Is it more blessed to send than retrieve emails? Mandatory-TLS transmission vs IMAP over SSL retrieval A client (another company) wants us to send them info via email regularly (hundreds of emails a day). They requested emails because each email will create a separate ticket in their task management system.

The emails contain private information. We can set up Mandatory TLS (a.k.a. "policy-enforced TLS") on our mail servers to make sure the emails are encrypted in-transit.

My question is: would it be better, instead, to set up a mailbox on our server  and have the client retrieve the messages from this mailbox via IMAP over SSL? My first thought was that this would be more secure, since the mail would not be transmitted between unknown intermediate mail servers, but then I remembered that TLS is the successor to SSL, which I presume means stronger encryption.

So which is more secure: sending the email to the client's mail server, via policy-enforced TLS, or having the client retrieve mail from a mailbox on our mailserver via IMAP over SSL? (Our server doesn't seem to support IMAP over TLS; not sure if that is a thing.)

For the purposes of this question, assume that we have secure mail transmission within each respective company: I'm just asking about securing the mail transmission between the two companies. You can also assume secure mail storage on the two respective mail servers.

There's a similar question about Secure third-party inboxes, but such inboxes would be accessed via a browser, presumably with a TLS connection, not via IMAP over SSL, so I don't think it applies here. The client will retrieve messages programmatically.

My instinct is that having the client's task management system retrieve the messages via IMAP over SSL is more secure because it has fewer "parts", so there's less things that can go wrong. What isn't clear to me is how much benefit there is to using TLS instead of SSL.

TLS in SMTP is hop by hop encryption, i.e. the mails are only encrypted between each mail server in transit but each mail server involved has full access to the decrypted mail. Otherwise these MTA would not be able to add Received or DKIM-Signature headers or similar to the mail.

Apart from that, the sender can only control if TLS is used to transmit the mail to the next hop and the recipient can control that the mail is only received by TLS from the last hop but both have no control how the mail gets transmitted between any other hops. And, TLS does not help against DNS spoofing or misconfiguration when the attacker can control which MX is involved in delivery.

IMAP with TLS instead is end-to-end encrypted. Insofar the IMAP solution would be more secure against eavesdropping by design. You could only reach a similar security with SMTP if you have control of all the hops involved. Depending on your outgoing mail server this might be done by configuring a fixed and direct route to a specific mail server of the recipient instead of relying on the common mechanisms (MX lookup) to automatically find the route.

  but then I remembered that TLS is the successor to SSL, ...

TLS and SSL are just different names the same protocol family and are often used interchangeably or are just called SSL/TLS unless a specific protocol version is meant. In fact, TLS 1.0 is practically SSL 3.1 and the amount of differences between difference between SSL 3.0 and TLS 1.0 might even be smaller than between TLS 1.2 and TLS 1.3.

  ... which I presume means stronger encryption.

Better encryption does not help at all if the attacker is not trying to sniff the traffic during transit but at the mail servers involved which is possible with the hop-by-hop encryption in SMTP but not with the end-to-end encryption in IMAP.


SSL MITM Proxy Security - Can we rely on it? In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate certificate for the site(means the original certificate chain is replaced). I am not getting any alert in my browser because I think the organization has added the proxy's root certificate as a trusted party in my browser / OS.

My question is: Can we trust an SSL MITM proxy for exchanging confidential information (say bank transactions)? I believe that the organization can snoop if they want to as there is not a single end to end SSL connection (There are two I guess - one from my system to proxy and another one from proxy to the original website).

I understand that if the proxy has not replaced the certificate chain, the traffic is secure even through proxy; but here that is not the case. Can you please let me know. Thanks in advance.

It should be secure overall, but it's not as secure as a direct communication (endpoint <-> website) would be, because there is another section that could get compromised (endpoint <-> proxy <-> website) by the attackers and leak your data.

If they want to, they can snoop on everything you are doing and you have agreed to that by signing your work contract.

I am not a legal expert here, but where I am from if you would intercept and monitor bank transactions for any of the employees, the organization can get into serious legal trouble, that's why when SSL MITM proxy is setup we have to whitelist financial sector domains. You should read up on laws about that in your country.


Extra features required for TrustZone to provide main security features The paper Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me? describes 5 desired security features for mobile devices:

Isolated Execution
Secure Storage
Remote Attestation
Secure Provisioning
Trusted Path

If I understand correctly, one cannot design a system that leverages TrustZone's bare capabilities alone to provide these features.

My question is:
What extra features are required (for a system that uses TrustZone) to provide these security features?

My current understanding is as follows (Beware: There are many mistakes here, as @Gilles pointed out):

Secure Boot is a must.
I.e., upon boot, the first code to run on the device must be trusted (e.g., burned into a ROM chip by the manufacturer), and then each piece of code is verified before it is run, at least until control is transferred to normal world.
Combining Secure Boot and TrustZone is sufficient to provide Isolated Execution and Trusted Path.
Isolated Execution and Trusted Path can be leveraged to provide a Secure Storage that is based on a secret known only to the user, e.g.:

A trusted app in secure world  prompts the user for a secret password.
The app derives a symmetric key from the password, and removes the password from memory.
The app uses the key to encrypt some secret data (or other keys) and stores it on disk.
The app removes the key (that was derived from the password) from memory.
Later, when the user wishes to access their secret data, the trusted app prompts the user for the password, and then uses it to derive the key and decrypt the secret data.

In order to provide Remote Attestation, as well as Secure Storage that is based on sealing data to this specific device, a feature that allows only trusted* secure world code to access a device-unique key is required, e.g., Samsung Knox's Device-Unique Hardware Key (DUHK). (This is also discussed in this answer.)
* 'trusted' might mean that this code runs after a Secure Boot. E.g., the Knox whitepaper explains that in Samsung Knox devices the DUHK becomes inaccessible if "the device has ever been booted into an unapproved
state".
Finally, Remote Attestation can be leveraged to provide Secure Provisioning, e.g.:

A trusted app in secure world generates an asymmetric key pair.
The app creates a remote attestation that includes a signature of the public key.
The app sends the attested signature alongside the public key to the remote machine that holds the data that is to be provisioned only to a trusted app in secure world.

Strictly speaking, you can't do anything with TrustZone itself. TrustZone itself is an isolation feature of the CPU core. It adds another level to isolation between processes: in addition to user/kernel or user/kernel/hypervisor, there's normal-user, normal-kernel, normal-hypervisor, secure-user and secure-kernel. But since normal-kernel mode (or normal-hypervisor mode if the hypervisor is in use) can access the whole RAM, there's no place to put code and data out of reach of the normal world. To do something useful with TrustZone, you need not only a core with TZ (which is the case of all Cortex-A CPUs) but also a TrustZone-aware memory controller on the CPU (which some manufacturers omit). A TZ-aware memory controller can firewall memory regions to block a region from being accessed when the CPU is in normal mode. In addition, the DMA controller should also be TrustZone-aware, otherwise the normal world may be able to circumvent memory protections by leveraging a peripheral (e.g. set up DMA between memory used by the secure world and the flash controller, then read the content back from flash).

If your CPU includes a TZ-aware memory controller, it supports isolated execution. However, this alone is of limited use because without other features, the isolated execution environment only runs whatever code was there when the isolation was set up, and can't keep anything past a reboot.

Secure boot, where each stage of the boot process verifies the signature of the next stage before allowing it to run in the secure world, allows whoever controls the ROM to control what runs in the secure world. All Cortex-A processors boot from ROM (as in, actual read-only memory, not flash or EEPROM).

This is still of limited use because you have a secure environment… to do what? If the only privilege that the secure environment has is access to a particular region in RAM, that doesn't do anything useful.

CPUs that leverage TrustZone additionally have a secret key that's accessible only to the secure world. See Does the ARM TrustZone technology support sealing a private key under a code hash? and Secure keys in hardware. With secure boot (for code integrity) plus isolated execution plus one bootstrapping privilege (access to a secret key), the software running in the secure world can implement features such as remote attestation and a limited form of secure storage.

The secure world can store data persistently by encrypting and authenticating data and letting the normal world take care of storing the encrypted blobs. This guarantees the confidentiality and authenticity of the data, but not its integrity. The normal world can still delete data, and can roll it back. To prevent rollback, the secure world needs at least a small amount of rollback-protected storage. In practice, on mobile devices, this is done with the cooperation of the flash controller. The flash controller dedicates a partition to the secure world, known as replay-protected memory block (RPMB), and uses the RPMB protocol to communicate with the secure world on the main CPU, using a shared key that is established when the device is manufactured. Secure storage doesn't need to involve the device user at all: the secure world already has a secret key, it doesn't need to derive one from a password, which would be weaker (typical passwords, even with strengthening applied, are weaker than a run-of-the-mill 128-bit secret key).

“Trusted path” in this context refers to an isolated channel between the CPU and a peripheral. A trusted path needs support inside the CPU, not only TrustZone, but also a peripheral that can be put in a secure mode where it only obeys the secure world, and the bus(es) in between need to isolate the communication. The most deployed kind of trusted path on mobile devices is with the display subsystem, to apply DRM to video rendering. Providing a trusted path for user input and display is technically difficult and not widely deployed.

Remote attestation is not needed for secure provisioning: a server can send data encrypted with a key that only a specific device can decrypt, it doesn't need to receive an attestation from the device. It might want to receive an attestation, either because that's how it discovers the device's public key or because it wants additional content in the attestation (e.g. knowing what software versions it's running).

The big thing you left out is: who controls all of these features? Ultimate control belongs to whoever decides who signs the code that the ROM is willing to load, and that's usually the chi manufacturer, and they allow only code from the device manufacturer. On mobile phones and tablets, the end-user typically has no access to the secure world.


Is it more secure to close port 80 and leave port 443 open I believe that this question is not duplicate of the following question. This is because the answer provided to that question only focus on user experience, while my question focus purely on security.

Scenario: I am running a small website, which is only meant to be used by me and few of my friends. I am using HTTPS to connect to the website, and I left port 80 blocked. All of the legitimate users were informed that the website will ONLY work if they put https:// on the front of the address, and everyone accepted this without any obligation and no one had any issues with this. The website requires the user to login straight from beginning, before they can access anything, which means that the SSL is required from beginning of the connection. While the HSTS is not available yet, implementation of HSTS is also planned on the server.

Question: Is blocking port 80 rendering the website more secure? I have been looking for results on google, however everything focus purely on user experience (e.g. that the user don't need to put https:// on front of the link, or otherwise the web browser wont connect.)

For this question I expect the answer to focus mainly on security. However for further reference I will be alright if the answer also highlight why blocking the port 80 is a bad idea. If this is a case I would like to ask to separate the answer into two parts.

In theory, closing port 80 might make the system more secure: for example, if you ran a vulnerable version of a server listening on port 80, and a different non-vulnerable version on port 443. If you're using the same software for both ports, though, it is unlikely to make any difference, unless there are specific bugs which only work on given ports. Given that most web server software is written in such a way that it can listen on any port, it seems unlikely that there would be radically different code paths taken though (it's even possible although uncommon to run HTTPS on port 80, after all).

The general principle is to minimise the number of ports exposed to the world, and since the primary benefit of opening port 80 is to aid usability, which you've said doesn't apply in this case, there is little point in opening it.


How to respond to attack made from my dedicated server? There was a sudden unusual peak of outbound traffic from my hosted dedicated server (OS - Windows Server 2008 R2). The hoster threatened to block the server if the problem is not solved.

There are an ASP.NET MVC application and a SQL Server 2008 Express database installed on the server.

After that I've installed all missing security patches, changed and hardened passwords, scanned the server with Microsoft Malicious Software Removal Tool (nothing found). But I don't feel the problem is solved.

What should be done in such a case?

If you're truly paranoid, extract only data and completely reload the server.

In most cases, I find it satisfactory to boot the server from a bootable anti-virus rescue disk and run a full scan. Kaspersky's free bootable, updatable rescue disk is a good choice.

ftp://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/

It is important to use a bootable scanner. Some modern malware can completely make itself invisible during the boot process and thereby hide from scanners, even in safe mode. By booting from a CD, you don't give any malware a chance.


verify an api call is made from the mobile device I am developing a webserver and provide an API to be used by mobile clients.
Some of my calls are without any authorization, for example, to start the authentication process.

Is there a good way/best practice to verify that these calls are made only from the device?
For example, my authentication process used a 3rd party service to send SMS messages, and if someone uses this API from the computer he can cause the sending of many SMS messages which would cost much. Is there a good way to prevent such attacks?

Unfortunately no, there is no way to prevent this, but there are ways to mitigate and reduce the abuse. The reason is that eventually whatever process you are using to authenticate your client app, it can be reverse engineered and imitated in a third party app.
Ways to mitigate are:

using some kind of challenge response between the server and the app so that the client must respond to the server challenge with the correct response.
code obfuscating the part that handles the challenge response in the client
periodically changing the challenge response algorithm so that whomever reverse engineered it and imitated it will have to repeat the whole process.
putting some hard limits on API usage so it can not be over abused.


New Gmail login system—going against conventional wisdom? I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input.

Does this not go against conventional security wisdom to not divulge information about whether an username exists, to thwart the class of attacks that tries many possible usernames?

I assume Google knows what they are doing, so does this mean they have some way to be secure against what is conventionally considered a vulnerability?

For smaller sites, you don't want to allow hackers to enumerate your user lists, but for Google, the site is so large, one can assume almost everyone has an account or several accounts. So, the risk is minimized after a threshold of ubiquity.

It is still a good idea for most sites to not disclose whether a username exists, but the risk needs to be weighed against the new user registration process. What you want to prevent is an automated process from enumerating your lists. The new user registration process should include some form of delay or gate so that a script can't rapidly try a dictionary of users. This is often achieved by sending an email with the results of the un/successful registration process. Yes, one could still enumerate, but there is a delay and an additional step.

Another thing to consider is the difference between a public site and a private site. Google is a public service an usernames are also public (disclosed with every email sent by an account). On the other hand, an internal corporate site, where only current employees can access, is private, and requires more stringent controls to prevent enumeration.


Is Chrome giving out information about me? I'm stepping up my privacy online and have recently switched to Google Chrome, which may be a huge step backwards. Chrome pesters the user to sign in with their Gmail account. When I first created my Gmail account I told the truth about my location and I'm wonder, does Google support APIs that give out my geographical information that's associated with my account? One problem is for work I connect through VPN to networks in different countries and Chrome always asks me do I want to change your default search from google.us to google.fr etc. Also on YouTube when I comment on a video it somehow has my real name and I can't find the setting to change this in my Gmail account.

Generally speaking how concerned is Google with privacy?

I've been looking into this recently and, yes, Google are collecting information as you use Chrome but Google claim to collect this data anonymously.

Be aware that 'anonymously' in this context means it is difficult for Google to personally identify you but they can combine some pieces of information to identify the collective activities of an anonymised user through the use of a unique ID.  Not all of the telemetry from Chrome uses the unique ID though, some of it is completely anonymous.

There is a a very good description here:

https://www.google.com/intl/en/chrome/browser/privacy/whitepaper.html

Obviously this is a biased source but I came across it while I was looking at Chrome's privacy controls.

Regards.


Do I need to have Airpcap? I am learning system security in an online course. In a practical experiment I tried to monitor the traffic through my router using wireshark1.10.3. But I have a feeling that it only sensing traffic from my windows laptop to the router, but not all systems connected to the router.
Do I need to have a Airpcap adapter to monitor all the packets from my router or is there any alternative?

Are you looking to monitor packets between your computer as a client on the network and the router and other wireless clients and the router? If you're using windows, it looks like the answer is yes: you'll need to purchase Airpcap.

http://ask.wireshark.org/questions/8504/supported-adapters-for-wireless-packet-capturing

If you're attempting to monitor at some other point, you might clarify?  Are you capturing on the router?  On the WAN port of the router?  Or are you collecting as a client on the network and expecting to see activity of wired clients in your capture?


The reason you're seeing alien characters is that it's displaying hex characters when it has to ('\xfc', for example), and ASCII when it's mappable (so the 'H' immediately following is there instead of '\x48'). So it's not pure hex - it's an ASCII string with the non-ASCII characters hex-encoded.

Are the ip address and port encoded in there? You can likely just find them in the original hex string, before attempting to decode them, and change it.

Just remember that they're probably encoded as little endian. Normally when I'm writing shellcode, I use a port where endianness doesn't matter, like 0x1313 or 0x6666. But that's just laziness! If you want to find and replace their port number, if it's for example 4444 (0x115c), you'll probably want to search for '5c11' (little endian) and replace it with the port you want (like 0x6666 or whatever).


Would using distinct IP addresses help support browsers with older SSL implementations? We have a site with two wildcard certificates: *.foo.com and *.bar.foo.com. All of our subdomains resolve to the same IP address.

Newer browsers work fine with this, but IE7, for example, does not. My understanding of the problem is this: in older version of SSL (prior to TLS 1), the domain name itself is encrypted. Thus, when a request comes in to the server, there's a chicken-and-egg problem:

It needs to decrypt the request in order to find out the domain, but
It needs to know the domain in order to pick the right certificate to decrypt the request

I think this is the problem, and that it is also connected to the fact that the differnet subdomains point to the same IP.

I think that if we used different IP addresses for these subdomains, the server could differentiate requests that way and pick the correct certificate.

Is this correct?

Your particulars are wrong (it is not a problem of encryption per se) but you have the right general idea.

In SSL/TLS, the client first connect to the server and sends a "ClientHello" message stating "I wish to do some SSL with you". This happens just above the TCP layer, and below anything which is related to HTTP; an HTTP request will be sent within the SSL tunnel only after the SSL tunnel has been created. SSL tunnel creation is done through the procedure called "the handshake", of which the ClientHello message is the first step.

During the handshake, the server sends his certificate to the client. The certificate contains the server name and his public key, and it is signed by a certification authority. The client will accept to use the public key only after having "validated" the certificate, a process which entails the two following steps:

The client must verify the signature by the certification authority over the certificate. It may have to validate the certification authority's own certificate before that, though; the process is recursive. Certificate validation is full of intricate details which I will skip here because they are not relevant to this discussion.
The client must check that the intended server name indeed appears in the certificate. Because that's the point of the certificate: to bind a public key (a mathematical object with which cryptography is done) to an identity (the server name); the certification authority issues the certificate (i.e. signs it) only after verified in some way that the public key is indeed the one for which the server controls the corresponding private key.

Once the client is reasonably sure that he has the correct public key, he can finish the handshake: depending on the negotiated cipher suite, this entails asymmetric encryption or digital signatures; either way, the server will use his private key. At the end of the handshake, both client and server end up with a shared session key with which more cryptography is going to happen, this time symmetric encryption.

Then, and only then, can "application data" be transfered through the tunnel. In the case of HTTPS, "application data" contains the actual HTTP request.

Now, the problem is the following: the client wants to contact a given server (with a name such as www.foo.com), but that intended server name is sent to the server only with the HTTP request. At the TCP level, only IP addresses exist. When the server needs to send his certificate, he only knows that it was contacted under some IP address, but it does not know under what name the client tries to locate it. Nevertheless, the server must send a certificate which contains the right name. When the server only hosts a single HTTPS server per public IP, that's easy: only one possible name. With several HTTPS servers sharing the same public IP, the server has to do some divination, which, on a general basis, is not possible for computers (it is already quite hard for augurs).

Possible solutions:

Embed several names in a certificate. The server has only one certificate, but it contains the names of all the HTTPS servers which share the public IP. This is supported in X.509 as the Subject Alt Names extension. This requires client browsers to actually support standards the way they should, so this is not a given. This page claims that most browsers support it, but I think this warrants at least some extensive testing (especially when there are several names in the extension and these names contain the "wildchar" *).
Enhance the protocol with an extra exchange at the beginning. This is known as the STARTTLS option. In an HTTP context, this means that the client would first sent a special HTTP request which contains the server name, with a special command (namely "STARTTLS" instead of a normal "GET") to indicate the willingness of the client to engage into an SSL/TLS handshake right away on the same connection. This has been proposed at some point for HTTP, but rejected because it does not work well with existing HTTP proxies. STARTTLS is used in other protocols such as SSMTP or IMAPS, where an actual connection is always available.
Have the client send the intended server name early enough in the handshake, e.g. by smuggling it somewhere in the ClientHello message. This is known as Server Name Indication. This is what the HTTPS world is aiming at.

The biggest issue with SNI is that it is not supported by IE on Windows XP (it requires IE 8+, but also a Vista or newer version; because the actual SSL code used by IE comes from the OS, not from IE itself). So you have to somehow induce your clients with WinXP to switch to Firefox, Chrome, or some other browser which knows about the SNI and does the SSL itself instead of relying on the implementation provided by the OS.


Buffer overflows on the heap vs the stack It is my current understanding that in order to successfully exploit a stack-based buffer overflow vulnerability, we must first overflow the buffer, thus overwriting the return pointer and gaining control of EIP. Once we control EIP, we can utilize a JMP ESP instruction in order to jump to the beginning of our stack, executing our shellcode (let's assume DEP or ASLR are not in place just for simplicity and theoretic sake).

Now for the heap, I understand that overflows are still present. My question is: Does the exploitation of a buffer overflow look different upon the heap? If so, what are the finer details?

With a stack overflow - if you just keep overflowing - you overflow first locals vars, then saved registers, then return address, then function arguments, then stuff further down the stack, maybe exception handlers, etc.
Usually as an attacker you indeed use the overwritten return address to jump somewhere interesting.

With a heap overflow you overflow ... whatever lies beyond your piece of memory. In old or bad heap implementations that might be heap metadata that can give you e.g. the power to write stuff into memory (which you could use to overwrite a function pointer). In other heap implementations you will have to engineer a pattern of allocations and deallocations to get the heap into a state where there is an interesting allocated piece to the right side of your piece of memory. Maybe a vtable or some other function pointers.

Heap overflows are highly specific to heap implementation and application. On linux there are the „house of ...“ techniques because glibc malloc is a joke (sorry!), on windows the heap got very well secured and well randomized and you have to hope for applications to bring their own insecure heap implementations to get 1% more performance. They often do.


Wannacry testing in lab - Not getting SMB scan attempts So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is that when I'm running wireshark I don't see any attempts of the SMB exploit on the other machine. Is it because wannacry is detecting the vm?

I want to see SMB activity in my lab, which is my main goal of this test.

WannaCry does not have any VM detection features, at least according to all the existing analysis. WannaCry itself also does not launch the EternalBlue SMB exploit; the WannaCry dropper does. If you're just trying to use the unpacked crypter executable, you won't see it attempting to exploit EternalBlue.

The first thing the dropper does is attempt to resolve and connect to a particular domain (later referred to as the "killswitch domain") on port 80. If it succeeds, the malware exits. It is unclear what the purpose of this was in the original malware, but it could either have been an intentional killswitch or a way to avoid analysis on malware honeypot/sandbox platforms that cause every domain lookup and connection to succeed. Security researcher Marcus Hutchins (aka. MalwareTech) registered the domain after seeing it during analysis and discovering that it was available, without really realising the impact of the domain, and that effectively stopped the progression of the malware in the wild.

The domain in question was:

iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

If your VM is able to resolve and connect to the killswitch domain, the malware will simply exit.

Since the dropper uses the InternetOpenUrl API to perform the check, it respects the proxy settings, so you can configure a non-existent proxy in the Internet Explorer settings in order to make the check always fail and make the malware run.


What is Application Layer Encryption in Web application? I have found a lot of definition of application layer encryption through Google but none of them is giving a concrete example of how to do it in web application.

The following post says encrypt the data is only view able in your applications memory space.
Transport Layer Encryption vs. Application Layer Encryption

What does it actually means when let say I am building a banking web application. How does it perform application layer encryption?

Is there any difference on client side or server side?
Does encryption in database considered as application layer encryption?
How is data encrypted on client side? Is it using javascript on browser or this is done on the server side?
If I implemented application layer encryption, does it add another layer of protection from MiTM attack if https / CA is compromised?
Where does encryption and decryption take place?

It will be really helpful if someone can clarify it. I have experience with building web application in RoR, Django and nodejs. Any examples will help.

Thanks

You normally use Application Layer Encryption for app to app communication: firsts app encrypts its data and sends it whatever the underlying transport is to the second one. And the data will only be decrypted there.

In a browser to server application, the only way would be to use client code (Javascript) to encrypt the request payload and decrypt the response payload. I willingly use payload here, because at application level only the request and response payload is considered. And on the server side, the server application will decrypt received data and encrypt what it sends back.

But it is more used for web services. Here the client application can more easily encrypt/decrypt the data before sending it and after receiving it.

In fact the way I described the browser to server Application Layer Encryption is just a special case of a web service where the client is a Javascript application.


Is crossdomain policy file required by EVERY web application? 1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ?

2) If a web application does not host crossdomain / clientaccess policy file, is it vulnerable ?

Short answers : 1.) no not a requirement 2.) yes via authenticated client browsers being manipulated.

SilverlightFox is correct in that the crossdomain.xml is not a web application requirement. Per Adobe's website the crossdomain.xml is a policy in the form of an XML file which "grants a web client, such as Adobe Flash Player or Adobe Acrobat (though not necessarily limited to these), permission to handle data across domains"[1].

That said it's more geared toward the protection related to client-behavior and not the servers themselves but client security is important as you don't want a third party bad actor attacking your website via an authenticated client.

Likewise it may be an organizational policy to have one for all webserver deployments just on the off-chance flash is used or is uploaded to the site via some other type of attack but from a purely technology perspective it certainly isn't a requirement to protect the server itself.

The real security concern around the crossdomain.xml issue is when a flash client receives malicious commands from a malicious flash server which could cause the client to make requests from your server using the clients credentials. In this case if you accidentally had a misconfigured crosssdomain.xml file such as

This would allow the commands from a malicious server to be executed as the authenticated client connected to your site giving an attacker access to your server via that users session. If you have sensitive data this would be a problem.

To protect from this it would greatly help to have a correctly configured crossdomain.xml restricting these actions to your domain or a specific host.

The following website goes into this issue in greater detail but as a quick answer to your question yes there is value in this security-wise.

http://gursevkalra.blogspot.com/2013/08/bypassing-same-origin-policy-with-flash.html

Cross Domain Policy File Specification:

http://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/CrossDomain_PolicyFile_Specification.pdf

[1] Quoted Adobe article on setting up a crossdomain.xml policy file:

http://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html


Can I use SHA-512 hash as AES key? I want to combine hashing and encryption for better security. So can I use a hash key generated from SHA-512 as a key in AES.

For example, I have a password "secret", I calculate SHA-512 hash for it and I want to feed those bytes as key for AES.

What things I need to care while implementing this?

Technically, not as stated. AES-256 requires a 256bit key. SHA-512 will output 512 bits so unless you chop off half of the digest it will not work.

A better solution is to use a standard and well tested key derivation function such as pbkdf2.

Don't roll your own crypto unless absolutely necessary. Use vetted constructions.


FIPS 140-2 ready linux distribution We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space.

So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the distribution configuration?

CentOS has "fips" mode, but, again, you have to tackle CentOS configuration to make it FIPS compliant. I'm looking to "just install" distribution.

Red Hat regularly puts its OS through FIPS 140-2 certification. See this press release from 2016.

Whether it works out of the box with zero config, I'm not sure, but that config should be easy to automate.

Also, be careful with the term "fips mode". Typically this means that, while running in this mode, the software only uses FIPS-approved crypto algorithms, and performs FIPS-style power-on self-checks, but simply turning on this setting does not mean that you meet all aspects of FIPS compliance. Unfortunately, unless you're buying a packaged hardware appliance like an HSM, there's no way around needing to read the manufacturer documentation to see what steps you need to do to be FIPS compliant.


Whether certificates can be used for regulating access I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose.

My problem is that my so called server have only limited memory and processing power but somehow can deploy an SSL. My client is a mobile device.

What I need to do is establish an SSL connection with the embedded device. For this my mobile device to be authenticated first with the embedded device.

My questions are:

Whether certificate based authentication can do that ?
What all things should be there in the embedded device first?
How does this thing happen actually?
Is there any mechanism other that this for an embedded device?

A certificate typically implies that you have taken a public key and gotten a certificate authority to sign it to validate identity.  You don't need this second step; you just need a list of the public keys you are willing to accept from trusted users.  E.g., in ssh you have a list of trusted public keys that you put in your ~/.ssh/authorized_keys allowing people with the associated private keys to ssh into the machine.

Obviously, you may need a signed SSL certificate for your server, so users can verify your identity.


What is the point to the IPEK in DUKPT? I'm trying to understand the DUKPT (Derived Unique Key Per Transaction) system used for PIN devices, but I'm getting hung up on the IPEK.  This blog post has an image where the sequence is:

BDK (Secret)
IPDK (Generated, used, then thrown away)
Future Key (Generated, used in devices)
One-Time encryption key (Generated, used to transmit data)

I know that given a Future Key and the transaction counter (which is also included in the transmitted data), the correct One-Time key can be generated to decrypt the data.  What I'm failing to understand is why the BDK isn't used to generate the Future Key directly.  Why go though the IPDK?

Derived Unique Key Per Transaction (DUKPT) is a key management scheme in which for every transaction, a unique key is used which is derived from a fixed key. Therefore, if a derived key is compromised, future and past transaction data are still protected since the next or prior keys cannot be determined easily. DUKPT is specified in ANSI X9.24 part 1

The key aspect of DUKPT is that for each transaction that is originated from the PIN device, the key for encryption shall be unique. The key shall not have any relation with the keys that were used in the past or the keys that might be used for future transactions. The encryption algorithm that shall be used is TDES.

IPEK is derived from Base Derivation Key(BDK). The inputs to create IPEK are the PIN Device ID  and the Key-Set ID. The Key-Set ID uniquely identifies the BDK. So you can see that, with one BDK, you can have multiple IPEKs. One IPEK for each device with unique ID. The BDK shall not be known to the PIN device. The BDK is a super secret key which shall be known to the gateway with which all PIN devices communicate. The gateway shall store the BDK securely in a HSM device. The BDK cannot be shared among the PIN devices. Period. Thus comes the IPEK to rescue.

Once the terminal has been initialized with IPEK, it shall populate the 21 Future Key registers by invoking a non-reversible transformation process. The inputs to this would be IPEK and a value which is function of the register number. Then the IPEK is discarded.  Now the terminal has 21 Future Keys stored in 21 registers. Now PIN device can communicate witht the gateway, encrypt with the generated key along with meta data which includes Key-Set ID and device ID. With this meta data and the BDK , the gateway also shall derive the key for decryption.


Get data without Firewall detection I was browsing through some cyber security questions and I came across a question that kept sticking in my mind so I figured maybe I just ask here.

The question is:

  What is a way to get data from a private network you hacked, without being detected. The network has a NAT gateway (including firewall) to the public Internet.

I was thinking: as there is a firewall in place, most incoming connections will probably be logged or blocked. So in order to get data I would try to start the transmission from within the network to the public internet. Also, as the system is already hacked, I could save the Firewall log before transmitting data and restore them after the copy file transaction is complete.

Is my idea complete crap or is there a clear answer to this? This is just out of curiosity, I do not want to motivate someone to describe detail hacking skills now, just a general approach would be great.

In my own opinion when it comes to data exfiltration you should approach the situation from two:

Public facing network (our NAT gateway (including firewall))
Internal network (internal VLANs, the internal network)

In general NAT gateway (including firewall) will do nothing at all (nada, blank, only IPs and ports.. hooray!) to protect any data as far as the opened (forwarded) ports with their respective services or applications are vulnerable.

If you have in your network a vulnerable application with Remote Code Execution and you expose it to the world then is job done. Is just a mater of time until an attacker with knowledge to the RCE will exfill data from that server and other assets from the internal network (pivoting through the first web server).

Even more an NAT gateway (including firewall) will not protect you from Reverse Shells or other means of data exfiltration from the internal network.

Also in case of a Web Application you do not even want to worry about logs as they would only log access (prohibited or not). Your expose Web Application to the world, thanks and I know that I will look just like a legitimate user when sending the payload as far as I am not sending a lot of requests per second.

In a short answer, In my opinion:

The best way to detect an attack over an Web Application is to use an
WAF.
The best way to detect an attack on something is to use an
IPS/IDS.
The best way to protect data leakage is to have an DLP and an IDS at
the lvl of network with certain on host or on server appliances.
The best way to restrict and manage access to your network is to use a firewall.

Some tricky ways to extract data from an internal network or from an internal application servers:

Over port 0 (yes, it is a port)
Over web requests (I request attacker.ex/data?=this_is_the_victim_data)
Over DNS requests (I request this_is_the_victim_data.attacker.ex)
Over VPNs or proxy (It should be your last option as it can be easily detected)
Over some public and legitimate services (Web Applications, ftps, ftp etc.)
By replacing an legitimate services (for example replace the ssh service on a compromised public faced server and extract data through the generally ignored ssh banner)
Sky is the limit here...

Yes, for: "Also, as the system is already hacked, I could save the Firewall log before transmitting data and restore them after the copy file transaction is complete."

"Is my idea complete crap or is there a clear answer to this?" Is hard to replace a log but was done it before, I have done it before.

Let's not add all the ways you could be not be logged or block by a firewall and keep it for a better day.


Metasploit Meterpreter alternatives These days I am testing various type of client hacking techniques, but in all scenarios I am using Meterpreter variations as payload. Now I can bypass Anti-Virus and Firewalls easily, but Symantec Sonar and IPS always detect Meterpreter payloads and block the attacker IP.

Is there any better payload than Meterpreter that can bypass IPS?

Is there any payload writing tutorial on the net that matches my needs?

Bypassing AV and IPS can be done through meterpreter or any other RAT. Most of the time meterpreter is handy because first it is open source and second it is implemented as a reflective DLL which insert itself in the exploited process without touching the disk.

AV solutions can be bypassed easily through the Veil Evasion project while reverse_https meterpreter can bypass the IPS since the connection is encrypted. You have the option of Stage Encoding for encoding the second stage metsrv.dll as well which can bypass a lot of IPS solutions. Also, the stageless meterpreter over HTTPS is very handy in bypassing the host and network based detection solutions as well.

However, sometimes meterpreter being a synchronous payload where the user needs to interact with the session becomes difficult to manage e.g. when client side attacks or campaigns need to be executed over large periods of time. In such cases, you always have the option of using Throwback, Pupy, or the Cobalt Strike's Beacon payload. The advantage of these payloads is that they are asynchronous in nature and all of them are implemented as reflective DLLs which means they can be used with Metasploit through the payload/windows/dllinject/ payload type. And since these payloads are not used as often as the plain meterpreter in the Metasploit source tree, they can bypass many AV and IPS solutions out of the box.

Lately, the payloads implemented in pure Powershell can bypass AV as well as IDS/IPS. Powershell Empire is one such payload implemented in pure Powershell.

One thing that was missing from Meterpreter is to script the actions in the first stage without contacting the handler. Such a thing is now in the main source with Python meterpreter, and in the coming days, the functionality will be ported to other meterpreter payload types as well. Take a look at my answer at Techniques for Anti Virus evasion for a list of techniques for bypassing AV for further explanation on the topic.


Does git use the ssh user keys or the repository's deploy keys for encryption? In this question I asked, why the SSH-Host key shown when connecting to a gitlab repository does not match the one shown on the instance configuration page. Nevertheless, the accepted answer says that a man-in-the-middle attack seems very much unlikely (and I agree on that).

However, just out of interest, suppose there was such an attack at place. This seems to be preventable if git uses the repository's deploy keys or the user's ssh-keys for encrypting the connection. That is, because I can log in on gitlab via an https connection (which then I know to be secure) and place the keys there. Therefore, an attacker would be unable to decrypt the data transmissions.

My question is therefore: Does git use the ssh user keys or the repository's deploy keys for encryption?

tl;dr: No, this will not work. The fact that the server knows your public key does not authenticate the server, even if you try to keep the public key secret.

  This seems to be preventable if git uses the repository's deploy keys or the user's ssh-keys for encrypting the connection

Several issues here:

git has no such concept as a "repository deploy key", this is part of GitLab. It appears to be simply a public key configured to allow read-only access to the repository, intended for use in code deployment (you may already understand this, but your question isn't fully clear to me).
Using your ssh key to connect to something authenticates you by proving that you have the private key. It doesn't authenticate the server. This is why host keys are necessary.
ssh keys aren't used to encrypt the connection, only to authenticated an already established secure connection (establishing the secure connection is a separate part of the ssh protocol)

Public keys are called public for a reason, you should never assume it to be private even if you just generated it to add to GitLab over HTTPS and don't use it anywhere else.

ssh authentication involves sending the public key to the server to see if it is allowed (called "public key blob" in RFC 4252 section 7). This is done after establishing a secure connection so that it can't be intercepted, but that doesn't matter if the session was established with a malicious server. An impostor could simply reply with "Why yes, I will accept that key to authenticate that user!" and fool you into thinking it's the legitimate server. The only correct way to authenticate a server with ssh is by using its host key.


Decrypting a Truecrypt system - how to make deleted files unrecoverable? If I have full disk encryption on my computer and want to decrypt it, but want to delete senstive documents before decrypting, how do I ensure they are unrecoverable post-decryption?

Edit: I suspect someone will mention a File Schredder type program. My understanding is that these still leave traces that can be recovered forensically, even with 32 passes. Is this correct?

Depends on the hardware, if you are using an SSD then there is a "chance" (read very expensive material needed) to recover those documents. If it's a magnetic disk, then there is no way to my knowledge.

If you really want to get rid of your documents, burn your hard drive and just reinstall your operating system. That will probably be faster too.


SSH over VPN blocked on certain networks Why can I only access protected resources over VPN on some networks?

Location          | SSH to GitHub | SSH to private IP
------------------|---------------|-------------------
On-campus Wi-Fi   | Yes           | Yes
Coffee shop A     | Yes           | Only on VPN
Coffee shop B     | Only on VPN   | No

Here is the output when I try to SSH while connected to the University VPN (Cisco/IPSec) at coffee shop B:

$ ssh -T git@github.com
Hi RinkAttendant6! You've successfully authenticated, but GitHub does not provide shell access.

$ ssh 10.X.X.X
ssh: connect to host 10.X.X.X port 22: No route to host

Is the coffee shop able to inspect the VPN traffic to determine whether I'm connecting to GitHub or an internal network, or is there another explanation for these results?

Everything works as expected at coffee shop A, if I understand this answer correctly: https://networkengineering.stackexchange.com/a/23976

From my comment: The coffee shop B may be assigning you a local IP address in the 10.X.X.X range, (which is in the range of the host your attempting to SSH to through the VPN) and that may be your conflict.

Resolution: After a bit of searching I found a similar question and answer over on server fault. The easy solution is to change your internal IPs to a range that's not allocated by most coffee shops, hotels, etc 10.123.0.* maybe.  The complicated solution that's more reliable is not tricks as mentioned in the accepted and we're.


Contact form without validation one of our web page is a contact form eg name, email, and a textbox for sending comments. It seems like if we leave all of those text fields blank and click the submit button, it still went through without giving any errors. Would you consider that a vulnerability, as I think an attack could be automated to submit the form and cause a DOS? in such a case, would implementing re-captcha the best to prevent DOS from happening? what other types of attacks can be used ? I am trying to mitigate as much attack vectors as possible. thanks.

No - I would't not consider the ability to submit an empty form as a security vulnerability.  I can't think of a reason that the ability to submit an empty form would be more vulnerable than the ability to submit a form with valid or even dummy data.

It is an indication of a poorly written application - and if I came across this I would suspect that there are real vulnerabilities throughout the site, but you can't say for sure without doing an audit.


How to access SQL server inside a Powershell script I'm coming from a Linux world so I'm a bit at a disadvantage here.

Assuming a windows Task scheduler script that calls a stored procedure to return some rows, and transmit a file over email or SFTP - what would be the best way to pass SQL Server credentials.

Both the script machine and SQL Server 2014 are running on a cloud server on Rackspace or Amazon so the physical access/admin access vulnerability is minimal here. My concern would be an attacker obtaining access to the server, then the script and obtaining clear text credentials.

If an attacker gains access to the server, you'll likely have other concerns than exposing clear text credentials in a file.

Also, your on the right track for inquiring about security best practices. Don't go through all of this effort only to email the results. Email is not secure so your results should be encrypted or use something else such as your mention of SFTP.

With that said, you have two options:

Windows Account - run the task as a dedicated Windows account and use Integrated Auth. This will not require storing the username/password in the connection string but you will need to store the credentials when setting up the scheduled task. If this account is compromised, you now need to consider what access it has. Either domain account or a local account on the sql server. If the former, they'll be able to enumerate domain resources and if the later access will be limited to the sql server. Finally be careful what security groups this account is granted membership, if any.

SQL Account - will be specific to the MSSQL instance though it will require storing the username/password combination in the connection string. A way to get around this is set NTFS permissions only allowing the account running the scheduled task access. For example, if the task runs as SYSTEM only allow that account access to your script. Don't forget to include the account used to run backups and your account as well.

DPAPI - I believe this would be out-of-scope for what you're looking to accomplish so I'll just mention that DPAPI allows one to use asymmetric encryption in configuration files and such.

Consider account management when making your choice. There may be policies requiring a password change every ?? days. See what applies and choose the account type that best fits what you're looking to achieve.

No matter what option you choose, make sure the account only has access to run the applicable stored procedure(s). This will limit the exposure on your sql server should the account become compromised.

Finally, there are lots of examples of using PowerShell to run stored procedures. I just used the following search string which returned lots of results.

  sql server stored procedure from powershell stackoverflow


What fraction of software bugs are vulnerabilities? What fraction of software bugs are security vulnerabilities?  Obviously, software bugs can be security vulnerabilities -- but also obviously, many software bugs have little or no security impact.  Is there any data (or rules of thumb) on roughly what fraction of software bugs are also security vulnerabilities?  Or a rough range of values?

Well, obviously any estimate is going to fairly hand-wavy, since if we knew the existence of all bugs and could enumerate them, then the bugs probably wouldn't have shipped. So these bug counts are based on bugs found after the fact. Scrutinized software will naturally have proportionally more of its bugs discovered than rarely used software, so our measurement technique is biased.

But here's a post that references Code Complete saying 10-15 bugs per KLOC:

http://amartester.blogspot.com/2007/04/bugs-per-lines-of-code.html

And here's a post right here on SO that estimates security bugs at at a max of .05 security bugs per KLOC:

Average number of exploitable bugs per thousand lines of code?

So one rough estimate to your answer is .05/15 = .003333. It's a fairly small proportion.


Can a neighbour who installed my router access it? I have a bit of a security concern. I'm concerned that my neighbor sees everything on my computer, web sites I have visited, my passwords, etc.

Background:

He installed a Linksys router in my house after I complained to him about poor signal strength. He is experienced with IT, and I am concerned that he is able to connect through a backdoor and see everything from his home as he lives three doors down from me.

Questions:

Should I be concerned?
Is it possible to remotely connect to the Linksys device and see my online activity?
What can be gained out of doing something like this?
If this issue is possible, how can I defend myself from attacks like this?

Is it possible to remotely connect to the Linksys device?

Yes.
Most routers have an online administrator page that can be accessed externally by visiting your public IP address (go check WhatIsMyIP.com too see yours).
It's even easier internally by accessing the internal IP address of your router, which is in most cases either 192.168.0.1 or 192.168.1.1. If these don't work, you can find this IP address by opening a command prompt by opening start and typing cmd (Windows Vista, Windows 7 and Windows 8) or by pressing Windows + R and entering cmd.

Once the command prompt is open, enter ipconfig and look for the default gateway address under Wireless LAN if you're connected via the Wi-Fi or under Ethernet adapter for LAN connection if you're connected via wire.

If you browse to the address of your router, you shall be greeted by the Lynksys administrative page and you'll have to login. Read the manual or Google lynksys [your model, see box] default login to find out the password.

And see my online activity

This depends. Some routers allow to log the activity of the connected devices. Check the manual or the administrative page of your router for settings like this.
If I were to stalk you, however, I'd connect to your network and run a sniffer. A sniffer snifs all network traffic on the network you're connected on and most of them allow to filter on interesting protocols like HTTP (normal browsing network).

If he knows the password of your Wi-Fi, he can connect to it and sniff your network. Sniffers are tools that listen to all network passing by, even if it's not being sent to you. Wi-Fi is easy to sniff, as wireless data is sent in all directions.

and should I be concerned?

Do you trust this person?

You allowed him in your house and you allowed him to install the device. This means that there is some basic trust between the two of you. Is there any reason not to trust this person?

What can be gained out of doing something like this?
The neighbour might be connected to your Wi-Fi to steal your bandwith, i.e. he downloads movies via your network, so he doesn't have to pay for it. He might also use your network for stuff he wouldn't like to see linked to his own network (for example, criminal activities or surfing to adult websites).

If he's able to sniff your network, he could capture passwords on weakly protected websites (they use normal HTTP instead of HTTPS, which encrypts network traffic). If you suddenly were to see notification of HTTPS-sites being non-trustworthy anymore, although they have always been (e.g. Facebook), then he's trying to sniff the encrypted connection between those websites. If you use other services, like FTP to connect to a fileserver or RDP to connect to a virtual work environment, he could steal those passwords.

By listening on someone's network traffic, it's also possible to collect information about a person's behaviour. Do you check a lot of travel websites, adult websites, cat videos, ... This information could be used to make a profile of you. The advantage of this depends on what it would be used for.

If this issue is possible, how can I defend myself?
If you decided that you don't trust this person, there's a lot you can do yourself.

First of all, undo all possible settings your neighbour made. This means resetting the device.

Unplug all network connections to the device and reset it by sticking a pencil in the hole at the back where it says 'reset'. Hold this for 5-10 seconds. Most devices will notify you of the reset, e.g., with some blinking lights.

Follow the instruction manual of your device to reinstall it. In most cases you'll have to connect a device via cable or via a default Wi-Fi and browse to the IP address I mentioned before.

You'll be able to change the administrative password, name of the Wi-Fi and password of the Wi-Fi. Do all of this. Be sure to use a strong password (8+ characters, capital and small letters and a few numbers, maybe a - or _). And use at least WPA2-PSK protection on the Wi-Fi. Use a generic name on the Wi-Fi that doesn't reveal whose Wi-Fi it is or what device is being used. I like to use names of stores that aren't in my neighbourhood (for example, Starbucks).

Once you've done all of this, you'll have to reconnect your devices. If they're connected by cable, nothing has to be done. If they're connected via Wi-Fi, you'll have to connect them to the new network with the new password.

Whether you trust the person is up to you. But it never hurts to learn something new by installing the router yourself, and it'll give you a more safe feeling knowing that nobody is able to do you harm this way.

Big hint: although this practically does it, reading a manual every now and then might help you.

Next time you need a router, ask a store clerk for one that fits your needs (number of wired connections, does it need Wi-Fi, do you want a wired connection that is guaranteed to get better speed than the others [e.g. for gaming, streaming], ...). When you get home, spend some time reading through the whole manual and then start installing the device with the manual close by.


Security of root terminal (su -) when logged into X I often log into X as normal user (of course), open terminal and switch to root:

su -

I have then a terminal owned by user but effectively with root privileges.

Are there any security issues in this situation?

Can a malware/exploit running under normal user  potentially get access to the root console (possibly by exploiting some bug in X server?

Is this less safe, than if I had switched to text console (Ctrl+Alt+F1) and logged in as root directly ?

Clarification:

I have to enter the root password every time I switch to root using su -

Yes, it is less safe than if you switched to text console and log in as root directly.

Proof 1:

If you are logged in as root in a terminal, another process can send commands to that terminal.

Simple proof of concept:

Open a terminal, place in in the top left corner of the screen and switch to root.
Open a second terminal that does not overlap the first and type:

  $ xdotool mousemove 100 100 click 1 && xdotool key l && xdotool key s &&
  xdotool key KP_Enter

xdotool

Proof 2:

xinput can read all keyboard strokes

Use

  $ xinput list

to identify the id of your keyboard and

  $ xinput test id

to see which keystrokes are pressed. This will also display the keystrokes from the su terminal and reveal your password.

xinput man page


Execute a PHP function that returns an array from an XSL file There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document.

So I found a way to make the server interpret my own XSL file, And I used the php:function functionality to execute a php function on the server. Here is an example of the code I'm giving to the server:

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
<xsl:template match="/">
<xsl:value-of select="php:function('file_get_contents','index.php')"/>
</xsl:template>
</xsl:stylesheet>

This code will output the source code of the page index.php.

The next step is to execute scandir on the server to list the current directory (to find the flag). The problem that I'm having is that the response from the server is only Array, that's all what the server outputs.

After searching for almost 8 hours, I'm stuck, and I can't find any XSL functionality that will output the array returned by scandir.

Notes:

The functions that allow code execution (eval, exec, passthru, popen, proc_open, shell_exec, system) are disabled by the server.
I'm really a beginner (complete noob) in the XSL and XML languages.

I am also a noob when it comes to XSL. To be honest, I had no idea it could be this powerful... and dangerous. But I will have a shot at this anyway.
I don't know if it is possible to get the output from a function returning an array. Perhaps you can nest function calls somehow? But given my lack of knowledge about XSL I can't tell you how. So lets work around the whole problem instead. Is there a way to get the directory listing without having to deal with arrays at all?
Enters the PHP manual. The two following functions look useful:

resource opendir ( string $path [, resource $context ] )
Opens up a directory handle to be used in subsequent closedir(), readdir(), and rewinddir() calls.

string readdir ([ resource $dir_handle ] )
Returns the name of the next entry in the directory. The entries are returned in the order in which they are stored by the filesystem. [...] If the directory handle is not specified, the last link opened by opendir() is assumed.

So you will not be able to get the resource from opendir, but since readdir kindly assumes you want to read from the last resource it might work anyway. I suggest an attack file with something like this:
<xsl:value-of select="php:function('opendir','/some/where/')"/>
<xsl:value-of select="php:function('readdir')"/>
<xsl:value-of select="php:function('readdir')"/>
<xsl:value-of select="php:function('readdir')"/>
...

Edit: Apparently there is an undocumentet php:functionString() that "will automatically convert output to a string", according to a comment on php.net. Not sure if it helps, but worth a try.


Bash scripting and password input I am writing a bash script and prompt the user for his password.
This password is supplied for either a local or domain account to query a MS SQL Server (using sqsh and freetds).

How secure is the code below ?

echo "What is the password for $mssqlu ?: "
read -s mssqlp

I suppose there is no hashing involved here, and the clear password exists somewhere in memory.

Is is vulnerable to any sort of attack ? Can it be revealed ?
Thank you for your help

Great question.

In bash, when you use "read" to get a password from standard input, the password is of course stored in plain text in memory.  However, this is often the case for passwords in general -- something has to be storing them in plain text to use them.  If it was encrypted, a way to decrypt it would have to also exist in memory -- thus the encryption wouldn't be very helpful then.

In this case I can offer two sets of best practices:

1)  Use another method of authentication than password entered by the user.  This could take the form of:

For MS-SQL databases, using a "trusted" connection for authentication rather than a user-entered password.  Other databases offer a variety of systems for logging in without a password.
Join the computer to the domain and have the user login with Active Directory credentials. Then have the script use this authentication to login to sql. MS does publish sqlcmd and an ODBC driver for Linux that I've used successfully.

2)  If you must use a password supplied by standard input, turn echo off in the bash script.   Of course, bash scripts still need to be checked for possible exploits.  If your script sources a file that is writable by any user, then of course that file could be altered to send the password to an attacker.

You may want to consider use of a passphrase file which is chmoded so only a single user can access it. Then simply read-in the password from this file.  This is probably comparable in security to using the stdin password. While the user doesn't constantly type the password so some vulnerabilities (e.g. keylogger) would not exist; it would increase the ease of a password grabbing attack if someone just hacked the server.


Is it possible to block URL using manageable switch I want to block some specific URLs and DNS addresses.
I am thinking if I buy a manageable switch (More specific would be TLSF1024D)
What can I do to block some sites, and specific URLs like http://www.youtube.com/watch?v=fGH7NxSEGtA  , that are not suitable for children.

I think the short answer to this question is "no".  Specifically switches work at layer 2. The content and data you're looking to block is at layer 3.  A switch that's "managed" or "smart" typically means the switch can be managed remotely (command line or web UI) and configured to participate in STP, VLAN, flow control and other layer 2 stuff.

All that said current trends are for network hardware manufacturers to pack more and more stuff into the routing hardware.  Some providers may be integrating some layer 3 functionality into their switches but the link you provide looks like a pretty basic switch to me.


Want to implement a really good authentication mechanism for REST API I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1).

So basically, I'm not an expert in security and so I initially wanted to use a "tool" for implementing authentication easily.
Thus I chose to make use of SecureSocial.

I customize it to fit my needs, but after reading some documentation about REST authentication scheme, I realized that I'm likely to be in a wrong way.

Why? Simply because it's based on a Session-token mechanism rather than a full stateless solution.

In short, the authentication workflow is:

The user logs in the web application through a traditional form (e-mail/password)
Server checks for the validity of the credentials (comparing BCrypt hashes for the password), and if valid, returns a cookie containing a kind of authentication token.
This authentication token is also stored in server cache (Play configured to access a Memcached store), in order to be able to make some comparisons each time the user asks for a restricted (in term of visibility) functionality.

Pros of this solution:
..this works well for controlling access to RESTRICTED API.

Drawbacks:

This solution requires a datastore to store the authentication token on servers, in order to compare which the ones provide by client at each request attempt. Currently, I make use of Memcached.
Unable to restrict access to some small list of clients. Indeed, what if I want to restrict all REST API accesses to my application only? Surely needed for a kind of API key/API secret key to implement Authorization and not simply Authentication.
For example, I strictly don't want to let external command lines or external web sites, accessing the APIs even if they succeeded the authentication step by providing some good credentials.
Worst, they would have no difficulties to access some data that was initially public, meaning without authentication like for instance: taking a list of a precised set of data.
Seems to be very vulnerable to some known attacks if HTTPS transfers are not ensured.

I heard and read a lot about HTTP BASIC but it seems that it should be avoid: http://adrianotto.com/2013/02/why-http-basic-auth-is-bad/

Then I read about HMAC solution, as Amazon implements, and it seems a pretty good solution; OAuth1 sounding too complicated for simple cases I want.

Should I try to implement the HMAC solution?
Is the HMAC solution really compatible with a browser, meaning allowing user to call for several distinct operations without needing to authenticate each time?
Does it involve tokens exchanges in this case to do this trick?

I would be really happy if anyone could introduce me the concept of HMAC while dealing with a web application/ browser.
Indeed, I struggle to find some documentations about HMAC scheme coupled with browser.

Or perhaps, really trusting an Oauth Solution? ...

I'm meditating on the subject...

Don't roll your own auth, Json Web Token (JWT) can do what you want, it is simpler than oAuth and uses HMAC


Unknown ports shown on Nmap scan...and other strange behavior My local network has been exhibiting some inexplicable behaviour.

Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g and found that it didn't happen from outside the network. This has never happened before and has not happened since.

I was worried the page was being spoofed so I didn't submit any data. A traceroute took me straight to my wan ip, with no stop at 192.168.1.1.

EDIT: I believe I have resolved this aspect. I have a dynamic IP address so if it changes (due to power outage or such), I think it takes time for my DynDNS service to be updated. Though this is handled by the router and why it doesn't do this on boot I don't know. Might have to make my own updater.

Further, and Nmap scan of 0.0.0.0 revealed this:

$ nmap 0.0.0.0\
\
Starting Nmap 6.47 ( http://nmap.org ) at 2016-02-03 18:14 GMT\
Nmap scan report for 0.0.0.0\
Host is up (0.00075s latency).\
Not shown: 970 closed ports\
PORT      STATE    SERVICE\
22/tcp    open     ssh\
80/tcp    open     http\
83/tcp    filtered mit-ml-dev\
88/tcp    open     kerberos-sec\
139/tcp   open     netbios-ssn\
280/tcp   filtered http-mgmt\
445/tcp   open     microsoft-ds\
631/tcp   open     ipp\
1045/tcp  filtered fpitp\
1072/tcp  filtered cardax\
1081/tcp  filtered pvuniwien\
1175/tcp  filtered dossier\
1187/tcp  filtered alias\
1594/tcp  filtered sixtrak\
1658/tcp  filtered sixnetudr\
1755/tcp  filtered wms\
2222/tcp  filtered EtherNet/IP-1\
2381/tcp  filtered compaq-https\
2393/tcp  filtered ms-olap1\
3527/tcp  filtered beserver-msg-q\
3737/tcp  filtered xpanel\
4003/tcp  filtered pxc-splr-ft\
5102/tcp  filtered admeng\
5678/tcp  filtered rrac\
5900/tcp  open     vnc\
6025/tcp  filtered x11\
6646/tcp  filtered unknown\
9001/tcp  filtered tor-orport\
9666/tcp  filtered unknown\
55600/tcp filtered unknown\
\
Nmap done: 1 IP address (1 host up) scanned in 6.46 seconds\

I repeated a scan for each machine on the lan and found nothing, netcat was no more forthcoming. I could not find these ports anywhere.
Since then the same Nmap scan returns has stopped throwing out these results.

I am worried there may be something nefarious going on...could anyone offer an alternative explaination of this behaviour? I'm not well versed on Nmap.

0.0.0.0 is your machine that has a lot of services sometimes non-visible by other machines. Try to scan your machine from another machine and all can be more clear.

Run netstat -plnt on your machine and you can find which processed are running on these ports.


How can I stop this remote attack? Someone appears to be logging into my machine remotely, I am running Avast anti virus with Comodo Firewall both report no attacks.I only noticed this because on my router security logs I see the following.

I have scanned the machine with 6 different anti virus scanners and all report the machine is clean, so it's probably a zero day attack. It happened after I stupidly downloaded a .doc from a torrent. I suspect a Trojan on my machine, is there anyway I can block this attack and find out manually which program is dialing home to the attacker?

Router Logs

Line 4: [LAN access from remote] from 221.163.250.228:3389 to 192.168.1.58:2345, Thursday, March 26,2015 19:59:59
Line 5: [LAN access from remote] from 142.4.215.8:27010 to 192.168.1.58:27015, Thursday, March 26,2015 19:59:34
Line 6: [LAN access from remote] from 188.138.9.50:36877 to 192.168.1.58:2323, Thursday, March 26,2015 19:13:36
Line 26: [LAN access from remote] from 221.163.250.228:3389 to 192.168.1.58:2345, Thursday, March 26,2015 00:15:44
Line 53: [LAN access from remote] from 223.130.239.89:1010 to 192.168.1.58:2345, Wednesday, March 25,2015 01:39:57
Line 76: [LAN access from remote] from 223.130.239.89:1010 to 192.168.1.58:2345, Tuesday, March 24,2015 17:28:28
Line 81: [LAN access from remote] from 103.249.103.31:6003 to 192.168.1.58:2345, Tuesday, March 24,2015 16:01:15
Line 86: [LAN access from remote] from 107.20.201.237:4244 to 192.168.1.58:60615, Tuesday, March 24,2015 11:38:33

First, the firewall will not identify it as an attack if the traffic is allowed.

Second, in the logs, you can see the port numbers that the communication is destined for. You can correlate those ports with the binaries that are listening to those ports on your machine. Look for the netstat command for your OS and version.

Third, you should configure your firewalls to reject incoming connection requests to that machine (or in general, depending on your needs).


android automatically accepts self signed certs on wifi I have a WPA2 Wi-Fi network and currently using self-signed certificates.  My iOS devices request I accept them manually.  My MacBook pro asks as well.  My Android (Samsung), just connects.  Is that normal?  Kind of concerns me it doesn't even warn you.

While it is frustrating, keep in mind that ultimately a user is being asked to make a security decision. When most users are prompted in Windows, iOS and macOS, they're usually blindly accepting the certificate. Even if the user were to examine the certificate, there is nothing to compare against (unless IT has explicitly told all users what to look for).

If security is top of mind, tunneled EAP methods with password exchange should not be used. In environments where some devices are unmanaged, EAP-TLS is the only safe bet.

Note that Android 7.1 and higher has greatly improved EAP server certificate validation.


Does Google Analytics collect any information about the contents of the web page? If I enable Google Analytics on my web application, does the Google Analytics Javascript collect any information on the web page (any of the content on the page)?  Does it collect any information about the GET parameters in the URL or the POST parameters for the page?

I've done a lot of Googling and found a lot of references indicating that Google Analytics collects information about the browser and operating system version, screen resolution, IP address, etc., stuff like that.  However, I'm wondering if it collects any information about the contents of the page that the server sends to the user, since some of the information in the page is confidential and not something that I want Google to collect.  Similarly for some of the GET/POST parameters.

I haven't found a good unobfuscated version of the ga.js Javascript file that Google Analytics loads, but here's one unminified version that I found: http://blog.xam.de/2008/07/towards-gajs-un-obfuscated.html#!/2008/07/towards-gajs-un-obfuscated.html

You can install the Google Analytics Debugger Chrome plugin to see the data that is getting sent to Google. I don't believe that it sends any of the page content, other than the page's title and URL (including GET parameters).


Setting a limit on password recovery attempts in a setting where one has forgotten their password, I'd like to be able to limit the attempts of entering in email addresses to something like 10.  My first thought was to use a cookie.

$attempts = 0;

if( isset( $_COOKIE['password_recovery_attempts'] ) )
  $attempts = $_COOKIE['password_recovery_attempts'];

if( $pass === false ){
  $val = $attempts + 1;
  setcookie( 'password_recovery_attempts', $val, time() + 86400 ); //86400 = 1 day
}

if( $attempts > 9 ){
  echo 'You have attempted to reset your password too many times';
  return false;
}

My concern with only using a cookie, is that cookies can easily be removed.
What would be a better practice here?

You're right that a cookie is a bad idea, but the approach itself is misguided.

The problem with these kinds of hard limits is that they make it easy for an attacker to create a DoS condition for the legitimate user, simply by putting in 10 incorrect email addresses. Even if you time-delay the attempts, the attacker can simply send a request every time the time limit lapses.

The way I'd implement it would be to time-limit the requests on a per-IP, per-account basis, with no delay after the first and second attempts, but increasing delays on consecutive attempts up to a limit of 45 seconds. Another useful measure would be to enforce 45 second delays on any request coming from an IP address that has seen more than 10 incorrect attempts in the last 15 minutes across any number of accounts, in order to protect against attacks that scan the entire list of usernames against a single known email address. I might also consider requiring a CAPTCHA after a certain number of failed attempts, to protect from automated attacks.

This provides the following benefits:

A legitimate client will always be able to use the feature (i.e. no DoS condition can be reached) as long as the attacker is using a different publicly-facing IP address.
A reasonable number of failed attempts can be performed without the user being hindered by lock-out mechanisms.
Both targeted attacks and low-hanging fruit attacks are hindered with minimal negative effects on legitimate users.
The worst-case scenario is that an attacker generates a DoS condition when on the same network as a legitimate user. Not exactly critical or likely.

This would involve storing failed attempts in a log on the server side, perhaps in a database table or in-memory cache.


Enforce Code/Script Signing I have both a couple of X.509 Code Signing certificates and a GPG keypair that I can use to sign against code I run on my VPS. Every now and again I write code for iOS, OS X and Windows and always ensure I sign my binaries with my X.509 certificates. However, I would like to ensure that anything I run on my VPS (in regards PHP/Django scripts and maybe even Javascript that I send to a client) is signed too.

I could simply write a bash script that signs every file in a directory with my GPG keypair, but my problem is the fact that if the code was not signed, it doesn't raise any additional errors than if it was signed correctly, so in interests of protecting my server from sending out/executing malicious scripts that I haven't explicitly authorized, is there any way I can use my GPG keypair (or even my X.509 certs!) and ENSURE all code in a particular, say, directory is always checked for a valid signature before execution?

To throw a spanner even further in the works, how could we effectively 'sandbox' this in such a way as malicious scripts placed outside the scope of the enforced checking could not interfere? For example, if a directory was 'flagged' as requiring enforced signatures on all files, would it be possible for files outside this directory to be used to circumvent the code signatures and interfere with the application or scripts?

I'm not really interested in the signing algorithm, scripts vs. binaries or operating system, but for the application I would apply this to, it would be against python/django or PHP scripts running in a Debian VPS (for the purposes of web applications).

Just an interesting thought, one I'd certainly like to pursue if a suitable solution is around! Ideas or discussion is much appreciated!

In order to support this functionality the interpreter will have to be augmented.  Fortunately this a code singing feature probably doesn't require a PHP extension like hardened-php. In fact there is a simpler way.

You could change your php.ini to auto-prepend a php script that reads the $_SERVER['SCRIPT_FILENAME'] and verifies the current script's signature.  If the signature check fails, then call die(); and it will never be able to execute.

This is a pretty simple solution.  However,  this won't prevent an attacker from exploiting vulnerabilities in existing code to obtain code execution,  including but not limited to eval() and RFI/LFI vulnerabilities.  Also,  each interpreter will require its own solution.  For instance client-side JavaScript would require a browser specific extension like NoScript.  "Unauthorized JavaScript" is more more commonly refereed to as XSS.  A great solution for XSS is the Content Security Policy,  because it gives you control over where the browser can execute JavaScript.  There isn't a one size fits all answer to this problem.


Can people let me know why this command was ran and why he typed "network hacked....clampi found What is the reason this command was run and why network hacked....clampi found was typed in at the command prompt

Title has been changed....somebody gave me the computer to fix after calling a number via a popup that was difficult to get rid off....and also used a phishing technique to get her to call a number so to speak to a microsoft engineer...he logged on and messed around and said 500 euro...

i'm not sure if he typed the "what the title of this question is" there for? to scare the user using a technical term?? or did the person make a mistake and write something in there that was meant to go into his notes?

had to refresh the machine, didn't have a chance to look into it too much, but it had me investigating wannacry which clampi is related....but was it just a pop up that caused the problem? or did he want to say it would cost the 500 euro to get rid of clampi...perhaps the attacker thought that this person would have heardd of the term....basically all i wanna know is if that was only meant for his notes? from the technical pov he wouldn't be using the term network hacked.

If i understand this correctly, you called the 1800 number and gave them remote access to your computer where they opened cmd and ran netstat and typed "hacked... clampi found"

What is happening here is theater. When the scammers "check the computer" they do a variety of things including but not limited to:

looking at eventvwr
typing netstat or tree into cmd
looking at running services

Each one is designed to show you true information about your computer but then twist it in a way to convince you to believe there has been a breach of some kind. This is the essence of their con.

The idea for your specific example here is that while cmd is running a command, like netstat or tree, it still takes typed input. You can open cmd right now and type tree. While tree is running type something like "VIRUSES FOUND, MUST KILL EACH AND EVERY VIRUS" You will notice that once tree has completed  your text appears after the > in your cmd prompt. They usually use commands that take more than a few seconds to complete, just enough time to fully type out whatever they want so it doesnt appear one letter at a time but fully when the previous command is completed. netstat -sp tcp will generally take anywhere between 30 seconds to a minute and a half depending on connections. More than enough time to type out a sentence.

To the inexperienced this makes it appear as though a scan has been done and the result of that scan is output. In your case, they made it seem as though netstat is a scanner of tcp traffic and it found "clampi" a well known malware.

But it's theater, nothing more, they simply typed it so that, upon seeing it, the user enters a state of panic. In this state someone might do anything to fix the problem immediately! Well lo and behold your knight in shining armor, the tech support agent, who, for a fee of only 599.99 for the 3 month plan or 999.99 for the lifetime plan will personally make sure your computer is "hacker free" forever.

Its nothing more than a scam designed to prey on people who don't know the deeper aspects of computers or the full extent of their available features, which even today, is a lot of people.


How to build a secure stateless authentication system for a client-side JavaScript application i'm building a stateless authentication system for a Dart application (Dart gets compiled to JavaScript, so the whole application is an index.html file which loads JavaScript and runs in the browser) and have discovered that it's quite tricky to build a stateless authentication system that's actually secure.

The stack is as follow: Dart application that does JSON POSTs to a Spring MVC (Java) backend using Jackson to convert back and forth between JSON and Java objects. Everything will be behind SSL when it goes into production.

Scenario 1: User logs in, I keep a session on the Java side - this is not stateless and will cause problems when load balancing the backend.

Scenario 2: Upon hitting the login button, a POST is done by Dart to the Authentication controller which verifies the credentials and passes back a token (which could be a bunch of UUIDs concatenated together). The token comes back to the frontend - This token combined with the username will then have to be passed along with each request. The dart application now needs to store this token somewhere, since a Dart application compiles to JavaScript, cookies seems to be not an option (can JavaScript access cookies?). HTML5 localstorage comes to mind, but from what I've read, it's pretty easy to hijack that token if any form of XSS vulnerability is available (and I'm guessing browser plugins and toolbars that inject JavaScript into the page can also access this token?).

Scenario 3: Just like in scenario 2, I get passed back a token from the Spring MVC backend, but instead of storing it in HTML5 localstorage, I keep in a JavaScript variable and pass it on if a new window is opened. The same problem applies here, since it's inside a javascript variable, any kind of XSS vulnerability or browser plugin can nab that token and hijack the session.

To prevent against brute-force attacks, any request that is being sent, if the username-token combination is incorrect, the token for that username will be invalidated and the user will need to login again. Tokens also expire after 15 minutes.

Is this a secure way to maintain state? IF not, how would I either make this stateless-with-token implementation secure or what would be a better implementation?

Update, a diagram of the stack:

Any mechanism you come up with, that does not involve the user entering a secret for     every request will be vulnerable to XSS. The solution is to try and eliminate XSS from your domain, not to have a solution that is secure in the presence of XSS vulnerabilities. A strong CSP policy will help you in browsers that support it.

Javascript can access cookies, as long as you don't mark them HttpOnly, but you don't need it to as the cookies will be sent automatically with every request. So cookies are going to be more secure then LocalStorage as long as you mark them Secure and HttpOnly.

So I would go for Scenario 2, using cookies. If it needs to be stateless the cookie should be a signed and HMAC'ed token with a time expiry in addition to the cookie timeout, such that the servers stop accepting these tokens after the timeout. It will be hard to securely implement the logout functionality without storing state on the server, you can instruct the client to throw away the token, but without a blacklist or whitelist maintained on the server-side you will be vulnerable to the token being used after the user has logged out.

Response to Comments

  CSP, is it something I need to implement on the load balancer in front of A? A is just static html and javascript files.

CSP will need to be served on the top level page (The url the user sees in the address bar), this is A in your case. You should be able to configure you static web server to add headers to every response. Doco. You could also do it at the load balancer but that seems more complex then is required.

  If I add CSP on requests going between A and B, ...

CSP is added between A and the browser, not between A and B. In the CSP policy you can configure the browser to be able to communicate with B.

  somebody could easily modify the javascript to send different headers.

They could only do this if your html/javascript is being sent over HTTP, not over a secure link e.g. HTTPS. If your top level URL is HTTP all scenarios will be susceptible to man-in-the-middle attacks. The communication between A and the browser and B and the browser need to be over HTTPS to have any security.

  A and B are running on different domains, B adds a CORS filter to only allow JSON POST requests from a specific domain for A, should the CSP also be added  alongside the CORS headers?

You will need both CORS headers, sent from B to allow communication from A. And CSP headers sent from A to restrict javascript execution as a mitigation strategy for any XSS vulnerabilities in your site.

  Since the authentication token is generated, validated and invalidated in the Authentication Service, would HMAC really be needed

In most situations a HMAC makes tokens more secure. If you need to remain stateless you will need a HMAC. If you Authentication Service is state-full, that is it has a list of valid, current tokens, then HMACs are less important as long as your token id's are not guessable. If this is the case consider GUID's for your tokens.

  The cookie should obviously be created at A as that is what the browser is interacting with.

My understanding is the browser is also interacting with B, via AJAX, hence the need for the CORS policy. As it is B that is managing the login state and requiring the authentication token the cookie should be set by B. Also as A is just serving static content it would be more elegant if A did not require to set cookies, a dynamic process.

  Seeing as it's completely HTML and JavaScript, I'm guessing it's impossible to access data inside the cookie if HttpOnly and Secure is turned on?

Yes with HttpOnly turned on javascript on the browser will be unable to access the cookie. In your case it would be best if the cookie was set by B, with HttpOnly and Secure set, this should happen on a successful login call. Then all subsequent calls to B will automatically have the cookie added to them, and the javascript will not be able to access the cookies.

Timeline - As I would see it.

User navigates to https://a/index.html
A responds with a HTML page
including CSP headers, the HTML includes a <script
src="https://a/code.js"> tag.
The browser fetches https://a/code.js
code.js puts up a login box, user enters username and password and instructs the browser to send an AJAX POST request to https://b/login
The browser sends a HEAD request to https://b/login to ensure it can make posts.
B responds with the CORS headers allowing POSTs from https://a
The browser sends a POST request to https://b/login containing the username and password
B checks the password and if successful returns a success message and sets a cookie which is HttpOnly and Secure. This cookie contains a token such as a random GUID. This token is stored in B's state.
The user clicks a button
A request is sent to https://b/customer/5/update containing the cookie
B validates the cookie value and proceeds to do the action requested e.g. updates the customer.
The user click logout
The browser sends an AJAX request to https://b/logout
B invalidates the token contained in the cookie in it's state, and send a message back to the client clearing the cookie there also.