Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux please forgive beginner question.
I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu.

I have been using Keepass2 which is just such an amazing password manager; HOWEVER
I have the following 2 questions re this:

I am using KeePass-Http connector (just such a useful and quick extension to enter logins/passwords!) and there are some security concerns re this:

from the website of KeepassXC: https://keepassxc.org/project/

A note about KeePassHTTP
KeePassHTTP is not a highly secure protocol and has certain flaws which allow an attacker to decrypt your passwords if they manage to intercept communication between a KeePassHTTP server and KeePassHTTP-Connector over a network connection (see  https://github.com/pfn/keepasshttp/issues/258    and  https://github.com/keepassxreboot/keepassxc/issues/147. )KeePassXC therefore strictly limits communication between itself and the browser plugin to your local computer. As long as your computer is not compromised, your passwords are fairly safe that way, but use it at your own risk!
As of KeePassXC 2.3, we deprecated KeePassHTTP in favor of KeePassXC-Browser.

However, I have now tried using KeepassXC which has changed beyond recognition in the past few months. Superb!
It doesn’t need Mono (if I understand correctly) and it uses  KeePassXC-Browser (rather than KeepassHTTP)

Would anyone have any comments re the security of KeePassXC-Browser extension?

Also
2. in order to run Keepass2 (esp if also using the Keepass-Http connector) one needs Mono.
Some would say Mono is a security risk.
See https://sites.google.com/site/easylinuxtipsproject/security

Is this correct? – I would have thought that I would be unlikely to ‘accidentally’ execute malware as root under Linux?

Sorry for mix of questions… basically I am asking if, under Linux, KeepassXC would probably be safer to use compared to Keepass2?

The mix of questions makes harder to reply, it would be preferable to ask different things as separate questions.

I will try to provide a general answer to the things you mentioned:

  Some would say Mono is a security risk. See https://sites.google.com/site/easylinuxtipsproject/security Is this correct? –

This page makes the point that by installing wine or mono, as that allows you to run more programs (like windows ones), they make easier to run malware, too. (As you could be infected by eg. a ransomware that was developed for a windows target).

YMMV, as you may find that the benefit of running program X outweights the added risk of higher exposure.

  I would have thought that I would be unlikely to ‘accidentally’ execute malware as root under Linux?

How unlikely you are to accidentally a malware of coke depends a lot on the person. Some people are very conscious and won't run as root anything not completely innocuous (or even they restrict themselves to their package manager), while others will do all kinds of stupid-to-harmful actions… as root (and should have no root privileges at all).

However, running malware != running malware as root. Even if it isn't able to run as root, a malware can do a lot of harm, for example a ransomware. Your system files (which could be recovered by reinstalling) will be safe, but your photos and personal data won't. This was expressed by Randall Munroe on his xkcd 1200: Authorization:

(image under a CC-BY-NC-2.5 license)

  Is KeePassXC-Browser better than KeePassHTTP ?

I haven't studied the extensions themselves, but from a brief look at the linked bugs, I think it is. If any, because KeePassHTTP has some shortcomings that KeePassXC-Browser was designed to fix.

Note however that you could be using either of them without any browser plugin, in which case this piece may not be important.

I personally prefer KeepassXC to Keepass2 under Linux as I find it to integrate better with the system overall. But in a security aspect, I would say that you can use both of them in a safe way. KeepassXC would probably be safer? Maybe. Although the difference may be marginal.


Safe erase of a Toshiba SSD with Absolute Secure Disk software I have a SSD drive extracted from a crashed laptop which seems to be working, but it's got a Absolute Secure Disk sofware which asks for password when I try to boot from the drive or denies any access when plugging through USB interface.

Now I don't want any data from this disk or so, I just though that it is possible to make it usable. Read here and there about safe erase but so far I failed in doing so, is it anyhow possible with this software? Mhdd fails to secure erase the drive.

Maybe someone could point me into right direction or clearly state that this drive is a brick and I can hang it on the wall.

It's not a duplicate. That question is about restoring the data, my intention is to reuse the disk losing the data thats already on it. I do not want to recover the existing data at any means.

(As Rory noted, this isn't strictly a password-cracking approach, so may be better suited to Superuser or Server Fault. But the question is relevant to not knowing the password, and the original data isn't generally accessible, which has information security implications that may make it worth answering here anyway.)

It sounds like the Absolute Secure solution may be setting a controller-level ATA password. With high-security configurations, drives locked in this way cannot be unlocked without the original password, and can only be re-wiped.

If you attach the drive directly to a system with a SATA or other direct cable (and not via USB), and then boot from your Linux live CD, you may be able to at least restore the drive to service, as follows.

First, check to see if the drive is in a frozen state:

hdparm -I /dev/sda | egrep -i frozen
        frozen

If so, you may have to tell the OS to sleep the system, and then wake it back up, to un-freeze the drive.

Next, issue the following to set a new password, and then erase the drive:

# Set a new password to prepare the drive for erasure.
hdparm --security-set-pass password --user-master m /dev/sdX

# Erase the drive.
hdparm --security-erase password --user-master m /dev/sdX


CSR's with null bytes in them According to wikipedia.org's article on X.509 certificates, "There are implementation errors with X.509 that allow e.g. falsified subject names using null-terminated strings Marlinspike Blackhat 2009 or code injections attacks in certificates." My question is...  how do I create a CSR with null bytes within them?

Here's a CSR that does have one in it:

-----BEGIN CERTIFICATE REQUEST-----
MIIBSTCBtQIBADAQMQ4wDAYDVQQKDAVhYgBjZDCBnTALBgkqhkiG9w0BAQEDgY0A
MIGJAoGBALoqjrGPCxX2oWX8APXhB3dzKJAXWHKWSlMWDw1whCP+EpsdFY2pTq+D
RnX8wRIP2yssIii/4FwsDxjcjlYMpSqYBPnEq3Lql/7LeW5ulLn4wk4Gnd4B55WP
BLveMNCORZXtE5rNJISTRMHYZKp7sLOPFlE3Gb5G/o/rkxSqOKOPAgMBAAEwCwYJ
KoZIhvcNAQEFA4GBAB0CX/T2wBTHHE6dcCFwzXsVkqkoewQbLjDLoAjCBy7nFrCI
6+kLPj7zcYi6f+Jg+OcFMl0Oat+2iO7OARSib3S0WyuAFpJQQwZIiG9RISy2HF1A
jQPuWvOan1GsY74Dn0kac6BIaWlY0/9h/iIcl4BiUaFrW+xUinKGWofsdq8l
-----END CERTIFICATE REQUEST-----

According to asn1parse the value corresponding to the organizationName has a length of 5 even though the string displayed has a length of four. The thing is, there's a null byte between the ab and the cd. That CSR was generated with a library called phpseclib but I'd like to know how to generate similar CSR's with OpenSSL or some other more standardized tool.

I tried this but it didn't work:

openssl req -new -key privkey.pem -out test.csr -subj "/O=ab\000cd"

That got me this:

-----BEGIN CERTIFICATE REQUEST-----
MIICVzCCAT8CAQAwEjEQMA4GA1UEChMHYWIwMDBjZDCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAKe9z81r0pvpqN98WinJVAphD0bRqi1W6OrEh9rx0DPO
RILofZwLP11d8vot19VMHBqB+kQuhtWKc/2Te+F1fgy1NJjcF+tjErE038zMd4O6
sU7QiVuFKRceznaXiL2BKm5nCR5FBMj2gBu2WJ61mUKEkNYEvj7QtcMc/VUTYISq
D2DFoGmSjgltCtUyMqaSGtS6f2fqHFBvxVwLBDm+XSYYLrEREk2PmM1RbFY1b9fO
lKnrvRIN4X+RbqG9iF88Ax5T0L2/D1OjLD24eFY8m/ecrsMwxCAa9FL+oKIvT7M0
OGK+LWOkPpjKwegnppFYGOCEfLBDocSgD8z2AuV24usCAwEAAaAAMA0GCSqGSIb3
DQEBBQUAA4IBAQBmQwFqS8L4YO17hpTZTr/mKq0Mgzzf8PCI6d1OtRgKUM5LbFBX
WqCJSUzSrkCGQdMdFA9l20jw91gxaeLiEDbAS+1I8agel/TD6Hic5457HjyGbPx4
usqm0/c1/JRreG/1dyh2K6/TFPIN8dN++dLohmZlRWZdIMC0D/KNls5M++DiWqw3
J5S24BWIC6FOUsAs5EImd30+s4wXcL+uqlRmyQVZ3C+JI8ZBl5HuIKCLmS2d3rhG
/CBwlZHH4fyeYUpeWec6HUNjfvnJ8amDFyKPlbTgcSSEpXBBPGP4EJ+zrWFjZRe3
YDCxZ0RdBHjKsYzbJZDJEOe9YML5HqoXY1pr
-----END CERTIFICATE REQUEST-----

ie. the organizationName is ab000cd - not ab\00cd.

These things are normally done programmatically. The command-line apps from OpenSSL are restricted in many ways, and don't give access to the full power of the underlying library. If you look at the source code, you will find the implementation of the req command in apps/req.c. For subject name parsing, that command relies on the parse_name() function (defined in apps/apps.c). That function internally builds the name elements as so many null-terminated C strings, which, by definition, cannot contain a null byte. Therefore, no possible way to achieve what you seek with that tool alone.

So one option is to simply download OpenSSL's source code, patch apps/req.c to include a null byte where you want it, compile it and run it. This will require a bit of knowledge of C. You will want to use the X509_NAME_add_entry_by_txt() function (or one of its acolytes), with an explicit len parameter (not -1) to use as "string" a sequence of bytes which includes your null byte. If you look at parse_name() in apps/apps.c, you will see that it invokes X509_NAME_add_entry_by_NID() with len set to -1: that's the exact point that you'll want to change.

Another option is to generate a "normal" certificate request, with another letter where you would like to have your null byte (e.g. a 'Z'). Then, make sure to convert your request to binary ("DER") format; then use a binary file editor to replace the 'Z' with a byte of value 0; then recompute the signature so that it matches the new request contents. This last step can be done with basic Linux command-line tools (dd for file surgery, sha1sum to get a new hash, dc to do the big integer arithmetics) but you have to master both ASN.1/DER and PKCS#1, and if you did then you would not have asked the question you asked.


How can password mangers be secure? I have been recommended to use a password manager, but I don't understand how it can be secure. Any passwords it saves have to either be stored in strings or encoded in a way that is easy enough to decode, so anyone who knows how it's encoded can crack them, right?

Normal passwords are hashed so this isn't a problem.

Using a good password manager that generates unique, long, random passwords is a good idea. The passwords are not "stored in strings or encoded". They are encrypted, hopefully with a strong encryption algorithm like AES.

The encryption key is usually generated from the master password with an algorithm such as PBKDF2, specifically designed to be slow so as to prevent brute forcing.

Someone who does not know the master password cannot generate the encryption key, and therefore not decrypt the passwords.


How to justify that a stored XSS that occurs after logging in is a vulnerability I have performed security testing on a web application. Following is the scenario:

Logged into the application with valid credentials.
There are two fields in a particular feature which are displayed only after login.
I have provided XSS payloads which generates alert boxes with cookie information, domain information and saved that feature.
Whenever a user visits that feature, those provided scripts are getting executed and alert boxes with cookie information are generated continuously.

But the dev team says that unless you are logged in, you cannot give the scripts as inputs and this is therefore an invalid scenario.

So now, how can I justify that it is the valid scenario and it is a potential risk to the application?

The Dev team is wrong. The impact here is horizontal and vertical privilege escalation.

Post-auth XSS is just as valid as pre-auth XSS. Generally, you want the victim to be logged in anyways, as you want to exploit their current authentication. The only mitigating factor is that the attacker requires an account. Depending on how easy that is to get, the impact rating of the issue would go down, but it is still a vulnerability[*]

An attacker can use XSS to perform arbitrary actions in the name of any user visiting the page containing the payload, and read any data that those users have access to.

[*] Note that for some users this may be an accepted risk. Some applications would for example let administrators post unfiltered HTML, as they already have unlimited access without XSS.

If the payload would only be displayed to the user inserting it themselves, then that would be a different issue. You could only exploit it by either getting the user to enter the data (eg via clickjacking or CSRF) or by tricking the user to log into the account that placed the payload (eg via session fixation or login CSRF).


Proxy not rejecting illegal host header when coming from my VM provider's network I have a django app hosted on a linode VM, proxied by nginx on that same VM.

In my nginx config I have a block to deny bad host header requests:

## Deny illegal Host headers
if ($host !~* ^(mydomain.com|www.mydomain.com)$ ) {
    return 444;
}

This blocks almost all the bad requests, but I'm still getting occasional requests from a random linode host (the app sends me an email due to this host not being in the ALLOWED_HOSTS whitelist). Why are those requests able to get past nginx?

$host will be set to $server_name if the client does not provide a Host header value in the request. You should use $http_host to access the pure Host header.

See this document for details.


How could police identify digital contraband and charge someone if it's encrypted with keys? For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an encryption algorithm that may be uncommon. They would have these problems, no?

1.They can't guarantee it's what it's said to be if they can't retain the original binary data that makes up the evidence of the accusation. In such a case, they could never charge anyone without proof, and if they can't decrypt it, they can't prove anything.

2.Even if they, by some miracle, found a key and or decrypted it, the file could be an executable wrapped around the actual data; be self-modifiable; and it could attempt to use a host software program or OS library to delete itself if opened from a modern desktop, or re-arrange its own data to make it unidentified without a key/passcode.

On top of that, encryption could be done on a computer with no internet connection, leaving it virtually impossible to figure out who encrypted it if it's uploaded from an IP randomly used (public Wi-Fi, different location, protocol, secured proxies, no agent info, etc.). In that case, wouldn't piracy and other stuff illegal be easy to transfer without getting caught?

One could provide the keys to open the decryption and data scrambled within it over a throw away phone number, Skype, proxy, or unidentifiable remote locations. In short, can't decryption prevent authority from charging anyone in the legal system?

1.They can't guarantee it's what it's said to be if they can't retain the original binary data that makes up the evidence of the accusation.
  In such a case, they could never charge anyone without proof, and if
  they can't decrypt it, they can't prove anything.

Assuming that any confiscated or eavesdropped data is encrypted in a secure way, there is no technical way for law enforcement to decrypt it. Most legal systems in the world allow a suspect to refuse to incriminate them self. But whether or not the disclosure of passwords or passphrases is protected by these statutes is a topic of debate which is currently handled differently by different jurisdictions. There are places in the world were refusing to provide decryption keys when under suspicion is a criminal act itself and can be punished on its own independently from what a person is actually accused of. Refer to the Wikipedia article on Key Disclosure Law for more information.

But depending on the circumstances, decrypting the data might not even be necessary. When there is other strong evidence that you are involved in the exchange of illegal material, that alone might be enough to convict you in some courts around the world.

  2.Even if they, by some miracle, found a key and or decrypted it, the file could be an executable wrapped around the actual data; be
  self-modifiable; and it could attempt to use a host software program
  or OS library to delete itself if opened from a modern desktop, or
  re-arrange its own data to make it unidentified without a
  key/passcode.

That's really not an issue when investigators follow common forensic practices. Usually all data is backed up to read-only media in every stage of the forensic analysis. This is required to prevent any suspicion that the evidence got tampered with.

Also, there is no reason to execute anything you find during a forensic analysis, except in a properly secured sandbox. When you are collecting evidence for trials, the last thing you want is to give attorneys a reason to claim that all your work is meaningless because your digital forensics lab got a virus during a different case.

  One could provide the keys to open the decryption and data scrambled within it over a throw away phone number, Skype, proxy, or unidentifiable remote locations.
  In short, can't decryption prevent authority from charging anyone in the legal system?

The problem with the scenario you described is that it is inconvenient. The moment you invest more work into providing someone with an illegal copy of a media than one would have to invest to earn the money to get a legal copy, it becomes pointless. The reason why movie- and software piracy is so prevalent is not just because it is cheaper than buying but also because it's often more convenient.

There are systems like TOR hidden services, Freenet or I2P which allow people to publish and download files anonymously and encrypted. Some people use them for piracy. But unfortunately these systems do not provide the performance necessary for exchanging large files quickly and do not provide a powerful search. That makes them very inconvenient to use, which drives people to less secure but much more convenient systems like BitTorrent or one-click filehosters.

The only people who really have a reason to use encrypted and anonymous filesharing in its current state are those who want to exchange material which can not possibly be obtained legally. Not people who want to avoid paying for media but people who want to avoid going to jail because of it (or worse).

Interestingly, there were various sting operations in the past were people who were doing this did get caught even thought they did use encryption technology which was not broken in a technical way. Usually the evidence against these people is collected in much more old-fashioned ways: Infiltration, detective work and of course following the money streams.


What would 'best practice' look like in protecting critical infrastructure against state actor cyber attack? I was reading this article from the New York Times, which details the alarming degree to which the IT systems running critical civic infrastructure have allegedly been compromised by Russian cyber attackers.
In particular, my question relates to the text:

Still, new computer screenshots released by the Department of Homeland Security on Thursday made clear that Russian state hackers had the foothold they would have needed to manipulate or shut down power plants.
“We now have evidence they’re sitting on the machines, connected to industrial control infrastructure, that allow them to effectively turn the power off or effect sabotage,” said Eric Chien, a security technology director at Symantec, a digital security firm.
“From what we can see, they were there. They have the ability to shut the power off. All that’s missing is some political motivation,” Mr. Chien said.

Clearly, security should be important to infrastructure providers but protecting against state sponsored level attacks may be beyond their capacity.
What measures have been taken to minimize the threat of state actors compromising critical infrastructure - particularly drawing on examples from other countries - that could be combined to define 'best practice'?
From an abstract perspective, I'm suspecting the best answer would likely involve a suite of infrastructural, technical, assurance and legislative/regulatory measures.
e.g. establishment of a body of oversight with powers to penalize non-compliance, having a separate physical network, vetting of involved personnel, vetting of involved infrastructure hardware providers, an ongoing vulnerability bounty program, innovative cryptographic methods, etc.

Warning, lots of text. Very complicated issue. tl;dr is: we as a nation are not doing much and have not been doing much. The current mentality is "it's up to businesses to fix it before the GOVT has to get involved." Companies don't want to pay, and don't know what to do, and don't see a "market motivator" (yeah, literally hear that all the time. I'm not kidding). Europe is doing much better with the push towards 62443 requirements for all ICS.

I'm primary on ICS/Critical Infrastructure for a company that is involved in the certification of security for devices associated with this. And I have bad news. there is not much requiring most infrastructure to secure itself. Nerc-CIP is related to power grid, but not everything has security requirements. Nuclear has some, through both NEC and IAEA and their overlap with Power Grid. Otherwise... not much.

Every year there are speeches at security conferences about how "squirrels" have done more damage to our infrastructure than hackers. That said, remember there is no honest disclosure rules for infrastructure. We don't really know how much is squirrels and how much is not.

I can tell you this though, as a first hand ICS pen tester who has worked with a slew of products in this space... at least 1/3 of -new- products come in the door critically vulnerable (in my experience. and I'm being generous), and only a very small percent in total have clearly been built with a full "defense in depth" security plan. Good news is when we are done with them they are way more secure and the companies we have worked with are developing better practices (if needed).

Also good news, there are good practices to secure insecure devices inside a network, even if the devices are not secure, but there are not a lot of constant audits and checks for this. In fact, my experience is the HIPPA, PCI, and SOX all have much firmer rules and accountability than securing Crit. Infrastructure. I'm also including 911 response systems in this, which have been shown to be vulnerable also.

There are a myriad of examples from the past 10 years, which really ramped up in the past 4, of nation state style attacks on Crit. Infrastrucutre. The Ukrainian power grid has been attacked multiple times using multiple tools, the thinking being it's a training ground for Russian hackers. The US gov't attacked nuclear facilities in Nitanez using custom malware in a very famous exploit back in 2010-ish. Lots more. Too much for this response.

As far as what's being done... not much. Companies can't afford millions of dollars of renovation, there are no universally agreed upon standards for modern secure ICS protocols (yes, most ICS network protocols are plain text with no verification of devices), ICS teams can't find security professionals who understand ICS because there are -very- few. There is a slew of other issues...

And it gets worse... I literally sat at lunch with the former head of DHS. It was me, him, 2 other people. He was deeply concerned as our current administration is leaving massive staffing holes and seems to be completely uninvested in any sort of push to fix this issue and secure the nation. Yes, it's true they have lots of DC conferences to talk about it... but no one is putting up the money or creating legislation.

The good news is that in general we know how to secure our systems and what are the major weakenesses at every level of the technology stack (from CWE's to Network zoning). ICS-CERT (a branch of US-CERT, the american emergency response team for cyber) has a great articles on it. Along with NIST, IEC 62443, and a smattering of others. Good place to start for anyone in ICS who is now concerned. Google search this are there are multiple, find the one best suits your needs:

[google] filetype:pdf ics-cert best practices


Internal Pen testing - Can't get SMB Relay attack to work? Using Responder to capture NTLMv2 hashes on LAN using kali and relay them to the smbrelayx.py module from Impacket.

I understand I have to change the config file in Responder to set the SMB and HTTP servers to OFF.  However after doing so, they still appear to be on as I am getting an "Error starting TCP Server on port 445" and port 80 while I am running the other SMB server from impacket. The responder.conf file shows OFF for both.

Has anyone had this issue before?

Close Server service and reboot:

To close it, log in as an administrator, and do the following:

In the run box, type "services.msc" and run the Services console
Scroll down to find the service "Server"
Right-click "Server" and select Properties
Stop the service, and then click the drag-down box in the center, and select Disable.
Restart the system.

Keep in mind that any services that depend on the Server service (e.g. Homegroups, print sharing) will fail. Consider creating a System Restore point prior to making the change.


Monitoring Active Directory Domain Administrator Activities I need to monitor Active Directory domain administrator activities and look for the following:

Looking for anomalies in daily activity
Getting alerted upon a violation

My problem is that turning on Windows Auditing in my environment (over 100 domain controllers and 50,000 users) generates massive Security Event logs and is not feasible to sift through it.

Is there an alternative solution? Or is there an option where I can still turn on Windows Auditing and filter for these activities?

I think you should consider filtering and aggregating the Windows event logs. You can start by filtering for specific events, like 4624, successful logon of a user: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624

If you were to do nothing more than monitor when each Domain Administrator logs on, you will already be monitoring for one of the most important anomalies, which is when a user changes their work schedule.  Unless your admin works nights or is in Australia, we don't expect him to be working Chinese working hours.

If you have a large budget, simply go to one of the many Security Information and Event Monitoring ("SIEM") vendors.

I don't recommend "getting alerted on a violation". You are going to want to watch data for a while, before you will know what constitutes a real important event.


security & personal use of RDP I'm an absolute security nubile who wants to access his Windows desktop PC from his Mac laptop. I'd like to do this so I have all of my stuff in one place, and I also have some work documents stored on my personal PC that I'd like to access from the road. I discovered Microsoft RDP and thought it might fit the task, but I'm concerned about security implications, and some of my work documents being exposed to malicious do-no-gooders. I've made some changes to my RDP setup after a bit of searching, such as changing the RDP port to a random number, requiring authentication using NLA, and requiring SSL for incoming connections. I've also set up Duo TFA to be required on all RDP connections.

My question is, if i set up port forwarding and expose myself to the internet, is this still a really bad idea? What other alternatives do I have? I did a bit of research on VPNs, but I couldn't really make sense of it all. I'd really appreciate your advise.

I would say that the biggest risk exposing RDP to the internet, assuming your machine is fully patched, is the possibility of brute force attacks. If you're username is Administrator and your password is Password1 you're going to have a bad time.

Now with that said, I have run some boxes in my day with RDP exposed on the internet on a non-standard port and brute force attempts dramatically decreased. The fact you've added two-factor authentication means that you've reduced your attack vector significantly (though you should still use a long and complex password).

I would say that your setup looks safe enough.


How does the browser decide to accept a self-signed certificate? As far as I know, with OpenSSL, you can self-sign your website's certificate. This means that the browsers that will connect your server are supposed to be willing to accept a self-signed certificate for your website. My question is, how does the browser know whether or not to accept a self-signed certificate for a particular website? What if I MITM a client and present a self-signed certificate for a bank website? How does the browser not get tricked at that point?

Browsers will only accept an invalid certificate - and self-signed is one form of "invalid" - when the user acknowledges the risk and overrides the browser.  The specific steps for doing so vary from browser to browser, but they're usually onerous by design - they want the decision to bypass security to be hard, not easy.


How to keep web traffic private with a satellite intenet connection I use satellite internet and I would like to have some a little more privacy when using the internet.

TCP spoofing appears to be an issue among other things and the people from a well known VPN service tell me its a no-go. I wonder if could use a VPS as a secure proxy?

I would like the solution to work on a router level, my speed is 10Mb/s and there is no streaming/gaming - light use. A degree of 'privacy' would be good - I don't think 'anonymity' exists for my pockets. How would I go about it?

The correct way is a VPN.

Since satellite communication is already relatively slow adding a VPN in the middle will just slow it down. Only if you really don't trust your provider go ahead and use a VPN.

  I wonder if could use a VPS as a secure proxy?

You can. But you have to make sure (and trust yourself) that you are able to provide the correct security measures you are looking for.


How to decrypt a text with substitution cipher? I recently got a file which I had encrypted with substitution cipher a long time ago.

I went to crack down the key and almost got it.

But I encrypted it not just with alphabets but also with numbers as well.

I checked online for a substitution cipher encoder/decoder, but didn't found any.

I know the algorithm: Substitution Cipher

I know the key: Alphanumeric (Like A=1, B=F, C=5 and so on)

I have the cipher text

Is there any site or code implementation where I can decode the message with an alphanumeric key?

P.S. If this is not apt question here (security section), please let me know where should I ask this.

You should be able to crack it with some simple statistics analysis, using common patterns of english language. For example the word 'the' or 'is' will appear frequently and same word would appear the same in different locations of the ciphertext.

After obtaining the key, you can probably write a simply script or program to 'decrypt' the message. I wrote a Ruby function that will do this

table = { 'a' => 1, 'b' => 'f' ... }
def decode(msg, table)
  msg.split("").each { |a| table[a] }.join("")
end


How to properly transition from standard PGP keys to using subkeys? When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like to transition to using subkeys properly. But I don't want all of my emails which I signed previously to no longer be valid. What's the proper way to transition to having multiple subkeys under the main key while keeping prior communications valid?

You should be able to add the additional subkeys to your master key pair, while still leaving the master keys intact. It doesn't matter if the "master keys" have been used for a while, you don't have to generate new master keys to add subkeys to it.

You linked to the article I usually recommend which describes this process, of using gpg --edit-key <key>, and then addkey. Once you have generated the subkeys, hide the private half of the master key in a safe place and just use the subkeys from now on (only bringing them out for "special occasions" such as singing other people's keys, revoking, or adding new UIDs or subkeys).

  I don't want all of my emails which I signed previously to no longer be valid.

That won't be a problem; old emails should still show up nice and signed. The only way old emails that you signed previously can become invalid is if your master key that you signed them with gets revoked or expires. So long as the new signing keys are subkeys of your old keys, anything you sign with the subkeys will still show up as being signed by "your" key.

Encryption on the other hand might be a bit trickier. If you have used your master keypair for encryption in the past, you will still be able to decrypt your old messages, but you will have to fish out your master secret key from its safe place every time you do so.


What is the risk of allowing display of arbitrary HTML files? Github and Bitbucket allow README files in formats such as Markdown or reStructuredText, but not in HTML format.

Is there a security risk in doing so?

HTML files can contain Javascript which browsers will run with permission to the domain it's displayed on. If github allowed arbitrary HTML uploaded by users to show on the github.com domain, then for example an attacker could create a repository that when viewed caused your browser to copy the readme into all of your own repositories (by making AJAX requests against github.com), which would then continue to spread across the site. (The code could also have other functionality, like making all of your private repositories public, changing your profile info, etc.)


Is the action of accepting a pull request on Github vulnerable to race conditions? On github, any person (let's call them Alice) can fork a project, make modifications to it, and then submit those changes to the project owner(Bob)  as a pull request, and the idea is that Bob reviews the submitted code to make sure it is up to spec, and contains no viruses*.

If Bob wants changes made before accepting the pull request (such as code style), they can make comments asking Alice to make those changes, and Alice will most likely make those changes, and commit them to Alice's fork, at which point the commits automatically appear as part of the pull request.

Now, what if there is a malicious person (Malice) that creates a fork with beneficial changes and submits a pull request, and Malice knows exactly when Bob is going to look at that pull request, and that Bob is going to take approximately 5 minutes to look over the new code. Would it then be possible for Malice to make a malicious commit in between Bob requesting the page to view the pull request and Bob pressing the "Accept" button?

*Ideally, this is what happens. We assume Bob is both benevolent and intelligent, and does this properly to his best ability, but is unaware of this particular possible vulnerability.

No, Github is not vulnerable.

I have tested this with a very helpful friend of mine to make things go quicker. When this was attempted, github updated the list of commits live, and if I clicked the "Accept" button before the list was updated, github throws up this message:


Mail interception fraud My company has been the target of a mail fraud attempt for the second time this year.

The fraud goes as followed:

My company sends an invoice to a customer from the email address alice@mycompany.com (alice is responsible for invoicing).
alice@mycompany.comsends a reminder because the invoice hasn't been paid yet. The reminder has a pdf attachment with the invoice and payment information.
Shortly after alice@evil.com also sends a reminder mail to the customer. In this reminder there is also a pdf attachment that's nearly identical to the one Alice send, only the payment information has been altered.

The customer also has a conversation with Alice about the change of bank account and always receives answers. My boss is cc'ed in all the emails but he never receives the emails.

The @mycompany.com email addresses are hosted on o365.

In January we had this for the first time. Recently we had the same thing but with a different client. The first time the emails were sent from alicemycompany@evil.com the second time from alice@evil.com.

How does this fraud work?

What can I do to prevent this from happening?

I checked Alice's account and there are no rules of any kind for forwarding.

Microsoft checked the account and said there is no indication of it being compromised.

UPDATE:

I got some new information that I included in the question, all our mails were received by the customer!

I don't think that there is a standard way that this type of fraud is perpetrated, but I can tell you what I have seen and what I do when this happens to us, when about once every two months we get "change my bank account" emails sent to suppliers "from" our mail systems.

Our first thought is that the scenario didn't happen and that we have fraudulent staff working in collusion with the supplier.  We have to rule that out, so we may review the staff emails looking for anything suspicious. This invariably turns out to be a dead end.

Then we ask if our own mail system or user accounts have been compromised: we have had this where a bad actor had access to an email account and could intercept, reply and delete mails as they arrived.  It was very cheeky so don't underestimate these criminals.  We spotted this as a users was logged in from two places at one, which is normal because of our business and use of VPNs etc. Because we have an immutable store of all messages we can see the deleted ones.  We put in two-step verification to mitigate this risk and now we are very confident that an email account with 2SV is not compromised.  Not 100% confident of course and it is still an option.

Then we look at the mails outbound from our domain and look for bounces and we ask the recipient email team to look in their logs for our mail.  This has mixed results.  In your case you say that your outbound mail never arrives, so I'd be looking at our outbound logs for mails to the domain and I would be checking the MX record of the recipient domain.  If the message really did go out from our system, I'd get the message ID from the header and ask the recipient mail team to tell me if they have received it.  The results are mixed because often the recipient organisation does not have an IT team and they don't know how emails get routed, delivered etc.  It would be quite unusual for all emails to mydomain.com not be be delivered at all and quite unusual for a man-in-the-middle to be capturing all the mydomain.com mails and forwarding them, but I guess it's possible.  If the recipient organisation never gets the mails then that spins off another query: why.  Of course trying to do this over email when the recipient email system might be compromised is flawed to say the least.  But the fact that your emails do not hit the recipient is a big indicator to me and I would want to get to the bottom of why.  My hypothesis is that the recipient has shared their web-email password and a bad actor is logging into their account because that is a simple approach.  Bad actors can get the password through various ways but one way that i have seen is they send a link to an online O365 doc or Google Doc that required a login and the user logs in using that link and the bad actor then has the password.  There are other ways, I'm just saying this is what I have seen.

You say that your client sends mails cc to a manager but those don't arrive?  That sounds like an interesting avenue to pursue.  I would want the sender to check their logs for mails to the manager and our system for mails inbound for the manager.  My hypothesis being that one or other of the mail systems is compromised.  In the investigations I have run, the compromise has usually (well always now) been with the recipient email systems, the reason for this is that our systems have many defences in depth but we deal with small suppliers who don't have an IT engineering function.  But we keep an open mind always as we really do not know until we have the data.

So now alice.smith@outlook.com sends an email to the recipient.  If Alice Smith's corporate email account were under the control of the bad actor then my assumption would be that they would not bother with the @outlook.com address, but that's just an assumption. I'd ask myself why the recipient is dealing with @outlook.com rather than the real company, but perhaps the bad actor has changed the FROM address.  We get that too of course.  If the email sent out does match the email that was sent back with minor changes the obviously someone has intercepted that mail.  I would want to confirm that though as the scams I have seen often have the email signature of one of our staff, it has a PO number etc but it's totally fake, but looks plausible.  We know this because there is no exact match in the immutable email store that has been altered, but the human sender misreads the situation and says that it is the same email.

We now realise that it's a fool's errand to try to stop these scams most of which now originate with the recipient: their mails are compromised, they answer a fake email and change details etc.  Some of the controls we have put in place to prevent a successful scam include:

2SV on all email accounts
immutable storage for all emails so we can search actual content without the users being aware (we have governance for the process)
Constant communication to staff "don't change bank account details based on an email" and "no, the CEO will never write to you telling you they want you to make a secret payment"
Our internal payroll teams don't (or shouldn't) accept a "change my bank account" email, they should use a form on the intranet so that deals with message spoofing, but not account hijack.  We have so many payroll teams though it does not always get through
SPF, DMARC, DKIM. These are great ideas and I am sure they work well for small organisations.  If you have these in place then the idea is that the recipient mail servers will use these to identify fraudulent mails.  In practice for a big enterprise it's a big old effort and we realised that implementing DMARC and DKIM would kill our business because of the vast number of email sending domains, devices, third parties etc and we would need to employ a team just to deal with that.  SPF works OK for us, most of the time.  If you are not aware of these then Wikipedia will guide you but as I say we found them a great idea but simply too complicated for us to use in our enterprise. O365 may well come with these in place already?
Mail inbound rules that flag spam from known bad domains.  We know about legitimate service providers that host spam sending servers that our mail spam engine allows through, so we flag all mails from, for example, GoDaddy servers.  It's whack-a-mole and we really let our cloud email service provider deal with spam

We have not implemented any third party tools that do "email security" because of the cost and because we have protection from Google, which isn't perfect but it's good enough.

When i look into these issues I find these tools useful

https://toolbox.googleapps.com/apps/messageheader/ to review the message headers
https://mxtoolbox.com/ to check the MX records and other DNS-type data

I have not answered your question directly for your specific case because I don't have enough data, though others may have come across this exact scenario, but I thought it might be helpful to share what I do although I accept it's not a perfect process and I make assumptions that are not 100% proven.


JWK with X.509 Certificate - is self signed okay? I'm working with a client that, in order to use their OAuth 2.0 web API, requires me to provide them with a JSON Web Key (JWK) that contains an embedded X.509 certificate.  Then, when I'm requesting information from the API, they say I need to pass a "signed (with private keys) JWT Bearer token" on each request.
I've never worked with JWK's before so I was looking over the official JWK documentation, but it's very dense and doesn't really talk about how these are used in real life applications.
I found this site / command line tool that can generate JWK's in different formats, and it generates the JWK with an X.509 certificate that is self-signed.  I'm wondering, in this case, is it okay to use a self-signed cert to talk to this API?  I understand that with web browsers, you absolutely need a cert that is from a trusted CA because the client and web server are essentially strangers, but this cert isn't being used publicly for a website; it's just being used between my application and this OAuth API, and both parties already trust each other.
So really my question is, would generating a JWK with a self-signed X.509 certificate be sufficient, and then use the private key of the certificate to sign JWT Bearer tokens when actually using the API?

The possible use of a self-signed certificate should be part of your customer's security policy and/or security guidelines. I would strongly advise against the use of self-signed certificates in any type of production network for any purpose as it provides less security than a certificate signed by a trusted CA.
To answer your question, the certificate will provide the needed functionality, but I doubt it is your decision to make if it can be used. You should consult that with your customer.


Rationale for subkeys in OpenPGP? I have seen from different sources that the sole purpose of the master key should really be to generate the subkeys, and that it should be subsequently backed up to an offline location and deleted from the device on which it was generated. Why is that? I just don't get the rationale for having both master and subkeys since, ultimately, they're all associated with the same passphrase.

The primary key, and only the primary key is allowed to perform key management operations (adding and removing user IDs, subkeys, ...) and issue certifications on other keys. Storing the secret primary key offline provides additional security against misuse of those especially sensitive operations.

Furthermore, the primary key is target of incoming certifications from other keys. If you have to revoke a subkey because it got compromised (computer got hacked, issues like the DSA and random number generator bug Debian had), you roll over your subkey and everything's fine (at least, for messages encrypted/signed in future). All your contacts have to do is fetching the updated key from the keyservers running gpg --recv-keys <key-id>. If you have to revoke your primary key instead, you lose all certifications on that key: all trust in that key is lost, you will have to start over distributing your key and getting it signed.


What are the security practice or case studies for account lockouts? We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal information is held about the customer. There is a possibility that the user account may be compromised through brute force attack by bots. Please keep in mind that we also do not want to discourage legitimate user experience.

Scope
What are the best practices or case studies around the platform on

How many attempts before locking out an account, and
duration of account lockout (linear or exponential based on the number of further retries).

Out of scope: Strong password

There are a couple of ways that the passphrase could be compromised by an automated attacker, which of course does not apply to the social media login. I ignore application-level vulnerabilities. You need to threat model these for all the ways that users can access the data: web and any APIs presented.  Often APIs will use an identification token which is really just a string, which has obvious implications.

A dictionary or brute-force against a known user ID. Where an attacker tries many passphrases against a known user ID.

A known passphrase against brute-forced user ID. Where an attacker tries the same passphrase against the set of user IDs.  This is particularly an issue if the user IDs are sequential or easily guessed.

You have some defences against these.

Login throttling.  Many web frameworks have this or can implement it:
for example Django-Axes link
For a given UID limit the number of attempts.  Fewer than a dozen,
then prevent access for a minute.  All you want to do is increasing
the work effort to run the cracker For a known password attack then
you can check for enumerated accounts.  You'll have to identify the
attacker for which the IP address is a reasonable proxy or you can
use browser finger printing or possibly use cookies.
A CAPTCHA could work for your users.  They are fairly intrusive so
you could do what Amazon does and only show the CAPTCHA if there have
been X failed attempts.  Then you do not incommode your users.  If
you choose to use Google's reCaptcha then you have to deal with the
fact that you are delegating to Google and the reCaptcha is really a
check that the user has a Google account: it's perfidious IMHO. You
could throw a simple "what is 1 +1" or whatever check.
Blacklist source IP addresses that have too many failed attempts.  But you will
need to consider in your threat model that many people may come from
a shared IP, for example anyone who works for company X may be behind
the company firewall so you can't simply use IP address. Blacklisting
is a great DOS that a malicious actor can use against you to block
off access to your users. You will need to think about that in your
threat model and ensure that your blacklist algorithms account for
this.  Eg if you have lots of users from university X and one person
runs a brute force then you are going to shut off all your legitimate
users if you are incautious in your defences.
Web Application Firewall.  Apache ModSecurity could be your friend, or a commercial
variant Bash script to update IPTables based on X failed attempts
from address Y
As a variant to CAPTCHA send a one time code / link to their email address. The account is locked until the click on the link, which resets their password.

  How many attempts before locking out an account, and

Allow five attempts for the same UID, same IP and different password.  On the fourth attempt throw up a CAPTCHA or tell them you are going to email them a one time password valid for X minutes.  On the seventh attempt with a valid CAPTCHA lock the account for 1 minute.  Repeat and double the lockout each time.  A legit user will have given up by this point and will have requested a new password.  Give them the choice to reset password via email link.  You need at least five because the first wrong password is wrong, the second is the same password typed more slowly, then the third, then they add 1 and then 2 to the password and finally give up.

Having a periodic 2 step authentication code sent to email can be a good mitigation.  As NIST and NCSC both recommend not having periodic password changes then that still introduces some control.


Is it possible for an attacker to change my sent emails content before arrival? I have a web application that sends "change password link" to user that wants to changhe his password.

The link is something like this:

  http:// www.my-domain.com/changepass?uid=username&secretkey=some-hardly-encoded-secure-key

Is it possible to change my email content before arrival?
I have a scenario in my mind but I don't know anything about possibility of it.

Attacker gets my sent email before recipient
Attacker changes the link inside my email to something like this:

  http:// www.attackers-domain.com/changepass?uid=username&secretkey=some-hardly-encoded-secure-key

Attacker Sends the email to recipient (The original user)
User clicks on the wrong link inside email and goes to wrong place
for changing his password
User enters his new password in attackers site
Attackers site sends new password using right protocol to me and
changes users password

and now:

User does not know anything about the attack
Attacker has users new password

It is possible, but requires a relatively sophisticated attack.  E-mail is generally insecure.  Secure protocols do exist for exchanging e-mail, but very few servers actually use it.

If the attacker is able to execute what is known as a man in the middle attack, they could change anything they wanted about the e-mail.  A man in the middle attack requires that they have control over some part of the e-mail's route from sender to recipient.  This could be either the sending or receiving mail server, the user's e-mail client, or any Internet router that the e-mail happens to pass through along its way.

If the attacker can get in the middle, it is trivial to adjust, but it is relatively hard to get in to the middle unless they are a relatively established hacker with a decent amount of resources available to them.

In your case, the easiest countermeasure is the use of an HTTPS based link.  If you use SSL and the user bothers to check that the URL corresponds to your site, then the attack scenario doesn't work.  You could also tell them the domain that the link will go to when they choose to reset their password, that way they know if it is valid.  This is probably the easiest solution.


Malicious PDF file upload I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from uploading. The problem is that in case it detects a pdf file that has not seen it again (meaning its SHA) it allows to be upload it and then sends it for analysis in a dedicated sandboxed cloud environment.
But since it allows the file I am trying to "block" PDF files containing Javascript or Embedded files using a code snippet running on the web server. Is there something else I should consider to block besides this?

Run them all through a converter into PDF/A format.

It forbids any sort of active content.

If they won't convert, trash them.

  IDS/IPS with Anti-Malware license

Scanning is a losing battle. No matter what your scanner knows to look for, there will always be something new that it doesn't know to look for.

  dedicated sandboxed cloud environment

That's useful for generic malware, but not useful for targeted malware that will only execute it's payload under conditions that only exist at it's target.

If you want to make sure the file won't do anything Evil when opened, make sure it doesn't contain anything executable. You do this by running the conversion to non-executable PDF/A yourself. This creates a new, clean PDF file that by definition isn't infected because you created it.


Detecting port scanning activity of a mobile app I highly suspect that one of my iPhone apps is scanning for open ports on the local network, but can't think of a way to detect such activity.

I know that I can monitor http(s) connections by using tools like Charles Proxy, but I don't think they can help in detecting port scanning.

I had the following ideas, but not sure how effective they are:

Setup a local VPN and use it on the phone, so I can detect every connection attempt.
Setup a local server (say FTP server) and monitor for any connection attempt from the phone.

Do you think of a better/easier way?

EDIT:

Based on suggestions from @AlexProbert and @Matthew, I was able to monitor all outgoing connections from my iPhone. Here is how I did that:

Enable Internet Sharing from MacBook to the iPhone.

Open Wireshark. Select iPhone USB and press Start.

Wireshark is a great tool to analyze packets within the network.

As suggested, you can install Wireshark on a PC that is connected to the same network the iPhone is and see what packets are being sent to your PC.

Ensure you know the IP of the phone within the network, so you know where the packets are being sent from.

EDIT

@matthew - To make the laptop the access point which the phone is connecting through, it'll see all traffic the phone sends to the local network.


Are scripts scanned by AVs at runtime? Are malicious scripts like (.js, .wsf, VBA macros) scanned at runtime? I noticed that if a malicious script is not detected at scantime it won't be detected at runtime either, only the downloaded file can be detected. All these scripts downloads file from internet and starts it, so I'm wondering if this behavior is detected at runtime, or if AVs wait for the downloaded file to be executed and then checks if that file is malicious. I suppose that all files are not detected at scantime.

Virusscanners (in general) hook in on the filesystem. This means whenever a file is transferred it passes the virusscanner, which tries a table of common know patterns (aka definitions) against the file. This works well for binary files as patterns are easier to detect in static content. Patterns are not the only assessment, for example Windows Defender traces routines to see where they lead to. A combination of system calls can also trigger an alert. Windows host scripts (eg, js, vba, vs) are well known to cause problems, and are scanned in various ways to insure they cannot cause harm (or unintended actions). Malware scanners have various ways of detecting threats, these a re only two of them.

If you were to download a random, malicious, python script that has been slightly altered to cover its purpose, changes are it will go unnoticed.

Executables are also checked before they are loaded into executable memory. Ofcourse options and techniques vary per product.


Is initializing variable to NULL or 0 or -1 a bad practice from security standpoint? I'm trying to learn little bit about armoring application against reverse engineering. In one article I read that initializing variables to NULL or 0 or -1 is as secure (vs RE) as using common passwords in applications. In short, it is said we should use RNG to produce random data which we initially "store" to new declared variables. Other approach would be by using XOR operator. Unfortunately, I forgot to bookmark this article and I've not had the time to read it whole.

The question would be - is it true that if we use random data and/or XOR operator when initializing variables we add to application's defense against reverse engineering?

EDIT:
It seems my question wasn't clear enough. What I'm asking is which one is better (or there are no differences at all)

int variable = 0;

or

int variable = random(seed);

Let's assume, for the sake of the question, random(seed) is indeed true randomness.

About XOR operator. As I said I only partial read the article. I saw two paragraphs one named something like "Using random number generator" and the other "Using XOR to initialize variables". How is XOR used is unclear by me and I only mention it here to draw attention to it if someone knows something more about it.

In many programming languages, initialization of local variables is forced, or the engine will flatly refuse to read uninitialized data. Even in languages where you can read uninitialized variables and thus get a copy of what remained in RAM at that emplacement, you cannot count on it to be "random"; it will have a tendency to contain always the same value, depending on what the application did previously. Indeed, in C, local variables are from the stack and/or cached in CPU registers, and these are resources which are constantly reused throughout the application.

If the article you read recommends not to initialize local variable, and then to read them, and expects this to yield "randomness", then this article shall be burnt to the stake, for many reasons:

Reading uninitialized data is a clear breach of specification; in the C programming language standard, this is called "undefined behaviour" and may yield problematic results, including an application crash, or, even worse, silent memory corruption.
This kind of randomness will not be any good, by any notion of "randomness" worth speaking of.
Reproducible behaviour is good. By trying to obtain non-reproducible values from local variables, the article just promotes making the code impossible to debug, which can only be described as a bloody stupid thing to do. In particular for security. This will almost guarantee the presence of long-standing, hard-to-detect security holes.

If you want randomness, use what the OS provides, e.g. /dev/urandom. It is incomparably better, from all point of view, than irrational home-made rituals meant to propitiate the gods of randomness.

Edit: As @TerryChia points out, your question might be about forcing a random initialization of variables (local or not) from a PRNG, instead of leaving the default value there (if there is a default value, of course; in many programming languages, local variables have no default value at all). What you call "XOR" in that context is unclear.

In that case, either you do not read the said variables before storing a meaningful value in them, in which case what the variables initially contained is completely irrelevant: it does not impact the behaviour of your code. Or you do read the variables and then get these more-or-less random values from them, making the application code not reproducible and leading to the problems explained above; namely, that the code will be hard to debug, increasing the probability and density of actual vulnerabilities.


Stateless authentication with JWT: refresh token is not stateless In my current architecture, my backend issues a JWT back to the (mobile) client. The primary reason to opt for a JWT is stateless authentication, i.e. the server doesn't need to store data in the session/database, which means less overhead and scalability issues.
A common strategy is to log in the user and return back the short-lived JWT (approximately 15 minutes - as I read), together with a refresh token that the user stores in the client. The refresh token never expires, and can only be revoked. The purpose would be to avoid sending a long-lived JWT over the wire too many times, and only refresh the JWT when expired; when an attacker would get hold of the short-lived token, the attack time window is brief.

The problem is that this story seems to be full of holes when I think about it. Please help me clarify.

A 15 minute expiration time would mean that some users might as well send a refresh token over the wire 10 times/day. That might just be as high a frequency as some user would make requests with a regular, short-lived access token. Therefore the argument of the refresh token seems questionable.
If you question SSL, then I don't know why so many companies use basic authentication. To use JWT with refresh token, you probably should use HTTPS anyway.
What is the benefit of JWT if you then need to store a refresh token in the session/database in order to issue a new jwt to the client. In this case, the refresh token would act as a sort of password (although I realise it's not exactly the same) that gets stored in the backend. This makes the authentication flow essentially stateful and seems to take away the benefit of using JWT altogether. Also, with a brief expiration period of 15 minutes, it means that you have a lot of overhead, needing to get a refreshed access token almost every time you check your phone if there is a 30 minutes interval.
Not only is there the overhead to check the stored refresh token, additionally you need to check whether the refresh token is blacklisted, which means another performance overhead. (Edit: the last check can be removed by just removing the refresh token from the db when revoked).
A refresh token requires multiple server roundtrips:

401 is returned when the access token has expired (resource server).
A new access token needs to be requested at the auth server
The request to the resource server needs to be re-initiated.

Can someone explain to me what I'm missing here?

One of the main criticisms of stateless session tokens is the lack of a secure logout. Having a separate access/refresh token allows a compromise. You can greatly reduce the amount of database access, while having a secure logout function with a 15-minute delay.

The design doesn't do anything to protect against session hijacking, i.e. malicious capture of the token. Just use SSL, it is ubiquitous these days.

You can reduce the amount of round trips with some care. Many client HTTP libraries allow you to perform proactive authentication, which avoids the extra round-trip to get a 401.

I agree that it's not a particularly sensible design. Most web site are database heavy anyway, so checking a token on each request isn't much more overhead. And while the basic concept of access/refresh tokens is secure, I worry that the extra complexity invites implementation flaws.


Is it possible to avoid PHP string validation with malformed UTF-8 string? Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid string validation with malformed UTF-8 strings somehow?

It is hard to make a list of this functions. I think every core PHP string function is affected somehow. For example strpos does not give the right position in a string, strlen, does not give the right length. So I guess htmlentities, htmlspecialchars, etc... are affected as well, but it is more complicated, because some of them has an UTF-8 flag, some of them is not UTF-8 compatible, like strpos, some of them does not work with malformed UTF-8, etc... I can do a search after I have a working example, so that's what I am looking for.

It is enough for me for instance something like:

send 2 malformed string to the server, which in theory I cannot check with these functions
concat them with implode, and get something malicious, for example XSS.

Is this possible? I don't understand fully how UTF-8 or how malformed UTF-8 works...

The explode() function does not use any encoding. It simply splits a sequence of bytes at a subsequence of bytes. Whether those bytes are valid characters in the encoding you happen to use is outside the scope of this function.

So explode() works the same for any string, be it a valid UTF-8 sequence or an invalid UTF-8 sequence.

If you want to validate the strings against a particular encoding before the split operation, you're free to use mb_check_encoding().


Is storing encrypted data in a database futile? The way I see it: there are two ways to encrypt data for a web app.

1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if a hacker does gain access to your server, it's only a matter of time until they find the encryption key and then all hope is lost.

2) Use a user's password as the encryption key. It seems like a bad idea to store their password in session information though, and it wouldn't work for collaborative apps. For collaboration, you could use a shared secret instead, but I've never seen a website ask you to remember two passwords (one that everyone in the organization knows).

So are we supposed to just go with method 1 and hope for the best? Or is it enough to just encrypt at the disk level? With that though again, if a hacker can gain access, they'll have no problem reading it. What's the standard here when dealing with sensitive data?

It depends on from which threats are you going to protect.

Encrypting data on database level is great protection, when you have so many IT employees, that you're able to divite them into teams responsible for each layer.

For example, banks and credit cards acquirers use PCI DSS security standard, which require such protection along with dividing IT staff into teams and restricting permission outside assigned layer (eg. internal network, or just border routers).

On the other hand, database-level data encryption gives you very little additional protection from outside threats, while causing rather huge application development overhead.

So if you don't care so much about protecting from inside threats, then disk level encryption should be just fine.


Websites Forcing Weak Password Standards (Updated) Please Note: I am not going to name the websites which have these horrible standards for their clients and users.

I have had to change my passwords for my routine update just recently in the last few months, several of my major services that I use forces weaker password standards. These weaker standards, which all of my passwords has to have, is special symbols (!@#$%^&*) and other special requirements.

A few of the major issues which came up with my password using their standards of a password is as following:

Must not start with a number
Must not have a special character
Must be a max of 8 to 12 characters long (depending on the service)

Why would they promote weaker passwords with these requirements?

I thought that passwords were suppose to (currently) be as long as we want, have special characters, and who cares if it starts with a number, etc, etc, etc.

Update 1

I may have forgotten details of what is going on, but I can provide some more information on the issues that I am seeing seeing here.

One of these services is my banking company and the other is my cellphone service provider. I am stuck with these two services given where I live.  These services are widely used, so they should be able to afford high-quality security.

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords".

(Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread custom of frequent password renewal, but it is a "common practice", certainly not a "best practice".)

If you have site-specific passwords, then poorly designed requirements will impact that site only. Ultimately, each site maintains its own security, and their "password requirements" are part of it. If a site enforces a maximum password size of 8 characters, then this means that:

The site owner does not have a good grasp of security.
The site is most probably weak in many ways; the weird password requirements are, usually, only the tip of the iceberg.

Thus, concentrating on the password misses the point. That site's security stinks and you can do nothing about it, except isolating the troublesome site, which is done by not reusing passwords.


Security during data transfer I am downloading a file from a http site on an wifi network. Is it possible(even theoretically) to change the contents of the file(or replace it with a malicious variant) during the download process?

Yes, an attacker can perform a man-in-the-middle attack against your requests over the network and replace  the file your requested with his -malicious- own.


Decrypting a BitLockered USB drive I have encrypted a USB drive with BitLocker and I have lost the password and the hash backup. I have tried to search for something to decrypt the drive but came short. I have imaged the USB drive and was wondering is there a way to decrypt an image file?

As @schroeder mentioned in the comment, the design goal of a product like BitLocker is to prevent exactly what you are asking.

It is impossible to decrypt an encrypted drive without a key? No - you can exhaustively search the entire key space until you locate one that works - if you can tell that is the case.

Is it feasible to decrypt an encrypted drive without a key within a reasonable amount of time and effort? No, it could take millenia to complete such a task.

Is there any way to crack a Bitlocker drive?


Approach to (nmap?) port scan a subnet over VPN? (updated with figure) I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server.

I want to do a port scan, indicated by the red arrow. The ports should appear to be closed when scanned from any other place than the jump host (due to firewall rules, in Azure - Network Security Group rules).

I want to test that nodes connected to the VPN gateway should be able to reach the jump host, but nothing else. The reason we want to test this is that we are using Azure technology that is new to us (firewall rules implemented by Network Security Groups). It's a proof of concept project.

What I discovered is that I cannot scan these directly with nmap from my local machine, because the VPN is treated like a PPP connection/dialup interface in windows. E.g. see http://seclists.org/nmap-dev/2006/q3/438.

I am looking for input suggestions on how to proceed.

I seem to have found a solution. Although it seems Npcap is not fully supporting PPP connections, I was able to use the --unprivileged option, in combination with skipping the ping probe using the -Pn option in nmap. In this case, this seems to suffice for the task I have at hand, although it is not fully clear to me what I might be missing when using the unprivileged mode.

For completeness I am adding the description of these:

  --privileged (Assume that the user is fully privileged) Tells Nmap to simply assume that it is privileged enough to perform raw socket
  sends, packet sniffing, and similar operations that usually require
  root privileges on Unix systems. By default Nmap quits if such
  operations are requested but geteuid is not zero. --privileged is
  useful with Linux kernel capabilities and similar systems that may be
  configured to allow unprivileged users to perform raw-packet scans. Be
  sure to provide this option flag before any flags for options that
  require privileges (SYN scan, OS detection, etc.). The NMAP_PRIVILEGED
  environment variable may be set as an equivalent alternative to
  --privileged.

  --unprivileged (Assume that the user lacks raw socket privileges) This option is the opposite of --privileged. It tells Nmap to treat the
  user as lacking network raw socket and sniffing privileges. This is
  useful for testing, debugging, or when the raw network functionality
  of your operating system is somehow broken. The NMAP_UNPRIVILEGED
  environment variable may be set as an equivalent alternative to
  --unprivileged.


How Chrome avoids sslstrip? I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against.

Anyone know how Chrome defends against that tool?

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.


Best way to encrypt user data stored in xml? First of all I am not very familiar with the world of encryption so please be nice.

I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from 5MB to 10MB.  So I am zippping this file with other xml files (not required encryption due to insensitive info) into one file in order to lower the size.

Due to security reason, I like to encrypt some part of this xml (still major part of a xml file) but it will need to be compressed with other files and encrypted data will not compressed much at the end.

Some articles say compression need to be done prior to encryption.  Is there any efficient way of serializing the data and compressed then encrypted?
Or all at once conveniently?

Anyone faced similar issue and resolved in a different/smarter way?

Some articles say compression need to be done prior to encryption.

Compression should be done before encryption because encrypted data will not be compressible. So, if you encrypt first then there is no point in trying to compress the encrypted data further.

This happens because the encryption algorithm causes the encrypted data to look like just random data, and random data can not be compressed, generally speaking.

You can certainly encrypt part of a file first if you like, that just will make the file a bit less compressible.


ECDH and Forward Secrecy I just read about ECDH and while getting a overview over the process, I noticed that this key exchange method does neither provide any forward secrecy, nor does it protect against replay-attacks, because the shared secret will be the same for each session. Are there any common methods that extend ECDH to support these security features?

To get Perfect Forward Secrecy, you have to use ephemeral keys.

With static Diffie-Hellman (elliptic curve or not, that's not the issue), Alice and Bob both own a DH key pair: Alice's private key is a, public key is aG (elliptic curve notation, G is the conventional "base point" for the curve); Bob's private key is b, public key is bG. When Alice and Bob want to talk to each other, they do the DH thing, which means that they end up with the shared secret value abG. They always have this exact shared secret. If an attacker manages to steals Alice's private key (a), then he can recompute the shared secret, and thus decrypt all past and future conversations between Alice and Bob.

Ephemeral Diffie-Hellman is about generating DH key pairs "on the fly" and not recording private keys anywhere (the private keys are kept in RAM only, and for the duration of the conversation only). Never being recorded ought to make these private keys immune from ulterior theft; that's where PFS comes from. This is used in SSL/TLS with the "DHE" (and "ECDHE") cipher suites: the server owns a private/public key pair, with the public key being in a certificate, and fit for signatures (e.g. that key pair is of type RSA or DSA). When a client connects, both client and server generates new DH key pairs; the server signs his newly generated DH public key with its signature key (the client verifies that signature and validates the server certificate). The key which is actually used to encrypt the data is the one derived from the Diffie-Hellman algorithm.

With DHE cipher suites, should the server's private key be stolen, then the thief only gains the power to compute forged signatures. The thief may then impersonate the server and endanger future communications by running a Man-in-the-Middle attack, but past connections were encrypted with regards to DH keys which have long been lost, and thus won't be decrypted by the attacker. That's PFS.


Aren't browser extensions a critical security risk? Lately, there was a lot of publicity given to such exotic security risks as Spectre and Meltdown, with immediate Pavlov reactions from Microsoft, Mozilla etc. However recently I came upon the (otherwise widely known) curious fact that nearly all browser third party extensions require permissions to access everything on the web pages you access including the data you insert in web forms yourself.

Citing Mozilla:

"There is one permission in particular, “Access your data for all websites”, that we’ve gotten many questions about since the feature launched. The reason why it’s worded this way is because a web page can contain virtually anything, and some extensions need to read everything on it in order to perform an action based on what the page contains.
For example, an ad blocker needs to read all web page content to identify and remove ad code. A password manager needs to detect and write to username and password fields. A shopping extension might need to read details of the products you’re searching for.
Since these types of extensions wouldn’t know whether any particular web page contains the bit it needs to modify until it’s loaded, and neither does Firefox, it needs access to everything on a page so it can look for and modify the appropriate parts. This means that in theory, while rare, a malicious developer could tell you their extension does one thing while it actually does something else."

But this includes scraping all your passwords, credit card numbers etc. ..

This appears to be not just "a security risk" but "THE security risk". It is insane: cryptography, as I understand, means now nothing and the user, assured by the green "Secure" label in the URL bar, happily inserts his credit card number just to have it sent immediately to some remote server which is not the one he had in mind..

My question is why so relatively little attention is given to what appears to be an enormous security  risk? For example, I would expect that as soon as you have any third party browser extensions with the permission to view "all your data", the "Secure" green label for HTTPS sites would be replaced with something else.

And shouldn't third party browser extensions be banned in any organization which treats sensitive personal data?

Addons can do almost anything in the browser and could be a security risk.

Mozilla has both automated and manual checks in place for addons. Before a addon is placed on addons.mozilla.org the code is first checked by an automated tool and subsequently reviewed by a human.

Chrome only has automated checks, but if you want to publish your addon you need a credit card number. This means they can block you and your creditcard if you do something nasty.

Furthermore, on Chrome on Windows it is particularly hard to install an extension that is not in the webstore. Chrome tries hard to block any malware extensions from installing in the browser.


Client security using UDP Introduction

I am currently trying to build up a networking layer for Unity from scratch. Currently I am testing the communication via UDP using Node.js for the server and the client. However I guess the language of the implementation will not matter for what I am asking for.

I actually only read about security related things at the server side. But due to I need other people to help me testing what I am creating I really need to be sure that they won't be harmed in any way.

Current approach

The current approach using Node.js for the server and the client is pretty basic. I simply send a message from a client to my server while the client and the server are not in the same local network. Both are behind a router and therefore also behind a NAT.

The server then sends back an answer to the IP and port received within the UDP packet that was sent from the client.

Problem

I am curious about the security on the client side regarding malicious data sent by somebody that is spoofing the client and/or NAT. Also I am not sure about if the fact that my application is opening ports on the client machines and routers might be used for something malicious.

Assumption

So far I figured out that malicious data might in fact be a problem at the application level. Also I figured out that it is not a security issue when my application opens ports (locally at the clients machine and then when sending within the clients router) or at least I cannot do anything against it.

So in sumary this would mean that I only need to protect the client on OSI layers greater than 4 (within the application). Anything less than or equal to OSI layer 4 doesn't need to be made more secure by myself.

Question

So is my assumption correct? If so what am I able to do against malicious data?

This should be a comment, but it's a bit long.

  security on the client side

...is totally dependent on the application itself (which, within the context of the question, we don't need to know about/discuss) and the firewall/NAT (which you've told us nothing about).

  I figured out that it is not a security issue when my application opens ports

Really? Increasing the attack surface does not affect the security?

  or at least I cannot do anything against it

Try harder.

That you are using UDP across a WAN or the internet (between 2 fixed points) rather implies that:

1) the application uses very little bandwidth

2) low latency is critical

Hence, TLS or a challenge based authentication step would undermine these 2 requirements. This rather implies that you should be using a one time pad both to authenticate the requests and to protect against MITM.


Why has my OpenPGP key been duplicated on expiry change? I've published my OpenPGP key publicly on the MIT key server. Later I realized I needed to set the expiry date to an earlier date than the one the (sub-)key was published with.

I managed to do this locally, but after I pushed the updated key to the server, it shows up as having two subkeys with the same ID. One of them has the old expiry date, and the other one has the correct new one. My local keychain still reports having only one subkey.

Why has this happened? Shouldn't the old key just get replaced with the updated one?
Can I be sure that my published key will expire on the new correct date that I set?

Why has this happened? Shouldn't the old key just get replaced with the updated one?

In OpenPGP (at lest for version 4 keys), the expiry date in not stored in the key packet itself, but in binding signatures (self signatures) on the keys. Changes to the expiry date (and other attributes) are performed by distributing a never version of the binding signature, which then superseeds the old one.

As key servers only do partial verification of signatures (if any), they keep all versions around and have the OpenPGP clients perform verification (and choose the newest valid binding signature and thus expiry date). Furthermore, it offers a kind of history of the key.

This was also discussed some years ago on the GnuPG mailing list, also linking an example showing the duplicated binding signatures that occured because of changing the expiry date:

sub  1024D/2D16624C 2003-05-13
sig sbind  FFFD5DA0 2003-05-13 __________ __________ []
sig sbind  FFFD5DA0 2003-05-14 __________ 2007-05-13 []
sig sbind  FFFD5DA0 2011-03-06 __________ 2013-05-13 []

OpenPGP clients like GnuPG will usually discard (or hide) the older versions after verifying the binding signatures.

  Can I be sure that my published key will expire on the new correct date that I set?

Yes, OpenPGP clients will follow the newest self signature available, and consider the older ones superseded.


Why TCP port 6666 and port 7777 open in a LTE router? I've got a LTE wifi router(JioFi 2) and there's port 6666 and 7777 are open.

Nmap scan result,

PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
6666/tcp open  irc
7777/tcp open  cbt

I can understabnd why port 53 and 80 are open, but why 6666 and 7777 ? What they're doing there ?

The device is made by Haier, which is accused many times of shipping devices with preinstalled malwares.

So my main question is how can I go deeper into this issue ?

In most situations, I would recommend trying to remote into the system, and see if you can see what processes are listening on those ports.  That would give you the best idea of what is going on in the system (i.e. which processes are bound to those ports).

Since that does not appear to be an option for you, my next suggestion would be to monitor all traffic which is going into those ports using Wireshark or a similar protocol analyzer.  You might be able to determine what those ports are doing based on the traffic going to them, and may even be able to capture some login credentials.

Given the fact that this is an LTE router, and you may not be able to perform a capture on those ports, my last suggestion would be to see if you can download a copy of the router's firmware from the internet. You can then analyze the firmware with a tool like binwalk. This is not a very reliable method, since there is no guarantee that the firmware on your router will match what was downloaded, but if you can't find those ports open on the downloaded image, you know something is odd about the firmware running on your router.


Brute-force attack to exe file I have an encrypted file and the program.exe through which it was encrypted. When I want decrypt file, I need to know the password with which the file was encrypted. Can you help me some tool for brute-force attack to this password, which will be usable for .exe file? When I paste wrong password, I get a popup window displaying message: wrong password.

The oldy but goldy one is John the Ripper which is open source and can be extended to your "program.exe". Needless to say, you need to know how the executable was encrypted. You cannot use John, or even your own extended version, to decrypt container formats for which the format and choice of algorithms isn't known.

Kerckhoff's principle states that the security of a crypto-system should not depend on static information such as the algorithm. Unfortunately that does not mean that it is necessarily easy to decrypt if the protocol or algorithm is not known or kept secret.

You may be able to identify the format of the file by using the Unix file command, other tools or even a text or hex editor. Looking at the header of the file does indeed make most sense initially, as safesploit muses.


Does using VPN on insecure host improve security? Let's say we have a private network that is inaccessible without VPN.

Now we want an external service to communicate (e.g. HTTP/AMQP) with the service from our network. As stated in title, it is less secure than hosts inside the network (no regular security checks, etc).

Is there any difference to provide VPN credentials or just adding this service IPs to the whitelist? I mean if external service would be compromised, VPN will not help (I guess).

What is considered a good practice in this scenario?

As said in a comment, VPN grants the untrusted host access to the network. A quick VPN setup can allow that host to have complete access to all network resources. This is the part you must focus on: providing the access but only for the required service. That service can be seen in multiple ways: access to an IP, to some ports in the network or to even an IP and a single port. So the good practice is to filter this access and only allow the VPN system to access the least possible resources required to perform the job. If a host can only access a port on an IP address instead of a whole network, there's huge security difference.