Is there a "security fail forum / website" with lessons learned? I have done some searching, and cannot seem to find this.  Does anyone know of a "security fail forum" that lists embarrassing and / or damaging results from lack of security practices?  I would like it to serve to educate everyone on how important computer security really is, kind of like the drunk driving horrors video is meant to discourage drunk driving.  It would be nice if it also pointed out what could have been done differently, or the lesson learned.  Here are a couple examples:

Example 1:

Security Fail:

Someone let their former friend use their computer, but they did not log out of their bank account before hand.  This "friend" transferred all the funds of the owners bank account to their own bank account!  The owner lost $10,000, quite a costly lesson!

Lesson(s) Learned / Preventative Measures:

Do not let your friends use your computer under your user account
If you do let your friends use your computer (especially under your account), make sure you watch what they are doing
Log out of websites when you are done on them
Lock your computer or log off when you leave it

Following any of these practices would have prevented the incident.

Example 2:

Security Fail:

My website is being repeatedly Distributed Denial of Serviced (DDoS)!  What can I do to prevent it?

Lesson(s) Learned / Preventative Measures:

NONE YET - Awaiting good suggestions!

The Department of Homeland Security offers Open-Source Infrastructure Reports though daily emails, and in tandem with this you may sign up for US-DHS-CERT updates on vulnerabilities.  I don't know of a singular source with this information.

http://www.dhs.gov/dhs-daily-open-source-infrastructure-report

https://www.us-cert.gov/ncas/current-activity

For a comprehensive list, such as the one you are looking for, cross-referencing will more than likely be necessary.

For the specific format of information you are looking for, the IRC site may have this type of information, though you would be essentially entering the 'wolves den.'


Are hardware security keys (e.g ones supporting Fido2) "able to protect authentication" even in case of compromised hosts? Correct me if I am wrong, please.
I understand that 2FA (MFA) increases account security in case an attacker obtains a password which might be possible via various ways, e.g. phishing, database breach, brute-force, etc..
However, if the host where one uses the 2FA device is compromised (full system control) then 2FA is broken. It's not the same as haven the password being compromised  but conceptually this is similar.
Do hardware security keys protect against compromised hosts? I read that the private key cannot be extracted from those security devices. I think about protecting my ssh logins with a FIDO2 key. Taking ssh as an example, I would imagine that on a compromised host the ssh handshake and key exchange can be intercepted and this way an inserted Fido2 key can be used for malicious things.
Additionally: Fido2 protects against phishing by storing the website it is setup to authenticate with. Does FIDO2 and openssh also additionally implement host key verification or doesn't it matter because FIDO2 with openssh is already asymmetric encryption and thus not vulnerable to MitM attacks?

I understand that 2FA (MFA) increases account security in case an attacker obtains a password which might be possible via various ways, e.g. phishing, database breach, brute-force, etc..

Right. With 2FA you need a second factor to authenticate. For example, not only you give the passcode to the guard (something you know) but he also looks closely at your face to ensure that you are "Big X", and not "Spy Z".

However, if the 2FA device

I guess you refer to the common practice of using "something you have" as second factor.

is compromised (full system control)

Depending on the device, this could be quite hard, consider for instance a hardware token:

How would you go about compromising it?

which can also be the very same device then 2FA is broken. It's not as likely as opposed to only using a password but conceptually this is true.

If you compromised the second factor (e.g. the 2FA is in a smartphone app, and the smartphone is compromised) then the second factor is compromised. You still need to also compromise the first factor (phishing the credentials, compromising the computer from which the system is accessed...).
Or you may be referring to compromising a smartphone which has an app generating the OTP tokens and is used to access the remote system. Then yes, you didn't truly have a second factor, as it only needed compromising a single device.

Do hardware security keys protect against compromised devices? I read that the private key cannot be extracted from those devices.

Generally yes. The key is guarded by the hardware device. So if you use a compromised computer to do online banking, with a hardware security key as second factor, an attack wouldn't be able to log in as you later, since he would need the second password: to have the hardware device on his possession.
Please note that it wouldn't preclude the attacker to getting access to your bank page when you log in there. Also, there are multiple types of second factor hardware devices. While all of them require possessing the device itself (this may not completely hold if it's based on a software implementation, though), there are multiple ways of interaction:

Some of them require the user to take an action, such as providing the code showed on a
Some just need to be connected, and they get activated by the computer (sometimes after providing a password). In this case, a compromised computer might be able to get more codes than the user expected.
Others are commanded by the computer, yet they need physical interaction from the user for authorization, such as pressing a button or disconnecting and reconnecting the device. Some even have its own keyboard, so they can be feed a password without the (potentially compromised) computer learning about it

Do take into account the limitations of each approach. A compromised computer could ask you to confirm (via the hardware token) the action "Pay $50 bill to the utility company", yet what it is actually having you sign is "Transfer all the available money to the attacker's overseas account".
The hardware device confirms that the person holding the device the approved the action. However, it doesn't protect the integrity of the message the owner wanted to sign.
In some cases, where the device is not directly connected to the computer, it would even be possible to bypass the through a phishing page. The user provided the second factor bank token to log into the bank account, it just was not the bank web page (the extra effort is that they would need to perform the log in / actions exactly at that moment, as otherwise they would not have the temporary code).

I think about protecting my ssh logins with a FIDO2 key. Taking ssh as an example, I would imagine that on a compromised device the ssh handshake and key exchange can be intercepted and the Fido2 key can be used for malicious things.

The key can be used to sign messages. Just that. If your use f the key is to log in by ssh, it could be used to log in through ssh (which may require hardware confirmation, per above).

Additionally: Fido2 protects against phishing by storing the website it is setup to authenticate with.

More or less.

Does FIDO2 and openssh also additionally implement host key verification

I'm not aware of a specific security key using WebAuthnfor openssh, although I guess that could be done.
Also note that often keys support multiple standards. So you could have a key that supported FIDO 2 and also allowed ssh logins, but the later could be though an interface quite different than the one for FIDO.

or doesn't it matter because FIDO2 with openssh is already asymmetric encryption and thus not vulnerable to MitM attacks?

A ssh login through private key is not vulnerable to a MiTM sniffing the login credentials, since they are never sent on the wire. The user only shows possession of the private key. Which can be in a local file, or in a hardware device, it doesn't matter. It's out of reach of a network attack
However, if you don't do any host key verification, then the attacker could replace the machine you connect to, allow you access to their machine, and then get advantage of the actions you do on that one (like inputting passwords on that remote machine which is not the one you thought it was).


Is it possible to install spyware in password protected android phone? I own samsung galaxy y, an android. I suspect my roommate has installed spyware in my phone. Is it possible to install spyware in password protected android phone ?

The scope of this question is too large. Is the phone stock? Running a custom ROM or rooted? Could he have guessed your PIN (looking at grease marks on screen)? When you say spyware do you mean an app from the store or custom apk?

I would say no, this is not possible, in normal circumstances. If you suspect something why not just wipe the phone and sync all your data back and vet the applications?


Ransomware encryption on opened files I am wondering if ransomware can encrypt currently opened/locked files by an application?
Example: Some application opens files and lock them for manipulation e.g. Database. So I assume that when the system gets infected by ransomware, but database file is already in use, it can't be encrypted until database engine closes all handles to it. Only then, the ransomware can encrypt the database file and during its stealth operations decrypt it when file is again used by the database engine.
For the database redologs, I assume that when new log file is created, it gets encrypted by ransomware while it is still available to database engine due to ransomware operations transparency. Only when required percentage of drive is encrypted ransomware deny the file access, so database will loose access to redologs.
I am aware about techniques (example VSS) which allows to read even locked file in parallel, mainly for backup use case, but that's not for altering the file content or metadata.
My assumption is that all such files, from example above, are safe from ransomware until they keep the lock on the file and consequently also databases backups should be safe from ransomware if not done as offline backups.
Is my assumption correct, or are there any programming techniques which overrides the file handle locking mechanism?
I haven't found answer on the internet, so I hope to find answer here.
Edit: My question is platform independent. Windows, MacOS, Linux and other Unix brands (e.g. AIX, Solaris...) are in the scope.

The "stealth operations" you speak of not only require the ransomware to be able to modify open files, but to be able to modify the data stream returned to the application (in order to hide until it springs the trap).
Either you are talking about a shared library injection into every running process owned by the current user (which can just use the existing open handle to the file to access it), or you are talking about a rootkit (which intercepts file access at the filesystem driver layer).
What might save you is if the malware hasn't performed privilege escalation and the current user doesn't have file-level access to the database, only a client/server architecture accessing it through system services running as a more/differently privileged user.  The mere fact of the file being open is no use at all.


Secure hard drive disposal: How to erase confidential information When it comes to disposing of hardware that may contain PII, confidential, or other sensitive material, how do you determine what needs special handling?  What process do you use?

I'd like to expand this question to not just include computer hard drives, since photocopy machines also have hard drives that maintain an image of everything that was ever printed.

1 - What hardware and devices would you include in-scope for secure disposal?

Would you include just the harddrive, or would you include the RAM as well?

2 - What is the process for disposing of this hardware?

Do you hire a 3rd party, or do you do it yourself?
What are the technical requirements for it to be unrecoverable?

It looks like you are already aware of the 1st part of this question. For most purposes any non-volatile storage which may have held he data you consider sensitive should be included (solid state drives, hard drives, EPROMS, USB keys etc) but volatile memory should not. These storage devices could be in printers, fax machines, routers, switches, any computing platform.

A key prerequisite is understanding what you consider sensitive - eg the configuration of a router may need to be protected to avoid weakening network security, or devices storing personal or account data may come under DPA in the UK, or GLB or HIPAA in the US. A general rule of thumb is to look to the organisation's data classification policy as a guide and destroy data storage which comes under data protection requirements.

The in-house/outsource question could come down to just how sensitive the data is. I recently sat in an excellent presentation on data destruction in the military, where complete outsource was not an option, and complete destruction was a requirement, so the use of grinders which could take entire hard drives down to dust was approved. For many organisations who use hard disc encryption, a provider who carries out multiple overwrites to the extent that recovery is unfeasible may be sufficient. This will depend on both the level of sensitivity and the type of agent who may be trying to recover the data. If an attacker has an electron scanning microscope, they may be able to retrieve useful data off a hard disc platter which has been broken into pieces - but that is only likely to happen if the data is known to be of extremely high value.

Either way, auditable reporting of the destruction is essential - so you can evidence you received all the devices, and destroyed them, along with the destruction mechanism and final disposal details.


What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis? I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and possibly share it with another researcher. What is the recommended process for storing this potentially malicious attachment, given that at least one mail client I use may preview the attachments before I actively click on them?

Should I use a webmail client, and download the file, then promptly zip it? Should I GPG or encrypt the file in another way, to prevent the filesystem from triggering some auto-open payload? Should I create a VM with my credentials loaded into it (seems like a potentially bad idea, should the VM be compromised) for a mail client, and download the file there?

This is different from this question, as I'm looking to store (and transfer) these potentially malicious PDFs.

If it matters, I'm considering using PDF Tools by Didier Stevens for later analysis.

Don't download it on a regular machine, as various services may try to access it for indexing or for previewing, which can be exploitable. But regardless, how advanced do you expect the malicious PDF to be? Who is your adversary? The answer to that will determine whether or not the answer is just to copy it with your AV enabled, or if you need to do it on a dedicated airgapped test machine.

Corporate espionage is often comparable to nation-states in terms of the risks. If you are a large company or in a high-risk business, consider getting a dedicated security team that can deal with this. If in doubt, use an airgapped system for analysis. Qubes OS uses virtualization for isolation, creating a new virtual machine for each application when necessary. Although it relies on Xen and a Xen 0day could easily break out of individual VMs, it can be quite secure when used on an airgapped machine.

PDF parsers are infamously insecure, so expect that it will not be difficult for an attacker of even moderate skill level to be able to achieve arbitrary code execution when the PDF is opened.


Professor wants a Wireshark capture of mail client and browser activity of my own machine As part of a home exercise in my networking class, the professor is asking students to submit a Wireshark capture done on the students' private machines.

The capture must contain activity of the local mail client (e.g. refreshing mails) and arbitrary browser activity (browsing on a website of choice).

The capture should not be larger than 5000 packets or capture longer than one minute.

My device is a MacBook Pro, macOS 10.15, and the mail client would be Apple Mail.

I am worried that the capture may contain compromising data, especially from the mail client, but also other activity on my device which may be happening in the background. Are my worries justified?

Now days, that capture should be mostly encrypted traffic unless he's also expecting you to do a MiTM (Man in The Middle).

Check your capture before turning it in just in case of surprises.

You could also set up a disposable email account to use just for this assignment.

The most likely teaching moment is probably the potentially large amount of ancillary traffic from advertisers and third party web sites that take place under the covers of going to a commercial web page.


What are best practices for implementing Remote Desktop within a corporation? After the recent critical vulnerability: 'MS12-020: Vulnerabilities in Remote Desktop could allow remote code execution'  I have been looking for a hardening checklist or in the scenario that I am an admin at an organization which allows access by Remote Desktop, what would be reasons to disable it or how to implement it securely, apart from Transport Layer security?

Defense-in-depth, patching policy, audit lots, and the standard security spiel are a good starting point.  The risk isn't that there was a critical vulnerability as much as it is having mechanisms to prevent or detect unauthorized access.  There are vulnerabilities that are known and exploited well before a tracking code (MS, CVE, BugTraq) are assigned.

The Center for Internet Security publishes hardening checklists for various devices.  There are likely other organizations that publish similar checklists too.

You can easily disable RDP, but that may not necessarily increase your security posture (say if you're running a vulnerable/unpatched version of IIS with a publicly available exploit package).  Protecting against 0day is a bit tougher, but there are ways to detect intrusion and prevent data exfiltration.


Can a hacker, that knows my IP address, remotely access accounts I have left logged in on my computer? I frequently leave accounts logged in on my personal computer because of the immense physical and cryptological barriers a hacker would have to overcome to access my computer. Could a hacker, that knows my IP address and what websites I left logged in, take advantage of this knowledge in any way?

I hear that IP addresses are very dangerous when a malicious user knows them. Would this even be my first concern if someone knew my public IP address?

No, they would have to have access to your browser cookies in order to abuse them to log into a site you left logged in. Merely knowing your public IP address would not allow them to log into any website. If you are asking this question though, I would not be so sure that there are "immense barriers" between them and your personal computer. A good hacker can do a lot more than you may think.

In theory, a vulnerability in your router could be exploited which typically requires knowing your IP address, but there are dozens of ways to get your IP address anyway. Not to mention, the IPv4 space is small enough that a decent server can scan every single possible IP address in under a day (only 232, or 4,294,967,296 in total, including a large number of reserved or invalid ones). It is more likely that an attacker would exploit a vulnerability in, say, your browser than your router through your IP address. That is not to say that vulnerabilities in routers are uncommon, but the risk of an infection or compromise through some vulnerable or out of date program is far greater.

IP addresses are not very dangerous when a malicious user knows them. This is somewhat of a myth caused by script kiddies (especially of the video gaming variety) who ominously proclaim that they have your IP address and you better watch out, often with the implication that knowledge of an IP address amounts to full access to a network. The worst common scenario is that a malicious user mounts a denial of service attack on your router, causing your network connection to slow down or break. This can be irritating, but is not particularly dangerous.

There are two real situations where your IP address is sensitive information:

If you are dealing with a bitter player for an online video game who you just beat (because that headshot totally didn't hit him) or a spiteful troll on IRC, they may mount a DoS attack against your network in vengeance. In this case, you may want to call your ISP. They may be able to change your IP address or protect you from the attack in order to restore your connection to the network. Even if that does not work, these types of attacks quickly subside. You should probably just avoid associating with the type of person who falls into this category.
If your adversary is a law enforcement agency or any other legally-privileged entity whose goal it is to tie your IP address to your real-life identity, you should be using an anonymity network such as Tor (for web browsing) or a VPN (for P2P). This is the case when your adversary is able to subpoena your ISP to obtain your subscription details. In the past, it was easy to social engineer ISPs to get this information (folks on IRC used to do this to get someone's real address), but nowadays it tends to take a legally-binding court order, in which case your ISP will barf up all the personal information it has on you without giving it a second thought.

If neither of those cases applies to you, you have nothing to worry about.


Understanding salted password hashing using Java Context:

I am using this tutorial and trying to understand and implement salted password hashing using Java. After spending some time on this topic, I figured out that the basic idea is to:

Convert the password string to a character array.
Generate a random salt using SecureRandom(or similar).
Hash the password character array with a standard cryptographic hash function.
Convert the salt and hash byte arrays to respective hexadecimal strings.
Prepend the hexedSalt to hexedHash and save the resulting string along with the hexedSalt to the database.

Questions:

What's the point of prepending the constant PBKDF2_ITERATIONS to createHash(char[] password) method?
Is my understanding of the whole process correct?
Here is the link to my source code - which value should I save as hash and which value as salt?

PBKDF2 is a password hashing function(*); it uses a configurable number of iterations (to make it as slow as is appropriate) and a salt (to deter all kinds of parallelism in attacks). To verify a password, the hash is recomputed, and should yield the same value. To perform this recomputation, you need to use the same number of iterations and the same salt value; otherwise you will get a distinct output and will be none the wiser.

A new salt shall be generated for each new registered password (e.g. whenever a new user account is created, and also whenever a user changes his password), so it must be stored along with the hash value.

The iteration count should also be stored, because it may be modified at some point. In the code you link to, the count is a constant (static final), but its conceptual role is to counter the increase in performance of computers over time: you use the number of iterations to make each password hashing as slow as you can tolerate, because it will also make it slow for the attacker. When you buy a new, faster server, you may want to increase the iteration count (i.e. modifying the source code and recompiling the application, with a higher count). However, in that case, you do not want to invalidate existing, stored hashed passwords. Thus, you need to know, for each stored hash, how many iterations were used for that specific hash. This is why the iteration count is stored along with the salt and the hash value itself.

(*) Strictly speaking, a password-based key derivation function, but let's keep things simple.


Does sslstrip have to do something with Bettercap's certificate? I am trying to perform a MITM attack using bettercap against a website that doesn't have the HSTS security policy implemented at all.
When I try the following command: bettercap -T AddressIpoftheTarget -X --proxy --https-proxy, it works fine. Bettercap succeeds in injecting his own self-signed certificate to the web browser. The browser shows the "Not Secure" warning, and lets me accept the invalid certificate by proceeding to the website in an unsecure way.
When I try this command: bettercap -T AddressIpoftheTarget -X --https-proxy it doesn't work. I don't understand why the --proxy is needed. Is it because it enables the sslstrip? How does sslstrip contribute in all of this during this scenario?

You are correct; the --proxy argument enables sslstrip. The sslstrip module in Bettercap re-writes any https:// links (and also I think by default adds an extra character to the hostname to defeat HSTS policy if it enabled). As to why the --proxy switch is needed - if there is no HSTS, then the initial page will be served over HTTP.


Securing Flask admin pages We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities.

The admin functionality is based on flask-admin package and we are using flask-jwt-extended keeping the access token in the cookies. The passwords are pbkdf2:sha256-hashed with a salt; neither passwords, nor password hashes are ever shown in the admin. Everything is HTTPS.

One other thing we did was moving from the default admin/ to a custom endpoint name.

What else could we do to make the Flask admin page more secure?

Please let me know if any other details are needed.

In general, flask-admin is not different to any other web app and you need to follow general application security guidelines. The OWASP Top 10 is a good introduction and there are more detailed guides too.

If you've written your own controller code it could be vulnerable to flaws like SQL injection.

To configure flask-admin securely, enable CSRF protection

Make sure you have detailed logging of actions within the admin area, which include application layer actions not just HTTP logs, and are connected to user IDs.

Securing authentication is important. You could consider using MFA, and possibly IP restricting admin access. In addition to password hashing, you want a decent lockout policy, password strength checks, and to ensure your forgotten password process doesn't undermine this.


Need for additional verification in mutual TLS authentication with own CA Say, the goal is to facilitate secure communication between two parties. The definition of secure is that

both parties can be sure that they are actually talking to a trusted party, not somebody else
they can be sure that no third party is listening to the communication

Furthermore, I have a Certificate Authority (CA), and the two parties (rightly) trust all certificates coming from that CA. Only trusted parties have a certificate. They do not trust any other certificates. The possession of a valid certificate from CA is counted as evidence that the owner of that certificate is trustworthy.

Under these circumstances, i.e. TLS with mutual authentication with single, controlled CA, is a Man In The Middle attack possible without prior possession of a certificate from the CA? Is there any need for additional precautions, such as host-name verification?

First, a brief on how TLS works and why it is used-

TLS is used to provide encryption to the data stream and form a secure channel between the user and the server. A TLS Handshake is used to authenticate the server and generate the session keys to be used in the encryption process. TLS uses a combination of symmetric and asymmetric cryptography and hence, a prerequisite for this is that the server and the user need to have public and private keys generated for themselves. Additionally, The server needs to have a valid SSL/TLS certificate which it can send to the user, which the user can then use to verify the server’s identity (checking with the Certificate Authority that issued it) and also get the server’s public key. The user sends a premaster secret encrypted with the server’s public key and the server decrypts it using its private key. Both parties now generate the session key using this premaster secret and previously exchanged nonces.

As long as the Certificate for the user is valid, the data is encrypted, and hence secure in transit.

Without the Certificate from the CA, A MITM (Man in the middle) attack is very well possible as the public key received can not be verified.
Even stolen certificates are a problem (Refer to the Stuxnet attack for more on Stolen digital certificates from Realtek and JMicron).

I hope I answered your question correctly :)


Exploiting an XSS vulnerability This question is related to a class project involving a team of 2 students against another team of two students. We both have servers with a default plugin that we have a week to patch vulnerabilities in, and another week to attempt to steal information from the other teams server. The server has 2 users and an admin with their passwords hashed on a mysql database on the server. We must gain access to the admin account and also deface the website in some manner.

My teammate and I have located a XSS vulnerability like so: www.example.com/dir/page.php?speed=--></script></head><script>alert("Problem here"); </script>. What are some common ways in which we could exploit this vulnerability to gain information or deface the website. Also, no users will be logging in and we cannot send a malicious link to anyone because no one will click on it.

If you know for sure that no user will ever be logged in, you can't really do that much with a reflected XSS vulnerability (you can't steal cookies, you can't post requests on their behalf, you can't perform phishing attacks, etc).

I would still consider this a possibility to deface their website though. Sure, it's reflected, but if you post a specific link somewhere, and someone visits it, their website will show content you control, which obviously should not happen (and which is pretty much the definition of defacement).

If there may be a reason that the other team does log in (for example, the requirements may change, and the contest may require them to log in), no one will click a malicious link doesn't necessarily need to be an obstacle. You don't need to send the other team a link to their website, you just need them to visit a website where you can place JavaScript code. It does require a bit of social engineering, and may be difficult (as they are expecting attacks), but it doesn't necessarily have to be impossible.


Digital Signatures of XML, PDF and Office Documents on every platform I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not sending away the user's private key. This key (in theory) must be always with the user and it must not be sent to the web (even if protected with SSL, for example).

I want that every platform may be able to sign the documents. I've already developed a Java Applet with the signing algorithms, but Java is not supported in iOS or Android.. In .NET is impossible too. So I think I'm restricted to JavaScript, but I'm not aware of any javascript library that signs XML, PDF and Office documents.. What should I do? Only with Javascript every platform works..

Disclosure: I work for CoSign.

You're raising the common question of digitally signing data at the network "edge."

Good luck on the idea of signing at the client/edge, for the reasons that you discuss. And forget Javascript, it is completely insecure from the cryptography point of view.

You're right that the signers' private key shouldn't be sent anywhere.

Good news: there is an alternative architecture that will:

Not require that the private keys be sent anywhere
Protect the private keys
Enable signing from clients of all types including mobile, Android, .Net, iOS, etc.
Decrease administrative costs by centralizing the keys and key management

The answer: use a centralized signing appliance. The appliance is hardened at the hardware level: if you try to open the box, the keys are destroyed. Signing appliances are made by my company and some others.

In this system, the document (or better, just its hash) is sent from the edge device to the centralized signing appliance. The user also authenticates with the appliance (using any one of a number of techniques). The appliance holds the private keys. It signs the hash, and returns the digital signature to the edge client.

Depending on the capabilities of the client, it can:

Assemble the signed document itself (combining the digital signature with the source document). Benefit: less data needs to be sent between the edge client and the signing appliance. Issue: requires more sw on the client. Or:

The appliance can return the complete signed document. Benefit simpler implementation on the client but requires that the document be sent to the signing appliance from the edge client.

Note that an entire PDF document doesn't have to be sent back--the PDF digital signature is simply appended to the source document. So the flow can be:

Send the entire PDF for signing. (Or just send the hash if the client can calculate it.)
Receive back either the entire PDF (signed), or just a "tail" that, when appended to the source PDF creates the signed document.

Multiple data types
My company supports signing of PDF, Word, Excel, XML and other document types out of the box. Eg Word documents are signed using the Word "standard" -- a digitally signed Word document can be verified by a recipient (relying party) without installing anything beyond Word. No plugins, etc.

Signer Authentication
Signers need to authenticate themselves with the centralized appliance. My company supports multiple types of authentication including OTP and 2FA.


OAuth2, SAML, OpenID connect - Which one to use for my scenario? I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites and we also spend alot of time removing accounts when customers no longer need access.
I would like users to register for Site A. After successful authentication; a user can click on a link within the site to access Site B but without the user entering credentials. I want Site A identity to be used to access site B and its resources. I do not need site B resources to be presented on Site A site, but simply allow users to access site B if already authenticated to site A.
Users may have different roles on site B.
What is my best option? Oauth2 sounds like a good option. But will it satisfy my requirement above?
Who will manage the authorisation server? I presume Site B?
Thank you.

OAuth2 is a framework for authorization, if your request is about the identity of the users then you should consider using OpenID which is part of the global framework OAuth2, but for a special use case: authorize access to the identity.
As for SAML, you can configure one of your servers as identity provider and the other as service provider, but the hard part will be assigning different roles for the different servers A and B.
OpenID can be more easy to use when you have roles or scopes to exchange, you should install an SSO solution (like openam, gluu, keycloak) on your server A, users will be redirected to authenticate, and their session will be valid for server A (or a seperate server), as for server B an OpenID request is sent by server A to server B, which will contain a request for authenticating the user, with scopes relative to server B, for example:
  curl -k --data "grant_type=password&password=1234&client_id=app-profile-vanilla&scope=scope_sever_B&username=100000&client_secret=578262e1" http://localhost:8180/protocol/openid-connect/token

Result: {"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJCaTM1c2VPQTh4c290bzQ5eTMwTXNpNVZ6MW...","expires_in":60,"refresh_expires_in":1800,"token_type":"bearer","scope":"email profile scope_server_B"}

This example is just to demonstrate how its works, in your environment you should use authorization code flow, which is the default flow for a user, and since the user is already authenticated to server A, the authorization server will pick its session and created another one for server B, without the user having to do anything.
Another advantage of using OpenID is that in case you wanted to add more sites, the configuration to include them in the sames process would be very easy (create an OAuth2 client, configure scopes, configure the new server), which is relatively easy compared to SAML2 integration.


Docker containers, environment variables, and databases Environment variables (set with -e) in Docker containers are available to every linked container.

Consider a typical use case, a database. The official MySQL image gives this example command:

docker run --name some-mysql -e MYSQL_ROOT_PASSWORD=my-secret-pw -d mysql:tag

I have just put my password as plaintext inside an environment variable. To be sure, you need to docker inspect to see it, and if you can do that, that means you have root access to the host OS, which is game over anyhow... So let's move on.

Now I want to set up a wiki as well. Let's use this MediaWiki image. We also need to link the database:

docker run --name some-mediawiki --link some-mysql:mysql -d synctree/mediawiki

Oops! When I linked some-mysql, the environment variables propagated and now some-mediawiki can see MYSQL_ROOT_PASSWORD as well! This means that if someone were to compromise the wiki, they can potentially also find out the root password, and then get into the database with it through the link.

There has been some discussion by Docker devs about this, and the conclusion is that environment variables were never meant for sharing secrets securely anyway, and it is a mistake to use them in this way. Yet all the time I see images passing the password as an environment variable, even many official database images do this. Why?

A clear answer to your question can really only come from the maintainers of the individual images that are "mis"-using this feature, however some possible explanations are

They aren't aware of the risks.  Docker is a relatively new technology to a lot of people and "best practice" isn't always clear for everyone, although the docker devs have made good efforts in this regard with things like the CIS guide
They're aware of the risks but have decided that it isn't a serious issue to their particular architecture.  This may be the case, for example where other aspects of the system mean that the linked containers are required to trust each other, so compromise of one container leads easily to compromise of the other, regardless of environment variable sharing.
They're aware of the risks, but lack a better alternative.  Ultimately service password management is a tricky problem to solve well and depending on the software in use on the containers, there may not be an option which the maintainers feel would work as well as using environment variables.


XSS MySQL Database Accessible? I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page.

I have the following link. When you go to this link, the text I've enclosed as code displays on the site:
www.site.com/languages.php

{"languages":"
\n
<\/a><\/div>\n
English<\/div>\n <\/div>
\n
<\/a><\/div>\n
French<\/div>\n <\/div>
\n
<\/a><\/div>\n
German<\/div>\n <\/div>
<\/div>\n ","Russian":{"html":"
\n<\/a><\/div>","list":["57"]}}

I change the link to this and the text changes accordingly:
www.site.com/languages.php?list[]

{"languages":"
\n
<\/a><\/div>\n
English<\/div>\n <\/div>
\n
<\/a><\/div>\n
French<\/div>\n <\/div>
\n
<\/a><\/div>\n
German<\/div>\n <\/div>
<\/div>\n ","Russian":{"html":"
\n<\/a><\/div>","list":["","57"]}}

I again change the link and get this corresponding text:
www.site.com/languages.php?list[]=whatever

{"languages":"
\n
<\/a><\/div>\n
English<\/div>\n <\/div>
\n
<\/a><\/div>\n
French<\/div>\n <\/div>
\n
<\/a><\/div>\n
German<\/div>\n <\/div>
<\/div>\n ","Russian":{"html":"
\n<\/a><\/div>","list":["whatever","57"]}}

Yet again, I make the following change in the link and get the following on screen (whatever onwards is displayed in a red color):

www.site.com/languages.php?list[]=whatever

{"languages":"
\n
<\/a><\/div>\n
English<\/div>\n <\/div>
\n
<\/a><\/div>\n
French<\/div>\n <\/div>
\n
<\/a><\/div>\n
German<\/div>\n <\/div>
<\/div>\n ","Russian":{"html":"
\n<\/a><\/div>","list":["whatever<\/font>","57"]}}

It is possible to access the database with XSS,  if an attacker delivers an XSS payload to a browser that has database access.  XSS allows an attacker to control a browser,  if that browser is an authenticated user then an attacker can carry out actions as that authenticated user.


How many ways are out there to know IP of client from website? If we are behind a VPN, then in how many ways we can try to find the ip address of the client? here are some that i know
- Torrents (most people say torrent expose real IP)
- Javascript (but how can they? )
- Web-RTC requests

My point is, i opened a website in firefox private browser, behind a VPN, i checked myself that my IP was not leaking, DNS was not leaking, VPN was working fine, my actual IP was of other country when i checked from different sites, but the website was able to find my actual country where i am. (not sure if it was able to get my location too)

So how is that possible? can just javascript be used to send my real ip , country or location to site owner ?

You assume the website identified the country via your IP address. How sure are you that this is in fact the case?

Modern browsers have a geolocation API which is accessible to javascript if you opt in (e.g. you should get a warning message when javascript wants access to your location).

Determining the geolocation can be done via IP address, but might also be done via wifi signal, mobile signal or gps signal if available. It's possible that your browser is leaking your geolocation not via IP address, but via one of the other venues, especially if you're browsing from a smartphone.


where did they get my Gmail address? I pointed my browser at the website of a web developer I barely know, and the page returned was his home page, with the message "Welcome myname@gmail.com!"

Whoa. Where did it get my Gmail address? Never seen that before. I was logged in to that Google account at that time, but somehow that login account is accessible to someone whose web page I go to. That info sure isn't contained in any Apache logs, though certainly my IP address is. I am aware that Google makes all kinds of information available to users, unless one tells them not to.

How does one prevent one's Gmail address from being transmitted to a website, so as to preserve some semblance of anonymity?
How do you set up a website to get that info?

The website is simply asking the Google login handler to display the information to you -- and then placing it on the website in such a fashion that it appears to be the website knowing your logged in account. But in truth it's just a tag to them, like <%InsertLoggedInName%> or something like that.


Indexing of URLs over IM protocols Recently, I scanned a physical document for a friend, put it on my web server so that he could download it, and sent him the URL over the MSN chat network. I removed the file again shortly afterwards, but about an hour later, I got the following HTTP request for the same URL:

65.52.100.214 - - [15/Apr/2014:03:58:48 +0200] "HEAD /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "-"

65.52.100.214 is neither me nor my friend, but is in fact registered to "Microsoft Corporation", if whois is anything to go by. Note that it's a HEAD request, so Microsoft never fetched the actual contents.

About a week later, I started getting multiple requests per day to the same URL from various IP addresses with weird user agent from all over the net. Here are but a few of them:

74.217.148.74 - - [22/Apr/2014:22:36:14 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ;  Embedded Web Browser from: http://bsalsa.com/; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; msn OptimizedIE8;ESES)"
64.124.203.74 - - [22/Apr/2014:22:52:51 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; GTB6.4; SIMBAR={DBAB9A86-8527-4206-A26B-A5C3AFEEFC8D}; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; eSobiSubscriber 2.0.4.16; .NET4.0C; Windows Live Messenger 14.0.8117.0416)"
64.124.203.71 - - [30/Apr/2014:23:26:39 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; chromeframe/11.0.696.57; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; SLCC1; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; Tablet PC 2.0; .NET4.0C)"
208.50.101.158 - - [03/May/2014:01:10:28 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6.6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; ibrytetoolbar_playbryte; ShopperReports 3.1.69.0; SRS_IT_E8790771BC76555133AA96; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)"

(The complete list can be seen here.)

Note that this URL has 404:ed ever since that day. Though, I'm not sure whether the file was yet removed when the first request from Microsoft was made at Apr 15.

Neither me nor my friend knowingly used the URL in any other place. Does this mean that Microsoft is scanning MSN chats for URLs, and sometimes does "stuff" with them? What is even happening in this following barrage of requests? Or is there some other explanation? Is this behavior known and documented somewhere?

I have also, of course, shared a lot of other private URLs over MSN, without detecting them having been scanned.

Microsoft does indeed scan URLs in messages to see if they are "spam, fraud, or phishing" links.  They assert this is the only reason they use them.

I'm not sure if the other requests from weird UAs are microsoft as well, but it's a fair bet, unless they're leaking the URLs somewhere.  Given the "OfficeLive" in some of the user agents, I'd guess they're Microsoft, but of course, it's trivial to send whatever you want as a User-Agent header.

See:

http://www.h-online.com/security/news/item/Skype-with-care-Microsoft-is-reading-everything-you-write-1862870.html
https://news.ycombinator.com/item?id=5704574


Embedded system - is it a good idea to run the user application as root? I'm working on a Linux powered consumer electronics. Everything user interacts with is running as root (legacy design). Should I make the application run as its own user with restrictions?

Should I make the application run as its own user with restrictions?

Yes!


Single key pairs for SFTP I have a single machine (client) and several servers and I need to take from them several files through sftp. My idea is to generate a pair of public and private keys in the client, and copy the public key to the different servers to be able to access them later. Does this make sense or is it a bad practice?

Yes, this makes sense.

With key pairs, the private key is important to keep secure, and in your scenario you're generating it on the client and keeping it only on the client.

The public key can be copied to as many places as you'd like to log in to, without threatening the security of your logins.  This matches what you're doing, copying it to the servers you need to access.


Are non-English speakers better protected from (international) phishing? After I received dozen of spam mails over the last year with my thrashmail (used for "You must log in once to check out this product.."-Sites, etc.) I noticed they were mostly translated (if they are at all) horribly.

I thought about that after reading the Wikipedia article about the ransomware "Locky" where the Spam Message pattern was shown.

  Dear (random name):

  Please find attached our invoice for services rendered and additional
  disbursements in the above-mentioned matter.

  Hoping the above to your satisfaction, we remain

  Sincerely,
  (random name)
  (random title)

Refering to my experience, only a few mails were translated well enough to even consider it as my native tongue (German, by the way).

So, I was wondering If non-English users are theoretically better protected from international scam/phishing than native speakers. Of course there are a lot of properly translated versions out there, or they are also based in the same country, but my inbox is dominated by non-German Spammers.

Or would you (as a 'normal' user) trust a [insert random title here] who can't properly speak your native language and therefore sounds like Master Yoda with Dyslexia? Or if it was in English I'd wonder "Why the heck would a [insert radnom country I've never heard of] Lawyer write to me in English?"

I believe these users are a bit safer, as Phishing is mostly about gaining the victim's trust.

I'm interested in whether this thesis is true.

Edit: It's awesome to see how multifarious the Answers and Comments are. Kudos to the Stack InfoSec Community.

There is a really, really good paper on this here.

Tl;dr:

95% of spam is in English
In f.ex. Germany only 17% of the spam is in German
In Scandinavia it's less than 1% in the local language

Conclusion I: Yes, generic phishing is mostly directed to English speaking people. I can only confirm that many German people will not even consider opening a mail with a non-German subject.

Conclusion II: The main factor for the phishers will be to gain proficiency at the target language. Target languages are English and other "first world" languages, but they are differently hard to learn. Since it's much easier to auto-translate and learn basic English than for example Icelandic, phishing will be much less effective on non-English speakers.

But: Spear phising is much more dangerous and will always be done in a local language, so statistics can't take that into account.


CSRF Token for Anti Automation for multiple requests Need some inputs for  the CSRF token  design to prevent anti-automation.
1. When a page loads for an user session, a request is given to the server, which would fetch the CSRF token , returned as part of the Get Response of Page Load.
The idea is to provide a solution, where no major state is stored on the server-except for one token for each user session per request.

Every time, a request is made( Get/Post), the existing token is validate and a new token is returned from the server to the client.
This is stored in the user session.
On sending the post request, client validates whether the token value is equal to value in the session and server validates, whether the token received in the request is same as the token stored in the session.

When the user performs an action, there can be multiple requests to the server at a point  of time from the client side.
Or before the earlier request's response is  received , there can be another request send from the client application.
In this case , would the same CSRF token be send?
Or should a pool of tokens be returned from the server for the same?
Can this token's also be used for Get requests so as to prevent the attacker to not clog the server with  replay attacks with the get requests?
Also, should the CSRF token send in the header or body?
Is there any need for it to be encrypted?

Generally CSRF-Token is used only when the state change request is made by user. State change means when user perform some CURD Operation on Application.

It’s not required to gives bunch of CSRF-token to every form in multistage form. But generally Programmer gives to every single form. Whether that Form is contain any state change action or not

We generally not recommended to use CSRF-token in get request because of GET request logged at multiple places (Logs, Load-Balancer etc.) so it creates risk for your Application .

Questions:

1) For Updating operation, there are multiple requests send to different modules on the Server. should the CSRF be same or different?

Ans : You  can use the same CSRF-token issue one token for each user-session. If your application is perform critical operation than you can go for one token for each form.

2) Before a response is received, the screen is allowing user to initiate one more request? what should the CSRF token be send? The assumption is that, once the CSRF token is validated, then a new token is generated and send in the response.

Ans:if your application uses the multiple token for a single form of action, then you need to validated that token in each request and in response new token will be given to the user. But generally we haven't recommended these kind of complex implementation. if it is not that much critical application

3) CSRF should be send in header or body? Should It be encrypted?

Ans:Always in the body not in cookie. There is no need to do encryption on CSRF-Token. It is nothing but a Secure random generated string for validating that the action is intended by that user or not.

For More Details

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet


Prevent Brute force attacks on WordPress with SSHguard I've installed sshguard: sudo apt-get sshguard -y and it works fine (I tried to "brute force" my own server and was blocked).

I desire to utilize sshguard to defend form brute force attacks on WordPress. I've read the this tutorial and understood I need to do 2 things:

1) Totally disabling XML-RPC in WordPress.

Yet from the comments here I understand that totally disabling XML-RPC is an outdated, redundant operation in WordPress 3.x.x and so forth (and I use at least WordPress 4.7.x)

2) Put this location block somewhere inside Nginx conf (it wasn't clear to me from the article where exactly):

location "/wp-login\.php" {
  access_log "/var/log/httpd/wordpress-logins.log";
}

Does indeed all one has to do to protect WordPress login from brute force attacks is to add this location block be to the global /etc/nginx/nginx.conf (inside the server block there)?

Or I might have misunderstood the authors intention.

Does indeed all one has to do to protect WordPress login from brute force attacks is to add this location block be to the global /etc/nginx/nginx.conf (inside the server block there)?

More or less.

You add the line to nginx.conf which indicates that every time someone tries to access a url that looks like the login page, the request gets logged to disk. SSHguard is going to monitor and analyze the log file continuously and presumably update iptables if the number of hits to that page from a specific IP exceeds a certain threshold.

XML-RPC as implemented in Wordpress can only be described using strings of obscenities. It's critical to a lot of third-party plugins so disabling it will break those, but leaving it enabled will also open you up to additional bruteforce authentication attempts. If you're using Jetpack or similar I'd recommend you add /xmlrpc\.php to nginx.conf as well and tweak SSHguard so it monitors page requests there too.

One problem you'll quickly come up against after doing all this is that only the laziest of attackers bruteforce from a consistent IP address. You'll quickly find a misappropriated IoT/botnet bruteforcing you from a variety of IP addresses over time to circumvent your defenses, but it's a worthwhile step to at least stop basic attacks.


Can a secure invitation link be sent client-side only? One mechanism for inviting a user to join a community in which private, personal information is to be shared is to generate a time-bombed (5-15 minutes) confirmation link with a string generated with a secure random number generator and email an invitation message to the invitee with this link. For example:

  Hello! You've been invited by ____ to join ___. Visit mysite.example.com/confirm/Ip10QEUECfkw2XFTSvzt88oj to join.

I can implement this by generating the link server side and sending the email server side. The link in this case is never exposed to the sender, ever, and is only (1) stored in the invitations table in the database, and (2) appears in the email, sent by the server (Amazon SES for example).

My question is: can a client securely send this email with its native email client? I've been told a lot of systems do this, and that the invitation email, with the secure link exposed, goes into the "Sent Items" folder on the client's email app! This strikes me as bad because it seems that client-generated links that the server has to know about expose too much. Why not take the sender out of the picture completely?

Is the generation of an invitation using a native client email okay? Seems it relies entirely on the expiration of the link for security. Is this an acceptable trade off of security for convenience? If it is not okay, why do folks do this?

First, email is not secure. If you need strong security, you can't use email. Email can be sent on the wire unencrypted, it is unencrypted by interim mail servers, and potentially stored in the clear in the user's mailbox. You can google or look on this site for more info about email security.

So let's assume that you decide you can live with the insecurities of emails...

Typically the point of sending a verification email is to verify the user's email address. You cannot do this from the client as the user will be able to capture the link and use it without proving that they have to the email.

In short, I see no point in emailing the link from the client. Either you don't need to verify the email address, in which case don't bother with the email. Or you want to verify email address, in which case you must send the email from the server.


Status of Trusted Computing and Remote Attestation deployment Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM).

I've heard of one practical application, for convenient disk encryption via a "Transparent operation mode" of BitLocker.

What other examples are out there of applications of trusted computing technology?  I'll separate out two categories of interest.

Stand-alone, protects "me the user and owner" from modified files.  Bitlocker is one example, but this also includes e.g. "TXT late launch" from an untrusted environment into a trusted virtual machine, as discussed at Attacking TXT (Joanna Rutkowska))
"Remote attestation": demonstrate to another system that this one is running approved software (e.g. to allow a server to trust a browser, for fairness in online game playing, etc)

Open source applications are of most interest to me.

Note: I'm very aware of the issue that TC can be viewed as "treacherous computing", due to the various threats to user control e.g. via more effective DRM, and associated political issues.  But please don't discuss that side of it here.

Generally one has to know what TPMs and TXT and all these technologies are aimed to protect from, because there are misunderstandings.
TPMs, generally, enable 5 distinct processes, and only those:

Integrity measurement – computation of a cryptographic hash of a platform component
Authenticated boot – a process by which a platform's state (the sum of its components) is reliably measured and stored
Sealed storage – the process of storing data on a platform in such a way that the data can only be retrieved if the platform is in a particular state
Attestation – the process of reliably reporting the platform's current state
Isolated execution – enables the unhindered execution of software

From the Intel perspective, TXT is the entirety of trusted computing functions including the TPM, modifications to the operation of the processor and modifications to the operation of the chipset.

Main features of TXT technology are all those of TPMs plus

protected execution (hardware-based domain separation)
protected memory pages (providing protection against all four different ways memory can be accessed - through software, through DMA, through GPU cards, through SMM)
protected input
protected graphics
enabling trusted channels (between two computers or devices between one computer)

The Late Launch feature you mention is an optional TXT feature to enable measurements to occur after a system has been booted instead of every step of the boot processes, it's somewhat complicated.

Generally Trusted Computing is a huge project, with much research going on around the world for years, and has short term, mid term and long term goals. I must disclose here that I'm part of that research.

Now on to real implementations (although these are outside my field)

First of all, all major system manufacturers have enterprise hardware and software that makes use of TPM's, some features of it a least. Companies like Dell and HP that produce the majority of enterprise systems use software like (HP ProtectTools). In this example, pre-boot authentication is used with the help of a TPM. Microsoft has been in this research since forever, and has relased bitlocker with support for TPM before Vista. Actually bitlocker is not only about encryption: It has a separate feature named Secure Startup that implements the integrity checking part (it could be there without the encryption component). Transparent operation has to do with authentication - it can work in pre-boot auth mode as well. Also security software ventors, like symantec and mcaffee have software that relies or makes use of TPMs.

Now, I'm not aware of any other commercial or ready-for-use open source software dealing with TPM's and attestation or any other feature. (but as I said I haven't looked much, maybe another member knows more).

If you want experimental tools, proof of concept software or just papers and specifications, there are lots of that - as I said there are long-term goals in the project, and attestation is one of the long-term goals. Here is an example, reference implementation of the software stack necessary to support all features of a TPM in linux: http://www.opentc.net/publications/OpenTC_PET_prototype_documentation_v1.0.pdf (software is at http://www.opentc.net )

Just to intrigue the readers, Network Access Control is an active area of research - commercial tools may exist on that one already. The general idea in NAC using TPM's is of course to only allow a device in a network if it can be verified as secure by providing specific measurements, not only on the integrity of the booted software, but also on the level of patches applied, the anti-virus definitions, the firewall configuration... Other examples of research: Secure software download, as in a mobile carier that needs to update a phone's firmware over the air securely, specifically the software of the Software Defined Radio. Of course, Digital Video Broadcasting (DVB) is an area or research - dvb receivers already use smartcards to store keys, TPM's can be used instead.

Very-long term goals? Imagine a world where every system and mobile device has a TPM: a cryptographic coprocessor, secure storage.. and can generate public key pairs on demand, without user interaction: a worldwide PKI - research is ongoing on how to manage and what to do with that!

I think i've drifted far than the scope of the question so this should be enough.


Is there any reason to allow Python fetches of my Web server's pages? I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website.
It's kind of creepy.
Who would set up an Amazon server to scan websites? Should I just block them?
Cheers

You have a Web site; it is meant to provide pages to whoever asks for them. That's the whole point of a Web site. What sense would it make to refuse to send the page to some people ? Especially if the exclusion criterion is the User-Agent string, which is freely chosen by the client. Any individual with nefarious intentions can masquerade his software so that it would appear, on your side, as a basic Internet Explorer or Chrome or whatever; even if it was sensible to exclude HTTP clients which happen to be written in Python, filtering on the User-Agent would simply reject clients who are honest enough to admit using Python as their programming language.

It is plausible that this specific client is some sort of Web crawler. You cannot really prevent Web crawlers from slurping the data from your Web site, as long as you allow browsing from unauthenticated users, though you can install some mitigation measures against systematic site-wide download (that's what Google does, for Google Maps: if they see too many requests from a given client within a given time frame, they suspect foul play). You can document your unwillingness to see your site inspected by Web crawlers, with a robots.txt file; most crawlers honour that file. But this won't stop any determined crawler. Best course of action is to:

either implement and deploy authentication procedures, refusing access to people who have not been duly authenticated with, e.g., a user name or password;
or accept that public data is public, and there is no such thing as "public except for evil people".


How does algorithms ensure public/private keys uniqueness? - RSA I'm new to security and crpyto,
I know that Public/Private keys are generated in a different way depending on the used algorithm,
But let's take RSA as an instance (Using prime numbers),
Does the algorithm generate keys randomly or in a structured way?

I mean if I asked for a public/private key, would the algorithm:
 - Generate random prime numbers and then generate from them the Public/Private key? OR
 - It has for example a database that contains all of the keys that it has generated before, and then compares new keys to them to avoid collision?

OR how can it ensure that that generated public/private key has been never generated before?

The way random prime generation works is by generating a huge, random odd number of a specific size (e.g. 2048 bits). It is then checked for primality. If it is not prime, it is incremented by two and checked again. This repeats until it is found to be prime. I describe this more in another answer.

There is nothing specific that prevents two private keys from being the same, but the probability of that is so astronomically low as to be irrelevant. There's no reason to explicitly try to avoid collisions. Note that this assumes the system has a good source of random numbers. Bugged random number generators or embedded systems with a poor source of randomness may generate RSA moduli who share a prime factor, leading to trivial cryptanalysis by checking for the greatest common denominator between two moduli and then dividing them by the result to obtain both prime factors.

See also What are the odds of an RSA private key collision?


Authentication system against the user I try to search articles on the internet in this category, but no result. In generally we use authentication of the user against the system. So, we want to authenticate the user before he\she use our system. Example an ATM machine, we must authenticate the user before he take out money from the machine(authentication of the user against the system).

I read somewhere that exist authentication of the "system against the user" and I am curious, which cases we use this kind of authentication?

Server authentication may help against phishing. For example, if you're going to https://bank.com and you're lead to the phishing site https://b4nk.com, both with valid server certificates for their URL (server is authenticated as bank.com and b4nk.com respectively, so we only know that the site corresponds to the URL, which most people overlook).

A petname system (documented here and here) can be set in place, so that the user upon registration associates the target web site with a petname (either a string of text, a recognizable picture or a sound). This petname is presented the user upon accessing the site. If the petname cannot be found, the user will be alarmed and should check the URL. If the URL is correctly entered, the site is safe.

Edit: note AJ Henderson's comment below.


typical purpose of self-signed certificates I am trying to understand the typical purpose of a self-signed certificate.

Reading this link on self-signed certificates and link on DV certificates I believe there is no information contrasting them so I infer that a self-signed certificate simply offers no assurance you are accessing content from an entity that controls the domain and that the purpose for a self-signed certificate on a web host is to merely make it feasible for SSL encryption to operate?

While with Let’s encrypt offering certificates free of charge and easily today does take away the “it doesn’t cost anything” argument, there are still reasons why self-signed certificates can be useful, for example

for testing purposes (no CA is giving you a certificate for your local domain like testing.testenv.cooperation)
on local networks (to secure routers’ web interfaces, for example.),
as client certificates,
for S/MIME,
countering the problems of CAs in general.

The only real difference is that a CA-signed certificate is (usually) trusted without prompting the user for input while a self-signed certificate does need the user to validate it and put trust to it - for example by checking the fingerprint through a trusted channel. Once trust has been put into the self-signed certificate, it is as good as a CA-signed one (not counting rollover issues).

Self-signed certificates might come in handy when someone is not trusting the CA to not create a certificate for a MITM, for example.

Another big application of self-signed certificates (or more generally “non-CA-signed certificates”) can be client certificates: A web application can create certificates for authenticated users and use them to authenticate them from that point forward - certificate-based authentication is way better in terms of security than traditional username/password schemes and gets used often for B2B applications as well as mobile applications.

Using self-signed S/MIME certificates makes S/MIME about as convenient as GPG with the need to validate certificates manually (see above), but there are edge cases where someone without trust in a CA might have access to S/MIME encryption but not GPG (iPhone users, for example, as well as some corporate email clients)


Is the action of adding non-official repositories to Linux dangerous by itself? Is the action of adding non-official (third party) repositories to Linux dangerous by itself?

For example, in Debian environments one could do:

add-apt-repository ppa:some_non_official_repository/nor_name

I don't mean to the actual download of software from a given non official repository, but of the action of just adding the repository to a system.

The adding of the repository itself is not dangerous.
But you will probably do an apt update and apt upgrade (or similar) sometimes after you've added the repository. The apt upgrade will cause any software already existing on the system to be updated with a newer version if possible - no matter if this newer version comes from the same repository as the previous version.

This means if the new repository you've just added claims to have newer versions of some software you already have on your system, then the newer version from the recently added repository will be used to replace the existing software version.
This way backdoors or just buggy software with exploitable vulnerabilities could be added to your system - and this is definitely dangerous.

Note that the contents of a repository can change after you've added it as trusted. This means even if the repository does not currently contain software which you have on your system already it might contain such software in the future. Thus you should not base your trust on the current contents of the repository but decide if you trust everybody which can make changes to the repository.


Are firewalls based on linux secure? I recently set up a local server on my home network to host some files and personal webapps. In an attempt to improve security, I bought a pfsense-based firewall. I know some basics of networking but I'm not particularly advanced, so I tried to do some general reading about firewalls as I was setting things up.
There was a long thread that I read on some forums where the benefits of firewalls on a home network were discussed. The general consensus seemed to be that if you were to hook your computer (say a Windows desktop machine) directly to the internet with no router or firewall, that it would very quickly get compromised. This seems to (at least intuitively) make sense, as a computer is running lots of software, where any application could have some vulnerability. Things might be patched or not.
So here is where my question is: If the pfsense firewall essentially running a full OS (FreeBSD), then what makes it any more secure than a desktop machine plugged directly into a firewall? The firewall is loaded with software like VPN servers, DHCP servers, cert CA, DNS resolvers, firewall filtering, logging, admin interfaces (the web gui), and so on, so it's not like it is running a particularly lean configuration. In addition, desktop machines update very quickly, while the firewall OS hasn't been updated in over 5 months.
In fact, I wonder if running a firewall like this simply increases the amount of attack vectors compared to something much simpler like the NAT on a basic router. This also means that if the firewall is compromised, all those services mentioned before would also now be compromised.

The general consensus seemed to be that if you were to hook your computer (say a Windows desktop machine) directly to the internet with no router or firewall, that it would very quickly get compromised.

Modern Windows systems have a built-in firewall which severely restrict access, at least if the computer is declared as being in a public (and thus insecure) network. So it is actually not that bad as what you've read.
On the other hand most attacks today against users of desktop machines are not directly attacking the machine from the outside. Instead the user "invites" the attacker when reading mails or surfing the web, i.e. it explicitly downloads potentially malicious code to the computer in the form of mail attachments, alleged browser plugins, alleged software updates or similar. Basic firewalls like pfsense are not designed to protect such attacks at the application level, i.e. they provide none or only rudimentary protection.

Are firewalls based on linux secure?

Just using Linux does not make a firewall magically secure - but it also does not make it magically insecure. And FreeBSD is not Linux anyway (but also not implicitly secure or insecure).

... what makes it any more secure than a desktop machine plugged directly into a firewall? The firewall is loaded with software like VPN servers, DHCP servers, cert CA, DNS resolvers, firewall filtering, logging, admin interfaces (the web gui), and so on, so it's not like it is running a particularly lean configuration.

True. And especially if these services are facing the internet or are indirectly accessible from the internet (like with CSRF attacks) they can be a problem. Critical bugs in VPN stacks and WebGUI's of Firewalls actually happen.

In fact, I wonder if running a firewall like this simply increases the amount of attack vectors compared to something much simpler like the NAT on a basic router.

Just to protect a desktop computer, a firewall like pfsense if likely overkill on one side and not sufficient on the other. In such a scenario it will not add much value compared to some simple router, as long as this router is actually secure. And like you said it can actually increase the attack surface.
It is different though with more complex networks and/or with more need (and expertise) to monitor and control what happens. For example one might want to separate IoT devices from the rest of the network, have a network wide VPN, have a server accessible from outside but separated from the inside, have more visibility in the traffic etc.


How can I stop fraudulent credit card submissions on a donation site? We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a distributed attack). 99% of these are declined, however our merchant services provider (Braintree) has asked that we remedy the fraudulent card verifications by adding security measures.

I've tried installing reCAPTCHA v2 and v3 on the site, and neither of these stop the submissions. I have detailed front-end logging which shows that the reCAPTCHA was successfully validated before the form was submitted.

My suspicion is that these attacks are being carried out by humans, not bots, but I can't confirm that. My front-end logs show the forms being filled out in around 20 seconds on average -- which is fast, but not impossibly fast.

At the moment I'm blocking requests based on GeoIP (as most of our donors are in our region), but this is not ideal, as we have some out-of-state donors.

Is there a better solution we can try?

According to prowebscraper.com cracking 1.000 reCaptcha's costs around $2 so it is just factored into the business case of the fraudsters.
Your only chance is to make your site less attractive than other websites, e.g. by requiring a registration and e-mail activation for visitors from outside your region and limiting the amount of times an account and IP-adres can be used each day


Public key in resources for avoiding man in the middle attack I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK installation file) so before starting sending or receiving data to the device, first server asks for a secret shared key from device which is encrypted via public key.
Is man in the attack possible in this scenario?

Update:
The method which I want to use is called "certificate pinning" and is common is some use cases.
https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning

What you are asking is basically redefining the "common SSL". However, you are basing trust on the server only, whereas in SSL the trust is delegated to a third party. Moreover, in SSL certificates are signed, therefore you can verify their authenticity.

So yes, the scenario will be able to prevent MitM attack (in a way), but the user loses some trust in the process (compared to SSL) because:

there is no more verification of the key
there is no one to vouch for your identity as a certification authority would do

A scenario that could be devised to perform MitM would be someone tampering with the APK to change the public key to replace it with another he has control on. This is probably not technically easy but not impossible either.

Finally, you would be better using a recent version of the SSL/TLS suite rather than developing your own protocol.


Is it possible to load an endpoint agent in my Heroku environment? ie: Carbon Black, Crowdstrike, etc Can an endpoint security solution be loaded onto a Heroku instance?

Such endpoint agents require access (and typically root access) to be able to run. As Heroku is just a PaaS for deploying your code, you do not control the environment that code runs in. As such, you will not be able to load an endpoint agent into your Heroku environment.

What you can do for more control and monitoring, is to implement and/or improve the logging of the application you deploy in Heroku.


Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript? Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication?

Is there any security concern from doing that whether the token is encrypted or not!

In my case, there is a web application which is asking an IdP to authenticate users. I'm using a WCF web service with Ws2007FederationBinding in order to send the security token. Everything is fine when I call the service from the server, but now how can I consume it from the client side using JavaScript as well?

I see two possible attack vectors.

eavesdropping
cross site scripting vulnerabilities in your web application

When the token isn't transmitted via HTTPS, it can be intercepted and used by an eavesdropper. To prevent this, enforce https for all communication.

When the HTML document includes any data from a 3rd party, you need to be weary of XSS injections. When an attacker is able to smuggle JavaScript code into the page which is executed, it can access any data in any JavaScript application embedded in that HTML document and send it to any other website. To prevent this from happening, make sure that all your web applications sanitize any user-provided strings properly. You might also want to inform your users that your website does not have any hidden features which can be unlocked by entering some cryptic codes into the developer console (like Facebook does, for example).

Also keep in mind that you can not prevent the user from finding out about their own token. When you need to protect the token from being discovered by the user it is issued to, you will need to find a different solution.


Which ssh exploit works by changing the user name in the middle of the process? Every few hours, I get a few of those in my server logs:

sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth]
sshd[...]: Disconnecting: Change of username or service not allowed: (identd,ssh-connection) -> (ident,ssh-connection) [preauth]
sshd[...]: Disconnecting: Change of username or service not allowed: (administrator,ssh-connection) -> (admin,ssh-connection) [preauth]
sshd[...]: Disconnecting: Change of username or service not allowed: (admins,ssh-connection) -> (admin,ssh-connection) [preauth]
sshd[...]: Disconnecting: Change of username or service not allowed: (admissions,ssh-connection) -> (adm,ssh-connection) [preauth]

...other attempts of the same kind: tony -> to, users -> user, wwwrun -> www, ...

Apparently, someone tries to confuse my ssh daemon by first identifying himself as foo and then as somePrefixOfFoo (without success, obviously).

Is or was there some specific vulnerability in SSH which would allow such an attack to succeed?

I don't think, there was any vulnerability in this, at least not in openssh. The code resulting in this error was added in this commit and it is referencing recommendation from ietf-drafts. Probably RFC4252, which states today:

  The 'user name' and 'service name' are repeated in every new
  authentication attempt, and MAY change.  The server implementation
  MUST carefully check them in every message, and MUST flush any
  accumulated authentication states if they change. If it is unable to
  flush an authentication state, it MUST disconnect if the 'user name'
  or 'service name' changes.

So I believe it is the highlighted case.


Steps to become SOC 2 compliant? Are there any specific steps one must follow to achieve SOC 2 compliance? Or should one just get a checklist from a specialized auditor?

Some context:

We are a small company and need to become SOC 2 compliant in order to integrate with a partner's API.
We have a Ruby on Rails app hosted on Heroku.

I am an IT security professional, currently working as an IT Auditor and am very familiar with the SOC 2 attestations.To answer your question, it helps to first give a little of background into the SOC 2 program.

Th SOC 2 certification is the brainchild of the AICPA and it is based on Trust Service Principles. Each Trust Principle has a defined set of control criteria that outlines what characteristics the system as your management defines must meet. As to the specific controls used to meet each control criteria, that is a decision of your company's senior management.

  Are there any specific steps one must follow to achieve SOC 2 compliance?

This question is ultimately misguided. The SOC 2 is concerned around the controls that your management has defined governing the services
it provides to a client. As such, rather than asking what checklist I can use to ensure I pass, think about which of the Trust Principles are important to the customers of your company. Most likely they will be reviewing the audit results before deciding whether or not to do business with your firm. If controls attested to by the service auditor are of no value to the end customer, having a SOC 2 certification means nothing for that particular customer

At a high level, the service auditor will be looking to see that the the controls contained in the description given by the senior management of your company are suitably designed and operating effectively to meet the control objectives for each of the Trust Principles. Representative questions the service auditor may ask are listed below:

Are procedures and policies necessary to meet the Trust Principles (as applicable based on service provided) communicated to relevant users?
Is the system as defined protected against unauthorized access (Security Principle)
Is confidential data as defined with the customer protected as agreed upon? (Confidentiality principle)

Ultimately, you are much better served, by focusing on customer needs rather than a generic "check the box" approach.


How to check and trust call encryption software There are lots of software for mobile operating systems providing end-to-end encryption. What is the best way to decide which one is trustworthy if their source is not revealed? Reverse engineering android .apk files or trying to monitor network traffic?

Monitoring network traffic is a way to see how easy it might be to break the encryption head-on, but it will tell you nothing of how secure the app itself is, and only if they happen to choose a very weak standard would you find anything of interest.  Rather, the greatest risk is an app that will give up the keys in a specific way (either locally or remotely) to allow eavesdropping. This is impossible to know unless you have the full source for the app, and everything else running privileged on the phone (which could snoop on the app).  The team behind Signal (Open Whisper systems) publishes their source code via Github.


(Updated with some background information)

For RSA operations, the public key consists of a modulus the product of two large primes, p and q, which are to be kept as secret, and an exponent, which is typically 65537.  Not always, but the binary representation of the latter (only two ones in 17 bits) allows for more efficient operations, so it's very common.

Since the key consists of two numbers, various techniques are available to make sure both are available for processing.

The original question was what this two different format means.  If you look carefully, the modulus quoted above is part of the "Public Key" hex string, starting at byte number 8.  Also, the ending in binary is 010001, which is 65537 in decimal, therefore it seems that "Public key" is indeed containing both of the values with some binary framing.

With X.509 certificates, most data is encoded with ASN.1 representations.  The ASN.1 representation is a very versatile (and complex) representation standard, most commonly encoded in two different formats: DER or PEM.  PEM is very easy to recognise as it's using a PGP like BEGIN/END framing, and DER is the raw, binary one.  PEM is actually the Base64 encoded DER, with the BEGIN/END lines around it.

To manipulate this data, the three most useful openssl sub-commands are "openssl x509", "openssl asn1parse", and "openssl rsa" (described respectively in the x509(1), asn1parse(1) and rsa(1) manual pages).

As the hex encoding above does not look to represent text, so it seems better to look at it with the asn1parse(1) tool, after converting to binary.  I did the conversion by hand, to be used by the xxd(1) tool, usually supplied with the vim(1) package; the "xxd -r" command is used to reverse the hex display of the same command.  Again, as this example is quite short, so I simply added the prefix lines, and broke lines at the 16 bytes boundary:

 % cat pub.txt
 00000000: 3081 8902 8181 00CC CB64 54C2 FAA3 7A81
 00000010: 365F 1BD5 1081 75B7 4202 3183 B1D5 5A76
 00000020: 726A 77BE 6269 16AB EB39 66B5 2039 33D1
 00000030: B401 7D23 4024 9E60 1CA8 3283 EA9D F1F2
 00000040: D9F0 1885 9DE1 C0E2 99FF 89A4 F915 BD5D
 00000050: BA3F 392E 2614 4880 75EF B5C0 946E 2A62
 00000060: D242 342C 4A15 1758 B055 9811 6E91 FD28
 00000070: 0D80 C521 C23E FB78 6F38 314A 78F2 812D
 00000080: 85C9 B82B F186 C902 0301 0001

Now's time to convert to binary, and check if it's really an ASN.1 encoding:

 % xxd -r <pub.txt >pub.bin

 % openssl asn1parse -inform der <pub.bin
     0:d=0  hl=3 l= 137 cons: SEQUENCE
     3:d=1  hl=3 l= 129 prim: INTEGER           :CCCB6454C2FAA37A81365F1BD5108175B742023183B1D55A76726A77BE626916ABEB3966B5203933D1B4017D2340249E601CA83283EA9DF1F2D9F018859DE1C0E299FF89A4F915BD5DBA3F392E2614488075EFB5C0946E2A62D242342C4A151758B05598116E91FD280D80C521C23EFB786F38314A78F2812D85C9B82BF186C9
   135:d=1  hl=2 l=   3 prim: INTEGER           :010001

It indeed is - and we can see the two integers described above.  Just as an example, we can convert it to PEM, which may look more familiar.  We know it's an RSA key, so we can check the rsa(1) tool, and after making sure we specify DER format, and one(!) of the RSA public key variants, it indeed parses the binary successfully:

% openssl rsa -RSAPublicKey_in -inform der <pub.bin
writing RSA key
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMy2RUwvqjeoE2XxvVEIF1t0IC
MYOx1Vp2cmp3vmJpFqvrOWa1IDkz0bQBfSNAJJ5gHKgyg+qd8fLZ8BiFneHA4pn/
iaT5Fb1duj85LiYUSIB177XAlG4qYtJCNCxKFRdYsFWYEW6R/SgNgMUhwj77eG84
MUp48oEthcm4K/GGyQIDAQAB
-----END PUBLIC KEY-----

(There is another format actually, which would show up as BEGIN RSA PUBLIC KEY, but the above is usually how the key is represented inside the certificate.)

This all is just an excercise to see what the data supplied in the question actually is.  The raw RSA public key is only theoretically useful, as it's handled during the SSL/TLS handshake, and that requires most of the certificate data as well.  In theory, you can try following/debugging the handshake, but it's generally more complicated - with PFS, it's not even possible, even if you have the public and private keys. PFS - Perfect Forward Secrecy means there's a random Ephemeral key agreed during the handshake that only the two endpoints know - not even us observing the handshake.

The only useful purpose I've seen that needs actually looking at the public key is to compare the modulus of the public key with the modulus computed from the private key.  This is necessary if you want to check which, or if the, private key is corresponding to the public key in the certificate.

The commands to do this are somewhat different, as you usually have the key as part of a certificate (in PEM encoding), and the private key in the RSA format in PEM encoding as well:

% openssl x509 -noout -modulus -in myserver.crt
% openssl rsa -noout -modulus -in myserver.key

The two numbers should match if you want to use them together (sometimes you just compute the md5 for the above outputs, which makes for an easier comparison).


Injecting a TCP packet into existing connection let's see a scheme:

and I would like to consider two cases:

All IP addresses are public, a cloud is symbol for the Inernet.

The first one

The H has an established TCP connection: C = (210.10.10.10,9999,98.98.98.98,9999). That connection is used for  HTTP communication- let's assume that some HTTP frames are sent by the connection C.
So, H just sends some HTTP messages.
Now, MH would like to sent a HTTP message on behalf of H. So, it guess TCP.SequenceNumber and other TCP's header fields. Then MH sends a proper TCP message with IP.srcAddress set toH`'s address and HTTP's message: 'I am a fool' (look at scheme).

A packet was received as next packet in connection C.

My question is:
Is it possible scenario?

The second one

The situation is same as above. However, H and Server communicate by https. MH tries send a HTTP message, as before. It cannot be encrypted because MH does not know a key. So, it cannot be correctly decrypted by a server. Server can find out that a packet is malicious because content is not decrypted to correct form.

Is it the only symptom that packet is malicious? It seems to be slippery.

The "all odds in attackers favor" scenario

Attacker is in the same network as the victim, can monitor the network and can not only eavesdrop the connection, but interfere with it. This is the case when the attacker can execute an ARP Spoofing attack against the victim.

In this case, the attack is possible, and trivial against an unencrypted protocol like HTTP. Attacker can read every packet from the victim and the server, and can alter things when he wants to. He can tell H that he is the gateway, and alter packets going to the server. As he have the entire packet in his hands, he knows the TCP Sequence Numbers, all flags, options, and everything else. This is called Man in the Middle Attack.

Attacker in another network

It's harder than guessing a 32-bit number. In this case, MH must guess the correct sequence number (a 32-bit number) AND craft the injected packet with the correct flags AND correct options AND have his packet reach the server before the package from H. As H and MH are not in the same network, MH will have to employ IP spoofing, and that is almost impossible to execute. As lots of routers have Egress Filtering, they will discard packets with a spoofed source address.

Encrypted protocols

The same constraints as the other scenarios, but with a complication: attacker must forge an encrypted packet, guessing the cypher suite, all the encryption parameters, padding, IV, checksum, and have it merge seamlessly with the next packet coming from the client... No, it's not possible to inject data on an encrypted protocol and expect it to be accepted by the server or client.

  Server can find out that a packet is malicious because content is not decrypted to correct form.

No, server find the malicious packet because the TCP sequence number is incorrect, or correct but late (newer packet already arrived), or much above the expected number plus the transmission window. If all those almost impossible to spoof values are correct, and encryption is employed, server will discard the packet because it does not even remotely look like a valid one.

TCP is a complex protocol, so it's actually hard to bypass. Add an even more complex protocol on top of that (TLS/SSL) and you have an impossible task trying to inject spoofed packets on the communication.


SSL cert minimize downtime key rotation strategy As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not

a. Generate a new CSR, submit to Godaddy to re-issue the cert

b. Install the cert and key on web server, and restart as fast as possible

My questions:

Are there any steps I have missed?
In step (a), when the new cert is re-issued, I assume the old one is revoked, but before the new cert is deployed, are there any risk during that time, the client check the revoked cert and experienced error?
Will the client (desktop/mobile) cache the revoked cert? And it will fail to communicate for my new private key even after I have installed the new cert?

You assume incorrectly: a cert does not have to be revoked when re-issued. It is typically a different process altogether. This means that you should add a last step to your plan: revoke the old certificate once you are done with installing the new one.

Clients will not cache your certificate. In fact, they cannot keep a cached copy since it is your server that is sending your cert as part of the SSL handshake. They might keep a copy of the CRL in cache for as long as it is valid but that should have only very limited impact on security and none on availability.

Finally, you don't have to restart the servers, you can just restart the process/services using your certificates. It will still cause existing connections to be dropped but it should be much faster than restarting the whole server.


Can the Gmail Activity IP Address's Be Spoofed? My gmail accounts are accessed simultaneously. When I log in sometimes, I am logged off because "another user" has logged on. I have two way authentication turned on. Gmail has a "Recent Activity" section that details the last 10 IP addresses used to access the account. They only show mine. Is it possible to manipulate Google's reporting of the IP addresses accessing the account by hijacking my IP address and simultaneously intercept the two-factor authentication code that comes to my cellphone? Or if they are on the same network?

I would think that this would be hard, if not impossible to spoof. For a TCP session to be established the three-way handshake needs to occur, and I'm not aware of a method where a spoofed IP address is able to successfully complete this.

If the traffic claims to originate from your IP address then it's almost certainly coming from your IP address. If you didn't have 2FA enabled I'd be concerned that perhaps another computer in your network was compromised, but I would wager that there isn't anything malicious going on.

I've never experienced this error myself and I have two factor authentication enabled, so I'd say reaching out to Google to inquire is your best course of action.