What is the best way to be sure of user's identity? Not sure this is the right stack to ask this in, it's kind of an abstract question.

Say you have a website where it is very important that the personal information provided by the users is authentic. Like age,sex, residency and optionally occupation, civil status,etc. How would you make sure that the credentials they submit are authentic? Obviously the most direct way would be requiring for the user to fax/upload scans of their certificates/IDs/etc but that would require a physical person to validate the certificates. Is there any modern, web-based way to securely connect a user's account to a physical person? Maybe like a national/global database where a person can register to(providing all the aforementioned certificates) and gets assigned a personal/unique "e-badge"?

This is a very difficult problem. It is sometimes refered to as the "level of assurance". In fact, it can be further divided into the entity (i.e. person, company etc) level of assurance i.e. the level of assurance you have that the information about the entity is accurate and correct and the identity level of assurance, which is the level of assurance that the identity using that information is the same identity that is associated with the entity.

A common example of the entity assurance is the 100 points system used by many organisations to verify a person i.e. photo ID, passport, driver's license etc. Each bit of information is given a score based on how reliable the information is for proving someone is who they say they are. A passport may be worth 50 points, a birth certificate 10 points, a drivers license 20 points etc. The person wishing to prove their credentials must provide enough proof to add up to 100 points. This establishes the entity level of assurance. This normally needs to be done in person so that you can verify the photo on the passport/drivers license etc represents the person presenting the proof.

Identity level of assurance is used to prove that the person using an identity associated with an entity is that entity. For example, when you connect to your bank. Often it is achieved with something like a password (least strong) or a combination of things (password plus unique token pous some form of biometric data, such as a finger print (something you know, something you have and something you are).

In your exzample, you probably have a need for both entity level assurance and identity level assurance. Some sites don't have such requirements. for example, facebook and gmail have very low entity level assurance - they trust that the information you provide is true. However, they have increasingly strong identity level of assurance, for example, adding 2 factor authentication.

Normally, any site which reuires high levels of entity level assurance will also require high levels of identity level assurance i.e. if you require the user to provide true and accurate information, you probably also need to ensure anyone logging into the system as that person is actually that person.

Identity level of assurance is usually easier to achieve than entity level assurance. Entity level assurance is very difficult to achieve remotely. Normally, you would require the individual to be physically present so that you can do things like verify the photo on a passport, license etc matches the person standing in front of you. When this is not possible, you usually need to rely on some form of 3rd party to assist in your vetting process. This could be something like a partnership with an organisation which has a large number of public offices - for example, a post office. You might pay a fee to this 3rd party for them to provide a vetting process. An individual wanting access to your service would then need to visit the post office, provide their 100 points of proof and then the post office would provide you with their details and sign off that they have vetted this person with the level of assurance you require. Obviously, you are trusting in this 3rd party. Another alternative is to use a certificate authority. Most of the CAs provide a personal certificate service. The individual purchases a personal certificate from the CA. The CA performs the vetting prior to issuing the personal certificate. Of course, the risk with all these 3rd party solutions is that your trusting they actually do a decent job. As vetting can be an expensive process, some CAs do a better job than others. If you reduce the rigor associated with the vetting you can reduce the cost and in turn provide cheaper certificates, thereby gaining a competitive edge. However, this may result in less confidence/trust in the certicates that are issued.

The other problem with certificates is that it relies heavily on the person managing their certificate in a secure way. If someones certificate is stolen and either it does not have a passphrase/password associated with it or if the thief was able to get the passsword/passphrase, then they can use the certificate and effectively impersonate the user it is associated with.

This all probably makes your problem seem impossible. However, things may not be as bad as they first appear. We often fail to really analyse our requirements and have many inherent assumptions about what we need. It is important to consider that the more personal information you require and the more accurate it needs to be, the more expensive it will be for you and the more inconvenient it will be for the user. It will be more expensive for you because of all the additional safegurds you will need to implement, which means more complexity, which means more development, more testing and more maintenance. For the user, it means more hoops to jump through and most likely, more concerns regarding using your service etc.

In additional to considering whether you need the information, also consider whether you really need it to be 100% accurate. For example, if you require their date of birth, how are you using that information? What is the impact/affect if it isn't accurate? What will the users impression be when you requirest that information? etc.

After you hve gone through all the information and assessed it along these lines, if you find you still require a high level of assurance, then you can look at options such as requiring a certificate, establishing relationships with 3rd parties who can assist in your vetting etc.

Finally, note that your example of faxing/mailing in copies of certificates probably won't be sufficient. I could easily obtain birth certificates and possibly passports, drivers licenses etc of someone else and fax them to you. While these certificates may be 'real', there is nothing that proves the person who sent them is the person the certificates represent. Likewise, if you decided to use something like OpenID or some form of social media authenticaiton, you need to look at what the vetting levels of that identity provider are to know if they are sufficient for your needs.


How use snort with local.rules in offline mode? I'm using SecurityOnion distro and I would to run snort on my pcap files.  Is there a way to specify just one rule? I couldn't understand whether local.rules is used.

How can I show only the result of my rules instead of standard output?

Are you trying to have Snort display only the result of your own custom rules created in local.rules?

Why not create one such as an example below in local.rules, move all the other existing rules to someplace else leaving only the local.rules for testing?
That way, only your local.rules will be checked against.

alert tcp any any -> any any (msg:"Testing TCP"; sid:10002)

When you run Snort in IDS mode, it will show up below alerts whenever there is any TCP traffic is happening.

Hope this helps.


Basic Auth exposed to ISP/DNS? Would someone using basic authentication in a URL such as

https://username:password@example.com

have their credentials be visible to their ISP or DNS?

The credentials are not part of the DNS query so they are not visible there. The credentials are included in the encrypted part of HTTPS so that the ISP cannot see these either.


What is the accessibility of a process's environment on OS X? Are the environment variables of a process running on a modern OS X system accessible to other processes? If so, is this information accessible only to the same user and root?

This answer from Gilles for the same question, except applied to Linux, is exactly the sort of answer I'm looking for here.

There's no difference in how the environment behaves between Linux and OS X, which is a UNIX system.


Authentication of support engineers on client systems Are there any good methods for authenticating that a user is a maint engineer, or at least trusted enough to use the maint access? The environment is code that is running in client sites, without internet access, and runs for many years between visits.

Think of a vending machine as example, how do i know that you are from service company, OR are talking to service engineer who gives you the password? I want to stop you being able to use this password again weeks later, although again within next few hours is fine if it helps.

We currently use a long term password, so you login first (site security) and then enter maint password to jump to super mode. Only problem is once this password is known, we cannot really change it.

I am not after perfect security, only that users must be reasonably trusted to access the maint mode. I was thinking of some challenge/response, where the challenge question changes every 24hours or so, but if the code might need to store 10years (life of single release) of challenge/responses I'm wondering if this is really a good idea. We only have keyboards as authentication capture devices.

I'd use some kind of HOTP-esque system - Event-based One Time Password. Think about the little RSA key fobs some people use with random numbers. You can either buy a bunch of them and give them to your engineers (they have to be programmed in to the machines, though), or set up some phone system for your engineers to call to get the OTP.

One issue is that you can't revoke stolen keys. If you give them to your engineers, and they lose it or leave and don't return it, they can still get in. If these systems have accurate (+/- 30 seconds from real time) clocks, you can get a time-based OTP system instead. Use the same 6-digit number code, but then your engineers can't stockpile a dozen numbers before they walk off the job with their company ID and those passcodes.

You can do this without the keyfobs. The downside is that, if anyone has access to the private key in the code, they can get into any machine anywhere. If you can compile it in, you're pretty set.

The HOTP or TOTP dongles can be purchased, or you can just use a Linux command to generate them at-will.

Simpler way

The simpler way is to have a random number generated by an algorithm. The number changes daily at a specific time. That way a newly non-employee or a stolen code couldn't be used for more than a day. You can actually use the HOTP example from above in this, using the HOTP method to generate the daily code and validate it.


BufferOverFlow - How come ESP points to the end of the payload I just don't understand how ESP points to the shellcode
let's say we've sent this string
string = 100 * 'A' + 'BBBB' + 'CCCC'

I have filled the stack with 'AAAA..' and overwritten the EIP value and set it to 'BBBB' and I got the segmentation fault as expected, what I don't understand is when debugging the ESP points directly to 'CCCC', isn't the ESP pointing to the top of the stack, and we have already filled the stack with 'AAAA', shouldn't be ESP pointing to these AAAA?

The stack pointer (ESP on x86) moves up and down as the stack grows and shrinks. While you are correct that it likely should point to the beginning of your payload at time of overflow, it is possible that the stack is shrunk by the time you observe ESP pointing to your C's.
Specifically, during the function prologue (or leave instruction) before returning, the saved stack pointer from the previous frame is popped into ESP. It is likely that the tail of your payload overwrote this saved value and could explain what you are seeing if you are debugging at return-time.


Are there already any Win10 remote exploits? I'm pretty new to pentesting and I just penetrated my first Win7 test-pc several days ago. Now I want to continue with my Windows 10 one.

Does anyone already know some Win10 remote exploits? I heard about eternalsynergy. Are there other ones? I also heard about eternalblue being ported to Win10, but I can't find it anywhere.

What else could I try to penetrate my Win10 PC without user interaction? What are the most common ways and what are more exotic ways?

This question could have been answered with a quick Google search. You can go to CVE Details and find out information about vendors, products, versions, and so on. Most CVEs will post information relevant to a vulnerability, e.g.: "Exploit available." As for "more exotic ways", I think you need to understand exploits, threats, and threat actors in general. Many organizations are compromised via phishing/social engineering primarily, then applications (Office, Excel, IE, etc) are "client side" attacked. (Browser based, file based, etc).

Exploits have been dwindling for some time now, so finding them is increasingly difficult, and threat actors aren't going to burn "0 day" exploits when they can continue using traditional methods that work time and time again. For what it is worth, metasploit's team does a decent job of adding exploits when there are proof of concepts in the wild/discussed. But you need to also understand that there is a huge market for exploits. What this means is that some researchers can hoard their exploits, sell them to heavy hitter buys (govs/mil), or sell them to some exploit clearinghouse. So if you think someone will be making it rain 0 days some time soon, I don't see it happening.


Avoiding the race condition between time of release and time of update There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will be able to learn about the vulnerability and attack a system that hasn't been patched yet. Can this problem be avoided completely? If not, what are the best practices for mitigating it at much as possible?

This might not sound like a huge problem in some cases, for example when the patch is for a complex issue that is difficult to exploit, especially when the software is closed-source. In that case, an attacker will need several days to develop an exploit, and the user has enough time to update the system. But in other cases the effects of this race condition are actually disastrous. Imagine the following commit in an open-source project on GitHub:

- echo '' . $username . ''; // line removed
+ echo '' . htmlspecialchars($username) . ''; // line added

That's obviously a fix for a persistent XSS vulnerability. Even supposing that the security update is publicly released only an hour after that commit, and that the user is going to do the update only an hour after it's been released (which is totally unrealistic), this would result in a two-hour window for a vulnerability that even an inexperienced attacker would be able to exploit in one minute. For very popular software, it's not uncommon for automated attacks to start only a few hours after a security update has been released, or worse sometimes even shortly before the official release.

So what can be done to completely avoid or partially mitigate this race condition? What are the best practices used by vendors and customers who are serious about the security of their systems? Here are a few possible solutions that I thought of:

Don't make the source code readily available, maybe by compiling or obfuscating it. This is what is often done for proprietary software. I suppose Microsoft relies on the fact that reverse-engineering their patches will take time, and in the meantime all users will be able to do the updates.
Don't advertise security fixes. Just fix and release it, without telling anybody that you have fixed anything, or leave any hints anywhere. This might delay the attacks, but might also delay the updates because the users might think "it doesn't sound important, I'll update it later".
Force automatic patches for security bugs. Systems will be patched automatically as soon as possible and before making any public announcements or giving any security advisories, only fixing security issues and nothing else to avoid breaking any functionalities. This sounds like a good idea, provided that all systems are patched almost at once, in a short time frame. Wordpress does something like this by default for its core, but I don't know how long it takes to update all the installations (there are millions of them).
Rely on the services of a security company to stay ahead of the attackers. There are security companies that claim to monitor a variety of things just like an attacker would do (detect and investigate new attacks, check official advisories, even gather information from blackhat communities, etc.), and help you stay ahead of the attackers with special advisories, web firewalls, etc. This seems to be another popular solution, except it doesn't really solve the race problem, it's just trying to race faster. Also, this solution might help with popular software, but I guess it's hard to find services that can help with less common applications.

I can't think of anything else right now.

This is where the concept of Defence in Depth comes into it's own.  Yes, patch regularly and properly, but account for the fact that in any non-trivial
system you will have vulnerable components.

Your first line of defence, as XSS is sometimes exploited via phishing, training your end-users about how to spot and avoid phishing attacks.

If the user had implemented a Web Application Firewall; then whilst the XSS may still exist, attempts to exploit it can be detected and blocked.

If the webserver is configured with standard same-origin policies, the likelihood of an xss being sucessful is reduced. Even if the WAF doesn't detect it.

If your software uses proper session management, and relies on e.g. re-authentication for critical transactions, then the impact of an XSS attack can be significantly reduced, even if it's successful.

If you ensure that data is properly encrypted, users have access only to that which they need, and that sensitive data is only stored when it's absolutely necessary, exploiting that xss vulnerability will cause less harm, even if they give an attacker full access to the vulnerable system.


How is the AIK TPM generated? Here is what I understood from the AIK(Attestation Identity Key) generation the AIK is generated after the boot, when all the PCRs have been initialized. The algorithm will take some PCRs (not necessarily all the PCRs), will encrypt it with the private part of the EK. Am I right/wrong? Another way of formulating would be  “How is the AIK generated?”

So, the AIK identifies one and only one TPM? And that’s why we need to use DAA(Direct Anonymous Attestation), to prove we use a non-compromised TPM, while keeping privacy?

I’m sorry if I got it all wrong, but I didn’t find much information about this AIK.

Edit: So I understood the link, I have the confirmation that AIK and EK are linked, but what exactly is the link?

First, there is the Endorsement Key (EK), an asymmetric Key. Each TPM owns a unique and identifiable EK. As it is unique and identifiable, we can clearly see privacy issues.

So the TCG created the AIK. An AIK is another key pair generated by the TPM, which will be signed by the EK. One can create multiple AIK. For an AIK to be used, one need to send the signed AIK to a privacy CA (Certificate Authority). Last issue, is can I trust the CA? If not, one can use Direct Anonymous Attestation (DAA), which will prove the keys used come from a valid TPM through a Zero-Knowledge-Proof.


Cyber Security vs. Digital Security What is the difference between Cyber Security and Digital Security? They sound very similar (same) to me, But my university course slides said:

current techniques of Machine Learning can provide Digital Security, but not Cyber Security.

So what is the difference?

"Cyber" is a very frequently misused buzzword people like to throw around because it sounds futuristic and cool. What many people mean when they use the word is "computer-related".

What it actually means is the short form of Cybernetic: The integration of human and technology.

What the quote could mean (you are not providing context) is that machine learning can help for security problems in machine-machine interaction (digital) but not human-machine interaction (cybernetic). For example, you can already use machine learning to teach a program to automatically detect an automated brute force attack on a login form, but you can't yet teach it to automatically detect a phishing attempt. (I am not claiming this is right or wrong, just that it might be what the author wants to say)


Side Channel Signal/Attacks 1) What type of information is leaked through side-channel signals from a laptop? List all types where possible. (i.e. keyboard input? the application used on the computer, like google chrome?)

2) What tools/devices are used to pick up the side channel signal from a laptop? (i.e. Can an attacker use his laptop or his smartphone to pick up side-channel signals?)

3) Does the information leaked through the side channel signal only involves the activities that are currently in use in the laptop? or does it involve data that are not currently in use? (example: can something that you type in the laptop 1 month ago be leaked through side-channel signal although it is not in use?)

4) How revealing a side-channel signal can be, in terms of an example: if I type a confidential document consisting of 10 pages with 1000 words, how many words can be leaked through side-channel signal? Can I have a rough estimate like 20%, 50%, 80% etc?

5) How easy or reliable to pick up a side channel signal from a laptop? How long does it take to analyze the information from a side-channel signal?

6) What is the typical distance/range can a side-channel signal be picked up? i.e. how many kilometers? Can it be picked up through a wall although it is a weak signal?

Extra question: can you find out what information is being typed in the scientific calculator using a side-channel attack?

I know this is a bit old, but in case other people are curious about these answers I thought I would post. I have performed side channel testing professionally for PCI-PTS compliance

1) Virtually anything can be obtained from a side channel attack. It is really just monitoring EM emission from a CPU for long wire.

2) a simply EM probe is typical, but monitoring power to a cpu can be used as well. A typical cell phone/laptop does not have the hardware to perform a side channel

3) side channel only involves data currently in use. When the CPU is operating on a key, for example, it emits small amounts of EM radiation. Used enough times  ~30k you can begin to do statistical analysis to start to uncover the information.

4)This is entirely Dependant on the Signal to Noise ratio of the EM /power. I have personally tested about a dozen cpus professionally and I would commonly start to see leakage around 30k, and by 100k uses, I would be able to derive an entire aes 128 key.

5) The EM probe needs to be within a few centimeters of the wire or cpu, or the SNR drops off to fast to be feasible. It would commonly take anywhere from 1 day to 1 week to obtain enough data from the machine, and about 2-20 hours of analysis.

6) It needs to be within a few cm for a probe. If using power we typically had to be on the downstream side of a good power supply to pickup any leakage meaning between the power supply and the CPU


Random mouse input vs random keyboard input vs CryptoAPI I ask this question because it's really starting to annoy me to move my mouse until the " generated bits : 256 " appear every time I want to generate an password on Keepassand I wonder, why software require me to this tedious and completely non random task ( Humans are not random, even myself can see that I have a pattern when moving my mouse in this small square box, usually down,up,left,right,repeat).

So my question is : If I'm really forced to use mouse input or keyboard input which are more random ? Assume that people will be lazy, and there will be a pattern on mouse input and keyboard input ( people are lazy, they won't input symbols or special characters just A-Z mostly )

And why can't Keepass just rely on Windows CryptoAPI ? What is wrong with it ?

Boiling down RNG (random number generators) discussions:  It all depends on how your system and/or software you're using wants to use the random number entropy pool.

Most systems rely on the OS kernel to maintain a pool with sufficient entropy to provide all RNG operations.  If hardware is available, this will use disk rpm, interrupt operations, even thermal changes in CPU (Haswell).  In the case of your software package that wants mouse movements for key generation, it's most likely seeding it's own entropy pool because it doesn't necessarily trust the OS.

There's a lot of discussion around limitations of RNG in virtualized environments (though most have been quelled with good research), but in the case of software manually asking for "movements", the movement provided by a human using a keyboard or mouse will generate enough random data (not just the movement but the I/O variables) to compensate for insufficiencies in the OS entropy pool.  What the software is showing is not the actual entropy and unless it was written by a 4 year old, mouse movement will generate plenty of I/O entropy to satisfy most pseudorandom number generators falling just short of NIST/FIPS compliance.

This is where TrueCrypt failed because while they allowed hardware to manage entropy management, they capped their prime number ranges, allowing easy guessing of numbers used for keygen (from what I read).

Makes sense?


What are the differences between Session Ticket and Session ID based Session Resumption? Is there any other difference except the session cache?

Will only Session ID based Session Resumption update symmetric TLS session key ?

Update: Warning: my understanding of this is botchy. See Dave Thompson’s comment.
——————————————

Will only Session ID based Session Resumption update symmetric TLS session key ?

Neither method will do that.
To quote Adam Langley: (line breaks mine)

TLS offers two session resumption mechanisms: session IDs (where the server and client each store their own secret state) and session tickets (where the client stores the server's state, encrypted by the server).
If an attacker can obtain the session resumption information for a connection then they can decrypt the connection.
(This needn't be completely true, but it is for TLS because of the way that TLS is designed.)

Source: How to botch TLS forward secrecy (27 Jun 2013) (Archived here.)
Further reading

https://blog.cloudflare.com/tls-session-resumption-full-speed-and-secure/
https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/
TLS 1.2 has never provided any Forward Secrecy against a compromise of the Session Ticket key at all, so even with 0-RTT 1.3 is an improvement upon 1.2.
Added 2017-01-04: See section 2.2 "Session Resumption" here: Springall, Drew and Durumeric, Zakir and Halderman, J. Alex, 2016, Measuring the Security Harm of TLS Crypto Shortcuts


Is there any security value of creatively naming folders containing sensitive files? A friend of mine asked me if he could sign his tax returns without printing them out. While helping him, he insisted on naming the folder containing images of his signature and initials a completely random thing. I insisted that if someone gained access to his computer, it wouldn't matter what his files are named. He asked me to provide proof, and I couldn't think of anything. That is a ridiculous idea, isn't it?

In security, attacks are generally divided into two categories: Opportunist attacks and targeted attacks. The former are generally low-effort and low intelligence (ie, no specific information or recon on the target), the latter have to be assumed to be motivated, well-equipped, and intelligent.

The broader issue behind this question is: Does obscurity do anything to thwart attacks by either attacker?

In short, "yes", because it does offer some resistance against opportunist attackers. Attackers aren't perfect and the defender can use to their advantage by capitalizing on the attacker's laziness or ignorance. Attacks by opportunists are modeled as being generally both ignorant and lazy. Opportunist examples:

People who steal a mobile device. Someone who steals the computer (if it is a mobile device) may not look through all the files, there are stories of devices that get stolen and the contents completely ignored.
Botnets. Malware is written to work on many machines. It is unlikely to upload every single file in a user's profile directory and also unlikely to be able to recognize an image of a signature.

For such attackers, Desktop/a_copy_of_my_signature.jpg is far more likely to be carefully processed than data/misc/receipts/DATA_1/rozs/ewa34.dat.

In this case, obfuscation here improves the odds of the signature file not being discovered but it doesn't really do anything to thwart a qualified attacker, so the security gain is minimal. So it's not ridiculous to take this measure, but it is silly to rely solely on it.

More generally, obfuscation can offer a worthwhile outer layer of security in a multi-layered security system. Remember that, as the defender, you win every security battle you prevent. (But don't become too reliant on avoiding them.)

On a side note, signatures aren't that extremely important to protect. Signatures exist in so many places and this person may very well have unprotected copies of it elsewhere in his house on various documents. (Or think about celebrities whose autograph signature matches their legal signature.) And just about any system that requires a signature has mechanisms in place to deal with fraud, so most forged signatures can be contested since this is a well-worn legal path. The signature is probably worth protecting, but it's also likely that the computer is not the easiest way to get a hold of the signature should he be the target of a determined forgery attempt.


How many OpenPGP keys should I make? I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not good since it makes it difficult to be trusted by others. On the other hand, my feeling is, maintaining a single key may not be able to keep separate things separate.

How many keys are okay? How many are too much?

In general, one key per identity should be fine.

One key can include:

Several UIDs (for separate mail addresses, ...)
Several subkeys (for different devices, so you can put some subkey on your mobile; if it gets lost, revoke only this)

Advantages

Less hassle when signing keys, interacting with keyservers, cross-signing your keys
Less hassle maintaining your keys including moving to other computers, revocation certificates, ...
Less hassle when actually using it
Less pollution: If somebody wants to use your public key, it's easier to find the correct one as they're grouped in a semantic way. Imagine looking for a person's name and finding a dozen keys for all his different addresses in use, which to use for encryption?

On having multiple keys anyway

If you want to manage multiple IDs which shall not be connected directly (I can imagine a personal one, one at your employer, one for stuff which may not contain your real name - I think of governmental pressure, ...), feel of course free to use multiple primary keys.

Limitations of Subkeys

Others encrypting for you will always choose the newest subkey. There is no way to connect subkeys to specific user IDs (for example, to have different subkeys for work and home). This would be a good reason for using multiple primary keys (also, your employer might be able to require the private key, depending on your local legislation). This is not valid for signing subkeys: each computer will just use the subkey that is available; if you only distribute the specific subkey, you can easily enforce a given subkey.

GnuPG can only merge different sets of private subkeys for a primary key starting from version 2.1. Make sure to have all subkeys on a single machine and export as needed, or upgrade GnuPG. There is a way using gpgsplit and cat, but it is tedious and requires deep knowledge of RFC4880 (the OpenPGP specification).

Creating and Exporting Subkeys

Subkeys are generated by running gpg --edit-key [key-id] for the primary key, and then starting the subkey generation assistant with the addkey command (don't forget to save afterwards). To export a subkey (or set of subkeys), run gpg --export-secret-subkeys [subkey-id]! >subkey.pgp -- do not forget the exclamation mark ! , otherwise GnuPG will resolve the subkey to the associated primary key (and export this one instead). You can import it using the normal gpg --import [file] command.

I strongly recommend Debian's document on subkeys for further reading.


Trusting CA Certificates by Thumbprint Id like to create an application which trusts certificates issued from specific CAs.
My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate for authentication, it checks its cert chain and makes sure the thumbprint of its issuing certificate is found in my "trusted thumbprints list".
However, what happens when a CA certificate expires? Will the CA generate a new certificate with a different thumbprint, forcing me to update my list of trusted thumbprints whenever this occurs?
Would trusting CA certs based on public key make a difference, or will these be rotated as well?
How about trusting CA SAN? Can a malicious party create issuing certificates with the same SAN as one of my trusted CAs?

First, a thumbprint (also called fingerprint) of a CA certificate is not sufficient to verify the trust chain. In order to validate the trust chain you need to have the public key of the CA which is contained in the CA certificate but not in the thumbprint. Still, you can have a collection of CA certificates and then define using the thumbprint which to trust and which not.
Whenever a certificate gets renewed the certificate fingerprint will change because the fingerprint is computed based on the full certificate, which includes the (changed) expiration. A public key fingerprint is more stable in this regard since a renewal might reuse the previous public key and in this case the public key fingerprint will not change. But while this is at least possible it is far from guaranteed. A CA might decide to use a different public key, for example because the previous one was considered too weak and not sufficiently future proof.


Send credentials by sms If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?

I wouldn't send his credentials via SMS, but perhaps a code that can be used to reset his password. Sending the password unencrypted back via sms is sometimes seen as a violation of privacy. (it shouldn't be possible to do the unencryption in a good setup)


Approach business(es) with security vulnerabilities As a security researcher, I have become familiar with different related tools and software packages.

The other day, I opened up one of those software packages and was attempting to attack a personal wifi network with a WPS attack to asses the usefulness of the software.

I clicked the Start option and then let it run. Long story short, I selected a neighboring business's wireless network and not my intended network.

I will not disclose any information publicly and erased the data immediately, but I would like to approach the business and discuss this vulnerability.

Considering I did not have permission to run the test, but I would like to responsibly disclose my findings to those affected.. I am not asking for legal advice on here, but should I be finding a lawyer first? Is a standard NDA the accepted standard here? I know the approach is important, so how would I go about assuring my safety too?

This all depends on what tools you used and how you actually found the vulnerability. Some places running a simple NMAP scan is legal, while other places it is not. If you ran more intrusive programs, then you leave this alone. Forget it. If you still feel obliged to tell them, then do so anonymously.

You have two options. Leave it alone. Just forget it. Probably the safest. Depending on how you yourself connected to the net, there is most likely something in their logs from your scan. For all you know the server is a honeypot.

If you choose to contact them then legal advice is exactly what you need, and consider that the odds are not on in your favor. If you feign ignorance then you won't seem very professional, and your move can also be viewed as an attempt to sell your services.

It all bounds down to which country you did this in, and if you take a look at the history from similar incidents, then you'll see that in some countries this often ends with a lawsuit.


Why don't popular web services mask the CVV? Most popular web services like PayPal, Google Wallet, and others do not mask CVV numbers, eg: (<input type="password">).

As I read, the CVV is a security feature and it seems logical to mask it in order to hide it from prying eyes. But I haven't see any web service that masks this input.

Most likely answer:

They don't have to (it's not a PCI requirement)
It's better from a UI/support standpoint

Let's keep this in perspective.  This is the number that's printed, on the back of the card, right where minimum-wage cashiers are instructed to visually inspect when performing a POS transaction.  Absolute secrecy from physical bystanders is clearly not the intended control for the CSC!

Pay attention rather to the aggressive controls the PCI DSS imposes to ensure it's never stored by anyone in the processing chain.  They are not concerned with onesie-twosies being shoulder-surfed, they're concerned with the people who steal credit card databases getting away with the CSC too.


Deanonymising social networks I've come across this paper about "De-anonymizing Social Networks". The goal is to use Flickr network to de-anonymise Twitter's anonymous network, but the experiment section doesn't seem to be right.
At section 6 Experiment, the author crawled the API of Twitter and Flickr that exposes the mandatory username and optional names and location. He then goes onto explaining how to deanonymise.
My concern is, surely those graph he used in his experiment are not anonymous, they clearly have a mandatory username and (sometimes) names to go with it. Wouldn't it be wise to anonymise the identifiers or maybe my definition of anonymous social network is skewed. It seems to me, that he used a public graph (Flickr) to identify users on another public graph (Twitter), which seems wrong. Can someone offer me any insight to this?

Well, technically speaking, it is possible to make a truly anonymous social network. But why the mainstream ones are so intrusive? Because they want to sell you as a customer and/,or visitor to their advertisers and here goes the "publicly available reason" for deanonymising users: they say "we want to make money" and it's a part of the truth and a top part of the iceberg. The bottom part below the waterline is that to say "go away and stop breaking the human rights and your Constitution" to criminals in uniform, to publish it as wide as possible and not keep silent smile - it requires guts and the conscious mind, a very rare combination of quality nowadays, sadly. Ed Snowden's reports about PRISM only confirms this point of view, adding specific company names to that crowd of coward criminals... Now there's an attempt to make the anonymous social network with blockchain - it's called Steemit, take a look there, all open source. Also take a look at ZeroNet collaboration in website publishing, it is described in the documentation. And remember: no tool can protect you from yourself, so be confidential in your mind first hand


How was Walmart able to pop up an unsolicited "Rate your visit" notification on my phone? I was in Walmart this afternoon, and later this evening I noticed a strange icon in the upper left of the home screen on my android phone. On examination, I found a notification ostensibly from Walmart asking me to rate my visit, timestamped seven minutes after the timestamp on my receipt.

I have no Walmart-related apps on my phone, so how were they able to push a notification to it, let alone IDENTIFY it while I was in-store in such a way that would allow them to do so?

TL;DR: By December 6th, 2018, Google stopped serving Nearby Notifications. Android users won't receiving this kind of notifications.

How were they able to push a notification?

As @Martin Fürholz pointed out, that was came from Google Maps notification service. Specifically, from Nearby Notifications feature that being developing by Google for the last years.

  Nearby Notifications Overview:

  Nearby Notifications helps users to discover what's around them, by surfacing location-specific notifications for apps and websites, with no prior app install required. Using Nearby Notifications, you can:

  Drive your own app installs.
  Open personal or business profiles in social apps.
  Launch conversations or chatbots inside messaging apps.
  Drive consumers to content about nearby products.
  Help users explore store inventory.
  Drive checkins, reviews within local/travel apps.

  Neither experience requires that an app is installed on the user's device.

(source)

  How Nearby works:

  Nearby can use small amounts of Wi-Fi or mobile data to connect to Google and get info about broadcasts or shared apps.

  Nearby doesn’t track, monitor, or send personal info from your phone.

  Nearby broadcasts are one-way, like over-the-air TV or radio.
  Services that send Nearby signals don’t detect or get data from your
  phone.
  When you give permission, apps that work with Nearby share
  with each other using remote servers. The sharing devices don’t
  connect directly.

(source)

How to disable Nearby Notifications?

Open your phone’s Settings app
Tap Google > Nearby > Settings
Under "Notification categories," tap a category.
Turn that notification type off.

(source)

Related articles:

Google Maps now lets you quickly, and mindlessly, rate places from a notification
Google Maps for Android Lets Users Give Ratings to Places Directly From Notifications

But, keep in mind, Google decided to discontinue support for Nearby Notifications. They'll stop serving Nearby Notifications on December 6th, 2018. Learn more.


Should we encrypt data in a multi-tenancy product in the cloud? We have started to develop a multi-tenancy product.
The product will be deployed in the cloud.
Should we encrypt the product data?
Should the data for each tenant be encrypted using its own key?

Added

Each tenant stores the following information:

a tenant configuration
a tenant reports

In the shared environment like the cloud, there is always the possibility of data leakage. Therefore encrypting data is a great way to prevent anyone from seeing the data they are not authorized to see. Encryption involves the use of keys and without the access to the proper keys, the data is unreadable and unusable. So the data for each tenant should be encrypted using their own keys.


Which cybersecurity job is most likely to be remote When looking to get into cybersecurity what job/certification is most likely to be available as a remote position?

I see a few vCISO roles now and then that are virtual, they would be at the top of the career path. Further down the path you could find pen testing work that is purely virtual, as well as log analyst roles. Truly, you could make most infosec work virtual with the exception of forensics, in-person social engineering, and some incident response. I think the key will be using the right search terms, and using them correctly. Look for "virtual" as a location (to keep from returning "virtual machines" or such from polluting your results. Similarly, "remote" is only good as a location. Listings with many locations listed are more likely to be remote jobs.

PM me for a few good recruiters if you are interested in going that route.


Getting multiple key matches on plaintext/ciphertext pairs in double DES I'm trying to implement a Meet-in-the-Middle attack and just to test it out I've done some hardcoding of values, which is simply this block of simple code:

byte[] key1 = new byte[] { 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
byte[] key2 = new byte[] { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

string p1 = "Hello Dear World";
string p2 = "Hello Evil World";

//SimpleDES is just a C# implementation of DES that I've wrapped in its own class
SimpleDES des1 = new SimpleDES(key1);
SimpleDES des2 = new SimpleDES(key2);

byte[] toEncrypt1 = Encoding.ASCII.GetBytes(p1);
c1 = Convert.ToBase64String(des2.Encrypt(des1.Encrypt(toEncrypt1)));

byte[] toEncrypt2 = Encoding.ASCII.GetBytes(p2);
c2 = Convert.ToBase64String(des2.Encrypt(des1.Encrypt(toEncrypt2)));

I'll leave out any more code, unless it is requested by any of you.

The problem is that given the above simple test keys and test plaintexts, I'm getting several different key pairs which when encrypted with key1 and then key2 yields the same ciphertext.

Is there something obvious, from what I have stated so far, which explains it, or do I need to look closer at my brute-force code.

Is it caused by the short key that I'm using ?

For a cipher each key defines a different permutation, but that doesn't mean that there cannot be identical 1:1 relations. Take AES-256, which maps 2^128 values to another 2^128 values using a 256 bit key and you encrypt one 16 byte plaintext, say all zero's. The output will also have 2^128 values. So there must be keys that map the same plaintext to the same ciphertext.

That's probably not what's biting you though. DES keys have parity bits, which is the lower bit in each byte. This bit makes sure that the number of bits in the byte is always odd. An implementation may chose to ignore the parity bit. If you have a key that only differs with regards to parity then the key value used to derive the sub-keys is identical. So only the topmost 7 bits of each byte matters, giving DES an effective bit size of 64 - 8 = 56 bits.


Cable modem/router hidden internal ISP network? I was querying my router(Thomson TCW750-4) over the SNMP and stumbled upon some interesting information.
I see that the router actually has five separate network configurations operational:

Loopback(Router IP: 127.0.0.1)
Local network(Router IP: 192.168.1.1, Subnet: 255.255.255.0)
Local network 2(Router IP: 192.168.100.1, Subnet: 255.255.255.0)
Broadband WAN network(Router IP: 109.X.X.X - dynamic, Subnet: 255.255.252.0)
ISP internal network(Router IP: 172.21.X.X - static, Subnet: 255.255.248.0)

(I've hidden parts of the addresses for privacy reasons with X)

Now I'm interested in this number 5 network. I'm not actually sure if it is called 'ISP internal network' that is what I basically think it is. From my computer connected to the router I can not access other addresses on that network but I can access my router configuration page over that address the same way I do over 192.168.1.1!
However inside the router configuration there is a ping test page and through that ping I can ping other machines inside the 172.X.X.X network.

So my questions are: What is this network for? Is it essential for cable network to function properly? Is it just there so that my ISP can access my router configuration? Can other users on the network access my router configuration over this network? How?

I tried answering the last question by testing, but whatever I do(for example configure my PCs network to be in that network range) I can not access(ping) any other machine in that range. Pinging from the router test page however does work. So either the router is blocking traffic from local network to that network(which would be some sort of security measure) or I do not know how to configure things correctly.
What I think would definitely work is, if someone managed to clone his cable modem on a more capable router machine running DD-WRT for example he could basically reach this network.

However I would be interested if it is possible to reach this network even through these primitive routers that the ISP is giving to its users(Mentioned Thomson router and the second option that users potentially get is a Scientific Atlanta DPC2203), by some sort of configuration.

Disclaimer: I'm primarily researching this to know if my personal network is vulnerable or not.

The IP addresses beginning with 172.21 are in the "172.16/12" block, reserved for private networks by RFC 1918. It is plausible that:

The routers from the ISP are indeed part of an ISP-maintained private network.
The ISP uses that private network to talk to the routers, e.g. to reboot or configure them remotely.
The routers are configured not to route packets between that private network and the rest of the world, including the Internet, and the local network on the customer side (the 192.168.*.*). This is not surprising, since that network is supposed to be private.

How exactly the router prevents packet exchanges between the ISP network (172.21) and the local network (192.168) is an open question. It is possible that the router is very basic in that respect. Most such routers run on a Unix-like OS, often a VxWorks or Linux derivative. Let's suppose a Linux. Linux maintains a routing table, which would tell him something like:

There is a local network with IP addresses 172.21.X.Y/21 on interface eth0; when a packet is for such an address, send it on eth0.
There is a local network with IP addresses 192.168.1.Z/24 on interface eth1.

(Use netstat -rn on a Linux machine to see that table.)

If you configure your PC to assume a 172.21.U.V address, but still connected on eth1, then you may bring an ICMP request targeted to another 172.21.X.Y address to the attention of the router; but even if the router accepts to forward it to the target machine, and the target machine responds, the response will be for 172.21.U.V, and the router won't re-emit it, or only on eth0, so you would not see it. This is why configure your PC with an internal address will not allow you to see anything in that respect.

Similarly, if you keep your machine with its 192.168.1.Z address, and send your ping request from that, then the router will see it, and possibly forward it on the 172.21.X.Y network. But then, the response will be sent to 192.168.1.Z as seen from the target machine, which will not be your machine, but possibly a machine on the internal network of another client. Or maybe it will go to the default gateway of that target machine, i.e. to the Internet. The Internet does not know that 192.168.1.Z is in your home, so you will not see the response anyway.

If you reflash your router with something like DD-WRT, then you might be able to access that network, except if the reflashing destroyed some credentials which the router was using to connect to the ISP network in the first place. You may have better luck if you find an exploitable hole in the router, allowing you to hijack it without rebooting it: in that case, it seems highly plausible that this would give you network access to all other systems on this private network, including (probably) the routers of other customers. At that point, risks depend a lot on how the ISP people authenticate themselves with the routers when they want to run administrative things (e.g. firmware updates). Right now you have zero information on the subject. For an attacker, using this private network may be useful in that a target home router (the one in the home of someone else) is nominally accessible from the Internet but through the ISP firewalls, and the private network might allow for working around the said firewalls.

A noteworthy point is that your router sees a netmask of 255.255.248.0 on that 172.21.X.Y network: that's room for about 2000 IP addresses at most. So this private network is probably used for only a small subset of the cable routers from that ISP.


Packet size and flood attacks Do the attackers use small but a lot packets or big and some?
e.g. 2 bytes or 512bytes?
Also , can packet size affect the size/speed of the attack?

Something more , how do the firewalls block dos attacks? Just checking the content of the packet e.g. A string 'aaaaaaaa' in bytes gets deleted or do they just have "cooldowns" for each user request?

Routers route packets, regardless of their size, therefore it's more interesting to use small packets. Small packets can saturate your link a lot faster than large packets. In practice routers can't route at a certain speed expressed in Mbit, those speeds are calculated based on the average packetsize multiplied by the amount of packets the router can route.


How to set up a single sign-on for multiple domains? I've set up a single-sign-on for two of our sites that live on the same domain:  a.domain.com and b.domain.com

I did it through cookies, but they are domain-dependant. And - as it is written in the Great Book - now the need for single-sign-on on different domains has raised its ugly head :)
I'm 99% sure i can forget about using OpenId (they don't like external services here, i couldn't even get them to accept reCaptcha)

I'd like to be able to identify somebody on different websites (a.domain.com, b.anotherdomain.com, etc). What are the recommended ways to setup/manage single-sign-on on multiple domains? Any specific security concerns i should be aware of before drafting a proposal?

The way that single sign-on has been implemented for the Stack Exchange Network is very interesting. It makes use of HTML 5 Local Storage. Depending on the browser support that you require you maybe able to use a similar method.

You can check out the stackoverflow blog post Global Network Auto Login for more details.


519 tls handshake attempts in 3 seconds, with 415 within one second, was this a DDOS attack? This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least.
I was forced to do a reboot via the remote hosting console to get it up and running again.

It's a windows server 2008 r2 with latest updates, and the websites have an A rating on ssllabs.

I've pinpointed a potential cause, but I'm not sure if this was the cause.
This morning between 3:27:58 and 3:28:00 there were 519 TLS handshake attempts that ping up as errors within the windows system logs, I haven't seen any successful connection attempts in the IIS website logs in this time frame for requesting a page.

The TLS handshakes varied from TLS 1.0 and 1.2

A collection of the error messages

  An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
  An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
  The following fatal alert was generated: 40. The internal error state is 1205.

Repeating over and over for those three seconds that it took.

Sadly I don't see any port details or IP addresses that attempted this so I don't even know if this was a webserver attack or an attack on another service.

Was this a DDOS attack? Is this attack signature known for a certain type of attack? And what can I do to mitigate future server chocking up because of these requests?

It's not a DDoS.

  It's a windows server 2008 r2 with latest updates, and the websites have an A rating on ssllabs.

That's what the source of the traffic is. The SSL Labs scanner will make a large number of SSL/TLS handshakes in order to test for support of various ciphers and features.


control digital signing What is the secure way to support dev mode and production modes on embedded systems that support digital signing. Dev mode will skip signature verification.

The same way that Windows 10 does:

Add a setting to it that lets its owner/administrator enable "Developer Mode". This is secure as it gets unless your security model is something evil like "keep the device safe from its owner so I can do DRM".


Is there a secure way that a website can retrieve and send your "forgotten" password in plain text My question is related to What to do about websites that store plain text passwords. There are a few websites that I use that when I click "forgot password" my password is sent in plain text to the registered email account. Ignoring the obvious compromise of sending my password without any encryption, does this also highlight security issues on the back end? For example, I thought generally passwords are supposed to be saved in a hashed format such that the actual password is not retrievable. I also know that banks do something funky that lets them check individual characters of the password.

Storing a hash of the password is now the best practice, because even if the password database is compromised, it is not possible for the attacker to get the original password. But if the attacker cannot, it means that neither the site admin nor the application can.

So if the site could send you back your password, it means that it has been stored in plain text or which is mostly equivalent in a security point of view in an invertible encryption. Compromission of a password database normally involves passing multiple barriers, and the last encryption is only one more, not necessarily harder than the other ones: the key must be accessible to the application so it must be present somewhere.

TL/DR: if a site could send you back your password, it stores the password in plain text and not in a hashed form.


Application does't connect to Charles proxy I need to check an android app for vulnerabilities. I have to intercept encrypted data sent to the server. This application uses certificate which is placed in res/raw directory, so it is a resource file. I modified it to a Charles proxy root certificate, installed the same certificate on Android, but application does not connect.

A common problem with mobile applications and making use of proxy software, such as charles, is that the application may be using "certificate pinning" to prevent proxied interception of the traffic between it and the server.

The easiest way to ascertain this would be to ask the application developer if they're doing that and request a build with that feature disabled to make testing easier (I'm assuming here you're acting as a security reviewer for the app.).

If that's not possible, something like Android SSL Trustkiller can be used on a rooted device to remove the certificate pinning and allow interception.


Sign certificate for localhost I'm using HTTPS Node.js server on my localhost, and every restart (PC), when I go to 'https://localhost' I get the certificate message (Chrome).

I want to ask how to install the certificate?

If it is only for development purpose you can add process.env.NODE_TLS_REJECT_UNAUTHORIZED = 0; in your source code or use environment variable on your system with :

$ export NODE_TLS_REJECT_UNAUTHORIZED=0

For production, it's mostly recommended to use a trusted CA certificate.


Can one use a Credit Card as a Smart Card? Okay, first question on any Stack Exchange site, and Information Security seems the most fitting for this question.

Anyways, I realized that my laptop has a smart card reader. I understand that smart cards can be used to store encryption keys and the like. Is there any way that I can erase/format an old (unused) credit or debit card as a smart card?

If so, is there a caveat i.e. can only store one 1024 bit key etc.?

While the EMV chip on credit cards is technically a smart card, It is of a type that is    not reprogram-able. (would be a very bad design if it could be)

Most smart cards can  be used as a key source and often they can hold several keys inside. they usually employ a strategy of single-write or generate on chip for the private key itself. this also makes duplication impossible (a preferred characteristic in most cases).

If you want to play around with smartcards is often easier to get a sub variant, like the YubiKey or Nitrokey. I also strongly advise you te read up on what each type exactly is and what it can and can not do.


Printer Job Auditing Is there a way to audit the actual contents of print jobs sent to a Windows 2008 / Windows 2012 print server?

I'm not interested in the metadata (pages, username, datatime etc), but the job itself - as in the data that was printed.

I can't find anything that would allow IT Security to see what the printer actually printed.   Our concern is that malicious users could print "Hello World.docx" and be stealing classified information, but we'd only see "Hello World.docx" in the job description.

I'd love to have a PDF or similar copy of every job sent to IT Security.

This has already been asked and answered (partly) in a previous stack-exchange article. It's a simple configuration change so save a copy of every printed document. You will need to make sure you have a great deal of storage available before you enable that.

The problem is not saving the documents and knowing what was printed and when, that's very easy, the problem is using the information pro-actively. Generally this information is used to re-construct events after the fact.


How should I defend against TightVNC brute-force attacks? How should I defend against this type of attack?  This is a tightvnc logfile excerpt from a linode cloud server running Ubuntu 12.04 (Precise) with the ubuntu-desktop package added to the bare server.  By default this Ubuntu linode cloud server has exactly one user named root.  No other users will ever be needed for this server and sudo is considered to be inconvenient.  This server runs exactly one application for a very small anonymous business.   When running, the application talks unattended through a socket/port over the internet.  The viewing of application results occurs through an SSH tunnel for VNC.  Light administration occurs via ssh, sftp, scp and rsync with SSH.

The IPs shown in the excerpt are not the IP of the legitimate client.

05/06/12 20:07:32 Got connection from client 69.194.204.90
05/06/12 20:07:32 Non-standard protocol version 3.4, using 3.3 instead
05/06/12 20:07:32 Too many authentication failures - client rejected
05/06/12 20:07:32 Client 69.194.204.90 gone
05/06/12 20:07:32 Statistics:
05/06/12 20:07:32   framebuffer updates 0, rectangles 0, bytes 0

05/06/12 20:24:56 Got connection from client 79.161.16.40
05/06/12 20:24:56 Non-standard protocol version 3.4, using 3.3 instead
05/06/12 20:24:56 Too many authentication failures - client rejected
05/06/12 20:24:56 Client 79.161.16.40 gone
05/06/12 20:24:56 Statistics:
05/06/12 20:24:56   framebuffer updates 0, rectangles 0, bytes 0

05/06/12 20:29:27 Got connection from client 109.230.246.54
05/06/12 20:29:27 Non-standard protocol version 3.4, using 3.3 instead
05/06/12 20:29:28 rfbVncAuthProcessResponse: authentication failed from 109.230.246.54
05/06/12 20:29:28 Client 109.230.246.54 gone
05/06/12 20:29:28 Statistics:
05/06/12 20:29:28   framebuffer updates 0, rectangles 0, bytes 0

This is a problem because eventually tightvnc rejects a new legitimate client session and reports that there were too many authentication failures when the legitimate client tries to do a VNC session.  The workaround is to reboot and reloading tightvnc on a frequent basis.

Since you're only accessing VNC over a SSH tunnel, just close the VNC port at the firewall and drop every connection attempt coming from outside.


Are passwordless SSH logins more secure? I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers with passwords, while I prefer to log into a system without having to enter a password every time.

They fear that it is not secure to connect without a password. What should I tell them? For me, passwords are bad because they could be brute-forced or captured with a keylogger.

I use the ssh-copy-id tool to copy my public key to the server. I then simply connect with ssh servername. In fact, I only have to enter the password for my private key once every time my system boots. If my workstation runs for 3 days, I never have to enter the password again, which they say is insecure. Is that true? I know that keys are better, but I don't know how to explain that to them.

Key based login is considered much more secure than password based logins when looking from the perspective of a brute-force attempt to gain access from a third party system: The chances to crack a key are effectively zero, while bad passwords are all too common.

From the perspective of a compromised client system (your workstation), there won't be a difference because if the attackers can get your private key and/or hijack a session, they could likely also install some kind of key logger, rendering the perceived advantage of passwords useless.


Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things manually without using realm join or net ads join and so on. When I look at a kerberos keytab file (via ktutil) that was automagically generated by these ad joining utilities, I see entries like COMPUTER$DOMAIN.EXAMPLE.COM (note the dollar sign).

But if I follow articles that describe how you can do things manually (not using realmd, etc), such as creating keytabs using the ktpass command (Windows AD), setspn, and creating the service principles (such as RestrictedKrbHost/domain.example.com and HOST/domain.example.com, etc), then these keytab files don't contain these COMPUTER$DOMAIN.EXAMPLE.COM entries. Not sure if I have skipped something or misstepped, but it seems, when using utilities like ktpass on Windows, I cannot create these kind of entries manually, or I don't know how.

Question: How do automatic utilities (like realmd) work to create theseCOMPUTER$DOMAIN.EXAMPLE.COM entries in the keytabs, or put another way, how can I create them manually (Linux- or Windows-AD-side) if I do not use such utilities? Looking through the realmd sources is leaving my head a bit dizzy. (https://github.com/freedesktop/realmd/)

Thanks!

The tool I was looking for is called "msktutil", by Dan Perry and others (https://github.com/msktutil/msktutil). It can create the keytabs I was looking for (COMPUTER$@DOMAIN.EXAMPLE>COM). A man page (Ubuntu) is here: https://manpages.ubuntu.com/manpages/eoan/man1/msktutil.1.html

It's a useful tool when you want to script docker images/containers that need to integrate with Windows Active Directory, while avoiding SSSD and mount-binding the host /var/lib/sss/pipes directory as data volume to the container. This utility also allows me to keep things nicely in sync with AD.


What tools are available to assess the security of a web application? What tools are available to assess the security of a web application?

Please provide a small description of what the tool does.

Update: More specifically, I'm looking for tools that assume no access to the source code (black box).

there's a large number of apps that can be used in web application assessments.  One thing to consider is what kind of tool you're looking for.  Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools.

On top of that there's a huge range of scripts and point tools that can be used to assess specific areas of web application security.

Some of my favorites

Burp suite - http://www.portswigger.net . Free and commercial tool.  Excellent adjunct to manual testing and has a good scanner capability as well.  Of professional web application testers I know, most use this.

W3af - http://w3af.org/ - Open source scanning tool, seems to be developing quite a bit at the moment, primarily focuses on the automated scanning side of things, is still requires quite a bit of knowledge to use effectively.

On the pure scanning side there's a number of commercial tools available.

Netsparker - http://www.mavitunasecurity.com/netsparker/

IBM AppScan - http://www-01.ibm.com/software/awdtools/appscan/

HP WebInspect - https://h10078.www1.hp.com/cda/hpms/display/main/hpms_content.jsp?zn=bto&cp=1-11-201-200^9570_4000_100__

Cenzic Hailstorm - http://www.cenzic.com/products/cenzic-hailstormPro/

Acunetix WVS - http://www.acunetix.com/vulnerability-scanner/

NTObjectives NTOSpider - http://www.ntobjectives.com/ntospider


How does getting a remote shell via exploiting a vulnerability really work? I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software vulnerabilities out there that work in some different way that allow you to place things you want in memory. I've also gained access to some old XP machines of mine using metasploit, which was fun.

But I cannot trully understand how you can get access to the remote system by having (for example) the buffer overflow vulnerability in mind.

There are some points that are not clear for me:

Does the program that has the vulnerability need to run and to listen to a specific port on the victim machine (like a mini-server or something)? Can a program that is badly written be exploited remotely if it doesn't listen to a port?
I assume that the program will read some input from that port and then write it to memory in some variable and maybe process it. Giving the program more data than it should read, and providing that it has the vulnerability, it is going to write to a location into the memory (specifically, exactly after the variable) whatever we want. How doesn't this crash the program 99.9% of the time? What if exactly after the place in memory where this variable is stored there is a pointer to some function that fails to execute and the program crashes?
Providing that the program does not crash, how can we execute the code that we have injected into the memory? Do we need to place the code we want in a place inside the memory that we know it's going to be executed? How can some random part of the memory be executed? Almost never in my programs I execute some variable of mine, unless I want to run some other program, which is very rare and it shouldn't be the same as directly executing code from memory (which reminds me of eval()).
Providing that point 2 assumes correctly that the vulnerability usually arises when the vulnerable program reads malicious input from a port and that this code is executed, how is the executed code able to get back to me, the attacker? Do I send in the malicious code my IP address in a variable or something?
Programs generally cannot read or write in another program's memory. Does this mean that when the vulnerable program closes I will lost the connection to the open remote shell? Or does it spawn an independent subprocess once it executes and I am actually connected to it?

Can anyone give me a simple but yet realistic and thorough example of how the whole system works, from the program listening to some port till the attacker gaining a shell?

Vulnerable programs need to listen to ports in order to access them over the network directly. But, you could gain access to the system through other means then exploit a vulnerable program that does not access the network (e.g. email malware that triggers a vulnerability in a PDF reader)
Knowing how the vulnerable program behaves predictably is the key to finding and exploiting vulnerabilities. In short, you have to already know what will happen in the stack before you send the exploit. That's why, just like all programming: testing, testing, testing.
If you understand BO, then you know that you write to the stack in a place where the pointer will direct the execution. That's how we can execute our code.
Just as in my #1, the vulnerable program does not need to be a network service running on a port. If you want a 'reverse shell', then the code for the shell must include the networking code required to connect back to you.
Yes, and yes. If you do not migrate to another process (either embedding into a running process or a new process triggered by your code), then once the vulnerable program ends, so does your connection. So, migrate.

My answer is a VERY simplistic view of your questions. There is a lot you can do to dig deeper in what I have provided, and even techniques that will contradict what I have said, but these are the very basics.

Simplistic Scenario:

A vulnerable FTP server is running on a port. You discover that a certain FTP command is not properly constrained, so it is possible to send overly large command arguments and write into parts of the stack that the FTP server accesses. You design code (including networking features) that can fit on to the stack space occupied by the FTP program. Then you connect to the FTP server and send the command with your shellcode as the payload. When the FTP server processes the command, it hits your code and processes the payload. Your shellcode executes and creates a networking connection back to your machine.


Appropriate length and slow, unsalted cryptographic hash function for random codes? Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet.
We generate a random code that we send to a user to grant him access to his information. There would also be a second factor for the access. But this question only concerns how to hash and store the hash of the code.
The code acts as a password, with the important difference that it is random and not chosen by the user. We only want to store a cryptographic hash of the code, not the code itself.
However we need to be able to query the information by the hash of the code, so when the user submits the code, we compute the hash and lookup the information by the hash. This prevents us from using a salt. Given that the code is already random, it doesn't seem strictly necessary to salt the code, unlike a password. So we cannot use, for example, bcrypt, as we do for hashing user passwords, because bcrypt always uses a salt.
The code should also not be excessively long for usability reasons.
Now the question is, if we use, for example, SHA-256, which is fast to compute compared to password hashing functions like bcrypt, how long would the code have to be for it to be secure against brute forcing?
Am I right to think that, if our code is, for example, 12 digits alphanumeric, it would only take 36^12 attempts to guess the SHA-256 hash, instead of 2^256 guesses for arbitrary length input. (This question was also asking about that).
To protect against brute force attacks, is there another, slow-on-purpose cryptographic hash function that works without a salt so that the hash is queryable, that we could use in place of SHA-256?

First of all, let us assume the code is in the form of XXXX-XXXX-XXXX-XXXX. Four groups of four alphanumeric symbols, kept apart by dashes for easier readability, is something that is not too bothersome for a user to type in. I will assume that the code will have to be typed in and can't otherwise be submitted to the application (e.g. an URL, copy/paste, etc.), because in such cases, there really is no reason not to use very long, completely random tokens instead.
Next, let's have a look at the structure. I said "alphanumeric" before, but there are some characters which make sense to exclude, such as 0O1IS5 and perhaps others. You don't want a user to mistake an O for a 0, for example. Sure, it may seem obvious to you, but not for everyone - so for the sake of usability, drop all ambiguous characters.
That leaves us with 16 characters and a 30 character alphabet, meaning we have 30^16 possible keys, or ~78 bits of security. In terms of a randomly generated key that a user should type, that's not bad. (By comparison, using 36 characters gives you ~82 bits). So that alone makes online brute-force attacks infeasible.
However, you also want to protect against offline brute-force attacks, in case someone steals the keys. To do that, you should store the first four characters in plain as an identifier. That allows you to generate 810,000 different keys at once, while still leaving ~58 bits of entropy for the secret part.
For the hashing algorithm, you have two sensible choices: bcrypt and Argon2id
bcrypt is the "you can't mess it up"-choice. If you have a good cryptographic library, you should have a function like password_hash(string password) and password_verify(Hash hash, string password) - or similar. These will take all the trouble of using good parameters for bcrypt from you.
Argon2id is the "better if you know what you are doing"-choice. It offers better resistance against offline-brute force attacks, but depends on the correct configuration. You can read about it in more detail, but if you're not already familiar with it, I would suggest using bcrypt instead.
By using these as designed, you will get a hash from a strong key-derivation function, designed to make offline brute-force attacks infeasible. It also makes pre-computation attacks infeasible, in which attackers calculate the hashes beforehand and then compare - since this would take ~22 Yotta-Byte of storage (~22,000,000,000,000 TB), that's not feasible.
To summarize

Generate four characters to "identify" the code and make sure that's unique
Hash the entire code using either bcrypt or Argon2id
Verify the entered code with the stored hash


Is a longer WiFi password more secure? Today I had to type the same password to connect to a WPA2-secured WiFi network several times, and got really annoyed with the length of the password. Especially since it is just a phrase repeated twice.

So, when using WPA2 with a WiFi router, is it always more secure to use longer passwords?

A short paragraph from another answer I have here pretty much covers this, though not in much detail:

The amount of protection offered by implementing a password in any system will always vary in direct proportion to the password complexity, and the effort taken to protect that password. Wireless networks are no exception.

Where a strong hashing mechanism is in use, longer and more complex passwords will almost invariably put you in a better security posture.  I strongly suggest you read some of the other passwords questions we have here.  One of particular interest is:

XKCD #936: Short complex password, or long dictionary passphrase?

It should be noted though, that a WPA2 network's PSK is only effective where WPS is either disabled or unsupported on the AP.  Recent side-channel attacks allow an attacker to break WPS in a relatively short time, and gather the WPA2 PSK directly from the AP without having to actually crack the PSK itself.


Running airodump-ng from script I am trying to write a script that runs airodump-ng.
I use the command:

timeout -sHUP 1m airodump-ng -d MYBSSID -w wpahandshake wlan0mon

when I run it from the command line it works but when i run it from a script it creates a empty .cap file.
Do someone have an explanation to why and a solution?

This is a bug existing in airodump-ng 1.2 rc4 (Released 14 Feb 2016) to airodump-ng 1.2 (Released 15 Apr 2018).

But in 18 Apr 2018, the GitHub user Mister-X fixed the problem. See the commit.

In src/airodump-ng.c with the bug, it will use input_thread() to create a thread regardless of whether the airodump-ng process running in the foreground or background.

The input_thread() will call mygetch(). And the mygetch() will call getchar(). Thus airodump-ng process will read stdin when running in the background.

In Linux, if a process reads stdin when running in the background, it will be stopped. And running timeout without --foreground option will let the COMMAND, here is airodump-ng, run in the background. So in this situation, the airodump-ng will be stopped and create a empty .cap file (asked by you).

There are two lines of thinking to solve your problem:

Let the airodump-ng run in the foreground by using --foreground option of timeout or running source <your_orignal_script.sh>.
Don't let the airodump-ng read stdin when running in background by redirecting stdin to /dev/null, timeout -sHUP 1m airodump-ng -d MYBSSID -w wpahandshake wlan0mon < /dev/null or downloading the newest source code without the bug from GitHub then compile and install it.


How many iterations of Rabin-Miller should be used to generate cryptographic safe primes? I am generating a 2048-bit safe prime for a Diffie-Hellman-type key, p such that p and (p-1)/2 are both prime.

How few iterations of Rabin-Miller can I use on both p and (p-1)/2 and still be confident of a cryptographically strong key?  In the research I've done I've heard everything from 6 to 64 iterations for 1024-bit ordinary primes, so I'm a little confused at this point.  And once that's established, does the number change if you are generating a safe prime rather than an ordinary one?

Computation time is at a premium, so this is a practical question - I'm basically wondering how to find out the lowest possible number of tests I can get away with while at the same time maintaining pretty much guaranteed security.

I just answered to the same question on stackoverflow, so I will duplicate my answer here (I don't think duplication is the way to go; maybe the question should be migrated):

Let's assume that you select a prime p by selecting random values until you hit one for which Miller-Rabin says: that one looks like a prime. You use n rounds at most for the Miller-Rabin test. (For a so-called "safe prime", things are are not changed, except that you run two nested tests.)

The probability that a random 1024-bit integer is prime is about 1/900. Now, you do not want to do anything stupid so you generate only odd values (an even 1024-bit integer is guaranteed non-prime), and, more generally, you run the Miller-Rabin test only if the value is not "obviously" non-prime, i.e. can be divided by a small prime. So you end up with trying about 300 values with Miller-Rabin before hitting a prime (on average). When the value is non-prime, Miller-Rabin will detect it with probability 3/4 at each round, so the number of Miller-Rabin rounds you will run on average for a single non-prime value is 1+(1/4)+(1/16)+... = 4/3. For the 300 values, this means about 400 rounds of Miller-Rabin, regardless of what you choose for n.

(Edit: actually, for a randomly chosen non-prime, Miller-Rabin works better than that (see @Brett's answer) and the average number of rounds will be closer to 300 than 400. It does not substantially change my argument.)

So if you select n to be, e.g., 40, then the cost implied by n is less than 10% of the total computational cost. The random prime selection process is dominated by the test on non-primes, which are not impacted by the value of n you choose. I talked here about 1024-bit integers; for bigger numbers the choice of n is even less important since primes become sparser as size increases (for 2048-bit integers, the "10%" above become "5%").

Hence you can choose n=40 and be happy with it (or at least know that reducing n will not buy you much anyway). On the other hand, using a n greater than 40 is meaningless, because this would get you to probabilities lower than the risk of a simple miscomputation. Computers are hardware, they can have random failures. For instance, a primality test function could return "true" for a non-prime value because a cosmic ray (a high-energy particle hurtling through the Universe at high speed) happens to hit just the right transistor at the right time, flipping the return value from 0 ("false") to 1 ("true"). This is very unlikely -- but no less likely than probability 2-80. See this stackoverflow answer for a few more details. The bottom line is that regardless of how you make sure that an integer is prime, you still have an unavoidable probabilistic element, and 40 rounds of Miller-Rabin already give you the best that you can hope for.

To sum up, use 40 rounds.


What tools exist to crack, disable, and undo the effects of a malicious Linux binary? I'm a network Penetration Tester and I'm trying to learn how to crack binaries. As an exercise, I've spent two days trying to crack a Linux binary that was supposedly designed to be cracked.  Searching on the web and trying what I know on Linux has thus far been fruitless. I've only been able to find the word 'PAsswOrd' using the Linux utility 'strings'. When I submit it, the binary outputs 'you have to try harder'. Running the executable outputs 'I'm not your property'.

I realize I need to know what tools exist beyond basic Linux utilities to unravel the executable.  I'm not asking for any part of the solution or a set of instructions.  Just some sort of starting point would be useful, since I do not see any SO questions or online training that provides this.

What you are doing is called reverse engineering an executable.  It is not unusual for a person who is hard coding a password into source code (a horrible security strategy) to make an amateur attempt to keep it from appearing in the static data intact.  However, the password PAssw0rd may not be at all related to the actual one.  The various program responses are obviously intentional, so PAssw0rd may be a deliberate red herring.

Several tools are common in reverse engineering efforts.

The command "file" which takes the file path as the first parameter so you can determine (in most cases) what type of executable you have.
Disassemblers which show EXACTLY what the executable does but is difficult to read for those that don't write assembly code on that specific architecture or have experience with disassembly.
Decompilers like Boomerang, Hex-rays, and Snowman can provide some greater readability but they do not recover the actual variable names or syntax of the original program and they are not 100% reliable, especially in cases where the engineers that created the executable tested with these packages and tried to obfuscate the security further.
Data flow diagrams or tables.  I know of no free tool to do this automatically, but a Python or Bash script over the top of a text parser of the assembly output (which can be written in sed or Perl) can be helpful.
Pencil and paper, believe it or not, for jotting flows and ideas

A common approach is to hunt for two things in the decompiled or disassembled code.

Cryptographic functions, such as a hash or cipher algorithm
The user prompt for the password and the subsequent read of the
user entry

These are the two endpoints in the data flow.  You will want to back-trace from the place where the password enters the cryptography algorithms and forward-trace the user entry of the password, hoping to find where the two ends meet.

Once you trace the path between user entry and authentication components, you will be able to see the mechanism in between.  If the security was done correctly, it will be a properly created hash value and your attempt will end poorly, but I suspect, this being an exercise, favorable results will be possible.


Apache 2.4 log question Documentation for Apache 2.4 states that:

  Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? I looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

Edit:
Poking around a little more on the Apache "security tips" page I found this further explanation:

  If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

  Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

It is not saying non-root user can perform any kind of direct privilege escalation as a result of this, what it is saying is the log dir should be restricted as their is potential to perform a PE.

Apache is spawned by the root process (needed to bind to port 80) so the logging dir is owned by root. You could theoretically use a public or non-root owned log file as a potential avenue for privilege escalation, e.g non-root user writing files that root would consume, but their are a number of steps needed to do this.

The Apache logs, like any other kind of logs will contain all sorts of juicy information that you definitely do not want to be public.

  Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777?

Yes. For the reasons mentioned above.

I have no idea what kind of logs you are creating, their are options around all of this (custom log dirs, new users/groups etc) but it all depends on context.

Definitely do not make them public.


How do browsers make sure their setting page is secure Take a look at below picture.

This page is not loaded over https, so how do modern browsers make sure this page is secure?

What is there to secure it from? It's loaded directly within the browser. There is no connection outside of the local user context of the machine meaning there is nothing to intercept / tamper with.

To modify what you see you'd have to either modify the browser executable, memory space or modify the underlying data used to store the settings. To read the values you would have to be able to read either the browser memory space or underlying files. All of these are end-game. If a malicious actor can do that they have full control and there is no way to protect from it.


Can a criminal fake the use of a PIN in a chip and pin credit card transaction? Within minutes of my credit card being stolen by pickpockets, two large transactions were made by the thieves, apparently in a bar or cafe. My bank tells me that they were chip and pin transactions. I am sure to a high degree of certainty that my pin was not compromised:

It was not written down
It was not used for other purposes
The card in question had not been used in months, and even then, in a different country (effectively ruling out shoulder-surfing)

Still, my bank insists that my pin was used, although there is no reasonable way the thieves could have come to know it. The bank's people obviously place a high degree of trust in this technology.

Are there known exploits that could allow a chip and pin transaction to appear to have been made using the pin, without the criminals actually having it?

Is it possible?  Yes.  This article from 2015 describes one way:

[T]he fraudsters were able to perform a man-in-the-middle attack by programming a second hobbyist chip called a FUN card to accept any PIN entry, and soldering that chip onto the card’s original chip. This increased the thickness of the chip from 0.4mm to 0.7mm, "making insertion into a PoS somewhat uneasy but perfectly feasible,” the researchers write.
...
The researchers explain that a typical EMV transaction involves three steps: card authentication, cardholder verification, and then transaction authorization. During a transaction using one of the altered cards, the original chip was allowed to respond with the card authentication as normal. Then, during card holder authentication, the POS system would ask for a user’s PIN, the thief would respond with any PIN, and the FUN card would step in and send the POS the code indicating that it was ok to proceed with the transaction because the PIN checked out. During the final transaction authentication phase, the FUN card would relay the transaction data between the POS and the original chip, sending the issuing bank an authorization request cryptogram which the card issuer uses to tell the POS system whether to accept the transaction or not.

Effectively, there are two things that a card reader can do with your PIN when "you" enter it - it can encrypt it and send it to your bank to verify, or it can give it to the chip (either in an encrypted or unencrypted form, but it doesn't matter here) and ask the chip whether it's correct.  By intercepting that request and replying "correct" no matter what, the reader thinks that everything is good, even if the PIN was wrong.
Since then, the methods of tricking chip-and-pin have just gotten more sophisticated.
The bank should be able to tell you whether the PIN was "verified online" (sent to them) or "verified offline" (validated by the card).  If it was online PIN, then I really have no idea how it could have happened.
Side note:
I know you don't have the receipts from these transactions, but the next time you do use your PIN, look at the receipt for something called TVR or Tag 95 or something along those lines.  It should be a ten-character string.  If the 6th character is a 4, then the PIN was sent to your bank.  (See here for the rest of it, or here for a decoder).


How can I prevent GPS spoofing? (prevent a Pokemon-go hack)? I want to prevent GPS spoofing in a mobile device and want to investigate additional ways to improve authenticity of this data.

PokemonGo is already struggling with this  around the world.

Here are a few ways that may improve the situation:

For phones with a manufacturer signed bootstrap, sign the GPS hardware location data. This would limit the usage of emulators, and some jailbroken/rooted devices
Correlate GPS data with an IP ping to a trusted server. Lookup the IP coordinates of that IP in various GeoDatabases
For high volume games, like Pokemon, collect additional verification such as SSID, BTLe addresses.  Peers in the same location should have some overlap in data.

To preserve privacy, I think that hardware manufacturers (iOS/Android) could modify existing APIs to add a confidence level to the GPS data returned.

Do any of these ideas make sense? Is there a better way?

Fundamentally, you are trusting the OS to not feed you bad data. If the OS is modified to feed you bad data, it can also feed you bad authentication.

If the GPS device were to produce signed data, all that tells you is that a device who knows the private key produced that data - it doesn't authenticate it as the device. What does authenticate it as the real deal is a certificate chain, starting at one of the trusted roots on the OS. Oh, wait, we don't trust the OS.

If your attacker used a physical device to emulate GPS signals, then even your GPS receiver can't tell the difference, so the signing doesn't help there either.

It really boils down to you running on an un trusted device and having to make inferences as to what is and is not trustworthy (and what the APIs allow you to see!).

Also, I don't know what you were trying to accomplish pinging a known server and then looking it up in a geo-database... All that tells you is that they know where they are...


Folded TLS as a protection from root cert issuer vulnerability TLS security reduces itself to how much one trusts issuer. However it mathematically possible to reduce dependence from root cert issuer if the traffic is double-encrypted: with two certs from two independent issuers (or more).

Is there any practical approach to do this? Is there any demand for it?

... if the traffic is double-encrypted: with two certs from two independent issuers (or more).

The traffic is not encrypted with the certificates. The certificates are mainly used for authentication, i.e. to verify that the client is talking to the correct server. The key pair of the leaf certificates is also used inside the RSA key exchange but not with DHE or ECDHE key exchange.

While double TLS like you proposed would be a way to not rely too much on a single CA it would need to be supported by all clients. But, since the encryption itself is not the problem but authentication is it would be much better and less overhead to make the authentication part only less dependent on a single CA. And this is the direction  where improvements are done in browsers today. While it is not possible to directly sign the same certificate by multiple CA one can use certificate transparency or projects like Convergence for an extended validation of the certificate. There are also standards like DANE as replacement of the current PKI or for additional validation and certificate pinning also helps in this regard.