What are some metrics to be used to evaluate SaaS security? What are some metrics to be used to evaluate a SaaS app's security?

Some examples:

static code analysis (Fortify)
code coverage (bugs being a potential source of vulnerabilities)
others?

In case it isn't obvious, the code is available to audit and measure.

In a SaaS model, you will likely not be able to perform code audits. This is because as stated, it is Software as a Service. Not software where you would be able to download the software itself, let alone the source code for the software. That task would be done at the discretion of the software vendor, and or provider. Please see "5 Problems with SaaS Security"

So I will document issues I have with SaaS, and SaaS Security.

Access - Who is accessing this. Is it just my organization. Is it a
multi-tenant software. Would there be any overlap.
Auditing - How can I audit this at will. Where are the logs stored, how can I modify this to my business (data retention)
Security - while I may not be able to audit code, how can I test for the low hanging fruit (known known vulnerabilities, configuration issues, etc)

Security when it comes down to software you purchase is never your responsibility. When you buy a car, and the automaker tells you they went through (in the US at least) IIHS (Insurance Institute for Highway Safety) testing that established a baseline of safety, have you ever said: "I don't believe them, I need to crash my car for myself to make sure the airbag deploys." Many larger SaaS vendors have security measures, and testing in place. (Google, Microsoft, Salesforce, etc)

So let's put this into an alternative view now. You test the software, find vulnerabilities. So what. Now what. Do you fix them on your own? What makes you think a SaaS provider would allow you to randomly test their software "pre purchase." There has to be some level of trust, and while it can be said: "Trust but verify" in the business world, this is where Service Level Agreements, and Terms of Service agreements come into play to mitigate/transfer the risk.

Many SaaS providers do take security serious for example see Microsoft's stance on this:

  Office 365 and Microsoft Dynamics CRM Online internal monitoring
  includes automated compliance monitoring of infrastructure (e.g.,
  vulnerability scans, penetration testing and testing of process and
  people controls). The Office 365 and Microsoft Dynamics CRM Online
  third-party validation program includes independent audits that are
  conducted on an annual basis to provide verification of Office 365 and
  Microsoft Dynamics CRM Online's security posture.

What exactly is it you are trying to accomplish? Trying to be the security team for a vendor?


HTTP Proxy vs bump-in-wire If I'm an administrator of a corporate network, I could use an HTTP proxy to examine outgoing connections to monitor what websites my employees are going to, and terminate connections based upon policy/content rules.

Or, I put an invisible bump-in-the-wire box at the gateway to examine traffic content and terminate connections based upon the same rules.

As far as I can tell, these two options are identical, except that a proxy requires configuring clients to use the proxy.  This makes me think that everyone would choose to use a bump-in-the-wire, yet HTTP proxies still exist and are in use.

Is there a benefit to HTTP proxies that explains why they are used?

With the HTTP proxy, user systems can have local private addresses (e.g. addresses in the 10.0.0.0/8 or 192.168.0.0/16 networks) since, at the TCP/IP level, these systems only talk to the proxy, not the Internet at large. With the "bump-in-the-wire" box, user systems must be able to contact arbitrary external sites more or less directly, which involves either public IP (expensive !) or some NAT (which can have problems scaling to thousands of local users).

The bump-in-the-wire box also needs to intercept incoming and outgoing traffic, and, as such, may be cumbersome to retrofit in an existing architecture. The HTTP proxy, on the other hand, is an ordinary host, as far as routers are concerned.


What fields in a suspicious certificate should I look at? Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields

Version
Serial number
Signature algorithm
Issuer
Valid from
Valid to
Subject
Public Key
Basic Constraints
Certificate Policies
CRL Distribution Points
Enhanced Key Usage
Key Usage
Subject Alternative name
Authority Information Access
Thumbprint algorithm
Thumbprint

Under some circumstances, the browser conveys what the problem may be.

E.g.

Certificate not yet valid/expired: In this scenario either 'Valid From', or 'Valid To' is bad
Certificate for a different web-site: In this scenario 'Subject' is bad

I remember being told that on a suspicious certificate some fields should be verified manually/explicitly. I can't remember which fields amongst the above are relevant, nor what to look for in these fields.

For instance, what would happen if the field "Basic Constraints" in the certificate is bad? Or if the field "Certificate Policies" is bad?

Which fields in a suspicious certificate should I look at?

EDITED:
Useful responses all around. Thank you!

What is the significance of the fields 'Basic Constraints', and 'Certificate policies'? I took a look at the RFC5280 but am too dense to figure out the significance to the  description

Look at the Issuer field also!  As discussed at How feasible is it for a CA to be hacked?, you really can't trust all the Certificate Authorities out there, and actually the whole CA model is flawed.  So one field to look at is the Issuer field, and you might want a browser feature that notices if you're looking at a certificate issued by an untrustworthy CA.  This covers both CAs owned or overly influenced by countries that you don't want to trust with your data, or CAs that have flawed security or issuance procedures and have mistakenly certified fraudulent certificates.

Another case you should be alert for is the case in which your proxy server issues certificates  via a CA which has been baked into your browser - something that some organizations do because they don't trust their employees.   See e.g. some of the corporate proxy software like Blue Coat, which may also be used in Syria.


Four-way Handshake in WPA-Personal (WPA-PSK) Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP Pre-Shared Key from these informations after we capture the Four-way Handshake.

This book is a very good resource on wireless security. This section explains the details of the four-way handshake, but you really need to read the whole chapter to understand it.

Both WPA2-PSK and WPA2-EAP result in a Pairwise Master Key (PMK) known to both the supplicant (client) and the authenticator (AP). (In PSK the PMK is derived directly from the password, whereas in EAP it is a result of the authentication process.) The four-way WPA2 handshake essentially makes the supplicant and authenticator prove to each other that they both know the PMK, and creates the temporal keys used to actually secure network data.

Capturing the four-way handshake will not divulge the PMK or PSK (since capturing the handshake is trivial over wireless this would be a major vulnerability). The PMK isn't even sent during the handshake, instead it is used to calculate a Message Integrity Check (MIC). You basically need to perform a dictionary or bruteforce attack on the handshake until you find a password which results in the same MIC as in the packets.


Generate RSA2 key in OpenSSH format in windows I have to generate a key, RSA v2 in OpenSSH format. I am a bit confused.

I am trying to generate it using Putty key generator. There I see an option SSH2-RSA and SSH1-RSA. So is SSH2-RSA the RSA2 key or it means something else? Also is this key in the OpenSSH format?

I see that there is a conversion tab with 2 options: export OpenSSH key and export ssh.com key. So I am not sure if the keys I have generated are in OpenSSH format.

I just cited below from PuTTY manual:

  Selecting the Type of Key

  Before generating a key pair using PuTTYgen, you need to select which
  type of key you need. PuTTYgen currently supports three types of key:

An RSA key for use with the SSH-1 protocol.
An RSA key for use with the SSH-2 protocol.
A DSA key for use with the SSH-2 protocol.

  The SSH-1 protocol only supports RSA keys; if you will be connecting
  using the SSH-1 protocol, you must select the first key type or your
  key will be completely useless.

  The SSH-2 protocol supports more than one key type. The two types
  supported by WinSCP are RSA and DSA.

  The WinSCP developers strongly recommend you use RSA. DSA has an
  intrinsic weakness which makes it very easy to create a signature
  which contains enough information to give away the private key! This
  would allow an attacker to pretend to be you for any number of future
  sessions. WinSCP’s implementation has taken very careful precautions
  to avoid this weakness, but we cannot be 100% certain we have managed
  it, and if you have the choice we strongly recommend using RSA keys
  instead.

  If you really need to connect to an SSH server which only supports
  DSA, then you probably have no choice but to use DSA. If you do use
  DSA, we recommend you do not use the same key to authenticate with
  more than one server.

Reference link: https://winscp.net/eng/docs/ui_puttygen#generating


Why is accessing kernel memory a security risk? A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few sources have explained exactly how accessing kernel memory is dangerous.

What information is stored in kernel memory? What would being able to access, but not modify, kernel memory allow an attacker to do?

In order to understand the threat from Meltdown, you need to understand how memory is organized in modern computers.

The naive view of memory is that each memory address corresponds to a specific set of cells in RAM.  This is called "physical addressing", and until about the early 1990s, was the most common way of handling memory in a computer.  Under physical addressing, if your program reads a byte from address 17, it's reading from the same set of eight memory cells each time.  Turns out, a "physical-only" way of addressing memory rather limits what you can do, particularly with regards to running multiple programs at once.

Enter "virtual addressing".  Now, your program's "memory address 17" no longer corresponds to a specific part of physical memory.  Instead, when the CPU wants the data from that address, it asks a component called the "memory management unit" (MMU) which, in cooperation with the operating system, figures out how to fulfill that request.

This permits a number of efficiency and capability gains.  The best known is probably "swap", commonly known as "virtual memory": address 17 might be temporarily stored on disk, and your program's request is put on hold while the OS stores the contents of part of physical memory to disk, and then loads the piece that your program thinks of as "address 17".  Since the range of available virtual addresses is typically much larger than the amount of physical memory, this lets the OS give the appearance of a computer with far more RAM than it actually has.

The biggest gain from virtual addressing, though, is also entirely hidden from the typical user: it lets the OS give each program the illusion that it's the only program running on the computer.  Your program's "address 17" isn't the same piece of memory as some other program's "address 17".  This means that programs don't need to worry about hiding secrets from each other: Javascript running in your web browser, for example, can't read the contents of your password manager's memory.

For efficiency reasons, the Linux kernel assigns half the available virtual addresses to itself in each program's view of memory, and assigns all of physical memory as part of that address range (the Windows kernel does similar things, though the details vary).  This lets the kernel access anything it needs to without having to adjust the MMU.  The kernel then protects its address space so that an ordinary program trying to read the memory will crash.

Enter Meltdown: it lets a program indirectly read kernel memory without crashing.  It's much slower than direct reading (typically around 150 kilobytes per second, where direct reading is measured in gigabytes per second), but it bypasses the protection.  Because all of physical memory is mapped into the kernel's address space, an attacker employing Meltdown can break the "I'm the only program" illusion.

An ordinary desktop user doesn't have many programs that need to keep secrets from each other, and doesn't run much untrusted code -- the only major threat from Meltdown is hostile Javascript reading the contents of their password manager, and the details of how Meltdown works make it hard to use from Javascript.

The big threat from Meltdown is to cloud and shared-hosting providers.  These computers routinely run programs from untrusted users, and depend on the "I'm the only user" illusion to keep things safe.  Meltdown lets an attacker with an account break this illusion, and do things like steal other users' SSL private keys, usernames and passwords, payment-processing credentials, and other sensitive information.


It is safe to share a wireshark file? I wanted to share a wireshark of my file, because it may help with some problems i'm having but i need to know if it is safe, or if could reveal sensitive data about me, the only IP's i see are my internal ones not external

I think it largely depends on what else you were doing at the time you created the capture. For example, if you were browsing the web, then obviously people would be able to see what websites you were visiting and the content of any unencrypted pages. If you were logging in to something that does not use encryption (for example, telnet, FTP, or a non HTTPS website) then your login information could be in the wireshark capture. Granted, this is fairly unlikely as encryption is used for nearly all logins these days.

Other than that, the wireshark capture will contain broadcast packets from other devices on the network, in addition to MAC addresses. These are fairly unlikely to contain any sensitive information; some people may consider MAC addresses to be sensitive, since they are unique to each device, but unlike public IP addresses they cannot be easily linked to a location or specific person. All it really reveals is the manufacturer of the computer/network card.


Is it possible for ssh app on Android to collect my credentials? I have a condition that I am far away from my laptop that I use to work. All I have is my Android Samsung J2. Sometimes I need to work remotely on my server, checking some stuff like traffic data, logs, and such.

I try using putty on my Android. There are many ssh apps like putty for Android.

Is it possible for the ssh apps to get my ssh user and password? Could the developer of that app collect credentials?

There are malicious applications in the Google Play Store. Extracting your SSH login data like the password or the private key is possible for a developer of a malicious Android application. Once the adversary is in possession of your password or key, he can connect to your server.

Back in 2013 attackers created a trojanized version of PuTTY to steal SSH credentials.

Thus, you should only use trustworthy applications for your SSH connections.


Basic Website Protection (XSS,SQL-inject,hashing) I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out special characters but I do not think that is the best approach. What is the best approach to guard against SQL-Injection attacks?

Additionally, the site is heavy in javascript and so I will probably rewrite some of the logic to be server-side. The main vulnerability I see would be a callback function that sends a string to the server. This string is parsed and then submitted to the db. Is this a real vulnerability and if so, how do I fix it? Also, is having logic on the client a risk? What is the criteria there?

Lastly, how do I implement a simple password hash for the db? Do I just follow these instructions? (I ask because I tried and failed but just wanted to make sure I'm chasing the right rabbit)

Also, am I missing anything big?

For SQL injection, you're basically on the right path.  The best advice it to not roll your own.  Use something well known; whichever language you're using probably has a library to be used with proper parametrised SQL.  OWASP has a very good article including mitigations against this attack vector here

If this string is never executable, then it's not a vulnerability (that I can think of at the moment anyway).  Basically, this is an injection vector.  If the string is never used directly, then it shouldn't cause an injection vulnerability.  If this string is used to control the logic of your application, then yes, this could be vulnerability depending on what it controls and how deep the attackers knowledge of your application is.

For password hashing theory Thomas Pornin has a very good answer here.  The gist is to use a known good implementation, and whatever language you are using will likely have a built in method to hash passwords.  Just make sure you follow all recommendations in the linked post, such as which algorithm to use and the size of the salt.

As for any other advice, I suggest you check the OWASP Top 10 for excellent advice.


Varnish non-https connection back-end server I'm using a HTTPS connection for my webshop to have a secure connection for my users, but now I would like to add Varnish for faster pageloads but which doesn't support SSL.

So the idea to still implement Varnish is this setup:

Well except for User A cause I redirect all users to use the https:// webaddress. So the user connects to the server with a HTTPS connection, Nginx terminates HTTPS so varnish can be used.

But my question:
What is a save connection between my Varnish server and my actual Back-end server (the LAMP server in this case, which is a LEMP server in my case)? Cause I was thinking of private networking at Digital Ocean (where my current servers are hosted). But their servers with 4GB of RAM (which I would like to use for Varnish) are quite expensive!

So I was thinking of getting a bit more affordable server with 4GB of RAM somewhere else as my Varnish server, in a different datacenter, and connect to my back-end server at Digital Ocean. But in that case I cannot use private networking. But is this OK or not that safe?

Is it safe to have a non-https connection between my varnish server and back-end server? I suppose it's just OK, but to be sure, I hope someone over here can give me some advice.

If Varnish_VPS and LAMP_VPS are not in the same trusted network, you need encryption (and authentication) between both. If you don't, other users on the network of either cloud provider can sniff or manipulate your data.

There are a couple of ways you can do this:

HTTPS - could be self-signed, because you have full control over the client (Varnish).
VPN - this makes it seem that the servers are both in the same network, which is useful for other data besides HTTP.
SSH tunnel - a poor man's VPN. This could be fragile because it is not really meant for permanent use.


What happens if you forget your 1Password password? When using a service like 1Password, what happens if you forget or lose your master password?
My guess is that you can simply reset your passwords on all the sites 1password remembered for you, but I think if you don't have a recovery email address or phone, things like gmail accounts might be rendered permanently inaccessible. Is this correct?

If you don't have an up-to-date backup, you will permanently lose access to all the data stored by 1Password.
There is no way for 1Password to decrypt the data, simply because they don't know the key. Your password is the key to the AES encryption used.


How should Two Applications Authenticate between each other I would like to understand which would be the best strategy for authentication between two applications running at different places.
My application client needs to call the Rest API of a server, and there are only few clients which connect to this server, but the number of request made by the clients are huge. The client is in java stack, and communication occurs over TLS 1.2 .

I have considered the following options

Certificate based Mutual Authentication :- Here both server and client
provide their certificate to validate, However, I find this approach to be
complicated, though this seems to the best.
Basic Auth :- I find this to be less secure and not recommended.
OAuth :- I don't want to use any other auth provider for tokens.
Pre shared Secret Key : A key is encrypted with timestamp and parameters, and this is passed as a token to validate.

Are there any other approaches which are suitable, and what would be best approach to use.

Basic auth together with some simple bruteforce protection should satisfy you. But if you need more complicated way to manage your app's authentication and authorization, take  a look on JWT tokens


Lots of failed outgoing sshd attempts. Am I hacked? For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like:

sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed
sshd[xxxxx]: error: connect_to 1.gravatar.com port 80: failed
sshd[xxxxx]: error: connect_to 2.gravatar.com port 80: failed

I don't think anything on my server uses gravatar, and even if it did I don't see why sshd should be involved. Further, the reports showed up "randomly" and there's been around 100 failed attempts for each gravatar address per day.

I've tried doing a bit of diagnostics myself, but I'm not an expert. I tried looking for scripts which use gravatar (with grep on my web directory) and haven't found anything (which is extra suspicious).

While digging I found two directories that I'm concerned about:

/tmp/.X11-unix
/tmp/.ICE-unix

I thought I disabled X11 on my server since I don't use it, and I have nothing to do with the IRC or anything else that I can imagine would be in .ICE-unix. There's nothing in either directory, but their very existence is suspicious to me (possibly due to my own ignorance).

I can't find any other evidence that I've been hacked, and I thought I ran a pretty tight ship, but I'm obviously concerned about this. I run a Debian server and I make sure every single package is updated every week. I'm new to this site and to investigating a hack, so I appreciate your patience and if there's anything I can do to help you help me, please let me know (I'll let you know that I've read tons of articles and tried as hard on my own as I could before asking here, because I value all of your time).

My guess is you (or someone else on your server) is doing SSH proxy tunneling and connecting to stackexchange or another site using gravitar, and for some reason those connections to gravatar were timing out.  I do not think my home server is hacked and I see similar messages in my auth.log, but only on days when I was using the SSH proxy.  The messages are on my_home_computer when I'm using a proxy from a different computer that was setup by ssh -fND localhost:12346 my_home_computer -- granted my entries are logging IP addresses like:

Mar  6 14:33:57 my_home_computer sshd[17500]: error: connect_to 173.192.82.196 port 80: failed.

My guess is these messages correspond to the lines in the side using the proxy that say:

channel 6: open failed: connect failed: Connection timed out
channel 4: open failed: connect failed: No route to host
channel 2: open failed: connect failed: Connection timed out

EDIT: Further testing, confirmed this suspicion.  Starting the ssh tunnel with the verbose flag set (-v):

ssh -vfND localhost:12346 my_home_computer

and trying to connect to a bad IP address (10.11.12.13) that eventually times out, on the timeout (visible in the web browser with a "The connection has timed out" message), the output of the terminal that started the ssh tunnel will show:

channel 2: open failed: connect failed: Connection timed out
debug1: channel 2: free: direct-tcpip: listening port 12346 for 10.11.12.13 port 80, connect from 127.0.0.1 port 34199, nchannels 10

Meanwhile, watching the output of auth.log at the same time with sudo tail -f /var/log/auth.log the following log entry will pop up:

Apr  7 17:38:03 my_home_computer sshd[23789]: error: connect_to 10.11.12.13 port 80: failed.

TL;DR: Just harmless web browsing and ssh warning you that while browsing some HTTP requests timed out or had no route to host at various points in the day.


How much does network security audit and patch work? how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network?  I need my network to be PCI Compliance and what not as well.  MY office have about 15 workstations that consists of Sales Dept, Accounting Dept, and Shipping Department.

i bought a SonicWall NSA security router, so the person will have to manage and monitor that along with ASP, PHP, JAVA intranet system.

Thanks.

I don't think it is worth it to hire a 'security guy' for a 15 workstation company.  I think YOU are the security guy for your company (since you bought the router).  But,  if being attacked is something you are worried about and you think security is important then hire one.

This is a business question, not a security question.


Is using my phone number as a pin for a phone a security risk? I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. Are there security risks that make this a bad idea?

Your phone number is documented in a large number of places - your friends, your family, your employer, maybe even your Facebook profile and G+ profiles. Many of these people know your phone number. Some of them may even know it from memory.

The equivalent would be writing your password down in an email and sending it to your contacts list - you're not advertising the fact that it is your password but the information is out there and significantly easier to find than a password or PIN that you have memorized (which would require intimidation or  torture to get it out of you, or brute force/exploiting a vulnerability to bypass).


Will Wordpress nonces protect against Login CSRF? Can Wordpress Nonces be used to protect against Login CSRF?
https://codex.wordpress.org/WordPress_Nonces

I glanced through the code for the function and it seems to only be using the User ID for verification, that means that the attacker and victim will have the same nonce? Is this really correct?

Yes, Wordpress nonces can protect against login CSRF.

Wordpress nonces can be applied to URLs and also forms, like the login form:

  To add a nonce to a form, call wp_nonce_field() specifying a string
  representing the action. By default wp_nonce_field() generates two
  hidden fields, one whose value is the nonce and one whose value is the
  current URL (the referrer), and it echoes the result. For example,
  this call:

wp_nonce_field( 'delete-comment_'.$comment_id );

  might echo something like:

<input type="hidden" id="_wpnonce" name="_wpnonce" value="796c7766b1" />
<input type="hidden" name="_wp_http_referer" value="/wp-admin/edit-comments.php" />

Usually, nonces are created attached to a user that is logged in because it makes sense to protect users that are logged in. But login CSRF is special because it can be used to target logged out user by logging them in.

Looking through the wp_create_nonce code I can see that nonces are created for logged out users as well:

function wp_create_nonce($action = -1) {
    $user = wp_get_current_user();
    $uid = (int) $user->ID;

    if ( ! $uid ) {
        $uid = apply_filters( 'nonce_user_logged_out', $uid, $action );

    }

    $token = wp_get_session_token();
    $i = wp_nonce_tick();

    return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
}

Then use wp_verify_nonce to verify the nonce. It returns false if the nonce in invalid. Otherwise, returns an integer with the value of:

1: if the nonce has been generated in the past 12 hours or less.
2: if the nonce was generated between 12 and 24 hours ago.


How to airgap properly? Imagine I have the research papers on designing COVID-19, the cure and some nuke launch codes on my laptop and want to often communicate those to another computer at my home. I already installed a physically separate STP cable network. Now what? My previous experiment in the field resulted in the conclusion that un-updated OSs are worse than being online all the time. Because 2 years later you plug in an empty USB thumbdrive and things  break.

The point at which you can exchange the data makes it a "non-air-gapped interface".

The definition of an air-gap as per RFC 4049 is:

  An interface between two systems at which [..] they are not
        connected physically [..]

Normally, when dealing with highly sensitive data, you don't save it on an end-device.
There are Product Data Management solutions with comprehensive permission management that will run on a seperate server and store your files encrypted.

Any given user will never get access to the actual files but only to specific functions that can be applied to that file. In this way, you can ensure that some users can only view partial data whereas other users, if necessary, can commit write changes to the PDM solution that will then be applied to the actual file if found legitimate.

That said, data confidentiality is a very complex topic that does not have a perfect solution.
If you cannot guarantee the legitimacy of an access, there is no way.

If a user cannot copy the data, he/she will pull out his/her smartphone and make a photo. Once you hand the data to anyone who is not 100% trustworthy, mark it as "considered to be gone".


P12 private key vs private key file : what is more secure? The question is a bit tricky because they don't have the same purpose but :

Do both kind of file face the same security issue concerning private key protection : password strength? (PBKDF2 as both are often encrypted using password-based encryption)

I would like to better understand the differences between both formats concerning private key confidentiality.

It turns out that this is pretty interesting stuff.

From the Martin Kleppmann's blog "Improving the security of your SSH private key files" (Posted 2013-06-26. Archived here. HackerNews'd here):

But how do you get from the passphrase to the AES encryption key?
I couldn’t find it documented anywhere, so I had to dig through
the OpenSSL source to find it:

1. Append the first 8 bytes of the IV to the passphrase, without
   a separator (serves as a salt).
2. Take the MD5 hash of the resulting string (once).

That’s it.

So this means that there's not much password-to-key-transformation going on. And Martin then recommends using PKCS#8 instead.

But the question was not about PKCS#8 but about PKCS#12.

And the RFC for PKCS#12 says, that there is still a compatibility mode that works similarly. And they say that you should instead use PBKDF2.

Appendix B.  Deriving Keys and IVs from Passwords and Salt

   Note that this method for password privacy mode is not recommended
   and is deprecated for new usage.  The procedures and algorithms
   defined in PKCS #5 v2.1 [13] [22] should be used instead.
   Specifically, PBES2 should be used as encryption scheme, with PBKDF2
   as the key derivation function.

Now this implies that both old and new methods can be used. And the new method is safer.

So in summary: PKCS#12 files are potentially safer than the "BEGIN RSA PRIVATE KEY" PEM files.

But: What I CAN'T tell you is how you would find out if a given PKCS#12 file has in fact used the old or the new method. Perhaps some other StackExchange member can chime in?


Does a virtualised Windows machine without internet access need (security) updates? I recently saw a Windows 7 machine (virtually running in a Xen environment) and used in a production network to perform certain automated tasks.

This system was missing over a 100+ Windows update including critical security updates. The explanation that I got from the system administrator was that this system is only accessibly in two cases:

Over the Xen console when connected to the management virtual private network (VPN).
When connected to the production VPN over Windows Remote Desktop (RDP), using two factor authentication (2FA, Vasco Tokens) authenticating against an active directory (AD).

All servers in the production network are behind a Barracuda NG Firewall.

In his opinion that should do the job and updates are not required because the firewall blocks all incoming and outgoing internet traffic to and from that machine.

It feels unnatural not to update even when the machine is "isolated". So, does a virtualised Windows machine without internet access need updates and what are the potential risks when this machine isn't updated in this case?

Note: I allowed the firewall to let this machine connect to the Microsoft update servers in order to fetch a list of the missing updates. The in- and outgoing internet connections to/from this machine are all blocked in the firewall again.

I agree with mootmoot, there is no such thing as a closed system if it talks to other machines/there is more than one person accessing it.

You could have a problem if someone breaches the xen server, if someone gets the keys to the vpn, if someone walks up to the host machine with a usb stick...

The vm is in a relatively isolated position, but there are still IO channels hooked up to it and an IO channel is always a potential attack vector.

Update it after you've backed it up. More security is better.


How does encryption force a processor to "pause"? I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a processor to "make a pause" nor how a string of numbers could force that pause. Can anyone explain this using as much plain English as possible?

I recognize I might not be throwing all these terms around in an accurate way – my computer science and mathematical fundamentals are weak at best.

Your question sounds a little vague to me, so I can think of two things you might mean by forcing it to pause:

A programmed pause - in the event that you don't have access to the password hashes, and you're just trying to type a password into the device, the device can just arbitrarily wait a certain amount of time before telling you whether you succeeded or not.  This amount of time may increase with each unsuccessful attempt, though commonly the first few times have little penalty, due to human tendency to mix up password or type things incorrectly.  If someone has access to your password hashes, and is using their own software to test all combinations (a brute force attack), then they don't need to include that pause, and it will have no effect.

Computationally expensive password checking - certain hashing strategies require a LOT of computation* to verify the the password is correct.  These are intentionally used for password checking because you can't write your own software to bypass this.  While it may seem like it would be a bad idea to force your users to wait for this expensive computation, having to wait one whole second actually isn't that big of a deal for the valid user, but it's a huge deal when dealing with a person who is trying to guess the password by brute force, as that penalty is incurred for every single incorrect guess they make.  I should mention that while this may seem to just be a pause from the user's perspective, from the computer's perspective, it's a massive amount of work, which just doesn't happen to have any visible results drawn to the screen.

*a lot of computation compared to the few milliseconds that most operations take - actual delay may only be a second or so, depending on hardware.


Strange behavior when injection wifi packets with aireplay-ng When I'm testing packet injection with aireplay-ng I can witness a strange behaviour on my Lenovo T510i. Several blogs report my wireless device to be capable of packet injection. But then look at this:

$> sudo airmon-ng start wlan0
$> sudo aireplay-ng -9 mon0
09:58:05  Trying broadcast probe requests...
09:58:06  No Answer...
09:58:06  Found 3 APs

09:58:06  Trying directed probe requests...
09:58:06  22:4E:7F:XX:XX:XX - channel: 6 - 'AP1234_Guest1'
09:58:13   0/30:   0%

09:58:13  64:XX:XX:XX:XX:54 - channel: 6 - 'SOMEOTHERAP'
09:58:19   0/30:   0%

09:58:19  22:4E:7F:XX:XX:XX - channel: 6 - 'AP1234'
09:58:25   0/30:   0%

However, when I do it another way it works:

$> sudo ifconfig wlan0 down
$> sudo iwconfig wlan0 mode monitor
$> sudo ifconfig wlan0 up
$> sudo aireplay-ng -9 wlan0
10:02:43  Trying broadcast probe requests...
10:02:43  Injection is working!
10:02:45  Found 3 APs

10:02:45  Trying directed probe requests...
10:02:45  22:4E:7F:XX:XX:XX - channel: 6 - 'AP1234_Guest1'
10:02:45  Ping (min/avg/max): 2.920ms/11.290ms/45.006ms Power: -41.47
10:02:45  30/30: 100%

10:02:45  22:4E:7F:XX:XX:XX - channel: 6 - 'AP1234'
10:02:45  Ping (min/avg/max): 2.988ms/9.768ms/34.242ms Power: -41.37
10:02:45  30/30: 100%

10:02:45  64:XX:XX:XX:XX:54 - channel: 6 - 'SOMEOTHERAP'
10:02:46  Ping (min/avg/max): 1.208ms/12.228ms/29.528ms Power: -66.75
10:02:46  28/30:  93%

Does someone know what is causing this behaviour?

Edit:

First, be sure that you're close enough to the AP. This question had almost the same problem and it fixed by that.

But if it didn't work, then the problem isn't from the injection itself, but from monitor mode option!

From your question, I can see that the problem was solved by replacing

$> sudo aireplay-ng -9 mon0

with

$> sudo iwconfig wlan0 mode monitor
$> sudo ifconfig wlan0 up
$> sudo aireplay-ng -9 wlan0

In most cases, the first way causes some troubles, and some people suggest airmon-ng check kill to solve it, but it will lead to another issues.

So, the problem is within the airmon-ng package, and the solution is to set the monitor mode using a proper way.


Is it secure to connect to a remote Windows Server using Remote Desktop only? I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, please describe how it is more secure that way.

If you are using SSL, see this technote for details.

In particular, it is important to set up your security layers

  The three available security layers are:

  SSL (TLS 1.0) SSL (TLS 1.0)

  will be used for server authentication and for encrypting all data
  transferred between the server and the client.

  Negotiate

  The most
  secure layer that is supported by the client will be used. If
  supported, SSL (TLS 1.0) will be used. If the client does not support
  SSL (TLS 1.0), the RDP Security Layer will be used. This is the
  default setting.

  RDP Security Layer

  Communication between the server
  and the client will use native RDP encryption. If you select RDP
  Security Layer, you cannot use Network Level Authentication.

And the Encryption Level:

  Low

  Data sent from the client to the server is encrypted using 56-bit
  encryption. Data sent from the server to the client is not encrypted.

  Client Compatible Encrypts client/server communication at the maximum
  key strength supported by the client. Use this level when the terminal
  server is running in an environment containing mixed or legacy
  clients. This is the default encryption level.

  High Encrypts
  client/server communication using 128-bit encryption. Use this level
  when the clients accessing the terminal server also support 128-bit
  encryption. When encryption is set at this level, clients that do not
  support this level of encryption will not be able to connect.

  FIPS
  *Compliant* All client/server communication is encrypted and decrypted
  with the Federal Information Processing Standards (FIPS) encryption
  algorithms. FIPS 140-1 (1994) and its successor, FIPS 140-2 (2001),
  describe U.S. government requirements for encryption.


Mature CIRTs gather intel on their attackers. What sources & methods are used for this? I copied this question verbatim from a tweet by Dave Hull.
CIRT = Computer Incident Response Team

Then: Time Well Spent

I used to run an IRT back in 2000-2002 and at the time, the (perceived) greatest threat came from local script kiddies.

We used whiteboards and raw RDBMs (with no GUI or application on top) to track individuals, their nicknames, known successful attacks, group affiliations, internal rivalry, etc.

We knew a lot more about these people and what they'd done, than we would ever be able to prove in court - but they didn't know that, so it was helpful to sometimes participate in various IRC channels. We estimated that we spent less time tracking and "reminding" them of our existence than we would have spent cleaning up after them.

Now: Consult your risk assessments

While I prefer regular sleep over IR these days, I suspect it makes much less financial sense for mature, corporate IR teams to track attackers today. Many attackers are criminal gangs or intelligence outfits located far away. The time required to research individuals and liase with appropriate LE would be counted in weeks or months instead of hours or days.

So, I don't think corporate IRTs gather intel on their attackers and if they did, I'd probably challenge their risk assessment. I have a hard time imagining a scenario where a corporation would be the least bit interested in spending money on knowing who is trying to attack them.

The cost/benefit analysis is obviously very different for commercial/for-hire IR shops, LE and intelligence agencies but none of those fit the term 'mature CIRT' in my book.


Creating a simple self-signed crlertificate with openssl x509/ca/req All I want to do is create a self-signed certificate that is like this:

It has the serial number of 0.
It lacks both a start date and end date.

If this cannot be done using OpenSSL, then I'd like to have the start date be 00000101000000Z and the end date 99991231235959Z.
If this can be done using other tools in conjunction with OpenSSL, then let me know.

SHA-256 is the hash algorithm.
With no default values used if I choose to leave a field blank. So, I don't want to see Widgets, Inc. in the organization name field if I choose not to fill it out when I am prompted.

The problem with using openssl x509 is that it does not allow me to specify the start date, the end date, or the serial number.

openssl ca allows me to set the start and end dates as command line parameters, but using this command requires that I have a configuration file, a particular directory structure, and I cannot choose the serial number I want to use as a command line parameter. This post has the same complaint. I don't want to use special directories NOR do I want to specify the configuration ib an environment variable. Do not ask me why I want to do it this way.

openssl req seemed like what I needed until I realized that it uses the same sort of configuration as openssl ca.

As far as I understand you looking for something like:

configuration file: openssl.cfg

# use 'ca' as the default section because we're usign the ca command
[ ca ]
default_ca = custom_ca

[ custom_ca ]
dir             = ./demoCA
serial          = $dir/serial     #  a text file containing the next serial number to use in hex. Mandatory.
                                 #  This file must be present and contain a valid serial number.

database        = $dir/index.txt # the text database file to use. Mandatory. This file must be present though
new_certs_dir   = $dir/newcerts  # specifies the directory where new certificates will be placed. Mandatory.
certificate     = ./ca.crt       # the file containing the CA certificate. Mandatory
private_key     = ./ca.key       # the file contaning the CA private key. Mandatory
default_days    = 365            # how long to certify for
default_md      = sha256         # the message digest algorithm. Remember to not use MD5
policy          = custom_policy  # a section with a set of variables corresponding to DN fields

[ custom_policy ]
# if the value is "match" then the field value must match the same field in the
# CA certificate. If the value is "supplied" then it must be present.
# Optional means it may be present. Any fields not mentioned are silently
# deleted.
countryName         = match     # C
stateOrProvinceName = match     # ST
localityName        = match     # L

-

$ openssl req -nodes -newkey rsa:2048 -keyout ca.key -out ca.csr -subj "/C=US/ST=California/L=Los Angeles"
$ openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
$ openssl req -nodes -newkey rsa:2048 -keyout new_server.key -out new_server.csr -subj "/C=US/ST=California/L=Los Angeles"

$ mkdir ./demoCA
$ mkdir ./demoCA/newcerts
$ > ./demoCA/index.txt
$ echo 00 > ./demoCA/serial

$ openssl ca -config ./openssl.cfg -out new_server.crt -startdate 00000101000000Z -enddate 99991231235959Z -cert ca.crt -keyfile ca.key -infiles new_server.csr

If you have a segmentation fault 11, you need to change the index.txt.attr from unique_subject = yes to unique_subject = no:

$ cat demoCA/index.txt.attr
unique_subject = no

$ openssl req -text -noout -in ca.csr
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=US, ST=California, L=Los Angeles
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a8:d7:f8:b3:3c:66:7d:ca:2d:fc:05:ea:93:2b:
                    ee:db:a8:f3:69:fd:6a:7a:6b:4f:52:ae:5c:ba:46:
                    dc:72:35:58:17:48:59:60:76:72:db:5f:ba:50:d7:
                    05:6b:45:b5:84:27:05:b0:86:7a:41:ff:04:32:14:
                    1e:73:1a:78:b4:36:95:e4:dd:04:73:47:ae:19:e9:
                    ed:0c:f7:52:a7:8a:1e:43:96:86:a4:59:d0:51:9b:
                    a9:50:19:38:e0:ff:cd:f8:ed:6c:76:ef:6f:fc:33:
                    33:16:15:d5:27:31:15:6f:c0:b7:9e:2f:22:fa:77:
                    d7:d6:06:a8:51:87:b9:7f:c3:35:0e:33:f5:04:a8:
                    d2:f5:5a:29:c4:1f:e9:db:d0:7e:e7:d0:a2:fc:8e:
                    c7:8b:5a:ca:b5:7d:c1:29:e9:6d:c1:20:01:6f:68:
                    d9:06:27:87:7b:fc:02:e7:4a:d9:32:5d:6b:18:0b:
                    c6:57:b7:06:c8:b9:08:b6:bc:c4:52:76:c3:b8:58:
                    49:9f:46:ca:ef:96:17:88:3c:6a:cf:a9:a9:51:2e:
                    ff:a9:20:52:d0:6b:0e:1c:c9:20:46:3c:28:d5:1d:
                    1d:c0:46:15:18:a6:6a:4d:ec:02:44:7e:78:f7:47:
                    ff:49:49:77:1d:15:c6:6d:07:a2:74:c6:fc:70:2a:
                    d6:e9
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha256WithRSAEncryption
         58:fb:28:e1:99:d0:b5:7b:5d:3d:16:e9:ab:f2:b2:9f:e9:28:
         0f:a0:65:ab:ea:00:69:4b:44:1c:2f:1e:aa:38:60:2a:19:16:
         12:19:5c:67:83:5f:fe:21:d9:eb:dd:cb:ec:be:af:d5:5a:31:
         05:99:73:9a:1f:8e:39:0f:1a:7e:68:7f:d0:ad:6f:76:8f:d2:
         83:e0:bf:27:a2:5c:c2:ca:09:33:e2:88:56:ac:4e:5b:51:58:
         62:d2:57:71:49:02:5b:bd:09:08:a8:fc:70:05:19:f2:8d:b9:
         86:19:4a:d6:53:51:f7:6c:c3:dd:c7:50:24:b0:20:5d:07:3d:
         6a:e0:60:d1:d0:4b:ab:a0:ad:ab:c6:62:5a:a8:79:4d:d9:f0:
         46:a7:27:c5:e1:62:2d:a7:88:2f:30:a4:8b:a6:05:c9:d1:af:
         09:c6:db:08:48:d7:72:4a:89:c9:09:15:de:31:8a:97:17:ea:
         45:0e:f1:c5:a0:25:fe:a1:df:fb:35:6a:b0:56:a3:f6:fe:ae:
         1b:fb:64:9c:95:43:bf:73:26:17:b0:5e:23:2c:9e:45:2f:05:
         3d:0e:6d:32:3b:80:f4:a1:80:6e:fd:15:3d:ad:21:4d:4e:87:
         da:74:c6:48:55:e4:03:5e:3e:9c:c7:ac:c2:40:3e:3f:b0:df:
         9b:59:a1:12


TOTP: Storing symmetrical secrets Is it just me or does TOTP for two factor auth seem like a step back to the days of digest auth where you have to store the symmetrical secret in a reversible manner. Passwords stored in plaintext were--and still are--rampant and there have been myriad high level exposures of these secrets by even the largest entities.

Aren't we now just delaying the inevitable exposure of the TOTP secrets along with the vulnerable databases of user information being compromised by increasingly skilled attackers?

In a world where we have hardware asymmetric crypto engines in almost every device used for 2fa how has this method of authenticating a device become the most popular?

With systems like Secure Element and Touch ID hardening key access with silicon and biometrics we have access to security that even government actors struggle to compromise, so much so that they are moving towards legislation to weaken it.

Storing derived keys has been best practice to protect passwords at rest for at least a decade, but this strategy can not be used to protect the TOTP shared secrets. This leaves symmetrical encryption, which even when implemented properly is of dubious value in protecting live systems. PKI has been around even longer and yet it still struggles to gain a foothold in implementation space.

It's still the Wild West in most respects and a roiling crap shoot of kiloword RFCs and flawed implementations. Are there any existing simple to use systems that leverage the PKI tech available today to to securely assert device identity for 2fa on internet connected system that may need to be critically secure?

You need to be aware, that TOTP is derived from HOTP (RFC4226), which was RFCed in 2005. This was the time, when smartphones have not been around, yet!

The algorithm was NOT designed for the Google Authenticator! but for hardware tokens, which would not be connected to a computer or would have no internet connected. So you would have to use the human optical interface, the eye and the typing fingers.

When thinking about it a bit, you will realize, that in this scenario, where you want to be able to type in a one time password, this must be generated from a symmetric key, since in the process of creating the OTP, there is a truncating involved (so that the OTP is short enough that it is fun typing).
If you were using assymmetric crypto to create an OTP, the truncation would destroy your crypto.

Yes, PKI, smartcards would be even better, but you will not get happy with the driver hassle in many scnearios.

So of course, if the attacker gets access to the authentication system or the database, you are lost. But if the attacker gets access to your secret documents in the backend, you need not to worry about 2FA. So the question is, which threat models you want to mitigate. And there are still a lot out there, for which a one time password algorithm based on a symmetric key works pretty well.


The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates I have some SW that extracts certificates data and the SW utilizes OpenSSL. I am confused what is the difference between the subjectKeyIdentifier and the sha1Fingerprint. Both are hash values. My intuition is that the subjectKeyIdentifier is the hash of the public-key of the certificate and the sha1Fingerprint is the hash of the overall fields of the certificate. This reference says about the subjectKeyIdentifier:

  This is a hash value of the SSL certificate.

This is an example of what I get from the SW:

"subjectKeyIdentifier": "A8:XX:6A:XX:04:7D:DD:BA:E6:D1:XX:XX:XX:45:65:EF:F3:XX:EC:XX", "sha1Fingerprint": "E6:XX:XX:5B:06:XX:50:9B:XX:82:XX:2D:XX:6E:XX:97:XX:95:XX:CB"

Note: XX in the examples is used for redaction.

The question is: What is the difference between the two hashes? What each hash is for?

The subject key identifier (SKID) is an x509 extension and thus actually part of the certificate. The fingerprint instead is not part of the certificate but instead computed from the certificate. A certificate does not need to have an SKID at all and can have at most one SKID. But since the fingerprint is just a computed from the certificate there can be multiple fingerprints, like one using SHA-1, one using SHA-256, one using MD5 ...

The SKID is used to create the trust chain not based on the certificate subject and issuer but on the certificate SKID and authority key identifier (AKID). This makes it easier to deal with situations where the same subject string is used with multiple CA certificates. While the RFC 3280 describes common ways to generate SKID the only real requirement is that the SKID of the CA certificate must match the AKID in all certificates issued by this CA.

In the example below it can be clearly seen that the SKID BB:AF:7E:02:3D:FA:... of the issuer matches the AKID of the issued certificate:

    ...
    Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
    ...
    Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
    ...
    X509v3 extensions:
        X509v3 Authority Key Identifier:
            keyid:BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4

    ----

    ...
    Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
    ...
    Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
    ...
    X509v3 extensions:
        X509v3 Subject Key Identifier:
            BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4


How to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi? I have some specific problem. Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?

I need it for my bachelor thesis, where I am using android app WIBR+ which simply tests all words from my own dictionary one by one, but if it finds the password, it should also connect to the Wi-Fi.

The problem is, that I am testing the security of WI-Fi networks which are not mine and even if I had an agreement from the owner of the Wi-Fi every time, it is necessary not to join to the Wi-Fi due to law but to just find out what the password is.

So my question is if there is any program (utility) which I can run on Android and which prevents from connection to Wi-Fi. My supervisor of the bachelor thesis also told me that it may be possible with some FW rule, but i am not really sure how to deal with it.

EDIT:
I am testing vulnerability of some specific internet provider in my city. In fact it's all about finding default password of the Wi-Fi with dictionary. I actually have to walk around the city and search as much as possible Wi-Fi networks which fall within this provider and can have these vulnerability. Then it is necessary find out who is the owner of the Wi-Fi by the signal strength and ask him if i can check his Wi-Fi for this vulnerability.
So using WIBR is probably the only one app on android which can I use, because it simply test words from my own dictionaries and that's exactly what I need. (I also have to use for every Wi-Fi network specific dictionary - not still the same) I didn’t find another app for android which does what I need and using laptop would be really impractical. Creating my own Wi-Fi doesn't help me too and I can't also afford do any de-authentication attack and kick legitimate users in my case.

I am testing the security of WI-Fi networks which are not mine

I will assume you are acting in good faith and that this was passed by some ethical committee at your university. If not, I urge you to cease doing this and wipe any cracked passwords immediately, until you have such consent.

  Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?

Sure. You're doing a bachelor's thesis in IT I assume? In that case, I'd say you should know this... but anyway, to answer the question, WPA2 does a handshake. If you capture the handshake, you can use it to brute force the password offline. This is also much faster than the online attack you are doing. The only requirement, since you need that handshake, is that you capture someone connecting to the WiFi network.

If I remember correctly, you need someone who successfully connects, but I might be wrong (i.e. you might be able to try to connect yourself with a password that you are sure will not work, and then use that handshake to brute force).

For the sake of completeness, in order to obtain such handshakes, you could do a deauthentication attack. Clients will automatically reconnect and you will get a positive handshake. I would however recommend that you do not do this, because it disturbs legitimate users (ethically wrong) and it's also illegal in any jurisdiction I know of (it's not jamming a signal exactly, but I'm reasonably sure I read about a conviction because it's close enough to be considered jamming).

  I am using android app WIBR+ which simply tests all words from my own dictionary one by one, but if it finds the password, it should also connect to the Wi-Fi.

Which is illegal, by the way. The Dutch law states one may not break into an automated system in such a way (it's even a felony if I remember correctly, not a misdemeanor or infraction), and I'm sure your country has similar laws.

Cracking the password is one thing; then using it to break into an automated system... that's where it becomes 100% sure to be illegal. But you seek to prevent doing that, which is good.

If the tool is open source, you could modify it to not include the connection part. And if it's not, you could patch the bytecode if you have the skills.

But since online attacks are slow, I don't see why you want to do this sort of attack anyway. It'd give much better (more reliable) results if you can do the cracking offline, and by doing it offline, you don't risk connecting to the network either.

Tools to do this are available in Aircrack-ng. Please use them responsibly; I believe I've given ample warning about the legality of your actions by now.

Edit: I missed this part:

  find out who is the owner of the Wi-Fi by the signal strength and ask him if i can check his Wi-Fi for this vulnerability

Ah, so you ask the owner for permission. That's good! Now I understand what you are doing a lot better. In that case, I'd not be afraid of joining the network: you have permission and you will disconnect immediately anyway, so what does it matter that it connects?


Can the router admin page be faked by an attacker? This is just for my curiosity regarding securing the router.  I understand all the things such as securing password, encryption, update firmware etc etc.  But I was just wondering could the router admin webpage in the browser be compromised where all the settings are fake and the DNS still being spoofed.

Now would this scenario be impossible if the router firmware can still be updated? Is the best practice just factory reset it and update again?

Yes, this could happen in theory. The webinterface could be faked by the attacker if she manages to get full control over the router (e.g. rewrite firmware), so that your normal DNS server is displayed on the settings page, while in fact a malicious one is actually used. In theory the attacker could also fake the firmware update function, so that you think you update the firmware but the router is in fact still vulnerable.

However, that would be a quite advanced attack that would have to be tailored for the specific router model, and not something I would normally worry about. But if you are feeling suspicious, do a factory reset.

So can the factory reset be tampered with? Possibly on some router models, if the memory where the original state is saved is writeable. Also, some models might not restore the firmware but only settings leaving infected firmware intact. But again, this would be something out of the ordinary and the average home user should loose any sleep over it.


SIEM: Monitoring End Users and DHCP IP assigning issue I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with host name XYZ, I start investigating and I see that this IP is now showing Host name BFU. Because 10.10.10.4 has been assigned to a new user by DHCP.

What I see as a solution is that I should correlate the end user logs with DHCP logs to monitor / investigate the malicious attack at a certain period.

Can some one assist me here, how to go about it? If there is any other solution I'd love to know about it.

Some SIEM tools give you the ability to run scripts immediately upon alert creation, therefore you could do an nslookup real-time as the alert fired and store the host name in the SIEM.

Some SIEM tools also have an asset management feature that tries to keep track of this information for you.

Otherwise you can manually search in the SIEM by filtering on that source ip during the hour or so before and after the event and look for other events around that time that may indicate the host name such as Windows authentication that have a source workstation field , or antivirus logs that have a hostname field or dhcp lease logs as you indicated.

Or if your analysts are working alerts real-time , then nslookup the ip immediately as the alert comes in.


How to export secret keys from GnuPG including photo IDs? I'm trying to create an OpenPGP key with a photo ID using GnuPG and then export it, so it can be imported on a different computer.

Whatever tests I've done the photo ID never appears after the import on the new computer. As an example, I've started a virtual machine with no hard disk and a Linux Mint CD, then ran:

wget http://lorempixel.com/200/200/ -O test.jpg
gpg --gen-key # minimum options
gpg --edit-key -- -test-
# gpg> addphoto test.jpg
# gpg> save
gpg -K  # the photo is there

gpg --export-secret-key -- -test- > exported.secret.gpg
gpg --delete-secret-key -- -test-
gpg --delete-key -- -test-

gpg -K # verify nothing left:
gpg -k

gpg --import exported.secret.gpg
gpg -K

The photo is not there! How should this be done?

The photo is on the public part of the key, so you need to export that, too:

gpg --export -test- > exported.public.gpg

Then import both keys again:

gpg --import exported.secret.gpg exported.public.gpg

And the photo is there.


Is there any virus that can cause physical damage? Like damaging a chip on the motherboard, increase the fan's speed till something explodes, or anything similar to that. I am not an IT guru, but I never came across a malicious code that couldn't be erased using a certain software, nor a virus that caused something beyond corrupting the OS.

In older times, virus could be damaging to the hardware in the following way:

Playing with video signal rates, so as to exceed the tolerance ranges of CRT monitors. Post-1995 CRT monitors included safety mechanisms (and LCD panels are inherently protected), but older monitors have died that way.
Reflashing the BIOS. This does not permanently kill the hardware, but resurrecting it can be hard; e.g. some motherboards can be reflashed after such a junk flashing only by reading the BIOS from... a floppy disk. Who has a floppy disk nowadays ?
Causing overheating by blocking fans. This works only when the fan speed is controlled from the motherboard itself. However, hardware which allows for a variable fan rotation speed also includes thermometers, and safety circuits which forcibly cut off power in case of overheating, before permanent damage occurs.

Though I know of a motherboard that did melt an ethernet card once (the chip turned completely black and the plastic partially collapsed). Strangely enough, the motherboard was fine afterwards.
Laptop batteries can be permanently damaged from software.

However, wanton destruction is often deemed useless by virus writers, who now prefer silently installation and remote control. Modern virus try hard not to damage the computer.


Rogue WPAD server attack Today I encountered something I have certainly not seen before first hand. Our IDS blocked some outbound traffic attempts from 5 servers with no WAN access. This traffic was leading to an inactive address hosting a nonexistent wpad.dat file. 208.91.197.132/wpad.dat is the address and file.

These devices do not use DHCP, and therefore could not have been accessing a bad record.
DNS that these devices use appears to be unpoisoned.
The only thing left, and what I predict, is that WPAD is relying on NetBIOS broadcast to find a WPAD server, which is then forwarding to the above address.

The IDS blocked attempts starting 2 days ago, about every hour, and the IDS block logs matched up perfectly with outbound WSUS http requests.

There isn't any infection we have definitions for on the affected hosts.

Any ideas? At this point, I believe a device made its way onto the network and WPAD picked it up.

No, we aren't running IE 5.0 :)

WPAD attack is a common attack technique among penetration testers (and attackers) usually performed on the network segment where workstations can be found. Doing WPAD attack on servers might make sense, but it is not common. E.g. there can be an auto-update mechanism which downloads regularly something from the internet. But as you said, your servers had no WAN access.

And yes, the most likely scenario is that there was a device on the network which answered to the WPAD requests. In the future follow best practices and both register the WPAD hostname in your local DNS server, and meanwhile disable "Autodetect proxy settings" on client and server machines.


Supplying a password to PBKDF2 in raw binary vs. base64? Background: I'm working with Node's crypto library. I'm using PBKDF2 to convert a variable-length binary "passphrase" into constant-length keys for an AES cipher later on.

The underlying source of this passphrase data, for reasons out of my control, is encoded with base64. Out of habit, I decode the passphrase back to binary before supplying it to PBKDF2. But that got me thinking... Base64 encoding makes the passphrase longer, but with a more limited set of characters. In practical applications, would this make the data better or worse as an input to PBDKF2?

Put another way, if given a choice between:

key = pbkdf2(binaryPassphrase)

...versus...

key = pbkdf2(base64encode(binaryPassphrase))

...is there any difference in the security offered?

Between

key = pbkdf2(binaryPassphrase)

and

key = pbkdf2(base64encode(binaryPassphrase))

there is no difference in amount of security provided. The base64 encoded passphrase is longer input, but it is based on exactly the same amount of entropy and thus offers no additional security.

The pbkdf2 function takes practically same time to execute with either input (unless binaryPassphrase is multiple kilobytes or more). The only significant difference will be that the resulting keys derived will be different.


Security implications of setting the broadcast flag on a UDP socket Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended, but if I don't set it then only unicast or multicast IP addresses will be accepted by the kernel.

As far as I know, sending broadcast over UDP protocol is normal. So, there is not problem to use SO_BROADCAST in setsockopt(2).

Disclaimer: The only thing you SHOULD be aware of is the tiny change of optval (in setsockopt(2)) between Linux and Solaris/sunOS environment.

snippet code example:

  static int fd = -1;
/* Use the SVR4 macros to distinguish between Solaris and SunOS */
#if defined(sun) || defined(__sun) || defined(__SVR4) || defined(__svr4__)
/* Solaris || SunOS */
  char on = '1';
#else /* defined(__linux__) */
  uint32_t on = 1;
#endif
  if ((fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP))== -1)
  {
#ifndef NDEBUG
    dbg_err_fputs("Cannot open datagram: \"%s\"", strerror(errno));
#else
    dbg_err_fputs("Cannot open datagram");
#endif
  }

#ifdef SO_BROADCAST
  if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &on, sizeof(on)) == -1)
  {
#ifndef NDEBUG
    dbg_err_fputs("Cannot set brodcast flag in socket optname: \"%s\"", strerror(errno));
#else
    dbg_err_fputs("Cannot set broadcast flag in socket optname");
#endif
  }
#endif /* SO_BROADCAST */

If your development platform is a Solaris/sunOS, then you will have to add some flags at the end of the command during compilation: -lnsl -lsocket. Depending on the Solaris/SunOS version, the socket will only work if you add the -lxnet flag... If error persists: -lresolv.


cyberattack by password guessing admin account logon type 3 We have a 2008 R2 virtual server that is only used for logon via rdp or from local console. No VPN traffic is required.

The server was under attack for a couple of days, viruses where installed etc.
Most of it is cleaned up now but i still see many failed logon attempts mostly for user administrator. Logon type of the failed attempts is logon type 3.

From what i understand this (logon type 3) is a logon attempt from the local network. Now i'm trying to disable all logons of type 3 but with no success.

What i have done so far:

disabeled file and printer sharing in the network adapter settings
disabeled windows networking in the network adapter settings
in the advanced sharing settings i disabeled everything (network discovery, file and printer sharing, public folder sharing and password protected sharing)

Also i tried to close some ports that i didn't need, but the login attempts keep coming.

My question:

What can i do to block all login attempts of type 3?

Are there ports i can close?

Other settings that prevent local logons?

Is it possible that these attempts originate from a running program in windows? And if so how can i identify this program?

Other debugging tips?

below an entry from the event log:

An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       ADMINISTRATOR
    Account Domain:

Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xc000006d
    Sub Status:     0xc000006a

Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:
    Source Network Address: -
    Source Port:        -

Detailed Authentication Information:
    Logon Process:      NtLmSsp
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested

.

Logon type 3 are "3: Network logon—This logon occurs when you access remote file shares or printers. Also, most logons to Internet Information Services (IIS) are classified as network logons, other than IIS logons that use the basic authentication protocol (those are logged as logon type 8)."

Source: http://windowsitpro.com/systems-management/q-what-are-different-windows-logon-types-can-show-windows-event-log

What you really need to do is take a step back and think if you can block these logins and squelch these events, do you still trust that the server is not compromised in some other way? Then it becomes fixing that, then the next. And even still, you  might get sucked up into an endless loop because the next compromise you don't know about is re-compromising the thing you just fixed.

The best path is to stand up a new uncompromised VM, and move the services this server was providing, and of course ensure that is done in a way that doesn't move compromises as well. This will seem to be a pain, and it is.

What I cannot get from the post is whether this Windows server was exposed to the public Internet. I presume it was. You really need to put Windows servers behind a firewall and only expose the ports that must be exposed to the public Internet.


Is it secure to store passwords with 2 way encryption? I'm a parent who has a parent account with my local school district so that I can log in to their website to view my child's grades etc.

I clicked the "forgot password' button, and my password was emailed to me in plain text.  This concerned me, so I emailed the principal, including some links from the bottom of this page.  This is the reply I received from the organization's IT department:

  Parent passwords are not stored in plain text. They are encrypted. Not
  a 1 way encryption but a 2 way encryption. This is how the system is
  able to present it back via an email through Ariande's CoolSpool
  utility.

  For support reasons, the parent password is visible to certain staff
  until the parent has successfully signed in 3 times. After that, no
  staff can see that password. However, it is stored in such a way that
  the system itself can send it back to the verified email.  In the
  future after a parent's 3 successful sign ins, if they forget their
  password, their verified email account will be sent a link to reset
  their password, this change is in the works.

Does this explanation justify the plain text password being sent by email, and are my passwords secure with them?

If not, what references or resources could I reply to them with?

No, this is not a good practice. There are two distinct problems.

encrypting the password instead of hashing it is a bad idea and is borderline storing plain text passwords. The whole idea of slow hash functions is to thwart the exfiltration of the user database. Typically, an attacker that already has access to the database can be expected to also have access to the encryption key if the web application has access to it.

Thus, this is borderline plaintext; I almost voted to close this as a duplicate of this question, because this is almost the same and the linked answer applies almost directly, especially the bit about plaintext offenders; there is another answer about plaintext offenders as well.
sending the plain text password via plain text email is a bad idea. They could argue that there is no difference when no password reuse happens, but I doubt they would even know what that is and why it’s considered bad practice. Also, password reuse is so common that that wouldn’t be a good answer.

Additionally, as they seem to be working on the second part (even though password reset links in plain text emails are in the same ballpark, i.e. a threat that can read the password from the plain text mail can also read the link, maybe before you can), you could explain them the problem about not hashing from my answer, also feel free to link this answer directly.

Maybe even explain that encryption is one way, but can always be reversed by the inverse function of the crypto system in question, aptly named decryption. Using terms like "one way encryption" and "two way encryption" rather than "hashing" and "encryption" shows a lack of understanding.

The real problem is: them implementing a password reset does not mean they will hash (correctly) in the future; there is not much you can do about this except using a password manager and create a long, strong passphrase that is unique for this site and hope for the best.

This is especially true since they seem to want to keep the part of their system that tells staff your password (for absolutely no good reason). The implication being they keep not hashing properly - them saying staff can only see the password in that three login timeframe is not true; if the web app can access the key, so can the administrative staff. Maybe no longer the customer support staff but they shouldn’t be able to see it in the first place. That is horrifically bad design.

Depending on your location, schools as being part of the public sector have obligations to have a CISO you can contact directly, expressing your concerns. And as usual in the public sector, there ought to be an organization that is supervising the school; they should have a CISO at least, who might be quite interested in this proceeding.


SNI (server name indication) with SSL Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension.
Is there any alternate to SNI?

The SSL-3.0 specification contains the following excerpt, in the description of the ClientHello message:

  Forward compatibility note: In the interests of forward
  compatibility, it is permitted for a client hello message to include
  extra data after the compression methods.  This data must be included
  in the handshake hashes, but must otherwise be ignored.

What this means is that while TLS extensions were only defined, formally, for TLS-1.0 and later, they can be included in a ClientHello for SSL-3.0, and nothing prevents any client or server to actually use such extensions as part of a SSL-3.0 handshake. OpenSSL, however, appears unwilling to do just so. Notably, the command-line tool, when used as a client (openssl s_client), does not send a SNI extension (or any extension) when instructed to use SSL-3.0 only.

There is no room for extensions in a SSL-2.0 ClientHello message. A consequence is that if a client wishes to support a SSL-2.0-only server, then it must send its ClientHello in the SSL-2.0 format, and this prevents the use of any extension.

Note that SNI support involves both client and server (the client must send the extension, the server must understand it). Old clients may not know about SNI (a notable example being Internet Explorer when running on Windows XP). A client that requires using SSL-2.0 or SSL-3.0, but does not support TLS-1.0, must be quite old (more than 15 years) and is unlikely to be aware of the existence of SNI. TLS-1.0 was published in January 1999 while SNI was first formally published in June 2003.

In any case, you should not use either SSL-2.0 or SSL-3.0, both of which having irremediable security issues. There is even a standard that prohibits using SSL-2.0. It can be argued that a Web browser that does not know SNI or TLS-1.0 is a browser that has not been updated for many years, and therefore must include a huge number of known vulnerabilities, and is probably already host to a handful of malware and part of one or several botnets. In that view, the only sane behaviour of a Web server that receives a connection request limited to SSL-3.0 (or lower) is to reject it unconditionally. It may be contagious.


Hash for secure file downloads? Is there any hash structure that can be used for secure download of a file and validation of its contents?

Looks like all hashes like MD5 are made for consistency check and are vulnerable to hash extension attack, so it is possible to create another file with the same MD5 by just appending to the end of it.

I am writing an automated service that downloads data over insecure channels and I want to make sure that MITM can not alter file.

UPDATE: Hash is transferred to the user through secure channel. Right now I am using hash + filesize combination, to avoid hash extension attacks. Is it possible to use just single hash function?

UPDATE 2: I misunderstood what a length extension attack is. Quoting @CodeInChaos:

  It does not give you a collision, it merely allows you to compute the hash of a longer file given the hash of a shorter file whose contents you don't know

So it is not possible to just append to file with existing hash to get the same hash. Doing this will mean looking for collisions in a longer file, so the question boils down to classic "how strong is the hash function". On the other hand, it is still interesting why SHA3 is not vulnerable to hash extension, but that's another topic.

Modern hashes like SHA-256 provide a strong protection against hash collision attacks, that is it is practically impossible to create a different program which has the same hash as the original program - no matter if the size is the same or differs.

This still leaves the possibility that the attacker not only modifies the file but also the accompanying hash, which means you have to find a way to transfer the hash in a secure way to the user.


Sniffing the data around me Scenario:
no router, just a laptop network card turned in monitor mode.
(imagine you are in the bus or train)

In this scenario can I see all the data that is going through air around me?

Can I capture this data?

Can I get some relevant info out of this data? (e.g. source and destination of the packets)

EDIT:

Can I sniff the traffic of other networks (other routers around me, and smarthphones) and get some relevant info?

what can I see? I should at least see the source and destination IP, but can I get some info our of this packets or the packets are totally encrypted?

This scenario is monitor mode? promiscuous would be when I am actually connected to the network I am sniffing? or do I miss something?

This questions is way too broad, try to be more specific, but YES.

If you put a wireless NIC in monitor mode it will capture everything within it's range (This depends on the antenna type, gain, position, etc.), from smartphones, tablets, AP, laptops, etc.

Now about all your questions you can do whatever you want to, but it is likely that most data will be encrypted, hence you won't be able to make much use of it.

Be warned that this may be illegal in different countries.

Related Topics:

Wardriving
Warchalking
Piggybacking


Is there a security risk in using pointers instead of struct instances? Recently during a code review, a senior developer asked me to replace a pointer with structure instance in a utility method. He asked me to do so for security purpose.
One reason that I could think of was that structure instances would get cleaned up thanks to instruction stack but pointer value would not.
Is there any other reason? Wouldn't an attacker be unable to access my memory in any of the two cases?

EDIT:
Adding the code snippet:

static void make_digest( const EVP_MD *md, char *header, char *message,unsigned char *digest)
{
   EVP_MD_CTX *mdctx;
   unsigned int digest_len = 0;

   EVP_MD_CTX_init(mdctx);
   EVP_DigestInit_ex(mdctx, md, NULL);
   EVP_DigestUpdate(mdctx, header, strlen( header ));
   EVP_DigestUpdate(mdctx, message, 32);
   EVP_DigestFinal_ex(mdctx, digest, &digest_len);
   EVP_MD_CTX_cleanup(mdctx);
   return;
}

I don't know the specifics of the routine you were asked to amend, but I can tell you the following.

When you allocate memory on the heap, even if you correctly de-allocate it, there is no guarantee that the contents of that memory is erased after you're done with it.

On the stack it's the same deal - however because of the way the stack works - that memory is more likely to be overwritten in short-order (heck, the next function might overwrite it).  With memory allocated on the heap, the time for it to be over-written is indeterminable from your perspective as a programmer.

So to answer your question - an attacker might be able to read the memory in both instances - but during the course of running your program, the stack is potentially going to be overwritten immediately, whereas the data in your heap allocation would be much easier to find long after your program deallocated it.


Send new password by email is bad practice but what to do if user forgot his password? According to http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in it's bad so what to do ?

Just ask him to set a new one ?

Check out the question/answers to the StackExchange question What type of Password Reset/Forgot Password (verification) mechanism would you recommend. It analyzes the two major methods: "Secret question" and "Reset email".

If you'd like to review an in-depth analysis of weaknesses to various methods/implementations (written by Ron "iagox86" Bowes):

Hacking Crappy Password Resets Part 1
Hacking Crappy Password Resets Part 2
(Mostly) Good Password resets

Now for an aside regarding password hashing. If you are able to send cleartext passwords, you are doing it wrong from the very start. And by this I mean you are storing cleartext without employing password hashing. Please read about why passwords should be hashed. There is no need to sit around thinking about whether or not it's appropriate to send user's their password: it should not be possible to do so.


How to decrypt a ciphertext encrypted in AES CTR mode if you are given ciphertext, plaintext, and key? Question is the title. To give a bit more information, the same key is used for all ciphertexts and I know ciphertexts C1 and C2 and plaintext P1, which corresponds with C1. The incrementing method for each Ei is also known. I want to find P2.
I can't seem to find an answer since the IV is not known. The first step I took was to do C1 ^ P1 (^ = XOR/direct sum) to get E(K, IV). If I can somehow extract the IV from that then I would be good to go, since I know that C2 ^ E(K, IV) = P2. But I can't find what they used to encrypt K and IV nor can I find it's inverse. If someone knows of a link explaining the process to get IV or the algorithm to encrypt that, please let me know! I've spent a couple hours thinking about this but I can't seem to get it.

To recover the lost IV in the given situation, you can make use of the fact that ECB mode (electronic code book) does not use an IV.
Below is a bash/openssl session that illustrates the procedure.
After creating the two plain text files P1 and P2 we create the two cipher text files C1 and C2 using CTR mode.
Then, simulating a situation where both IV and P2 are unknown, we xor C1 and P1, and use the first block of the result (X1) for the decryption using ECB mode, which works without IV. In the result however, we can discover the IV with which P1 has been encrypted (scroll all the way to the right to see the (padded) IV):
~/$ echo -n "The quick brown fox jumped over ..." >P1
~/$ echo -n "... the lazy dog." >P2
~/$ cat P1 | openssl enc -e -aes-128-ctr -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -iv DEADBEEFDEADBEEF >C1
hex string is too short, padding with zero bytes to length
~/$ cat P2 | openssl enc -e -aes-128-ctr -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -iv DEADBEEFDEADBEEF >C2
hex string is too short, padding with zero bytes to length
~/$ ./xor.sh `<P1 bin2hex` `<C1 bin2hex` | hex2bin >X1
~/$ head -c 32 X1 | openssl enc -d -aes-128-ecb -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -p | bin2hex
73616C743D433037343038434344333535303030300A6B65793D41414141414141414141414141414141414141414141414141414141414141410ADEADBEEFDEADBEEF0000000000000000DEADBEEFDEADBEEF00000000000000

Now, as we know the IV, we can use it to decrypt C2 and get P2, using CTR mode as usual:
~/$ cat C2 | openssl enc -d -aes-128-ctr -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -iv DEADBEEFDEADBEEF
hex string is too short, padding with zero bytes to length
... the lazy dog.


CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS? I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in Firefox, when I click on the test.html file for viewing, I'm prompted the "Open in/Save as" box and I click "Open in Firefox", which opens the file in another tab but the address is file:///tmp/mozilla__0/test.html.
The file is downloaded to and open in a local file://, but the process is still initiated by example.com Can this still be used for XSS, or is it nullified by the fact that the XSS payload is now in a separate local file?

The file is downloaded to and open in a local file://, but the process
is still initiated by example.com Can this still be used for XSS, or
is it nullified by the fact that the XSS payload is now in a separate
local file?

No,the XSS payload wont work that way.
also in CVE-2019-14748 the step to reproduce is from within the osticket portal itself.

Login with another user(agent)
Now within the User Directory, go to the user under which the payload has been put.
The ticket raised with the name mentioned will be shown under the subject category.
Scroll down and the file uploaded will be present below.
Click on the file, and the payload gets executed which is persistent


Does it make sense to implement OAuth when no 3rd party is involved I own a REST API at server side and a distinct web application that would call those APIs.

I want to secure my APIs calls.

After some reading, I want to implement the OAuth 1.0a mechanism at server side.
Indeed, dealing with temporary tokens, nonces etc.. is by far more secure than a traditional HTTP basic solution that depend strongly on the SSL encryption.

However, in most of examples I found on the web, OAuth seems to be by essence a means to access some data from a resource owner (like Facebook, Twitter etc...) without the need for the user to transmit its corresponding credentials to my own app.

My question is:
Does it make sense to implement OAuth if my actors are just my own web application and my own set of API's at server side, (meaning no external data provided by a 3rd party are involved)?             Indeed, I really want to benefit of its algorithm.

While it isn't necessary to have the complexity of OAuth when authenticating against your own system (because you can share your actual user account data) if you want to provide that level of isolation to the user server, then using OAuth does still afford you advantages.  At that point you would simply be implementing a stand alone OAuth provider which your various services could use as a single sign on across your system.

You could also then allow users to use their profile as a single sign on for other services if you so desired by making the OAuth account usable by other sites.


Security better between WPA/WPA2 and AP Login Webpage I silly wonder if we can stand outside and sniff password login webpage in protocol HTTPS or not? And attacker can brute force the WPA or WPA2 but if they change  AP:set non-password and redirect client when click SSID, use a defaut webpage to login Acess Point with database stored all user enter or supply user the username and password.They can brute-force WPA/WPA2 password but I wonder if attack can crack password on web login with protocol HTTPS and firewall or S.A blocking brute force attack,prevent automatic login by captcha.

So what is better security with router wireless configuration?

Your question isn't the easiest to understand, but I take it you're concerned about the security of the router admin pages on your device. There are ways of compromising the security of HTTPS connections, such as performing MITM attacks (made much easier by manufacturer's tendencies to use self-signed certificates).

However, this is rarely the easiest way of getting in. Recently Netgear, one of the largest router manufacturers, revealed a serious security weakness in the software of some of its products, that can be exploited without even being connected to the network in question. Essentially the attack revolves around a piece of software running on the router that does not correctly verify its input (your credentials/the action). You can read about that here: http://www.computerworld.com/article/3149555/security/an-unpatched-vulnerability-exposes-netgear-routers-to-hacking.html

If you're dead-serious about protecting it, then the best way of doing this is to turn off the web interface. Failing that the next best thing to do is to use network segregation to control from where on your network the configuration  services can be accessed. I do this with a Cisco access point; the wireless users join a different VLAN than the configuration service, and the router refuses to route between the management VLAN and the wireless VLAN, thus preventing them from getting at the configuration portal without using some form of jump-box. This, however, is not a feature available on most consumer-grade routers that I have encountered.


Detect if another Process reads my Programm's memory Hypothetical Scenario: I have written a programm which runs on my machine. An attacker wants to read (not write) security-critical information from my programms memory.
To achieve this, he hacked my machine, installed a programm hisself plus a kernel-driver to hide his programms process and activity.

Is it possible for me to modify my programm in the way that it (just) detects this attempt? To mark keys or whatever as possbily compromised?
I am not asking for programming details.

Simple answer: No.

But why? I don't know of any common OS that separates processes enough to reliably prevent or detect reading memory. In Windows, you are especially lost, unless you run in administrator mode, in which case non-privileged processes should only be able to get some limited information about you (unless it runs in privileged mode too). I can also simply freeze your "extremely secure" application, read all it's data and then simply kill it.

When attacker has a driver on it's side, you are especially lost, since now attacker is on ring0 and can essentially do anything to your system.

Would another application help? No. Nothing will help, because it's essentially playing game of "I detect X" "so i move to Y, X wont help you". If attacker knows how your application works (and this applies to any program you release), then he can think of yet another method to bypass all it's security. This is essentially what happens in online gaming, in virus development and in software cracking for years. And even multimilion companies weren't able to solve this problem.

Only help would be getting level lower than attacker is. In your case that's hardware.


MCC records in JPEG2000 I was looking at some image vulnerabilities and came across the fairly new openjpeg vulnerability in JPEG2000 images. It says that: "out of bounds memory can be accessed due to an error in mcc records parsing".

I wanted to play around with this a bit, but I cannot find anything about what mcc records are. I am assuming this is metadata information, but I cannot find what exactly I can play with here (what name it has to be and what possible values etc.). I have downloaded "JP2 Meta Editor" so I should be able to edit any metadata.

Can someone point me in the right direction about this?

EDIT: On the github page of OpenJPEG they also keep track of all the bug work and have some POC files they used to fix the problem. Using these anyone can do research on the vulnerability.

You need to read the Talos blog about the vulnerability and the source code.

mcc is an internal reference to Multiple Component Collection (line 1040).

A Multiple Component Transformation is a colour transform for images in JPEG2000.

This is not something you can edit in metadata. It's about how you craft the image itself to create an index reference error when it tries to process the colours.

Please make sure you read the CVEs for the vulnerabilities that you come across, and read the source code and bug reports so that you can understand the context for the issues.


CERT FOE Fuzzing Framework documentation So I read another post here about fuzzing local standalone applications. I have understood how to exploit basic buffer overflow vulnerabilities in standalone applications and am now looking on how to find such vulnerabilities.

I downloaded the CERT FOE framework, but found very little documentation on it. In fact, the only thing I found was one video on YouTube.

Could someone provide sources of documentation/videos for the CERT FOE fuzzing framework?

Lets not shave a yak. It sounds as though you want to understand and get into fuzzing.

Sulley and Peach are fuzzers that have extensive capabilities that should help you. Also, writing your own fuzzer should help understanding the actual fuzzing process.

Here is a resource for a bunch of different fuzzers.

Ultimately, common sense aids in the fuzzing process. If the binary accepts files (and you're fuzzing file formats) on linux, having your testcases generated on the fly on a ramdisk helps. On windows you need specialized ramdisk software, of which SoftPerfect Ramdisk looks the be the most efficient. Ramdisks minimize disk I/O, so it speeds up fuzzing and lessens the wear&tear to your HDD.

Also, you need to take into account what the specification says, then disregard it with the utmost abandon! 010Editor helps as it is a hexeditor that has can parse known file formats.

For instance, you need to take into account your platform's integer limits, whether windows or linux. Also, most source code has its own defined integer limits, so where does it differ from the platform (u)int limits? Also, some software parses strings. Does it accept null bytes? In which situations? If you're black-box fuzzing (no source available) what happens if you pass a (u)int that is equal to the platform limits defined?

If you start fuzzing from scratch (like I did) you'll be that much closer to more effectively finding bugs than your peers.

Good luck