Is the entire ciphertext needed for decryption with key? Lets say that you have they encryption key, but you don't have the entire cipher-text. You just have a part of it, say 60%.

Is there a way to possibly decrypt that part of the cipher-text? Does it depend on the specific algorithm or mode? Does it depend on the specific forms of data like text and not image form?

First, regarding the encryption algorithm, there are two general types of algorithms, blocks and chains. A block algorithm applies the key to each block of data (e.g. 256 bit blocks), while a chained algorithm uses the previous block to decode the current block, with the key serving as the first block in the chain. For the block algorithm, you can decrypt every block that you have access to. The chain algorithm, however, will not be able to go any further than the first missing block, so if the 60% of the data you have doesn't include the first block, it's not possible to decrypt any of the the data, even with the key.

Next, once you get whatever data you get back, what you can process depends on the file format. For a plain text file, you can read whatever parts you were able to decode. More complicated file formats may or may not be readable. For example, GIF will break as soon as you have a byte you can't decode correctly, while formats like JPEG and MP4 are generally recoverable except for the missing frames, and ZIP can usually recover files as long as the files and some critical data structures are present.

So, there's really three possible outcomes: you can't decrypt the data at all, you can decrypt the data but can't parse it at all, or you can decrypt the data and recover useful information. It really depends on the encryption's algorithm and the payload contained in the data.


How is it possible to bypass single-site restriction set by ISP? What's going on in this video?

https://www.youtube.com/watch?v=lXVqdezJf1A

Here, the ISP restricts access to all other sites but one (twitter.com) when the user's account balance is insufficient. In this video, an SSH connection is being used somehow to connect to restricted IP addresses through the ISP's proxy server.

How is all of this working? And what can be done to protect against such attacks / hacks?

Not sure where you are getting the part about the ISP from? That isn't shown in the video as far as I can see.

What is happening in the video is that the OP is creating an SSH-based VPN for their mobile device. They are then using that as a tunnel to connect to a remote service.

This would allow the OP to bypass specific site restrictions placed on the mobile service - for example, in countries that don't allow access to certain websites.

However, the traffic patterns are possible for the mobile operator to detect using smart pattern analysis and may well be against the terms and conditions of use.

So to prevent that kind of bypass, you need to implement a smart filter. For example Sophos UTM.


How do these techniques work for protecting against SYN flood? I'm reading about how SYN flood can be prevented. Wikipedia has

Filtering
Increasing Backlog
Reducing SYN-RECEIVED Timer
Recycling the Oldest Half-Open TCP
SYN Cache
SYN cookies
Hybrid Approaches
Firewalls and Proxies

What exactly is meant by "filtering"? Is that like an ipfilter of known hackers?

What exactly is 'increasing backlog'? Does that just mean making more resources available?

What's a SYN cache? How can a cache work in this context, isn't it legitimate for the same client may need to open another connections with the same server?

Maybe you should have added the line from Wikipedia preceding your list. There it states:

  There are a number of well-known countermeasures listed in RFC 4987 including:

Thus the recommended way to get details to the items of the list is to look into the mentioned RFC.

  What exactly is meant by "filtering"? Is that like an ipfilter of known hackers?

RFC 4987, 3.1 will tell you that this is about filtering incoming data based on the source address. So this is about either blacklisting known offenders or only allowing specific clients based on IP address (i.e. whitelist).

  What exactly is 'increasing backlog'? Does that just mean making more resources available?

Yes, it will increase the backlog, i.e. how many connections are accepted by the host but not are not yet accepted by the application. But the relevant part in RFC 4987 will also tell you that this method causes additional performance problems at least with the implementations at the time the RFC was written.

  What's a SYN cache? How can a cache work in this context, isn't it legitimate for the same client may need to open another connections with the same server?

Section 3.5 of the RFC will tell you that the concept is "best described by Lemon [Lem02]" but the section has also a good explanation of the concept itself. It essentially means that not the full state of a pending connection is stored at the server but only parts of it and thus it saves memory. It also replaces the socket based queue of incomplete connections with a system wide cache. I cannot see how it should cause problems with multiple connections from the same client.

See also What is the difference between SYN cookie, SYN cache, and SYN proxy?.


What does "Server Temp Key" mean in an openssl output? I am using openssl 1.0.1e-fips. When I ran the following against my server, I get a line in the output that begins with Server Temp Key:

$ openssl s_client -cipher DHE-RSA-AES128-SHA -connect myserver.com:443 -state -tls1 -msg
...snipped...
Server Temp Key: DH, 2048 bits
...snipped...

$ openssl s_client -cipher ECDHE-RSA-AES128-SHA -connect myserver.com:443 -state -tls1 -msg
...snipped...
Server Temp Key: ECDH, prime256v1, 256 bits
...snipped...

Can I conclude that ECDHE-RSA-AES128-SHA is "weaker" than DHE-RSA-AES128-SHA given that its length is smaller than 2014 bits ? Is the Server TEMP key the negotiated protocol key i.e. the session key.

The ephemeral (= temporary) key used for Diffie Hellman key exchange.

You should configure it to be as strong as the key for the certificate.

DHE with 2048 bits provides 112 "bits of security". ECDHE with 256 bits provides 128 "bits of security". So ECDHE over P-256 is more secure than 2048 bit DHE. There are also fewer bad implementations of ECDHE and TLS allows to negotiate its strength (the curve), which is why Google Chrome removed support for DHE so you should switch to ECDHE (i.e. make the server support and prefer ECDHE).


How does a crypter for bypassing antivirus detection work? I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?

In some circles, "crypter" and "packer" are synonymous to mean binaries or programs which are self-checking and/or self-modifying. Crypters may, more specifically, mean self-modification that includes encryption and/or code scrambling (see more below).

I suggest that you read Chris Eagle's The IDA Pro Book for an introductory understanding of packers and their disassembly of components and architecture.

Daniel Reynaud's work on packers and self-modifying code is also very fascinating. He makes some distinction between integrity checking, blind writes, code scrambling, and encryption of PE files in this blog post about visualizing packers and self-modifying programs. His crude system of checking for these various technique implementations in packers using dynamic binary instrumentation (not the best way of going about this, but it can be very fast compared to other methods) is available at https://code.google.com/archive/p/tartetatintools/


TLS library problem when connecting to Dovecot I have a Comodo PositiveSSL certificate issued for mail.btcontract.com and I've set up Postfix and Dovecot to work with it in the following way:

Postfix main.cf:

smtpd_tls_cert_file  = /etc/ssl/mail/mail_btcontract_com.crt
smtpd_tls_key_file   = /etc/ssl/mail/mail_btcontract_com.key
smtpd_tls_CAfile     = /etc/ssl/mail/AddTrustExternalCARoot.crt
smtp_tls_CAfile      = /etc/ssl/mail/AddTrustExternalCARoot.crt

dovecot.conf:

ssl_cert =< /etc/ssl/mail/mail_btcontract_com.pem
ssl_key  =< /etc/ssl/mail/mail_btcontract_com.key

I've generated pem out of crt following this tutorial: http://blog.wong42.com/2011/05/converting-a-ssl-certificate-from-crt-format-to-pem/

The problem is that when I try to connect to my server from a Thunderbird mail client I see the following errors:

At the same time in /var/log/mail.log I see this:

Nov 16 12:15:57 BTContractTest postfix/smtpd[22870]: connect from 51-28-134-95.pool.ukrtel.net[95.134.28.51]
Nov 16 12:15:58 BTContractTest postfix/smtpd[22870]: Anonymous TLS connection established from 51-28-134-95.pool.ukrtel.net[95.134.28.51]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Nov 16 12:15:58 BTContractTest postfix/smtpd[22870]: warning: TLS library problem: 22870:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1258:SSL alert number 48:
Nov 16 12:15:58 BTContractTest postfix/smtpd[22870]: lost connection after STARTTLS from 51-28-134-95.pool.ukrtel.net[95.134.28.51]

When I try openssl s_client -connect mail.btcontract.com:143 -starttls imap I first see this:

CONNECTED(00000003)
depth=0 OU = Domain Control Validated, OU = PositiveSSL, CN = mail.btcontract.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 OU = Domain Control Validated, OU = PositiveSSL, CN = mail.btcontract.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 OU = Domain Control Validated, OU = PositiveSSL, CN = mail.btcontract.com
verify error:num=21:unable to verify the first certificate
verify return:1

What is going on and what should I do fix all this?
Also, these are all the files I've got from certificate authority:

I don't use intermediate certs anywhere, could that be the source of problem?

UPDATE

Following Thomas Pornin's advice I did the following:

cat mail_btcontract_com.crt COMODORSAAddTrustCA.crt COMODORSADomainValidationSecureServerCA.crt > full.crt

and then in Postfix main.cf:

smtpd_tls_cert_file  = /etc/ssl/mail/full.crt
smtpd_tls_key_file   = /etc/ssl/mail/mail_btcontract_com.key
smtpd_tls_CAfile     = /etc/ssl/mail/AddTrustExternalCARoot.crt
smtp_tls_CAfile      = /etc/ssl/mail/AddTrustExternalCARoot.crt

dovecot.conf:

ssl_cert =< /etc/ssl/mail/full.crt

And now I'm getting a different error:

Nov 16 13:28:09 BTContractTest postfix/smtpd[23921]: warning: cannot get RSA private key from file /etc/ssl/mail/mail_btcontract_com.key: disabling TLS support
Nov 16 13:28:09 BTContractTest postfix/smtpd[23921]: warning: TLS library problem: 23921:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:330:

I've tried switching places of concatenated certificates and also tried to inclue root ca like this:

cat AddTrustExternalCARoot.crt mail_btcontract_com.crt COMODORSAAddTrustCA.crt COMODORSADomainValidationSecureServerCA.crt > full.crt

But no luck so far.

I had a very similar problem with Postfix and Dovecot on Ubuntu. I had purchased the basic SSL certificate from Comodo and because I selected "other" as the server type I ended up with a zip file with four certificate files in it, as per the above posts.

I wasn't getting security exceptions in the client. In my case I couldn't even get past the account setup and server detection in Thunderbird, despite selecting the correct ports in Thunderbird. In the server's system log I was getting SSL connection abort errors about unknown CA, much like mentioned above.

I fixed this successfully by using a text editor to concatenate all four certificates into one file, starting with my own cert at the top and then subsequently the two intermediate certs and finally the CA cert at the bottom. I then pointed the config of both Postfix and Dovecot to this combined file and Thunderbird was able to connect and I could send/receive email.


Is it safer to use less heard of software than popular software? Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for hackers to exploit? On the other hand if it's more popular it may have a larger community for support and if it's open source then it has more eyes and people fixing it.

To clarify I see 3 positions one can stand on this: it's better, it's worse, it depends on the specific situation/irrelevant.

For example I once heard using Opera web browser is safe because (in Turbo mode) it proxies traffic. I thought it may be better because it's less popular.

Another consideration is the popularity of the security software itself. It would be reasonable for a virus writer/hacker would aim to defeat the most popular security checks, for example a virus may be designed to avoid detection or knock out Avast but may not have bothered with Trend Micro.

Using obscure applications is, as my phrasing suggests, a form of security through obscurity. Such reasoning is false, and only leads to a false sense of security. Obscurity is not security.

Don't select your security-critical software based on how popular it is or isn't; select it based on the amount of analysis that has gone into the software, how quick the vendor is to patch security issues, and what provable security measures they offer.


a sent message for an unknown number without me sending it there is a message sent from my iPhone to an international number.
but i didn't send it and it doesn't appear in my message history.
is this possible?
how can it happen?

Yes, this is possible.
If your iPhone is not jail broken
There is probably nothing to worry about:
Apple send themselves a registration text to verify your iMessage registration (and says so in the text when activating iMessage).
The destination gateways receiving the texts are international, those for Europe are in Belgium, if I recall that correctly.
Just google the number and see if apple comes up as a result.
If your phone is jail broken
You might been "lucky" with some form of malware.
In that case, google on the number may still help and keeping an eye on the running processes and connections might be useful to find out more.


Openvas : Change in port list has unexpected results I have encountered strange results while changing only the port list for some targets.

If I use the wizard (immediate scan) to scan a couple of hosts, I get a report with some medium vulnerabilities. If I clone the target that was created by the wizard and just change the port list to scan all TCP and all UDP, I get a report with only "log level" vulnerabilities.

I may be doing something wrong but I can't figure out what.

Here are the details for the target used by the wizard:

Comment:    Automatically generated by wizard
Hosts:  example.com, example.io
Exclude Hosts:
Reverse Lookup Only:    No
Reverse Lookup Unify:   No
Maximum number of hosts:    2
Port List:  OpenVAS Default
Alive Test:     Scan Config Default
Credentials for authenticated checks:
SSH:
SMB:
ESXi:
SNMP:

Here is the target that I modified from a clone of the one above :

Comment:    Modified from automatically generated by wizard
Hosts:  example.com, example.io
Exclude Hosts:
Reverse Lookup Only:    No
Reverse Lookup Unify:   No
Maximum number of hosts:    2
Port List:  All TCP and UDP
Alive Test:     Scan Config Default
Credentials for authenticated checks:
SSH:
SMB:
ESXi:
SNMP:

Here is my All TCP and UDP port list :

Port List: All TCP and UDP
Comment:
Port count:     131070
TCP Port count:     65535
UDP Port count:     65535
Port Ranges (2)
Start   End     Protocol
1       65535   tcp
1       65535   udp

The score I get for the task created by the wizard is : 6.4 (Medium)

The score I get for the task ran on the cloned target is : 0.0 (Log)

What I am missing ?

AFAICT, I just changed the port list and should, at least, get a score as high as the ones I got with the wizard-created task

How can I create a task that would scan "à la" Wizard using all TCP and UDP ports instead of just the ones used by the Wizard ?

I am using OpenVAS9 in a docker container (mikesplain/openvas) and use GreenBone web-based interface and I had the very same problem on my local Ubuntu 16.04 LTS machine.

Depending on the target system the port scan of ALL UDP and ALL TCP will take too long to finish, the portscanner will timeout and thus information about the portscan got lost.

Try again with a different portlist with less UDP ports. This can be configured in the GSA when creating a new Target via Configuration -> Targets.

A good start could be either "All TCP and Nmap 5.51 top 1000 UDP" or "All TCP and Nmap 5.51 top 100 UDP".

Disclaimer: NVT Developer @ Greenbone


Logs for staging servers Is it required to have logs for staging servers for PCI DSS requirements where the real cards are not used in this environments.

PCI DSS aside, why would you not want logs on staging.

The logging on stage should be exactly the same as used in live.

Stage by definition should be a clone of live. Setting up logging properly is no trivial task. Using stage to develop the log management processes should be like any other part of development. Get it right there and you are not wasting time and potential errors in live.


Best practices for managing AWS EC2 Key Pairs Our organization uses Amazon Web Services (AWS), and we have multiple EC2 instances running in different subnets (VPCs) for different clients.  Our application is in development and we have need to remote (SSH or RDP) into these instances.

EC2 instances require a key-pair in order to gain access (SSH in the case of Linux, and administrator password in case of Windows RDP).  The private key is in the form of a physical file which can only be generated once and downloaded once.  Loss of this file equates to loss of the ability to connect to the instances.

Is there a widely accepted, industry-standard best practice for managing the private keys?

Currently I have a physical back-up (encrypted) on a portable hard drive, but that does not seem to me to be the best solution.  What methods are employed by large companies to ensure that they are able to survive a disaster?

Regarding the general managment of private/public keys, there are already other answered questions here on SE: What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts? and What's the common pragmatic strategy for managing key pairs?

Regarding AWS specific details: you can and should create your own key pairs outside of AWS and upload the public keys to Amazon. You can find the documentation for creating your own keys for both Linux and Windows systems in the Amazon EC2 documentation. Just make sure that you use the correct format for the key (the text you paste into the key upload form should start with ssh-rsa).

If you have added additional keys, you can select them when launching a new instance. You can also add them manually lateron (for Linux systems: add the public key to the ~/.ssh/authorized_keys file).

Edited: You should follow the advice given by @Jedi in the comments to your question:

  Private keys should be private to the user. Users should have their own keys and accounts both for personalization and auditability.

Not only for personalization and accountability, but also with regard to key revocation when somedody leaves the team / a key pair is compromised.


file transfer/sharing/hosting services: Are the antivirus natively incorporated? A few days ago, there were a few files that may have been plagued by a virus that I asked my colleague to send me through a file sharing service (here, WeTransfer).

The files were sent correctly and were without any viruses.

However, part of me wondered if those services like WeTransfer or Dropbox have anti-virus natively incorporated into their services.

If anyone tried to send files that contain viruses, will these files be blocked?

Nowadays a lot of file sharing services have natively incorporated antivirus that check if the files that are uploaded are virus files.

For example, Google Drive scans for viruses files smaller than 25 MB. For larger files, a warning is displayed saying that the file can't be scanned.

Dropbox so far doesn't have embedded virus scanning.

One Drive doesn't have antivirus protection too.

I work for Maytech, secure data transfer and storage company, we offer a secure file sharing service Quatrix, it has incorporated antivirus and all uploads are scanned for malware on the server side.


Is a company decrypting all SSL traffic through a Root CA GDPR compliant? I am wondering if a company employing EU citizens is allowed to decrypt SSL traffic of those citizens in a MITM style attack without even informing them what data is collected (without even notifying this software is being installed!).

People will often log into banking (maybe they need to transfer cash to their card for lunch) or online forums when searching for answers related to the work they do.

I find it impossible to believe this can be compliant given the strict nature of GDPR and how data that is collected needs to be minimized and collected with a specific purpose (not to mention the requirement to be informed).

The problem with the GDPR lies in the remark: "without even notifying this software is being installed". In that case: no it is not compliant.

If you dig a little deeper, you will find that in almost all cases there has been some form of communication about this, either in the contract or via the work council and publication to all employees.

In general, employees do not have the same liberties in the context of their work as they have in the free world. Some form of monitoring and/or command is allowed.

To be a bit more complete: of course, the grounds for the data processing in this case will not be consent. It may be 'necessary for the performance of the contract' (doubtful), but more likely 'necessary for compliance with a legal obligation' (in heavily regulated industries) or 'necessary for the purposes of the legitimate
interests'.

    In order to rely on [legitimate interest] as the legal ground for processing it is essential that specific mitigating measures are present to ensure a proper balance between the legitimate interest of the employer and the fundamental rights and freedoms of the employees. Such measures, depending on the form of monitoring, should include limitations on monitoring so as to guarantee that the employee’s privacy is not violated.

(last part is a quote from "Opinion 2/2017 on data processing at work", art 29 working group)

I work in a place where such a MITM-attack monitoring is deployed. I have not been directly involved in the implementation. But it was clear that:

some sites (e.g. banking sites, government sites etc.) needed to be white-listed, so no monitoring was done for these sites)
Contact with the work council, publication to all employees and making it part of contracts with contractors was necessary.
Not all employees will understand the implications of this monitoring.

If you want to have real fun in such an environment, exercise your art.13-15 rights. Make sure art. 15.3

    The controller
    shall provide a copy of the personal
    data undergoing
    processing.

is respected.


What security impact is caused by a TLS server continuing the handshake when presented with an invalid SNI? RFC 6066 defines Server Name Indication as an extension, whereby virtualised web servers may be given an SNI extension in order to know which certificate should be presented.

It has the following to say about cases where the indicated server name does not match a known name (emphasis mine):

  If the server understood the ClientHello extension but does not recognize the server name, the server SHOULD take one of two actions: either abort the handshake by sending a fatal-level unrecognized_name(112) alert or continue the handshake.  It is NOT RECOMMENDED to send a warning-level unrecognized_name(112) alert, because the client's behavior in response to warning-level alerts is unpredictable.  If there is a mismatch between the server name used by the client application and the server name of the credential chosen by the server, this mismatch will become apparent when the client application performs the server endpoint identification, at which point the client application will have to decide whether to proceed with the communication.  TLS implementations are encouraged to make information available to application callers about warning- level alerts that were received or sent during a TLS handshake.  Such information can be useful for diagnostic purposes.

What is the potential security impact of continuing the handshake when an invalid SNI is sent? I'm particularly thinking about cases where an entirely different domain is provided, or an incorrect subdomain. What is the compatibility rationale behind not rejecting such requests? My limited testing showed that sending "microsoft.com" in the SNI field to a TLS service on google.com didn't reject my content, whereas doing the same to a CloudFlare-enabled service caused the fatal alert.

There is no security impact to either stop or continue the handshake -- the security relies in the tests performed by the client, not the server. This is why the extension is called an indication. What matters is that the client duly verifies that the apparent server public key is really owned by the intended server. The SNI is a way for the client to convey to the server a hint about the process that the client will use for that verification: namely, the client will check that the server's certificate is valid, and that it identifies a specific server name.

Even if the server sees that the SNI matches its own certificate, the client still has to do all checks.

In case of SNI mismatch (the client sends a name for which the server has no matching certificate), keeping on with the handshake can be somewhat useful in order to send an explicit error message. The human user, on the client side, will have to "click through" the warning, and human users should really be trained not to do that, but if they do, then they may see a page sent by the server that will state exactly that ("This is not the Web site you are looking for"). With an SSL-level alert, all the user will see will be the generic "Could not connect, check your Internet connection" that is awfully uninformative.


Google Drive photo security and publicly visible lh*.googleusercontent.com I thought Google Drive was more secure than this.

If I upload a photo to Google Drive, I don't care that it's entrusted to them and I also assume someone working there can look at it. No big deal. However, for the rest of the world, I assume my photo is safe short of someone getting my password and logging into my account.

I opened my image while in the network tab inspecting traffic and I found that the image pulls from a secondary location:

https://lh3.googleusercontent.com/zXJGmFXf9unQUTbiHYijvzlD1itVOsfRSKnO2GHc64D1s7HbAUl_T16qfTPiH8vJvjhoKA=w1886-h513

This is an image shared with no one but myself on Google Drive. Anyone capable of inspecting network traffic can intercept that image by its googleusercontent address as it bypasses my login authority.

So, there's the public version of the private document hosted on googleusercontent.com, and there's the private version hosted on drive.google.com

Google Drive doesn't even seem like a reasonably secure option for my data, even though they claim "Your files are private unless you choose to share them."
source: Is Google Drive secure?

My files don't seem all that private from someone inspecting network traffic.

But, I must be missing something. What am I not understanding? I tried to find that address that exposes my image with Wireshark but got lost in details. How does a network snoop view the request generated to googleusercontent as I see it generated in my network tab in the browser when I open the 'private' photo in Google Drive?

Anyone capable of inspecting network traffic can intercept that image
  by its googleusercontent address as it bypasses my login authority.

Not quite.  As it's HTTPS, only someone who knows the private key in use (should only be you and google) are privy to the whole URL.  Now, it is vulnerable to things like browser history attacks (anyone looking at your history can know it since your browser doesn't do anything to obfuscate it) and a few other perils, but it isn't readily available to a casual bystander.

Thinking of guessing the URL? There are ~ 70 chars in the URL which yields 390 bits of entropy, guessing at it is definitely not practical unless you can find some weaknesses (i.e. if it's not truly random) otherwise in order to find even one actual picture would take over a billion years of attempts (assuming they have billions of images inhouse) and additionally finding a particular users' photos via guessing is completely impossible.

I could not recreate access to your URL (it gave a 404 error identical to using a guessed URL), I suspect that the image and/or thumbnail (whatever is created and put there) is in-memory or in some similarly short lived state, probably gone within an hour or less.


Site Executing control characters in title tag I am currently pentesting a site for a client of mine and I found a very strange 'bug'.

They have a search box on the home page which if I enter te\tst and hit search, it redirects to the search results page (not via ajax), and in the title it shows the keywords which I searched for, however, the control character actually gets executed.

So the title tag says this: "te    st | site name" <-- Executed the \t and created 4 spaces.

So my questions really are:

Could this be classed as a potential vulnerability?
Is there anyway that this can be exploited?

Thanks!

[Edit]

Just FYI, it does also execute other control-characters not just the tab. I just tried \r\n and it new-lined it.

Also, it only executes the control characters if they are encapsulated within other characters, so:

\r\n doesn't work
te\r\nst will return te[new line]st

Many vulnerabilities occur as a result of smaller non-exploitable bugs which cause different parts of the software make false assumptions about each other.

Returning user-input in a web applications response obviously suggests the possibility of cross-site scripting (XSS) attacks. These can be eliminated by proper input/output filtering/encoding.

Applying a transformation like parsing the control characters you mentioned can however make your payload slip through the applied protections, for example the following pseudocode:

transform(filter_xss($input))

can result in valid HTML/JS for the following input:

test\x3cscript\x3ealert(1)\x3c/script\x3etest

Multibyte characters can also be useful for exploitation.

Also it seems possible that the user input gets parsed by some kind of command shell that would make more dangerous attacks, namely command injection possible. Based on the operating system you can try different metacharacters to achieve remote code execution, these are some for *nix:

https://web.archive.org/web/20120810003039/https://www.cse.unsw.edu.au/help/doc/primer/node109.html


CSRF Security Independent From Front-End I'm trying to figure out if I completely understand CSRF security properly. Based on:
https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
In all scenarios it seems like your frontend has to have the CSRF token somewhere so that when a request is sent to the backend, it can compare both the csrf token in the cookie/session to the request.
That way when an attacker tries to create a request on behalf of a logged in user, since they don't have the token in the request, it won't be validated.
This means in order for CSRF implementation you need to configure both front and backend.
Now let's say I want all the CSRF security to be done on the backend is this possible, not changing frontend?
Also if my frontend application is separated from backend, do I still need to be worried about CSRF attacks?

Yes, one method of ensuring CSRF protection is to check the Origin and Referrer headers to see whether they match the expected origin, as these headers cannot be overwritten by any frontend code. However, the origin header is only sent on POST or CORS requests, and the browser implementations of these headers have historically not been consistent; e.g. possibly allowing JavaScript to spoof one or more of the headers (modern browsers should behave correctly, although I cannot speak for the future spec or implementation).
This protection only requires implementing a server-side check on every POST request. It is important to deny the request if the sent origin doesn't match, or if none was sent at all.
The OWASP CSRF Cheat Sheet includes some reasons for why you may not want to use this method exclusively. However, if you face none of those restrictions, I personally feel that this method is okay to use in lieu of a more complex method.
Also depending on browser support is the "SameSite: strict" cookie option. This prevents cookies from being sent at all from a 3rd party site, also mitigating CSRF.


Security of Microsoft OneDrive A friend asked about putting some of his data on Microsoft's OneDrive.

I did some research, and what I learned seems very surprising.

It appears that all the user data on MS OneDrive is store completely unencrypted (it is only temporarily encrypted during transfer).  The only "security" is trusting that whomever they hire to work at their datacenters, along with all of their subcontractors, are not looking at or copying any of the data (which would be trivially easy since it is unencrypted).

Is this an accurate understanding?

What's surprising is the number of people and businesses who apparently keep their data on OneDrive.  I'm guessing my understanding is incorrect, or most people are ignorant of how their data is stored.

It is not unusual for cloud providers to have a system in place where they can access their customer's data, because there are all sorts of useful things they can't do without looking at the data. They can't index it, they can't de-duplicate it, they can't compress it, they can't scan it for illegal content, and most important of all, they can't restore it to the user when they forget their password.

That last option is most likely enough on it's own to make encryption a bad security choice for a consumer cloud system.

Note also that there are plenty of security controls that Microsoft can implement to stop some random contractor poking through the data.

Lastly, since Microsoft wrote the client software for the service (and most likely wrote the operating system your friend is using!) then if they are malicious they've already won.

There are alternatives if your friend is still concerned. There are small, specialist cloud providers who do encrypt the data at rest and cannot see it. It is also quite possible to build your own private cloud system. However, both these approaches raise additional questions and issues of their own.

What I would recommend, and what I use myself, is to encrypt any sensitive data locally before uploading it to the cloud.


Why AWS distributes private key to address authentication problem? AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2.

AWS uses openssl tool

Key providers generally provide public key but not private key, because with keypairs, one can encrypt either with public key or private key and decrypt with other key, as shown below:

$ openssl genrsa -out mykey 2048

$ cp mykey privatekey

$ openssl rsa -in mykey -pubout -out publickey

$ rm mykey

$ # Encrypt with public key

$ echo "the cat sat on the mat" | open ssl rsautl -encrypt -pubin -inkey publickey > ciphertxt

$ # cat cipher.txt

$ # cat cipher.txt | openssl rsautl -decrypt -inkey privatekey

1)
Why AWS distributes private key instead of public key? for secure communication...

2)
Key pair is mainly to secure communication on the wire, but not authenticate user, to access a resource in AWS.

ssh -i something.pem user@ec2-public-dns-name

How does distribution of a key solve authentication problem? key can be stolen by any wrong person...Why AWS allow ssh login to EC2 without a password?

1) Why AWS distributes private key instead of public key? for secure communication...

Without the private key, you cannot prove you are the owner of the public key. Without proving you are the owner, you cannot use SSH Public Key Authentication.

So Amazon generates a key itself, and send you. If you don't trust Amazon, you can create another key, put the public key on authorized_keys and delete the former one.

  2) Key pair is mainly to secure communication on the wire, but not authenticate user, to access a resource in AWS.

Not quite. Key pair can surely be used for authentication too. If you sign some data with your private key, someone (or some system) can use your public key to see if you are indeed the one signing the data.

The oversimplification of SSH key authentication is something like this: the client sends the server the key he wants to use to authenticate. If the server have that key on its authorized_keys file, it will generate a random number, encrypt it with the public key, and send back. If the client really owns the corresponding private key, he can decrypt the file, concatenate with session key (left out for simplicity), hash the result and send to server. Server will have the random number, and the session key. If server hashes both and the result matches what the client sent, the client is the owner of the key and can login.

  How does distribution of a key solve authentication problem?

Easy. See above.

  Key can be stolen by any wrong person...Why AWS allow ssh login to EC2 without a password?

Because is several orders of magnitude harder to steal a key than to steal a password. If an attacker creates a phishing site to steal your Amazon password and you fall for it, your password is compromised.

If same attacker creates a phishing SSH server to steal your data, it will never steal your private key, as it is never transmitted. He cannot steal anything he doesn't already have (the random number and the session key), and the only borderline sensitive thing he can steal is your public key, and a public key is public anyway.

SSH with the key is the safest way. Passwords can be stolen or leak, but to steal a private key is way harder.


Verify a user's affiliation with an organization I'm in charge of IT at a students' organization. Let's call it FratA. FratA has ties to sister-organizations in other university cities in my country. Let's call those FratB through FratZ. These inter-organizational ties are formalized by an umbrella organization, of which FratA-FratZ are members. Let's call it SuperFrat.

SuperFrat is planning an event for all the student members of FratA-FratZ, and wants to sell tickets to the event using a web store provided by TicketSellingCorp.
However, the sale of tickets should be limited to members of the organizations FratA-FratZ.

TicketSellingCorp has approached me with an unusual inquiry:

We want users to type in their username and password to the FratA-website,
 so our web store can log in behind the scenes, scrape their personal/contact information
 from their normally protected profile page and use this information for ticket sales.
Don't worry about security, we won't store passwords, and our backups are encrypted.

The main problem is that once logged in, our members can not only access their own information, but also a lot of information about other people.
So if member Alice does not agree with TicketSellingCorp's proposed implementation, her information would still be exposed to TicketSellingCorp if Bob does agree.

I told TicketSellingCorp that I think this is a bad idea that conflicts our members' interests, and I offered them an openID provider (including an OSS sample client implementation) for the FratA-website; one that only tells the openID client that authentication was successful or not. It does not even share any information, such as an email address.
My motivation for that is that TicketSellingCorp can ask users for that themselves, so users are responsible for sharing their own information.

TicketSellingCorp's response to this was:

We cannot implement openID in our sales process.

Is there another way to cooperate with TicketSellingCorp that does not involve exposing all our members' personal information?

How about generating a special code for each user that can be entered on TicketSellingCorp's website? You can give TicketSellingCorp a list of valid codes. TicketSellingCorp can ask users for their name and other personal info when registering, and this could optionally be checked against your own database later.

The codes should be generated randomly to prevent people from guessing other people's code (impersonating them). 128 bits of randomness should be more than enough to make sure they can't be guessed. For example an easy way to get codes is to get 16 bytes of output from a secure pseudo-random number generator (/dev/urandom or in PHP openssl_random_pseudo_bytes), then convert it to hexadecimal and store it somewhere in the database.

If TicketSellingCorp is really set on logging in with the user's account, you could make the codes work as secondary passwords that only give out certain information. Also if they're so set on doing that, I'd trust them even less.


Risks of Using Google Native Client I was wondering if there were any possible risks in using Google Native Client.

I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your browser.

According to the diagram on the NACL site, the NACL code runs with the same privileges as the renderer which is a reduced privilege process.

If NACL fails, an attacker can take over the renderer, giving them access to resources in the same renderer process (set of frames that could be in the same domain after some set of document.domain sets).

"The Security Architecture of the Chromium Browser" by Barth, Jackson, Reis, et al. says

  Process Granularity. Roughly speaking, Chromium uses a separate instance of the rendering engine for each tab that displays content from the web, ...

It would take a double hull breach to get more privileges than the renderer process.

But the render process has significant authority.

Even though an attacker cannot be able to tamper with other tabs, they can probably tamper with websites in the current tab, including possibly simulating events to load other domains into the owned tab.  As long as a renderer can cause page transitions, owning any renderer allows you to craft credential (cookie) carrying requests to any domain.  This opens all the same holes as XSRF, but possibly with the ability to keylog if the user interacts with the resulting page.


What websites would I be allowed to DoS? I recently wrote an automated DoS script and was wondering 2 things:

Would I be allowed to use it on hackthissite.org?
Would I be able to make a Wix site and use it on that?

It might surprise you, but conducting an illegal activity is illegal.

To "hack" a website, you need the written authorization of the website owner and the website host (the owner of the material infrastructure).

When doing a DDoS (as mentioned in the first version of your question), you are abusing the common infrastructure known as "internet", thus you are not only harming your target, but its neighbors too. Just do not do it.

When doing a simpler DoS, you might still infringe on your contract with your internet provider. Of course, you still need the authorization from your target.

To directly address the two websites you mentioned:

The terms and conditions of hackthissite.org states "You must not use the Services in any way that causes, or may cause, damage to the Services or impairment of the availability or accessibility of the Services". So, you are expressly forbidden to DoS them.
You do not own Wix.com, event if you put your content on their website.


For PCI compliance, is a central Auth required for domain and non-domain security principles? We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI compliance our software needs to store those credentials in the same Active Directory that they use for our internal users. Their argument is that for PCI compliance you need a central authentication server for all authentication. Can someone please explain what they are referring to or share more light on the subject?

The most direct way to understand their claim would be to ask them to provide you with specific references to this requirement in the PCI Data Security Standard (DSS).  Otherwise we're taking shots in the dark to try to confirm or deny their statement.

I'm not aware of any requirement for having a single authentication system, let alone single server, in a DSS compliant environment.  I did review the requirement 7 & 8 sections of the DSS and confirmed those two in particular don't say anything about needing a single authentication system.  Requirement 7.2 does say "Establish an access control system(s) for systems components ...", but that doesn't support their argument even if you consider 'authentication systems' and 'access control systems' to be interchangeable.

Section 10 does talk about centralized logging, so that could be their reason for concern if their goal is for all user authentication to be logged in the AD.  But centralized logging doesn't require you to use a centralized authentication store either.  Your LDAP server could log the relevant security events to a central store if needed.

Finally, they may not be requesting consolidation due to any specific requirement in the DSS but instead their business requirement to keep the environment as simple and limited as possible.  Since each new server or component needs to meet compliance requirements they may not want to be responsible for yet another authentication system.  With your SaaS offering already in place that doesn't seem like reasonable restriction, but you'd have to negotiate with them to hopefully come to that conclusion.


Security risks on given session infrastructure I want to know if this is a suitable schema for session management. Once the user has authenticated with user/pass, the server returns session = MD5(SECRET + user_id) (along with other fields) where SECRET is a random string (say 256 bits).

Then the client just sends the received session hash with every request, and the server validates it by checking that MD5(SECRET + user_id) equals the received hash.

What are the potential risks here? I guess that if the user is able to send an empty user_id then she is a step closer to SECRET, but this is easily avoidable. Plus, SECRET could chage every week or so.

(Note: I'm using Node as the backend for a mobile app, so there's no browser and no cookies).

Length Extension Attack

What you have is basically a MAC to verify your user_id value. The problem is that a primitive MAC like MAC = md5(KEY | MESSAGE) is vulnerable to length extension attacks.

This means that an attacker with the user id 1 could for example impersonate a user with the id 10 by just appending a 0.

At a minimum, you would need to use a proper HMAC or use a non-vulnerable hash function such as sha3.

Token Expiration

If you store no state on the server, you have the problem of not being able to revoke a token.

So if a user for example changes their password because they suspect a compromise, an attacker that gained a token beforehand can still use it. You have no way of invalidating it, and need to wait until it expires naturally.

Solutions

What you seem to be looking for are client side sessions. You may want to consider using existing solutions such as JWT or some other existing library.

Further Problems

As @0x23212f said, your scheme obviously does not replace TLS and will not protect you from man in the middle attacks.

Aside from that, you should consider if you actually need client side sessions. If - as you suggested in the comments - the only reason is to avoid one database query, it's probably not worth the trouble implementing it, or the additional network overhead.


Error message when logging in with valid credentials while registration not complete I have a registration login process which includes a one-time activation link sent via email when the user registers. When the user clicks the link the account get's activated.
Now what error message should/can i show to the user when he tries to login with valid credentials but the account not yet activated via this one-time link? Can i show him an informative message the he needs to activate his account via the link from the mail? Or is this dangerous because it suggests that the credentials are valid?

Tell the user that the account is not active, he must click on the link received by email, or ask for a new link. I don't see anything wrong about informing him about the account status.
If an user is in possession of the login details of the account, it does not matter if he is the owner or not, he will be able to login after the account is active, so changing the message here does little to increase security.
On a side note, you should delete accounts that still are not activated after two or three days. If the account is not activated after that, probably the user entered the wrong email, or don't intend to finish the creation. It can lead to confusion if your user list leaks and president@us.gov is one of your users.


How do bits transefer over wire? i was tackling with networking and cannot seem to understand How bits are transferred over wires in the first place what counts for each of  0's & 1's

First of all I do not think this is belonging to Security SE Please read Security SE policy regarding questions. Its more of Physics. if I am correct!

I recommend you to read this article about Data Transimission require basic knowledge of physics
Simple way to find more about your question with no prior knowledge of physics is understanding Layer 1.

But however more regarding to your question. Date Transmit is just varying voltage levels in a circuit formed by the network cables.You will find that the details are fiendishly complicated and far too involved to reproduce here. Even the voltage levels used depend on whether it's 10MHz, 100MHz or GHz cabling. GHz uses five voltage levels and pulse amplitude modulation.

The simplest starting point is probably the Wikipedia article on Ethernet over twisted pair. If you want to know more about how the information is encoded look at the Cisco article on Ethernet.

Edit: As @munchkin mentioned not to forget about Endianness and I personally think it is such fundamental part to understand.

First, Endianness, is memory stores the binary data by oprganizing it 8-bit units(bytes) which we called Octec Not to confuse with Octal And how the bytes are ordered within momery:

But really to understand Endianness we need to know word

Wiki: In computing, word is a term for the natural unit of data used by a particular processor design. A word is a fixed-sized piece of data handled as a unit by the instruction set or the hardware of the processor. The number of bytes in a word (the word size, word width, or word length) is an important characteristic of any specific processor design or computer architecture.

Now, Assuming you know about Word, Memory, etc.

Big-Endian System:

**Most Significant Byte** of the word is stored in the *Smallest address given*
**Least Significant Byte** of the word is stored in the *largest address given*

Little-Endian System:

**Most Significant Byte** of the word is stored in the *Largest address given*
**Most Significant Byte** of the word is stored in the *Smallest address given*

And what are these fancy looking words is just terms that describe the order in which a sequence of bytes are stored in computer memory.

Big-Endian System: Most Significant Byte in Smallest = 1 2 3 *Read as One-Hundred-Twenty-Three
Little-Endian System: Most Significant Byte in Largest = 1 2 3 *THREE-Hundred-Twenty-One*

Now, its get bit closer and how that work: For demonstration I'll use this table:

         *-------------*                    *-------------*
         |  Register   |                    |  Register   |
         *-------------*                    *-------------*
*--------* ▼  ▼  ▼  ▼  *           *--------*--▼--▼--▼--▼-*
|Memnory |0A 0B 0C  0D |           |Memnory | 0A 0B 0C 0D |
*--------*-------------*           *--------*--*--*--*--*-*
|        |                         |        |
*--------*                         *--------*
|a|      |                         |a|      |
*-*------*                         *-*------*
|a+1|    |                         |a+1|    |
*---*----*                         *---*----*
|a+2|    |                         |a+2|    |
*---*----*                         *---*----*
|a+3|    |                         |a+3|    |
*---*----*Big-Endian System:       *---*----*Little-Endian System:
Most Significant Byte in Smallest  Most Significant Byte in Largest

Now, Notice the below Diagram

         *-------------*                    *-------------*
         |  Register   |                    |  Register   |
         *-------------*                    *-------------*
*--------* ▼  ▼  ▼  ▼  *           *--------*--▼--▼--▼--▼-*
|Memnory |0A 0B 0C  0D |           |Memnory | 0A 0B 0C 0D |
*--------*-------------*           *--------*--*--*--*--*-*
|        | ▼  ▼  ▼  ▼              |        |  ▼  ▼  ▼  ▼
*--------* |  |  |  |              *--------*  |  |  |  |
|a|    0A|<*  *  |  |              |a|    0 |<----------*
*-*------*    |  |  |              *-*------*  |  |  |
|a+1|  0B|<---*  |  |              |a+1|  0C|<-------*
*---*----*       |  |              *---*----*  |  |
|a+2|  0C|<------*  |              |a+2|  0B|<----*
*---*----*          |              *---*----*  |
|a+3|  0D|<---------*              |a+3|  0A|<-*
*---*----*Big-Endian System:       *---*----*Little-Endian System:
Most Significant Byte in Smallest  Most Significant Byte in Largest

Then, one might wonder how do we know if we are using Big/Little Endian ?

Now! Pay ATTENTION:

         *-------------*                    *-------------*
         |  Register   |                    |  Register   |
         *-------------*                    *-------------*
*--------* ▼  ▼  ▼  ▼  *           *--------*--▼--▼--▼--▼-*
|Memnory |01 02 03  04 |           |Memnory | 01 02 03  0 |
*--------*--*--*--*--*-*           *--------*--*--*--*--*-*
|        | ▼  ▼  ▼  ▼              |        |  ▼  ▼  ▼  ▼
*--------* |  |  |  |              *--------*  |  |  |  |
|a|    01|<*  *  |  |              |a|    04|<----------*
*-*------*    |  |  |              *-*------*  |  |  |
|a+1|  02|<---*  |  |              |a+1|  03|<-------*
*---*----*       |  |              *---*----*  |  |
|a+2|  03|<------*  |              |a+2|  02|<----*
*---*----*          |              *---*----*  |
|a+3|  04|<---------*              |a+3|  01|<-*
*---*----*Big-Endian               *---*----*Little-Endian

Here Processing code:

import "unsafe"
fun main() {
 var x unit32 = 0x01020304
 switch *(*byte)(unsafe.Pointer(&x)) {  //Get the address of &x & convert to pointer. (*byte)(unsafe.Pointer(&x)) convert to (*byte) type NOTE: *(*byte)(unsafe.Pointer(&x)) [Dereference][15].
 case 0x01:
   println("Big Endian")
 case 0x04:
   println("Little Endian")
  }
}

You can try this on your now to see.
My plan was for a brief approach to Endianness but oh well!


How to exploit a Use-After-Free vulnerability? I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.

There are programming languages like C or C++ where the program has to manually allocate and deallocate memory to store its data. After memory was deallocated, that memory can be reused to store other data. However, even after a C program has officially deallocated a block of memory, it can still read from it and write to it. If this happens it is practically always an unintended bug. In many cases the compiler and the operating system can detect when this happens and have the program crash, but it is not possible to catch every eventuality.

That means the program believes it is reading or writing one piece of data (which should actually be no longer relevant), but does this with some other, completely unrelated piece of data which was stored there in the meantime. This can, for example, result in data being overwritten with data provided by the attacker or result in confidential data being read and finding its way into the program's output.

Regarding how to exploit this: There is no universally applicable answer because the situations in which use-after-free's occur are heavily dependent on the application.


Prevention against Cryptolocker virus by requesting password for all installing apps in Windows 7 Is it possible to protect Windows like Linux?

I mean, I have Ubuntu installed on my laptop and when some program wants to install something etc. the pop up shows up and I need to type the password.

So, if I click on some file in my mail client in Windows and it looks like an image or rar file, but it is a Cryptolocker virus that wants to install the pop up will show up and I can at least be warned that some program wants to be installed.

Is something like in Linux possible in Windows, so when something wants to be installed a password would be needed.

Only in Linux or it could be done in Windows 7 too?

UAC is Window's way of handling this. If set to the appropriate level, a pop-up appears that requires the user to provide administrative permissions to install. If the user is not an Admin, it asks for the Admin password.

Just like Linux, Windows users should NOT be running as the local admin ....


How to prevent emails where sender has been spoofed? I have been at the receiving end of some classic spoofed emails where the sender sends an email looking like it has come from a senior executive of the company. Of course, these are always asking for some money or the other to be transferred.

Closer examination of the email headers reveals a spoofed "From" address field and also a spoofed "Reply-to" address field.

My question(s):

Is there any way to prevent this?
Is there any way to report this given that it comes from the great internets?
What security precautions (apart from please check emails carefully before replying) can I advise the finance and other teams?

Is there any way to prevent this?

Yes and no. You can't prevent email from being spoofed. But you can use electronically signed emails, and you can advise the IT staff to start using DKIM or similar, to prevent such emails from being accepted. After that:

a non-DKIM or non-signed email will be considered a forgery and rejected.
users will need to send emails through the organization's servers and/or sign them digitally with their private key.
users will need to only check the company email through the company server (no simply forwarding to convenient GMail accounts readable from the cell phone. You can still do that, of course; it just gets more complicated).

  Is there any way to report this given that it comes from the great internets?

Not really. You can try checking the headers and report them to the appropriate abuse office (i.e. that of the originating domain). Most such emails come from either zombied individual systems (maybe operating in groups - so-called bot nets) and/or domains and organizations that have been found to be either unresponsive or straight away friendly to forgers and spammers. There are actually lists of "promising pasture" networks circulating that allow abusers to find new victims.

  What security precautions (apart from please check emails carefully before replying) can I advise the finance and other teams?

Other people (the IT team) should implement what precautions can be taken, and the necessary infrastructure (for example, if lots of employees need to send emails while on the go, they might need to be equipped with VPN software so that they can securely use the organizational infrastructure even while on insecure grounds such as an Internet café somewhere). The other people should need do nothing except, as you suggested, carefully double check; and of course use properly whatever infrastructure they've been equipped with.

So, for example, if you do have a secure mail server, you need to go through the bother of actually firing up the VPN connection, authenticating, and sending the email, rather than just shooting an email from the hip from some unsecured hotel room WiFi.

That's particularly important for "weighty" individuals which, in my experience, often are tempted to consider themselves above the law, and will insist on having their emails read and immediately acted upon whatever the source, as they "haven't the time" of jumping through the various IT hoops (they are right up to a point: the security infrastructure must be as easy to use as possible, or it will be seen as a burden, will be routinely worked around, and thereby made useless).

One thing to carefully consider is how the various users connect now to the organizational infrastructure. In-house employees are obviously the easiest. But some OSes and cell phones, for example, cannot use certain security measures. So you either replace those devices, make do without those measures, or resign to some users being cut off from the network in certain circumstances.

In a pinch, you might need to set up some emergency procedure should the CEO ever find himself really stranded in Elbonia with no luggage, no documents, and need money to be sent over to catch a flight back home.


How can data execution prevention be implemented on websites and web applications to prevent privilege escalation? I have a basic understanding on what data execution and prevention is and how it works in Windows, but I saw an article online (which I cannot seem to find anymore) mention that it can also be used on web applications to prevent privilege escalation, but it didn't go into depth about it after that.

So what I want to know: Is it possible to enforce data execution prevention on web applications to prevent privilege escalation and if so how would it be implemented?

Techniques like DEP, NX, PaX, W^X etc only help against a specific type of attacks which uses buffer overflows or similar. Usually web applications are written in higher level languages which are not prone to this type of attack. The typical server side attacks against web applications are SQL injection, local and remote file inclusion, broken authentication etc and in none of these cases DEP will help.

But, these attacks where DEP does not help usually result only in non-privileged access to the server system. In order to get system privileges the attacker then uses local exploits which often work because of buffer overflows or similar. And in this case DEP or similar techniques can make it harder for the attacker to get system privileges. Which means that it is not DEP for the web applications itself which helps but DEP for the locally installed programs and for the kernel.

Of course there are also cases where the web application itself might profit from DEP. This is the case for applications written in lower level languages like C and C++. Such applications are often found in embedded devices (router etc).


How can we trust a CA? During the SSL/TLS handshake we are checking the authentication of the client and the server.

During this process certificate chain also comes into the picture to trust/complete the certificate chain.

The question is, Why we need to trust the CA ? what are the things justifies that we should trust that CA ?

Thanks in advance.

Why we need to trust the CA

We don't need to trust the CA but we could try to explicitly contact the owners of each website we visit to check if the certificate we get is the certificate they actually serve or if there is some man in the middle in between (which would result in a different certificate). Of course, you would need to have some protected way to contact the site owners so that a potential attacker could not just fake the reply of the site owner.

Of course, this does not scale well and that's why there is the Public Key Infrastructure (PKI) with trusted CA certificates as roots and certificates for the websites as leaves. For the exact process how this verification can be done by just using some trusted CA instead of trusting each sites certificate explicitly see SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?.

  what are the things justifies that we should trust that CA ?

These are basically the same things that make you run the operating system created by some company, the browser created by some other company, have your mail managed by yet another company, buy food without the fear that it will be poisonous, drive a care without fearing that it will fall apart while driving ... - you trust that somebody else did a proper job and also will not deliberately betray you. This is essentially the basis on how people live together.

Of course, not all of that trust is justified: The CA might have been compromised or might have been ordered by the government to issue certificates which can be used to hijack specific communications. The browser or operating system might have backdoors. The food might be poisoned. Somebody might have planted a bomb at the car. But that's the risk one is usually willing to take because it is small enough. Of course, depending on where you live it might actually be an unbearable risk so you might need to take additional measures to protect you and your communication.


How can an MD5-encrypted OpenPGP key be exported without entering the passphrase? I'm studying cryptography and I have a question about the GnuPG tool for Windows.

From what I understand a passphrase is used to hash with MD5 the private RSA key. But when I use the Kleopatra tool it let me export my private key without asking for the passphrase. What's happening?

Encrypted Private Keys in OpenPGP

Generally in OpenPGP and specifically also in GnuPG, private keys can be encrypted with a symmetric key derived from a passphrase. For deriving the symmetric key (session key), a string-to-key function is used. Usually the Iterated and Salted S2K is used:

  The salt is combined with the passphrase and the resulting value is hashed repeatedly.

The other methods include a simple hash and a salted hash. The hashing algorithm can also be chosen -- while MD5 is allowed, it shouldn't be used as it is considered weak. Also the symmetric encryption algorithm can be chosen, while the defaults depend on the implementation of OpenPGP you use.

You probably fetched up information for old versions of PGP, which only used plain MD5:

  Older versions of PGP just stored a cipher algorithm octet preceding
     the secret data or a zero to indicate that the secret data was
     unencrypted.  The MD5 hash function was always used to convert the
     passphrase to a key for the specified cipher algorithm.

Exporting Encrypted Private Keys without Entering the Passphrase

If Kleopatra is able to export the private key anyway, several reasons might exist:

it exports the encrypted copy of the private key,
the passphrase for the key is stored in gpg-agent or
the passphrase is stored somewhere else (which Kleopatra doesn't, but other graphic keyring managers do, like the GNOME keyring).


Anti-virus evasion testing: using VM with AVs to test payload detection Using a tool like veil or hyperion to evade an AV for pentesting, it's not advised to upload to virus total because it increases detection rate (and/or gets some special attentions). My understanding is that if you upload to Virus Total, there's a good chance your payload/ its signature could end up in AV databases.

That said, if you don't know what AV you're going to need to evade, is it appropriate to do the following:

buy a subscription to say, the x most popular AVs
install them in a VM
update so they have the most recent database
shut off any network connections (so it can't report back the payload)
Scan our payload

1) Would this prevent the payload from ending up in a an AV DB / getting detected?

2) Is there a better way of doing this? I know Virus Total allows you to check hashes but there must be other heuristics that AVs use.

3) If not, is there a VM or tool someone has made to do this?

Thank you.

After some research I believe I've come to an answer. I may need to clarify my question but in a nut shell what I'm looking to do is this: I'd like to be able to test my payload against as many anti-virus engines/databases as possible. Normally I'd do this with virus total, but I'm told that if you upload a sample it increases the likelihood that my payload will become detected. In other words, samples uploaded to VT get some "special attention" and thus most tools discourage users from uploading.

My solution is to scan my sample/payload with VMs containing various anti-virus softwares. In my search I found a tool that does just this. That is, it's an open source Virus Total which I as a user retain complete control over.

Meet Malice. Malice works by spinning up docker containers which contain various AVs. Most of them are free but you can also provide product keys for AVs that have paid subscriptions. This is exactly what I was looking for. I can now run a command like malice scan sketchy.exe and it will scan against the default AV engines. While not as complete as Virus total, this is definitely good enough. Really a cool project, I hope it continues to under go active development.

While this does answer my question, someone might know of a better solution so I'm going to wait at least a few days to accept my own answer.

As @atdre mentioned, there are many other such tools.
opswat.com/solutions/multi-scanning
irma.quarkslab.com/overview.html
github.com/PlagueScanner/PlagueScanner
github.com/joxeankoret/multiav
herdprotect.com


Why do so many spam emails lately contain a lot of unicode characters? I receive a lot of spam email (probably from recent breaches). A lot of them contain text that looks a lot like the below text:

Why do they contain such weird characters? Is this part of an exploit? Is this to mislead spam filters? Or is it for a different reason?

Usually those are UTF8 sequences that resemble other characters, without being them.

For example   is not the text "this string", and therefore does not trigger UCE detectors as spam, while you probably read it as "this string", as the sender intended.

On the other hand, it is weirdly encoded, so it can happen that it is decoded incorrectly. And " " becomes ����������� or other mojibake.


Can Apple Devices Give Away Location to Hackers? In a hypothetical scenario, I am travelling with my iPhone to, let's say, New Zealand. I stop at some random hotel and simply stay there doing nothing but staring at a wall for days with no interaction with my phone whatsoever.

Is it possible for hackers/organizations that are targeting me specifically to find my exact/relative location? Would it help if I turned off location services or used a VPN with a killswitch? How would the situation change if, instead of an iPhone that I used for a year, I travelled with a brand new iPhone, or with a Macbook?

Thanks in advance

Theoretically, yes they could track you, provided your phone was turned on.  There are actually several potential ways for them to do it, but they vary in terms of the level of sophistication (i.e. how technically advanced they are and the amount of money they have to spend).

For a more technically sophisticated attacker, the protocol which mobile phone use, Subsystem number 7 (SS7), has known vulnerabilities which could allow an attacker to locate you.

If they have access to your iCloud account, they could potentially use the device location feature to find your location.

If they have already compromised your phone/laptop, a VPN won't do you any good.  The attacker could potentially access your phone/machine, see what wifi networks are nearby, and use that to geolocate you.

Travelling with that new iPhone/macbook will only help if the attacker is not able to link you as an individual to those new devices.  How easy it is to link you to a device is going to depend on the sophistication of an attacker.


Has any virus attempted to compromise the anti-virus database? I was using an old version of Norton Anti Virus and the Live Update wouldn't run. The solution was to rename a file. This got me thinking if a virus could replace an anti-virus database with it's own bogus one and make it appear that the definitions are always up to date, would the anti-virus system be hooped? How could this be protected against?

Anti-virus software are only useful as a preventive measure.

When your computer is clean, they are able to detect and prevent any attempts by malware to execute on your system. They rely on their malware database to do this. New and undiscovered malware will not be detected in such a way.

If a malware manages to execute on your system, you simply cannot trust the system anymore. There is no way to ensure that the malware is successfully removed. There is just too many ways a piece of malware can hide itself. Your best bet would be to wipe the system and start over in such a situation.

To answer your question - yes it can be done, it has been done.

Prevention is always better than cure. Take the usual steps to protect yourself - don't execute untrusted files and so on.


Is it possible to change the admin user/password remotely on a router without logging in? Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?

Most routers use a HTTP Basic authentication scheme.
To access any page, including the change password, the credentials would need to be sent in header.
So, you dont need to "Log In", but you would need to send your credentials. Does that count?


Return-to-libc Attack mystery I'm studying the Return-to-libc Attack and I understand the concept. But one thing still does not make sense. In order to make the attack I need the memory address of system() and "/bin/sh", which is different on every system. And all the examples I have seen about the topic is about creating a dummy C code and debug it with gdb to find out these addresses on their host system.

Well how I can get these memory addresses on the target system if I have no shell access yet? All I have is maybe an EIP address that I found out by fuzzing and a non-executable stack which I cant run anything on it?

This depends a little bit on the mitigations employed by the host.  If you do not have ALSR on the target (rare on modern systems), and you know what OS they are running (e.g., Ubuntu 16.04), you can setup a system with the same versions and locate addresses that way.  If you look at many Metasploit exploits, they have a table of TARGET versions that you can specify, which usually results in the use of different target addresses.

On a more modern setup (using ASLR), you'll need to either:

Find a module loaded at a fixed address.  This used to be fairly common, but is getting rarer with more security awareness.
Find a way to leak some addresses so you can find where libc (or other useful libraries) are located, then add/subtract some offset to find the needed addresses for your attack.


Will a virus/malware travel between devices when logged into the same Google account If my laptop/desktop got infected with malware or some kind of a virus, will it be safe to log in the account on my laptop to my new PC or will it spread to it because I used the same account for new PC as I do now for my laptop?
Will anything happen? Is it safe or if I get infected, I shouldn`t use those accounts anywhere else?

If you have Google Drive set up to sync files, then the infected files might transfer over. But to get infected, those files would need to be run on the new machine.
Just having infected files does not mean that you are infected.


Is it possible to restrict email accounts within one computer? can emails(e.g gmail)can be configured to open-up only in my laptop ,my operating system is windows 8 and is it possible to restrict my gmail account to be opened up only in my computer?Usually we could check for unusual activity on the email but is it possible to
restrict within my computer?

Note : i dont know where to link up this question (superuser,web.se),since main focus is on security i post it over here

I'm afraid not. You might be able to solve your problem with something called "two factor authentication" though.

This is an option you can enable in Gmail where you will need to have your mobile phone with you whenever you log onto your mail. It is very easy to set up and highly recommended.

If this won't fix your issue, edit your question to add some detail about the specific worry you have, and we may be able to make a different suggestion.


Any Point To Paper Submission Of Forms Versus Electronic Submission I know we're not going to like this question because it has some obvious answers, but I am looking for a thorough breakdown, and I could not find another mention of this topic on this site. Paper Security is still Information Security. If this is a duplicate question, please point to the original and this one will be deleted:

For some pet peve, I still submit certain sensitive documents in paper through the mail. Obviously, this puts the information at risk of physical theft during transit and only circumevents the https portion of the journey. However, almost all systems that offer an electronic submission process will enevitably be scanned and input to the system. And then we must trust them to shred the original. Also, an electronic submission may go immeditelly to its final destination or it may need to traverse some sort of 'handling process', viewable by many, which may not be traversed by paper copies. Lastly, electronic submission could be vulnerable to local client-side attacks... sure we scan and practice safe habits, but can we ever be sure our systems are always completely clean?

I would like a definite answer: is there any security gained (or lost) by submitting a hardcopy instead of an electronic copy?

I'd say this all depends on how much you trust the end point and your carriers. For example, if you need to submit a payroll document to a HR manager at another site within your firm then that's a good example of sensitive information. You likely wouldn't want it being handed over to, say, a receptionist and then being passed in a chain to the HR manager.

If you send the document by paper then you can instruct your carrier to only hand over the envelope to the intended recipient him/herself, you can get their signature for confirmation of reciept, and you can use anti-tamper envelopes to demonstrate that no one has accessed the data in transit. Obviously if the recipient then leaves the document laying around then anyone can read it, so you'd need to trust them to keep your data secure. You shouldn't really be sending sensitive data to someone you don't trust anyway.

An electronic submission means that anyone with access to the recipients computer can likely access your data. I'm not sure about other workplaces, but at my work and in my places of study username/IDs and passwords are frequently shared among co-workers. If this is the case then it's entirely possible that anyone within that department (or anyone else that knows their ID and password) could easily read your data. It's also entirely possible that the government or your ISP or any other third party involved in your internet connection could intercept your communication and, unlike with an anti-tamper envelope, you'd likely have no way of telling if this has happened or not.

Really, which is more secure depends entirely on how much you trust your carriers, who you're sending data to and who is going to be involved in transmitting your data.


Security of Publicly exposed REST APIs We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple API Key based authentication.

I would like to get some inputs to understand what are the different precautions we should consider to host such APIs as provider.

Consumer have their interface exposed as browser based client (web page) & they would like to call the APIs directly from client side browser app (not from web server). I heard it is existing pattern & if data is not sensitive it can be supported. But I like to make sure that all possible precautions from security perspective has been taken.

Handing out some random string as API key is possible, but this does not allow you to enforce any fine-grained access policies.
If you want to prepare for more fine-grained access policies, then you might hand out a signed JSON Web Token (JWT).

From your customer's perspective, a JWT can be simply added to an HTTP header.


Any reason I shouldn't be salting and hashing before putting through bCrypt? I've been reading up on password storage and such, and have come to the conclusion that I need to be using bCrypt.
I've got an implementation working correctly, but I'm wondering the best way to move forward with my application.

The previous password storage system was simply hashing and salting. It's actually easier for me to keep this system and layer bCrypt over the top than it is to rewrite it with bCrypt alone.

However, I keep reading that combining different hashing algorithms is a bad idea - so I wanted to get some clarification, as I can't think of any reason not to implement in this way:

Hash(password + salt + pepper) * 1000 iterations - SHA-256
Resulting hash is run through bCrypt with its own salting and a defined work factor.
Final hash stored in DB along with original salt
To check password, it's rehashed as above before being put through the bScrypt hash check.

Is there any reason I shouldn't be doing things this way and should abandon the original password + salt + pepper in favour of just giving the plain password to bCrypt?

Thanks

There aren't any obvious security weaknesses with your schemes.  The original one (other than possibly not storing a version number with your hashes so you can upgrade your scheme to more rounds or a new pepper if necessary), or the new one layered with bcrypt.  Bcrypt can take 72 bytes of input so there's no problem using sha256 as your hash.

I would be careful if you encode the output of your keystrengthened sha256hash before feeding it to bcrypt.  In principle, its probably best to keep it in the binary form -- if you were using sha512, that would let all the bytes be used (as 72 bytes = 576 bits).  Granted with sha-256, it doesn't matter as long as you do it correctly.  A sha256 hash is 32 bytes long (in binary with non-printable letters), 44 bytes long after base64 encoding,  64 bytes long (in hexadecimal), but 88 bytes if you base64-encoded the hex-encoded hash (which would be partially truncated and slightly weaken security -- e.g., instead of 256-bits of inherent security you have 72/88*256 ~ 209 bits).

Note, if a user has an extremely high entropy password (e.g., 400-bits of entropy) that in principle would require ~2^400 time to crack, by using sha256 as an intermediate step it will only take time ~2^256 before its likely to find some password that works.  Granted 2^256 is completely secure these days (as is anything significantly over ~2^80, so this difference has no practical relevance).

It does get more complicated and potentially more annoying to maintain (granted you could argue this is a good thing -- if your database was ever leaked it would be harder for an attacker to get a GPU to brute force it).  If you ever upgrade your system and things don't work perfectly there are significantly more points where things could be going wrong.  If someone new developer comes along and see hashes are in the form like bcrypt, they may assume they are just bcrypt and change something that breaks the system.

An alternative would be to keep both systems in place and gracefully upgrade users to bcrypt on their next successful login.

def login(username, password):
    user = get_user(username)
    if user.uses_old_hash():
        calculated_old_hash = sha256_1000_round(password, salt=user.salt)
        if constant_time_string_compare(user.hash, calculated_old_hash):
            calculated_new_hash = bcrypt.hashpw(password, salt=bcrypt.gensalt(12))
            user.hash = calculated_new_hash
            print "Login Successful"
            return True
        else:
            print "Login Failed"
            return False
    else:
        hash = user.hash
        calculated_new_hash = bcrypt.hashpw(password, salt=hash)
        if constant_time_string_compare(hash, calculated_new_hash):
            print "Login Successful"
            return True
        else:
            print "Login Failed"
            return False


Use RSA Encryption With ASP.NET My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to the user (ie XXX-XX-1234). (A separate application running apart from the website will have access to the private key and decrypt the SSNs to transfer them to another system.)

I'm trying to use the built-in RSACryptoServiceProvider but I keep getting an error:

The system cannot find the file specified.

It runs to just fine on my own machine, because I'm an admin on my machine. But on the server (Windows 2008 R2 Standard), it errors out. The website is running as IIS APPPOOL\MyWebSiteName.

I saw on a tutorial that I would need to give IIS NTFS permission for C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA. The reason is that supposedly the RSA API writes temp files to that folder, even if you give it the keys in memory. But I've tried different combinations of users and permissions and nothing's worked.

I realize I could put the public/private key pair in a key container and use aspnet_regiis.exe to grant IIS access to the key, but that defeats the purpose of keeping the private key separate from the website. I'm also concerned that giving IIS access to this folder would also compromise the other system key containers stored there.

How do I get ASP.NET to work with RSACryptoServiceProvider? Or should I just use some other method to do RSA encryption?

I personally use Cryptosys PKI to do all of my RSA cryptography within my .net apps. I find it so much simpler than the built in methods - and for the main reason that it allows testing with my previous company's well established weak test keys.


Reference for Insecure password by email I have come across a site that on going through the password reset sends my old password to me via email.

Now we know this is insecure I see here this question and here and no doubt others.

However is there any well authoritative source saying that this is bad that I can quote to their customer services (ie quotes from here or a random blogger won't be official enough)

Ideally as I am in the UK is there anything under the data protection act or from the Information Commision that says this

well I'd have recommended plaintextoffenders but @razethestray has already done that :)

As to DPA, I'd say that the obvious place where this practice might not match up with its requirements is that principle 7 requires that

  Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Unfortunately the DPA doesn't provide any additional information about what appropriate means, which is (IMHO) a bit useless!

One other one is, if they're processing debit or credit cards they'd be in breach of PCI DSS requirements on storage and processing of passwords.


How to verify 2 hashed values with different salts originating from the same clear-text password? I have a project where I need to do an account merge across two websites.

Some percentage of users have accounts on both sites (same email address). Rather than just assume that two accounts with the same email address are the same identity, we'd like to go one step further and compare password hashes.

Both websites are on the same eCommerce platform, just 2 differently branded sites which we're consolidating into one. The hashing function is the same on both sites (SHA256) however we use different SALT's on each site.

For example:

SITE#1
password(1) = hello
salt(1) = abc123
hash(1) = 1a1A1a1A1a1A

SITE2
password(2) = hello
salt(2) = xyz456
hash(2) = 2b2B2b2B2b2B

Given just salt(1), hash(1), salt(2), hash(2), is it possible to verify that that password(1) and password(2) are the same? i.e I don't need to decrypt, just need to confirm that the two passwords are the same?

You can't. That's kinda the point of a salt.

If you could tell two passwords with different salts were the same, then attacks using pre-computed hashes would still be possible, and salts would be pretty useless.

You would need the original password to verify both salted hashes are derived from the same password.


How to implement iterations when hashing passwords? To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe?

In particular, from password-hash.js:

function generateHash(algorithm, salt, password, iterations) {
  iterations = iterations || 1;
  try {
    var hash = password;
    for(var i=0; i<iterations; ++i) {
      hash = crypto.createHmac(algorithm, salt).update(hash).digest('hex');
    }

    return algorithm + '$' + salt + '$' + iterations + '$' + hash;
  } catch (e) {
    throw new Error('Invalid message digest algorithm');
  }
}

Is this a safe way to hash the password? I can imagine that if you have an algorithm such as this that does:

HMAC(HMAC(HMAC(password)))

then there exists some faster function

HMAC3(password)

that gives the same output. Is this the case?

Yes, there are several requirements for an iterative hash function:

It should not be possible to do any precomputation, such as using rainbow tables.
The implementation should avoid running into cycles or fixed points in the hash function.
The implementation should be as fast as possible, because that is what the attacker would use.

Especially on the final point the example code is lacking. The crypto.createHmac(algorithm, salt) should really be outside of the loop. Because the attacker hashes many passwords with the same salt, he can even place the createHmac call outside of the password loop, e.g:

hmac = crypto.createHmac(algorithm, salt)
for (password in allpasswords) {
    var hash = password;
    for(var i=0; i<iterations; ++i) {
        hash = hmac.update(hash).digest('hex');
    }
    ...
}

This gives the attacker an advantage when cracking passwords, which would be avoided if the HMAC used the password instead of the salt as the key, as PBKDF2 does.

By implementing the given code in C and doing some optimizations, I managed to get it to be 10 times faster than the original NodeJS implementation. This means that an attacker can crack passwords 10 times faster than you intended, without even using a GPU or FPGA.

So there does exist a function that does a fast version of HMAC(HMAC(HMAC(password))), simply because HMAC does much the same work in every iteration.

I wrote a blog post about this.


Micrsoft Threat Modeling Tool 2016 make a bi-directional connect How do you make to two processes Bi-directional? I see that sometimes when I right click on the MS threat modeling tool that there is a bidirectional option but it is greyed out.

Select the two processes and right click Bi-directional.


What files should I download or check on a Windows system in case of Local File Inclusion (LFI)? I have a question about a Local File Inclusion (LFI) vulnerability on a Windows system. When it's possible to download any file from the operating system (OS), which file should I download first?

I'm currently only aware of this vulnerability and no have no further information about directory structure et cetera.

A few things came to my mind:

source code, potential information leaks about backends, configurations et cetera;
metabase.xml for IIS setups;
autoexec.bat in case there is anything juicy at startup.

To try to escalate, you could look for known versions of programs that are known to be vulnerable. You probably wouldn't need to download the whole thing, just enough to get the signature/version.

E.g. DLLs that would signal that an OS patch hasn't been applied. This would give you information you might want to launch another attack. (Or it would give you information that launching that attack would be useless and you should look elsewhere.)


A fake phone tech changed my start up password. I was duped into believing a phone caller was a computer tech. I allowed him remote access and when I refused to pay a fee at the end of all his changes he hung up. My start up now has an unknown password. Is there anything I can do?

You have fallen victim of scammers. Best thing to do is to format your PC and restore it from backup. Reseting the password is not enough as they might have installed several backdoors which could allow remote access.

If they have such access they could steal your credit card data the next time you make a purchase from your computer ( or any other payment data such as bank login).


HTTPS - ssl error bad cert domain When I try to visit some websites with HTTPS , I get the error that the
SSL is self-signed and that the SSL is only valid for another domain, and that SSL is actually invalid.
If the SSL is valid only for other domains(Error code: ssl_error_bad_cert_domain) what should I do? Stay to Http or go Https. Also can you explain my what is actually happening when I get that error.

Also when a certificate is only self-singed (Error code: sec_error_untrusted_issuer), I prefer HTTPS over HTTP, is what am I doing better?

The SSL server certificate is meant to convey the public key of the server. This is the method by which you can know that you are talking to the right server, not a fake one setup by some attacker intent on grabbing your password or credit card details. If you browser warns you about the certificate, then this guarantee has evaporated (like dew in the morning Sun, as the usual metaphor goes).

The sane reaction when faced with a certificate-based warning from the browser is to stop accessing the site altogether. Proceeding with HTTP or HTTPS on that site is at your own risks.

If you MUST really browse that site, then just consider it as unreliable and unprotected. You don't really know if you are using the genuine server, or a fake one. Don't send any sensitive information to that server. Don't consider that any information sent by that server is true.

(In that situation, HTTPS is still "better" than HTTP in the following sense: if the error is due not to an actual attack, but a thorough misconfiguration, then HTTPS will still do some SSL which will offer some protection against passive attackers, who spy on the line but don't try to interfere with data exchanges. This is not a big protection, because passive-only attackers are rare.)


Message Encryption vs Digital Signature for authentication I have this argument that I'd like to verify:

If ONLY Alice and Bob have the shared symmetric key, why cannot message encryption serve for authentication in practice instead of digital signature schemes? If an attacker can capture this message, he won't be able to do anything unless he knows the keys. Thus, message encryption seems a valid authentication mechanism to me which takes less computation than digital signature ( thus more efficient! ).

Yes, well-observed. In fact this is used in real-world crypto systems:

The Kerberos protocol that underpins all Windows authentication does almost exactly what you're suggesting (source: wikipedia.org/Kerberos_(protocol).

  Client Authentication

  The client sends a cleartext message of the user ID to the AS (Authentication Server) requesting services on behalf of the user. (Note: Neither the secret key nor the password is sent to the AS.) The AS generates the secret key by hashing the password of the user found at the database (e.g., Active Directory in Windows Server).
  The AS checks to see if the client is in its database. If it is, the AS sends back the following two messages to the client:

  Message A: Client/TGS Session Key encrypted using the secret key of the client/user.
  Message B: Ticket-Granting-Ticket (TGT, which includes the client ID, client network address, ticket validity period, and the client/TGS session key) encrypted using the secret key of the TGS.

  Once the client receives messages A and B, it attempts to decrypt message A with the secret key generated from the password entered by the user. If the user entered password does not match the password in the AS database, the client's secret key will be different and thus unable to decrypt message A. With a valid password and secret key the client decrypts message A to obtain the Client/TGS Session Key.

As you point out, this is as a valid authentication mechanism which takes less computation than digital signature, but it requires a pre-shared secret. This is a BIG BUT in a lot of situations.

For example, I want to create a new account at mybank.com, which I want to do over https. My browser has never been there before, so I don't have a pre-shared secret with the mybank.com server. Part of the https handshake is having the server authenticate itself to the client (prove that it is infact mybank.com, and not a man-in-the-middle), which is impossible to do using only symmetric crypto and no pre-shared secret.

It is for situations like this that Public-Key cryptography is king.