Solution for password spraying on my app We have a web application where the input fields for login are: username and password. In order to prevent brute force attacks, we have implemented a lockout function for 5 invalid tries of valid username but the incorrect password.

What the penetration testers did was use the same password but enumerated usernames until a valid one was found. No lockout can prevent that since the username field is always changed. They did enumeration at a rate just below the minimum threshold for the firewall to categorize this as an automated attack and block it.

It seems the only way to handle this is programmatically. I have some solutions in mind but I don't want to reinvent the wheel. Are there are solutions on how to handle this programmatically?

You need to correlate the failed logins on the server to some characteristic the attacker has. Typically, this can be the IP, but there may be other options depending on how your app is built and what data it collects.

This means you need to keep track of failed logins across all users for some window of time.

Once you identify an IP that is failing to log in across many accounts, you have some difficult options regarding how to respond. You could block the IP, which could lock out all legitimate users using that IP, or before lockout, check to see if the IP has been used by other legitimate users (i.e. determine if the IP is likely legitimate or not).

IP blocking is crude and error-prone. It is just as easy for attackers to rotate through IPs as it is to rotate through usernames. You also risk the chance of locking out your legitimate users.

You could also tackle the problem on a different layer altogether. You could implement 2FA, which protects the users and means that you don't need to protect user passwords through log analysis. Or you could make the decision that users who are vulnerable to password spraying need education or better password guidance rather than trying to protect them against themselves.

The problem here isn't that your app is vulnerable to password spraying, it's that the passwords are easy to guess.


Secure software development checklist I'm looking for a secure software development checklist.

I know that there exists several secure development methodologies (for example Which Secure Development Lifecycle model to choose?), which cover all the steps in software development, but when it reaches the point of "write secure code", they don't specify which elements a normal programmer has to take into account when they're coding.

The only documents that I've found interesing for what I'm looking for (something to advise my programmers what they should or shouldn't do) are:
https://www.owasp.org/images/0/08/OWASP_SCP_Quick_Reference_Guide_v2.pdf
https://www.owasp.org/images/5/58/OWASP_ASVS_Version_2.pdf

Do you know any other one?

Thanks.

This is kind of like a product recommendation, so it may end up closed however. You should also be careful to distinguish between a checklist and a standard.

If you are looking for some high level checklists to use for your development process, you may want to checks out SANS SWAT, which covers more logical considerations rather then specific code level issues. You may also be interested in the ISO 27000 (i.e., ISO/IEC 27034) series (not just 27001 or 27002). Other methodologies include STRIDE (would not recommend) and DREAD from Microsoft

It's not clear if this is for a specific programming language, but NASA JPL has guidelines for C and JAVA which may be useful to consider as part of security standards. Oracle has their own JAVA secure guidelines. The CERT guidelines already in Jaques answer are also in the same realm.

You will need to clarify your objectives and build upon these tools to create:

Secure coding standards (code will be formatted this way)
Library/platform specific standards (CSRF tokens will use this common function)
Secure development/SDLC practices (code will be put through these scanners, tools, or processes before being committed; pen test before promoted to production)
Ongoing testing and review (regularly occurring application re-certifications; responsible disclosure procedures)

A checklist might be a good way to start as it is clear cut, but bad processes can be just as harmful - e.g., you promote the wrong branch with the buggy code).


Do RFID key cards track the user through entry ways? At work we use RFID tags to enter the building and each floor. The tags double as photo ID, I always wondered if they are used (or can be used) to keep track of staff movements.

I always assumed that they were tied to a staff ID when issued. But another staff member thinks they are generic access i.e. all cards are copies (for each access level) and they just stick your picture on the front.

My question is: What is standard industry practice? I'm sure my scenario is technically feasible, but whether it is widely used is another question.

Having specified and reviewed smart card and RFID card entry systems as part of PCI DSS audit I can confirm that the system can, and often does, track people as they move through locked locations in a site. This is normally to allow the fine grained control of which person (usually based on role) can access which areas of a building e.g. only a few people can access the server room (often with 2fa anyway), and certain people can access security offices where CCTV is monitored etc. etc. Many security policies require that entry/exit data is retained for audit purposes and therefore tracking is inherent in the system.


What's the point of the pre-master key? In SSL, the client generates a pre-master key from random data from itself and also the server. It then encrypts this with the server's public key, sends it to the server and then both client and server generate a master key from this.

Why not have the client generate the master key and send that to the server?

My initial guess is to prevent the master secret from ever going over the wire in any shape or form. But I don't see how that is any safer than having the pre-master key sent over the wire if a Man in the Middle has observed the entire handshake (and thus knows the cipher used, and the random data sent by both client and server).

The point of the pre-master key is to have a uniform format for the master key (e.g. this helps sharing session parameters between multiple front-ends). SSL is generic: it supports several kinds of key exchange algorithms, in particular RSA asymmetric encryption, and various Diffie-Hellman variants. All these methods do not yield "shared secret" of the same size and format. Notably, with DH, you get a group element, in whatever group you are working, which can be an elliptic curve or something else; the shared secret is, as a binary string, somewhat biased, and is not chosen by the client.

Defining that the key exchange mechanism yields a pre-master secret (with characteristics derived from the actual key exchange mechanism), to be hashed into a master secret, thus allows for a better modularity.


Publishing a private key used for HTTPS certificates, is it ever OK? I want to make it easy for users who have private servers to connect to those servers inside their LAN from Android devices.

I want to avoid having these users perform configuration tasks like, trusting self signed certificates, setting up DNS or changing DNS settings in Android (which by default uses Google's 8.8.8.8 DNS server).

I'm considering a way to do this, however it involves delivering a private key for a HTTPS certificate on a domain-name we control, to the user, essentially publishing it.

Assuming the domain name is not used for anything else - is this ever going to be OK from a security perspective (I have noted MITM below)?

The scheme by the way is as follows:

-Obtain a LetsEncrypt wildcard cert. for our domain name somedomain.tld

-Setup DNS to point addresses like 192-168-1-1.somedomain.tld to 192.168.1.1

-Install the certificate for *.somedomain.tld on the machine 192.168.1.1 (this requires the private key).

-Now when their Android device tries to load https://192-168-1-1.somedomain.tld/ it will be pointed to 192.168.1.1 which will serve the page 'securely'.

Potential flaws that I can see:

-Private IPs on public DNS can cause confusion because they will not always point to the same machine or are not always accessible, in my context this isn't an issue.

-Attackers could do a MITM attack between private server and its client.

The context for this is development, and shouldn't be used for production, also I'm tempted to think that to implement a MITM attack on a private network may require the network to be so comprimised already that it would be pointless?

Why on earth do you want to do that? Issue a fresh Let's encrypt certificate for each subdomain. This is fairly trivial, as you can authenticate domains in DNS, by a txt record.

Run the ACME client on the local device that needs the certificate, send the required txt string to your server, update DNS with it, and notify the local device that it can proceed to verify the domain.

I do this for a few things inside my network, that cannot be reached externally, and it works like a charm. That way the keys will be unique. And LE certs are free anyway...

This Q&A explains dns challenge validation.


Possible to Derive Private Key from Public Key Given Enough Computing Power? Is it possible via brute force to derive a private key from a public key (such as a website's SSL certificate)? If so, how much computing power would you need to make it feasible, compared to say, current supercomputers? I thought it involved factoring prime numbers, or a similar function that's easy to compute forward, but not mathematically possible (to our current understanding) to compute in reverse, reducing cracking to a brute force scenario.

I think you are confusing quite a few things here:

First of all: There are only very few crypto schemes that are perfectly secure from an information theoretic standpoint. One of these schemes is the One-time pad. One might argue that Quantum cryptography is a field that looks promising in this regard, too. However, none of these are practical and are only used by secret agencies or universities researching the topic.

In practice we are stuck with algorithms that are computationally secure. This basically includes all the things you usually have in mind when talking about cryptography, e.g. AES, RSA, DH, ECC. When the key sizes get big enough, it is infeasible with our current understanding of mathematics and technology to come up with a computer able to crack these schemes. Some of these schemes are prone to theoretical attacks based on quantum computers, although this doesn't yet matter in practice. Nevertheless there are algorithms good enough to withstand even these sort of attacks by the sheer complexity of the calculations involved.

  I thought it involved factoring prime numbers, or a similar function that's easy to compute forward, but not mathematically possible (to our current understanding) to compute in reverse, reducing cracking to a brute force scenario.

Factoring prime numbers concerns RSA, which is probably the most prevalent public key crypto system used in SSL/TLS. It is true that in theory it can be done, but it is not feasible in practice, at least when the generated keys are good enough. There have been quite a few instances in the past, where it turned out the key creation process wasn't as random as thought, making it possible to guess the private key. I recommend you to watch the following lecture from Daniel J. Bernstein, Nadia Heninger and Tanja Lange, if you want to get funny insights into how RSA can be broken in some cases.

Other schemes, such as DH are based on a completely different set of problems, e.g. the discrete logarithm problem. This has nothing to do with factoring primes, but is thought to be similarly hard, which is the reason why the key sizes are quite the same for both set of problems, e.g. 1024 - 4096 bits.

Elliptic curve cryptography (ECC) is yet another field of cryptography, that is based on a generalization of the discrete logarithm problem with the advantage that the involved keys are much smaller, while the level of security remains the same.

In essence: Yes, most of our current day crypto systems can be broken in theory, but it doesn't matter for practical purposes. With our current understanding of the math and technology involved, even government agencies like the NSA can't build computers powerful enough to crack these schemes in this way.


Are there other ways to encrypt files other then TrueCrypt and BitLocker I don't trust BitLocker. Probably backdoored and relies on TPM which can be hacked according to DEFON. It also does not allow for hidden partitions or other advantages like TrueCrypt.

With TrueCrypt and the state that it is in, are there any other open source options that can be trusted and not backdoored?

Yeah. There are many alternative to Truecrypt and BitLocker that you can find in link below:
http://alternativeto.net/software/truecrypt/

However I software that meet you prerequisites are DiskCrypter and FreeOTFE(not supported anymore).
P.S. there is no guarantee that they are backdoor free!


Online Shop got hacked, fixed but is still under attack - what to do? an xt-commerce-based online shop from a friend of mine got hacked recently. The attacker mailed that the shop is vulnerable, he showed the extracted data (basically he dumped the databases and cracked the md5 hashes, which were not salted) and asked for some bitcoins.

My friend engaged a security company, which performed a (rather bad) webapp scan using accunetix web scanner. The output was almost unreadable as it contained almost 98% false positives (spread over some 40-50 pdf pages). So he asked me to perform a second scan and I found 4-5 SQL injections and some XSS, an outdated version of Apache as well as PHP and MySQL. The SQL injections were patched and I verified the patches, as I couldnt perform any SQLi anymore.

Now, the users of the shop were informed about the breach and were asked to change their password. However, some hours ago, the hacker managed to place a fake order in xt-commerce.

I wonder what the owners of the shop could do now?

The did not enable MySQL logging as this would fill memory quickly.
I asked them to inspect the Apache logs to see what happened during the point of time were the fake order was placed.
I asked them to look for PHP/Web-Shells, which might have been placed on the webserver.
I wonder if it is possible to somehow scan the contents of the database for abnormalities?
Of course there is the possibility of still having security holes in the web app.
If the attacker chose to exploit the webserver, php-daemon or the mysql server, we would have a hard time to trace this back, right? Should we thus turn on filesystem logging?

Could you suggest me what further steps to take or maybe just tell me your gut feeling about this situation?

I would do a few more things to clean up the site:

Change every password

Yes, before you do anything, change all admin passwords, ftp, ssh, MySQL and so.
Move all website's files to an inaccessible folder

Take the site offline and put a Under Maintenance sign to give you time to fix everything. This will disable any changed file from the attacker. Shells will be unusable too.
Reinstall xt-commerce from scratch

Patching the current xt-commerce is not enough. There are plenty of places to put a backdoor, and it's easy to bypass one even with very careful examination. If there's custom themes or plugins installed, reinstall from scratch. Try don't copy any of the resources from the old site, treat them as infected. Don't try to fix any infection, create from scratch.
Patch the new xt-commerce to use a better password storage

If the default password storage from xt-commerce does not implement salting, something is very wrong. Salting is required for every password management since the launch of Intel Pentium MMX. Or even earlier.
Take a full database dump and inspect it for signs of abnormalities

Any sign of eval, replace, decode, exec or system will be suspicious. Take a close look on those entries.
See if there's any strange account created

With the database dump in hand, see if any account have more privileges than it should have. Maybe the attacker created a disguised admin account.
Inspect the log files

This will show you how the attacker gained access to the site. As some PHP shells can use POST, custom headers and cookies to send and receive data, the default Apache log configuration can not show everything. Add the %{Set-Cookie}o directive to the configuration to log cookies, and log POST data too.


CAPTCHA Weakness to Automated Attack EDIT: This question was dumb, I misread the quote that made me ask it. Sorry.

This is more of a follow up question from schroeder's answer to another question.

schroeder said that CAPTCHAs are vulnerable to automated attack. After looking around it seems like modern CAPTCHAs are not (as far as I can find), the closest I have seen was a criminal organization having random people solve CAPTCHAs for them in exchange for access to porn or other online goods.

What attacks exist that are truly automated?

There may be modern forms of CAPTCHA that do not have automated tools yet, but a quick Google search will provide tools to crack various CAPTCHA systems with varying success rates.

In addition, not only are there sites that pay people to interpret CAPTCHAs (including Amazon's Mechanical Turk), but some warez include a CAPTCHA that must be passed in order to allow the user to access the software, but the CAPTCHA is a capture of a live crack attempt from some other source.


Why does OpenSSL not include AES-256-GCM? I'm trying to implement AES-256-GCM in Ruby.

Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this.

However, neither 0.9.8r (which I had installed) nor 1.0.1c (which I updated to w/ macports) seems to have it. 1.0.1c has AES256-GCM-SHA384, but Ruby OpenSSL and aead don't seem to know what to make of it.

Any suggestions?

xpost: https://stackoverflow.com/questions/14698473/why-does-openssl-not-include-aes-256-gcm

ETA: It turns out that this problem is caused by RVM having been built against OpenSSL 0.9.8. (FWIW, this seems to be the case on Ubuntu 10.04, but fixed in 12.04.)

It's easy to test:

require 'openssl'
cipher = OpenSSL::Cipher.new('aes-256-gcm')

# Bad response:   RuntimeError: unsupported cipher algorithm (aes-256-gcm)
# Good response:    #<OpenSSL::Cipher:0x007fc0754764a8>

It's semi easy fix w/ rvm, but it takes a while to fully recompile:

sudo apt-get install aclocal autoconf automake auroreconf apple-gcc42 libtool pkg-config openssl readline libyaml sqlite libxml2 libxslt libksba
# some but not all are available on macports; seems to work okay without the missing ones
rvm get head
rvm pkg install openssl
rvm reinstall 1.9.3-p194

Thanks to Stephen Touset for hinting at the fix.

As the author of the Ruby AEAD library, I can assure you that OpenSSL does support GCM on 1.0.1c.

~ $ /usr/local/bin/openssl version
OpenSSL 1.0.1c 10 May 2012
~ $ /usr/local/bin/openssl enc -help 2>&1 | grep gcm
-aes-128-gcm
-aes-192-gcm
-aes-256-gcm

If it is unavailable on your platform (OpenSSL added GCM support in 1.0.1, I believe), I have also implemented an CBC-HMAC and CTR-HMAC.

If you've installed a later version of OpenSSL, you need to ensure the Ruby binary you're using is linked against that version. It is probably not. Details for doing this are rbenv- and rvm-specific.

Partly for these reasons, I'm writing a replacement library that will bundle and link against DJB's NaCl instead of OpenSSL.


IPtables Linux Firewall and IPsec traffic Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?

Assuming that you mean "can host X, which terminates the IPSec tunnel, apply iptables filters to the de-tunneled traffic?" then the answer is yes.

Here's a Server Fault Q&A on this exact topic - With iptables, match packets arrived via IPSEC tunnel - which states

  You need to use the policy module, and specify the ipsec policy, to
  match this traffic.

and gives as an example:

iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 12345 -j ACCEPT

Unfortunately, documentation is pretty sparse.  Googling for it will find you things like this:

  I'm looking for for in-depth documentation for the iptables "ipsec
  policy match" module. It might be just the right thing to solve my
  iptables/ipsec-problems; but the information given with "iptables -m
  policy -h" is not very intuitive.

(and of course some help for using it is found in the ensuing thread).


Pros and cons of security images Over the past year or so, I've noticed that all of the banking organizations I work with that have or had "security images" as part of their login process have removed or are planning to remove that feature. Such organizations include Ally Bank, Bank of America, and Amazon Store Card by Synchrony Bank. I thought the purpose of that feature was to make login more secure, so why are they removing the feature? Is there some newly-discovered theory or some such that has made companies feel that this is a feature that should be removed?

One of your link refers to SiteKey (BOA): actually there is an interesting study on it conducted by Harvard University and which I recommend you to read The Emperor’s New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies.

First, this technique was seen as a  defense-in-depth strategy intended to mainly help  foil  phishing attacks. Nevertheless, studies as the one we mentioned, show this technique is a worthless measure as it is less effective than one might think.

Actually, the above empirical study, for example, proofs that  users have been attacked with two types of attacks: phishing attacks and MITM attacks (SSL stripping).

The study above was performed on 3 groups of users:

Groupe 1: usres perform banking tasks using their credentials on their own banking web site
Groupe 2: users perform banking tasks every Sunday afternoon
Groupe 3: similar to Group 2 but users were taught additional instructions to behave securely.

Researchers (who played the role of an attacker), offered login pages with security images where https:// is substituted by http://: all (the three groups)  users typed their credentials.

When the attackers removed away the authentication images were removed and replaced them with warning messages such as This service is being upgraded, 99% of the users (including the ones who have taught security behaviors) typed their credentials.

Conclusion: as security images are not fulfilling what they are supposed to prevent, some online applications decided to use something else instead.


Avast AV could read Firefox saved passwords My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed it read all the stored passwords from Firefox and gave this report.

This clearly shows that passwords were read and compared by a third party tool (Avast). How does Firefox save the passwords? Is it a bug which is being exploited by Avast?

Passwords saved by Firefox are not encrypted (they are encrypted but the key can be read out) until you set a master password. I don't think that this is a bug, but every virus could read those passwords nonetheless


Connecting via SPNEGO/Kerberos out from domain Is it possible to authenticate to SPNEGO/Kerberos server in domain A with an account from the same domain (obviously) when the client is connecting from computer in one of the following (quite similar) situations:

client is authenticated to domain B (different account, no trust between domains) or
user's computer is currently not authenticated against domain A (local login, e.g. when accessing intranet via VPN)

Of course both these cases can not lead to integrated authentication (as the primary computer authentication is different from what needs to be used in Kerberos). However is it possible with Internet Explorer (or Firefox) to ask for credentials and use Kerberos?

When using Kerberos, a connection to KDC required (as far as I know). Is Windows or browser capable locating KDC for the server's SPN?

Strictly speaking, both situations are not possible because they violate the trust semantics of Kerberos.  By definition, the first scenario has a TGT into domain B and domain A doesn't trust it. Your second scenario is similar, except you may not even have a TGT because its local-only. (My statement assumes we are speaking about the use of Kerberos tickets as authentication and not a situation where you're passing plaintext credentials to a server to then present to the KDC for verification).

In both cases, the client application will not have a TGT or service ticket which is valid in domain A for the HTTP service to validate with the KDC.

That said, there is a way to do this in your second case ... but it assumes that you CAN login into domain A, even if not initially.  This is done by running your client app (Firefox, IE, etc) with a RunAs that authenticates into a network account in domain A. See the /netonly flag of runas cmd (https://technet.microsoft.com/en-us/library/cc771525.aspx).  This works by establishing another login context and runs the application as that context. Windows uses the application's user context to initialize its APIs when making Kerberos related calls and therefore will have a TGT into domain A to carry on its session.


Set up a system to sandbox/capture outbound traffic from Windows PC? Does anyone know of a program/system that is purpose built to allow you to sandbox/contain an outbound connection from a Windows PC? The aim being that you can analyse the data being sent via the connection, without actually letting the data go to a device/system that is not under your control.

The best I can come up with is:

Configure a server with the relevant IP and set it to accept connections for the protocol(s) and port(s).
Statically route the traffic for the outbound connection to said device (either in the client PC's routing table or in the default gateway device).
Configure Wireshark on one end (or both ends) and capture the traffic and then analyse away...

Obviously the above is:

Not terribly convenient or quick to setup each time.
Doesn't give the full picture since any device I setup to masquerade as the same IP/Port probably won't behave in the same manner that the real end point device might. (i.e. I don't know what the other device is configured to do if its a command and control server sending back instructions etc).

How do people lab test this, do they just setup a genuine sandbox environment that is free of sensitive data and let the connection go to the genuine endpoint and monitor the two way traffic?

If it is malware analysis that you wish one virtual machine that is the analysed subject that forwards traffic to another one that is one proxy.
There in the proxy you can decide what passes and what stays and reroute packages if you wish to pre build answers in order to deceive the malware. (fake cc server) when possible :)

For that I usually use vmware workstations
Lab with 1 network interface connected to Network A in VMware
Proxy with 2 network connections one in Network A and another Nated or bridged with another physical interface.

If you wish to have something that handles all this for you fully automated search for cuckoo sandbox :)


Ways to exploit a form action value when it s reflected from URI on React-Django I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows:

<form action="/admin/login/?param=Whateveryouputhere" method="post" id="login-form">

Actually, you can even omit the "param", any value after the question mark will still be reflected. the default value for te param is "/next/" btw.

How could an attacker exploit it, especially via XSS? I tried to escape the the quotations but it failed (they are auto-replaced with URL-encodings). Does it mean it is safe?

I have also checked the network tab of the browser, no other relative JS files are loaded except favicon and magnific popup.

Finally, the URL is in the form of site.com/admin/login/?param=value

Unfortunately since it is prepending a path, there's not much which can be done if you can't escape from the tag. If you had FULL control over the input to the action parameter, then it'd be a different story.

You could achieve XSS here by injecting javascript URI. Here's an example:

javascript:alert(document.cookie);

Here's an example code snippet to test it (PoC):

<form action="javascript:alert(document.cookie);" method="POST">
<input type="submit">
</form>

Tested it on my website and got an alert. It should also execute in context, as the javascript URI usually does.


CentOS Security Tracker Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in.

I understand that CentOS derives most of it's packages from RHEL, which has that kind of page here: https://access.redhat.com/security/cve/

Unfortunately though it looks like CentOS takes the RHEL version numbers and changes them, so it's not possible to check what base version of the RHEL package it came from and whether a particular CVE is fixed in the CentOS package.

As an example, can anyone tell me what version of OpenSSH in CentOS fixes CVE-2014-2653? Is there an easy way (similar to the Red Hat site) to find that info for any CVE and any CentOS package?

So it appears that the Red Hat errata and CentOS errata are the same numbers.

This is Red Hat's format:

 RHSA-YYYY-####

And this is CentOS' format:

 CESA-YYYY:####

Where #### is the same number for both. So, to solve your example question, here's what I did:

I went on the RedHat site and searched for the CVE number. This led me to the CVE page that linked to errata RHSA-2014-1552
CentOS releases its errata on a publicly archived mailing list. In that email, they have the "CentOS Errata and Security Advisory" number, and the package they uploaded to fix it. Now I use the magic of Google and search for "CESA-2014:1552". site:lists.centos.org is optional, since it should be the first result regardless of domain restriction. The search leads me to this email listing the updates to OpenSSH packages. Click the link for the list.

It's not as easy as searching a central online repository (which CentOS woefully does not have) but you can get from point A to B without too much finagling.


Derivation of session keys from master_secrets during session resumption As far as i understand,

Master_key = PRF("pre_master_key", client.random, server.random)

Session keys and other keys derived from Master_key, Client.Random and Server.Random.

After session resumption, Master_key will be same as i know.

Will session keys and other key again derived or it will take previous derived ?

I think key_block generation does not care about whether we are doing resumption or not and is the same in all cases:

From https://tools.ietf.org/html/rfc5246 :

      master_secret = PRF(pre_master_secret, "master secret",
                          ClientHello.random + ServerHello.random)
                          [0..47];

(snip)

   To generate the key material, compute

      key_block = PRF(SecurityParameters.master_secret,
                      "key expansion",
                      SecurityParameters.server_random +
                      SecurityParameters.client_random);

   until enough output has been generated.  Then, the key_block is
   partitioned as follows:

      client_write_MAC_key[SecurityParameters.mac_key_length]
      server_write_MAC_key[SecurityParameters.mac_key_length]
      client_write_key[SecurityParameters.enc_key_length]
      server_write_key[SecurityParameters.enc_key_length]
      client_write_IV[SecurityParameters.fixed_iv_length]
      server_write_IV[SecurityParameters.fixed_iv_length]


How does SRP prevent man-in-middle attacks? SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?

SRP is a Password-Authenticated Key Exchange algorithm. One flawed but simple way to see it is that client and server share a secret, on which the algorithm expands; an attacker trying a man-in-the-middle attack does not know the secret, and cannot successfully impersonate either the client or the server (or both, in a true MitM).

What I describe above is "just" using the password as a (pre-shared) key. PAKE algorithms go a bit further, with a lot of mathematics, to be able to tolerate a shared secret of low entropy (namely, the password): an attacker observing the exchange, or even trying to impersonate the client or the server, does not learn anything which would allow him to "try passwords at home" (i.e. he does not get out of the algorithm a hash of the password), something called an offline dictionary attack. This is done with a subtle dance with a classical key exchange and a commitment.

Simplest to understand is Encrypted Key Exchange in which the exchange is a normal Diffie-Hellman, but client and server both "encrypt" what they send with the password. The "encryption" algorithm must be such that decrypting with the wrong password still yields something which looks like a normal DH message (another element of the group). An attacker who wants to run an offline dictionary attack will want to "retarget" a given exchange, by doing something which amounts to "let's imagine that for this past exchange, I had used password P". With EKE, any "retarget" with another password than the one he indeed used leaves the attacker outside of the DH key exchange, preventing him from obtaining the DH session key and testing his password hypothesis.

(I said "simplest to understand", not "simple". It takes some time to cryptographers to wrap their mind around what really happens in PAKE algorithms, which a friend of mine had once described as "a small miracle".)

Anyway, a PAKE algorithm is a key exchange and results in a shared key K. It is still up to client and server to use K to encrypt and protect subsequent data packets, using the usual paraphernalia of symmetric encryption and MAC. This is why SRP is best used as part of SSL/TLS, the latter providing the mechanisms for tunneling long streams of data.


CTF setup for debugging heap exploits I'm currently studying binary heap exploitation (mainly the glibc (ptmalloc2) implementation), for CTF competitions. The problem I'm facing is debugging challenges designed for a certain glibc version. I know there are some differences between (for example) libc 2.27 and libc 2.31 that can make the exploitation of certain vulnerabilities harder (or impossible) to exploit on newer versions.
This is a template script I usually like to use (with pwntools):
#!/usr/bin/env python3

from pwn import *

BINARY = ""
LIBC = ""
HOST = ""
PORT = 9999

exe = ELF(BINARY)
if LIBC != "":
    libc = ELF(LIBC, checksec=False)

rop = ROP(exe)

context.binary = exe
context.log_level = "debug"

if "remote" in sys.argv:
    io = remote(HOST, PORT)
else:
    io = gdb.debug([BINARY], gdbscript="""
         b main
    """
    )

io.interactive()

This makes debugging locally extremely easy and fast IMO.
I'd like to have a method to easily be able to debug programs using the same (or kind of the same) script as above and using the right glibc (and ld as both are required to be the same version) version without messing with my system's library.
How do I do that?

If you know the libc version, it is possibly to find a dynamic linker (ld) through a package database and download it.
To run the binary with a linker and libc that aren't your system defaults, you can use the environment variable LD_PRELOAD to specify the library and pass the binary as an argument to the linker.
For example, if given the files libc-2.27.so and vuln, you would find a ./ld-2.27.so online to match the libc version.
Then, to run the binary with the correct libc, you could use:
$ LD_PRELOAD=/path/to/libc-2.27.so ./ld-2.27.so ./vuln

It is possible to use this in pwntools with:
#!/usr/bin/env python3

from pwn import *

bin = ELF("./vuln")
libc = ELF("./libc-2.27.so")
ld = ELF("./ld-2.27.so")

context.binary = bin

io = process([ld.path, bin.path], env={"LD_PRELOAD": libc.path})

I would also recommend looking at pwninit, which will automatically find and download a linker for your libc and write the pwntools stub.


malware stream my phone activities to attacker I have a rooted android phone and I know there's a malware in the phone . The malware is capable of automatically connect to a nearby bluetooth device or wifi ap and stream whatever I do on the phone to the attacker .

My questions  :

What is the best way to dig out the malware ?
Which part of android filesystem should I look into to dig out the malware ?
What effective tool can I use to log the bluetooth and wifi connection if netstat and ifconfig can't detect the connection ?

1) Unless you know very well what you're doing (for example experience with malware reverse engineering) or you know the exact malware used, I would advise against this. I would say it's better to just format the phone outright.

2) How do you know that there is malware on your phone? This would help track down where you might want to look.

3) This website talks about recording Bluetooth packets. This uses the phone's storage so it may be compromised by the malware, but I have personally not found malware that modifies these logs. According to http://www.fte.com/WebHelp/BPA600/Content/Documentation/WhitePapers/BPA600/Encryption/GettingAndroidLinkKey/RetrievingHCIlog.htm the way to get the logs of Bluetooth packets is as follows:

On the Android device go to Settings.
Select Developer options.
Click to enable Bluetooth HCI snoop logging.
Return to the Settings screen and select Developer options.
In the Developer options screen select Enable Bluetooth HCI snoop log. The log file is now enabled.
On the Android device turn off Bluetooth.
Turn on Bluetooth.
Reboot the Android device.
The HCI log file is now being generated and is saved to /sdcard/btsnoop_hci.log.

As for recording communication over WiFi, I would recommend connecting to the AP and running WireShark on your computer to see what packets are flowing between your phone and the AP.


Can Chromebooks be affected by malware from an SD Card? I've got an SD card that I think might contain infected files. However, those files are from my Windows days. I hear that Chrome OS is pretty hardy, and that it's really only posisble to get damage from apps and extensions. But if I were to, say, plug in an SD card that's got malware on it... what then? Sounds to me like giving it a free pass to the Chrome Zone...

My main concern is that whatever may be on the card could infect personal files on the Chromebook, and vice versa. I'm not too concerned about the system files, since I know Chrome OS runs every app in a sandbox and has that verified boot thing. Only thing that's got me worried is that the file viewer is just one app, so it seems to me like something could spread in there.

Perhaps worth mentioning is that the only types of files on it are mp3s, videos, and images. I'm willing to bet I'm probably alright, since I think those kinds of files only cause harm if opened in a specific application, but I don't know how every type of malware would act.

I'm aware that a lot of malware out there is only built for a specific OS, but I figured I would ask about it just to be safe.

In Chrome OS, all Android apps are running in emulation mode. We can say that due to that, there is some security advantages if we compare it to Android, especially that the device administrator permissions are unavailable on Chrome OS.

But even with that, hackers could always  steal user data, phishing, hijacking CPU power (botnets and cryptomining)...

We can say that Android malware is the same as Chromebook's malware.


Open Source Vulnerability Scanner I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes are scanned and a composite report for each of them is served up.

I've been looking into OpenVAS and it looks like it might do exactly what I need. Has anybody ever used this before? Does anybody have any other recommendations? I'm only skeptical because the User Manual is virtually non-existent and I'd hate to invest a whole of time downloading and installing a software whose project is more or less extinct. Thanks for any feedback/suggestions!

Nessus and Nexpose are not open sourced. They do have free community versions though.

I have tried using OpenVAS, but i simply could not get it to work on my Backtrack installation. It is an active project though, which has regular updates.


From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work? I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?

Please note that I am not looking for instructions on how to exploit nor I am interested in reproducing it in any way; I'm merely curious about the technical background behind it.

Some Relevant Links:

Microsoft Security Advisory 2757760
CVE-20012-4969 on MITRE
CVE-20012-4969 on NVD
CVE-20012-4969 on CVE Details

CVE-2012-4969, aka the latest IE 0-day, is a based on a use-after-free bug in IE's rendering engine. A use-after-free occurs when a dynamically allocated block of memory is used after it has been disposed of (i.e. freed). Such a bug can be exploited by creating a situation where an internal structure contains pointers to sensitive memory locations (e.g. the stack or executable heap blocks) in a way that causes the program to copy shellcode into an executable area.

In this case, the problem is with the CMshtmlEd::Exec function in mshtml.dll. The CMshtmlEd object is freed unexpectedly, then the Exec method is called on it after the free operation.

First, I'd like to cover some theory. If you already know how use-after-free works, then feel free to skip ahead.

At a low level, a class can be equated to a memory region that contains its state (e.g. fields, properties, internal variables, etc) and a set of functions that operate on it. The functions actually take a "hidden" parameter, which points to the memory region that contains the instance state.

For example (excuse my terrible pseudo-C++):

class Account
{
    int balance = 0;
    int transactionCount = 0;

    void Account::AddBalance(int amount)
    {
        balance += amount;
        transactionCount++;
    }

    void Account::SubtractBalance(int amount)
    {
        balance -= amount;
        transactionCount++;
    }
}

The above can actually be represented as the following:

private struct Account
{
    int balance = 0;
    int transactionCount = 0;
}

public void* Account_Create()
{
    Account* account = (Account*)malloc(sizeof(Account));
    account->balance = 0;
    account->transactionCount = 0;
    return (void*)account;
}

public void Account_Destroy(void* instance)
{
    free(instance);
}

public void Account_AddBalance(void* instance, int amount)
{
    ((Account*)instance)->balance += amount;
    ((Account*)Account)->transactionCount++;
}

public void Account_SubtractBalance(void* instance, int amount)
{
    ((Account*)instance)->balance -= amount;
    ((Account*)instance)->transactionCount++;
}

public int Account_GetBalance(void* instance)
{
    return ((Account*)instance)->balance;
}

public int Account_GetTransactionCount(void* instance)
{
    return ((Account*)instance)->transactionCount;
}

I'm using void* to demonstrate the opaque nature of the reference, but that's not really important. The point is that we don't want anyone to be able to alter the Account struct manually, otherwise they could add money arbitrarily, or modify the balance without increasing the transaction counter.

Now, imagine we do something like this:

void* myAccount = Account_Create();
Account_AddBalance(myAccount, 100);
Account_SubtractBalance(myAccount, 75);
// ...
Account_Destroy(myAccount);
// ...
if(Account_GetBalance(myAccount) > 1000) // <-- !!! use after free !!!
    ApproveLoan();

Now, by the time we reach Account_GetBalance, the pointer value in myAccount actually points to memory that is in an indeterminate state. Now, imagine we can do the following:

Trigger the call to Account_Destroy reliably.
Execute any operation after Account_Destroy but before Account_GetBalance that allows us to allocate a reasonable amount of memory, with contents of our choosing.

Usually, these calls are triggered in different places, so it's not too difficult to achieve this. Now, here's what happens:

Account_Create allocates an 8-byte block of memory (4 bytes for each field) and returns a pointer to it. This pointer is now stored in the myAccount variable.
Account_Destroy frees the memory. The myAccount variable still points to the same memory address.
We trigger our memory allocation, containing repeating blocks of 39 05 00 00 01 00 00 00. This pattern correlates to balance = 1337 and transactionCount = 1. Since the old memory block is now marked as free, it is very likely that the memory manager will write our new memory over the old memory block.
Account_GetBalance is called, expecting to point to an Account struct. In actuality, it points to our overwritten memory block, resulting in our balance actually being 1337, so the loan is approved!

This is all a simplification, of course, and real classes create rather more obtuse and complex code. The point is that a class instance is really just a pointer to a block of data, and class methods are just the same as any other function, but they "silently" accept a pointer to the instance as a parameter.

This principle can be extended to control values on the stack, which in turn causes program execution to be modified. Usually, the goal is to drop shellcode on the stack, then overwrite a return address such that it now points to a jmp esp instruction, which then runs the shellcode.

This trick works on non-DEP machines, but when DEP is enabled it prevents execution of the stack. Instead, the shellcode must be designed using Return-Oriented Programming (ROP), which uses small blocks of legitimate code from the application and its modules to perform an API call, in order to bypass DEP.

Anyway, I'm going off-topic a bit, so let's get into the juicy details of CVE-2012-4969!

In the wild, the payload was dropped via a packed Flash file, designed to exploit the Java vulnerability and the new IE bug in one go. There's also been some interesting analysis of it by AlienVault.

The metasploit module says the following:

  This module exploits a vulnerability found in Microsoft Internet Explorer (MSIE). When rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner, but the same memory is reused again later in the CMshtmlEd::Exec() function, leading to a use-after-free condition.

There's also an interesting blog post about the bug, albeit in rather poor English - I believe the author is Chinese. Anyway, the blog post goes into some detail:

  When the execCommand function of IE execute a command event, will allocated the corresponding CMshtmlEd object by AddCommandTarget function, and then call mshtml@CMshtmlEd::Exec() function execution. But, after the execCommand function to add the corresponding event, will immediately trigger and call the corresponding event function. Through the document.write("L") function to rewrite html in the corresponding event function be called. Thereby lead IE call CHTMLEditor::DeleteCommandTarget to release the original applied object of CMshtmlEd, and then cause triggered the used-after-free vulnerability when behind execute the msheml!CMshtmlEd::Exec() function.

Let's see if we can parse that into something a little more readable:

An event is applied to an element in the document.
The event executes, via execCommand, which allocates a CMshtmlEd object via the AddCommandTarget function.
The target event uses document.write to modify the page.
The event is no longer needed, so the CMshtmlEd object is freed via CHTMLEditor::DeleteCommandTarget.
execCommand later calls CMshtmlEd::Exec() on that object, after it has been freed.

Part of the code at the crash site looks like this:

637d464e 8b07            mov     eax,dword ptr [edi]
637d4650 57              push    edi
637d4651 ff5008          call    dword ptr [eax+8]

The use-after-free allows the attacker to control the value of edi, which can be modified to point at memory that the attacker controls. Let's say that we can insert arbitrary code into memory at 01234f00, via a memory allocation. We populate the data as follows:

01234f00:    01234f08
01234f04:    41414141
01234f08:    01234f0a
01234f0a:    cccccccc // int3 breakpoint

We set edi to 01234f00, via the use-after-free bug.
mov eax,dword ptr [edi] results in eax being populated with the memory at the address in edi, i.e. 01234f00.
push edi pushes 01234f00 to the stack.
call dword ptr [eax+8] takes eax (which is 01234f00) and adds 8 to it, giving us 01234f08. It then dereferences that memory address, giving us 01234f0a. Finally, it calls 01234f0a.
The data at 01234f0a is treated as an instruction. cc translates to an int3, which causes the debugger to raise a breakpoint. We've executed code!

This allows us to control eip, so we can modify program flow to our own shellcode, or to a ROP chain.

Please keep in mind that the above is just an example, and in reality there are many other challenges in exploiting this bug. It's a pretty standard use-after-free, but the nature of JavaScript makes for some interesting timing and heap-spraying tricks, and DEP forces us to use ROP to gain an executable memory block.

Anyway, this was fun to research, and I hope it helps.


How to distinguish between "normal internet" Port scan and more "serious" port scan preparing attack? In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here.  Of course, there is a private network and public servers.

in the LogPoint there is an alert called "port scans" which is triggered whenever one source hits one destination on 100 different ports in 5 minutes.

With these logs How would you distinguish "normal" Port scan that happens every day on the internet, and port scan that can be a preparation for an attack and are more "serious" port scanning.

You can't because there isn't one. Unless a port scan is:

Initiated by you.
Initiated on your request or behalf by a security partner.

It is malicious. You can block them as you wish. The sole purpose of port scans, malicious or not, is to find weaknesses and vulnerable services in your internet facing gateway. If you or a partner does it, it's to help you strengthen your posture. If anyone else does it, it's to determine if you're worth attacking, and how to best launch that attack.


Can a wifi provider decrypt HTTPS usind MITM without users noticing? As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid.

So I could MITM all https traffic, and spy on my users?

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid.

Yes you could do man-in-the-middle attacks on the router. But you cannot usually do SSL intercepting without the user noticing because the browser warns about invalid certificates.

To do interception without these warnings you have to either make the user to accept your interception CA as trusted which usually means that you have access to the users system (in which case you could do much more harm). Or you have access to the private key for the specific certificate you like to mitm, or you have access to an intermediate CA signed by a CA trusted by the user. In both of these latter cases any hosts using certificate/public key pinning will still cause security errors.

Which CA's are trusted depend on the browser and OS and you can simply cause the system to trust additional CA's without user interaction or without having access to the users system. But you might try to hijack the download of Firefox which comes with its own set of trusted CA's and replace the CA's with something else. Of course if you manage this you could even simply bundle some malware to the browser or modify the browser so that it does not properly check certificates at all.


How does a private OpenPGP key's passphrase add to its security? I am a novice user of OpenPGP. I use GPGTools for OS X.
I have several connected questions, but difficult to find direct answers on the Internet.

When I create a key-pair, the password I enter is a passphrase that encrypts my private key only on my machine, and it is NOT a passphrase that is needed to decrypt encoded messages, correct?
If the above statement is correct, does it mean that the password I use to decrypt a message is actually just the passphrase that unlocks my private key: therefore if I loose my private key (let us say, drop my computer in the Pacific), so even if I reveal my passcode, nothing can be done since it is used only to unlock a specific file?
The brute-force technique breaks an OpenPGP encrypted text only via the private key (which is usually very long); consequently the brute-force technique used to break the private PGP key is done via the passphrase (known to the owner of the key) when the key was created for 'storage purpose'. Is that correct?

Sorry for the numerous questions, but I believe these represents one question for which answering I couldn't find anywhere.

Thank you.

If you have an encrypted private key, this means a private key was generated from random numbers and then symmetrically encrypted using your passphrase. With other words, the private key is not generated by the passphrase, but only protected through it.

  When I create a key-pair, the password I enter is a passphrase that encrypts my private key only on my machine, and it is NOT a passphrase that is needed to decrypt encoded messages, correct?

The private key is encrypted using your passphrase, that's right. But this also means if you want to decrypt a message (which requires your unencrypted private key), you have to enter your passphrase to decrypt it.

  If the above statement is correct, does it mean that the password I use to decrypt a message is actually just the passphrase that unlocks my private key: therefore if I loose my private key (let us say, drop my computer in the Pacific), so even if I reveal my passcode, nothing can be done since it is used only to unlock a specific file?

Then again, of course the passphrase alone is not sufficient to decrypt the message, so your "dropped into the sea" metaphor works out. The passphrase is of no use without the encrypted private key.

  The brute-force technique breaks an OpenPGP encrypted text only via the private key (which is usually very long); consequently the brute-force technique used to break the private PGP key is done via the passphrase (known to the owner of the key) when the key was created for 'storage purpose'. Is that correct?

Of course, the encrypted private key might be revealed by brute-forcing the passphrase (but with reasonable/default settings of GnuPG and an adequate complex passphrase, this is no practical attack surface as long as the algorithms used are not proved insecure). But at the same time, an attacker might of course also try to guess/brute force the (unencrypted) copy of your private key. Given you had vast and sufficient computational resources, you could brute force any of them; brute-forcing the passphrase is likely less expensive but require knowledge of the encrypted private key, while brute-forcing the key requires nothing but an encrypted message.


Can a good SSO protocol be built around a server signing tickets rather than validating them on demand? CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service:

Service A makes a request to Service B on behalf of a user. The request includes a perishable token (proxy ticket) from the authentication server.
Service B forwards the token to the authentication server, asking if it's valid.

It seems like it could be more efficient to have the authentication server sign the ticket, and have Service B know the server's public key so that it can validate the ticket on its own, with no need for the extra request. Obviously any single-sign-out functionality would have to be left to Service A, but otherwise this seems like all-upside: it's more robust in the face of network latency or the auth server going down, and it's even harder to brute-force than a random token.

Are there downsides or risks that I'm missing? Has anybody actually implemented this?

To some extent, what you suggest exists: it is called X.509 certificates.

The main problems with signed tokens are:

Control latency: once a token has been signed, it cannot be promptly canceled; you have to wait for expiration of the token. Or you implement an online revocation check (which is called OCSP in the case of X.509 certificates), which brings you back to the "online authentication server" model.
Clock synchronization: to enforce an expiry date, a verifier must have a reasonably accurate clock, which can be a challenge in a security context. Indeed, modern operating systems know NTP out of the box, but NTP is not protected.
Signed tokens to authentication, not authorization. The B server wants to be sure that it is talking to the right client, but also wants to know whether that client is allowed to access the service. It is not easy to fit a generic authorization matrix inside a signed token. About everybody who tried to work with X.509 certificates tried to use them for authorization, and regretted it.

With an online authentication server, that both A and B talk to, that authentication server can act as a big kill switch, with immediate cancellation and also possible fine-grained authorization control.


Is the TPM 1.2 Direct Anonymous Attestation Anonymity Revocation Still useful for random base names? I have implemented the Trusted Computing Group's TSS Version 1.2 Direct Anonymous Attestation according to their specification and this includes the Anonymity Revocation. There have been papers discussing privacy flaws among corrupt administrators but it seems that it's only a problem if the base names are not random - that is if they are named.

I use random basenames and I like that idea anyway because it enhances privacy. Random base names are useful for unlinkable applications, such as anonymous web browsing (see "Direct Anonymous Attestation: Enhancing Cloud Service User Privacy." - references it sites for flaws are concerned with linked basenames).

The literature over the years has been ambiguous. I sent out email to one of the algorithm designers of the TPM 1.2 DAA schemes and he has not responded. I'm wondering if anyone out there has an answer. I am holding off of deployment of this implementation I spent many hours on until I can get an answer on whether the anonymity revocation feature of the 1.2 spec is useful. Thanks in advance.

I should prefix this by warning you that this is not an area I have a lot of experience with, but from what I've read the DAA anonymity revocation was added by the working group as a feature for potential beneficial use, but no discussion was had around what scenario might make practical use of it.

The only possible case I can think of is some kind of cross-verification system in which two separate services require proof that the same device is being used for both of them, while also maintaining some privacy via a chosen random base name for that pair of systems.

I am wholly unaware of any system which uses this in reality, and it appears that nobody has thus far had any interest in implementing it for practical use.


Possible for Lync (Skype for Business) to adopt Activesync-style policies? My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes.

This also made me realize that our other email policies (encrypted device, pin required, etc) should also be adopted for this form of communication.

Is there any way to get a Lync client (or comparable/compatible 3rd party) to adopt Activesync-style encryption policies?

It's been a while since I last worked closely with Lync server, but while you can exercise quite a bit of control over the content of the conversations, I don't believe that it directly allows for Activesync style encryption policies.  I sadly no longer have a configured environment to go digging on to verify that though, so take this answer with a large grain of salt as a fair bit speculative.


Using SHA-256 to preprocess password before bcrypt? I would like to allow users of my web application to have long passwords, if they so wish. Today I became aware of bcrypt's password length limitation (72 characters, the rest truncated).

Would it be secure for me to do the following? I am using PHP.

Current Implementation:

password_hash($password, PASSWORD_BCRYPT, $options);

Implementation in question:

password_hash(hash('sha256', $password), PASSWORD_BCRYPT, $option);

What are the drawbacks of the implementation in question?

I am not a crypto expert, please advise.

Will the implementation in question limit the password length that a user can use? If so, what will the limit be?

In general, this will be fine. It's even a fairly well recommended method to allow arbitrary length passwords in bcrypt.

Mathematically, you are now using bcrypt on a 64 character string, where there are 2^256 possible values (SHA-256 gives 256 bit output, which is commonly represented as a 64 character hexadecimal string). Even if someone pre-calculated common passwords in SHA-256, they'd need to run those through bcrypt to find what the actual input for a given hash was.

The main potential drawback is implementation flaws: if you ever store the SHA-256 values, they're relatively fast to break, so an attacker wouldn't need to expend the effort to break the bcrypt values.

It would still be recommended to keep a high enough iteration count for the bcrypt step - this shouldn't have any particularly detrimental effect on your processing time, but makes brute force attacks much harder.

See Pre-hash password before applying bcrypt to avoid restricting password length for the general case.


Vulnerability management and assessment tracking solutions How does your company track the vulnerability management information that happens between receiving a vulnerability scan report and remediating a vulnerability?

Given the following example:

Scan A detects
  Vuln 1
  Vuln 2
  Vuln 3

You decide not to remediate Vuln 2 and 3, but you do remediate Vuln 1. At a later date you conduct another scan (Scan B):

Scan B detects
  Vuln 2
  Vuln 3
  Vuln 4

Putting the vulnerability information into a large master spreadsheet along with remediation decisions (whether or not to remediate) and manually updating it would allow you to keep track of vulnerability decisions so you're not constantly re-evaluating the same vulnerabilities (Vuln 2 and 3 in the example above) from scan to scan.

Is it common practice to have a large master spreadsheet that contains the relevant information for vulnerabilities found by scans (target, vulnerability, risk ranking, remediation decisioning notes, etc...) that is manually kept up to date across vulnerability scans or is there some other common practice or well-known tool(s) that does a better job tracking this information?

I am using Database (Based on mysql and PHP). It is more valuable and easy to maintain. I don't like to use excel Spreadsheet. Therefore i have database and updates are done by manually.

All attributes which you have mentioned are included in  my database and additionally i have been added how remediation was done or why it was not done.

Best Practices of Vulnerability Recordings are below.

Record all related Details about Vulnerability and remediate action.
do vulnerability assessment at least once a quarter, and compare with
previous result.
According to second line, your records should be able to compare with previous result. therefore DB is more useful than excel sheet.
Do VA with Different methods and all details are needs to be recorded separately.
Record analysis are very important, Again database more helpful than excel sheet.
when you conduct Audit, result needs to be accessible without any delay and again database will be provided more flexible accessibility than excel sheet.
Main thing, Vulnerability Scan results are very sensitive and confidential data. It needs to be stored in high secure environment. Database will be provided high secure environment than excel sheet.


Should I use FileZilla? Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a completely unencrypted form, but as Mozilla says - surely it is the job  of the operating system to protect the configuration files?

So, is there any other reason why I should no longer use FileZilla, as I've never had any problems with it? Somebody mentioned to me that the way it works isn't secure either, but I think they were just getting confused over the fact FTP transmits passwords in plain text anyway.

FileZilla per se isn't inherently insecure. Yes, it's storing passwords in plaintext, but the alternatives are only slightly more secure. You see, encrypting the credentials requires an encryption key which needs to be stored somewhere. If a malware is running on your user account, they have as much access to what you (or any other application running at the same level) have. Meaning they will also have access to the encryption keys or the keys encrypting the encryption keys and so on.

Your best option here is to disable password storage in FileZilla

Then start using KeePass to store your account credentials. There are also many guides on the Internet about how to integrate KeePass with FileZilla. Doing this, you're storing the encryption key somewhere where malware don't have access; you're storing the encryption key (or rather, the password from which the encryption key is derived) in your brain.

Finally (and perhaps this is a bit outside the scope of your question), please make sure you move away from FTP in favor of SFTP.


How does Intel SGX protect itself from being simulated? I'm trying to understand how secure Intel SGX actually is.

According to Intel:

  Note that developers cannot rely on a measurement supplied by system software; as noted earlier, software can always be virtualized or otherwise spoofed by suitably privileged rogue software. This implies that hardware must be responsible for supplying this measurement – the same hardware that establishes the trusted environment, loads/initializes the trusted application, and (ultimately) performs computations on the sensitive data.

However, what is stopping rogue software from virtualizing the Intel SGX extension itself, so that the enclaves and basically the whole thing becomes fake? One might claim that the hardware uses a built-in secret key for signing, but if rogue software sits in between the hardware and the software, it can wrap SGX completely and have it "measure" the right code to produce the desired signatures, to then get the trusted party to send protected data, to then execute it as-if it is running in an enclave. What am I missing?

The SGX enclave uses a built-in secret key for transmission of information to and from the enclave. Even if you wrap SGX in rogue software, you still cannot decrypt information sent to it. The best you can do with rogue software is trick a client in sending you encrypted data.

The vulnerability lies with a rogue SGX manufacturer who could save the built-in secret key when the SGX hardware is produced.


RSA/ECB/PKCS1Padding: Encrypting a Session Key JavaScript How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have to use RSA/ECB/PKCS1Padding but I am not finding any references to mode when dealing with RSA.

We generate a AES-256 session key on server and send to client. (We forget the session key)
Client encrypts his data block with symmetric AES/ECB/PKCS7Padding (using cryptojs)
Client encrypts his session key with 2048-bit Aadhar public key using asymmetric algorithm (RSA/ECB/PKCS1Padding)
Client also calculates HMAC of Data Block
Client sends us the three fields, the server fills in other data and sends to Aadhar server

So we need to do RSA/ECB/PKCS1Padding in the web client in Javascript. CryptoJS doesnot support RSA so you can use any other library

If somebody can tell me if the Forge library's example

var encrypted = publicKey.encrypt(bytes, 'RSAES-PKCS1-V1_5');

uses ECB or not. There are references to RSA/ECB/OAEPWithSHA-256AndMGF1Padding but I need PKCS#1 padding

Can you suggest me any other library or tell me proper code in Forge?

If I can do this in PHP on server side then also I can send session key and encrypted session key to client and then forget the session key.

I donot understand much cryptography but understand the terms somewhat.

ECB doesn't even make sense in the context of RSA. It's a mode of operation for symmetric ciphers like AES. More info:

http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#ECB

PKCS1Padding, however, does apply to RSA. And you're right - that likely means RSAES-PKCS1-V1_5. For the PHP side you can use phpseclib. eg.

<?php
include('Crypt/RSA.php');

$rsa = new Crypt_RSA();
$rsa->loadKey('...'); // public key

$plaintext = '...';

$rsa->setEncryptionMode(CRYPT_RSA_ENCRYPTION_PKCS1);
$ciphertext = $rsa->encrypt($plaintext);

$rsa->loadKey('...'); // private key
echo $rsa->decrypt($ciphertext);
?>

URL: http://phpseclib.sourceforge.net/


Service for Google two step verfication Google says:

"Why you shouldn’t use Google Voice to receive verification codes
If you use Google Voice to receive verification codes, you can easily create a situation where you’ve locked yourself out of your account.

For example, if you are signed out of your Google Voice app, you might need a verification code to get back in. However, you won’t be able to receive this verification code because it will be sent to your Google Voice, which you can’t access." (https://support.google.com/accounts/answer/185834?hl=en)

Then is there any message service that I can use for Google two step verification other than ones by telecom carriers (AT&T, Verizon, etc)

Mostly, I use the Google Authenticator App on my Smartphone as the primary means.

When necessary, it pops up and I tap the green checkmark to pass the 2FA part.

For account recovery I use Google Voice and have linked my phones (2 cellphones, one dumb and one smart, but both can receive texts) to Voice, so a text will go to both of them.

Then at Google I have set it to use an account at Yahoo as my alternate.  I never use it directly, and have it set to forward to my gmail, which, thanks to linking to Google Voice, makes it show up on both phones.

That way you can't ever lose control.


How to defend against a virus that hides the payload by encrypting it? Recently I've started to learn more about the way antivirus and other anti malware products work, and I realized that most of them mainly use 3 different techniques to detect and stop malware:

Signature-based detection
Heuristic analysis
Sandboxing (for the files that go through the filtering of 1. and 2.)

At first it seemed to me like a great idea, especially the sandboxing smart features that may be able to detect delayed execution, virtual machine countermeasures, encryption and more.

Then a way to bypass those detection techniques came through my mind, so I tested it and it works against every antivirus I tried and probably on any one relying on those techniques:

What if the malicious code is encrypted in an innocent looking file with a pass phrase that will be known only by the victim (who is completely unaware of it of course) and that'll be needed to decrypt the malicious code and run it at execution time?

Let's say some malicious code is encrypted using AES256 encryption function with a specific pass phrase. Then the encrypted resulting string is put into a JScript file that contains the instructions to decrypt it once the user type the pass phrase  and run it through an eval() function at runtime. There is no way for the antivirus to know nor guess the pass phrase right? And no way to know there is malicious code hidden inside that JScript file. And since it'll be decrypted in memory only at runtime, without ever being written on the disk, signature-based detection and heuristics analysis will fail. Same for the sandboxing since no malicious action will be triggered without the user typing the pass phrase.

Now to make the user type the pass phrase, a simple kind of Captcha may be used, that asks the user to type the words he sees in a picture (or ASCII drawing for example ^^) in order to make sure he's not a robot. Then when the user will type it, the malicious code will be decrypted and executed.

How would one defend against this sort of attack? Perhaps an advanced antivirus using deep learning techniques might be able to detect it, but it seems to me that current antivirus programs are completely vulnerable to it.

Updated: code sample illustrating the above technique

Here is a simple implementation in JScript :

var encryptionFunction = ; // Any encryption function, e.g. AES256 from CryptoJS

var hiddenCode = ; // Write any code here, e.g. WScript.Echo('My code has been executed !');

var passphrase = "Any pass phrase"; // It'll be used as a CAPTCHA challenge-response, e.g. picture with the passphrase or ASCII drawing

var encryptedCode = encryptionFunction(hiddenCode, passphrase); // Our hidden code will be encrypted with the passphrase

var template = "var decryptionFunction = ;" + // The decryption function is defined here

               "var passphrase = InputBox('Your CAPTCHA challenge goes here');" + // CAPTCHA in an Input Box, user's input = passphrase

               "eval(decryptionFunction('" + encryptedCode + "', passphrase))"; // Decryption of the encrypted code thanks to the user's input and run at execution time through eval()

var file = ; // Create a new JScript file (or WSF) and put the template as its content

08/04/2017 - Proof of concept + Antivirus scan

I have added a proof of concept:  https://gist.github.com/Joel-L-G/6cd8aede4126e71f361aeb90eecf4999

It's basically a simple WSF file that will display a window asking for a password, hidden in an ASCII drawing. Once the user types the correct password, the encrypted code embedded inside the file will be decrypted and executed at runtime, displaying a mere "My code has been executed !" inside a window.

As I thought, the decrypting routine wasn't considered as malicious by any antivirus on VirusTotal (0/56), here is the antivirus scan:  https://www.virustotal.com/en/file/a7d453fa3aa23d10144ce13b2a7a94120f664368f35a5ca32dc731c608f14c0e/analysis/

From my understanding this question narrows down a more general question to a very specific single example. The more general question is: how can some analysis system (antivirus etc) detect that some software is malicious if it only behaves malicious in a specific environment, with specific input data etc. This can be a password protected archive where the password is known to the user (like contained as text in the phishing mail), this can be code encrypted with a password which needs to be entered by the user, this can be the dependency on a specific OS, installed software or similar.

The answer in all these cases is: no analysis software can detect for sure that the analyzed software can be malicious. At most it might employ some heuristics which detects pattern typically associated with such behavior, like checking the specific OS and browser version or installed software, using data entered by the user for operations which might look like decryption etc. But these heuristics are not fully reliable, i.e. they might detect problems where no malicious behavior is and they will miss a lot of real problems.

Therefore such analysis can only be one part of the protection. Further parts might be to detect unusual system behavior, downloads from sites with bad reputation or only allowing whitelisted software to run.


why CVSS give a score of 0.66 for a full impact on CIA? By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values for confidentiality, integrity and availability:

none :           0.0
partial impact : 0.275
complete:        0.660

So, I would like to understand why is this given a value of 0.66 for a full impact? Why the value can not be higher than 0.66 since we have complete impact on the asset? In this case, how to explain a vulnerability with a full score for the three security attributes?

Furthermore, why assigning the same scores for all the three security attributes confidentiality, integrity and availability?

The scores baseline is relatively arbitrary - if you multiplied everything up so that 1 was the top score for full impact it would just change the resultant number output. It wouldn't change the meaning in any way, nor the relative scoring, which is the only important output anyway. From the nvd website you will see the figures were chosen to give 10 as a top score as that is simple to understand:

  CVSS consists of 3 groups: Base, Temporal and Environmental. Each group produces
  a numeric score ranging from 0 to 10

If you try putting in the scores from a particular example, you will see how it fits with the levels assigned.

The three areas, confidentiality, integrity and availability are often considered as equal value. For some industries availability is the most important, for others it is integrity, and others it is confidentiality - so while a particular industry may not have them all at the same value, on aggregate it is easier to treat them equally.


Techniques to find out the domain a given name server resolves for So I am asking this question cause I have been stuck in this situation a few times while carrying out pen tests.
A few times I find an IP with DNS service up and running and I am not able to find out what domain this IP is serving. I can do all the basic stuff like enumerating its version, dns cache snooping and all. I can even do a reverse resolution for the total IP range in which that IP falls into, basic whois stuff to gather the most likely domain that DNS server does resolution for. Still then in a few cases I end up with nothing. It also might be the case that its in a different mode of operation.
Either way, are there any known testing techniques you guys know that can pinpoint the domain a given DNS server resolves for or what mode it is operating in.

For example:-

Default Server:  UnKnown

Address:  10.211.55.1

server x.x.x.x

Default Server:  [x.x.x.x]

Address:  x.x.x.x

set type=any

domain.com (all domains found through reconnaissance)

Server:  [x.x.x.x]

Address:  x.x.x.x

*** [x.x.x.x] can't find test.com: Query refused

Even after I go through a list of all the domains I find through recon exercises, I have nothing. Are there known techniques to find out what the server x.x.x.x will resolve for?

Please let me know if my question still needs clarity.

Thanks

If your looking for all the DNS names that are served on a particular IP Address you can use http://www.ip-neighbors.com/ or recon-ng has some modules for IP enumeration as well.

As a last resort, if you have the client's FQDN, run Fierce or another DNS brute-forcing tool and cross reference your results.


Helping developers find logic and authorisation flaws Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, penetration testing is performed infrequently, so there is a desire for developers to do more security QA in-house.

In-house security QA is usually done with a security tool - either a web scanner or a static code analyser. These tools are great for some vulnerabilities (e.g. cross-site scripting) but they usually cannot find logic or authorisation flaws at all.

So, how can we help developers find logic and authorisation flaws?

This has been covered before, but in my opinion, the best way to help developers find flaws that could lead to exploitation is to teach them to exploit code, teach them how to execute an SQL Injection attack or a direct object reference attack. Set up a capture-the-flag competition in-house with developers using their new hacking skills to break the sort of code they're used to writing.

Once you actually see how the exploits work, and once you've spent some time exploiting it yourself, then places in code you see that are exploitable start to draw attention to themselves. Once you've been trained to look for these flaws as an attacker, you can't turn it off. You see them everywhere. And the more time you spend "hacking", the brighter they start to show up. What yesterday was a time-saving trick now becomes an stepping-stone to privileges escalation. It's just a matter of perspective.

Presumably your developers will never have a use for the hacking skills you teach them, but you want them to have those skills anyway. It completely changes their point of view as developers and changes the type of code they produce.


Is it allowed to store 8-digit BINs outside of CDE Can I separately store 8-digit BINs and truncated (6/4) PANs outside of my CDE?

Truncated PANs are no more than the first 6 and last 4 digits of PAN, compliant to the standard's section 3.4, but it only says:

  The intent of truncation is to permanently remove a segment of PAN data so that only a portion of the PAN is stored.

from which I am not sure if it's still allowed to have the first 8 digits separately, for other purposes, let's say, to maintain a mapping from BIN to bank name.

Current standard: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf

Also a note from https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/What-are-acceptable-formats-for-truncation-of-primary-account-numbers and https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/Are-truncated-Primary-Account-Numbers-PAN-required-to-be-protected-in-accordance-with-PCI-DSS which makes sense but I didn't find anything similar in the standard:

  Access to different truncation formats of the same PAN greatly increases the ability to reconstruct full PAN, and the security value provided by an individual truncated PAN is significantly reduced.  If the same PAN is truncated using more than one truncation format (for example, different truncation formats are used on different systems), additional controls should be in place to ensure that the truncated versions cannot be correlated to reconstruct additional digits of the original PAN.

I checked related Q&As, none of which mentions 8-digits:

Storing last 6 digits of payment card vs 4 digits
Minimum requirements for storing last 4 digits of credit card number?
Is PCI-DSS compliance required for non-credit card payment source?
Creditcard store first six digits PCI reference
PCI Compliance requirement when storing card data on user's device
Does transmitting first 6 and last 4 digits of the card number and expire date require PCI DSS compliance?

It follows directly from PCI DSS requirement 3.4 that PANs are the defining entity for the CDE system and truncation is the normal mode of storage.

But even if you would store them somewhere which you define not to be the CDE the DSS will still apply to that, as it is a connected system and DSS regulations will apply to the system and processes anyway.

I don't think BINs alone have this problem/requirement, but be very careful I would never extract the  from existing PANs but maintain them from external sources. Especially if you are unsure if they are 6 or 8 digits. (This way it might not be a connected system).


Public key encryption with modified private key requried I want the encryptor to be able to choose a key X and using it and the public key, he will be able to encrypt a message m. Then I get the key X and using the matching private key I'm able to generate another key Y, which using it anyone can decrypt messages encrypted with X, and only with it. Is such a cryptosystem possible, still being secure? If so, how?
Something like this:

Yes, there are ways to do this.
RSA-KEM
The sender

RSA-KEM select a uniform random integer x between 2 and n-1, where n is the RSA modulus with at least n>=2^2048.
Use HKDK to derive a 128, 192, or 256 it key k  k = KDF(x)
Encrypt the data with (c,tag) =AES-GCM_ENC(k, message)
Encrypt the $x$ with the receivers public key K = RSA_enc(pk,x)
Send (K,c,tag) pair to the receviver.

The receiver

Decrypt the x with k = RSA_DEC(priv,K)
Use HKDK to derive a 128, 192, or 256 it key k  k = KDF(x)
Decrypt the data with (message,tag) =AES-GCM_DEC(k, c)

If the tag doesn't match, stop!!!

Some notes:

The AES-GCM is an Authenticated Encryption with Associated Data (AEAD) that provides confidentiality, integrity, and authentication.
RSA-KEM is not a standard. If one ever wants to use RSA, this is the way.
Although the AES-128 is secure even after 20 years of research. you can use AES-256 with at most %40 speed penalty. This will also protect from the Quantum computers.
AES-GCM has many pitfalls for correctly use, using Chacha20-poly1305 is easier.
AES-GCM-SIV can be used for protection against nonce misuse.

NaCl
Use the existing libraries of the NaCl. This library has authenticated encryption with the public key; The Crypto-Box. Implemented for various languages.
ECIES
This is Elliptic Curve Integrated Encryption Scheme (ECIES). After the key exchange use AES-GCM-SIV or Chacha20-Poly1305.


Is a console application with NT Authority/System rights dangerous? A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in.

From that command prompt it is possible to execute arbitrary programs like Notepad, Internet Explorer and even Explorer to get a start menu.

With those local System rights, is it easy to acquire domain admin rights?

OS: Windows 7 SP1 x64

Update

This is how the "hack" was done. If you google for it, it seems quite well-known. To do it, you need admin rights, which were granted to our developer.

Take ownership of Utilman.exe
Replace Utilman.exe by a copy of cmd.exe
Restart the PC to get to login screen
Click on the accessibility icon

Why the hell do all the websites list "browse the web without logging in" as one of the use cases? None of the top 10 websites provides a way to fix this "security issue" (or whatever we should call this).

What kind of application is this, and how does it get executed before logging in?
Actually, scratch that, a better question would be: WHY is this application allowed to run.

Yes, it is very dangerous.
This allows arbitrary users to run any system command. The process account is known as LocalSystem, which is the only local account with more privileges than the Administrator.
This application can do a.n.y.t.h.i.n.g. Anything at all on this system: change the admin's password, install services, attach to memory of any process, anything anything. On this system.

Additionally, depending on configuration, the LocalSystem application could probably authentication to other machines in the domain as the machine's computer account. E.g. for registering changes in ActiveDirectory, etc.

However, one thing specifically you asked about - acquiring domain admin rights. This is not so simple (assuming the application is not running on the DC), since we are talking about local privileges.
So, while that machine is completely violated (as in, nuke it from orbit), the rest of your domain is (relatively) safe. (well, at least from this application).


Hardening a perimeter router What are some of the steps that could be taken to harden a perimeter (internet facing) router from attacks by potentially malicious users?

Basically you would need to prevent any packet from internet reaching switch CPU, except for the allowed hosts, so basically this can be done with policy, which works on the hardware level, before reaching the switch. Such policy would work the way, that you need to collect the public ip numbers of the switch, let's say 192.168.0.1/30 VLAN 10 connects you to the internet and 10.0.0.0/24 VLAN 20 is with servers, so this way you can apply the following policy. Best is to deny everything, and allow only specific hosts you need, than you will be seriously stable and secure.

This is simplified policy with one chain for ingress and egress:

# 192.168.0.2/30 - other router (VLAN10)
# 192.168.0.1/30 - your router  (VLAN10)
# 10.0.0.0/24    - servers      (VLAN20)
# 10.0.0.10/24   - you          (VLAN20)

#Allow Broadcast only on VLAN20, so you dont have malicious broadcast from other router
From Any To ff:ff:ff:ff:ff:ff VLAN 20 Permit

#Allow Multicast only on VLAN20, if you need it for VRRP you can add the rule for VLAN10
From Any To 224.0.0.0/4 VLAN 20 Permit

#Anti-spoofing rules for your servers
From 10.0.0.0/24 to 0.0.0.0/0 VLAN20 Permit
From 0.0.0.0/0 to 10.0.0.0/24 VLAN20 Permit

#Allow accessing (e.g. pinging the other router) for your admin
From 10.0.0.10/32 to 192.168.0.0/30 Permit
From 192.168.0.0/30 to 10.0.0.10/32 Permit

#Block any other VLAN to VLAN communication
From 10.0.0.0/8 to 10.0.0.0/8 Deny
From 192.168.0.0/16 to 192.168.0.0/16 Deny
From 10.0.0.0/8 to 192.168.0.0/16 Deny
From 192.168.0.0/16 to 10.0.0.0/8 Deny

#Allow internet for 10.0.0.0/24, this allows packets from and to internet go thru VLAN10
From 10.0.0.0/24 to 0.0.0.0/0 Permit
From 0.0.0.0/0 to 10.0.0.0/24 Permit

#Deny them all, this includes access to VLAN10
From 0.0.0.0/0 to 0.0.0.0/0 Deny

With this, others wont be able to tranceroute or ping your switch. But at the same time, you are way much better protected with potential denial of services, as your Switch OS is isolated. This is good in some scenarios.

Also, some switches do have hardware counters, so they allow only limited number of packets from specified host to reach the CPU. This way the rule could be to count ALL packets reaching from Internet (except your admin machine) and to limit them ALL (from any host) to e.g. 10 packets per second. This would be useful for ICMP, so you can still traceroute.

From Any to 192.168.0.1/32 Protocol ICMP Limit 10 packets / second
From Any to 192.168.0.1/32 Protocol ICMP Allow
From 192.168.0.1/32 to Any Protocol ICMP Allow


Getting an abnormal amount of firewall warnings on web server I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website).
All of them are trying to access a non-existent page on my website (/wp-admin.php).
My site is not on Wordpress, I run it by myself.
My firewall is easily blocking the requests, but I'm worried that it may escalate.
This looks extremely suspicious to me, so I have a few queries:

Does anyone know what https://aabbccdd.xss.ht is??? It seems like some sort of security testing service that gets abused a lot. A quick Google search brought up what looked to be Russian penetration testing sites, and something called cross-site scripting. Should I be worried about that?
What else should I do to prevent these attacks? My site is only really small, and doesn't get a huge number of visitors. I really don't want it to get to the point where my server crashes or something like that.

If you want your service to be accessible to the public, then you cannot prevent the public from interacting with your service. Because of the nature of the web, you cannot prevent someone from accessing arbitrary resources on your site, even if they don't exist. So, you can't prevent the attacks.
There are techniques to detect when someone is trying to access things that do not exist (like /wp-admin.php) or from certain sources (like aabbccdd.xss.ht) and to block that IP from further interaction. But that tends to be more trouble than it's worth, and it will never be complete.
The better approach is to make sure your site can survive these random probes of your site, detect when things go wrong, and be able to respond quickly and effectively when they do. Because you want to run this server by yourself, then all that fall to you. And that's why most people host their sites with a service that can do that for them.


What is the worst that can happen if your OAuth client secret is leaked? Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.)

Inside the app you have included the OAuth client secret (and client ID) as string constants.

An attacker extracts these from your app using reverse engineering techniques. What is the worst that the attacker can now do, knowing the OAuth client secret of your app?

Sometimes you have to share the OAuth client secret, which is the case for mobile apps. The real protection here is the whitelist of where the OAuth secrets can be used.  Despite the name "secret" sharing the OAuth client secret is generally not a problem for mobile apps - and is required to function.

The shared secret used in a 2-legged or 3-legged OAuth authentication flow might allow an attacker to initiate the SSO flow, and unwrap encrypted OAuth tokens.  This may or may not be a problem,  usually these tokens have a strict whitelist of where the SSO flow terminates, and the termination is the important part as this is where the access token is sent.  An attacker might be able to use another vulnerability, such as an open redirect to subvert the SSO flow which is an OAuth RFC violation in it's own right. The combination of these two issues would result in an account takeover chained-exploit.

Try and avoid sharing secrets, and make sure that other protections in place. Consider reading the OAuth security best practices IETF document for all of the ways OAuth can go wrong.


Public Key Authentication Is there another way to verify someones public key without a CA signing it?
A challenge-response authentication including some sort of UID of the smartphone?

Smartphone A generates asymmetric key pair
A sends public key K1 via internet to Smartphone B
B recieves a public key K2

How can B be sure that K2 = K1 ?

Without a CA, you need some type of other secure secret exchange.  It could be a side channel exchange of the thumbprint or use of some pre-existing shared secret.  Web of trust can also be used, though this is basically another form of side channel.

Using the UID as you suggest however, is likely insecure.  The UID of a phone isn't a secret and an attacker could obtain the UID and then impersonate the device.

Now, if you don't actually care about the identity of the phone, it could just submit an anonymous public key and you will know that it is the same phone in the future, but you will know nothing about the identity of that phone.  You don't need to involve the UID (and shouldn't) for that though.


SSO SP Initiated Single Sign Out - User Experience I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD.

Now non technical savvy users understandably presume that logging off from our software (the SP) would log them out. Because the SSO session still exists from the IDP it doesn't.

Their argument is that using a shared workstation and logging out leaves them exposed and without understanding that they need to sign out of their IDP on their workstation puts them at risk.

I'm of the understanding that this is a poor user experience due to the presumption logging out would log you out. Some SAML providers etc. facilitate a SP initiated single sign off from the IDP, but others don't.

Should I have a secondary "Log off from Idp" button that either triggers SP initiated log off or redirects to the IDP logout page to provide a better user experience? How would they know the difference and what this means?

Unsure what the best convention is around this that will help non tech savvy users as much as possible against leaving IDP accounts open on shared workstations. Or assist in explaining how SSO works as a SP.

Many companies use a SAML provider for their internal works and their customers, but often their customers only use that connection for a single SP and don't understand they are using a provider such as SAML. Our software facilitates for both internal staff users (who wouldn't want single sign off) and also external users in the same system who may or may not need the benefits of SSO.

I understand shared responsibility should mean the customers shared workstations should have sessions cleared after browser closure, but is there anything on our side that can assist here?

I'm a fan of giving the user the choice in simple words. For example when they click logout, if they are in an SSO session, you can give them a popup with two options:

Sign out of this app only (you can invalidate session tokens and at least make them go back to the IdP, but really this option doesn't do much).

Sign out of all connected apps (this calls the IdP logout URL).