Using JTR to crack Skype Passwords The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any credits so he can't use a CC to verify his account to customer service.

I know that Skype should have a saved AES-256 and SHA1 encrypted version of the MD5 hash of his password, and he thinks that it should not be a complex password (i.e. rockyou with some rules applied should be able to beat it).

He is on a Windows machine and sent me the config.xml file, which I read online contains the encrypted hash. How do I extract the MD5 from the config.xml file? I've tried some simple "john config.xml" kind of efforts, but I assume that because it's AES-256/SHA1 over an MD5 it can't be that simple. How do I go about getting to the MD5?

First off, I'd consider calling support:
https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password

Secondly, a recovery process has been outlined here: http://insecurety.net/?p=427

It is NOT as simple as running JTR on the conf.xml file ....


Volatility.exe suggests two profiles for XP memory dump. Which one should I use? Volatility suggests two profiles for XP memory dump. Which one should I use for further investigation? I am a beginner for the volatility.

You should try both!

If memory addresses and PID's appear with question marks around them, you should probably switch to the other profile.

The problem is volatility can recognize that it's a certain Windows XP release, but the identifiable properties of these 2 XP Versions overlap, and make them harder to distinguish.

When executing plugins such as connscan or proclist, the results might be a bit obscure when using the wrong profile, because the actual locations in memory of these objects might differ between the XP Versions.

You'll notice pretty fast if you're using the wrong profile.


Applying "principle of least privilege" when it comes to execs and owners of the company - should they automatically get all permissions if requested? As an administrator of certain systems in a company I understand and adhere to the "principle of least privilege" -- which I'm assuming I don't need to repeat its definition here, so let's just say people here get given access to systems only in accordance with what they need for their role and no more. I follow that principle and check carefully whether they can have read-only access in order to carry out the role and if so I give read access only, etc.

I had a request from an executive-level (C-suite) person ("Jack", let's say) who is actually one of the five co-owners of the company, to get blanket "sysadmin" level access to a particular system. (I am confident the request has come from Jack himself and isn't a hacking or phishing attempt, as I verified it with Jack directly.)

Jack is far too important and involved with strategic stuff to need to carry out any day-to-day work with this system, especially anything that would need sysadmin level access, but occasionally wants to get involved in "poking around" in there, as he is technical by background.

I get the sense that he doesn't like the idea that he is "walled off" from some system although he owns part of the company.

I'm not asking about the interpersonal aspects about this, just the info-sec ones.

Is it accepted info-sec practice to give an owner of the company "sysadmin" access and by doing bypass the "principle of least privilege"? -- since, after all, Jack (partly) owns the company so it's all his stuff anyway!

Or should that still apply, and even the CEO shouldn't have write-access to a system when they don't need it as part of their job function?

InfoSec Answer
Do not give his normal account elevated access. Create a new account. This limits the risks of cross-system access. And this follows the standard of admin accounts not being the normal user accounts.
IT Answer
Jack is now the owner of the system with all the rights and responsibilities that accompany that. Make sure that is clear. You can't have "the boss" make changes that override what the rest of the IT team are trying to do. Jack also needs to comply with your change management processes, etc. just as any system owner would.
Business Answer
Being the boss does not excuse anyone from the policies and procedures put in place to protect the business. This is true in IT, Finance, and every other business function. And you might need to have this uncomfortable discussion with him.


SS7 exploit on the wiretapping part Wondering if there are info/source code/guide on the SS7 wiretapping part (SMS interception). I had a look on the  track any mobile by a German researcher, and on PTsecurity about how the structure works, understood how the location tracking part works.
I read that the script can be written for Linux based machine. Wondering if there was any further in-depth info on this.

The intruder doesn't need sophisticated equipment. We used a common computer with OS Linux and SDK for generating SS7 packets, which is publicly available on the web.
Upon performing one attack using SS7 commands, the intruder is able to perform the rest attacks by using the same methods. For instance, if the intruder managed to determine a subscriber's location, only one step left for SMS interception, transfer of funds etc.

For a great introduction to the topic of SS7/MAP security (especially SMS Interception), Insinuator has great coverage of the ULIN story, as well as a links to:

The Tobias Engel prezo from CCC that covers competitors to the ULIN as well as mentioning that a Linux server would need SS7 Network access as well as SCCP roaming on the target network(s)
A link to a SANS paper detailing service-provider countermeasures
Discussion of potential intrusion-detect systems for subscribers based on the CryptoPhone

PTSecurty published a paper which mentions a lot of the required elements to perform SMS interception -- https://www.ptsecurity.com/upload/ptcom/SS7-VULNERABILITY-2016-eng.pdf

Using the following 4 resources, I was able to ascertain exactly how all of the elements you described function:

The SS7 Vulnerabilities eBook, available via direct link here -- [PDF] http://www.cellusys.com/?dl_id=14 [PDF]
A book, Mobile Cellular Communication, which covers many of the messages in the section Common channel signalling
The section on SMSC interaction with the VLR in the book, IP Design for Mobile Networks
Chapter 13 on GSM and ANSI-41 Mobile Application Part (MAP) in the book, Signaling System No. 7 (SS7/C7): Protocol, Architecture, and Services -- particularly the discussions around sendRoutingInfoForSM and updateLocation messages


Can Cryptolocker (Or Other Ransomware) Encrypt Files That Are Already Encrypted? If you have already encrypted files, are they still vulnerable to being encrypted a second time by a program like Cryptolocker, or would this protect them?

Yes they are still vulnerable. Encryption just transforms a sequence of bits into another sequence of bits (and assuming the encryption is good it will be computationally infeasible to reverse this process without knowledge of some secret). There's no reason why encryption can't be performed again on an already encrypted sequence of bits.

It's possible certain ransomware implementations might look for specific files that are likely to be of high value, and encrypting these files might make them more difficult to recognise. However, I would not depend on this as my primary control against the threat of ransomware.


If I install a certificate for the purposes of logging into a Wifi connection, is it still safe? There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time (i.e. from the companies official website, using SSL, which you are supposed to have accessed & downloaded ahead-of-time).

Now, assuming I followed their instructions and installed this cert (I can't seem to find a good example, it seems many use an exe tool instead that installs the certs into the system), I can log into their HTTPS captive portal and gain internet access - but would it be secure? how can I know that they aren't using the cert that they asked me to install to snoop on all HTTPS traffic? (aside from manually checking the certs for each website)? can I limit what domains their cert is valid for?

P.S. - it may be possible to access the page without the cert, after ignoring the big red text displayed by a browser, but then the risk is transferred to avoiding spoof networks by manually inspecting.. the same cert - question is more aimed at the vulnerability of those less tech savvy who simply follow the instructions as-is.

Most large networks will use a firewall or proxy to perform web content filtering. HTTPS pages can cause issues as the data on the page is encrypted. So I would assme that the pages that give you a red error are HTTPS pages. The reason for this is because the firewall acts as the client and decrypts the page to check it for viruses and against the network policy and then serves you the page under its own self signed certificate.

A large University should be safe however it is up to you as they are effectly decrypting the data so they could read your passwords and data etc. However there are laws to prevent this.


Android apps: required permissions reported before installing are misleading I've noticed several Android apps that advertise different permission requirements than they actually get after they are installed. I'm on Android 5.0.2.

To be more specific:

I locate an app through Google Play and I click the INSTALL button to get a look at the required permissions.
The system shows a pop-up to report that "[app name] does not require any special permissions."
After installing the app, through Settings --> Applications --> Application Manager, I locate the newly-installed app in the list, click on it, and the permissions listed are: "full network access" (among others).

Does anyone know why users are misled in this manner?

In Android, permissions are categorized into 2 categories:

Normal permissions: Very little risk to user's privacy (like access to internet)
Dangerous permissions: High risk to user's privacy (like reading and modifying contacts)

Normal permissions are allowed at install time, and they won't be asked.

If there are any dangerous permissions, then you will be presented with a pop-up stating the dangerous permissions, and allow you to make a call whether to go ahead with the installation or not.

In your case, access to internet comes under normal permissions, hence there was no confirmation before installation.

For a list of all normal permissions:

https://developer.android.com/guide/topics/security/normal-permissions.html

EDIT: Even if you upgrade to Android Marshmallow(6.0), which follows a different permission model, and allows the users to revoke specific permissions, you won't be allowed to revoke normal permissions. Revocation of dangerous permissions only is allowed.


does computing hash takes metadata into account? I am currently trying to create a scan system, which identifies files that have been modified since the previous scan.

It will work on some directories/files and identify the content which have been changed.

I am planning to use Hashing as a mechanism to find modification in files/folders.

Hash functions tend to work on content of the file/folder for computation of its hash. But i am not quite sure about it. Since some modified hashing algorithms also take into account the metadata of the file while computing its hash.

So I just want to know that does hashing takes into account the content of the file only, or even its metadata?

And is my way of identifying changes in file good enough, or there exists an improvement too?

Hash algorithms have no idea of files or meta data, they just work on bits and bytes. This means you can write a program which only works on the files content, a program which takes also meta data into account, a program which ignores every other byte of the files content ... - it all depends on which bytes you feed into the hash function. Common command line utilities like md5sum just work on the bytes of the content and don't care about meta data.


Is it possible to revert a steganographic process to reconstruct the original image? Using, say, outguess, it is possible to hide a secret message inside a JPEG image (LSB method).

Is it possible to undo the steganographic process given the modified image to reconstruct the original one? I want to obtain the same bits of the original image.

Not under normal circumstances.   They have been changed.

Your question does not state whether or not the message is known.  Any information like that can assist in the detective work that would help make any progress along these lines.

There is another possibility of having more information:   For instance, Playboy.com places digital watermarks inside their images.  So given a raw watermark and the steganos message, it is theoretically possible to reconstruct what was changed.

Of course, visually it will not matter.  That is the beauty of steganography.  If there are billions of possible colors and your eyes can really only tell the difference between 50-100,000 of them, then using those low-order bits is visually undetectable.

Where it gets complicated is if you use Steganos to put a message inside an image that already had another, the first one gets lost.


How does mitmf-filepwn implement dns-spoofing? While running the following command in Kali mitmf -i eth0 --arp --spoof --gateway 192.168.1.1 --target 192.168.1.4 --filepwn i have noticed that in latest chrome, when i typed google.gr the result was an http version of google. (Although that did not work in Facebook or Linked in websites opened by victim). How does filepwn implement the above feature?

Google.com (and all other country versions like google.gr) do opportunistic HSTS (see this answer for more details). It is an interesting question though, why they would stop enforcing https from their chrome browsers (as it used to be like that in the past).

Facebook does strict HSTS, which is why you will 'never' be able to force the client into http mode for Facebook. AFAIK, Linkedin does not use HSTS, so something else must have gone wrong there.


How I can hide from my ISP that I have created a hotspot? I am using manjaro Linux, And create a Hotspot with create_ap script
I spoof my mobile and laptop to have the same MAC address

What can I do so they can not detect I am using my mobile connected to my laptop with a Hotspot?

It is not easy or depending on your usage pattern it might even be impossible to fully hide the use of multiple devices on a single ISP connection. It also depends on the effort an ISP is making to detect such "abuse" and on its willingness to fight such abuse even if he is not 100% sure since detections might result in false positives.

The usual way to have multiple devices on a single link is to use NAT. But this can be detected by the ISP because of differences on the devices TCP/IP stacks which allow passive OS fingerprinting. Additional changes are done to the packets by the NAT itself, like decreasing the TTL and maybe changing the source port. See Detecting NAT Devices using sFlow and A Technique for Counting NATted Hosts for some more information. And there are actually DPI libraries used by ISP which offer the capability to detect the use of NAT and the number of devices behind it.

Using a proxy (e.g. HTTP proxy like squid) instead of doing NAT hides these differences since all TCP/IP connections now originate from the same system. Still, unusual usage pattern like a User-Agent header in the browser which does not match the detected OS or different User-Agent headers from the same system might give the ISP a clue that multiple devices (or browsers) are involved. While the User-Agent header could be set to some fixed value inside a proxy there or other methods for detection, like having multiple cookies for the same site or having multiple fingerprints for the TLS stack.


Where to place a vulnerability scanner within a data center There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center.

I see two options:

Place the virtual appliance in a secured VLAN, open ip any from the appliance to all IP addresses in the DC so we can ensure all UDP and TCP can be scanned.
Give the virtual appliance a virtual interface for each VLAN in the data center

I like the second option, as I do not have to traverse a firewall, as I know that firewalls can sometimes mess with vulnerability scanner.  However, is there any reason why the first option would not work?  Our network team is leaning towards it and I want to make sure that would be acceptable.

Edit: This scan is internal, only to production systems in our data center.

The question is which "view" you want on the network from the vulnerability scanner's Point of view.

If you want to include the firewall security in your vulnerability assessment, you should Place the scanner with no access to internet, but on "WAN" side of security boundary in the firewall.
Thus, your vulnerability scanner would then alert you if you accidentally misconfigure your firewall to expose a vulnerability on the internet.
Thus, all your servers and firewall will simply consider your vulnerability scanner as something coming from the internet. Blocking internet access at all for the vulnerability scanner (in both directions) is important so not your vulnerability scanner gets hacked and taken over to perform vulnerability Scans on hosts not belongning to your network.

Another view is for example if you simply want a assessment that Everything is so securely setup that you can completely remove the firewall from the equation, then you put the vulnerability scanner on the inside, on the LAN side.

A third use of a vulnerability scanner is for example bridging it with a wireless access Point, so you get a view of the network as of the hacker would connect with a wireless client.

So theres no correct answer on your question. Depending on what you want to see, you should let the vulnerability scanner either traverse the firewall (without any exceptions) or the vulnerability scanner should have full access.

A vulnerability scanner is a measurement tool, and you Place it of course where you want to measure the security. If I want to know the outside temp, I put the termometer on the outside. If I want to know the inside temp, I put the termometer on the inside. Here the isolation in the wall could be the "firewall".

Same here with your vulnerability scanner. To put it short - Place it logically in your network exactly where you want to measure the security.


What's the idea of two factor authentication? A hacker can use password with mobile 2-factor authentication means to enter MOBILE app (using username and password) and there you get code to enter your account from PC browser, right?

But if hacker has my password, then he can enter in the mobile app without 2-step login?

2FA means to have to two factors for authentication, preferable one is a physical factor ("know" and "have"). The idea is that this way it is not enough to get the password due to hacking, data leakage, phishing etc but that the attacker must additionally have access to the physical device.

There are lots of physical devices usable with 2FA like security tokens, smart cards (for example the "chip" in "chip and pin") or mobile phones. While security tokens or smart cards usually need to be bought explicitly for this purpose mobile phones often already exist and can be used as a second factor simply by adding some app to it.

Properly done the attacker can not simply use it's own mobile with you username and password but needs to have access to your pre-authorized phone - i.e. does not need only access to your password ("know") but also to your phone ("have").

Unfortunately this "have" can also be a remote access if the mobile phone was hacked. More limited 2FA devices like smart cards or security tokens are more safe in this regard but more costly too. Thus mobile phones established as a  good enough 2FA method when better security than just a password is needed but dedicated and more secure 2FA devices are too costly.


Secret, Public, and Private Keys? ...and nonces.  Can someone show an example of how this actually works using small intelligible numbers?  For example:

secret key: "100"
public key: "10"
private key: "1000"

I am just trying to better understand the concept of "signing" and how public keys are generated and what/how private keys are generated.

Is this possible to do without going in to some mind twisting mathematics?

Confusing question, but I'll take a stab...

'Secret Keys' are used in symmetric encryption, meaning the sender and receiver have the same key that is used to turn text into a cypher AND to turn the cypher back into text on the other end.  AES is a 'symmetric' algorithm.
'Public Keys' are coupled with a private key to do asymmetric encryption, meaning the receivers public key is used by the sender to turn text into a cypher, but decryption on the receiving end requires the receivers private key.  RSA is a asymmetric algorithm.

Often asymmetric algorithms are used to initialize a connection and to exchange secret keys to do symmetric encryption from that point forward due to performance.  Such is the case with https.

'Signing' refers to Public Key Infrastructure (PKI) where certificate authorities provide some level of assurance that a website is who they say they are.  Only related to public/private/secret keys in that they 'sign' the web providers SSL/TLS certificates.


Can I protect against keylogging by using the mouse? Can I protect against keylogging by using the mouse? For example, to enter the password hunter2, I might do the following:

type ttter2
select the first tt and press ← Backspace
type hun

To a keylogger, it would like like I typed tt← Backspaceter2hun, or ttterhun. Would this provide adequate protection, or are keyloggers able to follow mouse gestures, clicking, selecting etc., so they would catch password still?

A lot of keyloggers are smart enough to catch this. Not only do they log the keys being physically pressed, but they also log the contents of password boxes whenever window messages are processed, or when browser forms are posted. They also often capture small blocks of the screen around the mouse cursor, to catch cases like this.


Prevent change of document.location, when injecting the document.location JavaScript command I found a reflected XSS in an application during a test, where I define the string passed to:

<script language='JavaScript'>
document.location='/this-is-my-input'
</script>

Some input sanitisation occurs, for instance my string is only recorded after the first /. So I've managed to escape the document.location command by URL encoding /'//\nalert(1), which runs the alert(1), but immediately redirects me to the root / of the webapp.

Is there anything I can do to prevent the change of the document location?

edit: With the above mentioned user input, the code looks as follows:

<script language='JavaScript'>
document.location='/'//
alert(1)//'
</script>

Use hashfragments.

/'.replace(/^.*$/, document.location+"#") leads to document.location='/'.replace(/^.*$/, document.location+"#") which basically takes the current URL, and put a hash fragment after it. It won't reload the page since hashfragments doesn't do so on broswers.

Put whatever you want afterward like a ;alert(1).

Since the original code contains a ' (ie document.location='/'), then don't forget to discard it, using a comment (// or /*), or by leaving your last String value unclosed (ie write var x='My String and let the original ' close the string). Otherwise, it may raise a parse error and Javascript won't be executed at all.


WEP man in the middle my workplace is currently using a wireless router that is secured using WEP. If I connect a laptop to the wireless router with a cable, would someone that has cracked the password still be able to create a man-in-the-middle attack with the laptop? Or just with people that connect wirelessly?

Thanks

Anyone connected to the network, via wireless or wired, could use ARP spoofing or DNS hijacking to perform a man-in-the-middle attack against legitimate connections over the network.

I should point out that WEP provides security only against casual attackers. Freely available tools can crack the key using deauth and ARP injection in under a minute. I would highly suggest moving to WPA2 for your network, as WPA and WEP are considered broken.

You could also consider an enterprise option such as RADIUS for network authentication, as that provides additional security against password cracking, and integration with other user management platforms (e.g. active directory) within your environment.


Can suPHP lead to security issues due to hijacking people's accounts? Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on suPHP. I am assuming you use it exactly like PHP and it magically knows to run all scripts as the owner of that script.

I am creating a dynamic website which lets users upload scripts and execute them. Right now this is limited to javascript but I want to also allow them to execute serverside PHP scripts. As the default Apache user is www-data, I want to use suPHP. My idea is to create an intermediate script, lets call it load.php,  which takes as an argument the user's target script, lets call it target.php. load.php then checks to see if the user owns target.php, and if they do, launches target.php.

But then what's to stop the user from within target.php issuing a command like (I am not sure if this example is accurate as I can't find any documentation on suPHP).

shell_exec("suphp /home/someOtherUser/test.php");

Does suPHP need a user's password to execute these scripts?

Janne Pikkarainen pointed out that suPHP starts as root, then switches to the owner of a file before executing it. So now I have two questions.

If the PHP script that's executed by suPHP (as the owner, lets call him user1) in turn contains shell_exec("php /home/user2/test.php");, will this return an error since user1 is trying to launch user2's script, or will suPHP kick in again and change from user1 to user2.
what's to stop user1 from executing javascript/HTML code such as <form action="/home/user2/test.php" method="get">?

(In Darth Vader's voice): NOOOOOOOOOOOOOOOOOOOOOOO

That's not the way you use or configure suPHP. Even if you somehow manage to get it run that way, it is more dangerous than useful.

suPHP is supposed to be configured at Apache (or whatever your webserver is) level. The idea is to make Apache run suPHP instead of regular mod_php.

How suPHP actually figures out under what account to run the script as is not magic; it simply sees that from the file owner. At beginning suPHP runs as root, and before running the script it just changes the user to be the one owning the file, dropping the root privileges.

EDIT after your own edit: No. Let me explain this one more time. You cannot and should not even attempt to run suPHP via PHP's shell_exec. That's not its idea. Not at all.

suPHP belongs to Apache configuration file httpd.conf, not in individual PHP scripts. There is no exception about that.

Here's suPHP configuration documentation for you.


Context-dependent attacker In the context of the following statement what is meant by context-dependent attacker?

  The MySQL Client contains an overflow condition in client/mysql.cc. The issue is triggered as user-supplied input is not properly validated when handling server versions. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

Thank you!

I agree that this isn't the best wording. Essentially, it means that there are unusual circumstances in order to exploit this. In the specific case of this bug, you have to get the user to connect to a malicious server under your control, or Man-in-the-Middle a connection to a legitimate server.

The vulnerability is a simple stack overflow on the version string which the server replies with. The client expects that the server will only reply with strings shorter than a fixed size, and then copies the entire string into a fixed-length buffer. If the string turns out to be larger than the buffer, it copies over the end, corrupting the stack.


WPS and WPA2 connection methods Do clients use WPS every time when they connect to a WPS-enabled AP?
Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange?

If the latter, it's possible for an AP to force a client to use WPS every time?

WPS would generally only be used for the initial connection because the wireless network settings (pass-phrase/SSID) are saved on the connecting device. I don't know if it is possible to "force" clients to connect every time with WPS. If it is...I would not recommend it. WPS is insecure. A quick search for "WPS Hack" on a search engine will provide you with further information. Generally it is recommended that the WPS feature should be disabled.


How Does A Random Salt Work? I don't understand how using a random salt for hashing passwords can work.  Perhaps random salt refers to something other than hashing passwords?  Here is my thought process:

The salt is used to add extra junk to the end of a password prior to hashing it, to fight against the likelihood of being cracked by a rainbow table
However to ensure you can still verify a password is correct, you must use the same salt for each password prior to encrypting it to see if it matches the hash saved for a certain user
If a random salt is used, how can that password ever be verified again?  Is the random salt saved somewhere to be used for each encryption?  Seems less secure to me if the salt is saved right alongside the hashed password, rather than using some kind of computed salt an attacker would not inherently know if they got a hold of your data.

I'm not sure if I'm missing something here, or if random salting has to do with a different scenario in encryption, and doesn't make sense in this particular case.  How can a random salt work in the above case of hashing passwords prior to encrypting?

Is the random salt saved somewhere to be used for each encryption?

Yes

  Seems less secure to me if the salt is saved right alongside the hashed password, rather than using some kind of computed salt an attacker would not inherently know if they got a hold of your data.

It's not, because the only thing a salt does and was invented to do is, as you said:

  to fight against the likelyhood of being cracked by a rainbow table

and nothing more. It adds complexity to a single password - and for every password in a database, it is unique. To verify the password, you need to store it alongside it. This doesn't compromise the security of that single password in the least bit - the hash algorithm is still as secure as without a salt.

But, looking at the whole database, every password is better protected against rainbow attacks, because the attacker must calculate very single hash with the respective salt separately and cannot do bulk operations on them.


can this be canceled Limi1.com put up a malware alert on my computer, with an accompaining number to call. it stated for 29.97 it would be fixed. this was last night today I called my credit card, and was told a charge of $549.99 had been charged to my credit card from them. My question is ,I think you have 3 days to cancel any such charges. I did notify my credit card of this and asked them to check my paypal account. It was charged 3 times for 29.97.So tomorrow I will be calling both again credit and paypal, and will try the number for this company as well. I will tell them I want to cancel this year of service, which in the beginning was 29.97. I will see what takes place.

I hate to say it, but it sounds like you got tricked. It's a common scam for a pop-up to claim you have malware or viruses and "offer" you a to fix it for some fee. In reality you are usually paying for the privilege of giving hackers full control over your computer (if you installed software for them, that is).
Second, limi1.com doesn't appear to have anything on it, at least nothing that makes it past my script blockers (and I'm not willing to turn them off to check). That's not a good sign. A whois on limi1.com shows:

Registrant Name: Oliver Hoger
Registrant Organization: Virtual Real Estate Limited
Registrant Street: Suite 4, 4 Giros Passage
Registrant City: Gibraltar
Registrant State/Province: Gibraltar
Registrant Postal Code: GX11 1AA
Registrant Country: Gibraltar
Registrant Phone: +1.8553653669
Registrant Email: seek99com@yahoo.com

The admin and tech entries are identical to this registrant entry. This seems awefuly suspicious for a company selling software services.
Cancel all your cards, payment accounts, change all your passwords, and get a proper anti-virus
Those charges are terrifying. You should assume that the "company" you were dealing with was a bunch of criminals. You should think carefully about what information you gave them directly, and what information was on your computer that they might have copied. As a general rule, you should cancel all your cards and change ALL your passwords (unless you are 100% sure that for a given card / account that information has never been anywhere near your computer).
You may be able to get some of that money back from your credit card company by saying that you only authorized $29.97 and the rest was fraud.
As for your computer, you should assume that these criminals have full control of it, best option is to put your important documents onto a USB stick, wipe the drive, and reinstall Windows (or take it to a tech shop to do the same). The second-best option would be to install a legitimate anti-virus (Symantec, McAfee, AVG, or the likes) and see what it finds in the way of malware.


Basic PGP Encryption / Decryption I am working on a project that requires the basic encryption/decryption of a message. I generated private/public keys with my email and no password. The pgp public key as well as the private key, appear to be in the following format (appears to be base64_encoded):

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: BCPG C# v1.6.1.0

rwd3434f...key..4d44edw4
-----END PGP PUBLIC KEY BLOCK-----

This public key was then used to encrypt some message. I then received this sample non-encoded encrypted message in a (*.pgp) file that I need to decrypt using the private key generated.

WEÛπ*=‚d\Ì˝¯i⁄„˝∂FŒ™ç;ı\qä´©Õ·[. G»v‹4Ø˘∂0J˘ÏN8¡6ÓÿÖ÷Á{x_>À5ÉQug‘Ô}ôΩ\ò[@$¶rnò∂sƒ1E∂˛ 9M!üæd<˝GŸ^páwS”ö`Uó˙L"ª∑â˛T“û0EUΩÉ'£éZ¢Ïg∂ﬁH13èóƒíÁ⁄!∞èñ4ù(ÂC2ábñ§¥ªµìÀ(õ(Ô1'ü¥ªçh4
îD¬r?7œƒ?+†#ßGµ?±î<›+ä’ºÖ

My question is what is the simplest way to decrypt this encrypted message within the .pgp file?

I tried the following online tool: https://www.igolder.com/pgp/decryption/

but keep getting a unknown object in stream 22 error

That tool requires you to use ASCII armored encrypted files.  Your example has issues as the encoding on a binary file as displayed in a text-editor is not unique (and the web application doesn't know how to interpret it properly).

The easiest way is to just use the command line with gpg (gpg and PGP are generally compatible when they follow the OpenPGP standard except in a few rare cases).  For a complete example, you create a trusted key pair (again for this demo I chose no passphrase on the key) with:

$ gpg --gen-key
gpg (GnuPG) 1.4.20; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
[...]
Your selection? 1
[...]
Key expires at Thu 26 Oct 2017 01:58:43 PM EDT
Is this correct? (y/N) y

[...]
You selected this USER-ID:
    "john doe (don't use) <j@j.com>"
[...]
gpg: key DA65E019 marked as ultimately trusted
public and secret key created and signed.

which in my case created a new trusted keypair called DA65E019.

Then I can encrypt a file without ASCII armoring it (basically encrypting in base64 with linebreaks):

$ gpg --encrypt --recipient DA65E019 test.txt

that creates a file called test.txt.gpg or with ASCII armoring it:

$ gpg --encrypt --armor --recipient DA65E019 test.txt

which creates an ASCII armored file called test.txt.asc.

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1

hIwDLaGCjcd4AvcBA/wLm/sLb5yha7dPIz4288dtgR0a4zdynB+MZ1ikH8aVWi8x
w6aR3DoA5IyOQkg7whC2vWlWHaJLkrSOWYwnvHVSNm/bXVtXkLq9ZLWnvLVjux+E
+GVQDr8nCSdGR04ZfQ741LjDWubUzlZFacIlMuSmvMrfepIcl5i1ydr4UNA9OtJR
Ac0pgzY3odsl8nmcO+v9XmRpekDm8O3TTHAHN5ci1+iqxI6W/VOEHeuan8HW00Hh
E10+X0Sb5cNCNJBtrIE4G06F2JMKt53o4kTULiSPjT8A
=WEJE
-----END PGP MESSAGE-----

I can use your tool to decrypt this message with your online tool, by exporting my secret key:

$ gpg --armor --export-secret-key DA65E019
-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v1

lQHYBFnw0OUBBADpSAnz6pdZYIyeRHJDi4AuTyEAmZTzFNbbS5Ble0wRnydzkl0o
/1pF0FpnkpFcutN2U1fQA/wVi2mYnUT5m3dY9kQVM9qaOShELg21wuqbvEjE+Y1f
+8+aTNY8f1eeLO6sDPZcpaGhiPxWfpb+uM5dke6DQ1wO+wZM/zXlRNjVAwARAQAB
AAP/W6pK/uV3g09E8gvDOndebtP5C9tNhBb0NkeC/d1tDp+TSP6CTNHKDxTH8VrO
c7mVzjEBmGN4cp7NZ4Kkz9AfHL3N9J2Y0VwoxtwkVgCFktvYFZZRBGI8tw5utxt1
T0dhPkBMDsPqoLushbooymPKbl9vGTZGMmPD1PWCRBc/yUECAO7qowO1J7PAoR0+
p3Z1mWfUXqD1eRuT5WL/MpP8+aUf5LxjeFqBweC3IWRSO6F6GdfGi6OPR+9rQ5IS
NKIbuJUCAPn2QDWUZiUTTregWgpVe4QkYW5l2h5+GXwdIJAr2mda7hvnR7QWXRbr
uYeN9kLxJsKw1AWZ8+EnyzjluM/fOTcB/j2E/SOel+N5q9fBTZNRjoVTaP8SS4mV
Oqljhdb25j6Dbk7Hn39yr6oQMGQlpF3oe7e4FTynSVvaLDMutqPrcHqjBLQeam9o
biBkb2UgKGRvbid0IHVzZSkgPGpAai5jb20+iL4EEwECACgFAlnw0OUCGwMFCQAB
UYAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEBD5wEzaZeAZZIsD/0sF0CMg
uzc8YH/hJT0WyGRKAOvqVrZxoRuSSmcZtBiM4yXXHZfByfuCqNwssJ+MnRyC7n3h
JbqI8CqI2Vfp+Bij9qZQEhhEiZVan62jtzv5ta9SSEoJTIzJNdhi3gmirzTXVM19
Mc0ZqSMGQRwku/TmLb5dfhNeIpnh8j2tlh4mnQHYBFnw0OUBBACzHMrc3YDGu4tj
PBdTFG7ziDOq3pb9pRrIvDDfTnkD5A+WWsOhuk201gnE1fmVoiPN9HiewLIMBekH
oYgFqz2QvIoGe5aGs1vsPb3iTYbLPHkNU2NCmMvDo4eH9pwf0aq/dVOY8LOO/pKy
S0pj0zXdpQJ61emGzCLMky4ScI1U9wARAQABAAP7BDZAh4pGd70wG+Ob0VoZy3gx
VnwryuTkumTkWGnK3HQ+cQwcimwdulFTenu2kZMBp4n690BfPgcL6pSdE2KBiglZ
1APeiPuSM5zYyHJBd2qJdB4s9PEWIIpJFR/XchTMy+1OzpsMZ8xF5dkzx8jwt6JG
U1bpzJIHEH89e07BSV0CAMMfOJr9PxtxsHDUcvdObZvwGcRFffuon9m0N0oG/v0B
j2GM/8Z2xM6ICRCDyH1KNgnxwPxOYtN6JgSq0tUY8GUCAOr+3JsUlsXnmw6iOu/4
d6kiTJaZ/f2Rh6St4Sxc/tfDBKT8bNZZdkG67C+cH0gn09aCemLWDWLm+dk+XWKH
5CsB/RXJdJ2G/0J3ZwQ83YqiFFIc9B1cC5b1Ji5u/prjPVeWVBHA1+gTptWiYgZi
PAugw5HilG4ec9egBJdVGGPPCQ+jNoilBBgBAgAPBQJZ8NDlAhsMBQkAAVGAAAoJ
EBD5wEzaZeAZHoMD/j92pvKe1mr8usWzYFecmZx8uyb1WouxqP+UeEQtry0+IfNJ
Qmlo5UbxYvn5KPg1WIcMOAXlDpm0neBuG/FCIhuUbXq4JVxV5tKJYw2I+Px6jiCD
HivTQ+/NgZdVMcB8k9PqyA96yVyct18KrDAAQ6l8xqzzxXefJRbUaqj8usG7
=yKJT
-----END PGP PRIVATE KEY BLOCK-----

or directly decrypt the binary file test.txt.gpg with gpg in the commandline:

$ gpg --decrypt test.txt.gpg
gpg: encrypted with 1024-bit RSA key, ID C77802F7, created 2017-10-25
      "john doe (don't use) <j@j.com>"
this is a file

In your example, you'll have to import the private key:

$ gpg --allow-secret-key-import --import secret_key.gpg.asc

and then should be have the private key and can use it for decryption.


Is it possible to transfer a virus through browser video? I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer. The answer for that question is that yes, viruses can be embedded in videos for this purpose.

But what I am instead referring to are videos viewed through browsers (which are technically media software on target computers, if you want to split hairs). Now obviously we are talking about two distinct types of video: flash and HTML5 (MP4, WebM, Ogg). Are either/both of these vulnerable to this sort of exploitation, and if so, how would it operate? Presumably the browsers are somewhat sandboxed, so we would be talking about the browser specifically being targeted, rather than the computer on which the browser is on?

but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer.

No it is not. The implication is that there need to be a bug in the code handling the data. For instance the ffmpeg library is used  in browsers like Chrome or Firefox and it had several serious bugs in the past. And of course Flash had lots of vulnerabilities too so the problem exists for both HTML5 and Flash based media playing.

  Presumably the browsers are somewhat sandboxed...

This is an assumption which is not necessarily true. Some browsers like Chrome or Edge are sandboxed and some like Firefox are not sandboxed (yet). In case of sandboxes it gets much harder to exploit but it is not impossible as regularly shown at Pwn2Own.


Does a (kernel) exploit always need to use system calls? It was mentioned in this thread that kernel exploits usually use syscalls to trigger undesired behavior:
How can you detect kernel exploits?
Are there any ways or known examples which do not use syscalls?
What about programs beyond the kernel?

A kernel exploit (or anything at all) not using syscalls will be pretty useless.
Imagine writing a module without read, write, fork, no socket functions, no memory allocation, no IO functions...
Kernel malware needs the syscalls to intercept file read and write, open sockets, create files, read and write process memory, and so on. Anything that does not read or write anything, does not do any disk or network IO, does not allocate memory and does not even get the time of day isn't really doing anything at all, let alone do something malicious.


Is it possible to extract encryption keys from software executing on your own system? I'm a newbie in this field so forgive me in advance if this question is stupid in anyway.
Say we have a software that is executing on our system and encrypting files using a secret key that is not known to us. Is it possible to somehow gain access to the keys by say accessing what the CPU is executing or through some other means (this could include anything like using additional hardware to monitor the system, no restrictions there)
Since the files are being encrypted on the system and the key is also present there, technically it should be possible to reach it right? What is stopping us from finding the encryption keys in ransomware through this? And is it possible to decode applications to get the key?

You don't say that you're dealing with malware, but I will assume you are.
If the application is doing encryption, then of course it has the key. The fundamental approaches are to either analyze the application binary on disk, or to let it run and analyze the running binary. But be aware that malware authors do not want their applications to be reverse-engineered, and they make that very difficult to do; so you are venturing into the field of "malware reverse engineering" which apparently has a median salary of $125,000 USD, which tells you a bit about how specialized the skillset is.
So when you reverse engineer the malware you may find for example that they use binary obfuscation techniques to make the binary very difficult to understand, for example to figure out what is code and what is data (ie the key you're looking for). Another technique in this direction is whitebox crypto which aims to, for example take a traditional AES implementation and key, and combine them into a custom algorithm, so there actually is no key, just some very complicated code. You may also find that your malware sample is designed to detect when it is being monitored display completely different behaviour when it is being monitored (let's call this the Volkswagen maneuver).
Finally, as @mti2935 points out,with some early ransomware it was actually possible to reverse all this and extract the encryption / decryption key from the malware sample. Then the malware people got wise and started using asymetric crypto where you need the public key to encrypt and the private key to decrypt. The public key would be embedded in the malware, and the private key would be kept on the command&control server (c&c). Therefore the malware contains what it needs to encrypt, but not matter how hard you look, the keys to decrypt are not in there.
To be even more clever, when the malware starts up, it can contact the c&c to get a unique public key so that they can demand separate payment for each instance of the malware because they are all using different keys.
In summary: Not easily. Good luck. If this you are asking about ransomware, sounds like you need to hire a malware specialty firm.


How to operate PHPmyadmin with an SSH tunnel? My server environment is quite basic: Ubuntu 16.04, MySQL 5.7.16, PHP 7 and CSF-LFD. I also blocked port 3306 via scf.conf.

I have a script that installs PHPmyadmin (PMA) and deletes it after 2 hours.

To secure PMA even more I was advised to operate it with an SSH tunnel, so to send its browser requests encrypted in SSH, even in these 2 hours of action.

How can this be done globally for all port80 packets (or specifically for PMA, if at all) ?

Only expose phpmyadmin to localhost (if this is the only thing running on your webserver, you can bind to localhost; otherwise, do this with ip restrictions in your server of choice). Then, when you want to connect, use ssh to forward a tunnel:

ssh -L 80:localhost:80 your-server

and access it via http://localhost/phpmyadmin.

Clarification notes:

The your-server part is actually Usual_User@Server_IP. The usual user is of course the main working user which isn't root, so it would be like user1@111.111.111.111.
The your-server can come before the -L or after the last edge (last 80), it doesn't really matter.
Execute the command inside your Putty or OpenSSH session, that uses you to operate your server in an SSH tunnel through port 22.
If you use the exact same keys you use to authenticate the port 22 tunnel with Putty, you should create a version of them that suites the Linux OpenSSH. Why? Well because the formatting for OpenSSH is slightly different. This can be done from the Putty bundle itself, by Puttygen.

Read more on authentication here, if you feel the need to it: Public key and private key. What comes where.


Fingerprints of my computer I'm recently interested in having an paranoid level of privacy but there is little question in my mind for which I cannot find an answer.

I know there is fingerprint of my browser which it gives away to every website it visit. Being a fedora user with bunch of browser extensions, I'm completely unique according to Panopticlick.

My question is, any software other than web browser exhibit such fingerprints. For example can I trust software like filezilla, ssh, telnet or jxplorer(ldap browser) with my privacy? Will they give similar fingerprints to the hosts I have connected?

Thanks for reading.

No, I wouldn't worry too much about other applications, especially not the ones you've mentioned above.

First of all, they don't send out as much information as your browser does. Depending on the protocol or application there might be a a couple of things like a header describing the used program or version, but usually there are no plugins or extensions making it easy to identify you. Furthermore in most cases there are only a few appliactions to be used, e.g. for SSH it would be the OpenSSH client and PuTTY. Everything else would be quite unusual.

Secondly, you don't use these type of application randomly throughout the web. In a typical scenario you would use them only to interact with a few selected servers. You most probably need to login, in order to be able to use them anyway, so you can't expect any privacy.

Having said that, you can always use a packet sniffer, e.g. Wireshark to look at the things you are sending out and evaluate the situation for yourself.


Is it dangerous to have Tor exit node? If I buy VPS and create Tor exit node there what would happen if someone did bad thing using my exit node? (terrorism, hacking goverment sites etc)
VPS provider will share information about me to FBI or another goverment organizations or just will send abuse and block my VPS because it's obviously that I'm just an operator of exit node, not terrorist?

Some people ran into big trouble for what was done with their exit node. Others got away with it. It really depends on the jurisdiction, but also the context, and in particular the willingness of either law enforcement agencies or the privacy-defending organisations to turn a specific case into a story that will elicit emotional response from the general public and thus help in pursuing a political agenda.

So basically it depends. A lot.


Can my /boot be compromised if I Suspend my notebook? So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel!

Or if someone tries (evil maid) to modify the /boot then he has to power off my machine, but later I will notice that! Are there any backdoors of this concept?

They don't have to power off your machine to disconnect (not necessarily remove) the hard disk from your notebook and reconnect it to a different machine, modify the /boot partition, and then reconnect it to your notebook. As long as the notebook is sleeping, it won't even notice. On your next boot, you could be compromised. There are methods to remove SDRAM and read its contents. Of course these take a moderately sophisticated attacker.


Can linux abstract sockets using a psk as name be found by another user? If an abstract unix socket is named "\0some random secret", can it be guessed or retrieved somehow from the abstract socket namespace beyond using brute force?

Are there more security related downsides compared to normal unix sockets which is subject to file system access control?

That's not secure. You can enumerate sockets with ss -xa, even ones from processes that aren't yours. To test, run this:

#include <stddef.h>
#include <sys/socket.h>
#include <sys/un.h>

int main(void) {
    struct sockaddr_un addr = {
      .sun_family = AF_UNIX,
      .sun_path = "\0some random secret"
    };
    int sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
    bind(sockfd, &addr, offsetof(struct sockaddr_un, sun_path) + 19);
    listen(sockfd, 50);
    accept(sockfd, NULL, NULL);
    return 0;
}

And then as another user, do ss -xa and you'll see an entry like u_str  LISTEN     0      50     @some random secret 12979431              * 0 in the output.


I think i might have accidentally clicked a phishing link, how can i be sure? Long story short I might have accidentaly clicked a phishing link is there any kind of test I can do or anything I can do to check?

There are a few standard tests / questions to detect phishing:

Most serious companies will never ask you for login data by email.
Check if the URL is looking strange. (very long / with typo in main domain?)
Check for HTTPS connection and look for certificate information and check this (click on the lock in the adress bar). Check if you can find a certificate. Check if the certificate contains data like company's name. If so you're pretty safe.
Visit the site normally in another tab, check for green bar in adress bar if so, check if the potential phishing link provides this.
Call the company / write an e-mail to confirm this e-mail. (using the adress on default homepage)


Interaction between cash register and card terminal A store allows you to join their loyalty club by simply presenting an ID and a credit card. Your identity is somehow linked to your card and automatically registered the next time you pay, no extra actions required. This means the store is able to uniquely identify your credit card, but how? Directly using the card # is not secure, as it  could be stolen in case of an incorrectly/maliciously configured cash register. The card reader and cash register are two separate devices from different manufacturers, so an identifier must be sent by the reader to the cash register. How is this done without modifying the actual card and complying with data security standards?

Your identity is somehow linked to your card and automatically
  registered the next time you pay, no extra actions required.

Your name is on the card, electronically.  When they swipe your card the computer reads your name off the mag strip and they know that you're John Doe:

Credit/Debit cards follow the ISO/IEC 7813 standard for the data on the mag stripe, and the NM field is 2-26 characters of Name.

You can see the same type of thing when you go to the airport.  The airline check-in kiosks ask for identification, and inserting a credit card is one method.  It does not have to be the card that you used to purchase the tickets; they're just grabbing your name off the card.


Password-less authentication in web apps - How safe it is? I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun.
To quote the article, this is how it works:

Here’s how passwordless authentication works in more detail:

Instead of asking users for a password when they try to log in to your app or website, just ask them for their username (or email or mobile phone number).

Create a temporary authorization code on the backend server and store it in your database.

Send the user an email or SMS with a link that contains the code.

The user clicks the link which opens your app or website and sends the authorization code to your server.

On your backend server, verify that the code is valid and exchange it for a long-lived token, which is stored in your database and sent back to be stored on the client device as well.

The user is now logged in, and doesn’t have to repeat this process again until their token expires or they want to authenticate on a new device.

So what do you guys think? Is this really a realistic alternative to password-based authentication?
Edit:
As it has been stated, getting your phone stolen, gives potential access to your emails and SMS, which would compromise this system. But that would also be the case with password-based systems, where you can click the "Forgotten password" link to receive the email to change the password, and could also have installed Google Authenticator. So, in my opinion, having the phone stolen is a weakness for BOTH password and password-less systems.
Maybe the question should have been:

Do password-less authentication add risk scenarios that aren't present in password-based authentication systems?

As always, the choice of the authentication scheme mainly depends on what you need to protect and the kind of public you will receive.

As "I forgot my password" link mentioned in the comments is a good example. By the past, for certain non-important websites, I used such links on a systematic basis to open a session:

Click on the "I forgot my password" link
Get the email allowing to reset the password,
If actually required, reset the password to some long random string.

By this way, the security of the access to this site was dependent of the security of my mailbox. I did not have any password to remember, and the password recorded in this site's database was unique.

This procedure seems like dirty-version of the procedure you present in your question.

Regarding security, this works as long as:

The authentication source (email, phone, ...) is not compromised,
The long-lived token is not compromised.

For a non-important website, when such authentication scheme is correctly implemented, it could be more secured than allowing users to use some silly password already used on a dozen of other websites.

For a website dealing with sensitive data, the user must be in measure to prove his identity. Therefore the usage of a secret password only known by the user seems mandatory in order to proceed with a normal authentication. The usage of email / SMS should remain exceptional as a password reset procedure or as a second factor authentication.

Regarding usability, it would be better to keep such authentication scheme as optional, since some users may prefer to use passwords safes or other kind of password generators to handle their passwords and will not be able to act as they will with your authentication scheme (links provided are just sample of such software).


Maintaining data security in motion with SSL I am hosting with a HIPAA compliant hosting company, as we are required to do because of the industry I am in. We have a BAA executed with them, and their responsibility terminates at the application level, meaning they are responsible for maintenance of the operating system. Therefore, they have access to the operating system and system files. We utilize SSL encryption for data in motion through our web server. The hosting provider has access to the operating system, thus they have access to the private key for SSL encryption and decryption.

My question is this: In theory, isn't it possible for a rogue employee at the hosting company to use the private key to decrypt the data in motion? This seems to be a hole in our security policy, but I must not be the only one to encounter this. For instance, Box.net must have the same issue because when you upload to Box, the data is encrypted over SSL, but the certificate is managed by Box. Therefore, they have access to your data. I welcome your thoughts and suggestions on this. Thanks.

TL;DR: Any security policy is going to require basic trust of employees and business partners, which should be balanced with controls.

  In theory, isn't it possible for a rogue employee at the hosting company to use the private key to decrypt the data in motion?

Yes, it is possible.

  This seems to be a hole in our security policy

Not really.  You have a business relationship and a BAA with this company.  It is a reasonable assumption that they will act responsibly and not attempt to maliciously compromise you given their access.  You yourself acknowledge this when you say "rogue employee" - you're not worried about them being bad, you're worried about a bad apple that works for them.

By the same token, aren't you worried about the bad apples that work for you?  You should be.

Are there access controls on the key files?  Are there activity logs on the server?  Do you have access to them?  Do you audit them for inappropriate access?  These are all things you should do, whether it's your server and your employees or the hosting provider's server and employees.


Should I consider naming my AMQP queues randomly? I'm using rabbit-mq as the main communication method in my microservices. The names of each queue describe exactly what is the purpose of it. e.g "send-payment", "send-email" and so on.

Should I consider giving a random name for each queue to improve the security?

Security is not an universal thing that can just be "improved", just like code can't be "optimized" just like that. You can only optimize code to do something better (e.g. improve execution speed at possibly the cost of readability), just like you can improve security by protecting yourself against something.

So when you want to give your queues random names, what do you think it protects against? Not really anything, except that it makes debugging harder.

If your communication is in plaintext for the attacker to see, then a queue named ngGyUnGLyDNgRAadYnGMyCNgSGNgtaLaHy will seem more "cryptic" than a queue named send-email, but by observing the traffic, and attacker will be rather quick at determining what a specific queue does.

Could this be considered "improved" security? Not really. It only marginally inconveniences the attacker, while at the same time it annoys your developers. Imagine getting an error report involving a queue named ngGyUnGLyDNgRAadYnGMyCNgSGNgtaLaHy. Now the developer in question has to either look up which queue that was, or remember several cryptic names - either option is annoying.

In Summary: Don't rely on security by obscurity. Enable TLS and test your configuration, ensuring that it is configured correctly.


How to protect user privacy when sharing photos? I have a web site that lets users upload a profile picture that is then visible to other users of the site.

What steps should the site take to protect user privacy?

For example, some Jpeg files may have a geotag in the metadata. It seems to be standard practice to strip this. But, what else should be stripped?

To answer this question, it is necessary to know what information is stored in the photo. Different cameras and phones collect various metadata fields. These fields are collectively known as "EXIF" data.

There are quite a few tools that are capable of reading and parsing EXIF data. An incomplete list is available here:
http://www.forensicswiki.org/wiki/Document_Metadata_Extraction

In general, any personally identifiable information is a good idea to strip from the photo.

Once you have a list of fields you want to strip, you can select an EXIF editor from the following list and remove the desired fields:
http://en.wikipedia.org/wiki/Comparison_of_metadata_editors


Protecting Website Static Resources If I have a website that is only accessible by authenticating at a login page, is it possible for a non-authenticated person to get access to static assets (images, css, javascript, ...)?

I imagine the only way they could do it would be to brute force the urls somehow or somehow know where the resources on the server are located already, but I'm not sure.

It depends on server configuration.  If you configure the site to have the user authenticate with the server itself, then you can have the server use the users permissions and they will only be able to access resources that the user has access to and you can deny them to non-authenticated users.

If the authentication is instead a session level authentication that is implemented in a scripting language like PHP or such, then the server won't know if the assets should be provided and it would be up to your scripts to decide what to serve.  If the static resources are only protected by the URL being unknown, then they could still be accessed with the latter approach.


Information obtained from executing Javascript math functions in browser I came across interesting piece of javascript across few sites. It's executing  Javascript math functions such as abs, acos, random etc. thousands of times - or four thousand times in my case, though iteration count seem to be changing or random.

The sites in question are reputable sites. The code is collecting duration of how long it took to execute these functions and sending data to server and not to third party.

What kind of information can be gleaned from executing mathematical functions? Based on other functions in the file they are trying to gather information about the execution environment - that is browser, but I could not figure out what information can be gathered by executing mathematical functions and calculating duration to execute these functions.

Would virtual machines be slower to handle these functions than normal desktop?

Well, they are indeed benchmarking the user agent.

The time it takes to perform math functions, which only require CPU horse power, is a metric of CPU performance. The more performant the CPU, the higher the metric (or less the time to complete the cycle).

It is a benchmark. Now the question is: how can the benchmark be used in security/privacy scope?

Fingerprinting? Maybe.

I have repeatedly looked at amiunique.org and they, being an open source project, describe detailfully what's under the hoods. Truth is that Canvas fingerprinting is a technique that measures the performance of the system to render a canvas to add to the browser's fingerprint. It is possible that the site is using the performance metric to add it to the server-side fingerprinting routine. Who knows without auditing the server. It is interesting to note that Mozilla prompts (or was planning to, anyway it works on Tor browser) for canvas image, so math functions could be used as a workaround to canvas

Visitor statistics? Very likely

The reputable site may just want to collect info about the CPUs of their visitors. This could be especially true if they want to understand the impact of a front end change or perform browser testing on limited performance machines. Normally web developers have powerful machines with huge amounts of RAM and big screens. They can easily test on multiple browsers, resolution and connection speeds. But what about capping the CPU? Does the site continue to display well? With such metric, they could draw graphs and find test cases

Targeted profiling? Who knows...

I am getting creative here, don't get me too serious. An advertising company could use such information to understand how powerful is your hardware. Then you can get advertising for the most recent 3D hyper performance game that may run on your machine, or some old classic if they find your CPU is not powerful enough.

Please, don't take the last seriously. I was going to joke on that.


Session Token Embedded in Form I have a session token that's stored in a browser cookie client side.  The cookie is already available for scripting and it's used to validate XHR through Javascript. For a particular page I'm using an iFrame to upload data to the server.  Would there be any issues, beyond what I'm already exposed to, by including the session token as a hidden field in my iFrame?

This is a bad design.  You should be setting the HTTPOnly flag on your cookies because it makes xss more difficult to exploit (but not impossible).  If you write the cookie value to the page,  then it undermines the protection provided by this flag.

Why are you including the cookie value in a variable with each request?  The point of a cookie is that it occupies the Cookie: http header element of every request...  which is redundant.  It doesn't matter where the request originates from,  the browser keeps track of the cookie.  This is one of the reasons why CSRF is a problem.

Read the CSRF prevention cheat sheet and use one of these methods to protect your requests.


Apple AirPort w/ open network + Time Capsule backups We have an Apple AirPort running in our office. We are planning on opening a free Wi-Fi network for public use during a small event, but I started wondering about the safety of our Time Capsule backups that are running on the AirPort box.

Can we protect the backups while running open networks?

The communication protocol for the "Time Capsule" is AFP, a proprietary and rather under-specified protocol defined by Apple. Since version 3.1, AFP may be protected against eavesdropping by wrapping it into SSH, but whether this is the case for your Time Capsule is not clear (there are some conflicting reports as to whether this is doable at all; but, at least, it would have to be enabled explicitly).

You could try to run a network monitoring tool such as Wireshark, on one of your Mac, to see exactly how that Mac communicates with the Time Capsule when it performs backups.

In any case, allowing outsiders on your internal network seems like a bad idea, especially since with an open WiFi you cannot control who connects. In any town, running an open WiFi almost guarantees connections from strangers. Even if your Time Capsule happens to be safe, anything in your network can then be subject to hostile attempts (desktop systems, servers, printers...).

I strongly suggest that you run your "open WiFi" (if you really want one) in a dedicated network zone, isolated from your main network with some firewalls.


Mcrypt: is a long key more secure than a short key? I use MCRYPT_RIJNDAEL_256 in CBC mode using mcrypt in PHP. This supports key sizes of 16, 24 or 32.

Is a key size of 32 more secure than a key size of 16 or 24? If it is, does it really matter or is it just a little bit better? And does a larger key noticeably impact performance in this case?

Searching on Google or here on Information Security doesn't help me, I can't find an answer to this question.

My guess is that a longer key is more secure and that it doesn't really affect the performance but I would like a confirmation (preferably along with some sources).

Longer keys are not more secure -- not when the "short" key is already way too long to be breakable through brute force. You cannot be more secure than secure. It does not matter if the time needed to break your key is 10 times or 10 billion times the lifetime of the Universe.

Rijndael is better known as AES. When you use a 256-bit key (32 bytes), it is 40% slower than when you use a 128-bit key (16 bytes); the extra time is a quirk of the way the algorithm is defined (14 rounds with a 256-bit key instead of 10 rounds for a 128-bit key). It rarely matters in practice, though.

Therefore, you got it in reverse: a longer key is not "more secure", but it can affect performance.

(In practice, the key size is the strongest part of your system; it will be time to fidget about quantum computers when every other bit of software and hardware in your application has been brought up to such levels of safety, which is unlikely to happen in any actual piece of software, especially one containing a general-purpose OS, a Web server, and PHP.)


What kind of monitoring system can we have for existing security systems in the vehicles? The vehicles are fitted with a security system to track their movements and report it back to their owners if they are moved unauthorized.

My question is: can we have an additional security system or any third party system to monitor the existing security system? If so, how?

The security system on the vehicles would need some kind of an interface to allow access to the data from multiple sources.

Or, the third party system would have to be the approved recipient (customer?) of each of the vehicle's security system, and the third party would have to gather and report on all the data.

Short answer: API or hand-made aggregation.


Is it possible or common for a website (without ads) to only sometimes do a malicious redirect? Using Chrome, I went to a website of a company we were researching, following a link from a google search, and got redirected to a malicious website. After killing Chrome and scanning for viruses, I decided to investigate. In a VM, I did the same google search and took the same link, but this time there was no redirect. I think tried not in a VM and same thing, no redirect.

The site is Wordpress-based which makes me thing that they may have been compromised, as I've heard this is common for wordpress sites.

At this point though, it could have been another page or ad on another page opening a malicious window. I checked my history but I have no way to tell how the window got opened. Clicking on their site could have been just coincidence. I've been trying to see if there is a way to detect what opened the link, but have not found one yet. What I'd like to know is if I can confirm that this is happening on their website so I can report it to them. For instance, if it's possible for me to detect something like this, assuming it's not happening regularly or to me anymore.

Edit: I forgot to mention that the website has very little "live" data on the page, as it's mostly informative. There are no ad banners or anything like that, though they do have a twitter feed at the bottom. This seemed to rule out a malicious advertising network.

It is not uncommon for infected sites to only infect some visitors, detect repeated visits, exclude specific IP ranges or user agents from infection etc. This is done to not be detected by researchers and thus stay off blacklists and this way infect more users. See for example WordPress Redirect Hack via Test0.com/Default7.com where they describe that redirects within this specific infection happen only in 15% of all cases.


Is my VPN leaking or is this normal? Hi when I am not connected to my VPN and do a route print I get one 0.0.0.0 entry in the Network Destination column. It has a gateway of 192.....

When I connect to my VPN and do a route print I get two 0.0.0.0 entries in the Network Destination column. The first has a gateway of 192...., the same as above. The second has a gateway of 10.... which I'm assuming is my VPN gateway.

When I run a tracert to a website the I see the 10.... ip address followed by addresses in the VPN server I'm connecting to. All tests I have run online show only my VPN information. I cannot see my ip in any of the above steps.

What concerns me is that I see 0.0.0.0 and 192.... on both route print's whether I'm connected to VPN or not.

Is this normal behaviour or is my VPN leaking traffic?

I have seen people say to delete the route but that would force me to be connected to my VPN all the time which I don't want.

Any help??

Thanks...

This is normal. See the last column Metric. If there are two routes to the same destination, the one with lower Metric value has less cost and is chosen as the better alternative. On the other hand, the VPN tunnel itself needs a route to 0.0.0.0, too.

Some (Open)VPN implementations do extra measurements to be chosen over any other connections. They split the 0.0.0.0 e.g. into two halves in addition to using low metric values. As this route is more specific, it gets chosen over 0.0.0.0.

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.1.254    192.168.1.100     35
          0.0.0.0        128.0.0.0         10.8.0.1         10.8.0.5      3
        128.0.0.0        128.0.0.0         10.8.0.1         10.8.0.5      3

Likewise, you still see more specific routes e.g. for your physical networks:

      192.168.1.0    255.255.255.0         On-link     192.168.1.100    291

That's because OpenVPN's redirect-gateway doesn't actively remove routes to local networks, whereas some other full tunneling implementations go further by doing it. From the Reference manual for OpenVPN 2.4:

  –redirect-gateway flags…

  Automatically execute routing commands to cause all outgoing IP
  traffic to be redirected over the VPN. This is a client-side
  option.This option performs three steps:

  Create a static route for the –remote address which forwards to
  the pre-existing default gateway. This is done so that (3) will not
  create a routing loop.
  Delete the default gateway route.
  Set the new default gateway to be the VPN endpoint address
  (derived either from –route-gateway or the second parameter to
  –ifconfig when –dev tun is specified).

There you could leak information through various protocols e.g. mDNS, LLMNR, NetBIOS or SSDP, but that's another story and doesn't affect the connections to the Internet through the VPN.


How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)? I have a web application with a log in page.
In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.

@Html.TextBoxFor(m => m.Username, new { @maxlength="30"})

When I run OWASP ZAP, it gives me an alert with the following description.

  A Format String error occurs when the submitted data of an input
  string is evaluated as a command by the application

  Potential Format String Error. The script closed the connection on a /%s

But when I remove @maxlength="30", the alert goes away.

I've been trying to find the remediation for this alert, but I've read that Format String vulnerability doesn't really exist in C#: Do format string vulnerabilities exist in C# or Java?
.

Is it just a "potential" error and nothing to worry about because it's in C#?
Or.. if this is something that needs to be taken care of, what can be done to resolve this alert from OWASP ZAP? (I'd believe removing @maxlength is not a solution).

It could be a False Positive. You can mark the alert as such, just double click it and set Confidence to False Positive.

If you're seeing it a lot you could go into the Scan Policy and disable that one scan rule.

You could also grab the Alert Filters addon and use it to tweak things.

Lastly ZAP is Open Source so you could always check the source of the scan rule (link below) and see if there's a way to address the false positive or at least you could understand why it's coming up.

https://github.com/zaproxy/zap-extensions/blob/master/addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/FormatString.java


Can a polymorphic/metamorphic worm use a mutex? Can a polymorphic/metamorphic worm use (the same) mutex? This would solve the problem of grinding the network into the ground and consuming all resources with multiple instances of the worm. Is the problem that something this complex would need to be written in assembly, which doesn't have support for mutexes?

Out of curiosity, all polymorphic/metamorphic code I've seen is file infecting viruses. Has anyone heard of a polymorphic/metamorphic stand alone worm? It seems it would be easier to program than a file infector.

Short answer: no.

The point of polymorphic malware is to have no identifiable pattern. If you use a named mutex, you need to know the name of the mutex on both processes. To know the name of the mutex, there must be a pattern to it. If there's a pattern to it, the AV can use that pattern to detect the malware.


Persistent XSS in Blogger domain I have discovered persistent XSS in blogger domain. I have reported vulnerability to Google Security Team and I received this is the response:

  Users are permitted to place arbitrary JavaScript, Flash, Java, etc,
  in their [username].blogspot.com domains; this is by design. These
  domains are fully isolated from other Google content, and therefore,
  the risk in visiting them is no different to navigating to any other
  website on the Internet.

Note that there are no authentication cookies or other sensitive information in these domains; blog management is implemented on blogger.com, instead."

  The domain mentioned in your submission is what we call a 'sandbox
  domain'. These are meant specifically to host user-controlled and
  potentially malicious content and are isolated from any sensitive
  data, thanks to Same Origin Policy restrictions

So obviously I did not received the bounty, however I would like to ask what other attack vectors can be useful for attackers in this case apart from phishing?

If you made your content malicious, and you have enticed a user to visit your blog then you have already succeeded with your attack.

This is just the same as hosting your own website containing malicious content and enticing a user to visit it. The only advantage may be if your target user is likely to trust a *.blogspot.com domain more than any other arbitrary one.

Discounting phishing (e.g. showing a username and password box and asking the user to log into their Google account), the type of attacks you could launch are:

Redirecting a user to another site with an reflected XSS flaw.
Hosting browser exploit code such as Microsoft Internet Explorer colspan Element Processing Arbitrary Code Execution .
Redirecting the user to a malware site or to a malware download.
Executing a CSRF attack.

Again, as the user has to go to your site first they must have some basic trust in it, so I agree with Google in that any malicious code can only compromise the sandbox domain, which does not have any concept of user sessions or sensitive data itself.


How can a site preemptively notify browsers to enforce an SSL on their domain? I learned about this years ago and don't remember enough of the keywords to search for it appropriately.
Its where sites can tell the browser that the site must not allow the site to be downgraded to HTTP.

HTTP Strict Transport Security Preloading
This is the keyword you are looking for. If that's all you care about, then I'm happy I could help. However, if you would like to know why this is done, please keep reading.
HTTP to HTTPS redirects
This is the simplest form of ensuring your users only use HTTPs. Once a HTTP URL is requested, the server replies with a 301 response, redirecting the browser to the HTTPS location instead. http://example.com/foo/bar becomes https://example.com/foo/bar.
However, this means that whenever a client requests the HTTP site (potentially, whenever they want to go to your site via e.g. a bookmark), they can be intercepted by an attacker and potentially never redirected.
Attack Surface: Whenever they connect via HTTP.
HTTP Strict Transport Security (without Preloading)
In order to alleviate this, the HSTS system was developed. It works as follows: Every browser that supports HSTS has a HSTS cache. When a user tries to navigate to a domain via HTTP for which a HSTS entry is present, the request is automatically changed to HTTPS. So even if I explicitly typed http://example.com, my browser would request https://example.com (as long as example.com was in my HSTS cache).
How do sites signify that they support HSTS? By placing a HTTP response header into every request. While technically it's not necessary to do so for every request, the downsides are minimal. The header looks like this:
Strict-Transport-Security: max-age=31536000

The "max-age" parameter defines how long this request should be honored (in seconds). Typically a time of one year is chosen - although why this was done is anyone's guess. And while this is really nice and will protect your users on every subsequent visit, there is still the problem of when they first visit your site. After all, if they never visited your site, there is no way for them to know that you support HSTS. It's a chicken and egg problem. So the first time, there will still be a plaintext communication that can be intercepted.
Attack Surface: The first time they connect via HTTP.
HTTP Strict Transport Security with Preloading
So our goal now is to tell the user that we support HSTS without prior communication to the user. The solution is to use a so-called "preload list". The idea is simple: The website operator tells a list that they support HSTS and will continue to do so in the future.
The browser then gets this information1 through an already secure connection. As such, browsers will be able to know whether or not they should use HTTPS exclusively without ever having to communicate in plaintext.
Attack Surface: None.

1 I actually don't know if browsers regularly download the whole preload list or if they query individual domains. Turns out browsers get a new copy of the HSTS preload list whenever the browser is updated.


Bypass filtering of single quote for XSS in input field Is there a possible way to write a payload which can bypass filtering of ', ", < and  >? As far as I know, it's javascript:alert() as this uses none of the above. So should it work if I use that in an input field where all the above mentioned chars are filtered?

I have a field like this:

<input type="text" name="name" value=''></input>

Now I have to close the quote at value and put my string (e.g. ' onload=javascript:alert()), but that single quote doesn't show up in the source of my resource.

No, XSS cannot work here without a single quote.

In javascript:alert(), the first part is the javascript protocol. You need to be in a URL context for it to work (eg inside an href attribute). It will also work - but not be necessary - in an Event Attribute (eg onload).

To perform XSS in your context, you need to be able to exit the string context of the value attribute. To do this, you need single quotes. If they are properly filtered, there is no XSS here.

(There is a slight change that the filter is not working properly; filtering may for example be done first, after which the input is handled further - eg decoded from some format - which might allow you to bypass the filter; but if you cannot bypass the filter and inject a single quote, you cannot perform XSS).


How does OCSP stapling work? I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be done in one connection, which mitigates some privacy issues. How does the process work from a high-level perspective?

I'm mainly interested in:

Where / how does OCSP stapling get flagged as enabled? Is it something the CA does?
How does the server get the updated CRL from the CA? How does it know when to update?
What stops someone from stripping the "OCSP is enabled" flag from the handshake?
If the SSL connection is compromised (e.g. through BEAST or a private key leak) does it open up an opportunity for the attacker to cause long-term problems by manipulating the CRL?

A CRL is an object which contains the list of serial numbers of certificates which have been revoked by a given CA. It is a signed object; the CRL issuer is usually the CA itself (with the same key) but this power can be delegated.

An OCSP response is what an OCSP responder returns when it receives a request about the revocation status of a certificate. The request / response protocol is specified in RFC 2560. The responses themselves are signed by the responder and they can have an independent life; this means that a given OCSP response can be considered as a specialized CRL which talks about a single certificate.

During certificate validation, the verifier (e.g. a Web browser, when validating the server's certificate) must build a chain of certificate, from one of its trust anchor (aka root certificates), verify all the signatures and names and extensions, and then proceeds with ascertaining the revocation status of each certificate in the chain. This last step entails obtaining CRL and/or OCSP responses, validating them (which means verifying the signatures on them), and reading their contents. This raises two distinct types of question:

How does a verifier check that a CRL or OCSP response is genuine and up-to-date and really applies to the certificate at hand ?
How does a verifier obtain the CRL or OCSP response in the first place ?

CRL / OCSP match with a certificate

Let's concentrate on the following setup: the verifier wants to obtain the revocation status of certificate T (as "target"). He has already built and verified a chain of certificates which ends with CA certificate C followed by T, which means that the signature on T matches the public key in C. Also, the revocation status of C has been verified, and it is now T which the verifier is interested in. T can be an end-entity certificate (e.g. the SSL server's certificate) or another CA certificate as part of a longer chain, which extends beyond T.

A CRL is signed; who signs it is a matter of a subtle distinction between X.509 and its PKIX interpretation in the context of the Internet. For the "original" X.509, a CRL is valid if it is signed by an entity who has a valid certificate and bears the same Distinguished Name as the CA. This works well if the CRL is signed by the same public key than T, i.e. the key of the CA C: at that point, C is a fully validated certificate so its public key can be "trusted" (the verifier is reasonably sure that the public key is really owned by an entity which goes under the name given in C's subjectDN field). However, it could be any other certificate with that name, and located at the end of a valid chain of its own (which may imply more path building, validation and processing of CRL). In X.509, distinguished names are everything, because X.509 was meant for the Directory, the worldwide LDAP-like server aggregate where everything is uniquely referenced by it distinguished name.

PKIX, the working group which deals with the Internet, has noticed that the Directory, marvelous as it may be, shares some characteristics with mythical beasts like the Mokèlé-mbèmbé, specifically that it does not appear to exist at all (at least, no confirmed sighting has been reported). Correspondingly, PKIX enforces a restriction to keep trouble contained: the certificate of the CRL issuer must be at the end of a path which begins with the same trust anchor as the path which ends with T. This should avoid trans-root issues when two distinct CA which do not know each other ended up using the same distinguished names (they could have noticed the issue right away if they had worked in the context of the Directory, if it had existed). This specific point is in RFC 5280, section 6.3.3, step (f).

The role of CRL issuer can be delegated, in which case the distinguished name of the CRL issuer is found in the CRL Distribution Points extension in T itself, and a matching Issuing Distribution Point extension is found in the CRL.

For OCSP responses, a similar system is used. The OCSP response may be signed by the CA itself (with the key in C); or there may be a dedicated issuer. Things are more constrained there: when there is a dedicated issuer, it must have a certificate which is directly issued by C itself, and bearing a specific extension which marks it as an OCSP responder (Extended Key Usage with the id-kp-OCSPSigning OID, see section 4.2.2.2 of RFC 2560). The certificate for that responder can be attached to the OCSP response itself (outside of the signed area, but encoded within the same blob nonetheless).

The important point is that it does not matter how the CRL or OCSP response were obtained: they are signed object, verifying the signatures and all the name matching and extension contents is sufficient. The object themselves can travel over TCP connections, emails, USB keys, caravans of camels, learned by heart and declaimed by a Shakespearian actor, whatever. The signature abstracts these details away. Certificates, CRL, OCSP responses cannot be "manipulated" without invalidating the signature.

CRL and OCSP responses have validity dates. They both have a thisUpdate field which tells when they were issued (formally, the date at which the information they contain was gathered). They also have a nextUpdate field which is the date before which a newer version should be issued; thus, it serves as a kind of expiry date. It is expected that verifiers cache CRL and OCSP responses, using these dates to know whether the cached version is still usable, or a new one should be obtained.

How to locate CRL and OCSP responses

The way a CRL or OCSP response is distributed is not important for security, but, of course, a verifier cannot guess URL out of thin air. The URL at which CRL can be downloaded is encoded in the CRL Distribution Points extension of the certificate T (this extension has two roles: a validating role for delegation of CRL issuance power, and a descriptive role to give pointers to locations where the actual CRL could be downloaded). http:// URL are common, but also ldap:// URL (especially in closed environment like enterprise networks). An https:// URL for CRL download can lead to a loop (since the download entails validating the certificate of another SSL server) hence it will tend not to be supported well, or at all (Windows will not follow such URL).

Similarly, the URL at which an OCSP responder can be found is in the Authority Information Access extension in certificate T.

These URL are indicative only; the verifier can use any CRL or OCSP response it could obtain, regardless of its provenance, provided that all the signatures are verified. Since CRL and OCSP responses have a non-negligible lifetime, it makes sense to cache and reuse them. OCSP stapling is a way for a SSL server to obtain OCSP responses for his own certificate, and provide them to the client, under the assumption that the client may need them. This makes the whole process more efficient: the client does not have to open extra connections to get the OCSP responses itself, and the same OCSP response can be sent by the server to all clients within a given time frame. One way to see it is that the SSL server acts as a Web proxy for the purpose of downloading OCSP responses.

OCSP stapling is entirely up to the SSL server; the contents of the certificates and OCSP responses is unaffected. The CA or the OCSP responder need not be aware that stapling occurs at all.

"Removing" the OCSP stapling flag from the handshake would break the Finished messages at the end of the handshake, so this is not feasible for the attacker, unless this would allow him to break the whole handshake before the end. However, it does not: the lack of OCSP stapling does not mean that the client will not ascertain revocation status; it just means that the client will be on his own, and will have to obtain the CRL or OCSP responses by itself.

The unfortunate thing about OCSP stapling is that it is not yet widely supported. The idea is sound, though. Its security implications is that, with stapling, a SSL server has a powerful argument to convince the Web browser to actually do its job and not skip revocation status checks altogether, like many Web browsers are unfortunately prone to do (things change in that matter, but slowly).

Note: CRL / OCSP response lifetime usually ranges from a few minutes to a few days. The dates are verified with regards to the client notion of time; clients with out-of-date clocks can run into trouble.


Is Man-In-The-Middle necessary for a CA to read HTTP plaintext? Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires to attack the TLS/SSL traffic. Specifically, if I assume my CA to leak the private key it issued me to a third party Mallory (Mallory might also be identical to CA), can passive eavesdropping of TCP packets enable Mallory to get the plaintext? Or does Mallory need Man-In-The-Middle capabilities to read the plaintext?

My rationale for this is as follows: if the certifiacte merely enables a verified Diffie-Hellman, you have to interfere with the key exchange to be able to fool server and client into using your own key(s). But does X.509 do so?

CA does not issue private keys to anybody. CA signs (using its own private key, which is kept very secret) your public key. The CA has no access to your private key at all.

If the CA’s private key is leaked to Mallory, Mallory is able to issue valid certificates for any name. That means he can make almost undetectable (well, obviously, you can detect the certificate changed, but how many users check that?) man-in-the-middle attacks. But he has nothing which would help him with passive eavesdropping.

If your private key is leaked, passive eavesdropping might be possible, but in that scenario, the CA takes no part at all.


How does the attacker know what algorithm and salt to use in a dictionary attack? I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in the dictionary be compared with the hashes in the leaked database? Since the hashes can be of different types like bcrypt, SHA-512 and so on, how can the cracking tools know how to create the hashes and compare it?

For example, take a look at the dictionary attack below. The leaked passwords are just hashes and the dictionary has simple English words. Then how can they be compared? How does the attacker or the cracking tools know what hash algorithm it should use? Even the salt is there, but how does the attacker know what the salt is?

How are plaintext and hashes compared?
During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. So the attacker needs to know not only the hash value itself, but the algorithm and the salt.
How does the attacker know the salt?
The salt is generally stored in the database right next to the hash. In fact, it needs to be. How else could the web server hash the incoming passwords when checking them? So if you have a database dump, you have the salts.
How does the attacker know what algorithm to use?
This can be done in a number of ways:

You can often tell by the format or the length of the hash. For instance, a bcrypt hash usually begins with the marker $2b$.
Try a few very common passwords using the most common algorithms, and sooner or later you will get a match. Since usually only one algorithm is used for all hashes, you only need to find one match and then you can go on cracking the other passwords with that algorithm.
Even simpler, if you know just one password (maybe you created your own account before the breach) you can try different algorithms on that one. (Thanks, Goose.)
If you have access to the code, you'll find the answer there. (Thanks, marcelm.)
Or if you know what software is being used, you might find it in the documentation. (Thanks, eckes.)