Does Heartbleed mean new certificates for every SSL server? If you haven't heard of the Heartbleed Bug, it's something to take a look at immediately. It essentially means that an attacker can exploit a vulnerability in many versions of OpenSSL to be able to gain access to a server's private key. It is not a theoretical threat, it is a demonstrable and reproducible threat. See the above link for more information.

The question I think most organizations are asking themselves is the following:

Does every company now need to create new public/private keypairs and ask their CA to invalidate the original signed keypairs?

It means much more than just new certificates (or rather, new key pairs) for every affected server. It also means:

Patching affected systems to OpenSSL 1.0.1g
Revocation of the old keypairs that were just superseded
Changing all passwords
Invalidating all session keys and cookies
Evaluating the actual content handled by the vulnerable servers that could have been leaked, and reacting accordingly.
Evaluating any other information that could have been revealed, like memory addresses and security measures

Summarized from heartbleed.com (emphasis mine):

  What is leaked primary key material and how to recover?

  These are the crown jewels, the encryption keys themselves. Leaked
  secret keys allows the attacker to decrypt any past and future traffic
  to the protected services and to impersonate the service at will. Any
  protection given by the encryption and the signatures in the X.509
  certificates can be bypassed. Recovery from this leak requires
  patching the vulnerability, revocation of the compromised keys and
  reissuing and redistributing new keys. Even doing all this will still
  leave any traffic intercepted by the attacker in the past still
  vulnerable to decryption. All this has to be done by the owners of the
  services.

  What is leaked secondary key material and how to recover?

  These are for example the user credentials (user names and
  passwords) used in the vulnerable services. Recovery from this leaks
  requires owners of the service first to restore trust to the service
  according to steps described above. After this users can start
  changing their passwords and possible encryption keys according to the
  instructions from the owners of the services that have been
  compromised. All session keys and session cookies should be invalided
  and considered compromised.

  What is leaked protected content and how to recover?

  This is the actual content handled by the vulnerable services. It
  may be personal or financial details, private communication such as
  emails or instant messages, documents or anything seen worth
  protecting by encryption. Only owners of the services will be able to
  estimate the likelihood what has been leaked and they should notify
  their users accordingly. Most important thing is to restore trust to
  the primary and secondary key material as described above. Only this
  enables safe use of the compromised services in the future.

  What is leaked collateral and how to recover?

  Leaked collateral are other details that have been exposed to the
  attacker in the leaked memory content. These may contain technical
  details such as memory addresses and security measures such as
  canaries used to protect against overflow attacks. These have only
  contemporary value and will lose their value to the attacker when
  OpenSSL has been upgraded to a fixed version.


Are SSH certificates more secure for service accounts? I'm considering how to deploy a service that needs SSH access to many important boxes in my infrastructure. Rather than store a long-lived SSH private key in a key store that the service could request, I'm considering using short-lived SSH certificates to allow SSH access for the service. So the two architectures I'm comparing are as follows (and I'm not mentioning the technologies at play, because I'm more interested in the theory and reasoning):

Public-key auth:

distribute a service account public key to all necessary servers
store private key in secure secrets store.
run service in a role that has access to the private key store

Certificate-based auth:

Distribute a CA cert to all servers
Store CA Key in secure secrets store.
CA service runs in a role that has access to the CA key.
Service generates private key pair and sends CSR to CA service
CA signs and returns certificate with short life span (~5 minutes or long enough to for the service to authenticate to the servers it needs).

Thoughts

The tradeoffs I see, is that with certificate-based auth, compromised certificates are quickly expired and thus less risky. If a service using SSH is compromised, I can revoke it's ability to request new certificates without having to do any config on any of the servers and without taking away the ability for other such services to authenticate. However, this architecture is more complex, and in the end, the SSHing service still has to auth somehow to the CA server to authorize the signing. Whether this is from a provider role permission, shared secret (hard-coded or accessible by a secrets store), IP address, or some sort of PKI (having the service provided a signed cert by its provisioner).

But whatever the mechanism, is this providing a benefit above and beyond just giving the services access to the private key, because if the services are ever compromised, an attacker can just as easily request a valid cert and use it just as well as a private key.

Is there a method for providing a way of securely authing to the CA server for signing requests that doesn't require human intervention and is resistant to the service being compromised? Or is there some other benefit to this architecture that would justify the extra complexity?

I don't want to confuse the discussion too much by bringing specific technologies into it, but to prevent this from being too abstract, this would operate in a kubernetes, EC2, or similar cloud platform where I can provide a set of API permissions to a service from the platform itself using RBAC. The SSH services might be short-lived push-style tasks or long-lived services like Ansible Tower.

Lets break down your problem into three parts:

1) Identity provisioning: Ideally you should strive to provide an identity to each of your servicer at the time of deployment. This is generally done using leaf X.509 certificates signed by a CA which is trusted by all entities in your infrastructure. The private key of the CA should not be accessible to anyone. For kubernetes and most cloud vendors, this is achievable via some kind of Cert management service.

2) Authorization: This is an open area for creativeness. Even in large DC operations like google, state of the art is to maintain an authorization file which contains data like ACL (which service can talk to which service). All services pull this file from a central known location periodically and use them to provide access.

3) Certificate revocation list: This list is stored in a central known location where all certificates which are compromised stored. All certificates keep a local copy of CRL and update it periodically. The minimum time you keep the refresh, the window a hacker has is small.

Now during SSH call, your server needs to check following:

1) Incoming client has an identity signed by CA.

2) Is the incoming client authorized to access my service?

3) Has the identity of this client been revoked?

If you follow all the three guidelines, you can have a robust mechanism to secure infrastructure which can scale easily to several thousand services.


What will be the problems if 2 users receive the same OTP in an arbitrary time gap? First of all, I sincerely apologise if this question has already been asked before. I searched in Google and on this website but was unable to find any article.

I have seen that most OTPs are 6 digits in length. That means at most 999,999 OTPs can be generated by a system. But what if at a certain point of time more than 999,999 OTPs are required?

I know that one OTP should be generated only once. Then how should the system be able to cope up with the above-mentioned problem?

Suppose that user A receives an OTP 123456 at a certain point of time. User A either uses the OTP or the OTP gets expired. Then after, say 6 months (arbitrary time period), user X also receives the same OTP 123456. What problem(s) may arise in this condition?

There are no issues. Each OTP is linked to a specific user for a specific time. If it's an OTP sent via email or SMS it's likely in its own database table with a user id and expiration. If it's HOTP or TOTP the key(s) would be linked to the user and expiration is built into the algorithm.

  I know that one OTP should be generated only once.

No. Each OTP should only be used once, and invalidated after use. There is no requirement that every OTP must be unique and never used again.

If an OTP is generated and then used, it may be generated and used again in the future, but at any point in time the only valid OTPs are those that were generated but not yet used or expired.


Thoughts on creating unscalable conditions to brute force even small passwords? I stumbled upon something called "scrypt" which claims to add fixed time/space complexity requirements into password-based key derivation.

Quoting from their page:

A simple password-based encryption utility is available as a demonstration of the scrypt key derivation function. On modern hardware and with default parameters, the cost of cracking the password on a file encrypted by scrypt enc is approximately 100 billion times more than the cost of cracking the same password on a file encrypted by openssl enc; this means that a five-character password using scrypt is stronger than a ten-character password using openssl [emphasis mine].

I don't think anyone disputes that having fixed time/space complexity requirements can hinder breaking passwords.  However, I've not seen any peer-reviewed work done with it in crypto or infosec circles, so I'm not convinced in its implementation.  (I mean, you just can't take current methods and layer something like this over it, so they must be implementing their own algorithm.)

Can anyone shed light on scrypt or any, perhaps more well-known time/space complexity password-based key derivation systems in use?

I won't mark this a duplicate (in fact, I'll kick you a +1), but I will primarily answer by pointing to Do any security experts recommend bcrypt for password storage?

The accepted answer there is from our resident cryptographer. The concept itself, mentioned in another answer, is key stretching. For that, there are RFCs, NIST-suggested algorithms, and papers published as references on the Wikipedia page as far back as 1978.

Reading up on those materials should give you a good understanding. See also our sister site crypto.stackexchange.com where algorithm internals are discussed.


Why should I sign data that's already encrypted? My question is about the difference between signing and encrypting.
Why would you still sign something if you are already going to PKI encrypt it?

Doesn't the PKI encryption inherently provide authentication, integrity and non-repudiation?

==added later===

What if I use my private key to encrypt my message. Then anyone can decrypt this message with my public key so it is not private, but all who do, know it is from me because it was decrypted by my public key. Also all know it wasn't tampered with precisely because they could decrypt it

Encryption provides confidentiality, i.e. ensures that only intended recipient will be able to decrypt the message.

Signing provides authentication, i.e. allows recipient to check that message was sent by a particular sender and wasn't modified.

One way to look at this in the context of PKI is like this: encryption only requires the knowledge of recipient's public key, so anyone can encrypt a message. Signing, on the other hand, requires knowledge of sender's private key, so only the sender can sign the message. As you can see, pure public-key encryption doesn't provide integrity nor authentication.


I mistyped a `pip install` command. Could my system have been compromised? While working on packaging my Python app, I attempted to install it locally from the parent directory by typing the following command:
pip install cms/

However, I instead typed the following command:
pip install cms

Which unintentionally installed this package from PyPi. I have looked through the installed source code and there seems to be nothing there. Can I be sure that there was no malicious code executed on my computer?

Any time you run pip install, your machine could be compromised if the package is malicious.
Looking at the code in that package, it does indeed appear to be empty. However, the installed code would not run unless you ran it manually. The more likely location for auto-run malicious code is the setup.py packaging script that is run during install; however, nothing malicious appears there either, assuming I am looking at the exact same version.
I suppose it could have been possible for a sophisticated attack that ran malicious code in setup.py during the install that removes the malicious code so you can't find it, and also reaches out to some remote server to update the version in PyPi as well. However, that seems like a very limited attack since it would probably only work once per package name, and the version history is available on PyPi. It's more likely that you installed someone's abandoned project.
It is good to be aware of what packages you are installing, especially since pip and other package managers have a history of actors using typosquatting to distribute malware.
If you want to avoid this issue in the future when working on your own packages, consider using pip install . from the top level directory of your project.


Can modsecurity 2.x read data from a text file that has been updated? I'm writing a rule for modsecurity 2.x to match an IP address to those in a file.
 SecRule REMOTE_ADDR "@ipMatchFromFile /etc/modsecurity/address_list.txt"

I understand how this works, I'm just wondering if anyone knows when modsecurity loads that .txt file.
Is it only loaded when the rules first load or can it be dynamically updated?
For instance, if you have a running instance of modsecurity on apache and you modify the address_list.txt file, will the rules pick that up or will you have to reload the apache config?

Files won't update dynamically in the server. If you want to get updated details, You need to restart the server. I checked this manually.


What keys are involved in an X.509 certificate? I'm trying to examine some instances where an X.509 certificate uses public and private keys for a paper I'm going to write. However, the only thing I have explicitly seen so far is in one of the components where the subject's public key is identified, along with the algorithm and its parameters.

How else does this certificate use keys?

A certificate does not "use" keys, it contains keys. That's its job. The certificate contains the public key of an "entity" (a human being, a job function, a server...) and an identity (which designates the said entity in an hopefully unambiguous way). Besides, the certificate is digitally signed by a certification authority, and that signature is to be verified with the CA's public key (which is not in the certificate we are talking about; rather, it is to be found in another certificate which has been issued to the CA itself).

All these public keys have corresponding private keys, which are, naturally, not in the certificate themselves (since they are private); each private key is mathematically linked with the corresponding public key, in a way which depends upon the algorithm type.


How is it on some removable media, when enabling/disabling password protection the changes happen immediately? For example I have a WD Passport external hard drive. After installing WD security I can enable and disable password protection, however the settings basically get applied instantaneously. Does this mean encryption is not actually happening? If not, is there any point in using a password?

It is possible to achieve an "instant password change" with an encrypted disk. The idea is that the disk is really encrypted with an internal secret key K. K is a fat, random key that you never see; it was generated when the disk was first powered, and it never changes. K is then stored in a specific slot, encrypted with a second key K', which is derived from your password. When you unlock the drive with your password, the disk firmware recomputes K' from your password, then decrypts K, and then uses K to read and write data to the disk.

When you change your password, K is reencrypted with the new K', but that's fast because K is, say, 128 bits, not 128 gigabytes.

A disk which does encryption that way also often offers a fast "wipeout" feature, by the simple expedient of generating a new K: the previous K being lost, every contents which were encrypted with K (the whole disk) are as good as cleared. (Thus, "K never changes" is not completely true; rather, K does not change when you change your password.)

Now this does not mean that your specific disk uses encryption, only that it could still use encryption, even if it offers fast password changes. There indeed are disks with "password protection" which is only a simple firmware-based lock, without actual encryption of the data, and that can be bypassed by changing the electronic board. If unsure, try to obtain the disk specs from the manufacturer: if actual encryption occurs, then the manufacturer will state it proeminently on the disk datasheet.


Identify a process that uploads data I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about 200–250MB. This seems to me very suspicious.

I have noticed that a data is constantly sent to 255.255.255.255. Is that OK?

In general, how can identify all processes that are sending some kind of data over Internet on Windows 7?

You could try to use Sysinternal's Portmon to see which process(es) broadcasts on 255.255.255.255. Don't be too alarmed before you see what kind of things are broadcasted.

To see a more precise view of the packets sent/received, use : wireshark.


Are Tesla cars hacker-safe? I was wondering, what would happen if a Tesla car was hacked into?

Are future cars designed to be able to be stopped by police via remote access and commands? What if someone actually causes an accident using this method? Who will be to blame? How can one prove the accident wouldn't be caused by the police or someone (connecting to say a SIM card embedded in the car)?

I was wondering, what would happen if a Tesla car was hacked into?

Nothing good I can promise you that.

  Are future cars designed to be able to be stopped by police via remote access and commands?

Not that we know of.

  What if someone actually causes an accident using this method? Who will be to blame? How can one prove the accident wouldn't be caused by the police or someone (connecting to say a SIM card embedded in the car)?

I will assume you will not be able to blame anyone until after an investigation is complete and there was evidence that either the car was hacked into or not.

Note:
Hackers have already proven they can hack into a Tesla car. See here.


VPN vs SSH tunnelling for hotel wifi I know it's recommended to use a VPN with a hotel WiFi but if I'm in a hurry and don't have time to setup my own VPN server would an SSH tunnel (invoked with ssh -D) work just as well to secure my web traffic?

Yes, an SSH tunnel will provide the same confidentiality and integrity as an OpenVPN or IPSec VPN tunnel, assuming the configuration is secure. If you expect an active MITM attack, you will need to verify that the SSH fingerprint that you are seeing is correct. If you have set up the server, you should take a note of the fingerprint so you can verify that it is correct when you connect to the server.


Fastest way to "lockdown" CentOS and have network intrusion detection, firewall, etc up and running? Are there any proven concepts or "installers" to get up and running based on the best practices securing and locking down a CentOS installation?

I'm hoping for an automated tool that would scan the system, give suggestions, change security settings, install a good network intrusion detection, and have some simple admin panel to check.

Is there such thing or is this just a fantasy?

I doubt you will find a One-Stop-Shop kind of solution that actually works well. Your best bet will be to review one of the excellent hardening guidelines and implement what makes sense for you.

That being said, you should probably check out two projects

Bastille
Tiger

If you have a little more resources available some vulnerability assessment products can do configuration audits. For instance, ProfessionalFeed subscribers to Nessus have a large number of configuration audits available, including many CIS benchmarks.

All of these will inspect your install and make some recommendations on what to change or tell you how this install deviates from the standard. However, their base rulesets may very well not work for you. You really need to modify their checks to match how you want your environment to look.


metasploit: how do I force build database cache Every time I update from git, the database is invalidated.

msf exploit(handler) > search xxx
[!] Module database cache not built yet, using slow search

How can I force the database to be built?

And in msfconsole, how can I check the database update status?

If you get a "[!] Module database cache not built yet, using slow search" error after updating. Once you disconnect the database connection, you can try to reconnect db.

 1. msf > db_status
 2. msf > db_disconnect
 3. msf > db_status
 4. msf > db_connect user:pass@127.0.0.1:5432/dbName
 5. msf > db_rebuild_cache
 6. msf > db_status
 7. msf > search xxx

You can try version command maybe help

msf > version


Authentication between multiple systems/platforms within the same web application context Consider the following scenario: Web application is using two separate systems (they can share data/state through DB). First one is used for processing standard web stuff like HTTP requests/responses, HTML content, forms and all things related. Second is used for real-time communication like sending messages and notifications (long poll or WebSocket server).

User can be authenticated through the first system/platform and if the credentials are valid, some web page is sent back to the client. Once this page is loaded, client should be connected with the second system/platform transparently in the background.

The question is: how to authenticate user on a web page/application which consists of multiple systems/platforms on the back-end?

I can imagine it this way:

When user is authenticated through the first system/platform, GUID token is generated and stored in a database bound to some user. This token and user ID is also sent in a response back to the client and, for example, rendered on the page in hidden fields.
When the page is loaded and connection with the second system/platform is taking place, token and user ID from hidden fields are retrieved and sent as parameters with connection request. Back-end finds user, compares his token in the database and if they match real-time connection could be initiated.

I understand that this approach is vulnerable to sniffing for example, but I'm namely interested in the authentication procedure between two separated systems/platforms.

Generate a session token upon login.
Store that session token in the database.
Check for valid session tokens when authenticating.

Pretty much what you have. Just consider if you want to have more than one valid session at once and how you'll go about expiring sessions.

EDIT for crazy comment thread below

While one can provide tokens to the client that are verified by the 2nd server without communicating with the 1st server, that's ugly and involves a lot of work. Such a scenario does not permit one to invalidate sessions unless the client takes care of it. It also requires a certain time window when tokens are passed, timestamping of tokens, tracking of tokens by the 2nd system, signing or HMACs in the token passing, etc. Unless these two systems can't see each other on the Internet, just avoid that mess entirely.

I gather that both systems can access the same database, but if for some reason they couldn't, having a API exposed to the second system that can remotely verify would be appropriate as well (secret.page?checkUser=token... or such).

Without SSL, there is nothing you can do to prevent session hijacking by means Firesheep / MITM attacks.


What is the value of vendor specific security certs vs. general ones? Let me preface my question by saying that I understand that experience is generally more valuable than certifications when it comes to the IT profession.

Having said that, are vendor specific security certifications, such as Cisco's CCNA & CCNP Security routes, looked at similarly when compared to more general ones such as CISSP and Security+? i.e. a security cert is a security cert? Or do employers look at something from Cisco, MS, et al. as too focused and not really adding value to the candidate, especially if they do not use that vendor's equipment?

Do mind that within security there are different segments. You have:

security analysts
penetration testers
forensics
network security
...

When applying for a job it is important to look at the job description. If they are looking for security specialists in a networking environment then obviously a Juniper/Cisco security certificate will be plus, whereas a MS security cert will be of less value.

If you are working as a penetration tester then the OSCP/OSCE would be more appropriate.

It really depends on the job.

Some certificates like CCS or OSCE show that you are capable/willing to learn very difficult things. Which will also be considered.


MsChapV2 authentication and Evil Twin attack I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can retrieve the NTLM v1 password. From the implementation of the MS-CHAPV2, it seems it is not possible.

This is the context: A hacker sets his notebook to perform an Evil Twin attack on a WPA2-Enterprise network. He will impersonate the correct Access Point and the correct Authentication Server, waiting for some clients to connect to his notebook in order to steal their credentials and to impersonate them in the enterprise network.

The network uses MS-CHAPV2 as the inner authentication protocol.

When the client starts the EAPOL process to access to this fake network, we arrive at the inner authentication process (of the client at the server):

This process follows these steps:

The client starts the protocol with a “hello" message.
The authentication server answers with a 16 Byte ServerChallenge.
The client combines the ServerChallenge, a 16 Byte random ClientChallenge, and the username to create the ChallengeHash.
The client then calculates the NTHash which is the MD4 hash of the user’s password and pads this with zeros to 21 bytes.
Client splits the 21 Byte long NTHash in three 7 Byte long DES keys. A parity bit is added to each 7 bits to create a 8 Byte long DES key.
Each key is used to encrypt the ChallengeHash. The concatenation of these three ChallengeHashes forms the ChallengeResponse.
The 24 Byte ChallengeResponse, 16 Byte ChallengeHash and the UserName is sent to the AS.
The AS has to answer with an AuthenticationResponse which uses the md4 hash of the md4 hash of the user’s password combined with the ChallengeResponse sent by the user, two constant sentences and the ChallengeHash. This message is sent to verify that the server knows the password as well.

As an attacker, I can see all the information received by the client and all the information sent by the server. However, if the client uses the "MD4(UserPassword)" string as a key to encrypt the 3 different parts of the challenge response (see point 5), how can it be possible that I can obtain this MD4 password?

Why could I obtain, in my testing process, something like this (NTLMV1 hash)?
(I'm using hostapd-wpe)

TL;DR - You can trivially brute-force the DES keys used in the challenge/response mechanism. In order to reverse the challenge/response mechanism you only have to brute-force two DES iterations that have a 56-bit key.

In order to obtain the NT hash, you will need to concatenate the challenge & the first two-thirds of your response and K3 as Base64.

NTLM is a challenge-response authentication protocol essentially what this means is, one party will present a challenge and the other party must provide a valid response - if this doesn't happen then authentication will not take place.

A good way of picturing this would be a security question - imagine if to unlock your account you had to provide the correct answer to the following security question; What  was the name of your childhood pet? While this is not exactly what this would look like it's a nice way of picturing it.

High-Level Overview

NTLM has three messages to authenticate a client, these messages are defined in the following Microsoft document NTLM Messages

NEGOTIATE_MESSAGE
CHALLENGE_MESSAGE
AUTHENTICATE_MESSAGE

These messages are sent in the order they are listed in, we will change the notation of these messages to be NM, CM and AM.

Firstly the client will send the NM to the server this will allow the client to inform the server what NTLM options it supports, upon negotiating this the server will then send a CM to the client. The idea behind the CM is so that the client can prove it's identity to the server. Finally, the client will send an AM back to the server after the CM has been processed by the client.

Hashing

NTLM uses two hashed passwords which are stored on the server and while they are salted before they are sent over the wire they are not salted in the machine's memory, this is an issue because if you obtain the hash value from the server you can use it to authenticate without even needing the password.

The first hash is known as the LM and the other is known as the NT. The LM uses a DES-Based function and the NT uses MD4.

LM

The linked diagram shows how the LM hash is calculated using the example of "napier" alternatively the below steps follows the same premise.

Convert user's password to uppercase, then pad the provided password up to 14 bytes using NULL-padding
Split the 14 byte password into two 7-byte halves
Create two 64-bit DES keys using the 7-byte halves (with the addition of a parity bit for every seven bits)
Each key is used to encrypt the string KGS!+#$% which returns two 8-byte cipher values.
The resulting two values are concatenated to give a 16-byte hash.

It is not certain why "KGS!+#$%" is chosen however as per the below on the LAN Manager Wikipedia page it would seem the reason is related to the writers of RFC 2443.

  The string “KGS!+#$%” could possibly mean Key of Glen and Steve and then the combination of Shift + 12345. Glen Zorn and Steve Cobb are the authors of RFC 2433 (Microsoft PPP CHAP Extensions). - LAN Manager Note 2.

NT

With the NT hash each character is converted into UTF-16 and uses a Little Endian format, I am not going to go into detail about Endianness here so, unfortunately, it will require research if you're unsure of what that means.

Lets look at another diagram using the "napier" example again in the following diagram you can see we take the word napier and after every character we have a null-byte for example "napier" becomes 'n' 0 'a' 0 'p' 0 'i' 0 'e' 0 'r' 0 as shown in the linked diagram, this is the result of encoding "napier" with UTF-16-LE. Then we use an MD4 signature taken from the string which returns a 128-bit code that in our example would be 307E40814E7D4E103F6A69B04EA78F3D you can try this out yourself using this MD2/MD4 encryption site. In essence, the function would look like this to get the NT hash: MD4(UTF-16-LE(password))

Low-Level Overview

Now that we have discussed the hashing and a high-level overview of the challenge/response authentication method we will look at the low-level overview of how this works.

Both of the hashes above produce a 16-byte value, 5-bytes of 0s are appended to reach 21-bytes. Those 21 bytes are separated into three 7-byte values. Each 7-byte value is used as a key to DES encrypt the 8-byte challenge we send to the client. The three encryptions are then used to form the 24-byte response.

The server will authenticate by sending an 8-byte random number
known as the challenge. (See above)
The client will perform an operation involving the challenge and a
secret which is shared between the client and the server, this secret will be one of the two password hashes we described previously.
The client then returns a 24-byte result from the computation. It's
typical in NTLMV1 that both hashes will be used for the computation and thus both 24-byte results are sent back.
The server will then verify that the client has computed the correct
result, if they have the server will infer possession of the secret
and hence the client's authenticity.

In essence, the below code-block shows how the steps performed look with the mathematical notation.

C = 8-byte server challenge, random
K1 | K2 | K3 = NTLM-Hash | 5-bytes-0
Response = DES(K1,C) | DES(K2,C) | DES(K3,C)

Hashing/Encryption weaknesses

NTLM is a very old protocol - usually, older protocols don't survive (if there are issues with them). NTLM is one of those older protocols that didn't survive the test of time. Firstly the functions that are used are too weak/cheap for modern day hardware.

Let's look at DES, DES was first published in 1975, it's a very old protocol, one of the main issues with DES is how weak it is against brute-force attacks, especially in the modern age. In fact as per DES Strengths and Weaknesses it would seem that even in 1977 with enough money it would be possible to brute-force DES.

  In 1977, Diffie and Hellman proposed a machine costing an estimated US$20 million which could find a DES key in a single day.

  So it is arguable that DES was never strong against brute force
  attacks (the standardized post-NSA consultation version anyways -
  originally the designers did propose a "real" key size).

If you're wondering about the maths behind how long it would take to find a DES key compared to an AES key see: How long does it take to crack DES and AES?, the top answer clearly presents the length of time it would take, just be aware post is from '11, things do change and so does computing power so that is something to factor in, see that answer as a guideline rather than an exact figure.

In essence, the time it would take to brute-force a DES key (especially with today's computing) is way too short for it to be considered up to the modern standards and thus it's become obsolete.

What about MD4? Let's take a look at Message Digest 4. As you may be aware we now have MD5 which like MD4 is still pretty weak for things such as password-hashing due to its speed.

Whilst MD4 is a relatively "new" hashing function, it is still weak. It was first published in 1990 by Ronald Rivest who is incredibly well-versed in Cryptography and well-known to Cryptographers.

MD4's problem (and MD5's in-fact) is how cheap it is to compute collisions; in short, a collision is where a function maps two distinct inputs to the same output, a collision-attack describes the process of attempting to find two inputs that produce the same output. Computing collisions in MD4 is really fast & incredibly cheap. In-fact there was a collision attack published in 2007 that could find a collision in less than two hash operations.

Other Weaknesses

One distinct issue is the ability to perform a relay attack fairly trivially see: Practical guide to NTLM Relaying

I won't go into it here for the sake of post length however the above linked should have more than sufficient detail.

Weaknesses in MSCHAPV2

As for weaknesses in MS-CHAPV2, in step four of the process because the NT hash is not salted as an attacker you can reuse it, this means the NTHash is used as the password, meaning that we can use it to authenticate as the user; to add to that we can also impersonate the AS and authenticate the user. Because there is no salt being used this allows us to use rainbow tables.

Another blatant issue is in step six where you can easily perform a brute-force attack on each key fairly trivially see: Evil Twin Vulnerabilities in Wi-Fi Networks

Further Reading

MD4

DES Challenges

DES

NT & LM Hash

Stop using NTLMV1

LM, NTLM, Net-NTLMv2, oh my!


Are recent versions of ASP.NET implementing proper authenticated encryption? There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use FormsAuthentication.Encrypt() now (with latest patches to asp.net 4), will it use the proper Encrypt-then-MAC?

FormsAuthentication.Encrypt() now uses the encrypt-the-MAC pattern over both the IV and the ciphertext, so yes, it is done correctly now.

As a side note, it does depend on the machinekey element to determine which encryption and MAC algorithms are used, it's worth double-checking your configuration to ensure you're configured to use either AES or Auto (which resolves to AES) and not DES (weak) or TripleDES (slow).


Identify users accessing hidden link in a website Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it).

Any way, I found that there were plenty of HTTP requests with a reference of browsers which have accessed the hidden links.

E.g : "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31"

So now my problems are:

(1) Are these web crawlers? or else what can be?

(2) Are they malicious?

(3) Is there a way to profile their behaviour?

I searched on the web but couldn't find any valuable information. Can you please provide me some resources, or any help would be appreciated.

All websites should be receiving regular attacks,  if you are not begin attacked,  please check your internet connection.

A link is in no way shape or form "hidden" if a robot can find them.  A malicious bot will use a robots.txt file to enumerate resources on your system ignoring the deny directive.   Using a CAPTCHA will prevent automated attacks.  Also consider password protecting "hidden" links.


Securing data on Android app using a 6 digit PIN Lets say that on an Android app the user has to enter a 6-digit PIN on startup. Let's also say that we have some sensitive data in this application that we'd like to encrypt.

The way I would to this is:

Using a key derivation function (e.g. PBKDF2) we generate a key from the PIN.
Encrypt the sensitive data with AES using the key (and a decent config like CBC+padding).
Store encrypted data wherever, e.g. in shared preferences.

The main issue I see here: the original PIN space for a 6-digit PIN is 10^6, which is laughably small to use as the basis of your encryption...

Can we actually fine tune this so the stored data is reasonably secure for a while?

Even if we tune our KDF such that a simple derivation takes 1 second (I don't think we can expect our users to wait much longer during app start), then going through 1'000'000 of them takes merely 11.5 days (assuming same processing power as the phone, which isn't likely...).

  Restrictions:
  Obviously using a longer/stronger PIN would help - but regretfully even just a 6-digit PIN is seen as a hurdle by users, so this isn't likely an option. Also the KDF strength is limited by the amount of time we can expect the users to wait during app start, which I'd say is in the order of magnitude of 1 second.

My recommended option would be to either store the data, or at least store they key server side.

Since this isn't possible for you, I would bring it back to management that there are conflicting requirements.  I would argue that the keyspace is too small for the encryption to provide any real value.  I would recommend giving management a real world estimate of 156 guesses per second (from this article https://arstechnica.com/security/2015/08/cracking-all-hacked-ashley-madison-passwords-could-take-a-lifetime/), which would mean that a cracker would have all possible results within two hours.  Custom built cracking hardware will be much faster than a mobile device.  See here for an example: https://sagitta.pw/hardware/gpu-compute-nodes/brutalis/.

I would inform management that the offline requirement with such a small keyspace would preclude properly securing the data.  If they want the data to be secure, they will either need to budge on the 6 digit pin, or they will need to budge on the offline requirement.


How to use Gutmann method SQL? Is it possible to use Gutmannr method for single SQL cell ? https://en.wikipedia.org/wiki/Gutmann_method

Is it possible to use Gutmann method for single SQL cell ?

No. A database is several layers of indirection above the actual storage while the Gutmann method relies on writes getting more or less directly passed through the hardware. Changes to data in the database will often not even overwrite data (which is a fundamental requirement of the Gutmann method) but instead write the new data on a different position and once the transaction is completed declare this new data the current one. Additionally older data remain in transaction records and backups.


Is the Mirai malware attacks related to the TR-069 is a classic port attack? Refering to the following topic:
http://arstechnica.com/security/2016/11/notorious-iot-botnets-weaponize-new-flaw-found-in-millions-of-home-routers/?utm_content=buffer8f018&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

There is a  Mirai malware attacks related to the TR-069. which use the TR-069 opened port 7547 to make attack.

Is it a classic port attack?

I think to fix that attack I have:

to use a random port for each device instead of the known port 7547
to add a firewall rule in my iptable. The firewall  rulle will allow to accept connection request of the opened port from only a know IP address

Are my suggestion is sufficient to protect my devices against this attack?

I have no idea what you consider a "classic port attack" but this attack uses a security problem at the application layer and is thus more comparable to  attacks against web applications. In fact this is an attack which uses a security problem in the processing of a SOAP request delivered through HTTP.

While you can block connections attempts with a packet filter in front of the affected router you disable the remote management interface this way which might cause problems for your ISP and thus for your connectivity. Same is if you would just move the service to another port unknown to the ISP.


What to do if a vendor does not assign a CVE for an acknowledge vulnerability? We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas).

We notified the company, they acknowledged the problem and they are going to release a patch for it.

We specifically asked to have a CVE assigned to the vulnerability we found, but they replied giving us an internal "bug identifier".

Is this a "normal" behavior?

How can we get a CVE if they do not assign one to the bug we found?

Thanks

Most likely they would like to release a patch before making a public CVE. If they released a public CVE before they patched it would only hurt themselves, as the current version would be open to attack. Once they release a patch and are able to notify their customers, then I would expect that they would release a CVE to get the general public caught up.


Are positional parameters vulnerable to command injection? I am trying to find if the following shell script is vulnerable to command injection
#!/bin/sh

set -x
dig +noall +answer TXT $2._domainkey.$1

Now when I try something like this,
sh script.sh "sparkpost.com & echo \$(whoami)" "google"

(Note: the script is actually executed by a C program using posix_spawn)
the following output is printed
+ dig +noall +answer TXT google._domainkey.sparkpost.com & echo $(whoami)
...
...

The echo command is NOT executed.
Can the input be modified to make the injection possible or is it that position parameters aren't vulnerable?

I see three layers of interpretation where there might be some sort of injection vulnerability.
(EDIT: immediately after posting this, I realized that since you're working with domain names, you could just validate the inputs in C before any of this, and make the whole thing moot. The allowed characters in domain names -- plain-ASCII letters and digits, dash (but not as the first character), and period -- are restrictive enough that you'd completely block all of these injection opportunities.)
Layer 1: There might be a command injection vulnerability in how you pass the arguments to posix_spawn. Fortunately, it sounds like you don't use it the vulnerable way, but I'll discuss it for completeness.
If you construct a command string (that includes untrusted data) like sh script.sh "<untrusted data here>" "<more untrusted data>", and pass that via posix_spawn to a shell for interpretation, something like this:
char *argv[] = {"sh", "-c", cmdStringWithUntrustedData, NULL};
status = posix_spawn(&pid, "/bin/sh", NULL, NULL, argv, environ);

...then you're almost certainly vulnerable to command injection. There are ways to safely quote/escape untrusted data for inclusion in a command string, but it's tricky to get right and you're better off avoiding it.
(BTW, my C is pretty rusty; please ignore any errors.)
The safe way to do this is to avoid the extra level of shell interpretation, and pass the arguments (as separate strings) directly to the shell that'll be running the script:
char *argv[] = {"sh", "script.sh", untrustedData1, untrustedData2, NULL};
                 /* ^^^ note the lack of "-c" */
status = posix_spawn(&pid, "/bin/sh", NULL, NULL, argv, environ);

Since the script has a shebang, if it's also executable you could also safely execute it directly, without specifying a shell:
char *argv[] = {"script.sh", untrustedData1, untrustedData2, NULL};
status = posix_spawn(&pid, "/path/to/script.sh", NULL, NULL, argv, environ);

With these methods, the untrusted strings are passed to the script without any interpretation, so they're safe from injection problems (at least until the script starts using them).
Layer 2: There's an injection vulnerability when the script uses the arguments. If parameter/variable/etc references are not enclosed in double-quotes, then values are subject to word splitting (basically, being broken up into separate strings on whitespace) and filename wildcard expansion. This isn't strictly a command injection, but it does open up a variety of opportunities for an attacker to trigger unexpected argument interpretation, do filesystem enumeration, etc. So replace this:
dig +noall +answer TXT $2._domainkey.$1

with this:
dig +noall +answer TXT "$2._domainkey.$1"

Note that the ._domainkey. part could be double-quoted (as above) or not (as in "$2"._domainkey."$1") -- since it doesn't contain any special characters, it doesn't matter. Also, you might think that an attacker could escape from the double-quotes by e.g. including a double-quote in the argument, but that's not the case; when a parameter or variable reference occurs inside double-quotes, it's expanded and then no further processing is done on the expanded value. So no quote/escape/etc trickery is possible here.
BTW, there are some contexts where it's safe to leave off the double-quotes, but IMO it's easiest and safest to just always double-quote them.
Layer 3: There's an option injection vulnerability with the dig command's interpretation of its arguments. Most commands treat arguments that start with "-" as options (/flags) rather than normal arguments; dig also treats arguments that start with "+" as query options, and those that start with "@" as a servername to query. Double-quotes have no effect on this, so when an argument starts with untrusted data, you need to be careful that this doesn't create a vulnerability.
In the case of dig, I don't see any obvious way to do anything really nasty here, but it's best to sanitize your inputs anyway. You can do this for each parameter with a case statement. Here's an example that restricts them to valid domain name characters:
case "$1" in
    [-+@]* )    # Forbidden as first character
        # Maybe log/report that someone's trying option injection?
        exit 1 ;;
    *[!-.A-Za-z0-9]* )    # Only allowed chars at *any* position
        # maybe report/log an error here?
        exit 1 ;;
esac

case "$2" in
    [-+@]* )    # Forbidden as first character
        # Maybe log/report that someone's trying option injection?
        exit 1 ;;
    *[!-.A-Za-z0-9]* )    # Only allowed chars at *any* position
        # maybe report/log an error here?
        exit 1 ;;
esac

If you wanted to be really picky, you could disallow ".-" in the middle of a domain string, since "-" is forbidden at the beginning of a domain label (but I don't think that's relevant for security). Also, if you can count on bash, and not some other shell, you could use its regex-matching feature instead of glob patterns in a case statement. But you're using a /bin/sh shebang, so that's not safe.


How to detect bots clicking a link? I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, thus making the statistics look bad. What are the approaches one can follow to detect if a click is legitimate or not? The very basic approach that I can think of is to monitor the IP address of the user and block if the number of requests exceed a threshold.

There's a number of potential methods you can use to differentiate bots from humans but none of them are likely 100%

Obviously as you say rate limiting catches the really stupid bots who don't know to click at human speed. You could say one click per IP but that will artificially deflate your stats in the case of humans behind a proxy (becoming more common as IPv4 addresses run out)

IP blocking isn't too useful in the days of cloud computing, it's pretty easy for an attacker to get a different IP or range of IPs to work from if they're dedicated enough.

As @fas says you can try user agent, but again that'll only catch bots who don't know how to set a user-agent which isn't really too difficult to do.

You could introduce some "computer hard" task into the clicking process but that would make your site pretty user unfriendly (e.g. CAPTCHA's). Again not 100% but harder to overcome trivially.

Ultimately I'd suggest it depends on how motivated/well funded your attackers are. If they are reasonably motivated and have some cash they can just hire real people to click the link (e.g. via amazon mechanical turk), at which point you're likely going to find it tricky to differentiate legitimate traffic from non-legitimate traffic.

Assuming your attackers are more casual about it, I'd say combine User Agent and source IP address.  User Agents can actually be relatively identifying (more info on the panopticlick site ). So if you limit each user agent to one click per source IP address you may get a decent approximation, against an relatively unsophisticated attacker.


How to be sure that a program uninstalled properly in Windows? I installed a software and it automatically installed another software along with the desired one. Therefore I uninstalled it using Control Panel\All Control Panel Items\Programs and Features.

But still I am seeing traces of that software. It leaves behind directories in C:\Program Files (x86),
C:\ProgramData, and C:\Users\AGN\AppData\Local. I deleted the related directories.

In my current situaiton, how do I uninstall every trace/file/dir the program left behind?
What should I do to sandbox software I dont trust when installing it, to avoid problems like this in the future?

Unless you do a forensic analysis of every change the program makes on install and updates you can't be sure its uninstaller removes everything. There's file creations, dll registrations, registry changes and start up config changes  amongst other changes that an application installation can perform. You can't even search for changes as the malicious programs can hide these actions by using names unrelated to the program you installed. You could rollback to a restore point but that is impractical given you may want to uninstall apps at any point.

You can sandbox with virtualisation, that's not just restricted virtual machines but you also use containerisation like Docker. Set up a container with the application and dependencies you need and delete the container and image when you are done.


why they still exist webapps that are vulnerable to XSS and SQLi? To protect your web application from XSS, it's enough to use the function htmlspecialchars($input, ENT_QUOTES); and mysqli_real_escape_string($var); for SQL Injection, it's a simple information and a well known procedure even for beginners in web development, but in the other hand we see a lot of websites (sometimes big and famous ones) infected by these vulnerabilities,
I mean sanitizing user inputs is simple to apply and easy to remember, but how developers miss something very important like this ?

You are correct in stating that there are plenty of ways to protect your application from attacks such as XSS and SQLi. Unfortunately there are many reasons why these types of attacks are still the most popular type of attack. Consider the following possible reasons security is not always driven in a project:

Legacy code - There are plenty of applications that have been created years ago before security considerations became slightly more popular. These applications typically do not have a lot of ongoing development but are still available online

Developers / Engineers - The focus of these typically smart people are to create applications that address a business need. If the individual is not aware of the types of attacks that can happen, they simply won't prepare for it since their focus is getting the application built and deployed. If you never thought of the fact that the user might not be trusted, how could you possibly defend against it?

Time constraints - Business budgets rarely allocate sufficient time for security testing since it is relatively expensive and as any developer can tell you. There is almost always scope creep that eats into the testing budget

Rapid change in technology frameworks - Many developers / engineers are required to assimilate new technology rather quickly. Getting enough information to create the project does not always leave enough time to gain a proper understanding of the security options available in the framework

These are but a few possible reasons. My personal feeling is that developing secure applications at present requires at least some form of additional interest from developers / engineers / architects. The fundamentals are only slowly making its way into most university and other training institutions curriculums.

EDIT: Worked on my mobile at first and did not see the duplicate comments. Your question has definitly been addressed much better here: SQL injection is 17 years old. Why is it still around?


How to secure my captcha application? Hello information security stack exchange!

I made a captcha application in PHP. It's certainly not a great idea to do so, but I was bored and I wanted to learn about Bézier curves and Bresenham line algorithms. Therefore let's disregard that my application is not really secure against serious cracking attempts that try to crack it with OCR methods.

To my question:
My app basically writes every two hours 10 new captcha images in a directory (with a cronjob). If there are more than 1000 images in the directory, it replaces the oldest 10 images with the newly generated ones. So there is always a pool of 1000 captchas that slowly but steadily refreshes. All the captcha images have a 18 char long random filename and I have a associative array in my database that maps the filenames as keys to the captchas value.The array looks something like this:

Array
(
    [captchas/6aab1bfa796ff02b48] => knfbb
    [captchas/3f53d6eefb535233f0] => HnHnQ
    [captchas/436e3567bdbb987b45] => HaEQS
    [captchas/916ac5d684f17f1677] => aQnWE
    [captchas/fb6267bfb72ff37fdb] => fHWya
    [captchas/3fb748ba654b98088e] => WkSEG
    [captchas/71ea9d1d88a245c1e3] => HkQXy
    .
    .
    .
);

Whenever my captcha application hooks into a comment form or login form in order to inject a captcha image, it choses a random captcha from the pool and let's the user try to solve it.

Now you might already see the security drawback: How can I make sure that a user doesn't download all captchas and maps them manually (Decipher the captcha manually and map it to the md5-sum of the png-image) to it's corresponding string value and then spams my site with a script?

The attacker would just need to download around 20 percent of all images and then he had a average success rate of, errhh, yeah 20%, in succeeding to spam my site (The script would just refresh the form as long as it serves a captcha that it knows).

How would you defend against such attacks? (Under the condition that my app architecture doesn't change: I can't generate captchas on demand, it would be too slow).

I thought of blacklisting IP addresses (parsing apache2 access_log IP addresses) from my site that visit my site more than 100 times per 5 minutes, but this could easily be circumvented by proxies.

The issue seems to be exposing the url of the image and there by alerting the user to the possible repeated captcha.

Have you considered using a php script to serve the image? Perhaps using the session to identify which captcha image to serve.  Although a bit slower than the client getting the image directly, it does provide a means for obscuring which file the user is loading.


Creating a wordlist knowing parameters I need to crack my own router password. Advantage is that I know possible characters and maximum length.

What I need is to create a dictionary. The dictionary should contain all the combos of characters that I choose. I know that the maximal length is 8 characters, and each character can be ([A-Za-z0-9]).

How can I do that?

Well, I don't see why you need to create a dictionary. You could just generate the letter combinations as the program runs. No need to generate all the combinations ahead of time.

As for generating every combination, your alphabet has 62 characters in it. So, the number of combinations up to 8 characters in length, having at least one character is:

62 + 62^2 + 62^3 + 62^4 + 62^5 + 62^6+ 62^7 + 62^8 = 221,919,451,578,090

That is about 222 trillion combinations. So, you would need to buy about 200 terabyte hard drives to store your dictionary. Are you sure you want to do that?

Also, if you could generate and write to disk 1 billion combinations per second, then it would take 479 years to write all the combinations, so you would have to have your descendants continue the project after you had passed on.


Memory Dumping - Cause for concern in Virtualization? Recently, I started exploring threats to Virtual machines in general. The first question that popped into my head was whether a host machine can dump its entire memory onto a file, and inspect the memory to read contents of the VM's memory image.

As virtualization essentially leads to the fact that the guest and host share the same RAM, I'm guessing that this is possible.

=====================
|           |VM|    |
=====================

Suppose the memory looks like this. 1GB memory for the VM out of a total of 8GB. So if I dump the RAM, I should be able to view contents of the VM RAM.

Q1. Is this a possibility? http://www.symantec.com/business/support/index?page=content&id=HOWTO31321 shows how to obtain a memory dump

Q2. Is this a threat? (I'm guessing no). However, if someone comes up with an idea, it would be splendid.

Q3. A more interesting scenario - Could the VM somehow grab the memory of the host? i.e. are there any known attacks on VMWare or other software that has documented such an attack ?

Is this possible?
Yes, it's possible. The VM's memory is accessible by the host system, which allows the host to read anything inside the VM, including kernel-mode memory. Quite a few VM solutions allow guest instances to be dumped to file, or suspended (i.e. a VM version of hibernate).

Is this a threat?
Note that the VM's memory won't entirely be stored in the host's physical memory, but rather will likely be partially stored in a swapfile. This means that part of the guest OS's memory is stored on the host's disk, making slack space analysis a potential attack, even after the guest OS terminates. Images of suspended VMs may also be accessible to an attacker if he steals the disk or gets file read privileges on the host. If the attacker can compromise the host, he may also be able to issue arbitrary memory reads and writes on the VM process, allowing theft and manipulation of data.

Can the VM grab the memory of the host?
It shouldn't be able to. VMs work by creating virtualised versions of processors and memory controllers. This virtual hardware takes normal memory access interrupts and translates them into a virtual address space. For example, the guest OS's kernel might wish to access the physical memory at 7a22d6aa, but the VM actually translates that address to vm.swap+0x7a22d6aa instead, such that the VM is completely unaware of the translation.

Such an attack would require violation of the isolation mechanisms built into the VM. These isolation mechanisms are very strong, since they have to contain an entire OS and any software / drivers it might run. Isolation is often implemented at hardware level using CPU extensions such as VT-x. However, VM systems are software, and software always has bugs. There have been vulnerabilities in the past where software on a VM was able to attack the host, usually via inter-OS communication mechanisms used for sharing files and clipboard functionality.


Uploading Executable Files Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is available for download in my own portal at any time after upload. The thing about this is that no one else can see files I've uploaded (not even administrators). For this specific app, the files are strictly for my convenience.

So I could bypass and upload malicious .exe files for example. What are the dangers, since obviously i'm not going to upload malicious files to screw myself over. I want to explain the threat to others.

I thought surely if someone were to "force" a user through XSS or CSRF or something to upload a bad file and then the users sees it and downloads it, that's one problem but what else? Is it inherently bad to have a malicious .EXE sitting in the database? Perhaps if an admin later reconstructed the files, or if later the business decision came up to have administrators view files (or even if the site becomes social later and you can see other files). But besides all this, what are some possible problems with bypassing a filter check in this case right now how the system is currently designed?

Thanks!

No, its not inherently bad to store a malicious file, as long as no one can execute it. Anti-virus softwares do this all the time when they "quarantine" malware.

Another possible problem that you can highlight to them is that a malicious user can upload illegal content on their service, for example, someone can upload child pornography there and it will create a major legal problem for that company.


Is it a good rule of thumb to keep a URL as short as possible? I was wondering if there are any security risks of having too long URLs for an internet site.

Of course there are things that don't matter if they're long or not, i.e. the actual hostname and filename, but I'm not so sure about queries and fragments in the URL. I actually once encountered a URL with over 900 characters.

Is there a rule of thumb saying that you should try to keep URLs as short as possible for security reasons or is it completely depending on the information that's transmitted in the URL?

Yes, they should be kept as short as possible (and within a reasonable limit for public readable URLs).

There are various vulnerabilities that only affect long URLs, for example: CVE-2017-1000100 - When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the un-truncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

There are other non-security or partial related to security vulnerabilities too:

Search engines, google included, have various limitations and will not function correctly if the URL is too long.
The Windows Server IIS maximum URL length is defined by the httpRuntimeSection.MaxUrlLength property. Its value is 260 characters. If exceeded,  "The length of the URL for this request exceeds the configured maxUrlLength value" error will be generated.
HTTP/2 requests may fail with too-long URLs in some cases for PHP, Apache, Varnish.


Is Apple's AirPort Time Capsule vulnerable to ransomware? I have a Macbook Air laptop and use Apple's Time Machine program and an AirPort Time Capsule (physically connected to my router via ethernet cable) to periodically back up my data.

If my laptop were to be infected with ransomware, would that also infect the Airport Time Capsule rendering the backups useless?

If so, how would I get around that?

Technically, the Time Machine content is as vulnerable as the content on your computer. It depends of course on the exact implementation of the ransomware, but you have to assume that when they target Mac OS X, they will target this well-known backup solution as well.

In fact, I read some reports recently that suggested the ransomware "KeRanger" that became known through a breach on the Transmission website was in fact already trying to encrypt Time Machine backups as well: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

So, you would have to assume that yes, ransomware in the future will do this and you can't rely on your Time Capsule backup. Even if you only sync the backup once a day - it would be trivial for the ransomware to wait until it can encrypt accessible backups as well.

There are some Apple knowledge articles about how to secure your Time Machine backup (below), but they will not be of much help, because they are intended to encrypt your backup from other people. You, as the user, will still have access. It is possible that accessing this data requires user authentication, but the ransomeware could still encrypt the complete backup. This would take time of course, but it's not unthinkable. An alert user may notice this and take counter measures, but the ransomware could also just delete all your backups instead.

https://support.apple.com/kb/PH18852
https://support.apple.com/kb/PH18836

So, you see the weak-point is that this data is easily and constantly accessible. It will only be a matter of how aggressive the attacker wants to be.

Alternative Solutions

One counter-measure would be to regularly create CD/DVD/Blue-Ray backups. It may be a bit old-school, but I want to see the ransomware that can break into my Backup - CD collection ;)
Another could be to use an online backup service. Ideally, you would want one that stores multiple versions of your files (like Time Machine does), so even if all the old files would be pushed as encrypted copies to the online backup, you would still have older versions accessible. Now, you could say the ransomware may also start trying to delete that online data, but hopefully this would require them gaining access to your backup account.
If you want to continue only relying on the Time Capsule, Mac OS X does have a fairly good rights management system - but note that this is worthless if the ransomware manages to gain admin rights through some security vulnerability (I would say that's something most attackers would want to do). Either way, you would first make sure your own primary user account is not an admin. Second, you would setup the Time Machine from your (secondary) admin account. Third, you would require password access to the (encrypted) Time Capsule disk and make sure this password is different to your WiFi password. Then, make sure you never enter that disk password in your primary, limited rights user account.

[EDIT]

Of course this list of alternatives is not(!) exhaustive. There are a million options to secure your files, but in case it helps anyone, I might add a few more options here that you can use for free today.

One thing we will assume is that the attacker is really only interested in your personal files and you are really only interested in protecting your important personal files. Now, the attacker doesn't know which files are important or not, they will just encrypt everything in your home folder ending with .doc / .pdf / etc. That means you don't have to backup your entire hard drive to protect yourself from crypto ransomware.

Backing up your important (text) documents really shouldn't be a problem today. You can use countless online storage services with free storage quotas.

If you are using Dropbox or a similar service, make sure that you don't have these folders actually constantly syncing, though or can at least restore deleted files / older versions online somehow. You don't want the attacker to delete your files and then Dropbox to conveniently also delete them on your cloud storage.

Collections of smaller project files could easily be put into a git repository and uploaded to Bitbucket (or alternatively to Gitlab or Github).

Make sure you are using a private repository here. Technically, git is intended for version control and works best with simple text files, but nothing prevents you from putting PDF files in here. This option is probably more suitable for advanced users.

Photos and Videos can be synced to numerous (free) online storage solutions (including Google Photos, Flickr, Shoebox, etc).

As with the dropbox situation, try to make sure that your online copies can't easily be deleted.

Use write-only folders as a primitive measure. Under Mac OS X you may have seen a folder called "Dropbox" in your "Public" folder (long before the other Dropbox Could thingy was a thing), which is Write-only for other users.

The idea would be to have another user on your machine that has one or more of such write-only folders available. You would regularly dump your important files into that folder. The folder can not be read by you, so ransomware running in your primary user account, hopefully won't be able to look inside.


AWS declined to give me details on Multi-Factor Authentication reset procedure I asked AWS:

How do I recover access to AWS Account in case I lost device with Google Authenticator installed?
In case my email was hacked, what will prevent hacker from removing MFA?

Their answer essentially was:

  https://aws.amazon.com/forms/aws-mfa-support

  When you fill up the form, there is specialized team (Not from
  Premium Support) will contact you via phone ONLY within 15 minutes to
  verify your identity and ownership of this account. They have a very
  strict procedures to be followed before removing MFA from the root
  account. Any incorrect answer for their questions will result
  rejecting this request and ending the phone call.

Since I need to know how verification process works in order to protect information required, I asked for more details. After some back and forth their final answer was:

  We know customers care deeply about privacy and data security, and
  that’s why our customers retain control of what security they choose
  to implement to protect their own content, platform, applications,
  systems and networks, no differently than they would for applications
  in an on-site datacenter. Disclosing our processes violate our privacy
  and security policies.We encourage you to refer to resources on the
  AWS Site for best practices in securing your account, as provided
  earlier, including the AWS Security Blog:
  https://aws.amazon.com/blogs/security/

  Thank you for your understanding.

Why don't they make verification process transparent, otherwise isn't it some kind of security through obscurity?

What can I do to make sure I don't get locked out of my AWS root account?

How to make sure that hacker who broke first layer of authentication is not able to reset MFA?

AWS already answered your question about transparency

  Disclosing our processes violate our privacy and security policies.

To avoid being locked out of your root account, backup your two factor authentication tokens. This will be specific to the solution you use.

If you use the Authy app for two factor authentication it can backup your two factor logins, as well as make them available on multiple devices. Authy is protected by a password.

Regarding your question "How to make sure that hacker who broke first layer of authentication is not able to reset MFA?"

Two factor authentication means the hacker can't access your website without your phone or token, or in the case of Authy, without the authy account details.  This is the whole point of 2FA - something you know (password) and something you have (token).


Is there a true alternative to using CAPTCHA images? Security is about balancing costs and risks, nothing is impossible to beat, specially not typical CAPTCHA implementations, but they do add something no other system seems to offer.

I've been reading around about these CAPTCHAs for a while and possible alternatives... (so please don't refer me to other sites/answers unless they truly answer the following question).

I have no experience whatsoever, so for me it is hard to estimate the costs and risks associated with this decision: should I employ CAPTCHAs (I'm thinking of JCaptcha or reCaptcha), or are a combination of other techniques enough?

I have a registration form to be filled, but I don't want my user table to be filled with trash. Honeypot field is easy to implement, but oh so easy to circumvent, simple security check (what color is the sky?) works well against automated attack, but any 15 year old can build a simple targeted attack that wrecks my user table...javascript to check time taken to fill the form is insecure and with a simple post to my server broken. Basically, I haven't found anything that works vs a slightly smart targeted attack except a typical CAPTCHA so I don't get trolled... So the real question is, am I at a significant risk of getting trolled with a targeted attack so I'd rather lose 10% of my users to these CAPTCHAs or is there an alternative that doesn't tax so much the user?

EDIT: Thank you so much for your answers, it certainly has helped me clarify ideas, specially the link to OWASP about avoiding brute-force attacks (got my +1, but I did not accept it since it didn't feel like a solution, but it does help find one. If you think I should accept it because I find it the best answer so far, please comment saying so since I may be misinterpreting the workings of the site).

On the other hand Asirra is quite fun and easy, and a lot better than traditional CAPTCHAs, I certainly would recommend it over other services. The puzzle is a lot more fun, and even if you fail, you would only fail once... pity:

  Asirra is still in beta-testing; the service and its API may both be unstable.

Final Edit: Just in case it is found useful, here are the steps I've taken to ensure users are not bothered by CAPTCHAs but I feel safe from bots.

honeypot field (so easy to implement it cost me nothing though I don't feel very secure with it.)
e-mail verification link (or OAuth access) since it was always on my plans to add it. only validated users are migrated to my user table, the rest stay as registered.
time check: server time-stamp with signature loaded through ajax, user needs to take at least 5 seconds to fill the form before sending (the password) or it is discarded.
confirmation page (with server signed token to ensure the request has passed through the server first) after registration that warns the user that confirmation e-mail is required and has a button to send the confirmation e-mail. (In which case the data is also registered on the DB)

This will not stop a very dedicated attacker but I hope they will not want to spend hour and hours tuning his attack to gain nothing, just bothering me.

Thinking outside the box...

In most cases this applies: The business purpose for CAPTCHAs is to identify that the person accessing a page is a human being.  The underlying reason for needing to know it it's a human is to prevent automated form submission, and the main reason for preventing that is to prevent brute force attacks.

So the ultimate purpose of a CAPTCHA in most cases is as a tool to prevent brute-force attacks.

If this is your underlying reason for wanting to use a Captcha, read on.  Note that there are other reasons for using CAPTCHAs, and these suggestions may or may not be applicable.

That said, there are alternatives to CAPTCHA for preventing brute-force attacks.  The OWASP web site lists a few with pros and cons of each approach:

1. Locking Accounts

The most obvious way to block brute-force attacks is to simply lock out accounts after a defined number of incorrect password attempts. Account lockouts can last a specific duration, such as one hour, or the accounts could remain locked until manually unlocked by an administrator. However, account lockout is not always the best solution, because someone could easily abuse the security measure and lock out hundreds of user accounts. In fact, some Web sites experience so many attacks that they are unable to enforce a lockout policy because they would constantly be unlocking customer accounts.

The problems with account lockouts are:

An attacker can cause a denial of service (DoS) by locking out large numbers of accounts.
Because you cannot lock out an account that does not exist, only valid account names will lock. An attacker could use this fact to harvest usernames from the site, depending on the error responses.
An attacker can cause a diversion by locking out many accounts and flooding the help desk with support calls.
An attacker can continuously lock out the same account, even seconds after an administrator unlocks it, effectively disabling the account.
Account lockout is ineffective against slow attacks that try only a few passwords every hour.
Account lockout is ineffective against attacks that try one password against a large list of usernames.
Account lockout is ineffective if the attacker is using a username/password combo list and guesses correctly on the first couple of attempts.
Powerful accounts such as administrator accounts often bypass lockout policy, but these are the most desirable accounts to attack. Some systems lock out administrator accounts only on network-based logins.
Even once you lock out an account, the attack may continue, consuming valuable human and computer resources.

2. Inject random pauses when checking a password.

Adding even a few seconds' pause can greatly slow a brute-force attack but will not bother most legitimate users as they log in to their accounts.

3. Lock out an IP address with multiple failed logins

4. Design your Web site not to use predictable behavior for failed passwords.

As for this:

  I have a registration form to be filled, but I don't want my user
  table to be filled with trash.

In your particular case, I'd go with the a two-tier approach:

First, I'd use the "Inserting random pause" option just to limit how many bogus submissions could be entered in the first place.

To deal with potentially bogus registration attempts, use a verification mechanism.  Register them but not as active, send them an email with an "Activation" link. For those that activate - at least you know you have a valid email address of someone who actually wants to register.  Then implement a scheduled task that automatically deletes un-activated accounts after X hours or X days.


Determine Security Of A PDF File How do I find the exact encryption on a PDF file? I can't seem to get a direct answer on the net. For example how do I tell if a document is PDF 1.1 - 1.3 (Acrobat 2 - 4), PDF 1.4 - 1.6 (Acrobat 5 - 8), PDF 1.7 Level 3 (Acrobat 9), or PDF 1.7 Level 8 (Acrobat 10 - 11)? Additionally does anyone know which version Microsoft Word 2013 would use when I encrypt the file with a password?

If you know the password to the file, you can view the encryption type using Adobe Reader.  Go to File -> Properties -> Security and click the "Show Details" button.  See 'Screen Capture 1' below.  The security tab will also show you what version of Acrobat can open the file.  See 'Screen Capture 2'.

As shown below, MS Office uses 128 bit RC4, which is insecure, unlike AES encryption, and should not be used.


Is it acceptable for an internal HR site to run over HTTP? Our internal HR site - which has our personal details, payslips, holiday details etc. runs entirely off a basic http site.  The site is only accessible within the company network, and can't be accessed e.g. by employees at home (except through a VPN).  It can be accessed via our internal Wifi network.

I know https isn't the be-all & end-all of network security, but is this ever 'OK'?

This isn't a small company - it's a major publicly listed UK company employing 10's of thousands. I'd held off saying anything, as they were meant to be replacing the entire system Q1 this year, but this has now been pushed back to 2018.

Keen to understand

Whether there is a significant risk from this setup
Whether there's a possible breach of UK / EU laws (eg, UK Data Protection Act) associated with this
If there are any specific steps I as an individual can do to minimise my exposure (other than not using the site!) to being intercepted.

Network is a mix of wired & wireless. Site can only be accessed internally, or via VPN.

The main motivation for HTTPS is to prevent an attacker from reading and manipulating your communication with a website. So the decision to deploy it on internal sites depends on whether there is a risk of someone tampering with your traffic inside the company network.

If the internal HR site just serves static content that is already accessible to anyone in the company's intranet, then one could argue that HTTPS doesn't add any security because intercepting traffic to that page within the internal network would be pointless.

However, if the site uses a login system and employees aren't trusted to not interfere with the internal network or guests are allowed to access it - then the site should always be accessed over a secure connection.

  it's a site we log into (using a password we're forced to keep to max 8 lower-case characters only), where we can view wage slips, personal address / contact details etc.

That is concerning. Not only is the artificial password length limit really low and the lowercase-only restriction questionable. If the site uses plain HTTP, a rogue co-worker (or malware on their machine) could intercept your connection to the page, sniff your password and record your interactions with that site. Since you're saying it's a big company, not everyone accessing it might be completely trusted and hence they should consider deploying HTTPS.


Why is the DANE protocol depending on DNSSEC? Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?

The idea of the DNS-based Authentication of Named Entities (DANE) protocol is that domain owners publish the fingerprint of a certificate that their server uses in a DNS resource record. It is a measure to prevent certificate forgery. Users that wish to connect to the server via TLS can look up the fingerprint of the presented certificate in the DNS record for the corresponding domain name to see if it was permitted by the owner.

This means that DANE relies on the assumption that DNS responses can be trusted, which is not the case with regular DNS. So to assert the integrity of the DNS records, DANE uses the signature mechanism provided by DNSSEC. Otherwise a man-in-the-middle could simply modify the fingerprint in the TLSA record and DANE would be useless.


Is there a formal common Internet threat model? I'm looking for a common Internet threat model that describes active attacks formally. By active attacks I mean attacks of an attacker with literally unlimited resources and full control over the network, i.e. the attacker can intercept, modify and suppress every communication in the network but has no access to any of the communicating hosts. The ACTIVE ATTACK scenario of RFC 3552 seems to describe this model in an informal way.

Formal model for an active attack
Sadly there is no way to give you a correct and unique answer.
Please read the RFC3552 you pointed out carefully:

3.3.5. Man-In-The-Middle
A MAN-IN-THE-MIDDLE attack combines the above techniques...

About which type of active or passive attacks that have to be considered:
Both techniques will probably be used (mostly by complement, one with the other) to try and get the data the attacker is after.
Depending on what you have to protect and who could be interested in parts of your data the threat model could be constantly changing even for the same attacker on your system.
Sadly this means that there really is no available attack cookbook and this is not because they are keeping this secret, but because each target and attack are different and each way the attack happens(exploit, security hole, phishing site...) are constantly different, changing, and evolving.
But from my point of view, the most vulnerable element of any securisation edifice stay human: first the user, but the programmer too!.


How are hidden private URLs being "leaked" to third parties? We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is monitored through a protected dynamic (AJAX) UI, which displays a real-time stream of image previews which include the uuid in the URL, something like:
https://<SERVER>/<root>/image/a756f99c-f0ce-469d-80b7-8c8f3c0a0581

When I trawl through the Apache access logs I see requests to some of these image URLs from a small number of third party IP addresses, fairly consistently originating from either Amazon AWS EC2 instances in the US or "Bayer Business Services GmbH" in Germany, according to iplocation.net.
The question is how these image URLs are leaking out so that third parties are able to request them?
The URLs aren't aren't listed anywhere, so wouldn't be found by any crawling/scraping process looking at the site. The fact that they include a uuid means that even if a third party had the base URL (the "https://<SERVER>/<root>/image" prefix) it would be pretty much impossible to guess a valid uuid to append.
My guess so far would be one of the following:

The browser I'm using to monitor the site might be leaking request URLs to external parties, maybe for supposedly innocent reasons. However, I'm seeing these "URL leaks" whether I'm using Chrome or Firefox.
Some other process on the monitoring PC is leaking request URLs, for example maybe Bitdefender shares a selection of request URLs with their servers for safety checking (blacklisting) purposes. However these leaked URL requests are often 1 or 2 days after the original valid request, so this would imply that Bitdefender (or other) would have to be saving URLs for days and re-testing later.
Something on the server is leaking the URLs, which in practice would point the finger at Apache 2.4.x. That would seem like a major security loophole, if Apache was able to send out request URLs to external services. Very unlikely I'd have thought.

In practice the server is pretty well protected so these leaks are unlikely to cause real damage. Apache is Docker containerised, running under Linux, and fairly well isolated from the database and host. All web traffic is https, and unauthenticated requests are trapped and responded to with an http 404, so the Apache logs show a 404 for these "leaked URLs".
Nevertheless this seems somewhat sinister, that either a browser, browser extension, or server component such as Apache could be pushing out request URLs to some unknown external third parties, who can then reissue those request URLs for unknown purposes.
Can anyone explain how this is happening?

Answering my own question in case it's useful to others.
In order to distinguish between the 3 possible sources of URL 'leaks' I stopped monitoring the site from a Windows PC (Win10+Bitdefender+Chrome+various plugins) for 10 days from Oct 20-29th inclusive, and switched to monitoring only from the Linux server itself, again using Chrome.
At the end of that period the Apache logs show that no external requests were seen for the hidden & protected site URLs. This eliminates the possibility that URLs were being leaked from the server itself, and probably also rules out Chrome as the culprit (unless the source is a Windows-only plugin). To my mind this strongly points the finger at Bitdefender, which appears to be passing some user requests onto external servers, for purposes which are not clear, or documented.
In case it helps others spot the same pattern of mystery requests, the general form is either:

An initial URL GET from 195.47.249.18 [Bayer Business Services GmbH] followed immediately by the same URL from an AWS EC2 instance in the us-west-2 region.
Less often, a single 'region-less' EC2 request, for example from ec2-35-173-186-156.compute-1.amazonaws.com.

The complete list of external request sources for hidden URLs on Nov 1st 2020 is as follows:
195.47.249.18 - - [01/Nov/2020:01:08:10 +0000] "GET /{redacted}/02a7e770-a5e4-4879-baa5-e0d2aba771a5 HTTP/1.1" 404 - 1961
[Bayer Business Services GmbH]

54.186.168.31 - - [01/Nov/2020:01:08:10 +0000] "GET /{redacted}/02a7e770-a5e4-4879-baa5-e0d2aba771a5 HTTP/1.1" 404 - 3630
[ec2-54-186-168-31.us-west-2.compute.amazonaws.com]

52.38.242.51 - - [01/Nov/2020:01:25:51 +0000] "GET /{redacted}/b594cd3a-c464-4b3a-9c6e-60fb54ff07f0 HTTP/1.1" 404 - 3373
[ec2-52-38-242-51.us-west-2.compute.amazonaws.com]

34.219.247.27 - - [01/Nov/2020:01:39:48 +0000] "GET /{redacted}/60e876e4-15ef-4ad9-a92f-5701b29c3917 HTTP/1.1" 404 - 3327
[ec2-34-219-247-27.us-west-2.compute.amazonaws.com]

34.213.140.185 - - [01/Nov/2020:01:49:58 +0000] "GET /{redacted}/b02171fa-1a12-4952-a459-7d8aa444b4d3 HTTP/1.1" 404 - 3198
[ec2-34-213-140-185.us-west-2.compute.amazonaws.com]

52.10.55.64 - - [01/Nov/2020:01:52:15 +0000] "GET /{redacted}/b5690f82-3c51-4338-a1d8-05430ffbbff2 HTTP/1.1" 404 - 3414
[ec2-52-10-55-64.us-west-2.compute.amazonaws.com]

54.190.25.188 - - [01/Nov/2020:02:01:31 +0000] "GET /{redacted}/5cd37165-b5a0-41c2-9939-1ef651e04cf4 HTTP/1.1" 404 - 3701
[ec2-54-190-25-188.us-west-2.compute.amazonaws.com]

52.25.94.232 - - [01/Nov/2020:02:06:02 +0000] "GET /{redacted}/5a9d6b04-1bd3-4089-823a-d7e767f91224 HTTP/1.1" 404 - 3062
[ec2-52-25-94-232.us-west-2.compute.amazonaws.com]

34.220.193.71 - - [01/Nov/2020:02:16:52 +0000] "GET /{redacted}/05e4d8d3-6c57-4d8d-8a50-9a4502db96e3 HTTP/1.1" 404 - 3589
[ec2-34-220-193-71.us-west-2.compute.amazonaws.com]

3.231.31.179 - - [01/Nov/2020:02:21:45 +0000] "GET /{redacted}/8ec59182-c8fd-48fd-b826-3f01f7341c1c HTTP/1.1" 404 - 2754
[ec2-3-231-31-179.compute-1.amazonaws.com]

35.165.202.25 - - [01/Nov/2020:02:21:45 +0000] "GET /{redacted}/8ec59182-c8fd-48fd-b826-3f01f7341c1c HTTP/1.1" 404 - 2734
[ec2-35-165-202-25.us-west-2.compute.amazonaws.com]

35.173.186.156 - - [01/Nov/2020:02:37:32 +0000] "GET /{redacted}/02a7e770-a5e4-4879-baa5-e0d2aba771a5 HTTP/1.1" 404 - 3222
[ec2-35-173-186-156.compute-1.amazonaws.com]

54.172.84.153 - - [01/Nov/2020:02:54:52 +0000] "GET /{redacted}/708f9b0f-252f-42da-a50f-9ade2cc96667 HTTP/1.1" 404 - 1892
[ec2-54-172-84-153.compute-1.amazonaws.com]

18.237.236.242 - - [01/Nov/2020:02:54:52 +0000] "GET /{redacted}/708f9b0f-252f-42da-a50f-9ade2cc96667 HTTP/1.1" 404 - 1913
[ec2-18-237-236-242.us-west-2.compute.amazonaws.com]

34.212.199.166 - - [01/Nov/2020:02:56:45 +0000] "GET /{redacted}/9b40a90e-d0d4-43df-b451-9713ea1731a6 HTTP/1.1" 404 - 3619
[ec2-34-212-199-166.us-west-2.compute.amazonaws.com]

3.87.65.70 - - [01/Nov/2020:03:36:08 +0000] "GET /{redacted}/9b40a90e-d0d4-43df-b451-9713ea1731a6 HTTP/1.1" 404 - 1951
[ec2-3-87-65-70.compute-1.amazonaws.com]

52.90.240.183 - - [01/Nov/2020:04:37:12 +0000] "GET /{redacted}/df96f0ce-e7c2-4de2-ba6e-8aca06e0b4d9 HTTP/1.1" 404 - 3491
[ec2-52-90-240-183.compute-1.amazonaws.com]


How can I figure out which OCSP URL should be used for a certificate with OpenSSL? I have a PEM file that encodes a site's leaf certificate. I'd like to check it hasn't been revoked by querying the relevant OCSP server but I don't know which URL to use.

How can I extract the OCSP URL from the certificate?

This information is exposed when you use openssl x509 with the -text option:

$ openssl x509 -in cert.pem -noout -text

It's visible in the x509v3 extensions block:

Authority Information Access:
  OCSP - URI:http://ocsp.int-x3.letsencrypt.org
  CA Issuers - URI:http://cert.int-x3.letsencrypt.org/

If you are only interested in this information, you can directly use -ocsp_uri instead of -text:

$ openssl x509 -in cert.pem -noout -ocsp_uri
http://ocsp.int-x3.letsencrypt.org


Is it bad to use special characters in passwords? I'm trying to find the best degree of entropy for a password template, and after carrying out several tests, the best result came from this: à.

This symbol alone adds 160 characters to the set (contrary to lower-upper case letters, numbers, or even symbols) and is readily available from a Spanish keyboard such as the one I use, which looks perfect.

However, I can't find any information about this, all password generation software seems to avoid using those, and I don't know why.

A password like +9qQ¨{^ adds up to 254 charset size, +9qQ¨{^aaaa has 67 bits of entropy already, setting the ease-to-remember factor aside, is there any reason to avoid using these special characters?

Language-specific characters are typically avoided by password generators because they would not be universally available (US keyboards don't have accented characters, for instance). So don't take their omission from these tools as an indication that they might be weak or problematic.

The larger the symbol set (a-z, A-Z, 0-9, etc.) the larger the pool of possible characters to try to guess when bruteforcing a password. Adding language-specific characters adds to the pool, and that can be a good thing.

But be careful about how you calculate entropy. The string ààààààààààà doesn't have a lot of entropy if you are just hitting it on your keyboard because it's convenient. Entropy is about how the characters are chosen. A randomly chosen string has high entropy and a randomly chosen string from a wide pool of characters has higher entropy.


Is serialisation of HashMaps secure? I've done some reading in this area and there is very little information about the security of a HashMap. The only article I could find was on IBM's Developer Works site.

What hashing function is used for HashMap in Java. That's really the most important question regarding the security of HashMaps, right?

There are two different types of hash functions:

(non-cryptographic) hash functions
cryptographic hash functions

The cryptographic hash functions make specific security promises, such as being hard to invert, hard to create collisions, and such.

Regular non-cryptographic hash functions, such as the one used in java.util.HashMap, are designed to be as fast as possible, to distribute inputs as evenly as possible into the full range of hash buckets, and do not usually make specific security promises.

Nonetheless, that's not to say there aren't any security concerns with regular hash functions. For example, algorithmic complexity attacks, where the attacker chooses unique keys that they know all map to the same hashed value, allowing them to mount a denial of service attack.


Bitlocker lock removable drives at logoff I recently realized that after authenticating USB devices on a machine, then completely logging out, the next user that logged in was able to access them.

Is this something in the bitlocker settings that needs to be turned on?

I would hope that when I completely log out, it would also re-lock my USB devices in the event I forget to take them with me!

Thanks!

BitLocker is a system-level feature, not a user-level feature, and this apparently also applies to removable drives. @Joe's answer is accurate but not complete, as you would still need to manually run that command each time.

If you want the drives to be locked automatically when you log off, you should

Create a script (such as batch file) that executes the manage-bde.exe -lock <x>: -fd command for each drive letter <x> that you want to lock.
Use gpedit.msc (the Group Policy Editor) and go down the path User Configuration → Windows Settings → Scripts and assign that script as a Logoff script.

More info on setting a logoff script, with screenshots, is available here.