Where to find the exact specification for sha512 "values"? I am currently working my way into hashing with SHA512.

To my knowledge, the result of such hashing is often passed around as a string in this format

$6$salt$hashed-secret

And now I am simply wondering: within this string, what is the true nature of "salt" and "hashed-secret" --- are they "real" strings (as shown here for example, as output of the crypt tool); or is there a "rule" that says that those strings should always be base64 encoded.

You need to distinguish between SHA512 (a general-purpose hash function) and sha512crypt (a password hashing function based on SHA512). A string starting with $6$ is the output from sha512crypt. It's possible you knew this already, but the wording of your question leaves open the possibility that you didn't.

The specification for sha512crypt is here. It doesn't say much about the construction of the salt, only this:

  For the SHA-based methods the SALT string can be a simple string of
  which up to 16 characters are used.

At least one implementation (for python) says that the salt must be composed of alphanumerics, dot, and slash (the characters used in the original DES-based unix crypt). I think it would be wise to stick to those characters.

The hashed-secret is base64 encoded, not with the MIME base64 alphabet but with the unix crypt alphabet.

  The encoding used is as follows:

           111111111122222222223333333333444444444455555555556666
 0123456789012345678901234567890123456789012345678901234567890123
 ----------------------------------------------------------------
 ./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz


Where can I find a mentor/teacher in computer security? I really enjoy computers - especially security. That's why I went to a school profiled as technical/IT. However, they teach crap. They don't know anything after the release of windows xp/2003. When one of our teachers told us about the dangers involved with a ping of death I gave up on trying to learn stuff from there. I've been trying to find fun stuff to learn about since then and I'm really having problems finding people who know more than me - even though i know there are a lot of them out there. I don't want to be a script kiddie.

I want to learn security from the black-hat perspective. Not to take down NASA, but to learn the potential entrances. My view on security is simply that if i know how to bypass security, I also know how to stop me, and others. I will not do any attack anything over the internet, no matter what you tell me. When it comes to lab/playground, I have a few computers, and i have no problems running virtual environments. I do schoolwork before the "fun stuff" though, just to let you know.

I know basic c/c++. I also know c#, and how to use linux bash and windows scripts. I've been messing around with my computers over the past 12 years now and I'm past the knowledge of my dad aswell as everyone i know of around my hometown.

I'm from Sweden, so I also speak Swedish - if that would matter. English works great, though.

If i have missed anything of interest, please ask. I do not have any money to give and I'm not trying to find a babysitter or a slave owner. I am simply trying to find someone smarter and better than me, willing to teach.

(Also, mods - feel free to change anything. The tags for example.)

There is a global Infosec Mentors project.

From the website:

  Whether you are a seasoned veteran researching your millionth exploit, a network guru
  gone freelance consultant, or a CS grad looking for your big break, there's something for
  everyone in the mentorship program. As a mentor, we are looking for participants in
  the Information Security community with skills ranging from the highly technical to the
  richly experienced. For mentees, bring your passion and energy.


What is the easiest way to sandbox an application in a *NIX environment? I have a significant number of untrusted binary applications that need to be executed on a *nix box.

I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could easily be used to isolate a single application from being able to harm or access the rest of the system (I only need access to stdin/stdout).

I'd rather not use full-blown virtual machines, as the overhead resulting from running thousands of copies of an OS is considerably larger than I'd like to consider.

There is no secure, easy-to-use command line sandbox utility. Popular utilities such as Firejail can often be a cure worse than the disease, and many sandbox bypasses and privilege escalation vulnerabilities have been found (and continue to be found) in it. Sandboxing an application usually requires using mandatory access controls, such as the popular AppArmor or SELinux framework. This will generally involve customized security policies, tailored to the specific application.
I wrote a lot about Linux sandboxing in another answer.


Learning XSS: Why is my javascript ignored? <a href='mailto:'>*/</script>

I'm injecting into a guestbook setup where the XSS is injected by changing the email address. The email max length is short enough where I have to spread across multiple posts. When testing, I'm able to execute alert(1); but when I have to spread a more complicated expression over multiple lines, things break. What am I missing?

With the comments removed, your code looks like this:

<a href='mailto:'>*/</script>

This results in a syntax error, which prevents the code from running.  Particularly, the "" is problematic, triggering a SyntaxError for "Unexpected string."


Security pattern for third party uploads to Azure blob container Scenario:

Vendor 1 needs to upload data (.json, compressed .csv files, images and video) to an Azure blob storage container owned by Vendor 2
Vendor 1 is issued a limited duration SAS token each day to use
Azure does no scanning of incoming blobs (therefore content is untrusted when it lands)

Microsoft recommends pre-scanning all files before uploading

Questions:

What is a repeatable pattern for Vendor 2 to secure this type of content unpload against malware threats?

What is a repeatable pattern for Vendor 2 to secure this type of content upload against malware threats?

Assuming you are looking to secure blob from data not uploaded by you. You may use free online service to upload the file temporarily then use virus total like service and call an API to fetch uploaded files from URL and scan for examination by virus total, then parse results after which you may accept the upload of the files with same hashes.(Risk of loss of confidentiality shall be calculated based on how trust worthy those free services are)

OR you may want to have a dedicated server where you upload all the files first then examine them all with other trusted multiple solutions locally installed of your choice then uploading them all at once to blob.


What makes drive encryption safe? Let's build a scene: I'm working on my laptop in the library, and while I'm gone to the toilet for 5 minutes, someone disassembled my laptop and took the hard drive. I encrypted it with VeraCrypt, so I assume it's save. Now, I build some PC's in the past, and a simple step involved in that process is connecting the hard drive or SSD to the motherboard. I was wondering this: What's the exact thing that prevents the thief from connecting my HDD to his motherboard and seeing the contents of it in Windows Explorer? (Or any other way)

Disk encryption provides data-at-rest security. That is, the data is only secure if your computer is fully powered down (or the attacker can't or doesn't know how to perform attacks against a live system). In such a case, the reason drive encryption is safe is that only you know your password. This password is used to derive an encryption key. The drive contents can be downloaded, but they would appear to be gibberish to anyone who does not possess the correct key.


Securing hashes of short strings My understanding is that if I tell you that a given hash is the hash value of a single alpha-numeric character, then you can trivially identify what the source string is, by brute force checking the hashes.

However, if I tell you that the hash is based on a single a/n char again, but this time with a long unknown salt, then you're safe - you can no longer identify the char.

Now, suppose I give you a collection of 62 hashes and tell you that, collectively, those hashes represent the hashes of all 62 distinct a/n chars (a-z,A-Z,0-9) all hashed in the same way, with the same long unknown salt.

Is that secure?
Or would that information be sufficient to reverse engineer some or all of the data?

I think that yes, it's still safe, depending on how the "hashing" works.

You're not really talking about a salt value, since it is unknown. The scenario you describe fits a MAC better IMO. MACs require the input data (your single character) and a secret (your unknown "salt") and are designed to be safe despite the plaintext input data being known (since they are usually used to authenticate messages, where both the MAC and the plaintext message is known).

To be secure against attack, you can't just use a plain hash, such as

value = sha256(character || secret)

This wouldn't be safe. But if you use a primitive such as HMAC, it should be:

mac = hmac_sha256(character, secret)

Your requirements, if I understood correctly, are that it should be impossible for someone without the secret to determine, given

mac1 = hmac_sha256('0', secret)
mac2 = hmac_sha256('1', secret)
...
mac62 = hmac_sha256('z', secret)

which mac goes with which input character, and what the secret is.

MAC's guarantee that with a given input, such as '0', and mac1, there is no better attack on secret than brute-force, even if the secret is reused many times. So your secret is safe.

The question that remains is whether you can determine which input character belongs to mac1, mac2 etc if you are not in possession of the secret.

I think that's equally impossible, but I can't see how to prove the equivalence of that with the message integrity guarantees MACs make, so even though I don't think I am, I might be wrong.

I have some reasons for my beliefs:

Ideally, for hash functions, if you change a single bit in the message, that should influence all bits of the hash value. If I understand the way hmacs are calculated correctly, then that also goes for the secret, e.g. the secret influences every single bit in the mac output. So if there was a way to determine which mac belonged to which input without the secret, I think that would mean hmac is leaking information about the secret, and there should therefore exist a better than brute-force method to attack the secret.

But really you should ask a cryptographer, so crypto.stackexchange.com might be a better place to get a good answer.


Is it possible to design a system where the client doesn't have to trust the server? When you are using services like chat, file sending, exchanging etc., you always have to trust server providing these services. The only way to use services without having to trust third party is to not have third party (server) at all and to perform all actions directly (peer-to-peer).

The company providing services can actually encrypt client side so server wouldn't have access to client's data, but any software update can contain changes that would send decryption info along with encrypted data, so server has access to it.
Is it possible to make users sure that all their data is completely safe from server itself?

So the  main question is: Is it possible to keep user data safe without using complete decentralization (p2p)?

The problem you are describing is not solved yet completely. It largely condenses to Software auditability its distribution method, and protocol design.

Protocol design

You've already mentioned that the encryption needs to be done client-side. This is offered by lots of today's software already. Companies selling a client-side encryption protocol can't easily build their revenue model of selling the customer's data without this becoming public.

Software auditability

Even with a well designed protocol, it's possible the client doesn't follow it. In order to verify that the client does what the protocol says, the software needs to be audited by the public. This works most easily when the software is accessible in a format humans can undestand best: in source code. A verifiable software doesn't have to be open source, or at have its source code publicly available like truecrypt, but its a very strong point.

When the source code has been audited, the trusting trust problem arises: somebody needs to verify that the binary matches the source code. This can be solved by Deterministic builds, which is a new and currently very unstable method.
It has been used to ensure integrity for software considered important like the Tor Browser Bundle, or various Bitcoin clients. Debian has started an effort to make its whole application repository built deterministically (last link).

The amount of software that needs to be verified can be reduced by following a model similar to DRM: one part of the software is closed-source and not trusted, and another part doing the encryption is open source, and audited. End-to-End (repository, blog article) in combination with the gmail js client, or the addon published by Mega are a good examples for this.

Those approaches make it hard to hide that everybody's encryption is bypassed, but its still easy to hide that one's encryption is bypassed.

Distribution method

There are several ways to distribute software today. App stores like Google Play store or apt, the usual HTTP download, and, on the web, the HTTP/javascript solution.

The worst method is HTTP/js: every time you visit the page, you basically download the software a new time. The server can give you a malicious content, and the next time you visit the page all traces are deleted. The best way to secure a web page is the DRM-like method I've described above.

HTTP downloads also have lots of problems. You are trusting every download provider that they don't serve you malicious software. Android has an "untrusted sources" checkbox which is disabled by default to save you from installing such software. I'm also including PPAs into this, however I don't know of any malicious content served over PPAs. Better is you only trust one entity, through package repositories.

Even package repositories give you an entity you have to trust: the repo maintainer, be it google, debian, or someone else. The software may be auditable, and use a good protocol, but the particular version your maintainer gave you has a backdoor.

The problem is similar to the certificate distribution problem — ensuring that all people see the same — so similar solutions apply. I could think of a gossip protocol like the one outlined in the End-to-End wiki, or even more decentralized ones like Namecoin, however you can argue how decentralized Namecoin is, when hashing gets centralized.

To protect you from the usual bad guy, trusting a trustworthy repo maintainer is currently enough today, as most people still fall for the HTTP download trap, and they can make business there.


Imitation Gmail account created - what's the threat? My parents just received an email from Gmail:

  From: Gmail Team [mailto:mail-noreply@google.com]

  Sent: 14 September 2014 04:25 PM

  To: MyParents@gmail.com MyParents@gmail.com

  Subject: Your Gmail address, MyParents51@gmail.com, has been created

  Welcome to Gmail! You can login to your account at http://mail.google.com/.

  Here are a couple of tips to help you get started:

  Use Gmail's import tools to move mail and contacts from your other email accounts to your new Gmail address.
  Download the mobile app for Android or iPhone and iPad to stay connected on the go.
  Should you ever encounter problems with your account or forget your password we will contact you at this address.

  Enjoy!

  The Gmail Team

This looks like a bona fide email from Gmail in response to a new, duplicate email that looks just like my parents' email address - except for the "51" on the end.

Clearly someone is up to no good here - but what is the threat?  Has anyone seen this pattern before?

Some more background here: about a year ago my their Gmail account password was stolen and an attempt was made (thankfully thwarted) to get their bank manager to transfer all their funds into some unknown account.  I since got them to change their password to something more secure, though I admittedly did not exclude the possibility of a keylogger on their computer.  Could the two incidents be connected?

There are three possibilities that I see:

honest mistake. John Q. Samenameasyourparents set up an account, came up with your parents' name, was warned by Google and suggested "...51" as an alternative, blindly clicked "Yes, yes" without reading, re-entered your parents' account as backup address (never do that), and thus created an "orphan" account he will never be able to access.
the above is what someone wants you(r parents) to believe. The account is not orphan but is linked to another. By using it as a "backup" account or by mistakenly switching to your 'main' account, you may be giving unknown third parties access to some information. Of course this has a very low chance of happening (one in ten?), but a phisher might think that by creating one thousand such accounts, he may be gaining itself one hundred fat, unsuspecting marks. The attempt against your parents' account having come somewhat close to succeeding might have prompted someone to file them under "potential victims for a new scheme".
someone has attempted to create a fake account to pose as your parents. This can be used in connection to (b) above: should someone reply to that account, once set up, he would really get in contact with your parents. This would indicate that the unknown someone has also available a list of some of your parents' contact. I've seen a similar scheme in which several friends of mine (from a mailing list) would receive a heartbreaking email from lserni@gmailll.com in which "I", having been robbed in some faraway country and having no wallet, no documents and no cellphone (so don't call me to verify!), am now in dire need of a trusted friend to wire me some money c/o a money transfer parlor in Upper Nowherestan. The email was quite beautifully crafted too.

In all these cases I'd simply forward everything to Google. They can check what happened (i.e. were other accounts created? Did MaryAndJohn@gmail.com follow the unsuccessful creation of JohnAndMary@gmail.com? Were several similar accounts created from the same subnet in the same time interval?... and so on) and take appropriate measures.


openssl PSK cipher support openssl version on ubuntu machine is

$ openssl version
OpenSSL 1.0.2g  1 Mar 2016

Following is openssl PSK cipher list :-

$ openssl ciphers -v 'PSK'
PSK-AES256-CBC-SHA      SSLv3 Kx=PSK      Au=PSK  Enc=AES(256)  Mac=SHA1
PSK-AES128-CBC-SHA      SSLv3 Kx=PSK      Au=PSK  Enc=AES(128)  Mac=SHA1
PSK-RC4-SHA             SSLv3 Kx=PSK      Au=PSK  Enc=RC4(128)  Mac=SHA1
PSK-3DES-EDE-CBC-SHA    SSLv3 Kx=PSK      Au=PSK  Enc=3DES(168) Mac=SHA1

How I can get following cipher list support in openssl to test

PSK-AES128-CBC-SHA256
PSK-AES256-CBC-SHA384
PSK-AES128-GCM-SHA256
PSK-AES256-GCM-SHA384

DHE-PSK-AES128-CBC-SHA256
DHE-PSK-AES256-CBC-SHA384
DHE-PSK-AES128-GCM-SHA256
DHE-PSK-AES256-GCM-SHA384

ECDHE-PSK-AES128-CBC-SHA256
ECDHE-PSK-AES256-CBC-SHA384

RSA-PSK-AES128-GCM-SHA256
RSA-PSK-AES256-GCM-SHA384
RSA-PSK-AES128-CBC-SHA256
RSA-PSK-AES256-CBC-SHA384

How I can get following cipher list support in openssl to test

By using OpenSSL version 1.1.0 or higher:

$ openssl-1.1.0c ciphers -V 'PSK'
0x00,0xAB - DHE-PSK-AES256-GCM-SHA384 TLSv1.2 Kx=DHEPSK   Au=PSK  Enc=AESGCM(256) Mac=AEAD
0x00,0xA8 - PSK-AES128-GCM-SHA256   TLSv1.2 Kx=PSK      Au=PSK  Enc=AESGCM(128) Mac=AEAD
0x00,0xB7 - RSA-PSK-AES256-CBC-SHA384 TLSv1 Kx=RSAPSK   Au=RSA  Enc=AES(256)  Mac=SHA384
0xC0,0x38 - ECDHE-PSK-AES256-CBC-SHA384 TLSv1 Kx=ECDHEPSK Au=PSK  Enc=AES(256)  Mac=SHA384
...


Is there a way to calculate the complexity of an XSS-vector? Is there a way to calculate/estimate the complexity of an XSS vector?

I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood increases when the "XSS-vector complexity score" decreases and visa-versa.

For example, an very easy XSS-vector would be:

<script>alert(1);</script>`

A more complex XSS-vector would be2 :

<div style=overflow:-webkit-marquee onscroll=alert(1)>`

or 3

<script/%00%00v%00%00>alert(123)</script>`

1.  OWASP Risk Rating Methodology.

2.  Source: twitter.com, works only in Safari

3.  Source: twitter.com, IE XSS filter bypass

I'd suggest that trying to apply numeric values to abstract constructs like "risk", "impact" and "likelihood" isn't likely to be a great idea.

The problem is that each of these terms tends to be both subjective (what's likely to one person isn't likely to another) and extremely situational (the impact of XSS on one site will be likely different to another), so realistically there's very limited use in doing it (apart from to appease management who insist on quantification and ranking of things)

You can see loads of examples of these kinds of problems where people try to quantify vulnerabilities.  A good example with CVSS is this.

Having an open telnet port (an entirely unencrypted service) is CVSS 4 according to Rapid7 or perhaps 5.8 if you listen to Tenable , so obviously subjective as it's the same issue.  Then for added fun you can compare to having a self-signed certificate, which whilst not always ideal, is better than no encryption at all, but Tenable rate this as CVSS 6.4 , so higher severity than no encryption at all ! (Rapid7 has this one as 4)

Given that people can't even agree on consistent ratings for identical findings, I'd recommend against trying to rank things like XSS which have a much greater variety to them.


Posted images at company wifi network by accident. I used my personal IPhone Accidentally I sent my nude images through Grindr while  using the company wifi network. I sent these photos from my personal iPhone. Can they see these photos or only that I used the Grindr ? Should I worry ?

Assuming Grindr uses HTTPS (I'm not about to go confirm), you don't have to register your device with IT and your employer didn't force you to install anything on your phone before they let you use it on the network, then at most all they'll see is that a device made a DNS request for Grindr, connected to their server and transmitted some data (but not what specifically).

Again, depending on intrusiveness, they may not even be able to tell whose device it is. If they just said "here's the wifi password" and sent you on your way, then I wouldn't worry at all.

In my experience you likely aren't the only person in the company with it installed, so I wouldn't worry about being outed by that either. We've removed it from more than a few corporate phones.


What are the security implications of installing an iPhone configuration profile? What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > Profiles & Device Management.

Also, what are the security risks of trusting an "enterprise app", which is found in the same place in settings?

These configuration profiles can be used to install certificates on your phone. This let's the company then MITM your traffic and sniff all of your HTTPS connections. This comes down to whether you trust this company to see all your traffic and keep their private key safe so others can't pretend to be them.

As for "trusting" an app, installing any software you don't know about or inherently trust is probably a bad idea.


Sqlmap and multipart/form-data forms I'm working on some security for a website that is built in classic ASP and MS SQL 2000.

I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using Sqlmap with the following commands:

python sqlmap.py -u "URL TO FORM" --forms --level=5 --risk=3 --batch

python sqlmap.py -u "URL TO FORM" --forms --dbs --level=5 --risk=3 --batch

Now I'm trying to check another form that is using the multipart/form-data encoding type.

Sqlmap can't inject anything into this form but as it's using a different encoding type I don't know if it's because of the encoding type or because Sqlmap can't handle this form type?

The form does use concatenated queries so in my mind it should be unsecure but the Sqlmap result have thrown me a bit.

Does anyone know if I have to use a different command on this kind of form or can Sqlmap not be used here?

Just a quick update. This is the message I get from Sqlmap:

[WARNING] heuristic (basic) test shows that (custom) POST parameter 'MULTIPART #1*' might not be injectable

Then it continues to perform the tests until it starts over with:

[WARNING] heuristic (basic) test shows that (custom) POST parameter 'MULTIPART #2*' might not be injectable

Why don't you do it Manually ?? . It's Pretty Simple plus will give you better understanding what sort of Filtering is Present in the back end and what can be done to bypass it . Right now you are simply relying on tool to give you result .
If you are involved in pen testing the application , Beware , there still might be bugs . And if you are doing it for Fun , why not learn as well .

Use Burp or Tamper data see the request and reponse , play along with it and you will understand the application better .


Is there a way to be 100% sure that your computer is clean of viruses? If your computer has been hacked or infected, is there a way of cleaning your computer and have 100% sure that it's clean?

I heard that you can  safely clean your hard-drive with completely wiping tools, such as:Dban,but,today we have other types of virus like  bios virus

Technically it is impossible short of verifying every circuit path, bit of storage/memory and piece of data on your computer.

You have to practically start your trust some where. Computers are incredibly complex devices and there are simply too many possible attack vectors.

For the majority of attacks, formatting the hard drives and doing a clean install is sufficient, however there are demonstrated attacks that can compromise systems permanently or infect software you build yourself through hardware or compiler level exploits.

If you expect you are targeted, you're best bet is to source hardware from someplace you trust and be very careful what you install. If you just want to be safe from general threats, avoid questionable content, patch your system regularly and keep virus scanner up to date to minimize risk of an infection after you rebuild.


Is it ever safe to open a suspicious HTML file (e.g. email attachment)? If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file?

Clearly, HTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if any breaches could occur upon downloading the file and then opening it in Notepad / other basic text editor rather than a web browser?

Background

I'm only asking because the company I work for like to send out 'test' phishing emails from time to time, and the latest had an HTML attachment. I suspected the email immediately (so didn't click to open the attachment in a browser), but I was intrigued to see if it actually was another test!

So I suggested to colleagues that the file be opened with Notepad. We’re all savvy enough to read HTML, so would immediately spot the usual "If this wasn't just a test, your computer would be compromised!”, but they were extremely concerned that I had thought to interact with the file at all.

I'm reasonably confident that any malicious script in an html file would have to be opened in a web browser for it to have any effect.

Are my colleagues being too cautious, or was I being overzealous?

I'm an advocate of "better safe than sorry", so I don't think they were wrong not to open it; I just also don't believe it was completely unsafe to open with something like Notepad. I am very intrigued to find out!

"Gotchas" I'm aware of:

I believe editing it in a more complex website development tool (that actually renders the page in a preview) could be dangerous.

Also, I'm aware that simply double clicking the file (even if the default "open with" is set to be a text editor) could be dangerous. This is because something like readme.txt could actually be readme.txt.exe with file extensions hidden in something like Windows File Explorer.

Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for that editor (different editors are unlikely to have the same vulnerabilities unless the vulnerability resides in a library they have in common). An attack may be aimed at a popular editor and send out to as many people as possible, essentially turning it into a "spray-n-pray" attack.

Attack Surface

A very simple editor like Microsoft's Notepad has a smaller attack surface than a more advanced editor (like Visual Studio Code). More code generally means more potential vulnerabilities.

Mitigations

Certain mitigation techniques like Address Space Layout Randomization (ASLR), Data Execution Prevention and having an anti-virus with an "exploit blocker" (these are generally capable of recognizing basic overflow attacks, among others) may help to render certain attacks useless.

Software Updates

All of these techniques are of course no substitute to keeping your software (ALL your software I might add) up-to-date. Keeping your software updated is the best security strategy one can have. This is sometimes overlooked or trivialized due to its lack of feedback. An anti-virus yelling at you that "You are protected!" sends out a much stronger signal than a software update that silently patches vulnerabilities in the background. I tend to compare an anti-virus program with a person sticking their fingers in the holes of a dike to prevent the water coming through. It does its best to keep the flood out but chances are it's not going to have enough fingers to fill all the holes (or miss a few altogether). Software patches fixes those holes.

Bottom Line

You can never be sure you aren't going to have a bad day by opening any type of file in any type of program. However, some programs (like editors) are much harder to attack due to their small footprint or secure design and therefore are less likely to be targeted for mass attacks (especially because an attacker is likely to assume their evil .html file is going to be opened in a browser, not in an editor).


Restrict CA to issue certficates for one domain or to be able to sign just one server certificate I have a server and I want my iPhone to connect to it securely. However, I cannot just install the self-signed server certificate on my iPhone. When I install the profile (that's what they call the certificate), it says "Not verified".
Normally, you would go to CA Trust settings and enable full trust for the certificate. BUT I deliberately made the certificate with critical,CA:false constraint. That's the reason it does not show in the CA Trust settings.
Why did I do it -- I just need to install the single certificate and I don't want to totally compromise my iPhone security, if my CA credentials got stolen.
Do this have a solution? iOS probably requires a CA to trust a certificate, but I don't want a possibility to create certificates at all (beside the one), or at least for another domains.

One potential "solution" might be to create the CA, sign the server certificate and then delete the CA key, as it would not be needed and would live for a shorter time (lower chance to get stolen).
However, people except me wouldn't be stoked to install it. (I don't want to buy a certificate as its a home project and I don't even have a domain name, just the IP address.)
The certificate complies with apple's current requirements for server certificates. (https://support.apple.com/en-us/HT210176)

For this to work you need to use a CA and make it trusted. If you control and secure the CA key pair, you can be more confident that others won't sign certs with your CA.
Your idea of creating the CA then deleting (I would suggest shredding instead) would fit your purpose. If others need to trust the CA you created for the product to work on their devices, you can distribute the fingerprint in person for them to validate it.


TextSecure/WhisperPush instant messaging by Open Whisper Systems: End-to-end encrypted or not? Open Whisper Systems claims that its TextSecure messaging is end-to-end encrypted, but at the same time there are now some rather serious allegations of how it might be betraying its users.

If I understand it correctly, it seems they use a central server (or something similar) and therefore might store (and pass on if required by law) metadata about communications between its users (which of course is dependent on its own definition of "metadata", such as geolocation, which IMHO wouldn't be necessary for a simple messaging app to operate).

But then the Wikipedia entry also alleges that

  Whisper participated in a DOD project about suicide prevention by sharing aggregate mentions of certain words on military bases.

This suggests that they also have access to the message content, which seems to collide with Open Whisper System's "end-to-end" claim.

How trustworthy are these allegations? Has anyone checked the client/server code who can shed some light on this?

You're confusing two different companies and products:

WhisperText LLC which develops the Whisper App

They're the geolocating datasharing company that drew the criticism you linked.
Open Whisper Systems which develops TextSecure, RedPhone, Signal

These are various end to end encrypted products. I have seen no reason to distrust them.

But obviously even with end-to-end encryption, the server learns some metadata. It can promise not to retain it, but that's unverifiable. Some metadata could be avoided by routing through Tor, but that comes with its own share of issues.


Facebook Login for Intranet How safe is Facebook Login? I'm currently building an intranet, for my small company. We're 10 employees, and no risk of them messing up from inside.

But is using Facebook Login safe for this? How much info does Facebook get? The pages after login will show stuff like Economy, and future plans. Our key elements of the company.

There's no right or wrong answer to this, it all depends on what information you have to protect. If you are storing people's personal information or sensitive intellectual property on your intranet then using facebook logins are a bad idea because FB has no interest in security. FB does not enforce strong passwords. They allow very simple passwords and people are never required to change them. FB is written to make it easy for people to use so FB can profit from selling people's identities, they have no motivation to make it secure.

Ask yourself if you would rather have your salary details, address, ssn, employment history, plus the sum total of all the effort your company has ever produced to be protected by passwords that are likely to be your boss' birth date or kids name on a system that's ripe with identity theft. Or would you rather it be protected by a username/password scheme that enforces some level of complexity and the occasional change? hmmm, let me think....

In other words, if you have absolutely nothing to protect and don't care losing your job due to gross negligence then go for it!


Requesting a CVE for unpublished vulnerability in open-source project? MITRE reorganized their assignment policy last year. They introduced a list of covered products and excluded other products from CVEs.

This year, they again opened up CVEs to all existing software, except open source software not in a list of covered products. Those are delegated to the DWF. But they also say that they are the CNA for "any other products not list on this page".

The DWF says that they only cover issues that are already public. This means that one would first have to disclose an issue without CVE before requesting a CVE, which seems to be going against the purpose of CVEs. I would assume that the purpose of the DWF is mainly to cover issues for which the researcher for some reason did not want to request a CVE themselves? And can it be assumed that the process of assigning CVEs to issues which are send to mailing lists (what MITRE called "Partial Coverage Sources") is discontinued with the establishment of the DWF (so there is no danger of double-assignment)?

Should I request a CVE via MITRE for issues in open-source software which are not yet public and not in the list of covered products, or should I publish them and afterwards request a CVE via DWF?

My suggestion is to make sure the issue is fixed in the project, post it to Full Disclosure and then use that post to request the CVE.


Minimum number of bits to prevent hash collisions? There are a number of hashing functions in wide spread use now. Seems the general range of bits is from 128 (MD5) to 512 (SHA-2).

To prevent different types of hash collisions, what are the recommended & minimum number of bits?

Collisions:

Identifiers (PGP keys, bitcoin addresses, etc...)
Files (integrity checks)
HMAC (transmission integrity)
?

Any unbroken n-bit cryptographic hash function has a collision resistance of 2n/2. This means that, if you want to have a 2128 collision resistance, you need to use, at minimum, a 256-bit hash function. As 264 operations are achievable, you would not want to use a 128-bit hash. A 160-bit hash (that is, a 280 security level) is borderline. Using a 256-bit hash will give you a 2128 security level, which should be completely fine for the foreseeable future. Sometimes, weaknesses in the hash function itself result in it being easier to break than the output digest would suggest. The SHA-2 family of hashes is one example that is currently unbroken. SHA-1 on the other hand is broken. It has a 160-bit output but "only" a 263 security level against collisions, rather than 280.

I suspect you may be mixing up collision attacks with other types of attacks. A collision attack will not allow an attacker to find input that hashes to an arbitrary value. The formal definitions:

Preimage attack - Given h where f(m) = h, find any m' such that f(m') = h.

"Find input that hashes to an arbitrary value."
2nd preimage attack - Given f(m) = h, find any m' such that m ≠ m' and f(m') = h.

"Modify an input without changing the resulting hash."
Collision attack - Find any pair of m and m' such that m ≠ m' and f(m) = f(m').

"Find any two inputs that have the same hash."

Each attack has different implications. A collision attack is problematic for certificates, as they can be used in signatures that are valid for both benign and malicious versions of the same software. A preimage attack is problematic for verification. Imagine if an attacker could modify an executable without changing its hash. Clearly, a preimage attack is far more severe than a collision attack, but it is also thankfully far more difficult to pull off. The infamously insecure MD4 algorithm, for example, is so bad at collision resistance that it is cheaper to find a collision than it is to run the hash function itself twice. However, as broken as it is, preimage attacks against it are highly theoretical.

If, on the other hand, you simply want to check for accidental corruption and are not intending to protect against an active attacker, then a CRC with a properly-selected polynomial would be ideal. A CRC can actually guarantee error detection up to a point.


Mac OS: keylogger vulnerability & FileVault 2 I'm configuring my mac and  encrypting my disks with FileVault 2. As the boot disk is encrypted at startup I have to login via the EFI partition before the OS will boot.

From my understanding, most people who have investigated FV2 think it's a pretty decent FDE solution. However it appears to be vulnerable to keyloggers.

As my login is linked to the encryption keys, access to my login credentials will give access to my disks. As mac doesn't (easily/readily) support two-factor login, then an attack against my password will suffice, correct? Should I fall victim to malware with a keylogger, the entire security of my mac is compromised.

The question then, is this a valid attack vector and anything to be concerned about? Are keyloggers a real threat? I've read that there are no reported cases of keylogger malware for mac, but I'm unsure how old or valid those reports are now.

If it's valid - is there any recommended safeguards?

Key loggers exist and they are in fact a real threat.

Encrypting a disk is not so much about making sure your disk isn't vulnerable to trojans and malware that works across a network. Rather, its about ensuring that if your laptop falls into nefarious hands that the attacker cannot read your computers data using a live disk or some other means to bypass any sort of login all together.

However, it is possible your attacker could key log your computer before hand then get his hands on it and crack it like that.


Is conveying patient MRN in a web service URL a HIPAA PHI violation? I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me uneasy. I was thinking about just being "RESTfulesque" and relying exclusively on POSTS so that the MRN could be included within the body of the request.

For example
Instead of

GET | http://OrganizationName.org/ServerName/.../REST/XML/MedicalHistory?PatientID={PatientID}&PatientIDType={PatientIDType}&UserID={UserID}&UserIDType={UserIDType}/

I would use

POST | http://OrganizationName.org/ServerName/GET/MedicalHistory
POST |                            /ServerName/PUT/MedicalHistory

PatientID, Type and UserID and Type would be request header properties.

It seems like most EMR vendors will use traditional REST verbs and expose IDs in the URL but this feels wrong. Am I being overly paranoid with my design? I want my services to be very developer friendly, so I don't want to break with REST design principles unless its necessary.

Am I risking a HIPAA violation by exposing patient MRNs within a request URL?

It depends on a number of factors.

Because the Medical Record Number (MRN) is Protected Healthcare Information (PHI), you are responsible for its Confidentiality, Integrity, and Availability and are responsible to identify and protect against reasonably anticipated threats to its security (and integrity)  AND against reasonably anticipated impermissible uses or disclosures. HIPAA Security Rule

Although HTTPS will protect the parameters against interception, log entries for the GET requests will show the unencrypted full URL on both the client and server. These create at least reasonably anticipated disclosures (such as to unauthorized employees), and also need controls.

What sort of access controls are there between the client machines and the server?  Can any machine connect if it provides a user ID and password indicating an authorized user?  Or only certain machines in combination with certain users?  Would anyone on the server side have access to the log files that shouldn't have access to the patient data?  (for example, are patient records in an encrypted data base yet any technician would be liable to stumble across the logs)  Are the client log files encrypted and/or has browser history been disabled on all browsers?


Who can see an unencrypted email sent to Gmail? I mostly understand the relationship between two servers transmitting unencrypted email, and how those emails can be read by a third party. What I am getting confused about though, is in relation to a HTTPS web client like Gmail. In the following scenario, at what point could a third party be able to read the email?

Bank sends unencrypted email to Gmail account

As Gmail is HTTPS, would the only vulnerability be between the bank's server and the Gmail server?

The basic answer is SMTP.

HTTPS is only a consideration on the 'last mile', if you will - between the end user and the mail client (in this case).
In the case of IMAPS or POP3S, the same would be true - that encryption protects the communication between the mail client and the IMAP or POP3 server.

In order for these to 'see' the mail, it first needs to be sent between hosts via SMTP.

When your bank sends an unencrypted email to your Gmail address, anyone able to see traffic on the network between your bank's email server and their next relay/hop in the mail path can see the full contents (i.e. Google's server).

There is a long list of who that could be.

It could include local staff at the bank, third parties providing e.g. security monitoring to the bank's network, and so on. The same would be true of all network providers between the bank and Google, and the same would be true of anyone at Google able to sniff the relevant traffic.

Basically, if you run a traceroute from you to google's server, everyone on that can see your email.

Plus any state-level actor, it seems, with a passing interest.

The 'last-mile' between you and your inbox, though, should be safe(r) if properly encrypted (and assuming your machine isn't compromised).


How does DoH protect against ISP tracking? Seems like a modern ISP would already be equipped with some basic level of packet inspection to identify outgoing TCP connections even if just for doing traffic shaping or carrier-grade NAT, and maintaining a reverse lookup does not sound prohibitively expensive.

Normally DNS traffic is in clear and can easily be sniffed by the ISP (just sniff port 53), making it possible to create user profiles. And not only could the traffic be sniffed but it could also be redirect to the ISP's DNS server in order to give a different answer. This is a typical way to block domains at the ISP level.

DoH uses HTTPS for transport and this way gets the protection of HTTPS against sniffing and traffic modification. Sure the DoH server itself now has all the information and can also provide a different answer, i.e. the ability for profiling and domain blocking did not vanish but it moved to another party. Ideally this party would be more trusted than the ISP though.

  ... maintaining a reverse lookup does not sound prohibitively expensive.

A reverse lookup is of not much use today since often many domains are hosted by the same server (and thus IP) or since they are served by a CDN where even more domains have the same IP address. So there is often only a weak association between the IP address and the domain. A deeper traffic analysis might reveal the hostname from the Host header in case of plain HTTP and from the TLS handshake (server_name extension of ClientHello) in case of HTTPS. But plain HTTP gets less and less used and for HTTPS they are working on hiding the name in the TLS handshake too with Encrypted SNI.

In summary DoH does not solve all privacy problems caused by the ISP. But it is another step to make it harder and more expensive to create user profiles in the hope that the value of the remaining profiling for the ISP is less than the investments needed for the profiling.


I clicked a link in an email message. What should I do now? I got a message that looked like an ad from Microsoft. At the end, there was a message saying "You can simply WIPE Out your email from Mailing List  click here". I clicked. I got to a page this webpage:  http://gokk.tezharimirch.com/  which is obviously not from Microsoft. The page just showed an "404" message - I did not fill any form or do anything else.

What should I do now to protect my computer?

That sub-domain is still working/alive so there's a chance it would of still have deployed something then 404'ed.

Currently, a scan performed on that sub-domain shows it is clean, so it most likely did contain something bad at a point but was then removed. You can do URL scans with online tools like virustotal.com .

Just to be on the safe side, you should just scan your system for anything dangerous with anti-malware/anti-spyware tools.


How to store passwords in a text file in USB securely? I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget 1 or more of them).

If I create a text file, store the passwords in that text file, move that text file to a usb stick, and encrypt the usb stick with EncFS.

If the usb stick gets stolen, how secure is the usb stick?
If the method above can be secured further, how would I do that?

I'm guessing no solution exists at the moment to prevent brute force attacks from future possible quantum computers.  If no, I am looking for the next best solution.

Actually quantum computers are not that much a threat for symmetric encryption. To put it in simple (and somewhat simplistic) terms:

A quantum computer, if it ever exists, will totally break the most used asymmetric encryption and key exchange algorithms (RSA, ElGamal, Diffie-Hellman...) but not all asymmetric algorithms (QC does not break the concept of asymmetric encryption, only some of its incarnations).
For symmetric encryption, key space exhaustive search is faster, but still expensive. Roughly speaking, an n-bit key offers resistance 2n/2 against a QC (compared to 2n for a classic computer).

In the context of password-based encryption of a file, where the key is (derived from) a password, you are in the "symmetric" world, so if you fear quantum computers then it "suffices" that you choose a password with twice as much entropy. Say, aim for 120 bits of password entropy, and you should be all fine. See this answer for examples of password entropy calculations.

One may say that quantum computers do not actually exist (not "true" QC, the kind which can eat RSA at breakfast), and when they exist (if that ever happens) then they will be very expensive at first. Someone who can afford the few billions of dollars for a working QC is unlikely to be interested in your passwords.

Anyway, unless it was done with inordinate incompetence, the symmetric encryption will be the strongest point of the system, not the weakest. Any encryption relies on some software, somewhere, which does the encryption and the decryption. That will be the weak point; malware and key loggers are a much more plausible threat than an attacker who somehow obtained your USB stick and decides to attack the encryption upfront. More probably, such an attacker would write some nasty virus on the USB stick and put it back in your pocket.

(Which is a way to say that this is not a game: there are no rules between attacker and defender, and nothing compels the attacker to play nice and try to break the encryption only.)

Also, don't forget usability: keeping the attacker away from your passwords is fine; but don't lock yourself out. A USB stick is not the most reliable piece of hardware ever, and it can be lost. You should keep backups.


Is it correct to assign a CVSS to a misconfiguration? This morning, talking to a colleague, we were discussing the correction of assigning a CVSS to a bad configuration. Specifically, we were discussing whether using HTTP instead of HTTPS should have an associated vector.

From my point of view, a configuration is not a vulnerability, in the sense that it is not a software or hardware defect and therefore can have an associated risk factor but not a vector or a score derived from it.

What is your opinion?

As noted in the comments, your HTTP example would not be a misconfiguration. But, certain configs can result in or amplify vulnerabilities. For example, if a endpoint on a web app does not enforce authentication (when it should), this would be labeled as a “security misconfiguration vulnerability” on a Pentesting report because it allows an user or attacker to bypass security controls and also rated as High risk.

So I would answer yes, configurations can be a vulnerability because it can expose you to attack just like any other type of vulnerability.

And you can assign a cvss score to a configuration,  but if it makes sense is another question...


Seeing SSL requests in unencrypted form from a remote client I was wondering how I could be able to see SSL requests in an unencrypted form from remote clients (specifically, my phone).

I heard that you are supposed to use CA certificates, but how would I generate one from the Linux command line that works for all websites.

Also, I saw a video where an ethical hacker is asked to hack someones computer, the hacker manages to install the certificate on the victims computer through social engineering, with a fake e-mail.

Is it possible to install a certificate on button click, or do you have to manually import it?

(Don't worry, I will not be using this on anyone except myself, unless given permission)

Thanks

Is it possible to install a certificate on button click, or do you
  have to manually import it?

What do you think "manually importing" is? It's a software (part) that allows the user to select a certificate, and when clicking a button, it adds this certificate to the system. Meaning, of course such a software is possible. (This should be a no-brainer).

While eg. Android had restrictions in the past that third party programs weren't allowed to do so, it's now possible.

  I was wondering how I could be able to see SSL requests in an
  unencrypted form from remote clients

To MITM TLS requests (TLS, forget about SSL), you need not only the certificate part, but access to the data itself too. It's easier to start with that.

A common solution for legitimate purposes is to make a proxy server and to configure your phone to use it. Meaning, if you call a website, your phone won't connect to it directly, but connect to the proxy server, and the proxy server connects to the website. This allows the proxy server to read any transmitted data (but not to decrypt it).

Now, for the decryption part: You might know that, when a TLS connection starts, the server and the client agree on a encryption method and so on, and the client checks (with the local certificate) if the server is the real server for the given address.
If your proxy server wants to decrypt the data, it has to act as client when the connection starts, ie. the TLS connection is between web server and proxy server. The problem is the other direction: After reading what the server sent, it has to be sent to the phone too (otherwise, the phone won't ever get a started TLS connection, and won't ever start to send sensitive data over it).

The key part of TLS now is, the proxy server is not able to re-encrypt the data in a way that the phone thinks it comes from the web server (meaning the phone will reject the connection, because it recognized that the other side is not the web server). The (technial, not legal) solution 1 is to steal the private key of the web server (which is saved on the web server, but hopefully not accessible by the public). If you had that, your proxy server can successfully trick the phone into thinking that it communicates with the web server. It's just, stealing the private key can be a bit hard. The other solution is to add your self-created certificate for the website to the phone, and the private key to the proxy server, to make the phone accept the proxy server as legitimate web server too.

But now, you've still a tiny problem...

  but how would I generate one from the Linux command line that works
  for all websites.

While you could easily look this up, it won't help you, because a certificate for all web sites is not possible. The data format (used by web servers, browsers etc.) just doesn't allow it. Meaning, you would need a custom certificate (on phone and proxy) for each website that exists, if you go that route.

To solve this on the phone side, create a custom CA certificate instead of a single website certificate. Ie. a certificate that can be used to create more certificates, and if your phone has the parent cert, it trusts all children too. And on the proxy side, your proxy software needs to generate website certificates on the fly for each new connection. There's already software that is able to do this.


PKI: How does CA certificate revocation affect leaf certificates? I'm struggling to find relevant section in RFCs, and I hope someone here can help me.
How does - per specification - subCA revocation affect leaf certificates issued from this CA prior to revocation? I don't only mean TLS certificate, but also code signing, time stamping, S/MIME.
My take:

Depends on revocation reason code - for example, reason code "Cessation of Operations (5)" should not affect validity - after all, they were issued when subCA was valid, and the subCA revocation happened for reason other than "Key Compromise".

However, there is a problem with issuing new CRLs - the leaf certificates would be trustworthy only for as long as CRL is still valid. Which means, that if prior to subCA revocation I issue long-life CRL, all should be good to go.

The above works on logical level unless there's something in RFC that prevents that; and as always, developers of PKI verification code often don't understand PKI, so it probably also depends on particular software.

The short answer:
If an intermediate is revoked it can no longer be used to verify certificates it was previously used to sign, rendering the children certificates invalid.
Exceptions apply for timestamped signatures.
Revocation of intermediate certificates:
There is no need for a different section for intermediate certificates.
The RFC shows a reference algorithm for certificate path building and verification.
Given  a prospective certification path (a sequence of n certificates), path validation performs the following, per RFC 5280, section 6.1.3:
The basic path processing actions to be performed for certificate i
   (for all i in [1..n]) are listed below.

      (a)  Verify the basic certificate information.  The certificate
           MUST satisfy each of the following:

         (1)  The signature on the certificate can be verified using
              working_public_key_algorithm, the working_public_key, and
              the working_public_key_parameters.

         (2)  The certificate validity period includes the current time.

         (3)  At the current time, the certificate is not revoked.  This
              may be determined by obtaining the appropriate CRL
              (Section 6.3), by status information, or by out-of-band
              mechanisms.

         (4)  The certificate issuer name is the working_issuer_name.

(3) specifically spells out certificate revocation in addition to certificate validity ((1) signature and (2) time).
This means that every certificate in the chain from trust anchor (aka root)  to leaf certificate must not be revoked at the time of the check.
Revocation reason:
The reason field is mostly irrelevant, the only one that matters is removeFromCRL which removes a certificate from the CRL (basically "unrevoking" it). The final "certificate status" per section 6.3.3 is:
If ((reasons_mask is all-reasons) OR (cert_status is not UNREVOKED)),
   then the revocation status has been determined, so return
   cert_status.

Example:
Given the following simple path: root -> intermediate -> myexample.com.
If intermediate is found to be revoked in a CRL published by root, it will be considered invalid for all paths it is a part of. Since intermediate is invalid, I cannot verify the certificate for myexample.com, rendering it invalid it a well.
Answers to OP's take:

Depends on revocation reason code: it really doesn't. If a certificate was revoked, it can no longer be used to verify other certificates. It does not matter if the CA went out of business or leaked its private key.

there is a problem with issuing new CRLs: there isn't, the CRL revoking the intermediate CA is issued by its parent which is still valid. Since the intermediate CA is now revoked, the rest of the path is invalid.

But wait! Timestamped signatures
All of the above applies to path verification for "current" use. One notable exception is PKI use for timestamped signatures. This is described in RFC 3161.
Two important deviations from the above are spelled out in the RFC:
Use of revoked certificates, as long as the signature was prior to revocation: (from the intro)
   ... verify that a digital signature was
   applied to a message before the corresponding certificate was revoked
   thus allowing a revoked public key certificate to be used for
   verifying signatures created prior to the time of revocation

Meaningful reason codes when a key has not been compromised. Details from section 4:
      When a TSA shall not be used anymore, but the TSA private key has
      not been compromised, the authority's certificate SHALL be
      revoked.  When the reasonCode extension relative to the revoked
      certificate from the TSA is present in the CRL entry extensions,
      it SHALL be set either to unspecified (0), affiliationChanged (3),
      superseded (4) or cessationOfOperation (5).  In that case, at any
      future time, the tokens signed with the corresponding key will be
      considered as invalid, but tokens generated before the revocation
      time will remain valid.


Why do researcher need to control all C&C servers of a botnet? Why do researcher need to control all C&C servers of a botnet?

Wouldn't it be easier to spread a deinstall command to all reachable PCs to cripple the botnet? This could be done over and over again until most PCs are clean.

Apparently I don't know enough about botnets, so please help me out.
Do clients check commands from multiple sources? I.e. in a P2P botnet, do they accept multiple commands from various other bots and then compare them to check which one is valid? Same for C&C servers. Will they connect to the first active C&C and execute whatever command is placed for there? If so, the only two things hindering researchers from using the botnet infrastructure is access to C&C servers and possibly encryption keys to send valid commands.

The point is that simply removing the C&C servers leaves the affected PC wide open an possibly even in a state where it constantly tries to communicate with other bots / download commands? So if ever another C&C server gets reachable, the bots will be active again.

A possible reason that sprung to my mind was that deinstalling anything from a target PC could possibly be seen as an unlawful interaction with one's PC.

In answer to your questions about bots, this depends on the bot itself, I mean it is up to its designer to design how the bot itself receives commands.

The 'traditional' method is ofcourse to connect to a IRC channel and wait for instruction,

P2P is often more difficult to implement (due to NAT/Port Forwarding) and easier to detect (because holes in firewalls are easier to see. )

'Taking ownership' of C&C Servers, it is primarily to ensure that nobody else does, even by accident, and primarily to ensure that a IP address
does not get 'hammered' to much if the IP is allowed back into general circulation (for example, imaging a botnet of 2 million machines hitting a IP
address once per day, thats 1388.8 tcp connections per minute. could have a detrimental effect. )

As for 'not self destructing' the bots themselves, it is because it is not ethical to run code on another machine without the users consent
(even if it is for their own good. ). Its possible that the removal might require a reboot in some cases, or might effect running processes.
(if my machine reboots without my knowledge I am going to go out hunting for blood. can you imagine the backlash if the un-install process caused some damage by accident?)


On company intranet yet web server picked up URL scanning-type requests? I was running some unit tests for a web app using Karma in watch mode (so it was running a web server) and I got this output in my console between tests while the console should have been idle.

20 01 2017 13:47:35.359:WARN [web-server]: 404: /robots.txt
20 01 2017 13:47:40.490:WARN [web-server]: 404: /status.jsp
20 01 2017 13:47:41.041:WARN [web-server]: 404: /rs-status
20 01 2017 13:47:44.673:WARN [web-server]: 404: /tasktracker.jsp
20 01 2017 13:47:46.591:WARN [web-server]: 404: /.git/HEAD
20 01 2017 13:47:50.097:WARN [web-server]: 404: /nmaplowercheck1484938066
20 01 2017 13:47:50.312:WARN [web-server]: 404: /HNAP1
20 01 2017 13:48:11.679:WARN [web-server]: 404: /flumemaster.jsp
20 01 2017 13:48:20.064:WARN [web-server]: 404: /jobtracker.jsp
20 01 2017 13:48:20.948:WARN [web-server]: 404: /browseDirectory.jsp
20 01 2017 13:48:24.715:WARN [web-server]: 404: /dfshealth.jsp
20 01 2017 13:48:26.201:WARN [web-server]: 404: /master.jsp

To me it looks as if something saw I had a web server running (on the unlikely port of either 9876 or 35729 from netstat and what I know about Karma) and tried to query a bunch of possible pages to do something, my guess would be this thing is normally malicious intent.

The thing is, I'm on my company intranet with internet connection but also a 10.*.*.* address assigned to me (ipconfig /all). Unless the company specifically forwarded a port to my laptop (which they shouldn't have) there would be no way to reach my laptop externally, right?

Can anyone shed some light on what might be happening here? Unfortunately, I don't know if I can get a more detailed log than this because Karma is only meant to be for unit tests.

It appears that someone scanned your web server with nmap, based on the match with one of nmap's scripts:

$ grep nmaplowercheck *.lua
http.lua:  local URL_404_1 = '/nmaplowercheck' .. os.time(os.date('*t'))

which is what would cause this request:

20 01 2017 13:47:50.097:WARN [web-server]: 404: /nmaplowercheck1484938066

This is not unusual.  Under certain commands nmap will throw a bunch of its scripts against any port it finds open to see what comes out; the scripts in nmap go far beyond simple port scanning functionality.

As to who did it, and why, you should have web logs that list source IP address.  If you don't have that, given that the most likely cause* is an approved automated scan across your network, leave a packet capture running and wait for it to happen again.

*for an Internal network.  On the Internets it's a whole different story!


Why is a hash sent with data secure? Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine whether the data was altered.  Source.

  A common approach used in data transmission is for the sender to create a unique fingerprint of the data using a one-way hashing algorithm. The hash is sent to the receiver along with the data. The data's hash is recalculated and compared to the original by the receiver to ensure the data wasn't lost or modified in transit.  Source.

If the hash of some data is computed and sent along w/ the data, can't an attacker alter the data, re-compute the hash and the receiver would be none the wiser?

The source explains an overarching concept and is perhaps slightly ambigious rather than outright misleading. Hashes sent alongside data in their "raw" format are definitely susceptible to a tampering attack and, therefore, we need to either:

Share the hash value out-of-band: A simple example is downloading a file off a website which shows the file's hashsum on the web page next to the download link (the out-of-band channel here is the web page content being served within a different communication channel or even better served by a different web server). Once you have successfully downloaded the file, you would calculate the hash of the file independently and compare the hash to ensure integrity. This is a common practice for critical files such as an operating system image.
Authenticate the hash sent along with the data: this is done by using what is known as a Hashed Message Authentication Code (HMAC), which provides both the "integrity" and "authenticity" security services to your message.  There are a lot of detailed answers about this topic here.


2 vs 3 tier network architecture I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with the world, and a place where server compromise may have less impact. But then what difference do I get with a web vs web-app in the DMZ? And what what I do with non-conforming apps (I could put in a dumb reverse proxy in the DMZ as the 'web', but again, what's the value-add?)

The way you are thinking about the problem is running you into trouble. It is not the DMZ or the tiers that improve security; it's the separation of the access and the data.

A DMZ is one way to separate access and data at the network level
3-tier architecture is one way to separate access and data at the application level

So, thinking about it this way, you can start to evaluate your risks and your mitigation options in terms of layers of separation and the risks of not separating the layers.

If there is a risk of someone gaining access to the DMZ network (server-level access), then you need to place the high-risk assets behind the DMZ. If the "app" portion of your architecture is not where the high-impact assets reside, then you can be justified in deciding to place the app tier (or, similarly, the web-app tier) in the DMZ.

Your decision matrix is based on the questions:

"what is the impact if this control fails?"
"what other controls need to fail in order for this control failure to have an impact?"
"what is the likelihood of this combination of controls failing?"

A DMZ and a tiered architecture add layers of control that give you options in case a set of controls fail. Whether the layers of control will have an effect is entirely up to your risk assessment.

Security and risk management is about applying layers of controls to mitigate the likelihood and impacts of an adverse event from happening. If a control does not affect the likelihood or impact, then it is a waste of resources.


OpenVAS - how does it know if an SQL vulnerability is open? I'm trying to intentionally open up an SQL vulnerability in a web app to see if OpenVAS will pick it up.

There's a url that OpenVAS tries, which is /news/?group_id=&limit=50&offset=50;select+1+as+id,unix_pw+as+forum_id,+user_name||unix_pw+as+summary+from+users

I've got a simple NewsPost model and I've created a route that will respond to the above url inside my web app.

The SQL that gets executed is: SELECT * FROM news_posts WHERE group_id=&limit=50&offset=50;select+1+as+id,unix_pw+as+forum_id,+user_name||unix_pw+as+summary+from+users.

But for some reason, the OpenVAS scan does not detect this as being vulnerable in my Rails web app.

So I'm wondering, how does OpenVAS determine if it's vulnerable? is it based on the content that the web page returns? the status code returned by the server? or something else?

OpenVAS (now part of GVM) is a Vulnerability Scanner. Scanners of this class are checking applications / systems for "known" vulnerabilities like SQL injections within a CMS / Blog software or similar where e.g. a vendor advisory or a security researcher report exists. The check is then done in one of the following ways:

based on an exposed version
by an active check (e.g. SQL injection) to known vulnerable URL / endpoint. In this case quite often application specific response checks (e.g. checking for a specific text) is done.

Checking for unknown vulnerabilities like the SQL injection mentioned by the OP requires a Web-Application Scanner like Acunetix or Burp which often requires user-interaction a Vulnerability Scanner doesn't offer.

Nevertheless from being a Vulnerability Scanner OpenVAS / GVM has some very basic Web-Application Scanner capabilities which needs to be separately enabled within the default scan configuration. For this clone the "Full and Fast" scan config, search for the following VT:

Name: Global variable settings
Family: Settings
OID: 1.3.6.1.4.1.25623.1.0.12288

and configure the "Enable generic web application scanning" to "yes". While i doubt that the SQL injection of the OP will be found it worth a try.

To sum-up:

Vulnerability scanners are checking mainly for "known" (e.g. publicly documented) vulnerabilities via a version check or an active check to the known affected URL.
Unknown vulnerabilities requires a Web-Application Scanner.

To specially answer the question on how OpenVAS/GVM is checking for this specific vulnerability:

The VT doing this SQL injection request is 2009/GForge_multiple_sql_injection.nasl (can be found in your local installation) and once the application is answering with a response containing the following text a vulnerability is reported:

forum_id=$1$

Disclaimer: VT Dev @ Greenbone


Test the security of my Linux setup I have a Ubuntu installation running in VirtualBox. I have made a few modifications to it (some kernel modules and startup scripts) that I hope would make it very secure. Is there anyway I can test some malware on it? The virtual machine is versioned, so I can revert to a clean state easily.

Do you mean you want to get sample malware?
According to the book Advanced Malware Analysis, there are a few public resource to get those like:

malshare.com
Open Malware (http://gtisc.gatech.edu/)
malwareblacklist.com

You can find out more in that book.


How can all ports be closed? I was faced that, there was an hacker attacking my gmail account.

With the help of google service, I got the information about that hacker. Again next day he was attacking my pc.

When I scanned the IP for an open port, It goes down and no single port was found open.

How is it possible? How can I close my all ports to protect my system?

Ports are like holes in a wall, they exist but if no one is paying attention to them its no use to throw things at them.

A program uses ports (or sockets) to connect with other devices in the same network (and through routing techniques the program may reach other networks). The way this works is that the program opens a connection to the outside and listens to that connection that it opened. The program has to do something special to listen to connections incoming from the outside (like HTTP servers do, they take every connection that goes to port 80 -for example- and process that request).

If the program does not do this something special thing, then even if a connection goes through that port, the program will not process it and it goes to void.

When you got the IP of your attacker you scanned for open ports, but the attacker did not have a program listening for connections from the outside world (or had it set in a way that it would only log your connection requests but do nothing with them).

The best way to protect yourself from attacks like this is by installing a firewall and maybe a network monitor, for example Little Snitch will tell you every time a program a connection happens to or from your computer, and you can block or allow that connection. You will see that at least in OSX there are many calls to Apple servers.


Safe to use setuid with absolutely no input? I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the HTTP server - both of which belong to the same group.

I want the synced files to be owned by the "owner" user and I don't want the HTTP server user to be able to write to them. However, I want the HTTP server user to be able to invoke the sync script.

One option is to wrap the shell script in a small C application and use setuid so the HTTP server user can run it as the "owner" user.

Given that:

There will be no input to the script - the remote location, destination location, etc. are all constant.
The setuid script won't be owned/run by root.

Is this a safe and sensible thing to do?

Edit:

For the sake of explaining things you can use the following names:

deploy-user: The user who should own the files
www-user: The user running the HTTP server
www-group: The group deploy-user and www-user belong to
sync.sh: The script which updates the file
sync.txt: The target file

If I'm understanding your question correctly, I believe the easiest solution is:

chgrp <user> /path/to/syncfile

All of what you are trying to do can be accomplished with chmod, chgroup, or chown.
(*not enough rep to hyperlink >2 times)

This command above will keep the syncfile owned by owner, while giving group ownership to user.
User group permissions must be set correctly with chmod for this to work. eg.

chmod 754 syncfile.foo

or

chmod 750 syncfile.foo

Where 754 gives +rwx to owner, +r-x to file group (user), +r to all others..
Or where 750 gives the same, but does not give all others read permissions.


NAT traversal for IPsec AH protocol Wherever I looked I only saw the description of NAT traversal for ESP protocol (for example: http://pic.dhe.ibm.com/infocenter/iseries/v6r1m0/index.jsp?topic=/rzaja/rzajaudpencap.htm)

It's looks that encapsulation of AH will work the same way (as for ESP) in transport mode, and in tunnel mode another new IP (+UDP) header should be added (so the total number of IP headers is 3).

Does it right? IS there another problem in NAT traversal for AH that I'm missing?

EDIT:
The RFC that addresses this issue says that AH is not supported by UDP encapsulation whereas the draft of the same RFC purpose a solution for UDP encapsulation for AH protocol also.

AH includes the outer IP header in the HMAC calculation which is why NAT breaks it. My understanding was that NAT-T was never expanded to support AH because NAT breaks the outer IP header protection.

http://www.ietf.org/rfc/rfc3948.txt
"Because the protection of the outer IP addresses in IPsec AH is inherently incompatible with NAT, the IPsec AH was left out of the scope of this protocol specification."


Does SSLSTRIP in MITMF only works when the victim visits for the first time? I just started learning MITM attacks and I use MITMF to perfom these attacks. I have one question regarding to sslstrip. I notice that sslstrip only works when we first clear the cache and history in our victim's browser.  Is this always the case? Or is there any workarounds for this?

I've been thinking of maybe doing a dns spoof and then running a script to clear all the cookies in the browser but I'm not sure if this will works.

edit : I do understand that sslstrip wont work on HSTS websites but will it work without having the victim to clear their cookies first?

I do understand that sslstrip wont work on HSTS websites but will it work without having the victim to clear their cookies first?

This is completely unrelated to cookies.

SSLStrip works as long the browser thinks that the site can be accessed by plain HTTP. If the site response with HSTS or has pre-loaded HSTS  the browser knows to access the site next time or even first time with HTTPS.

Similar if the site issues a 301 permanent redirect to HTTPS the browser will next time skip the plain HTTP request and access this new HTTPS-URL directly (affects only the specific URL and not the whole site). I think you are confusing this 301 with the cookies.


how is Google Ads managing to track me? (even if I don't keep cookies!??) NOTE: in this question I am interested in discovering the actual method used by Google to track me -in my particular case- and in exploring eventual ways to circumvent it. This is completely different from the question is Google spying on us all. That question is asking "if" Google is tracking users and goes on to talk if that is a correct/acceptable behavior or not.

ok, here is the situation:

I started noticing the same type of ads following me in various sites: in particular a couple of ads regarding "2000+ Chinese women online" and about "meet Thai girls"...

Now, I find that really strange since my Firefox is set to delete cookies when I exit, and Chrome is always in "incognito" mode.
I also tried manually delete all offline content, but same result.
Another idea: I tried to reboot my internet modem and I got a different public IP.. but still same result.

As a tests I went on www.linuxquestions.org with different browsers:

with Firefox I get those ads.
with Chrome I get the same ads.
with Tor browser (tor is an anonimity network)  I get DIFFERENT ads,
about Linux and computers/technology.
with my other laptop, using Internet Explorer, same Thai/Chinese ads.

How do you think is Google managing to follow me?

PS: I have an idea but I would like to hear your opinions first..

I would try the following (while not logged in to any Google services of course):

Booting from a Ubuntu CD
Using a different device connected to your network (e.g. a smartphone or friends laptop).

If the ads change in both cases, it would suggest there is still something on your computer that is allowing Google to ID you. Perhaps an old installation of Google Talk? Maybe the cookies are (somehow) not being cleared?

If the ads remain the same in both cases, it would suggest that the ads are not tracking "you", but are perhaps based on IP address geolocation or some other indirect targeting method.

For extra points, you could check the IP geolocation theory further by booting from the Ubuntu CD again, and then borrowing your neighbors WiFi connection.

PS I would certainly expect different ads when using Tor - the exit node is likely to be in a different AS Number than your current IP, and that alone is very likely to produce a change in advertising.


What makes an SSL session pick one cipher over another? I am curious as to what causes the SSL session to choose one cipher over another. I am a total novice with this, so most answers out there already are way over my head.

Example: I need to connect to two different servers - A and B. Both appear to have certificates with the same signature Algorithm - SHA256 with RSA and both are owned by the same company.

Both return the same list of available ciphers in the Cipher Suites:

SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_DHE_RSA_WITH_DES_CBC_SHA
SSL_DHE_DSS_WITH_DES_CBC_SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
TLS_EMPTY_RENEGOTIATION_INFO_SCSV

However, connection to server A selects the first option: SSL_RSA_WITH_RC4_128_MD5.

While connection to server B selects the fourth: TLS_DHE_RSA_WITH_AES_128_CBC_SHA.

My question is what causes the connection to server B to select the fourth option that includes DHE? Is it something different on the certificates, or is there something else affecting it?

In the first step the server aligns the ciphers offered by the client with the ciphers configured for the cipher to get a set of common ciphers. From this set the server then selects a single cipher.  There are various strategies possible for this selection but usually it boils down to a selection either on the cipher order given by the client or the order configured in the server.

What you see here is probably a different value of the SSLHonorCipherOrder option in Apache (and similar options in other servers). With SSLHonorCipherOrder on it will choose the cipher depending on the preference of the server and thus pick from the top of the servers list, i.e. SSL_RSA_WITH_RC4_128_MD5 in this case. With SSLHonorCipherOrder on it will instead choose the cipher depending on the clients preference and choose the better cipher TLS_DHE_RSA_WITH_AES_128_CBC_SHA.

  Both appear to have certificates with the same signature Algorithm - SHA256 with RSA and both are owned by the same company.

The certificate does not have much relevance for choosing the cipher. You can only use ciphers with RSA authentication with RSA certificates and ciphers with ECDSA authentication with ECDSA certificates but apart from that there is no dependence.


Which one to use AES : GCM vs CBC I am planning to encrypt database fields using AES encryption.
Now, this encrypted data will not transfer over the internet and will reside in our own datacenter only.
From what I read, GCM mode should be the obvious choice for encryption since it's more secure(basically it's authentication encryption) and it's fast.
But do I need to use authentication encryption in this case? I mean data will reside inside our servers only.
So can I use CBC mode without appending MAC to encrypted text. I want to use CBC since we are using PHP 5.6 in prod(for some legacy code, I know this version of PHP should not be used in prod any how). Or do I need to first encrypt using CBC mode and then calculate MAC for encrypted text and then hash it and append to cipher?
So, will CBC solve my purpose. I have written this code?
Is this secure or not
    function encrypt($key, $textToEncrypt){
    $cipher = AES_256_CBC;
    $iv_len = 16;
    $version_length = 3;
    $version = "v01";
    $iv = openssl_random_pseudo_bytes($iv_len);
    $ciphertext = openssl_encrypt($textToEncrypt, $cipher, $key, OPENSSL_RAW_DATA, $iv);
    $hmac = hash_hmac('sha256', $ciphertext, $key, $as_binary=true);
    $encrypted = base64_encode($version.$iv.$hmac.$ciphertext);
    return $encrypted;
}

function decrypt($key, $textToDecrypt){

    $cipher = AES_256_CBC;
    $iv_len = 16;
    $version_length = 3;
    $encrypted = base64_decode($textToDecrypt);
    $version = substr($encrypted, 0, $version_length);
    $iv = substr($encrypted, $version_length , $iv_len);
    $hmac = substr($encrypted, $version_length + $iv_len, $sha2len=32);
    $ciphertext = substr($encrypted, $iv_len  + $version_length + $sha2len );

    $decrypted = openssl_decrypt($ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv);
    $calcmac = hash_hmac('sha256', $ciphertext, $key, $as_binary=true);

    if (hash_equals($hmac, $calcmac))//PHP 5.6+ timing attack safe comparison
    {
        echo $decrypted."\n";
    }
    return "";
}

First of all, your actual risks determined the need for confidentiality, integrity, and authentication. The risks can be deletion of rows, insertion of rows, altering cells, or the rollback of the whole database.. I'll not address these.
You seem only need an authenticated encryption (AE) and not interested in the bundle AES-GCM that provides confidentiality, integrity, and authentication. For the CBC mode of operation, you need HMAC to achieve this. Now your obligations for the CBC mode of operation;

choose a uniform random 256-bit key and keep it secret all the time.
for each field choose a 128-bit initialization vector (IV) that should be unique and unpredictable
The IV can be stored in a column or prepended to the data.
the unpredictable requirement of the CBC mode is not a problem in your case.
the padding oracle attacks are also not possible in this scenario.
the CBC-HMAC must be used as Encrypt-then-MAC

AES-CBC guarantees CPA security. With the AES-CBC-HMAC you will get authenticated encryption.

So, will CBC solve my purpose. I have written this code?

It is not advisable to use the same key for encryption and HMAC, or in short for two different purposes. You can use a Key Derivation function to derive keys for AES and HMAC from the given key HKDF, PBKDF2.


Using a login in automation While working a contract for a company that needs data security, I found a python script that a previous person had made which used login details stored in plain-text locally. On a network of roughly 200 users, 7 of which have access to this file, really how dangerous is this practice? Is there any way to make this system secure without making the user type in their login details every time they run the program? Ideally this script runs in the background so long as the computer is on, is there any risk associated with storing the password in memory for that time?

Previously when working with automated permissions, I typically would use a controlled group access. With only a handful of people having access to the file, I would say it isn't "dangerous" per se, but it is not good practice. In my past experience letting something like this run amok (plain-text credentials), it will become a pain to update and replace later on when it does become an issue. It would be better to deal with this now than later. Since you mentioned this company needing data security, I would say that this specific case applies and would need to be addressed.

There are a number of ways you could go about this - it depends on what you have access to or what you have already built. Implementing a file that can be imported to the script, which contains usernames as part of specific groups. Then, allowing only appropriate groups permissions to run the file/login. It would depend on the environment/OS you're running this on as well. I would look into Python Keyring as you would be able to implement it in-line with the script.

Obviously going this route, you would be in a similar situation where you would have to lock the permissions file down as well, only allowing key people access to modify said file. An alternative would be using SQL and creating a credential table based on users who should have access, in which permissions would work in a similar way (if these specific people exist in this table, allow access). This could be as simple as usernames/user ID and does not have to include passwords. A comparison to Windows Active Directory could work as well. These are some general examples as I'm not sure what environment you're running on, or if there are any measures that currently exist that would be able to be utilized.

Coming back to your question though, I would recommend implementing a solution. Even something such as creating an encrypted password - anything to get rid of plain-text would be a plus.


Generate variable length wordlist with ! character at the end? I am trying to create a variable length word list with crunch that guarantees a exclamation point (!) at the end of each word. I want a wordlist of all words of length 4 - 6, with the last character being an exclamation point and the rest being lower case letters. I'm then going to feed all of this into hashcat.

What command/crunch options would I use?

I'm fairly sure you can not create a word-list of variable word length and a fixed terminating character. Be sure to denote a specific word library if you have one, I'm using the default in these examples.

You have two options:

Run Crunch 3 separate times, once for each word-length (in total) 4 alpha with an appended '!', 5 alphas with an appended '!', etc... Also note, you need to make sure you escape the exclamation with a backslash. You can also establish parameters on the word-list file size, or number of words compiled.

./crunch 5 5 -t @@@@/! -o filename.txt
./crunch 6 6 -t @@@@@/! -o filename.txt
./crunch 7 7 -t @@@@@@/! -o filename.txt

Note the above word-lengths 5, 6 and 7. This corresponds to a word containing 4, 5 or 6 alphabetical characters, with an additional fixed special '!' character. The commands ./crunch 4 6 and/or ./crunch 3 5 will not create words of correct length.
Run one instance of Crunch to generate only the nonfixed characters,

./crunch 4 6 -o filename.txt

Write a basic script to retroactively append the '!',


How to search for evidence of webcam hacking? I'm worried about camfecting (webcam hacking). The camera light on my mac (running OSX) is not on, but it isn't hard wired so that doesn't say a lot.

I've ran a virus scan but no signs. Now my idea was to watch outbound traffic in activity monitor. If there is live streaming (most likely when camfecting is occurring?) the outgoing traffic can't be under 1 kB/s right? Or will such traffic be invisible for the total data traffic in activity monitor?

There is no good software way to do this.

Monitoring outgoing traffic on computer with the camera is no good solution as your traffic stats may be faked. If someone gains such a good access to your webcam to disable the light, faking traffic stats is not a huge step away. You could measure the traffic on your router, but then you would need to read the stats on another computer, and, besides that it is extremely inconvenient, the router can be attacked, too.

I protect me from camfecting with a thick tape. I can pull it (partly) off when I need it, and as my cellphone already includes a microphone that can tap me, I don't care for the webcam's mic, at least most times.

If you also cared for your mic, or had a tin foil hat, I'd suggest to completely disable the microphone and camera on the hardware side, most times by removing it. The NSA recommends to remove the camera (pdf). In the pdf are additional tips on how to protect yourself from camfecting:

  The best way to disable an integrated iSight camera is to have an
  Apple-certified technician remove it.
  Placing opaque tape over the
  camera is less secure but still helpful. A less persistent but still
  helpful method is to remove /System/Library/Quicktime/QuicktimeUSBVDCDigitizer.component, which will prevent some
   programs from accessing the camera.

  To disable the microphone, even
  if it means crippling the sound system, remove the following file from
  /System/Library/Extensions: IOAudioFamily.kext

Don't overestimate the software-side solutions above. Through a privilege escalation attack they can be defeated.

You can buy yourself a cheap usb webcam and use that instead of the built in one, and when you don't need it you can simply disconnect it.


Verify signature without digest I'm trying to verify that a smartcard (possibly doctored by an attacker) has access to the (ECDSA P-384) private key for which I was given a (signed) public key, in order to verify that the card is genuine. In order to do that, I should pass a random nonce to the card, ask it to sign it, and verify the result against the trusted public key.
I know that best practice for signing something with public/private keypairs is to hash the nonce and sign the hash, rather than signing the data directly, mostly because signing a long document with a private key would take a large amount of signing operations, which is not good for performance. However, since I'm not signing a document but just a small nonce, I can control the size of the nonce to have exactly the size of what the hash would be, and bypass the hashing operation. When trying to verify the result using OpenSSL's EVP_DigestVerify* methods, however, I see that it expects me to pass the hashing algorithm that was used for the signature, but since I just sent random bytes of the correct length, I don't really have one. I found EVP_md_null(), but its documentation says

A "null" message digest that does nothing: i.e. the hash it returns is of zero length.

which is not what I was looking for (I would need a function that passes the input unmodified as the output).
Two questions:

Is this a bad idea for some reason that I don't know about? e.g., is there an important security property that I lose if I do things this way?
If not, how can I tell OpenSSL with the EVP_* functions that I just want signature verification, and that I don't want a hashing operation of the input data?

EVP_Digest{Sign,Verify}* always hash the data before signing/verifying; that's their whole purpose. Less obviously, the older (before 1.0.0 in 2010) EVP_{Sign,Verify}* also do this. Trying to get them to not hash is kind of like going to the restaurant and buying a steak dinner, taking it home, throwing it out, getting some crackers from the cabinet, and eating the crackers; it works, but it's silly.
To sign/verify a pre-digested value the generic routines are EVP_PKEY_{sign,verify}*; see the man pages on your system or on the web here and here (note the description on the sign page is a little clearer that tbs,tbslen are expected to already be the digest).
Alternatively for ECDSA specifically you can call the underlying primitives ECDSA_{sign,verify}* combined with explicit encode/decode (which the EVP level does automatically) normally using i2d/d2i_ECDSA_SIG which are referenced/linked there.
Crossdupe https://stackoverflow.com/questions/57018976/evp-pkey-verify-doesnt-work-when-using-ec-key for the EVP_PKEY_* option.


How could ASP.NET forms authentication session leak into a different site? We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site.  I can't figure out how is IIS or ASP.NET allowing this to occur

Steps:

Login to site1.domain.com as user "admin"
Save authetication cookie value
Go to site2.domain.com and use "EditThisCookie" extension to create a matching authentication cookie from step 2
Submit that to bypass site2's authentication using site1's cookie (Logged in as "admin" on site2.  Confirmed that I'm looking at site2's data - not some kind of alias of site1)

Environment:

1 IIS Server (Windows 2016)
2 ASP.NET4 sites (site1.domain.com and site2.domain.com)
site1 cookie name is SITE1_AUTH, and site2 cookie name is SITE2_AUTH
using inproc session storage
using separate application pools for site1 and site2
cookies specify full domain ex: site1.domain.com (not domain.com)
In the code it's using FormsAuthentication.SetAuthCookie()
site1 and site2 have same user user1

I created a dummy test code to try to reproduce this issue using the relevant ASP.NET authentication code and web.config.   I can't reproduce it in the dummy code though.  It only works in the actual (large) application.   For that reason I can't share the relevant source code, so I would be able to accept any hints for further exploration as a solution.

The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both.   This node contains the key for encrypting and decrypting the authentication cookie, and by default (if the node doesn't exist) the server will create unique keys for each application.  If, however, you specify a machineKey node (which, for instance, if you had a single web application with multiple web serves and you needed an auth cookie to be created or consumed on any arbitrary node) the key that you specify will be used.   This can create a vulnerability if the same values are used on multiple web applications (or made public) because you end up with the situation you describe.  A valid arbitrary authentication cookie from one application can be re-used as a forged authentication token for another application.