Why does Google require a phone number for using their 2FA service? Both Gmail and Outlook keep asking for a phone number for security purposes once in a time, when you log in.

Now, I decided to use two factor authentication via a phone  authenticator app for both. Gmail seems to have a phone number as a mandatory requirement for using 2FA.

From my perspective, I don't think a phone number should be a mandatory requirement for the 2FA service. If you use 2FA, I think you're responsible enough to keep a recovery code stored at a safe place. Moreover, I find it infringing on my privacy.

Why does Google ask for a phone number as a mandatory requirement for using the 2FA service?

Furthermore, if you're logged in through your smartphone, there already exists a prompting feature. This seems to make the phone number requirement a bit redundant.

It is the mandatory requirement that I disagree with. They diverge in this policy from Microsoft Outlook and Attlasian's Bitbucket, for instance.

It all burns down to solving just one problem: spam protection.
Ensuring that the people who sign up for services are real people.

Before that, thanks for bring this up, and yes, it is  indeed annoying.

From what I have perceived, services that deal with "real people" often want some sort of "real world" token that a person would have on them. Like a biometric scan, something unique or nearly unique to a person.

And since we don't expect every person to have special hardware like biometric scanners, our phone numbers happen to be the next most unique (I cringe) and convenient way of having almost that.

Facebook, Twitter, Gmail, every people-to-people service wants (and are often criticised) for requiring it. Although in the case of messaging service it makes some sense to have that, because "that is how WhatsApp routes chat messages between you and your contacts" But no one seems to be arriving at a better solution for it. And from what all I have read, not a lot of investments are being done to fix this either. Yes, it does require fixing IMO.

Edit: Case in point is Google, and in their case, they also use it as a recovery option in case you lose access to your credentials. Which is not very secure, so they pad it up with additional checks like security question, or recovery Email addresses.


Active Directory Certificate authentication trust When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate authentication.
I am wondering if this is the ONLY certificate authority that the active directory trusts OR if the ROOT CA's specified in Certification Authorities Container ALSO can be used to validate a certificate.
Consider this.

I am deploying a Sub CA called SUBCA1 in the NTAuthCertificates which is signed by my ROOT CA called ROOTCA1.
My private key for the ROOTCA1 is compromised and the attacker now has the ability to forge a user certificate based upon ROOTCA1. So in this scenario will the fact that I have only published the SUBCA1 to the active directory protect me?

I know you should have a routine implemented for when a Root CA is compromised etc etc but this is totally hypothetical.

This page explains the different containers but I am curious if there is anything behind the scenes that maybe will accept a user certificate signed by the ROOTCA1. https://blogs.technet.microsoft.com/pki/2011/02/28/quick-check-on-adcs-health-using-enterprise-pki-tool-pkiview/

Certificate-based authentication in Windows require at a minimum:

authentication certificate's chain ends with a trusted root CA
issuing CA certificate must be installed in the NTAuth DS store.
revocation information is up to date for every certificate in the chain (except root CA, of course).

So, if root CA is compromised, only first requirement is met. There is no way to forge an already existing issuing CA certificate with the same public key. Certificates in NTAuth DS store are compared with exact match. This means that if root CA certificate is not installed in the DS store, it cannot be used to issue authentication certificates. Even if attacker attempts to do so, they won't work, because root CA certificate (as issuer of rogue authentication certificates) is not installed in the NTAuth DS store.

In order to craft legitimate authentication certificates, an attacker must compromise the CA which certificate is installed in the NTAuth store.


PHP SQL Injection Vulnerability In UPDATE Statements Take the following SQL query as an example:

UPDATE `sqlinjection2` SET `$vote`=`$vote`+1

Our goal is to increment the vote count by more than one, in one request.

We cannot access the code itself.

If we can send a value to $vote, we could send:

vote`=1, `vote`=X+`vote

So that the query looks like that:

SET `vote`=1, `vote`=X+`vote`=`vote`=1, `vote`=X+`vote`+1;

Clarification: X is a number.

My question is, how does this part work?

`vote`=X+`vote`=`vote`=1

I understand that it sets the column vote to be NULL, but why is that?

The example you give results in the value 0 (not NULL) being returned. This is because the query you constructed ended up to be a boolean comparison. The = within the assignment part(s) of an UPDATE statement is a comparison operator, not an assignment operator as you might expect.

Injection vote`=1, `vote`=10+`vote results in query UPDATE mytable SET /*part1*/`vote`=1, /*part2*/`vote`=10+`vote` = `vote`=1, /*part3*/`vote`=10+`vote` + 1 which deconstructs to this (using == as a comparison operator for clarity:

PART1:
vote = 1

PART2:
vote = ((10+vote) == vote) == 1
vote = ( 11 == vote ) == 1
vote = ( 11 == 10 ) == 1
vote = FALSE == 1
vote = FALSE (0)

PART 3:
vote = 10 + vote + 1
vote = 10 + FALSE (0) + 1
vote = 11

The more interesting injection would be to just set the vote column and then ending the query by using a comment:

$vote = "vote` = 1337 -- and we don't care about the rest";
// results in:
// UPDATE mytable set `vote` = 1337 -- and we don't care about the rest` = `vote` = 1337 -- and we don't care about the rest` + 1

MySQL will ignore everything after the first occurance of -- as a comment and will set the value (actually, all vote values in the table) to 1337.


Is this Bash code vulnerable to code injection? I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka.

My question is if that eval would be vulnerable to code injection if the invoking program surrounds its input with doble quotes, like this:

silently "function" "command \"${@}\""

Having silently this code:

#! /bin/bash

mainFunction () {
    if [ "${function}" != "" ]; then
        function="${function}: "
    fi

    error=$(eval "${command}" 2>&1)

    if [ ${?} -ne 0 ]; then
        echo "${function}${error}" >&2
        exit "${exit}"
    fi
}

setArguments () {
    if [ "${1}" == "-try" ]; then
        function="${2}"
        command="${3}"
        exit="0"
    else
        function="${1}"
        command="${2}"
        exit="1"
    fi
}

setArguments "${@}"
mainFunction "${@}"

There are two quick observation:

Using eval is very dangerous and your variable ${command} is not efficiently sanitized. (They could contain backticks, period, control chars, etc)
Using bash for sensible operation is not recommended as they suffer from a lot of vulnerabilities. I recommend using poor shell (like dash), for critical scripts. (Or more evolved languages like Python or Perl).
Sample of unexpected behaviour:

/path/to/silently Blah "'echo `date`;return 1'"
Blah: Wed Oct 16 08:26:16 CEST 2019

Where command between backticks are executed, semicolons do command separation (as usual) and return 1 force mainFunction to consider the result as an error then print them.

By using the code you've published @gitlab.com, result of this look like:

/path/to/silently Blah "'echo `date`;return 1'"
silently: surplus arguments on: Blah 'echo Thu Oct 17 13:54:36 CEST 2019;return 1'
Note that command must be quoted

date command is executed and result shown as error text.

Then you could try:

/path/to/silently Blah "'echo `cat /etc/passwd`;return 1'"

Using bash to do sensible operation is something possible, but do require strong experience. I personally  recomand to not do that!


TLS 1.3 server_handshake_traffic_secret calculation I'm currently reading the Transport Layer Security (TLS) Protocol Version 1.3.

In section 4.3.1 (Encrypted Extensions) it says

  In all handshakes, the server MUST send the EncryptedExtensions
  message immediately after the ServerHello message. This is the first
  message that is encrypted under keys derived from the
  server_handshake_traffic_secret.

How exactly is that server_handshake_traffic_secret calculated? Where does it come from?

I try to find out how all the application-data (e.g. certificate) in the server-hello is encrypted.

It should have something to do with an HKDF-Extract function. In the client-hello there is a random byte-string and a filled key-exchange extension. I assume that the (first) use of HKDF during the server-hello must base on that. But how exactly?

maybe this pdf will help you.
client and server will use DH result as PMS, just like TLS1.2 use DH result as pre-masterkey, then the middler can't know the encrypt key.


How to generate self-signed certificate for S/MIME with usage 'signing' only, like DOD uses I'm testing a feature to support S/MIME mail signing and encryption. As far as I know US DOD has quite strict standard on these certificates. So that DoD uses separate authentication, signing, and encryption keys. Also email address is placed not to "e-mail" field but somewhere else. Can anyone provide an example of how to create a set of test certificates similar to that?

Several of the OpenSSL utilities can add extensions to a certificate or certificate request based on the contents of a configuration file.

Key Usage

Key usage is a multi valued extension consisting of a list of names of the permitted key usages.

The supported names are: digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly (meaning of each name I'll leave for you)

Extended Key Usage

This extensions consists of a list of usages indicating purposes for which the certificate public key can be used for.

These can either be object short names of the dotted numerical form of OIDs. While any OID can be used only certain values make sense. In particular the following PKIX, NS and MS values are meaningful

 Value                  Meaning
 -----                  -------
 serverAuth             SSL/TLS Web Server Authentication.
 clientAuth             SSL/TLS Web Client Authentication.
 codeSigning            Code signing.
 emailProtection        E-mail Protection (S/MIME).
 timeStamping           Trusted Timestamping
 msCodeInd              Microsoft Individual Code Signing (authenticode)
 msCodeCom              Microsoft Commercial Code Signing (authenticode)
 msCTLSign              Microsoft Trust List Signing
 msSGC                  Microsoft Server Gated Crypto
 msEFS                  Microsoft Encrypted File System
 nsSGC                  Netscape Server Gated Crypto


How to share an encryption key between different PHP applications? I'm working with the php-encryption library to provide integration between two different applications. On one side, I have a corporative application that holds all data from users. This application will serve some sensitive data through an API.

On the other side, the other application will request some data, consuming the API. At this point, the API is using authenticated encryption to keep the data secure.

The question with the php-encryption library is: the key of encryption is a random key. I need keep that key because the other application must decrypt the data.

Example:

To encrypt:

$key = Crypto::createNewRandomKey();

$message = "mymessage";

$ciphertext = Crypto::encrypt($message, $key);

To decrypt:

$decrypted = Crypto::decrypt($ciphertext, $key);

What is the best way to share the key or keep the same key between different applications?

As @schroeder recommended, you should share the key between applications/servers using Public Key Infrastructure (PKI). It's not recommended that you implement this yourself.

There is a great article called Choosing the Right Cryptography Library for Your PHP Project. This is worth taking a look at. It recommends the following libraries:

Halite
Libsodium (as recommended by @NSSec)
PHP Encryption
Phpseclib (RSA! Only)

Others to consider:

EasyRSA (Not PKCS#1v1.5!)
phpseclib

Also since there are corporative apps involved, have a strategy for key management on the respective servers (i.e. key management processes and policies, use of a Hardware Security Module (HSM), etc). You can also consult Guidance for Securing Public Key Infrastructure.

Good luck with your project!


Is it possible to invoke OS commands from a NASL script in OpenVAS? I was wondering if it is possible to run a command like cat, w3m or any other Operating System (Linux) utility from inside a NASL script and use its output. Do you know any examples? I know you can use the tools that OpenVAS uses like nikto, etc because they are already builtin functions. But can you use other tools that are not part of OpenVAS directly?

There is the NASL function pread which allows you to run external commands from within a NASL script. An example to run cat and get its output could be:

args = make_list( "cat", # The cmd which is called, needs to be in cmd as well
                  "/etc/passwd" );
ret = pread( cmd:"cat",  # The command to run
             argv:args,  # The arguments list of above
             cd:FALSE ); # This specifies if a `cd` to the directory of the `cmd`should be done

A "full" example with various code path (e.g. checking if the command exists before running it) can be found in e.g. nikto.nasl (http://plugins.openvas.org/nasl.php?oid=14260)


Tools to test for BEAST/CRIME that AREN'T Internet-based? We have increasing pressure to identify and remediate any HTTPS server configurations that are vulnerable to BEAST (CBC) and CRIME (compression).  We need to fix servers that are accessible to the Internet at large, servers that are only accessible to limited partner IP addresses via the Internet, and servers that are internal.

Servers available to the Internet at large can be scanned using Qualys' SSL Labs web service.  It gives clear indication of BEAST vulnerability, and presumably the "Compression" setting that isn't a bad sign today relates to CRIME and will start triggering an alert in the near future. However, this does not help with sites that aren't generally available via the Internet.

I can find all sorts of information on how to test things by hand - for example, discussion of ciphers for BEAST and openssl s_client recipes for testing compression.  However, in my old age I'm getting more fond of tools - like SSL Labs - that just tell me, rather than having to decipher the various openssl cipher strings ("No CBC, unless it's TLS 1.1+, in which case CBC is okay, and don't forget Tuesday").

I also am leary that I'm unable to get a result indicating compression using various openssl + hand-coded HTTP headers on a web server that SSL Labs says has compression enabled.  Who do I believe?  I'm inclined to trust tools more than recipes, because tools are generally built upon a recipe that's then tested in a wide variety of setups and fixed, whereas recipes often worked for someone, somewhere, somewhen.

So what I'm looking for is a command-line tool like sslscan which I can run against all my servers, regardless of their availability to the Internet at large.  (Yes, I realize sslscan prints out the ciphers, which I can interpret to determine BEAST vulnerability - but I want an expert (or just knowledgeable!) system which is less fallible than I am to look at that output and make the call).

Edit (2012/09/23): Ask and ye shall receive. TestSSLServer is a simple command-line tool which I wrote this week-end; it obtains from a given SSL/TLS server the list of supported cipher suites, protocol versions and support of TLS-level Deflate. It then gives a summary of the encryption strength and the vulnerability to BEAST and CRIME attacks. It is written in Java and should work "everywhere" (I only tested it from a Linux/ppc client, though).

(Note that BEAST and CRIME target the client, not the server. We are talking here about steps which the server can take to "protect" the client by not allowing it to use vulnerable feature combinations.)

Original response:

For compression, there are two places where it may be activated; the blog post you link to talks about the wrong place, the one the CRIME attack is not about.

CRIME uses the compression which is at the SSL/TLS-level: a compression negotiated during the handshake, and which applies to every byte which is sent within the SSL/TLS tunnel. In a HTTPS context, this compression operates on both the HTTP request/response bodies and the HTTP headers (including the cookies, which is the point of CRIME). The compression which occurs at the HTTP level is the one which is specified with HTTP headers (like "Accept-Encoding") and which applies to the request/response bodies only. That compression does not cover the cookies (which are in the headers) and is thus, presumably, CRIME-free.

(This does not preclude the theoretical existence of a CRIME-like attack which abuses HTTP-level compression on the bodies, but it would require a request or response body which contains both confidential data, and data which the attacker can choose.)

To test a server for compression support, use this:

openssl s_client -connect www.theservername.com:443

This will produce some output which contains the server's certificate, and ends with a block of text which looks like this:

---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 4B4110C44117BA0382CA6C3903A8185E0C156B253073E66B2D44F04B83611633
    Session-ID-ctx:
    Master-Key: C11D38EE064BE6549364D54BD60E216E367A52825E62FFCCBEFC4AC8DB97D07BD72B7355CB268B91E3AD176EB69446AA
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 4c f8 be c1 d1 0f cf 03-4a 99 89 8b 75 28 97 3c   L.......J...u(.<
    0010 - 3e cf 2a b8 0f f0 d1 b4-7d c7 83 16 03 2c f0 8a   >.*.....}....,..
    0020 - 1b a7 57 be dd 1b be a3-14 eb cf 34 42 99 e0 5a   ..W........4B..Z
    0030 - c5 96 43 da c7 d9 dd da-ed 4c e2 7c eb c1 8b a8   ..C......L.|....
    0040 - ce 73 c8 22 43 10 88 d6-d2 f2 df 91 9d 47 71 70   .s."C........Gqp
    0050 - 77 bb c0 55 cd 46 34 3b-44 26 36 a1 7f 37 64 cd   w..U.F4;D&6..7d.
    0060 - 72 64 66 89 cc f6 8b 23-17 9b 9a 91 23 6a f7 c2   rdf....#....#j..
    0070 - 8a e2 8c 10 85 8f b7 6c-60 d2 b6 72 b3 13 98 8b   .......l`..r....
    0080 - 75 da 68 cc 2a ca 4f fb-ec 4c f2 db 91 4a f7 2a   u.h.*.O..L...J.*
    0090 - 40 eb 92 44 c7 7a f7 84-ef 65 ea 2c 96 aa c5 ba   @..D.z...e.,....
    00a0 - c3 b5 76 6d 52 03 85 c9-27 53 a2 a4 70 54 06 37   ..vmR...'S..pT.7
    00b0 - 82 3e 09 93 21 6d f6 e7-eb cf c3 5e 26 19 e1 a2   .>..!m.....^&...

    Compression: 1 (zlib compression)
    Start Time: 1348073749
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

This was done on a server which supports TLS-level compression. You see "zlib compression" in three places: Deflate compression is indeed supported by this server. Note that there is not a single sign of a HTTP header anywhere ! Just type the openssl command, and look at the output. No need to enter a HTTP header.

On a server which does NOT support TLS-level compression, things will look like this:

---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-RC4-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-RC4-SHA
    Session-ID: 59D609F13BEE9157D26318ADB12F4CF219EF7A1BC2C87AF84AD66773303F90A6
    Session-ID-ctx:
    Master-Key: 1DD9E0C306A86A7EC823561EF0B1F47B63E70B43D57F3B3FBB3D389863F540E3B4CCE5DE454E6D19811C24001E95777A
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 100800 (seconds)
    TLS session ticket:
    0000 - de c6 06 25 10 c9 22 38-c4 1f 82 d7 c7 b5 62 08   ...%.."8......b.
    0010 - 01 c0 e1 26 e2 64 8a 62-99 74 85 bb 60 bf a8 e0   ...&.d.b.t..`...
    0020 - 65 08 74 89 d5 62 45 e9-b4 f0 80 4e f7 bd ff d5   e.t..bE....N....
    0030 - 6a 12 3b 90 97 ca 7a f4-d1 1b e1 0d 89 d2 52 49   j.;...z.......RI
    0040 - 11 fe 92 82 94 70 ba 4b-5e 81 ff f2 12 62 f4 79   .....p.K^....b.y
    0050 - 11 eb 74 7a d6 ee 10 4e-b5 6d 50 8d 1c 1c 8e 57   ..tz...N.mP....W
    0060 - 19 46 67 91 89 2e 45 28-2e 49 94 8e c8 32 28 bf   .Fg...E(.I...2(.
    0070 - 7b 73 82 ab 63 c4 b7 8f-5c b3 1b 5c 74 59 3c 8d   {s..c...\..\tY<.
    0080 - ec 8a 6a 3a 28 c2 82 c1-d7 d5 4f ec 7e 79 e7 57   ..j:(.....O.~y.W
    0090 - 4a f9 45 e7                                       J.E.

    Start Time: 1348074257
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

The "Compression: NONE" shows that this second server indeed rejects usage of TLS-level compression.

Note also that the first server chose DHE-RSA-AES256-SHA as cipher suite, i.e. a suite which uses the block cipher AES in CBC mode. This first server is then potentially vulnerable to both BEAST and CRIME. The second server selected ECDHE-RSA-RC4-SHA, which is BEAST-immune.

(First server is mine; since I do not use cookies at all on it, I am not nervous about cookie-stealing attacks. Second server is www.google.com.)

If I find the time, I will write a tool which gives such results more easily. There is no need to do a full SSL/TLS handshake, only to send a ClientHello et look at the ServerHello which comes back.


Is kerberos unconstrained delegation partially safer than constrained delegation? When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A, and service A can then request other TGS on behalf of user B. On a first look this would seem less safe than constrained delegation, because service A can authenticate against any other service. But this has a previous requirement. User B needs to authenticate first to service A. If service A somehow gets compromised, it cannot impersonate any user until that user first connects to it, and forwards its TGT.

When using constrained delegation, this doesn't happen, because service A has access to S2U4self. This allows him to request a TGS to itself on behalf of user B. This TGS can then be used to ask for subsequent TGS to other services because it has the forward flag enabled (-f) using S2U4proxy. Granted, it will only be able to impersonate the user against services whitelisted in the attribute msDS-AllowedToDelegateTo (since its constrained delegation), but this seems like a good trade off against being able to delegate any user without the need of that user first connecting to it.

Is my understanding of these features correct? Can unconstrained delegation actually be safer than constrained delegation?

Thanks!

In short: no, unconstrained delegation is not more secure than constrained delegation (that does not necessarily prove the inverse either, but that's a different conversation).

You're conflating S4U2Proxy protocol transition with constrained delegation. Protocol transition is a mode of S4U2Proxy that lets a service request a ticket on behalf of any user without any evidence ticket. If you enable this feature then you've effectively delegated the role of domain controller to your application. This is not recommended for the majority of scenarios and is functionally orthogonal to constrained delegation. It also requires domain admin to enable by default.

Constrained delegation will not let you request a ticket on behalf of another user without that evidence ticket first. There's also an additional mode called Resource-based Constrained Delegation which flips the logic by letting the target service indicate who is allowed to delegate to themselves. If you compromise this service a user must still send an evidence ticket, and even then you can only request a delegated ticket to the approved list both the service and target have agreed on.


Security Implications of Private/Corporate APNs I'm interested in what (if any) the practical security implications of a company making use of a Private APN are as opposed to using a standard network provided APN and VPN connection back to the main corporate network.

On the face of there's some benefit in that VPN software might not be needed but I was thinking that there could be risks around how the end devices are authenticated and difficulties in restricting their access appropriately once connected.

Also are there any known attacks that take advantage of the use of network provided APNs, which could be mitigated by using a private one?

One of the disadvantages from a security point of view of a private APN, if I remember correctly, is that you are only securing the data traffic from the APN onwards, rather than from the device onwards. And unless you are using device policies it is trivially simple to change by the user and by an app.

As for attacks I know of none, my Google foo only brought up this article - How Mobile Carriers Expose Us to Wi-Fi Attacks - and others which discuss APN hijacking by malicious iOS apps.


Hashing bcrypt password hash for use as a password reset token There is an existing user database that has the following columns:

userId (v4 uuid)
created timestamp
bcrypt password hash
email

I must add a password reset functionality and I cannot add any new column to the table. So my plan is to implement the following flow:

user triggers password reset
the server emails a JWT token with expiry time in X minutes and the following claims: sub=userId and passwordResetToken=bcrypt(<bcrypt_password_hash>, 10).
The user opens the link, types a new password and sends it back along with JWT token
The server verifies JWT token signature, expiry time and based on userId in token loads the user information and checks whether passwordResetToken matches the calculated one based on current user state in the database.

This flow is supposed to protect against the same token being used more than once and doesn't reveal user's password hash to anyone.
Any problem with this approach? Can I use userId or created timestamp as a bcrypt salt instead of automatically generated one?
Thank you

This system works, though it's needlessly expensive for your server. Bcrypt is designed for low-entropy inputs that are stored long-term where there's a risk that an attacker will see the digest. That doesn't apply here; the bcrypt digest is technically low-entropy but not dangerously so on the timescale in question (I assume you're looking at a very narrow window, since you mention expiry in "minutes"), and if the attacker could breach the reset token this way they wouldn't need it anyhow (they'd have the password). Besides, you're not storing the result anyhow.
A simple hash (a single round of SHA256 or similar, over the current password hash) is perfectly sufficient and much less computationally expensive. If you want to avoid multiple reset tokens having the same secret in them even when one isn't used, you can salt the hash with a random value, but I don't think that actually adds anything; the actual secret is the JWT signing key and you could, in theory, leave the hash of the password hash out of it entirely! The only reasons to add it are to invalidate existing password reset tokens once the password changes, and to make it more difficult to forge the reset tokens if your signing key leaks (only relevant if your signing key is not also used to sign access tokens). Neither of those uses care whether the hash value is the same across multiple tokens for the same user or not. There's certainly no benefit to using a consistent field (like the userid or creation timestamp) as a salt.

The conventional approach here, assuming you can't alter the existing table, is just to create a new one for the reset tokens. The new table would be indexed (uniqueness optional) on a foreign key to the existing users table - typically either the userid or email would make sense, assuming duplicate emails aren't allowed - and additionally contain a hashed random secret (which need only be a single round of unsalted secure hash function) and an expiry. The actual password reset tokens would only have two parts, the identifier (whatever you indexed the password reset table on) and pre-hashed secret (generated on-demand via CSPRNG for each token). Upon successful reset, you'd just DELETE FROM PasswordResetTokens WHERE TokenId = @id to invalidate any copies (or additional tokens generated for that user, if you allow multiples). A scheduled job could periodically wipe out any tokens that have expired just to keep the table size small.
Given that a password reset operation needs to interact with the DB anyhow, and isn't something you can meaningfully load-balance, there's really no advantage to making the reset token a JWT unless there's extra metadata you want to stuff in there. Even if you're already using JWTs elsewhere, such as for the session/access token, adding more seems like needless complexity. Of course, that assumes you can create a DB table; if you can't do that and can't alter the existing one, then this approach might be next best.


What characters need to be escaped or replaced to prevent xss jsonp callback attacks? I have a service which allows the user to specify a callback function name that wraps the data being returned to support jsonp callbacks. I want to make sure that I am covering all of my bases in regards to preventing XSS attacks.

Note, I have read through the OWASP security checklist but none of the recommendations seem to directly address this question.

These are the currently supported methods for specifying the jsonp function where the function name is cbFn and cbFn is declared on its own, a method on an object, or being accessed from an object/array:

https://service.com/cbFn
https://service.com/?callback=cbFn
https://service.com/?callback=obj.cbFn
https://service.com/?callback=obj['cbFn']
https://service.com/?callback=obj[1]

These return:

cbFn({data: 'data being returned'})
obj.cbFn({data: 'data being returned'})
obj['cbFn']({data: 'data being returned'})
obj[1]({data: 'data being returned'})

However the following requests also work and are the known XSS issues I want to circumvent:

// executes an anonymous function
https://service.com/?callback=(()=%3E{alert(1)})
// replaces the user's callback function with our own
https://service.com/?callback=cbFn=((data)=>{alert(data)})

Is it enough to just replace/remove the characters ()=> in the callback name to prevent XSS vulnerabilities? I want to allow the full valid javascript character set for function names, so restricting the valid character range to /[$_\w]+/ (alphanumeric plus $ and _) doesn't seem to be a good option.

It sounds like you are asking from the context of the service provider protecting a remote client in which case the answer is simple:

As the service provider, you can't protect against XSS at all, and you might as well not bother

Keep in mind, I'm normally big on "defense in depth" and putting in security walls every step of the way.  However I think this is literally one of the few places where your concern isn't worth worrying about.  There are two reasons why:

1. Under normal usage the executing client has full control over the request, and so there is no reason to expect payloads like this

There isn't much more to say about this actually, because this isn't what you are concerned about.  But just to say out loud: the client itself is providing the JSONP callback, and so if they choose to ask you to return actual javascript, then there isn't much of a reason for you to stop them (especially since doing so would be silly and I doubt anyone would bother).  The only other time someone might request a "dangerous" callback from your server is if The remote client has had an XSS breach and malicious javascript has taken over their system.  However, if that happens:

2. The malicious javascript has full control over the remote client and doesn't need you to execute arbitrary javascript anyway

Which is equally simple: if an attacker has managed an XSS attack against a client using your service, they don't have to inject malicious javascript into the callback.  They can just replace the callback method in the local client with their own. In fact, that's much easier.  As a result, there is literally no reason why someone would attempt to use your service as an XSS injection endpoint into the remote client.  To put it simply:

If an attacker has managed an XSS attack against a client using your service, then they've already won and they have no reason to pass XSS payloads into your service.  It would just reflect back on the page they have already taken over.

I suppose there might be some developer out there that came up with some crazy (dangerous) scheme whereby user input on their site is used to build the JSONP callback passed into your service, and it becomes a first-order XSS vulnerability weakness.  However, there is no practical reason why anyone would ever do something like that (having used lots of these kinds of services myself, you would have to go out of your way to setup something that dangerous), so much so that I don't think it is worth spending any amount of your time trying to protect your users from that level of silliness.  You're more likely to accidentally introduce negative side-effects to your regular users than protect someone against the level of poor-planning that would be required for this protection on your end to do anything.


How easily could be truecrypt and EFS cracked in this scenario I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for the files in that partition. I’m not an expert so I have doubts about how easly can this be cracked.
The context is an office working environment, with some co workers willing (and waiting for) to copy valuable and personal information from my laptop. We usually work in the same “conference room” with only one table so the physical access to the laptop is easy. The chances of stealing the laptop is low due to security checkins . The true crypt volume with the protected data folder will be usually mounted while i'm in that room.
A planed attack combining local and remote methods is highly likely.  This is, installing a Trojan/keylogger having physical access to the laptop to later use it to steal the info.

-Weakness :  Even tho I try to lock the windows screen every time I leave a shared room, some few times I’ve forgot it (for example if I need to do something outside in a hurry and ill back later). Also, even I set my screen saver to lock the windows account after 5 mins of inactivity, the attacker could move the pad mouse to keep it active after I leave the room. I have an antivirus installed but as we know that sometimes isn’t enough.

The time that the attacker has psychically alone with the laptop to perform the attack could be around 3 -5 minutes.
A possible attack will look like this:

I leave the room, the account isn’t blocked, the attacker sees the opportunity and install the Trojan/keylogger.
the windows account password is captured.
the hibersys file is uploaded later to the attackers server as well as the target folders.
the files are decrypted with some tool. (like elcomsoft )
http://blog.crackpassword.com/2012/12/elcomsoft-decrypts-bitlocker-pgp-and-truecrypt-containers/
it would be that easy? Am I missing something here? Should ill be worry ?

And what would you recommend to avoid this?

Thanks in advance.

PDTA: after the first incident, I formatted my hard drive and I haven't been in the office since vacations. I'm going back the next week.

Physical presence of an attacker is the hardest to defend against. Some products consider "physical presence" as sign of ownership and allow full rights to the person in front of the machine. For example, motherboards that allow to reset BIOS passwords so as not to lock out an user who forgot his password.

The EFS + TrueCrypt solution is good but it depends on the security of your passwords. Your data is encrypted safely but your passwords are not protected against interception. Keylogging is a simple way of intercepting your passwords but most known keyloggers will be detected by an Antivirus. The attacker can run a program on your computer that looks like TrueCrypt and will send your password to the attacker.

If you leave your computer unlocked in a hostile environment, you cannot have any expectation of privacy and security. There is no way to be 100% sure that you can detect and disrupt an intrusion after the fact. Locking your computer is very easy and you should make a habit out of doing it. Pressing Windows key + L will lock Windows and CTRL + ALT + L will lock most Linux desktop environments.

EFS in Windows Vista and later will encrypt pagafile.sys but not hyberfil.sys which can be used to extract TrueCrypt keys.

TrueCrypt Unencrypted Data in RAM:

  Microsoft does not provide any appropriate API for handling
  hibernation and shutdown, master keys used for system encryption
  cannot be reliably (and are not) erased from RAM when the computer
  hibernates, is shut down or restarted.

Use TrueCrypt full disk encryption to encrypt all of your hard drive.

One weakness of TrueCrypt full disk encryption is when the attacker has physical access multiple times. The attack goes by the name Evil Maid and is mitigated by the use of TPM. Basically, the attacker modifies the TrueCrypt password check code to store the typed password in cleartext for later retrieval. The same goes for other full disk encryption products. Use TPM features if your laptop provide them. Take your laptop at home or lock it with a key if you want more security than Truecrypt can provide.

Update:

One ingenious solution for automatically locking your computer is using this program:  http://stevetarzia.com/sonar/. It uses echoes to "see" if you are no longer in front of your computer.

There are similar solutions using the webcam. https://www.keylemon.com/product/


Anonymity network like tor, but using the model of torrent I am thinking about an anonimity network (just as tor), but using some type of guarantee against mis-usage. For example, which torrent does: there is a tracker, which registers who has given how much how many pieces of a file, and uses this data to help or stop the actual downloader.

I am thinking about the same thing, but not with file pieces, but with network bandwidth.

Thus, you could get for example 1 gigabyte anonimized network traffic - but only if you give 1 giga for other somebody.

Does this, or something such this exist already?

Freenet is the closest to what you mention as it acts as a fully P2P service sharing between nodes in approx. equal ammounts dependent on your settings.
I2P doesn't have the same P2P infrastructure and works purely message-based but can still transfer similar amounts of data just not in the same egalitarian way you mention.

You can find a quick comparison of the two here: https://geti2p.net/en/comparison/freenet

And here you will find a list of other smaller networks a well as the two larger ones I mention above: https://geti2p.net/en/comparison


How to proceed with a white-hat hacker claiming a vulnerability? I am a security member of a small company which recently got contacted by someone claiming to be a Hackenproof member.
They were reporting on our website being indexed by googlebot (metadata, thin page content, anchor text issues) and an XSS vulnerability.

We do not have any legal statement that I know of regarding VDP (vulnerability disclosure policy) yet.

My questions:

Basically how to proceed or even should we? (Are they legit?)
What is the common expectation from a white hacker?
How to validate the vulnerability?

To answer each of your questions:

1. Basically how to proceed or even should we?

I recommend proceeding. You will be able to acquire valuable information that can immediately be put towards improving the security of your company. You haven't told us what the researcher has sent you, but they will either have a description of the vulnerability or methods to reproduce it. To proceed you will need from them:

A description/attack scenario of the vulnerability found. Why is this an issue, what specifically does the bug allow an attacker to do that they shouldn't be able to do, what is the worst case scenario/severity of the finding.
Reproduction steps. What steps could you give any engineer and allow them to reproduce the bug every time.
What the hacker is looking for in return. As mentioned it may be permission to publish the finding after fixing or money.
You might also want or receive remediation advice, risk scores, etc. from the researcher.

VERY IMPORTANT: make it clear to the researcher that you expect them to keep the issue confidential until the issue is fixed. They may counter with a remediation window, e.g. they get to publish and article if the issue is not fixed within 60 days. This is common practice and should be acceptable to most companies with a strong security posture.

2. What is the common expectation from a white (hat) hacker?

Depends on the researcher, but they will likely want permission to publish the finding once it's been fixed as well as a monetary reward. Reward prices are based on overall severity and size of the bounty program. Hackerone, a large bug bounty platform, has a matrix that suggests payouts relative to size of the company/bounty program: https://www.hackerone.com/resources/bug-bounty-basics. Determining payout price is a subtle art - I recommend searching hackerone or other bug bounty platforms for similar bugs and basing your payout on what other companies are paying for the same issue.

Again - a common expectation researchers will have is that they get to publish the finding in a certain amount of time regardless of whether it's been fixed by then. 60 days is common, but I wouldn't agree to an amount of time if you're not confident your company can deliver in that window. After the issue is patched, the hacker may want to validate that the fix was implemented correctly.

3. How to validate?

Use the reproduction steps the hacker has given you. They should be clear enough that any engineer can follow the steps exactly and reproduce the bug. If there are any issues here you can go back to the researcher and get clarification. It is the researchers responsibility to supply the company with reproduction steps that outline and identify the bug.

Once the issue is fixed you can invite the researcher to validate the fix and ensure that it was patched completely.


Does a separate internet connection increase security for remote users? Our network admin has requested that a single remote employee purchase a separate modem in their house for "work" traffic. I question if this is a legitimate security practice of any kind especially because other employees access company resources from home all the time using their shared home ISP.

The one difference between this user and others is that they have a Cisco IP phone. However, with encryption enabled, I don't see how having a separate modem enhances security, except the network won't have other devices on it assuming the user is compliant. However the Cisco phone uses VPN which I think takes care of isolating the traffic.

Is asking a user to have two separate modems, one for leisure and one for work, a legitimate security request that enhances security, or does this not really improve security at all?

I think there are many factors that could make it a legitimate request:

other people in the home who might need network segregation
load balancing
old equipment (getting a newer modem)
VPN configurations

I, myself, have made the same request to a certain remote employee to ensure separation of use within that employee's home. Sometimes it's simply to ensure that the work traffic is not competing with heavy home traffic.

Edit

Public networks are public networks, whether they are the Internet or a home network. If your company has controls in place to securely traverse the Internet, then they should have the same controls on a home network, all things being equal. But, at home, not all things are equal. Home users have physical access to endpoints. That can change the risk model, depending on the situation.


sniff mobile application to find whether packages sent to the third person I suspect that my messages via Viber are being sent to another person - because to my mobile have access a lot of people and it could be possible that somebody installed there some software  or configured it somehow to send my messages to another person

Is there a way to sniff this application and find whether my packages are send to some third person?

Typically you sniff mobile applications using a proxy system. You connect your phone to the proxy and then, obviously, all data runs through the computer/device which is running the proxy. Once the data is running through the proxy machine, you can simply open Wireshark, Fiddler, Charles, or your favorite sniffing tool of choice and start recording the packets.

Personally I prefer using Charles for mobile packet sniffing. Both Charles and Fiddler have the built in ability to set up a proxy for your mobile device which makes them perfect for a task like this. (As far as I know, Wireshark does not offer this ability.) However, despite Fiddler's comparable ability, I prefer Charles because of its HTTPS decryption options. If Viber uses HTTPS, you can use Charles to decrypt it by installing the Charles Proxy SSL Certificate onto the device. (The certificate file can be found here.) Charles does come with a price though.

Charles is a paid application and it's not too cheap. As of the time of this posting, the program is $50 USD for 1 license. Unfortunately, Charles also does not offer free updates to new major versions. So if they released a new major version, you would have to pay for the upgrade unless you purchased within 3 months of the update. Their purchase page does say you only have to pay 40% of the price for the upgrade, but that is certainly not free. Even with all of this in mind though, I do still believe Charles Proxy is a good option.

To clarify, I am recommending Charles Proxy based on my own user experience. I use Charles Proxy fairly often to sniff applications and I have never had any problems.


Testing network ACLs from blocked CIDR ranges I have a requirement to drop network traffic from countries which the United States is under an embargo with. Dropping traffic from certain CIDR blocks is trivial to do with AWS VPC, but I am curious about how to test whether or not my implementation is working correctly.

The options I have determined are:

Block the CIDR range of my own US-based traffic to determine if it drops
Locate a VPN service which terminates in one of the embargoed countries

In 2016 the embargoed countries are:

Iran
North Korea
Sudan
Syria
Myanmar

I am concerned about the legal ramifications of option 2, and the validity of the results generated by option 1.

Are there any suggestions on how to proceed?

One simple way of testing your filters is to spoof a TCP SYN packet with one of the IPs black-listed.

Another way is to check the FW that AWS is offering if it has a simulation feature where you enter the desired packet information (Source IP, Source Port, Destination IP, Destination Port) and see what the firewall will do with it through its current configuration.

In regard to the validity of the offered lists that is not something i can comment since i do not know where AWS is obtaining these lists.

Hope this helps


If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them? Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head:

Let's say that I decide to take Chromium, Firefox, or another open-source browser and make a slight modification to its capabilities: I alter it so that it will only load sites that bear valid Extended Validation certificates, to verify that the page/site is really from the organization/entity it purports to be from. This special EV-sites-only browser would definitely not be intended for use for most "normal", day-to-day browsing, but instead only to visit & login to very sensitive sites that one really, really wants to protect against phishing/impersonation-based credential theft. (Banking & other financial, email, etc.)

Second, let's say that I then create a usage policy (for users in an organization I work for, or even just for myself) that says that those sensitive sites can only be accessed in my special EV-only browser. Maybe I even make my EV-sites-only browser the default one that loads any links a user might unthinkingly click in email & messaging apps, just to provide the most comprehensive protection against fake-login phishing tactics I can.

So, from a practical standpoint*, would a user be effectively safe from site-impersonation phishing if he/she only visited sensitive sites in my EV-only browser?

Or, put another way, if a user ensures that he/she uses only sensitive sites that have Extended Validation certificates is he/she safe from phishing attacks that use impostor sites to steal the user's credentials?

*Note my use of the phrase "from a practical standpoint". Obviously, from a theoretical standpoint a Bad Guy might be able to get a cert authority to issue an EV certificate to him that could be used for an impostor site.  But is that something that actually occurs in the wild today?

let's say that I then create a usage policy (for users in an organization I work for, or even just for myself) that says that those sensitive sites can only be accessed in my special EV-only browser.

I don't think that's worth the effort.

Maintenance of a browser is very hard.

Also: I think teaching users to "use that browser for that site!" might be just as hard as teaching them: "look for the green lock!" -- Although this might be fixed if you just place bookmarks on their desktops that open a site either with one or the other browser.

Still: If you actually have such a list of known-sensitive sites, then you might also do something like set up Nagios to alert you on certificate changes. This would have the additional advantage of alerting admins that know how to handle such a change.

  Bad Guy might be able to get a cert authority to issue an EV certificate to him

The EV promise only holds if you trust the promise-giver. If the promise-giver is suddenly untrustworthy (for whatever reason, hacking, bribery, mistake) then the promise is not worth much anymore either.

After all the EV part of a certificate is just adding another flag to the certificate. And the CA can do that at will. If their internal accountability fails, if the okay, we add this flag if and only if we've actually done the proper identity verification policy fails, then this usually will be non-obvious to any outsider.

This is where Certificate Transparency might help. This would at least make (mis-)issuance publicly detectable.


Changing the SSL certificate chain When connecting to a resource with SSL, I know that the certificates can be validated by the client to make sure the connection is secure.

I recently run into SSL problems at work, when connected to my company's network (only when using specific WLAN endpoint). I did not face any issues when using the web browser, but when I made connections with curl or java I got errors like "SSL certificate problem: self signed certificate in certificate chain" or "PKIX path building failed; unable to find valid certification path to requested target”. I had a look at the certificate chain in the browser and saw that the entire certificate chain of the website was replaced with certificates of my company. However, this was only the case for certain websites, other websites like google or amazon were still loaded with the correct certificates.

So now I have a couple of questions for you. How is it possible to change all the certificates? Why does my browser not complain about this? Does someone know why this is happening only for specific websites? I work at a very large company and I still haven't found the right person to talk to about this.

How is it possible to change all the certificates?

The company is performing SSL inspection on the HTTPS traffic with a transparent proxy. This requires terminating the connection e.g. at the firewall and creating a new TLS connection for the client. This requires creating new (fake) certificates and signing it with an own CA.

  Why does my browser not complain about this?

The root CA used for signing the fake certificates is installed as a trusted CA to the certificate store the browser uses, but cURL or Java doesn't.

  Does someone know why this is happening only for specific websites?

Some sites might be trusted i.e. the inspection is disabled for those sites. There are many practices, e.g. some companies might add manual exceptions, some could only inspect sites that aren't categorized as safe...


How to decide "I'll trust this software" for closed-source or precompiled software? I am interested in watching an upcoming webinar that will discuss Puppet on AWS. In order to participate one needs to install a software application. Naturally, I won't do that as I can find enough information about the subject with a few simple Google services.

However, sometimes there are webinars that I am interested in participating in. What criteria might an average user use to decide if a software package seems safe enough to install. Though Firefox is open source, I'm satisfied enough to trust the Mozilla binaries and I couldn't review all the source alone even if I weren't willing to trust the binaries. So that is a lower limit of what I'll install. What would be reasonable criteria for establishing a reasonable upper limit?

Of course, I'm not looking for 100% security as nobody can provide that. I'm looking for something reasonable for average users who are not software developers. The computer is useless without installing third-party applications, even if the OS provided them via a repo.

Trust is not a boolean variable, "trusted = true / false", you should better think about trust level.

A few example of questions which may help you to evaluate the trust level you can grant to this software:

How much do you trust the editor of this software?
Could the software have been modified by a malicious 3rd-party between being created and being delivered to your computer?
What is the sensitivity of the data you need provide to this software?
What is the sensitivity of the data residing on the computer which will run this software?
How long and how often will need to use this software?

If I correctly understand your question:

You do not trust the editor, otherwise you wouldn't have asked this question in the first place,
This software will just need the information related to this webinar you will attend,
Your computer hosts sensitive or at least personal information which makes you worry about trust issues,
This will be a one spot usage for this webinar, at best for further reference only.

In such conditions, I would just create some virtual machine so I would not worry anymore with any privacy issue while being free to comply with the webinar requests. Once the webinar ends, I will be free to either archive the VM image or drop it.


How bad is rsync with no-password sudo? I need to backup files with preserved attributes from a source workstation to a LAN server (both on Linux Mint, the server is running sshd and Samba). One of the solutions which preserves files' source attributes is to run rsync over ssh, something like that on the client side:
rsync -a --rsync-path="sudo rsync" -e ssh /media/user1/source user2@server:/media/user2/destination/

However for this to work as expected, rsync needs to be added to the sudoer list as NOPASSWD on the server side:
user2 ALL=NOPASSWD:/usr/bin/rsync

This setup makes backing up with attribute preservation work fine. But how secure it is to have a passwordless rsync on the server? Is it inviting problems? Or I'm thinking too much? Our main security concern is unauthorised copying of sensitive data by a motivated hacker. Clearly if you can sudo rsync you can send any file from the server to an arbitrary internet location.
What are your thoughts? If it's that bad, any suggestions on a LAN backup which would preserve attributes from the source on the LAN workstation?

As you may be aware, that line in /etc/sudoers allows user2 to run any arbitrary rsync command as root. This could be used to read or write any system file, including your password hashes and modifying the sudoers configuration to grant more access. rsync alone could even be used to run commands as root.
So it becomes clear that user2 can easily become root and do anything to the system. Your attack surface increases greatly when considering that user2's account is accessed remotely from other systems. If another system is compromised, an attacker could easily pivot to your backup server and become root. Not great on a backup server, that's for sure.
Probably the best thing you could do in the current scenario is to limit the sudo command further. If you are running the same rsync every time, you could probably hardcode the entire server-side rsync command, arguments and all, in the sudoers file. This way, sudo is only useful for doing the backups. You may need to do a little investigating to see exactly which command is being run on the server side.
Or, if user2 is only used for backups, you could make a custom rsync validation script for allowed commands and force it to be called using command= in user2's ~/.ssh/authorized_keys file, but filtering like this is difficult to make airtight sometimes.
Alternatively, the TAR format can be used to preserve attributes, and there are a number of solutions out there to do networked TAR backups.


Difference between Code Injection, Command Injection and Remote Code Execution If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be?

How they are different from each other in terms approach to perform the attack and it's behavior on the target machine?

Hmm let me try:

Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into it and then it could be uploaded into the internet, forums, news servers etc. It is a rather easy form of exploit and similar to a trojan horse. Early viruses were made like this, and spread via users sharing executables. You probably find this still today in "key generators" and other illegal software, as well as in data files like the notorious windows sreensavers ".scr" and other formats that aren´t executables per se but can be loaded with code that gets executed.
Command injection is IMHO using the weakness of an unprotected system to allow execution of arbitrary commands to modify or damage the target system. This could be for example to inject instructions via web URLs and make the remote server execute them. Unguarded SQL strings became famous for this. Either they can corrupt the database or even execute code on the underlying OS.
Remote code execution is to actually again craft malicious code but this time it is not attached to the binary unit, but send via the network. The difference to command injection could be seen in that additionally to the malicious code / script it also needs a weakness or fault of the receiving process, like you would send over a wrong instruction, make the process crash, and then make use of the crash handler to execute code that has been delivered together with your "crash packet". Most modern "zero day" exploits work like this.

I think the terminology is used in a fuzzy way though, so other people might see this different.


PCI - store card details offline I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts.

We have been asked a few times by various customers if we can store there card details, for processing later, citing the fact that other suppliers offer this service.

How could this be allowed? E.g. the offline storage of full card holder data, including the security code (CSC) from the rear of the card?

Under PCI, if this data is received via a non electronic format and with written consent, would this be allowed?

We want to try and accommodate customers as much as possible (especially if competitors offer this service), but we want to be fully PCI complaint. Due the entire offline nature of this case, I am having trouble finding a concrete answer, please could someone clarify?

As under PCI compliance documentation, you cannot store any of the following:

CAV2/CVC2/CVV2/CID

So surely this applies to offline storage as well?

I am sure that I am correct in thinking this can't be stored (even in an 100% offline manor) but I just want clarification, thanks.

PCI-DSS is pretty clear on this point in a few documents:

Here's one for guidance on how to process orders over the phone:

https://www.pcisecuritystandards.org/documents/protecting_telephone-based_payment_card_data.pdf

  the three-digit or four-digit card verification code or value printed
  on the card (CVV2, CVC2, CID, or CAV2) cannot be retained after
  authorization

Period. It does not matter what media is used.


PCI Compilance - Custom payment processor Consider following situation:

We have location A where we have our online store.
We have location B where we have payment processing. Server is dedicated to do only payment processing jobs

We can ask for credit card details at server A, and send it via POST to server B
- OR -
We can ask for credit card details at server B using iframe, and send it via POST to same server
- OR - redirect user to payment gateway B, then redirect user back to my site A

Server A fails vulnerability test
Server B passes vulnerability test

So basically B is our small payment gateway. And we don't store any card details at any time.

Is it PCI compliant?

As a former PCI QSA, my opinion is no. With the detail available, it appears that Server A would be considered part of your card holder environment since credit card transactions are transfered through it via the POST.  In this situation, you would not be compliant with Requirement 6: Develop and maintain secure systems and applications, and Requirement 11: Regularly test security systems and processes.


Does "crypto offloading" require the use of ASICs? Can the concept be applied elsewhere? I'm studying for the CCSP exam and the training material is a little vague on the term "crypto offloading".

The term was mentioned in passing while describing TLS:

  TLS is a protocol designed to ensure privacy when communicating
  between applications.  This can occur between two servers such as two
  SMTP servers passing mail, or between a client and a web server as in
  the case of an application that passes confidential or protected
  information of some type. In years gone by, this type of encryption
  put a burden on both the server and the client, but today's advanced
  application-specific integrated circuits (ASICs) solve that problem.
  These chips are designed specifically to handle cryptographic
  functions and are therefore much faster and efficient than having the
  main CPU in the machine handle the encryption.  This is known as
  crypto offloading, but the term is not included in your test materials.

That got me to thinking though: Is the ONLY way to perform crypto offloading through the use of ASIC chips?  Can the concept be abstracted to a host level where powerful/dedicated systems are handling the crypto operations?  For example, would using hardware security modules (HSMs) be considered a form of "crypto offloading"?  Or at the end of the day, does it all come back to the use of ASIC chips?

Hopefully my question makes sense. :-)

Simply put, not, crypto offloading does not require ASICs.  To expand:

Crypto-offloading simply means removing the computational burden of encryption operations from a general purpose system, and performing them on a dedicated system instead.  The example from your training materials is dealing with TLS, and removing the responsibility for encrypting the connect from mail or web servers, and leaving it to a purpose built SSL terminator instead. The actual underlying hardware (ASICs, in their example) is not important to the higher level concept.

In addition to SSL terminators (or load-balancers with TLS offloading capabilities) some other examples of encryption offloading are layer-2 network encryption appliances, VPN concentrators, or the example you proposed, HSMs, which can indeed serve to off-load crypto operations from an application or service.

Inside the SSL terminator, VPN concentrator, or HSM, you could be performing the crypto operations with ASICs, with FPGAs (as @cHao mentioned in a comment) or even with standard general purpose CPUs.   20 years ago, ASICs were a very common option due to the performance increase they could provide over the general purpose CPUs of the day.  Today, not so much.  You still will find devices with ASICs, but nothing really needs them any more.  Even Seretas's 100Gb/s line rate link encrpytor uses much less expensive and more flexible FPGAs instead.   General purpose CPUs are so much more powerful these days that not only can they handle reasonably heavy encryption as well, but many applications don't feel the need to off-load crypto at all any more...With today's CPUs (most of which even have specific AES instructions for encryption), the demands crypto places on them simply aren't enough to justify off-loading any longer.


Is this idea for a password manager secure? If so, why doesn't anybody use it? I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc. For example, malware could use a keylogger to get your master password and then compromise all the passwords in the password file. Cloud-based solutions also raise the privacy issue of the cloud service knowing when exactly you access your passwords. And there's always the possibility that the cloud service keeps around an unencrypted copy of all your information. Or somebody bribes LastPass's developers with a million dollars to have LastPass send everything to the attacker, or something. More realistically, password managers seem to decrease security in the event of a targeted attack.

I've had a random idea to have a stateless password manager that would basically operate by hashing together a username, the website domain (or some user-chosen site identifier), and the master password to generate the password for each account the user has. In this way, there's no database to be kept around, and it's possible for users to use their passwords on, e.g. public computers by, say, manually computing the hash using some online JavaScript hashing tool.

This sounds pretty secure, but it also sounds pretty obvious, and usually if an obvious idea isn't a thing it's because there's some pitfall. Is there? Why don't password managers do this instead of storing everything in a big file?

One problem with this kind of solution where a predictable algorithm is used to generate a secret from a master password/phrase, is that if your master password is compromised directly (e.g. keylogger) or indirectly (e.g. an attacker with a password of yours generated through this system who can carry out a brute-force attack on it), the attacker has effectively compromised the security of all of your accounts, as they would be able to easily generate the passwords you use for all sites.


Clarification needed on CSR signing process There doesn't seem to be a lot of in-depth information on the certificate signing process other than:

Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF)
RFC 2986 - PKCS #10: Certification Request Syntax Specification, Version 1.7

Here is an example CSR I created:

-----BEGIN CERTIFICATE REQUEST-----
MIIC3zCCAccCAQAwaTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRQwEgYDVQQH
EwtMb3MgQW5nZWxlczEQMA4GA1UEChMHRXhhbXBsZTELMAkGA1UECxMCQ0ExGDAW
BgNVBAMTD2Nzci5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBALsbtWr46Mx8Loal+tKuAFzKHDmzBNr1DG1XlKuO32oVekJW8rkSXdIt
i90g2Bpl9yS8ndFt9djI+Jx0YZp2BnErAbriX7PXXLY13tj3OmO0f8JEAv/5HOaL
qYl79Mr03prhjyTZrlxSPsFuuXfy+arErNet7sqkOua7iexpC6Vx0CTL/YGjzEG3
PA3zAdqKMWnHruSzyAExf/NocLTJ8OdvvAIh2MP79ga8MRtXdM/nEIs6xgnd9B1c
I2mkS0gK7yFCKISZpeSusLJB9SplaOLiH0FBAzslek5WkMVs4AiEahieOMOFtyYR
8v3rKSNvSQW0y29M71AjQq9CA69VrVUCAwEAAaAxMC8GCSqGSIb3DQEJDjEiMCAw
CQYDVR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOC
AQEAGRIzq4nE7KhNZ5vt85gfw6BLM887G/W2A679cXzH7nSjL0Hmr7dii891ak8v
AzgwLKYn6sRBA+cN1bidExcb49v8G7TMOIBxhZjlEewgouBRBZMtNxSJFhD7TSrr
uj7r/tudnztqIjfYL9cXo+MuoGHsGJcXoBSQBIE8jheEUdaAA2LFVaLL+3lQgylL
14iCuY6DR1bF51lZP0zSqdba+mFvAVpspZfcrVClYqsf/xfkiHH7Rx1pz4sDCKTt
WV/7YHDxGXwIjIxkhEwuMX+zz3rO++jy+iBTXnFVwfPogcbLDmcFM/j4JPxuVz4a
nx5Y3pWKymuKNQ58BAguzF+tmA==
-----END CERTIFICATE REQUEST-----

I pasted the above in certlogik.com and had a look at the output.

If I understand it correctly, 4 components will make up CertificationRequestInfo:

Version
Subject
Public Key Info
Attributes

I am assuming that using SHA1 or SHA2, the CertificationRequestInfo is then hashed and that hash output is encrypted using the private key of the computer that is creating the CSR.

When it arrives at the CA, the CA takes the CertificationRequestInfo and runs a hash on it. It then also takes the encrypted value and tries to decrypt it using the public key in the CSR. If the hash output and the decrypted hash output match, then the CA will sign the CSR.

Please correct me if I am wrong with the above. At this point I'm confused regarding to what data the CA actually signs (what data the CA hashes and then encrypts that hash).

The CSR is checked for validity. If it is valid, then the old signature is stripped out and a new certificate is built.

The ingredients for the new certificate are as follows:

Info from CSR (Plus some fields added/changed/removed. Whatever your CA feels is best.)
Typically some basic constraints (Such as the statement: "What I'm signing here is (or is not) supposed to be a CA itself." )
Info about who is signing.
And then the signature itself.

All the pieces that are To Be Signed make up a set. This set is called "TBSCertificate".
And TBSCertificate + signature-parts make up what is then called "Certificate".

RFC 5280 breaks this down like so:

Certificate  ::=  SEQUENCE  {
    tbsCertificate       TBSCertificate,
    signatureAlgorithm   AlgorithmIdentifier,
    signatureValue       BIT STRING  }

TBSCertificate  ::=  SEQUENCE  {
    version         [0]  EXPLICIT Version DEFAULT v1,
    serialNumber         CertificateSerialNumber,
    signature            AlgorithmIdentifier,
    issuer               Name,
    validity             Validity,
    subject              Name,
    subjectPublicKeyInfo SubjectPublicKeyInfo,
    issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                         -- If present, version MUST be v2 or v3

    subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                         -- If present, version MUST be v2 or v3
    extensions      [3]  EXPLICIT Extensions OPTIONAL
                         -- If present, version MUST be v3
    }

There is an excellent blog post that goes into more depth about what is and what isn't actually inside a certificate: Morgan Simonsen, 2013-04-16, Understanding X.509 digital certificate thumbprints (Archived here)


How can I programatically keep track of number of certificate warnings in browser? I want to keep a count of how many certificate warnings have been made in the browser over a period of several weeks. I also want to keep track of whether the user ignored these warnings and just clicked through them. Any ideas on how I could do this? Any plugin out there which extracts such statistics from a web browsing session?

I'm unsure of a easy browser add on but there are web content inspection systems that should be able to count this for you in logs. You would then consolidate and perform counts on the logs if it's not native in reporting. Alternatively, you could group policy something like WinHTTP logging on each individual system in a spool and then you could extract based on error codes.


What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash I found this code, followed by several bash commands downloading and running a payload from the web, in the referer field in my apache error logs. The attack appears to work by converting a command name into a funtion name for the empty function body, (){ :; }.

This is clearly attempting to perform a bash command injection. What servers, configurations, or modules might be vulnerable to this attack?

This is targeting the Shellshock bug (which even has its own tag):

  GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

Affected are any systems which run a vulnerable Bash version and a way for an attacker to inject an environment variable. The most well known case is Apache which automatically sets certain environment variables from the request. You don't need a Bash CGI. See this article about Shell Shock Exploitation Vectors for an extensive list.

In order to defend against this attack you must update your Bash. To test if your Bash version is vulnerable, you may execute the following line from @EliahKagan's great answer:

x='() { :;}; echo VULNERABLE' bash -c :

See Everything you need to know about the Shellshock Bash bug or the corresponding CVE for more information.


Saving passwords and remember me functions (BTW, this is all coded in PHP as I'm sure you'll be able to tell from the function below)

When saving passwords, I am aware that you have to hash your passwords, in fact here's my code (tell me if it's secure enough) :

function hash($password)
{
    return password_hash($password, PASSWORD_BCRYPT, array(
        'cost' => 12,
        'salt' => bin2hex(openssl_random_pseudo_bytes(16))
    ));
}

However, my actual question is whether I am using an appropriate login system, or not. In the next paragraph I'm going to explain how my current system works and can someone please tell me if it's OK or needs to be changed. I've heard that the proper way you're suppose to do it is with a token that the client then saves in the cookies or something.

When the user first arrives on the site, and their account is registered, they're prompted to login. With the password they provided, I hash it and check if it matches, with password_verify(), the password in the database. Once validated they have the correct login information and I can go ahead and authorise them I set in the $_SESSION the username and password (which I understand is stored on the server side), and if they ticked the remember me button I save the username and password (unhashed) in the cookies to expire in 1 week.

Every time they attempt to do a new action, for example load a page like account information, it runs a function at the top of the code which returns if they're authenticated or not, to check if they're authenticated or not, it checks the $_SESSION for the username and password and authenticates them again. If they've ticked remember me and the $_SESSION has expired it grabs the username and password from there.

My concern is that I'm sure most websites use a token system, so that when you login it saves a token in your cookies and then instead of signing in every time, it uses the token. And also on forums for example you can check who's online whereas with mine, you can not.

Can someone please respond whether what I've done is correct, or it must be changed, or it's not the best but technically it's secure. The session part I'm pretty sure is secure, and even more secure than some videos I've watched, some say that you can just store the user's ID in the session which means if they change their password they're still logged in. But the cookies part, it's tripping me up with cookie stealing scares saving it unhashed in their cookies.

I am aware that you have to hash your passwords, infact here's my code (tell me if it's secure enough)

Yes, it's secure. I wouldn't pass the salt though, password_hash manages salts automatically.

  I set in the $_SESSION the username and password (which I understand is stored on the server side)

Yes, it's stored server-side. Still, you shouldn't store sensitive information in the session if it can be avoided - which in this case it can be (you don't need the password in the session at all).

This is a security issue as it may lead to the leakage of the plaintext password, as session data may be read out on shared hosts, via file inclusions, and so on.

  if they ticked the remember me button I save the username and password (unhashed) in the cookies

Again, this is not good. You really don't want to store the password unhashed anywhere, especially the cookie.

Anyone with temporary access to the victims browser would now have access to the plaintext password, it may be accessed via XSS (at least if your cookie isn't httpOnly, which it should be), and so on.

What you want to use instead is some random identifier that you generate and store in the database (ideally hashed).

  The session part I'm pretty sure is secure, and even more secure than some videos I've watched, some say that you can just store the user's ID in the session which means if they change their password they're still logged in. But the cookies part, it's tripping me up with cookie stealing scares saving it unhashed in their cookies.

You seem to know that you don't follow best-practices. So why build your own here? Your approach doesn't seem to offer any advantages, but does have some rather serious downsides.


More specific name for an inside attack I have a scenario where I evaluate two different types of attacks on a distributed network of nodes (you may also call it a multi agent system).

On the one hand the attacker is able to read incoming and outgoing messages of nodes. That is called a sniffing attack.

On the other hand he may pose as is a valid node (going through registration, etc.) and has access to internal control data that is sent through the distributed network. This can be described as an inside or intruder attack. But is there a more specific name in the literature for this kind of attack?

Thanks in advance

I would say a malicious internal actor. Internal actor meaning that he is validly participating in the network, but malicious indicating he's abusing the system.


What would be the best course of action if you accidentally paste sensitive information into a medium you don't control? Ever since the early 2000s, when I was using Linux IRC clients which would paste anything you had in your clipboard when pressing the middle mouse button, I have been scared out of my mind that I would one day have copied my sensitive.txt file content's and accidentally pressed the middle mouse button, causing many linebreaks which were interpreted as "Send", flooding some random IRC channel with my private information.

As far as I know, it never happened, but it came damn close many times. Middle-click-paste was an idiotic invention if you ask me.

The same goes for posting to Stack Exchange. I always type my stuff in a different window and only copy and paste the full text once I'm done. Of course, I always make sure I didn't paste the wrong text before hitting "Submit", but what if you accidentally didn't? Once you have posted it, it takes mere seconds at most for bots to grab that content and supposedly store it indefinitely.

In such a situation, or the one I described with the chatrooms, there is nothing you can do, is there? Just leave in shame and never come back, desperately trying to change your passwords to any accounts that were pasted or trying to brush it off as a "social experiment"?

Like many questions along these lines of "what should I do if", the answer is inevitably "it depends."

Firstly, it's up to you to determine the sensitivity of the information you accidentally shared. If it's something like your Neopets password, that you no longer care about, then maybe it's fine and you take your time changing your password. If it's something like your credit card info, you probably want to contact your bank immediately to get it cancelled.

Secondly, the software might have some sort of edit or delete functionality. Again, you will have to decided on how sensitive the data is and how long it was on the system to be seen publicly. If you accidentally post a secret RPG strategy but were able to delete it immediately, you might decide it's safe and you don't need to create a new plan. However, if it's your roll20 password, or you didn't notice and didn't delete your post for 5 minutes, you should consider it fully compromised and change anything sensitive relying on it.


FTP client development - firewall issues I am working on FTP client for internal usage for deployments. I have started out with WinSCP scripts, everything seems to be working fine, except one operation (deleting large(many files) directory containing files and sub-directories). I know that my targeted FTP server does not support 'recursive directory removal', however it is possible to achieve desired operation by doing recursion on client side (list all files/dirs and delete everything one by one).

WinSCP script line that fails:

rmdir /path/to/large_directory

Error:

Lost connection.
Disconnected from server
Error deleting file '/path/to/large_directory/InnerDir/InnerDir2/dir'.
Error deleting file '/path/to/large_directory/InnerDir/InnerDir2'.
Error deleting file '/path/to/large_directory/InnerDir'.
Error deleting file '/path/to/large_directory'.
Session 'username@ftp.hostname.com' closed.
No session.

After not being able to find solution on WinSCP script, decided to write on my own deployment application using C# and open source library 'System.Net.FtpClient'. However soon enough faced the same issue 'recursive large directory removal' fails. Except this time had more information about error:

Disposing FtpClient object...
Disposing FtpSocketStream...
System.IO.IOException:
Unable to read data from the transport connection:
An attempt was made to access a socket in a way forbidden by its access permissions.
---> System.Net.Sockets.SocketException:
    An attempt was made to access a socket in a way forbidden by its access permissions
      at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
      at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
--- End of inner exception stack trace ---

Challenge: error occurrence is unpredictable, in a sense that given directory which contains only few inner directories or files may succeed or fail, but given larger case it is almost guaranteed to fail. This applies to WinSCP and C# application. So, in theory this is possible solution - keep repeating the script until directory is completely removed, but doing that brings another challenges (manual re-connection is one of them).

While trying many different things, found out that completely disabling Windows 10 firewall did the trick. Thus allowed C# app and WinSCP script run flawlessly.

I need help with setting up firewall correctly, but no matter what I do the problem still persists, except if firewall is completely disabled. I have even created inbound / outbound rules, which should apply for all profiles, all local/remote ip addresses, ports, application/services... still no desired results.

Inbound rule:

Outbound rule:

FTP is a protocol which uses one TCP connection for control and then for each data transfer (i.e. files, directory listing) it uses new data connections on dynamically allocated ports. This makes it a nightmare for firewalls. You have the following options:

Disable firewall (works, but bad)
Allow all outgoing connections and switch your FTP client to passive mode (how this is done is off-topic here): This way the client tries to connect to the server for data transfer instead the server connecting to the client.
Allow incoming connections from port 20 (ftp-data) to any inside ports and switch your FTP client to active mode: A proper FTP server will originate all FTP data connections from port 20.
Use some kind of FTP helper with your firewall. Such helpers use deep inspection of the control connection to find out which ports need to be allocated for the data connections and then dynamically add the necessary rules to the firewall. Note that not all firewalls have such helpers and that these helpers don't work if the control connection is encrypted (FTPS).
Use another protocol instead of FTP, i.e. SSH/SCP/SFTP don't have these problems.


Security of shared "super pin" code table at meineschufa.de The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and is snail mailed to the user at registration.

To reset the password the system selects two positions and requests the characters at those positions.

I wonder how safe this system is against attacks to the server. The superpin cannot be stored salted and hashed because the server needs access to every individual character. Hashing and salting the character at every position (or all the 870 pairwise combinations) would not resist a brute force attack against the hash either.

From this facts I cannot derive an advantage over snail mailing a reset code to the user. What did I miss?

We are talking about the database of a bank, and that's not your average database. It's a special kind of database, when every step is audited, every alteration is logged. So a database leak is very, very unlikely.

If someone can get access to the bank database, why bother with PIN or password for any user? They can go direct to the money.

The reason to send snail mail for the user is that the bank can almost surely know that only the real owner of the account have the reset codes. If anyone else tries to reset the PIN by using discovered information, it will fail because the fraudster don't have the reset codes.

And unless the fraudster can convince the owner of the account to disclose the codes, only the owner can reset the PIN.


Why do some sites not configure their servers to get a SSLabs A rating? As the title suggests, I am wondering why some sites do not configure their servers to get a SSLabs A rating.
I have found a link suggesting why an A+ rating could complicate things compared to an A rating, but no other information. I also do not think that it is because of backward compatibility with older browsers such as IE 11 or Safari 8 (because those implement TLS1.2 and some ciphers with Forward Secrecy, meaning support of these browsers should be possible with an A rating).

Some of it is definitely backward compatibility. While IE11 on Win10 is capable of TLS 1.2 by default, some older versions of IE had TLS 1.2 disabled by default or were outright incapable of it, and some sites target older versions. There's also things like old versions of Android or other mobile browsers, embedded systems with older firmware, and so on.
Some of it is hardware cost. TLS-terminating load balancers used to be (maybe still are?) a common hardware purchase for somebody building a data center or similar large Internet-connected network, and many of those had limited configurability / upgradability and hence might not fully support modern protocols or be unable to turn old ones off. They could be replaced, but are a substantial monetary investment.
Some of it is lack of concern. Lots of sites use TLS less because the security properties are relevant, and more because of the various initiatives to get everybody using it (e.g. Google has talked about prioritizing sites that use it in search results, though I don't know if that ever went ahead). Sites that just host static content, or otherwise have no need for communication security, are unlikely to bother configuring for maximum security. They'll probably just use the defaults, which - on many, many platforms / frameworks - will still not get an A rating, especially using older versions.
Some of it is ignorance. While a combination of general efforts of security experts and some highly-publicized exploits in older versions have generally made people aware of the need to configure for higher security (and of scanners like SSLlabs SSLtest), this industry is enormous and most companies (much less individuals) don't have any security engineering talent on staff. They quite possibly have never even considered the question of what protocols, ciphers, and options to configure on their server.
Some of it is sites' hosting not being under the control of the site's owner. Lots of individuals and small companies use hosting providers rather than maintain their own servers. These hosting providers do not always keep up with the times, in terms of secure TLS configurations. This is deeply unfortunate, since they're in an excellent position to improve lots of sites at once (and since there's a sense in which their entire reason for existing is "we manage your servers" and thus they're arguably not doing their jobs), but it happens.
Some of it is standards marching on and leaving people behind. Lots of configurations that would previously get "A" ratings, and maybe even "A+" ratings, no longer do. Sites that don't keep up may have historically been considered fully secure and then fallen behind when, e.g., TLS 1.1 was deprecated.
Some of it is people having other priorities. Reconfiguring one TLS server isn't that big of an effort once you know how, but a company might not have anybody who really knows how, or might have a huge fleet of servers that would need this done and don't want to take the risk of breaking something, or might have a task to get around to it but it's de-prioritized below 14 months of work. They're not necessarily wrong, either; while there are known exploits for some old configurations, some were deprecated more out of an abundance of caution than due to any known practical attack. Even things thought of as definitely insecure in general, like RC4 or SSL3.0 with CBC, aren't even necessarily vulnerabilities if the only clients intended to communicate with the servers are ones that interact in ways that RC4 biases or POODLE can't be exploited.
Some of it is just not caring. People make bad security decisions all the times, from the individuals who re-use passwords across sites to the enterprise companies who take months to install patches against vulnerabilities being exploited in the wild. The costs of not having an "A" rating are pretty low - most people will never know, and TLS attacks appear to be (so far, and leaving aside things like Heartbleed) super-rare. In a world where phishing is rampant and shockingly successful, why would anybody bother with attacks that require a MitM position, script injection on another site, and then submitting huge numbers of requests just to get one victim's session token? Personally I think that's a bad mindset to have, but again, we're talking about the kind of people who know using a password of their company name in mixed upper and lower case isn't actually that secure but just don't care because who is going to bother trying to brute-force it? and that's way lower-hanging fruit than disabling RSA key exchange.


The source code of Metasploit shellcode can be found in the directory external/source/shellcode/windows/x86/ folder. Depending upon the type of shellcode, the asm file is placed in separate sub folders. For example, the source code for the shellcode windows/shell_bind_tcp is at the location:

source/shellcode/windows/x86/src/single/single_shell_bind_tcp.asm

If you look at the conents of the file, it refers to other files which are included in the main shell_bind_tcp.asm source file. The first file included in the shell_bind_tcp.asm file is the block_api.asm file where the main logic of setting up the environment for executing the shellcode. The line of include look like:

%include "./src/block/block_api.asm"

The next block included is that of block_tcp which setup up the TCP transport, then the logic of ExitFunction through (ironically) exit_funk.asm.

Take a look at Modifying Metasploit's Stager Shellcode blog post from Raphael Mudge on how to edit and then compile the modified shellcode. The source files of the shellcode are documented so you can easily follow what is going on in the Assembly instructions.


How to prevent source code theft in web application development I'm developing a webapplication working with PHP, SQL DB and other technologies. I'm always considering someone stealing the source code or using it to other means.

How can you prevent someone from stealing your source code? If that happens what is the security practices that you can place in order to prove later in court that that source code is yours?

I know some technologies that you can use to prevent and to secure your source code, such as:

Encrypting your files;
Using metadatas to add watermarks to your source code;
Letting all your friends know that you are developing this webapp so you have an alibi;

I would like to know how can you properly secure your source code. How can you place measures to prove later in court that that source code is yours?

I don't know if this next question fits very well in here but I will give it a shot: What proofs are accepted by the court in case someone steals your source code? I'm asking this because I know that in my home country Portugal the courts can't accept Facebook messages as proofs.

It depends against what you want to secure your code.

If this is code which will be used (as source code) in development then obviously you cannot secure anything. My rule of thumb is that one someone can see anything then you cannot secure it (this extends to all kind of DRM protected documents which you take a photo of, run though OCR and poof, there goes the DRM).

As for whether you can protect that in courts you need to ask a lawyer who understands copyright in your specific case.

If you want to co-develop but do not need to share source code, you can work via APIs, shared libraries (which can be reverse-engineered - again ask your lawyer if this is legal or not) or some other mechanism where someone makes use of the functionality of your code, but not the code itself.


Can headphones transmit malware? Can headphones transmit malware? My friend borrowed my headphones (a pair of Apple EarPods) and plugged them into his Android mobile phone for a few minutes in order to listen to a voice message. Would it be dangerous if I plug it into my phone afterwards (since I wonder whether the headphone can store malware which would eventually go into my phone)? Would it be possible to "factory reset" my headphone (just like doing so in iOS)?

I doubt there is a way to store any information (thus transfer information) on regular headphones. Some more advanced models (such as noise canceling) have some processing ability and firmware, but I don't see it as a viable attack vector.