in software and storing/decrypting it on a server I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.

I'm developing software which has 2 parts - a C# program run on a single, secure, trusted computer, and PHP software running on a server. This system deals in sensitive data, namely pharmacy records (not in the US, HIPPAA doesn't apply).

I want to securely encrypt the data, so that even in the case that the database is stolen, as little of the data can be decrypted as possible. I'm already protecting the data by not storing any identifiable data like Name, Address etc, save for an email address.

I initially wanted to use a variant on this solution, however on further contemplation I realised that RSA was not an appropriate way to encrypt plaintext directly. My research led me to believe that AES is the most appropriate algorithm for that. I know that the advice given to most people who are not experts on encryption is to follow an industry-standard protocol, however I was not able to find one which matched my criteria.

The criteria are:

For each user's data, only the user himself should be mathematically able to access his data given the contents of the server - meaning a key derived from his password is used (the C# software has full access to all users' data, it can have access to the keys)
Decryption should not be possible having obtained solely the contents of the server
Plaintext data should never be stored on the server (therefore I want to encrypt in the C# software)
Data needs to be able to be encrypted without having the user available to provide his password
Data will only be decrypted and read in PHP - no new data or modified data will need to be re-encrypted and written
Only a hash of the user's password can be stored or accessed

Here is a solution I have come up with:

Naturally, all connections are made through TLS/SSL (over HTTPS). Before any sensitive data is transferred, the server and software are "primed" or paired. An asymmetric key pair is generated on the server, and the private key transferred to the software (I refer to the C# component as "the software"). The private key is deleted from the server, and the public key stored.

When a user registers, their password is used to generate a 128-bit key using PBKDF2. This key is RSA-encrypted using the previously generated public key and stored.

When data is uploaded from the software onto the server (every 24h), the software sends a list of user ids it will be uploading data for (over HTTPS of course). The server sends back a list of the RSA-encrypted 128-bit keys along with the corresponding user ids. The software decrypts them one-by-one using its private key, obtaining a list of 128-bit keys. For each user, the server takes that user's data and encrypts it with AES-128 using that user's corresponding key. The whole payload is uploaded to the server and directly stored.

When a user logs in, their password is accessible for a short time, and PBKDF2 is used to generate their AES-128 key. To prevent them from having to re-enter their password on each page load, the AES-128 key is stored in a secure cookie on their machine with a short (5-10min) expiry time and used on subsequent page loads to decrypt and display that user's data. It's not actually stored on the server at any point.

Is this security protocol appropriate? Should I modify it? Is there anything which is industry-standard and would work here? Any help would be greatly appreciated.

Rolling out your own protocol is hard. You will easily have something which more or less runs, but getting something which is also secure will require a lot of work and a significant amount of luck as well.

From your requirements, you would like a protocol which looks like this:

Each user has an asymmetric key pair, suitable for encryption (say, RSA or ElGamal).
The private key Kpriv is encrypted with a symmetric key K derived from the user password, and then stored on the server.
The public key Kpub is stored on the server with no encryption (it is public).
Data elements are encrypted with Kpub. Anybody can encrypt anything with a public key (that's the point of the public key being public).
To decrypt the data, the user types his password, which is used to recompute K, then decrypt the blob which contains Kpriv. With that asymmetric private key, the user can decrypt all the data files which have been encrypted with the corresponding public key.

The OpenPGP format contains all the needed primitives for that. BouncyCastle is an opensource library which can use that format, and it as a C#/.NET version.


Privilege Escalation (Linux / Windows) I Want Some Books or somethin about windows / linux privilege escalation, enumeration.. tips etc i know the basic.. enumeration os version / kernel version etc

These are very good starting points

Linux

Gotm1lk's basic privilege escalation guide
Kernel exploits
searchsploit linux/local (can slim down results: searchsploit kernel linux/local
VulnHub

Windows

searchsploit windows/local, searchsploit win_x86/local (can slim down results: searchsploit Microsoft Windows VERSION local, etc.
Fuzzy Security guide

Both

www.google.com
Learning how to use the operating system(s) in question.


Malwares source repositories. Where? As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?

Update:  I added the link below after a reading a twitter message
"Links and resources for malware samples"
http://contagiodump.blogspot.com/2010/11/links-and-resources-for-malware-samples.html

Malware specific:

  If you have money:  http://www.frame4.net/home
  Free (and paid):  http://www.offensivecomputing.net/

Exploits:

  http://www.exploit-db.com/
  "The Exploit Database (EDB) – an ultimate archive of exploits and vulnerable software. A great resource for penetration testers, vulnerability researchers, and security addicts alike. Our aim is to collect exploits from submittals and mailing lists and concentrate them in one, easy to navigate database."
  http://www.packetstormsecurity.org/ is another one


What is the "PGP Global Directory Verification Key"? In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key".

Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99):

sig  exp   CA57AD7C 2013-07-14 2013-07-28 __________ PGP Global Directory Verification Key
sig  exp   CA57AD7C 2013-10-10 2013-10-24 __________ PGP Global Directory Verification Key
sig  exp   CA57AD7C 2013-10-24 2013-11-07 __________ PGP Global Directory Verification Key
sig  exp   CA57AD7C 2014-03-04 2014-03-18 __________ PGP Global Directory Verification Key
sig  exp   CA57AD7C 2014-03-17 2014-03-31 __________ PGP Global Directory Verification Key
sig  exp   CA57AD7C 2014-05-02 2014-05-16 __________ PGP Global Directory Verification Key
sig  exp   CA57AD7C 2014-05-16 2014-05-30 __________ PGP Global Directory Verification Key
sig  exp   CA57AD7C 2014-06-25 2014-07-09 __________ PGP Global Directory Verification Key

What does it mean? And why they are all expired (if "exp" means "expire")?

PGP Global Directory

The PGP Global Directory is a certification authority that validates that you have access to the mail address if you want it signed (but doesn't validate anything further than that).

In the end, it is a kind of yellow pages for mail addresses, you can look up keys in there, and with a given chance key owner and mail address owner actually are the same person, but do not trust in it (for example, man in the middle attacks on unencrypted server to server mail transmission would still be possible).

Expired Certifications

Alongside being listed on their key server, certifications are issued. These expire after a very brief period of two weeks, but new ones are added after you validated the respective mail addresses again. As keys are removed after half a year and they send you a reminder e-mail to reverify your key, you will often find these certifications being issued twice a year.


Where can I find sample DMARC failure reports? I want to automate ingestion of DMARC failure reports, both aggregate and forensic. Unfortunately, I don't have a mailbox set up to collect them yet. Does anyone know where I can find sample DMARC failure reports, so I can get scripting?

I'm attaching a few articles where the format of the reports are shown.

For example this image shows the image of Aggregate reports:

Articles:
 - https://mxtoolbox.com/dmarc/details/what-do-dmarc-reports-look-like
 - https://www.validity.com/blog/how-to-read-your-first-dmarc-reports-part-1/
 - https://www.validity.com/blog/how-to-read-your-first-dmarc-reports-part-2/


Using OpenAppID without Snort Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link

Lets say I have a sniffer application for myself; if I implement lua base binding as snort do, can I use OpenAppID as well for application classification. Or "OpenAppID" is just a extension to snort and can't be used by other application than snort.

It is a preprocessor to Snort and can't be used in anything but Snort unless you, essentially rewrite Snort's decoder and preprocessor structure. But why would you do that when you can just use Snort?


Is it possible for a virus or unknown program to automatically start up a webcam How can I secure my computer more, knowing these days that there are many websites, especially ones where you don't have to even click before a virus is downloaded straight to your hard-drive.

I read an article on Flash player having a security loophole that can automatically start up a webcam without the owner even knowing.

My question is: how can I prevent drive-by-download attacks from happening to me?

Even with firewalls and other anti-virus software, I know there are other people out there that are far more advanced and "can do Magic in computers" as the case may be.

You can disable Flash access to your webcam using the Global Privacy Settings panel.

Do not use a computer account with administrative privileges. Create a regular user account that is not authorised to install software.

It is important to use an up-to-date web browser. Popular opinion is against using Microsoft Internet Explorer. Try Mozilla Firefox or Google Chrome. You can install extensions for the browsers that provide additional security, such as blocking JavaScript on a per-site basis.


RSA-Based Signature Algorithms From Beginning Cryptography with Java - chapter 4, digital signatures:

  Signatures are created using the RSA algorithm by applying the RSA
  algorithm using the private key and then distributing the result as
  the signature. Because of the way the RSA algorithm works, this means
  the signature can be decrypted using the public key, giving you the
  process you see in Figure 4-5. The reason it works so well is that if
  a signature decrypts successfully with a given public key, then it
  must have been created with the corresponding private key.

"the signature can be decrypted using the public key"? I thought decryption is done by the private key...?

This is an ill-worded attempt at explaining RSA signatures. The basic operation - modular exponentiation - is the same for all RSA operations. So in that sense you can think of RSA signature verification as "decrypting" with the public key.

However, both the type of key as the message padding are an integral part of RSA operations. They are required to secure RSA operations. RSA padding is different for encryption and signature generation, even if both are informally called PKCS#1 v1.5 padding. The input parameters are generally also different; the signature generation requires the padding to be applied on a specific formatted hash value internally.

Public and private key operations differ in several ways. Both use modular exponentiation. However, private keys require additional protection to make sure that the secret components that make up the private key aren't leaked through side channel attacks. Private key also used a large exponent or multiple values that allow calculations using the Chinese Remainder Theorem (CRT). Saying that signature generation is encryption with the private key is therefore a very dangerous statement; internally they should be quite different operations.

I would urge you to simply read the RSA PKCS#1 v2.1 specifications in RFC 3447. They are quite readable, and they make a clear distinction between the various primitives in section 5.2:

  The main mathematical operation in each primitive is
     exponentiation, as in the encryption and decryption primitives of
     Section 5.1.  RSASP1 and RSAVP1 [EDIT: for signature generation / verification] are the same as RSADP and RSAEP [EDIT: for decryption / encryption, in that order]
     except for the names of their input and output arguments; they are
     distinguished as they are intended for different purposes.

This was different for PKCS#1 v1.5 and earlier versions of the PKCS#1 standard. The change in wording in PKCS#1 was very deliberate. Unfortunately the confusion remains when it comes to the OID that specifies an RSA public key, even one that is used for signature verification:

{iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) rsaEncryption(1)}

This is a legacy of the older PKCS#1 version 1 standards, I'm afraid.

For more information, also see https://crypto.stackexchange.com/q/15997/1172.


Is this code vulnerable? I have developed a php code given below. I would like to know what are the security vulnerabilities present within this php code?

<?php
        if(isset($_SESSION['id'])){
        // get data from mysql table where id = $_SESSION['id'];
        // shows data

        }else{
        echo "pls login";
        }

     ?>

That snippet in itself is not really a security check, it just checks that a value exists before using it (good practice, but not security related). The meat of your code will be in:

from mysql table where id = $_SESSION['id'];

And it all depends on how the data got to $_SESSION['id']. Either before inserting it there or before using it, you need to do the proper security checks, based on what are you going to use the value for. In your case, check for SQL injection AND you are better off using parametrised queries.

If your SQL actually looks a bit like what you wrote, that is, a concatenation of strings with the $_SESSION['id'] unqouted as a numeric value, then, yes, this is VERY vulnerable.


Is PGP web of trust exportable? I know that in local PGP keyrings, there's an idea of trust: I trust this key ultimately, this key less than that, etc.

Is this web-of-trust exportable? For example, if I trust someone@openssl.org and they trust someoneelse@openssl.org, can I import their web of trust?

There are two kinds of trust required: trust in the authenticity of others (named signing in OpenPGP) and trust in a kind of "vouching capabilities", so if you trust in signatures somebody else issued (named trust in OpenPGP).

A Trust Example

A simple example can make these categories clearer: there are some people of certain authority in the free software world, consider Linus Torvalds, Richard Stallman, or the PGP "inventor" Phil Zimmermann. Very likely you never met them for key signing, but still you might put trust in their signatures – you read of their qualities, their objectives. If you trust their keys (gpg --edit-key [key-id], then trust), nothing is won yet. Anybody could have uploaded a key with their name. But if you can create some kind of signature and trust chain to one of them, you'd be able to verify all keys they signed. Maybe you once signed a Debian developer who met Torvalds for key exchange?

Public and Private Data

Signatures are public. They're usually referred to if somebody's talking about the (OpenPGP) Web of Trust. You can either download all (publically known) signatures on a given key using gpg --recv-keys [key-id] from some key server, or even fetch a full key server dump (in 2014, about 6GB). keysigning.org lists a few of mirrors.

Trust is maintained locally and not shared on key servers. Whom you trust is much more sensitive. Signing somebody might occur with anybody you met on a conference or wherever, it does not necessarily reveal your social network. Trust would – and a friend of yours might criticize you didn't trust him. You might like him, but is he doing a good job at verifying IDs?