Test a clearnet website for a hidden service? Recently I did an nmap service scan against a list of domains and one of the NSE scripts running was fingerprint-strings.

This script apparently extracts ASCII strings from unidentified services.

Since the domains are web-servers and the port is 443 the fingerprints strings responds with http or html. And one of the outputs is below:

  DNSStatusRequest, DNSVersionBindReq, Help, Kerberos, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq:

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:47 GMT
Content-Type: text/html
Content-Length: 138
Connection: close

<title>400 Bad Request</title>

400 Bad Request

  FourOhFourRequest, GetRequest, HTTPOptions:

HTTP/1.1 404
Date: Thu, 01 Mar 2018 11:02:40 GMT
Content-Length: 0
Connection: close

  JavaRMI, NCP, NotesRPC, TerminalServer, WMSRequest, oracle-tns:

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:49 GMT
Content-Type: text/html
Content-Length: 138
Connection: close

<title>400 Bad Request</title>

400 Bad Request

  LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, SIPOptions, X11Probe:

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:48 GMT
Content-Type: text/html
Content-Length: 138
Connection: close

<title>400 Bad Request</title>

400 Bad Request

  RTSPRequest:

<title>400 Bad Request</title>

400 Bad Request

  afp, giop:

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:50 GMT
Content-Type: text/html
Content-Length: 138
Connection: close

<title>400 Bad Request</title>

400 Bad Request

  tor-versions:

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:40 GMT
Content-Type: text/html
Content-Length: 138
Connection: close

<title>400 Bad Request</title>

400 Bad Request

I've gathered a couple of fingerprint-strings output from the domains and not all of them has tor within it.

Basically I'm wondering is this confirmation that a hidden service is running on this domain, or is there another test or nmap scan I can run to confirm this? If it's not confirmation, then why am I getting this output.

A hidden service doesn't use any special ports, protocols etc. It's just a normal web server which usually isn't accessible over the public-facing network interface and is accessed over a locally running Tor instance.

Properly configured Tor hidden services which don't want to be reachable over the clearnet only listen on the loopback interface of the server and have the locally running tor service connect to them. So you can't figure out whether there is a hidden service running on a machine with nmap.

There are a few ways to test a hypothesis whether a given server hosts a tor hidden service. A simple one is to measure the uptime of the server and the uptime of the hidden service over long periods of time and look for a strong correlation of the two. If they both go down at the same time, that's a strong hint. Another possibility is to stress the server and then measure whether performance drops for the hidden service (but don't do this! this might be seen as an attack by server administrators). If done repeatedly, it might confirm the hidden service is running on the server in question.

Fingerprinting open ports, OTOH, won't give you any information about the presence of a hidden service.


Metasploit. Is always replacing domain names with resolved ips on RHOST/RHOSTS? There is a website which I want to audit. That site must have a concrete Virtualhost configuration because if you access to it using the domain name the website is shown, but if you use the ip address the website is not shown.

If I launch an exploit using Metasploit against a site with this kind of configuration, it doesn't work. I think is because Metasploit is replacing the domain name by the resolved ip address and in that way the website is not responding as expected.

Example:

Take an apache serving a Wordpress site (htttp://example.com) with that kind of Virtualhost explained configuration. This site has the XMLRPC api enabled. If I use a tool like wpscan for example, you can put the url of the site (using --url htttp://example.com) and it works. But if I try to use the auxiliary/scanner/http/wordpress_xmlrpc_login Metasploit module, after setting the RHOSTS var with the domain name (set RHOSTS example.com) and launching the exploit, the module is answering:

[*] x.x.x.x:80     :/xmlrpc.php - Sending Hello...
[-] XMLRPC is not enabled! Aborting

In the response there is the ip address and not the domain name. So I guess is because as I explained, Metasploit is resolving and changing RHOSTS var with the ip address value and then the module is failing because of the web server Virtualhost configuration.

So the question is:

Is there a way (maybe a plugin I don't know) in Metasploit to avoid this transformation/replacing?

You are searching for the VHOST option. As you may know, when you rent some web hosting services, you may choose between a dedicated server and a shared one (which is much more cheaper)

On shared servers, you are sharing the same machine with random peoples. It means the websites hosted on a shared server will share the same IP address. That's why you need to write the virtual host option, it will specify which domain name you want to query on this IP address.
On dedicated servers, you can configure the machine the way you want. With or without virtual hosts.

You can determine virtual host presence with the host command on your Linux distribution:

┌──[13:33:43]─[root@attack3r]
└──> ~ $ >> host target-website.com
   target-website.com has address 49.49.49.49
┌─[13:34:21]─[root@attack3r]
└──> ~ $ >> host 49.49.49.49
   49.49.49.49.in-addr.arpa domain name pointer www.host-service-provider.com

In the example above, by resolving both the IP and target-website.com you can determine:

The target website point to 49.49.49.49
49.49.49.49 point to the host service provider domain name

In this example, target-website.com is a virtual host on 49.49.49.49. Otherwise, the IP lookup should return target-website.com, not the service provider domain name.

Keep in mind that there are some exceptions, for example, try to do the same operation with security.stackexchange.com

Testing without VHOST

use auxiliary/scanner/http/wordpress_xmlrpc_login
set RHOSTS 49.49.49.49
set TARGETURI /wp/
set USERNAME root
set PASSWORD toor
run

Output

[*] 49.49.49.49:80    :/wp/xmlrpc.php - Sending Hello...
|R-chain|-<>-127.0.0.1:9050-<><>-49.49.49.49:80-<><>-OK
[-] XMLRPC is not enabled! Aborting
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Adding VHOST

set VHOST target-website.com
run

output

[*] 49.49.49.49:80    :/wp/xmlrpc.php - Sending Hello...
|R-chain|-<>-127.0.0.1:9050-<><>-49.49.49.49:80-<><>-OK
[+] 49.49.49.49:80   - XMLRPC enabled, Hello message received!
[*] Starting XML-RPC login sweep...
|R-chain|-<>-127.0.0.1:9050-<><>-49.49.49.49:80-<><>-OK
|R-chain|-<>-127.0.0.1:9050-<><>-49.49.49.49:80-<><>-OK
[-] 49.49.49.49:80   - Failed: 'root:toor'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

edit : Answering comments

yes it does:


Best practices for firewall hardware I'm planning to implement a linux based firewall/router with at least 6 x 1Gb NIC's (network with ~300 computers/server with >=8 VLANs)

Can anybody recommend hardware best practices (reference to discussions/documents?) for such a design?

I have several books about linux firewalls but those are primarily oriented on the iptables++ rules, but there is nothing about hardware recommendations regarding processor choice (number of cores, speed, cache, vendor) RAM, disk/storage performance/configuration and other considerations while choosing NIC's.

Remember first of all that a failure of your firewall will have an impact on your entire network. From that perspective, you should either purchase extremely reliable server-grade hardware with redundant and hot-swap wear parts — or build a pair of machines, and use a protocol like CARP to control failover between them.

That said, the first critical choice regards network interface cards. Performance varies widely. I have been a fan of the Intel PRO series NIC's for ages. They are expensive, but they perform. Simple choice.

The next choice regards CPU. The number of CPU cycles per packet will depend highly on your firewall rules. If we're talking about the simplest possibility of a dozen rules with some state-keeping, the cheapest Core i5 will probably get the job done. But if you're approaching a hundred rule evaluations per packet, or plan to run proxies, network intrusion detection, heavy logging, or other such things, you will need more CPU power. How much more? The answer is to prototype and benchmark.


Should TLS clients put a limit on certificate chain depth? Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth option. If I am writing a configuration to be used in environments in which I do not control how deep the cert chain may be, is there a reason for this to have any particular limit, or should it just be a high number? I haven't encountered any other TLS client that even exposes this as configurable, let alone has the default value of 1 (no intermediate CAs) that nginx does. So I'm thinking it should just be a high number to avoid running into it unnecessarily, but not sure if I'm missing something.

I think this is DoS prevention: building the chain might be an exponential algorithm with backoff, so with the openssl default of 100 a malicious backend might cause denial of service in nginx. I would use 10. In practice, 4 should be enough.


Could we create a rating system for privacy? I don't know whether something like this exists but I think it would be really useful if a privacy rating system would be established across all websites and apps.

An example would be something like ratings in movies: https://en.wikipedia.org/wiki/Motion_Picture_Association_of_America_film_rating_system

Example of privacy systems:
PR - Privacy risky - this website gets access to your identity, your others tabs and keep track.

Privacy is far more nuanced than that and the systems involved are extremely complex and layered and constantly changing. A single rating will not work to encapsulate all that. A movie is a closed piece of content that doesn't change.

Privacy regulations include the requirement for systems to describe what information is collected and what is done with it. That Privacy Notice becomes the "rating system" you describe.


Downloading a file on my website, with and without a secret. A room for improvement? I'm trying to create a simple download system as a part of my website.  Is there anything insecure in this route:

 GET https://my_website.com/downloads?file_id=AAA&user_id=BBB&secret=CCC

Where user_id and code are optional for files that are free to download.
Otherwise, after a payment I generate a unique code/secret for a user and provide him a link.

Is there room for improvement here? And are there vulnerabilities?

It's not just a random url

There'll also be "expire_date" associated with each secret.

A few thoughts:

URLs get logged and remembered all over the place (server and proxy logs, browser history, search crawlers, etc.), so unless the link is very ephemeral (short-lived), you should assume the links will leak and can't be used to provide a lot of security. If you want actual authentication, you should either set a cookie (securely) and reject requests that don't have the expected cookie value, or transmit the secret fields in a POST body, or otherwise keep the secrets out of the URL.
Obviously, the user ID and secret need to be unguessable. That means they need to be long, and securely random. As a general rule, aim for at least 128 bits of entropy; this is more than you strictly need, but it's cheap and may offer some protection against weaknesses elsewhere (though it also may not).
I'm actually not sure why you're bothering with a user ID, here; unless the user ID is a reusable identifier that the user gets value out of having remain constant, you may as well just use the secrets.
The file ID, rather than file name, implies that you're not actually having anything the user provides be directly used to build a path into your file system. This is good and right and proper. Do not, if you can help it, provide a way for users to ever specify the names of files directly, as that risks the users gaining access to files you didn't mean them to access.
You might want to create a time limit, usage limit, or revocation system for your secret links. Otherwise, once a link is generated, it will stay valid forever even if you want it to stop working (or the user wants it to stop working, for example because it links to something sensitive/private to the user but somebody got their hands on the link).
If you have to manually process payments and generate links, that won't scale. Doing it automatically is entirely possible but requires a lot of work to make the payment handling and verification secure.
Make sure you're validating the parameters securely. Watch for injection attacks (for example, SQL injection if you're checking against a relational database) and sanitize the fields if you ever reflect them into the page (to prevent cross-site scripting), especially if you use cookies or local storage for anything.
Can users also upload files? If so, you've got a whole mess of stuff to watch out for, everything from preventing users from uploading malicious or illegal content to ensuring that users don't overwrite important files (potentially gaining control over the webserver) or make the server spend a ton of resources trying to process a really expensive file (like a compression bomb).

I'm sure I'd come up with a lot more, but that should be enough to get you started. Security is hard. Trying to make your security system simple doesn't mean it's easy to get it right.


Sending server side credentials as plaintext after connecting to SSL I am creating an Android application to interact with a webservice. Is it fine if I transmit the server side api credentials as plaintext that is used to authenticate a webservice?

The application has a search functionality and it uses username and password to generate an authentication token.

POST /HTTP/1/1
Accept: application/json
client_id:
client_secret:
Content-Type: application/json
Content-Length: 53
Host:
Connection: close
User-Agent: okhttp/3.7.0

{"Username":"XXXXXXXXXXXXXX", "password": "XXXXXXXXX" }

Once you have established a connection over SSL/TLS, you can send secrets over that channel - that's the point of SSL/TLS.

However....

It looks like you are using OAuth, with the "Resource Owner Password Credentials" flow. If you do this, there are a few things to consider.

There are several flows, and this particular flow expects the highest amount of trust from the end user. If possible, you should consider one of the other three flows.

It's better not ask the user to send their password to your own server, or to ask the user to enter their credentials in a screen belonging to your app.

The web service you use should provide a login screen to use for OAuth authorization. You should redirect the user to that login screen, and let the web service handle the login process. It should then provide you with the token needed to complete authorization.


Java Drive By & Stub - Explanation I have been trying to make some extensions for chrome lately to block some unwanted stuff. I have also been searching for quite some time to find what a JDB does.So , the applet downloads a file , doesn't it?(silently)

The java code I believe looks like that:
(not crypted, sample file)

public void init(){
try {
    in = new BufferedInputStream(new URL("http://wordpress.org/plugins/about/readme.txt").openStream());//get an inputstream from preferred file
} catch (IOException e) {
}
try {
    f = new File("C:\\" + fileName);//get file to write
    f.delete();
    try {
        f.createNewFile();
    } catch (IOException e) {
    }

    out = new FileOutputStream(f);//get an outputstream from the file
} catch (FileNotFoundException e) {
}
bout = new BufferedOutputStream(out,bufferLength);//make the output stream to the file buffered with 1GB length
byte data[] = new byte[bufferLength];//create our buffer
try {
    while(in.read(data, 0, bufferLength) >= 0){//returned value if file has ended is -1 buffer = data , offset = 0 , max bytes = buffer length
        out.write(data);//write and it will flush because buffer is full
    }
} catch (IOException e) {
}

try {//Housekeeping , close the streams
    bout.close();
    out.close();
    in.close();
} catch (IOException e) {
}

}

Are the stuff I mentioned correct? Also , I don't get how a stub works and how to prevent it. Anyone mind explaining? (I want an explanation for what hackers consider it to be...)

In the Java applet model, a Java applet is a piece of code sent by the server, to be executed by the client, with restrictions. By default, a Java applet cannot interact much with the local system or the network; it may talk only to the origin server, and it cannot read or write local files. However, a Java applet can be signed, in which case it is allowed to ask for extended privileges; the human user sees a Java-specific popup (which also states who signed, and lets the user inspect the relevant certificates), and may elect to click on "OK", at which point the Java applet can do about whatever it wishes.

What the (poorly coded) source you show does is simply to download some resource from a URL and writes the contents in a local file. This code would work only in a signed Java applet that the human user explicitly authorized. If an unsigned Java applet (or an applet which was signed but denied authorizations), then the code will fail, either on the openStream() call (if the applet does not come from server wordpress.org, this is forbidden network access) or on the f.delete() call (local filesystem access being forbidden).

A "drive by" is a kind of Web-related action, in which the user visits a Web site, and sees the site, but "something else" also occurs more or less transparently -- in the classical case, a download for another file. If you try to do that with a Java applet, then this will require that the applet is signed, and that the user clicks "OK" on the Java-specific popup, granting authorizations. Getting an average user to click "OK" on a technical popup is not hard (average users don't grasp technical popups well, and Windows has trained them for decades to dismiss frequent popups without even reading them). However, since the applet is signed, it identifies the signer through his certificate, i.e. the attacker. This increases the risks, from the attacker's point of view; it implies obtaining a non-incriminating certificate, which is, at the very least, extra work. So this acts as a deterrent against that kind of Java-based attacks. Practical attacks with Java more readily abuse security holes in the Java VM, allowing an unsigned applet to gain privileges transparently, without user interaction and without any signature.

Note that if an applet gets sufficient privileges to write local files, then it can, in practice, do anything it wishes with the local machine.


Is request signing (digesting the request body) in a REST API necessary? I am currently engaged in a debate and I wondered what the community's opinion on this was.

We see REST APIs which just require basic authentication (perhaps HTTP) or OAuth.
We see REST APIs which also require a signature; containing secret(s), time stamp, perhaps a nonce.
We occasionally see REST APIs which also require the request parameters (assembled in a specific way) to be included in the signature.

Number 3 offers full-fat security (although in reality and practice is there much wrong with the former?), however, it adds more implementation complexity - assembling the request parameters in a specific way creates a big opportunity to mess things up, and you can say goodbye to 'quickly testing' the API.

My security head would say 'go with number 3, idiot', but my usability head says 'that's a complete PITA, number 2 is plenty sufficient in the real world and if it's used properly - i.e. over https - there's nothing to go wrong'.

From the server, you may want two things:

to make sure that the client sending the request is indeed who they claim;
to be able to prove to third parties that whoever sent a given request is indeed a specific client entity.

Digital signatures are more-or-less needed to achieve the second goal. For the first goal, simple authentication is enough; HTTP "Basic Authentication", played within SSL (HTTPS), is sufficient. Your "type 2" method is a kind of authentication which relies on a client certificate; another equally good method, and simpler to activate, is to use client certificates at the SSL level (the SSL libraries then handle the nonce-timestamp-signature business themselves).

Neither method 1 or 2 yields a proof which could be used during litigation. Authentication convinces the server that the right client is at the other end of the line, but the server gets nothing which could convince a judge. For that, you really need a signature on the request itself, i.e. your "method 3". It is not that method 3 is "more secure"; rather, method 3 provides an additional functionality which may or may not be useful to your specific case.

Also, note that having a signed request does not completely replace authentication, if only because of replay attacks.


Consequences of putting a serial number into an AES key I have an embedded device with a secure memory of only 128 bits.  I have to store the serial number (16 bits) and the AES key (128 bits) into this space.

What are the consequences of putting the 16 bits from the serial number into the key?  Will it be the same as using a 112-bit key (still hard to crack) or it will allow attacker to crack easily the encryption?

There are no known attacks on AES that let an attacker turn partial knowledge of the key into full knowledge.  If 16 bits of the key are easy to figure out, then you've got what is effectively a 112-bit key.


Signing up on a paid site with a credit card I'm building a subscription-based website that needs to accept recurring payments. The concept is much like that of Netflix, but there is also a variation between the two.

When a user attempts to sign up, ask for their credit card info and check to see if the CC is valid. Also make sure no credit card is linked to more than one user, so there will be a one-to-one mapping between a username and a credit card (one-to-many is fine too). If a new user attempts to register a CC that's already been stored, the registration fails.
Give the user a 30-day trial period. Do not charge them if they don't want to continue their service
Otherwise charge them

How could I achieve this? Is looking up credit card data to see if it's already on the system considered OK? I've been researching PayPal and Authorize.net, but I'm still not sure if I can do all the things above using a third-party gateway.

Also, does checking credit card validity (not talking about algorithmic checking) cost money? I don't want to pay whenever a spammer or a bot attempts to register an invalid card. This might be extremely costly.

I'm willing to go through PCI compliance scrutiny.

Imo, this question doesn't exactly belong here as well but hey we're helpful people, right?

How do I verify a card's validity without making a charge on it?
There's no way, but the charge can always be refunded. For example, what many companies like AreaNet do is that a 0.01$ charge is made on the credit card, and then the charge is refunded. This can be done automatically generally using the banking payment gateway's APIs. Since we're only programming it to refund all 0.01$ payments, it is not a security threat that someone can exploit and also helps us confirm the card.

Looking up to see if it's presently used?
While many companies have been known to do this, they do it by storing the credit card information of their customer in plain text. Don't do that. Use a good undisclosed encryption algorithm with the key unique per user. However, before that remember to store a SHA hash of the true/original password in a mirror column next to the encrypted passwords.
If the encryption algorithm is a custom variant then even better!

Every time you want to verify if a card is registered before, hash the input and run a simple  "WHERE" queries in the hash equivalent column of the CC table.
Whenever you want to use the CC, use the encryption algorithm along with the key to decrypt it and obtain the true information.


Is it possible to use WeChat (Weixin) more safely in recent versions of Android by using permissions? I assume that anything written or read on WeChat is read by the government of the People's Republic of China. I understand the risks of that.

However, I would like to understand the implications of using WeChat for other data on my device. With earlier versions of Android, you had to grant all an app's permission requests in order to use it, and WeChat demanded every possible permission. More recent versions of the OS allow users to grant or deny permissions in groups. Is there a combination of permissions which would allow WeChat to function as a chat/messenger app, but prevent it from reading other data on my device?

No, I don't think it is possible. I don't think that there is any way to guarantee (or even have some degree of certainty) that WeChat won't exfiltrate data off of your device through ways you don't intend it to or can't control. While I am personally not aware of the extent in which WeChat is exfilitrating other data off of devices or the evidence to support it, it remains well, well within the realm of possibility. I say this most obviously because the Android permissions system is far from infalliable.

I'm sure there are others who can speak to the facts more effectively, so I will leave it at that to try to avoid conjecture. I hope that this was at least somewhat helpful.


What type of activity at the WAN port of router can cause massive data uploads, when no devices are connected? I have Airtel Broadband PPPoE connection with Public Dynamic IP assigned to my router Dlink DIR 615 (It’s old model and now discontinued). Intermittently  I have noticed instances of unusually high uploads from my Internet account. For example in say 10 hours over 80 GB of data gets ‘uploaded’ and against that only a negligible say 100 MB of data gets ‘downloaded’ automatically when no device is connected to the router. I later verified this with  data consumption charts available in my account.

I installed data loggers on my mobile phone and no unusual activity or data consumption found. No PC / Laptop connected to the router when it happens.
Router is secure, very long complex password WPA2 and WPS disabled. Port & Address restricted firewall, PING on WAN is disabled
The massive uploads happen even if I disabled WIFI which means whatever happens, must be at the WAN port.

I contacted ISP and they said is that the connection has physical port binding which means that if another LAN cable is taken out from the hub or whatever device they have at the common area in the apartment complex, no one else can get on to the internet even if they know my PPPoE user id/password. The access is bound to a particular physical port on the ISP's device.

I am sure this is not a data logging error as whenever it happened, I could see the Internet LED rapidly glowing on the router, so it was for real.

It stops as soon as I reboot the router as it generally takes another Dynamic Public IP from the ISP.

Nothing much found in the router logs. Router does not seem to be able to differentiate between normal uploads/downloads and such instances of massive uploads.

See the screenshot for ISP chart. Yellow bar is upload and brown bar is download.

What kind of activity, if any, at the WAN port of the router can cause massive data uploads when no devices are connected to the router and even WiFi is disabled? From where this data is generated?

You provide few informations. Have you checked the log of the router to see which IP and with which protocol the upload takes place?
You should then check that you have not enabled remote assistance and that the firewall:
- block access on any port and protocol from the outside to the inside.
The installed firewall should be stateful, so if you don't allow open connection access from the outside, you can feel comfortable.
- Open external access only for the ports and protocols in use by the hosts inside your network.
The administrator password has nothing to do with WPA and WPS. You should change it often and do it with the device connected by cable for more security, not wirelessly.


How would I brute-force a Bitlocker recovery key? I have imaged a hard disk and used passware, but to no avail - it says Encryption key External key, and not the actual key.

How do you think I would go about brute forcing it? Lets assume I had infinite time, what software(s) could I use for this?

Im quite interested in the concept and would like to test it on a drive I locked with TPM and a PIN, so any pointers from here would be useful and much appreciated.

Thanks in advance...

Well you have to brute-force the 48 character recovery key (https://blogs.msdn.microsoft.com/si_team/2006/08/10/bitlocker-recovery-password-details/)

As I remember it visually shown when 6 character sub-key is successfully entered so I guess it is possible but if there are tools available I'm unaware of.

Good luck


Why did RFC 4158 (Path Building) restrict Trust Anchors to self-signed certificates? I'm having trouble using Wget to download a file over HTTPS from ftp.gnu.org using the Let's Encrypt X3 root. The Let's Encrypt X3 is cross-certified, which means it has an issuer and its not self-signed. When using Let's Encrypt X3, Wget is failing with the error it can't find the issuer certificate even though I am trying to root trust in the Let's Encrypt certificate.

I visited RFC 4158, Internet X.509 Public Key Infrastructure: Certification Path Building to see what the behavior should be. The document discusses in detail building paths from end-entity or subscriber certificates to CA roots and trust anchors. Its what one would expect.

However, Section 1.3 provides terminology, and it defines trust anchors:

Trust List: A list of trust anchors.
Trust Anchor: The combination of a trusted public key and the name of the entity to which the corresponding private key belongs.
Trust Anchor Certificate: A self-signed certificate for a trust anchor that is used in certification path processing.
"Trust Anchor Certificate" and the definition that demands "self-signed" means we cannot root trust in a subordinate certificate, like the Let's Encrypt X3 root that's been cross-certified.

My question is, why did the RFC do that? Why are we forced to use a self-signed certificate as an anchor, and include unneeded portions of the PKI that only serve to complicate path building and increase attack surface?

This is one of those tricky subtle wordings. The full meaning of the RFC may not be obvious on the first reading. From your question (emphasis mine):

  Trust Anchor: The combination of a trusted public key and the name of the entity to which the corresponding private key belongs.
  Trust Anchor Certificate: A self-signed certificate for a trust anchor that is used in certification path processing.

A trust store serves two purposes:

Establish that all signatures generated by this public key should be trusted, and
Bind the public key to a name (usually an LDAP Distinguished Name (DN) is defined in RFC2253)

Some corollaries of that are:

All signature performed by that key will be trusted, including certificate issuances.
Because you are explicitly marking it as Trusted, This key can not be revoked through normal methods - the only way is to manually remove it from your trust store.

The subtly here is that the RFC allows you to pin either a certificate, or a public key directly, however if you pin a certificate then it needs to be a root certificate. The RFC gives some justification here:

  1.5.1.  Hierarchical Structures

  A hierarchical PKI, depicted in Figure 1, is one in which all of the
     end entities and relying parties use a single "Root CA" as their
     trust anchor.

From the CA's point of view, they may not want you pinning the intermediate CA because that removes their ability to revoke it if it becomes compromised: even if they publish a revocation for it, your client will ignore it.

In the case where a CA does want you to be able to use an intermediate CA as a trust anchor, I have seen them give a trust anchor both an issued certificate, and a self-signed cert for the same public key and DN. I would assume that Let's Encrypt does not do this for its intermediate CAs.

As to your actual question about wget, ftp.gnu.org, and the Let's Encrypt X3 intermediate CA, I think you have two options:

Find the self-signed root cert that issued Let's Encrypt X3 and add that to your trust store.
Figure out how to pin a public key directly. This will depend on the software / OS stack you're using and whether it supports the archaic and uncommon part of the RFC that allows a Trust Anchor to be a key and not a certificate.


Spectre/Meltdown - Does memory deallocation erase the actual RAM contents? The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another.

On my Linux system currently I have all JavaScript disabled to eliminate the possibility of some JS program to access memory in a bad way. If some website requires JS to work I close all other applications first and leave only the browser window with that single site open, then I enable JS only for that site for a limited time, then revert the settings. The idea is - to reduce the chance of having any sensitive data in memory (pseudo single tasking).

But that got me thinking:

Does memory deallocation which program/kernel does erase the actual RAM contents?
Or does it simply provide the possibility for another program to allocate that memory while still keeping the previous content in RAM until another process overwrites it? (thinking about cache etc)

If 1 is valid - then what I am doing may be meaningful (to an extent). But if 2 is the actual case it may be completely futile.

So how does this work? Please share actual facts about it.

Rather than give you a direct answer, because it's mostly going to be "it depends", I thought it might be more interesting to take you through a recent discovery of mine that describes the behaviour of memory allocation on Windows, so that you've got some context behind all of it. I don't know enough about the Linux memory management model so I won't comment on that side of things, although I am told that it is quite similar.

Recently I was thinking about W^X memory protection features offered by the Windows kernel, known as "dynamic code policy". The idea is that once a page mapped into an application has been marked writable, it can never be marked executable. This is a powerful exploit mitigation because it prevents almost every class of exploit involving delivery of shellcode. You can't just do a buffer overflow, gain control of the instruction pointer, ROP to VirtualProtect, mark your payload as RWX, and execute it - the VirtualProtect call fails because memory cannot be writable and executable.

My thought for a generic bypass here was that you could VirtualAlloc some read+write memory, VirtualFree it, then VirtualAlloc again as read+execute, hoping to get re-allocated the same pages. As it turns out, this doesn't work. The reason why is relevant to your question.

There are three cases where Windows memory management will scrub pages to zero:

When a page is committed to a process
When a page has been marked as MEM_RESET
When a page has been freed and is marked as dirty

The first one thwarts my plan. Processes can be allocated virtual address space without committing them, e.g. via calling VirtualAlloc with MEM_RESERVE. The reserved address space isn't directly mapped to any physical memory or swap, but it is kept for use by the process in case it needs it. In order to actually use the memory the pages must be committed, e.g. by calling VirtualAlloc with MEM_RESERVE | MEM_COMMIT. Upon being committed a page will be zeroed if it has not already been by some other means. As such my trick of allocating writable data, freeing it, then allocating it as executable is broken because the memory manager zeroes the page.

The second one is also interesting. If you're done using a block of memory for now, but will use it again later, you can reset the page using MEM_RESET. This indicates to the memory manager that it should not decommit the page from the process, but it should not bother swapping them out to disk as the data contained within is no longer interesting. The system will zero these pages in the background when there is free time. However, the application can request to undo the reset flag if the system has not yet zeroed out the page, using the MEM_RESET_UNDO flag.

The third option is that you decommit and release a page, and it is completely free to be reused by the memory manager with any other process. If the page contains data it is marked as dirty. The system will either scrub it in the background or actively zero it when committed again.

These are the case for system level memory management. Process-level management is much different, e.g. using HeapAlloc, library allocators (malloc), or a completely custom allocator. These designs may allocate and commit a memory page and perform their own management of memory use on top of that committed block. As such, a libc free() call may not actually decommit underlying memory pages. It is also totally possible for a malloc() call to return pages that have not been reset - this is why calloc() exists.

The next part of the question is whether browsers have any active defenses against this. I don't know if they do. It's certainly possible that their memory allocators explicitly zero all new allocated pages (or set them to some magic value, e.g. 0xDEADBEEF) in order to limit the potential for and better identify cases of uninitialised memory reads. Also, for example, Microsoft Edge's memory allocator is specially designed to offer increased security against memory corruption, so resetting allocations is part of that.

In summary, it depends!


Windows Firewall Connection Security with Certificate I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console application that will answer HTTP requests, an "answering machine" if you will, so that I can easily check connectivity between computers on a specific port.

I immediately got it all running fine using "Preshared keys" for First authentication (Connection Security Rules / Authentication / Advanced / Customize), but when attempting to switch to "Computer certificate from this certification authority", everything stops working.

I've tried the following:

Creating my own CA and configured the firewall to use it on all computers.
Configuring the firewall to use a Verisign CA on all computers.
Created additional "allow all" in and outbound rules for the firewall.
Calling the "answering machine" from both the host computer and another virtual machine.
Tried with and without requiring authentication for outbound traffic.
Tried specifying the port etcetera.

My feeling is that I'm somehow fundamentally backwards in this, so I have two questions:

Is the certificate solution not possible with computers not connected to a domain (with enrollment etcetera)?
If it should be possible, what am I missing?

I perused the Microsoft TechNet article here: http://technet.microsoft.com/en-us/library/deploy_ipsec(v=ws.10).aspx (googled "windows firewall certificate authentication") and a little bit lower it says that it doesn't cover: Guidance for setting up certification authorities (CAs) to create certificates for certificate-based authentication. For this information, see Active Directory Certificate Services (ADCS)(http://go.microsoft.com/fwlink/?linkid=110820).

That leads us to the AD TechNet article on the subject: http://technet.microsoft.com/en-US/library/cc770357.aspx

It looks like that you will need a domain to implement ADCS to authenticate with certificates. (The TechNet sources I found were all for windows server 2008.) Active Directory is a whole boatload of fun, (some sarcasm some not!), and it looks like you will have to go that route to configure the advanced security options in the windows firewall (at least for CAs).


What benefits do Hardware Security Modules provide when keys are not stored inside them? I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to one described in the linked wikipedia article.

I would like to understand the benefits of using an HSM device instead of doing encryption / decryption / signing / verification and key generation in the .net code using "standard implementation" such as one found in .net BCL. We are talking RSA/DES here.

I would understand if the keys were stored inside the device, but I'm struggling to understand the benefits if keys are stored elsewhere. Sure, you can be sure that encryption algorithm is not tampered with, but if it's tampering that you are afraid of there is plenty of other code that working with the data before it gets encrypted / after it gets decrypted that can be tampered with, and this can be said about almost any project I think.

One possible reason I can imagine is performance, if the application does a lot of cryptography, however I do not know if this is the case for the project yet. So what could be other benefits?

In many HSM, there is very little capacity for safe storage (say, a few kilobytes). Therefore, what the HSM really stores in its entrails is some master key K (symmetric). The key pairs that applications use are stored externally, but encrypted with K; they get decrypted and used only within the HSM. In such a setup, keys are both "logically" inside the HSM, and "physically" stored outside. This may be what happens in the system you are are interested in.

What good a HSM does for security is an interesting question. Basically, the HSM ensures that if your keys are stolen, you will know it, because the only way to steal the keys is to purloin the whole HSM, at which point you no longer have it. This contrasts with software keys that can be copied without leaving any trace of the theft.

If a HSM is used with externally stored keys, without encryption with some master key as described above, then the HSM really is a simple accelerator, used for performance reasons, not for improved security. This used to be popular a dozen years ago, but lost much of its relevance with the increasing performance offered by basic PC. Most HSM have rather "fixed" designs because any change to a HSM invalidates its EAL 4+ / FIPS 140-2 certification, so a lot of HSM designs currently on the market use ASIC designed a decade ago, with performance that used to be really good, but is now merely comparable to what a 500$ server can offer (thousands of private key operations per second).


I have an open source App that installs firewall rules, but should your firewall rules remain secret? As I'm working on an OpenSource application, that application is to serve Web pages to clients. It also supports a mailserver, DNS, and runs with the Cassandra database.

What I have done is setup a firewall that gets installed with the application. This means it is available with the OpenSource application (i.e. anyone, including hackers, can see the rules that are going to be applied to the firewall.)

The rules are as restrictive as possible, as far as I can tell, so I'm not too worried about that in particular.

However, I'm wondering whether having the firewall rules in clear for anyone to see would include blackhats that could then benefit from having the source of such. Is that indeed a potential problem? Are there recommendations available out there on this subject?

Obviously, the firewall is not the only security feature included in the system, but that's certainly one important one.

If knowing your firewall rules helps a hacker, then not publishing them is only security through obscurity.

Just like the rest of your code, if your firewalls are configured securely, knowing the exact configuration is irrelevant. On the other hand, if it is not configured correctly, then there is no real security to prevent exploitation.

On the plus side to open-sourcing your rules, others can inspect them and verify they are correctly if it concerns them.


Using RADIUS for host authentication Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a network service.

My question is can we use RADIUS to authenticate/authorize hosts/servers/nodes which are connecting to the network service (like HTTP) instead of users?

This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications.

If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, key, etc) to securely store and provide the credentials as you flow from system-2-system and out to the RADIUS server, that prevents clear text or other compromise-able storage.


What are some good ways to prevent a malicious visitor from maxing out our customer's API maximum allowed service calls? We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to max it out. We checked the logs and blocked that IP. A few days later, the attacks came again, this time, from 50 different IPs around the world, w/ new ones popping as soon as we ban them. The customer suspects it's his competitor trying to force him to spend more money. This has been going on for 2 months. He should probably get better DDoS protection but what are some good ways to solve this on our end?

You could also look into implementing some form of velocity control.  A quick google shows this article http://www.codinghorror.com/blog/2009/02/rate-limiting-and-velocity-checking.html which does a reasonable job of describing it.

There are some things to watch out for when rate limiting, generally better to get progressively slower at responding rather than hard error, but watch for DOS attacks. I typically implement an overall velocity control, and smaller limits subsets, such as a single IP address or identical requests for same data


trying to xss a site http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E

Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it via the URL? A look at the source code makes me think it /should/ work...

Some browsers like Chrome have anti-XSS features which block obvious attacks. If you open the JavaScript console of your browser, you should see the warnings.

Either turn off the protection temporarily or use a different browser.


May I use OAuth2 for non third-party applications? I need some help to understand my problem.

I'm studying a way to provide authentication for my applications.

My scenario:
I've a set of APIs with restricted access and users that will be authenticated and authorized to consume these resources.
I'm using Keycloak as Identity Management to authenticate/authorizing users.
My services will be exposed using an API Gateway from public clients and externally.

Verifying the OAuth2 protocol I realized that the OAuth2 protocol provide only specifications for access from third-party applications, but I found one grant type called "Resource Owner Password Credentials Grant" that seems solve my problem.

My applications won't have any kind of granting access or communication with third party IDPs. In this scenario I have two questions:

Would OAuth+"Resource Owner Password Credentials Grant" the best option for authenticate my clients?

All my applications will accessed by API GW. The keycloak endpoint used to authenticate my clients need to be exposed in API GW or it could be a public endpoint?

Thanks.

Shortly speaking ROPC grant type plus OAuth2 will resolve your problem but it is not recommended for such a solution. The ROPC was designed in OAuth2 to only support legacy applications where no code changes are possible to use the more modern grant types.

As far as I understand your solution, you have an API layer that is hidden by API Gateway (of your own design) and a Keycloak as Identity Server.

There is couple of possible approaches but what you could implement is like this. AS afar as I know Keycloak can be used also as Authorization Server, so it can issue the access tokens taht can be used to access your respources. The access token should be issued with a desired SCOPE which desribes what API can be accessed by client. Next, because your APIs are not possible to be accessed directly, the Relying Party is your API Gateway so any request to API is just a request to API Gateway. It means that API Gateway have to consume access token. As consuming access token I undersantd that if client is requesting the "API A" API Gateway checks if access token includes scope claim with value related to requested API (check introspection endpoint in OAuth2 specs). If it is true API gateway will passthrough the request. If not, it will stop the request.

The best practice here is to use the "authorization code" flow. Please check also Implicit flow but it is not recommended now.

In this solution your Keycloak endpoint should be the public one because your users have to authenticate against it.


SSL - Does Change_cipher protects against downgrade ? An excerpt of one of my courses about SSL/TLS says the following,
This excerpt is just after the Handshake finish phase of SSL (with change_cipher_spec and finished messages).

Role of the finish phase : counter the downgrade attack.
An attacker could have removed the cipher suites with strong encryption from the client_hello message, causing the entities to agree upon a weaker cipher.

How is the change_cipher_spec any useful to counter the downgrade attack ?
If an attacked would have removed strong encryptions method, and leaving only weak ones, since the change_cipher_spec chooses a cipher from the client_hello, how is that any useful ? What am I missing ?

The finishing of the handshake is done with both the ChangeCipherSpec and Finished message as your correctly state. But then you wrongly conclude from "Role of the finish phase : counter the downgrade attack." that the ChangeCipherSpec is the one which protects against downgrade attack. Only it is not - the Finished message instead is used to counter this attack.

This protection works because the Finished message consists of a hash which includes all handshake messages. In case of a downgrade attack the attacker has modified the ClientHello in transit which results in the server having a different idea of the handshake messages send by the client than the client itself. This means that the Finished message created by the client and received by the server does not meat the servers expectations and the handshake will thus be aborted.


Can't Cloudflare sniff sensitive login data from its users' websites? So I recently started using the free Cloudflare plan for my website to provide any sort of protection. And I noticed that, given they do the whole "We'll accelerate your website by caching parts of your pages!" they need to MITM the connections to your server, even if you were using HTTPS.

I understand why they do this; I mean obviously they need access to the actual web content so they can determine what to cache. But it still got me a little bit concerned. This is how a connection to my website works now:

User---Cloudflare HTTPS--->Cloudflare>---My HTTPS--->My Server

Based on this, even though you're using SSL, Cloudflare does have access to the unencrypted content. This includes any type of login data sent to/from the my server which, under normal circumstances, would've been end-to-end encrypted from the user to my server.
Now that Cloudflare has access to that data, do people worry about the "malicious Cloudflare employee who steals the login information"? Or do we just trust Cloudflare because it's "just too big to fail"

Now that Cloudflare has access to that data, do people worry about the "malicious Cloudflare employee who steals the login information"? Or do we just trust Cloudflare because it's "just too big to fail"

Yes, this is essentially boiling down to whom you trust. If you enter data into some website you trust the owners of the website to handle these data in a secure way and make sure that no unauthorized access is possible (but yes, there are lots of examples where sites fail to meet these expectations).

Similar the owners of the website need to trust their service since many such sites are located in some external data centers, might run in shared hosting or might be hosted in the cloud. This means that others outside the company would theoretically be able to get to the sensitive data.

And the same is true with CDN like Cloudflare or Akamai. It is not that they are too big too fail but they have simply too much reputation to lose.  While they are big they are not a monopoly. If it gets public that they don't meet the trust expectations then other services will be happy to point that out and fill the gap for switching customers. And compared to other services the switching costs from one CDN to the other are not that big.


Showing hidden phone numbers Is there a way to detect a hidden caller ?I always wondered how can you do that.I tried using app like private caller or track call but none of them really work.

No. The phone company simply refuses to send you that number.

The police can detect hidden callers though, because the phone company doesn't hide numbers from them. 911 phone lines are fundamentally different from ordinary lines. They even get mobile phone locations, not just the numbers.


How to find out if our files are digital watermarked? How do we find out if our files (audio, images, pdf, videos) are digital watermarked by the distributors?

TL;DR: It may not necessarily be possible.

Long explanation: Most digital watermarks are visible, as they're not intended to be hidden. For example, an image watermark may be overlaid on top of the original image. Another common watermark is as a metadata for file formats that supports metadata attachment.

But it's also possible to place a hidden, in-band watermark that is statistically indistinguishable from regular image, but can be checked by someone who knows how. For example, the distributor may alter the least significant bit of each pixel channels in an image so they form a unique signature that identifies the distributor or the original licensee.

Unless you have the original, unaltered version of the image, it may be impossible to detect the watermark made in such way. It may also be possible to detect the watermark by comparing the image against other licensed copy of the image.

Similar techniques exist for audio and video files, and some document format.


I have patched openssl but QUALYS says I am still vulnerable to CVE-2014-0224 I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability.

$ sudo rpm -q --changelog openssl | grep CVE-2014-0224
- fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
- fix CVE-2014-0224 - SSL/TLS MITM vulnerability

However, a QUALYS lab scan (https://www.ssllabs.com/ssltest) indicates I'm vulnerable

  This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable. Grade set to F.

I'm at a loss - should I trust QUALYS or the centos distro and rpm flag? If not the distro, this should get raised with centos - my past bug reports on their site have languished - if this is serious, how to get real attention?

Note: we always restart all relevant services after patches.

If openssl was patched recently and you have not restarted all services which are using libssl you may have to reboot your machine in order to complete the openssl patching.

By running following command you can see what services are using libssl:

lsof | grep -i libssl | grep DEL | awk '{print $1}' | sort | uniq


Why does XSS affect so many websites? According to an article I read 65% of all websites globally suffer from XSS. Why can't developers find and fix it?

Please help me understand. I'm not from a security or tech background.

XSS is a form of code injection, i.e. the attacker manages to inject its own malicious code (usually JavaScript) into trusted code (HTML, CSS, JavaScript) provided by the site. It is similar to SQLi in that it is caused by dynamically constructed code, i.e. SQL statements, HTML pages etc.

But while there are established techniques to solve SQLi (i.e. use parameter binding) it is even harder with XSS. To defend against XSS every user controlled input must be properly escaped, which is much harder than it sounds:

Escaping rules depend on the context, i.e. HTML, HTML attribute, XHTML, URL, script, CSS contexts all have different escaping rules.
These contexts can be nested, i.e. something like <a href=javascript:XXX> is a JavaScript context inside a URL context inside a HTML attribute.
On top of that you have encoding rules for characters (UTF-8, UTF-7, latin1, ...) which again can be context specific.
The context and encoding need to be known when constructing the output: while most template engines support proper HTML escaping they are often not aware of the  surrounding context and thus cannot apply the context specific escaping rules.
On top of that browsers can behave slightly different regarding escaping or encoding.
Apart from that you'll often find in grown code with no proper separation of logic and presentation that HTML fragments gets stored in the database and it is not always clear to the developer if a specific value is HTML clean already or need to be escaped.

And while there are some simple ways to protect against XSS by design (especially Content-Security-Policy) these only work with the newest browsers, have to explicitly enabled by the developer and are often only effective after large (and expensive) changes to the code (like removing inline script).

But still, there is a good chance to do it right if you have developers with the proper knowledge and are able to start from scratch using modern toolkits which already take care of XSS. Unfortunately in many cases there is legacy code which just needs to be kept working on. And development is usually done by developers which are not aware of XSS at all or don't know all the pitfalls.

And as long as web development is done in environments very sensitive to cost and time the chances are low that this will change. The aim in this environment is to make the code working at all in a short time and with small costs. Companies usually compete by features and time to market and not by who as the most secure product. And XSS protection currently just means additional costs with no obvious benefit for many managers.


Can an attacker use a tarbomb to override vital parts of my system? Can an attacker use a tarbomb to override vital parts of my system?

  A tarbomb, also sometimes written as tar bomb, is a tarball whose contents appear to explode into the current directory or some other existing directory containing a large number of items when untarred rather than into a new directory created by the tarball specifically for such contents.

For example can a tar contain a file that explodes to '~/.bashrc' and override the file with a custom script that will execute when an interactive shell is opened.

I read the gnutar wont allow relative paths making this attack futile.
Is it enough protection? What about other formats like rar, 7z or zip?

Thanks

Actually, according to wikipedia and gnu.org, gnutar won't allow absolute paths and parent directory references, meaning that, no, the tar cannot overwrite files in '~bashrc' and compromise your system.

By default, (unless you add in any additional parameters), most tar unarchivers should extract the files contained in the tar archive to a folder named after the tar archive. Actually, some unarchivers will extract into the current directory, though you could avoid annoyance caused by this by "first creating a new, protective directory and then moving the tarball into it before untarring."

I would assume that if there is a folder with the same name as the tar archive, the tar archive would be extracted to a different (renamed) folder, but that would depend on the unarchiving program that you would use.

As far as other formats go, again, it depends on the unarchiver you use, but the same concept should hold.


Google's usage of RC4 I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following:

  I know Google uses RC4 for most of its services, and this is the
  reason one shouldn't keep gmail opened all the time ;-)

Is this true? What sort of attacks can be done if we're exchanging information for too long using RC4? and how long(or how much of data) is too long?

There are known biases in RC4 output, especially in the first bytes of the stream. In the "Gmail scenario", the client (Web browser) regularly connects to the server to poll for new incoming messages. Each connection implies encrypting the request data with a fresh RC4 stream; and all the requests will contain the same secret value at the same place in the stream (the HTTP cookie). Over time, an attacker observing the streams may do statistics to work out the data bytes of the said secret. See this blog post for some explanations.

Note, though, that in practice it does not work (yet). The attack is cryptographically real; however, the "Gmail scenario" does not do enough connections to allow the biases to become really dangerous. The safety margin is small (uncomfortably small), but it is there. Namely, it takes millions of connections for the biases to begin to show up, and, moreover, the "interesting bytes" for the attacker are a bit too far down the stream (a HTTP request will begin by the "verb + path" string, then other headers, the cookie coming only after a few hundred bytes; the biases are biggest at the beginning, but the farther the secret is, the less efficient the attack becomes). Assuming a connection every minute (Gmail does not do connections that often) it would still take 30 years of continuous observations to begin obtaining actual secret bytes, even if the cookie appears "early" in the HTTP header.

So while these biases ring as a warning bell, telling us that RC4 is flaky and we should be wary of using it, they do not mean that RC4-protected SSL can be routinely broken through. Google uses RC4 (that is, they support RC4 and they configured their servers to prefer RC4 whenever possible) because of all the noise which was made about the BEAST attack on block ciphers which use CBC. The BEAST attack setup is heavy and was demonstrated in lab conditions only; never spotted in the wild; and Web browsers promptly included countermeasures so the attack does not actually work in practice. So, in effect, Google has to choose between two attacks which do not work, and do things which will disable one or the other (although in practice neither works). This is not a cryptographic issue; this is a public relations problem. Right now, Google prefers RC4 because they consider that, in the view of the general public, BEAST is "scarier" (maybe because the BEAST was presented as a Youtube video whereas the RC4 biases were first publicized as a 335-slides technical presentation; it is no wonder that the former better took to the public eye than the latter).

In any case, Google can switch its server configuration at any time. As long as they keep track of advances in cryptology (they do), things will be fine.


Slow Loris Incomplete GET Request A slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made after extremely long periods of time, from my understanding.

GET / HTTP/1.1\r\nHost: hostname\r\nUserAgent: user-agent\r\n"

or

GET / HTTP/1.1\r\nHost: hostname\r\nUserAgent: user-agent"

Here are two examples of incomplete get requests that could be used for slow loris attacks (correct me if I'm wrong).

My question is, for each connection, how are these meant to be sent. Is there meant to be a time interval? Is it meant to be sent in parts? Or could you just send them whole with/without a time interval and it would still work?

And lastly is the slow loris attack outdated?

Each connection should be send completely (so send a complete incomplete request), the incomplete GET request will make the server think that you are on a poor connection and keeps waiting for the rest of the request.

Each connection does require its own port, for this reason slowloris doesn't work well on windows, which limits it to ~130 ports. Sending the requests with an interval will still have the same result, but keep in mind that you need to fill up all the incoming connections of the server before the first one starts to time-out.

It's not out dated, they even updated the script to also support ipv6, you can simply test this by setting up an apache2 server and run slowloris.pl. If you setup mod_status you can watch the connections filling up real time.


Prevent external processes from changing .NET variable values I was reading this writeup of how CylancePROTECT can be exploited. It has a Windows service which is implemented using .NET.

It seems that for code written in .NET, it is trivial to locate important variables and find their location in memory.

The exploit requires access to a context running as NT AUTHORITY\SYSTEM, so its impact is likely limited. The writer was able to use WriteProcessMemory to change a key variable that effectively disabled monitoring.

A possible protection I found was Microsoft protected processes, but some digging revealed that Microsoft only allows vendors to use it if they are members of the Microsoft Virus Initiative or Virus Information Alliance - which essentially means only large vendors are welcome.

Now, I know you can't protect against everything, but I was wondering what kind of defences were possible to:

Prevent the discover of important variables
Prevent finding the location in memory of variables that have been found
Prevent another process from writing to your processes memory

You can't implement this effectively.

You're running into what's generally referred to as the "DRM problem" - code running on a general purpose computing platform can always be subverted or modified by the owner of that system. Your code is no longer your code when it runs on a user system.

Designing these kinds of anti-dumping, anti-injection, anti-modification, anti-debugging, anti-cracking, anti-reversing, anti-emulation, anti-whatever-else-you-feel-like systems is an ongoing field of research and commercial effort. So far nobody has been able to produce an uncrackable protection. There have been cases where breaking protection was particularly difficult, but all schemes have eventually been broken somehow, even in the case where specialist hardware was used (see: HDCP, PS3 LV0 keys)

Discussion of what can be done to make things difficult for someone attempting to subvert your program could easily span a whole book, but here's a rough outline of tricks on a Windows platform:

Anti-analysis tricks such as:

Compression or encryption of code (packing)
Virtual machines (implement a custom processor emulator, write code for that)
Control-flow obfuscation
String and data obfuscation
Fake code
Runtime code modification

Anti-debug tricks such as:

Early execution of code (pre-EntryPoint) using TLS callbacks.
Execution time comparisons using rdtsc or GetTickCount.
Direct debugger checks (PEB flags, IsDebuggerPresent, etc)
Exploiting vulnerabilities in common debuggers (e.g. OllyDbg OutputDebugString bug)
Detection of common debuggers and tools via process names, window names, window classes, mutexes and other objects, drivers, presence of files
Injecting debugger checks into other processes (e.g. explorer) to avoid them being identified.
Endless others...

Anti-modification tricks such as:

Runtime checksums of critical code and data
Shadow copies of critical data for later verification
Encryption of memory using CryptProtectMemory API.
Moving critical operations to the kernel (using a driver) to make it harder for a user to tamper with code.

VM detection (again whole books can be written on this)
Hooking common APIs in all processes (either in usermode using DLL injection, or in the kernel) to deny or otherwise tamper with calls which attempt to access your process.
Anti-tracing tricks using software breakpoints and exception handlers.
General security hardening such as enabling NX + ASLR + ForceIntegrity, plus mitigation policies which may make it harder for software to access the process or inject DLLs.

Even if you implemented every feature on this list, it can all be bypassed with some work.

It's important to note that .NET itself doesn't necessarily have any real weakness to being memory edited that native (e.g. C, C++) executables don't. What makes .NET easier to attack in general is that the intermediate language (IL) instructions and metadata contained within can be more easily reverse engineered into something human-understandable, whereas native executables have more options for obfuscation and anti-reversing tricks and don't contain such metadata. The article you linked simply shows a way to use reflection to get access to the variable rather than a more native approach which would work just as well.


Comodo dragon gives me warning about certificates installed on my system today I was surfing the web with Comodo dragon browser and it gave me this warning:

it don't tell me which certificate! is there any tool that I can use to scan my installed certificates?
and also because I'm living in Iran and websites like youtube are filtered by government I use vpn to bypass this filtering. is it possible that vpn be the reason of this message?

I just used another Comodo's product to scan my PC and find out this warning was a false positive about "microsoft ecc development root certificate authority 2018".
but anyway if you need to scan your installed certificate just like me you can use comodo free antivirus

Update:
Because I wanted to investigate more about this issue, as described in this article by Kent Chen I used sigcheck to list all my suspicious certificates. it was so much better than antivirus and showed me more certificates which I should consider for examining.
just download the sigcheck, unzip it and open PowerShell in that directory and execute following command

 .\sigcheck -tv


What files can I keep to reinstall an infected system without getting infected again? I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have programs and all of my files. If I boot from Linux to save whatever I can save, what should I save and what should I be careful about completely deleting?

I guess all executables are better deleted as a malware with control of the system could've replaced them with malicious versions? And what about other kind of files?

In particular I'm concerned about my emulators and ROMs of retro consoles. I'll probably delete all the emulators, but are ROMs at risk? Can they easily be corrupted to become malicious software?

And in general, can I keep documents, videos and music?

And if any executable slips through and I don't manually execute it, could it cause any damage?

I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have programs and all of my files. If I boot from Linux to save whatever I can save, what should I save and what should I be careful about completely deleting?

If you have backups from before you got infected that could not be accessed by this system after it became infected, just nuke everything and restore from those.  If not, continue reading.

  I guess all executables are better deleted as a malware with control of the system could've replaced them with malicious versions? And what about other kind of files?

Office documents and PDF's are the big ones to make sure and remove.  Both of them are pretty actively used attack vectors, and just loading an infected one is quite often enough to compromise the system.

Others include (but are not limited to) JAR files (which are Java executables), any virtual machines you might have on the system (they're probably infected), and anything inside C:\Windows.

  In particular I'm concerned about my emulators and ROMs of retro consoles. I'll probably delete all the emulators, but are ROMs at risk? Can they easily be corrupted to become malicious software?

The ROM's are probably safe.  While they actually are executable code, they aren't native code and they aren't highly portable, so they're not easy or attractive targets for malware.  Unless you can reliably determine that you were infected through one of them, you can probably safely assume they are not infected.

  And in general, can I keep documents, videos and music?

Documents other than plain text files should probably be wiped.  Videos and music may or may not be safe to copy over, they're not hugely common attack vectors (so the same argument as used for ROM's (if you can't determine that you were infected because of them, they're probably safe).

  And if any executable slips through and I don't manually execute it, could it cause any damage?

If you're doing this right, no executable files should remain from the old system, at all.  This is not a case where you should be using the built-in factory reset provided by Windows, you should be wiping the drive and doing a clean install from installation media (which should be prepared on a separate system if you need to create it).  In an ideal scenario, you should actually get a completely new system (or, at least, a new motherboard, CPU, RAM, hard drives/SSD's, and any add-in cards), not just reinstall, because you can't be sure the firmware isn't compromised.

Also, when copying out old data, make sure you copy just the file contents and filename.  If you copy things in a way that preserves any further metadata, you run the risk of accidentally copying contaminated data (malware likes to hide in NTFS alternate data streams).


Conflicting requirements in FIPS 140-2 regarding manual key entry Requirement 1

  All output data exiting the cryptographic module via the "data output"
  interface shall only pass through the output data path. The output data path shall be logically disconnected
  from the circuitry and processes while performing manual key entry.

Requirement 2

  During key entry, the manually entered values may be temporarily displayed to allow visual verification
  and to improve accuracy.

To display the values for visual verification, the data has to be passed via the output data path which will contradict with requirement 1. What am I missing here?

No the manual entry referred here is done by an external device (i.e. a pinpad) which is connected to the cryptographic module.When you enter the key you give an input to the cryptographic module so the output data path can be disconnected.  Moreover the external device can have a display screen where the key holder will see what he types.

The meaning of requirement 2 is that the manual entry of the key on the device display doesn't have to be hidden (in contrast with password hidden with stars when you log in most of the systems). So the key holder entering is key can verify what he enter.


Can I trick a mail server into sending me an email? Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more information about the targets like: hostnames, IP-addresses, software and software versions.

I thought about trying to fill in some forms that contain an email field in order to possibly trigger an outgoing mail-event. But I want it to be more low profile. Since such mail-event will trigger and internal (mail) event as well.

Also I thought about sending an email to a non-existing email address in order to get it bounced back. But that won't work when they use a catch-all policy.

In other words: Can I trigger or force an mailserver to send an email to a desired mail address, owned by me?

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups.

The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized users to send mail to external sites.

If this does not work you might try to generate a delivery error upstream which results in a bounce to you. How such delivery errors can be generated again depends on the setup of the infrastructure, but you might try to send mails with a virus inside (like EICAR  test virus), with invalid MIME structure, invalid DKIM signature or similar problems in the hope that some firewall will croak about such mail and cause a bounce.


How secure is Java's hashCode()? On our views in a Java web application, currently I am using hashCode as Id's for objects so that at server end I can get the same object back.

However, I am wondering how secure Java's hashCode really is so that someone cannot hack it to retrieve other person's objects.  I am not very inclined towards Encryption-Decryption mechanism as it causes much CPU.

What other fast yet secure mechanisms I can use ?

You're breaking one of the hashCode() taboos; you're using its output as a key identifier. That's wrong.

You see, the output of hashCode() (in its default implementation) is a 32-bit unsigned integer, that's roughly 4 billion unique hashCodes. Sounds quite a lot? Well, not so much. Applying the birthday problem in this case shows as that with about 77000 objects, you have about 50% chance of collision. 50% chance of two objects having the the same hashCode.

Another issue is that the implementation of hashCode() can change from one Java version to the other. It's not meant to be permanent identifier of an object, so there's nothing forcing it to be consistent across versions.

If you insist on using hashes as object identifiers, then it's much better to have your own method instead of hashCode() to use for your key identifiers (for example, getMySpecialHashKey(). You can uses something like MessageDigest.getInstance("SHA-256") to digest the object into a nice 256-bit key.

My recommendation: Ditch the whole idea of hashing the object and rather generate a random identifier for your object when you construct it. Something along the lines of (in Java)

SecureRandom secRand = new SecureRandom();
byte[] objIdBytes = new byte[16]; //128-bit
secRand.nextBytes(objIdBytes);
String objId = Base64.encodeBase64String(objIdBytes); //Here's your ID

You also seem to bind access to an object only to knowledge of its key. That's also wrong. A proper permission-based model with proper authentication and authorization is needed.


Why is "MIME type mismatch on image file" a security vulnerability? Some security vulnerability scanners as Ratproxy detects a vulnerability called "MIME type mismatch on image file". Thanks to the CAPEC project we can see that Cross-Site Scripting Using MIME Type Mismatch is possible, but the explanation shown is not clear for me.

What I undestand is that where this vulnerability exist, it is possible to, for example, embed Javascript inside a PNG file, upload it to the site, and in some way execute the Javascript inside the PNG file.

Can you explain how exactly can an attacker exploit this kind of vulnerability with an example?

Is it needed that the web client (e.g. the browser) has also a vulnerability to exploit this web application vulnerability or it completely depends of the web application?

The problem is with the browser (or in the case of the linked CVE with Outlook).

The attack is as follows:

I create a file and send this file to the program with the MIME type image/png.

The browser ignores the MIME type and sniffs the content of the file (even I explicitly say that the file is of type image/png).

The browser determines (from sniffing) that the content type is text/javascript and handles it accordingly (as Javascript).

Therefore in my eyes this is a flaw in the browser because I clearly determined that the file is of another type.


Authorization on OAuth2 application that is both Client and Resource Server I am trying to understand how would an application which uses OAuth2 (OIDC) server implement access control to its own resources.
In this case, the application is both 'Client' and 'Resource server' in terms of OAuth2.

So, user, from the browser, accesses the application and is being redirected to OIDC server where he gets authenticated, after which OIDC server sends access_token and id_token to the application (not to the user's browser, suppose the application is 'confidential' client in terms of OAuth2).
I suppose this access_token could be issued with access rights to the application (now acting as a 'Resource server'), which could be used to control the access to the application's resources to the user. But how could user send this access_token to the application (acting as a 'Resource server') since the user didn't get in possession of this token (it get's shared only with the application)?

Is it possible that this access_token be used to create some sort of "access" session between the user's browser and the application, similar to how id_token is used to build authentication session in form of a cookie? Or, is the authentication session used to obtain access_token from OIDC server every time a user accesses a different resource in the application, user being unaware of this communication since it is not asked for giving consent?

Or am I getting this whole thing completely wrong?

My case: suppose we have one web application which has backend and frontend, but frontend NOT being implemented as an SPA (in which case it would act as a 'Client'). The token is still shared between backend and AS (not going through the browser). How does my application control access to its resources? For example, the user is able to see the home page, but not an admin portal?

Please don't base your responses on my concrete use case, try to answer in general.

I believable your application have an architecture similar what I have show by below image,

Application have front end which runs in the browser and have a back-end. Authorization server is externalised (out of application's boundary). Hence your app have a back-end you can make application a confidential client. The login to application happens through OIDC flow. Browser redirect user to login page of authorization server. He/she provide credentials, server sends back an authorization code and this is passed to back-end which allows back-end to make the token request.

One option I see here is to create an authenticated session between browser and resource server. The green connection in my diagram stands for this session. This session being authenticate means that it is bound to access token. Session timeout is defined by access token expiration. This will require some logic from front end as well resource server end.

Another option is to pass access token to front end. With this, you does not require to maintain a session but front end requires to protect access token and send it with every request make to the back-end. So the green connection line now stands for bearer token trust connection (refer RFC6750 to see the standard way to transmit access token over headers)

Regarding access rights (consents), this will depend solely on context of your application. If you want OIDC to externalise user logins, user directories and authentication mechanisms, then I don't see the requirement to worry much about this. What you need an access token (and ID token).


Strange login in Chrome I work from home in a company laptop. It has installed this software by the IT team: http://www.misutilities.com/network-asset-tracker-pro/

My main browser is FF and I use Chrome only to test my work. I can tell for sure nobody logged in on it because I was the one to install it and never logged in on it. This morning I found Chrome to be logged in with credentials of one of my colleagues who is in another city. Only option seems to be from remote. But how to know for sure how? Or should I ask him directly? Or the IT team?

I did logout and clear the login info completely.

Well my first thing to check would be are you sure you didn't give anyone else even temporary access to your machine? I seems very odd to me for someone to remotely log you in to their google account.

Second solution. It's possible that Google Chrome was originally installed on your machine by somebody else who logged into google chrome, and then when it was uninstalled it failed to clear the saved login data from the last user, meaning that when the program was reinstalled the browser automatically picked up on the saved login data.

Your best bet is to speak to your IT team. It's possible you aren't the first owner of that company laptop and it's extremely possible that it wasn't cleared correctly. It's probably nothing malicious.

With regards to the software that you said was installed on the machine, it looks to me after a brief glance to be a remote monitoring program without the functionality of remote administration, so therefore unlikely it was used in this case.


OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger encryption and authentication. Is it possible to change the 1024-bit CA seamlessly, like issuing a 2048-bit CA and sign it with the old one?

For the bits where RSA is used, OpenVPN actually uses SSL/TLS, in which the asymmetric keys are used as part of X.509 certificates. There is no intrinsic limitation(*) for key size in X.509 certificates, so switching to 2048-bit keys should "just work". Larger keys may hit some internal limitations in some implementations, but OpenVPN uses OpenSSL which is perfectly up to the task.

Arguably, SSL implementations which cannot use RSA keys larger than 1024 bits ought to be changed, because they are sloppy. 1024-bit RSA is not (yet) broken (current record is for a 768-bit key) but it seems to be within reach of current technology (using a substantial amount of millions of dollars, and a very specific to-be-built machine). Various bodies (e.g. NIST) have strongly recommended moving to larger keys for several years. Therefore, an implementation which does not support RSA keys larger than 1024 bits is likely to be unmaintained, which is never a good thing.

(*) Actually the length of a well-formed X.509 certificate is limited to 702223880805592151456759840151962786569522257399338504974336254522393264865238137237142489540654437582500444843247630303354647534431314931612685275935445798350655833690880801860555545317367555154113605281582053784524026102900245630757473088050106395169337932361665227499793929447186391815763110662594625664 bytes, which allows for a maximum RSA key length of less then 5617791046444737211654078721215702292556178059194708039794690036179146118921905097897139916325235500660003558745981042426837180275450519452901482207483566386805246669527046414884444362538940441232908842252656430276192208823201965046059784704400851161354703458893321819998351435577491134526104885300757005312 bits (you have to account for a few thousand bits for the other certificate fields).


Is there a tool allowing me to store some encrypted data in an image file? I've seen - http://stegosploit.info/ - it's adding certain data.

I'm not that sophisticated, I just want to have in an image file:

file header
encrypted data
the image does not have to be real (could be the visual representation of the encrypted data)

Is there a file format that would allow such thing? (I understand some file formats might be difficult to work with).

Is there a website allowing me to submit the base image and encrypted data?

The goal here is to distribute encrypted data across a large number of image files on image hosting websites. (first checking if the sites use lossless compression).

I don't know of any website that would allow you to do that, purely for security reasons. The point of steganography (what you're trying to do here) is to obscure the fact that there's content embedded inside other content at all.

Also, when you upload unencrypted content to a website, you are no longer the only person who has it. That makes it less secure, and as a result, you should always encrypt locally.

I recommend steghide for what you are asking.


Snort - Rule: Alert all php requests I am trying to understand writing rules for snort. Further goal is detection of sql injections like here.

I've read the documentation of snort rules and created this rule:

alert tcp any any -> any 80 (msg:"SQL Injection - Paranoid"; content:".php"; http_raw_header; sid:51233333;)

within /etc/snort/rules/mysql.rules which is refenced from /etc/snort/snort.conf. I was expecting that this rule should alert every single call of a php, but nothing was going to be logged. I also tried http_header and http_uri instead of http_raw_header.
I call snort like this:

sudo snort -A console -c /etc/snort/snort.conf

Could someone tell me please how to log every call of a ".php" through HTTP? Then I am able to go on with the next steps.

Futher information about my enviroment:
Snort is running within a virtual box with ubuntu 15.04 as OS. Network is bridged and promiscuous mode enabled for all VMs. Within the same VM is running a XAMPP Server with mutillidae which should be attacked.
If you need further information let me know!
Any advice would be appreciated! Thank you!

Not sure how helpful this is but have you tried

<?php

as your content rather. [Untested]
I've only personally setup TCP DDoS blocks using snort+snortsam for uni project.

Also check you have defined correct NIC in conf file.

Hope someone can give you a more direct answer.


Manual Checks for Signs of Infection on Windows 7 Suppose I wanted to run some manual checks to see if my Windows 7 machine has been infected. I don't usually do anything to get it infected, but I would like to check whether the below steps are enough to provide me with a basic level of assurance that it has not been infected. In this scenario, consider the machine does not have an anti-virus installed.

Reboot the machine
Using the netstat -ano command to see if there are any foreign connections from my machine. I make sure I have not opened the browser prior to this check.
Compare the PID from netstat -ano's output with Windows Task Manager
Check other processes under Windows Task Manager
Check the Startup tab from System Configuration (opened by typing msconfig at the Run prompt)
Check the Registry in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Check the Windows Logs
Check the Startup folder from All Programs

If none of the above checks shows anything suspicious, I take it as good enough assurance that my system has not been infected with anything. I know that a proper Rootkit will easily bypass all these checks and I would not be able to identify it on the system.

Questions

Is this process useful at all?
If yes, or potentially yes, what other steps should I take?
Is there really a need for an anti-virus?
Should I have done the check-ups in Safe Mode?
If this is a whole load of rubbish, would someone be kind enough to provide a pointer to a better approach?

NOTE: The nature of the question is more that of an academic/didactic one rather than a practical one.

Since the nature of your question is more didactic than practical, the answer is simple: No, that process isn't useful.

The malware designer/coder is smarter than you, he knows your operating system more than you, he spent hundreds of hours in his mother's basement (or his respective agency's labs) exploring the nooks and crannies. His whole job is to make it extremely difficult for you to conventionally find his program or even be aware of its existence.

Assume that every malware installs a rootkit, patches your operating system, modifies your bootloader, flashes your BIOS, override your settings, and change the default behaviour of everything on which you're making your judgement.

Having that said, practically speaking and in the context of pre-2008 simple malware (I haven't looked into malware code/analysis for years), yes your method is an acceptable forensic approach for a beginner to intermediate level.

Finally, utilizing an antivirus software is a good idea and a very good line of defence. Just think about of the millions upon millions of signatures, patterns, and behaviours that software is able to search through to verify your files even before they could affect you.


Automatic push on commit (on bitbucket repository) I have a website which commits to a git local repository all the changes done.

I need to automatically push them directly from the web server to a remote Bitbucket repository.

The authentication method I use to do it is by passwordless SSH key stored on the Web Server, but I think this could be not so secure.

So the question is... do you know a more secure (or simply better) method to automatically push changes from a Web Server to a Git-Bitbucket private repository?

If you can automatically push, all the secrets have to be on the server. So if someone breaks into that server he will be able to push to hat repository as well. From that point of view there is no difference in SSH passwordless key vs SSH key vs password. You will need to store it on the server that should do the push without interaction.


one-time link on 1ty.me 1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is removed permanently.

They say in their FAQ that the link is the key to decrypt the secret message. Their staff cannot decrypt anything.

I'm trying to figure out how they do it. I mean they must identify the data somehow.

That must be pretty obvious...

An encryption key is generated and used to encrypt the secret message you want to store. The secret message is then stored encrypted on their server and they distribute you an URL which contains the decryption key and the id of the secret message. They do not store the decryption key anywhere on their server and thus have no knowledge of the message content.
When someone visit your link, it uses the id to find back the secret message and the decryption key to decrypt it.

This kind of method is called zero-knowledge storage.