Does PKCS 1.5 padding make it possible for an attacker to extract the private key or not? Is PKCS 1.5 safe to use in authentication context? Im currently writing a authentication app based on RSA, for Android that should be impossible to copy, even if you have physical access to a phone without lockscreen/PIN.

However, the HSM inside the phone, that ensures the private key can never leave the storage, only be "used", does only support PKCS 1.5 padding due to a bug in the bouncycastle implementation.

The encrypted messages, will be different every time (nonce) so theres no possibility to observe that two encrypted messages are identical over the wire.

A attacker or adversiary, while not having access to the phone, does not have access to a padding oracle.
The app works by having the user scan a encrypted QR and this encrypted QR decrypts into a OTP code. Yes, the attacker can display, on a phishing page or hijacked connection, a QR code containing padding errors, and observe if the user proceeds with authentication (enters a valid OTP) or not, but what I read on some pages, a padding oracle attack requires millions of "tests" against the padding.

When the attacker or adversiary do have access to the phone, the attacker can use the phone itself as padding oracle, but also, when having access to the phone, the attacker is able to decrypt arbitary messages using the app anyways.

The security goals that must be met, is that:

While the attacker does not have access to the phone, the attacker should not be able to authenticate.
If the attacker does have access to the phone, even for a long time, he should be able to authenticate, but not extract the private key.
When attacker does no longer have access to the phone, for example if the attacker is a previous employee that have been fired and then have turned in the phone, the attacker should no longer be able to authenticate, even if he previously did have access to the phone, and even if the keypair inside the secure hardware, has not been changed.

On this page, the answer mentions its possible to extract the private key, by mounting a padding oracle attack:
What specific padding weakness does OAEP address in RSA?

However, the wikipedia page, mentions no reveal of private keys: https://en.wikipedia.org/wiki/Padding_oracle_attack

But the wikipedia page mentions, using the padding oracle, a attacker is able to decrypt arbitary messages, by just checking the padding oracle replies, without having access to the either the key nor the plaintext output of the decryption engine.
However, in this case, when a attacker does have access to the padding oracle, the attacker also have access to the plaintext output and vice versa, which means that decryption of arbitary messages is already possible when the attacker does have access to the decryption engine, without having to resort to a padding oracle attack.

The 2 things are completely different, because with the private key, the attacker is able to do decryption while he no longer have access to the padding oracle, but if the padding oracle can only be used to decrypt messages, the padding oracle effectively becomes useless to the attacker in this case, because when the attacker no longer have padding oracle access, he can no longer do decryption, and the security goal is met.

The questions I have is:

1: Is it safe to use PKCS 1.5 in this case?

2: Is it really possible to extract the private key using a padding oracle, or does the padding oracle just allow arbitary message decryption? The 2 linked articles are ambigious in that regard.

Is it safe to use PKCS 1.5 in this case?

I cannot answer "no" here. But it is recommended to avoid "safe in this case" for any practical purposes. E.g., why would you use RSA encryption if all you care for is protecting the private key (but not the confidentiality of the messages themselves)? Also, if BouncyCastle hasn't fixed that bug already - it's likely to get it fixed soon (have you reported it, by the way?).

  Is it really possible to extract the private key using a padding oracle, or does the padding oracle just allow arbitary message decryption?

No, RSA Padding Oracle just allows arbitrary message decryption (we are not talking about timing attacks, etc.). So the RSA private key is safe in the phone's HSM.

The CRYPTO'12 paper was about applying Padding Oracle to Key Wrapping - a key is "wrapped" (aka RSA-encrypted), passed to the token, and "unwrapped" there (aka decrypted and made ready for use in this token). It doesn't make sense to apply this attack to normal encryption/decryption, because if you have the device (your phone, your cryptographic token) and the PIN - you can tell the device to decrypt whatever ciphertext you got in one request, no need to pry it bit by bit.

Also, would you consider an authentication scheme based on signature rather than decryption?

Update

  The reason I selected a auth scheme based on decryption instead of signatures, is because signatures get huge, as long as the key.

For the RSA encryption the ciphertext is as big as the key (modulus), just like in RSA signature (and for the same reason - that's what padding is for). But I guess it doesn't matter, because it's passed to the phone as a QR scan...?

  But also the system needs to work without any network connectivity for the device, so I have based the system on encrypted QR codes, that decrypt to a simple OTP string, that is entered on server

Based on your comments, you mean that the phone itself may not be connected, i.e., it cannot react to what it QR-scanned. It just displays the result (presumably something fairly short that the user can type easily).

In the use case you describe, I guess it's OK. And your private key is not exposed anyway. Although I wonder how your public key is going to get from the phone to the server that would use it to encrypt that OTP for this specific client (so your phone would need some connectivity at some point in time).


MSSQL injection help If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema?
Thanks.

If information_schema is not allowed in MSSQL, what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? Thanks.

For SQL Server 2005 and up:

SELECT name FROM sys.tables
SELECT name FROM sys.objects WHERE type = 'U'
SELECT name FROM sys.all_objects WHERE type = 'U'
SELECT name FROM sys.columns
SELECT name FROM sys.all_columns
SELECT t.name, c.name FROM sys.tables t INNER JOIN sys.columns c
SELECT * FROM TableGuess1
SELECT * FROM TableGuess2
SELECT * FROM TableGuess3
SELECT * FROM TableGuess4

BACKUP DATABASE ... and collect the backup.

You can also try the information from @735tesla's MSSQL injection cheat sheet, in his comment to the question above, but be aware that's SQL 2000 syntax (which is still supported for backwards compatibility in many later versions).


How Can Malware Hide Using Cryptography How is it possible for malicious programs to hide using polymorphic cryptography when programs must be first compiled into machine code?  You cannot cryptographically hide machine code, can you?  Then the processor wouldn't be able to execute it.  However, wouldn't it be then simple to identify malware threats once it hits machine code in memory?

Polymorphic malware may not do the same actions in the exact same way every time. Antimalware programs will need to be able to interpret the outcome of a set of actions which may not very reliable if the malware author does well with making the actions seem benign and trigger false positives.

Even when boiled down to machine code, you can do the same action in a wide variety of ways. I don't know machine code so I won't write any but for a really simple instance, there are many ways to go about adding two numbers:

x + y = z
x - -y = z
|-x - y| = z
y + x = z
y - -x = z
|-y - x| = z

So even if the program decrypts its own code during runtime to avoid having itself be identified by antimalware software, it can still act in a variety of ways to achieve the same outcome.


What to choose ipsec or tlsv1 for rdp I found a link but it didn't answered on my questions.
(http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii).

I want to create secure connection for rdp users which are connect from whole the world. Just now they are connecting via rdp gateway using tlsv1 encryption and kerberos auth. But in last news about vulnerabilities i don't want continue to use it. But I want to create l2tp/ipsec connection to network and then via ipsec allow connections to rdp.

Is this way more secure?
Would you approve this decision if you was on my place?
Whether it will affect the performance of the connection?

P.S. I just need your advice.

Thanks in advance.

You might want to look at this answer as it bears on your question; in short, IPSec is overkill for single-port communication requirements and can be difficult for dynamic client environments.  SSH forwarding or sufficiently correct TLS is better for your use case.

That being said, I assume you're talking about Microsoft RDP, which has it's own innate encryption abilities.  While it requires some care to securely implement, it is possible to have a reasonably secure installation of it.  You should carefully consider whether you can achieve your goals with the native capabilities rather than bolting on outer layers; such hybrid solutions often have a hidden security cost due to their complexity.


Is there a way to change your current UID to equal your EUID? Here is the scenario:
running id gives this :
uid=1001(test1) gid=1001(test1) euid=1000(bl4ckc4t) groups=1001(test1) -
This means that I am user test1, but my euid is set to another user.
My goal is to get my uid to change to 1000 from my current position with my euid being 1000.
The problem is that running something like bash -i will just look at my uid and create a shell based on my uid, not euid.
The only thing I came up with, which does only work if you have euid=0 is:
python3 -c 'import pty; import os; os.setuid(0); pty.spawn("/bin/bash")'
Through python I can change my uid, and it works, except that if I try the equivalent for this case:
python3 -c 'import pty; import os; os.setuid(1000); pty.spawn("/bin/bash")'
it throws the exception OSError: out of pty devices
How can I achieve that change?
The general restrictions are to change it without uploading binaries, changing /etc/shadow or /etc/passwd. It would also be great if the method works natively and doesn't assume that specific programs, like gcc for example, exist.

The Linux system calls to do this are setreuid or setresuid, both available in section 2 of the manual. The difference is that setresuid lets you choose the saved user ID, whereas setreuid sets it automatically.
If you're using C/C++, this is easy; just #define _GNU_SOURCE and #include <unistd.h> (or the equivalent to call the relevant APIs in your language of choice). Languages that allow direct calls into C APIs should be similarly easy; the functions are defined in glibc (which many Linux programs already link against). If you're using another language that wraps the relevant APIs, such as python, consult the documentation for the wrappers in that language.
To then run another program as that user, either use a member of the exec API family (possibly the execve syscall directly) to become that program, or vfork/clone a new process and then exec inside it, or use system/popen. If not on C/C++, use the suitable program-execution / process-creation API in your language of choice.


Viruses From Email Attachments My company just got a worm. The specific one is beside the point, but I linked a couple pages that I think describe the worm / virus below. We're getting lots of emails to Outlook asking us to open documents.

For fun, I want to do a static analysis / dynamic analysis in a virtual machine at home. I know the rule of security is that it's "never safe", but can I practically assume that downloading the attached zip file will be safe if I don't run it?

Symantec
Malwr

Most email virus require to be executed through either of these methods:

The email software and/or the operating system automatically runs the file when it sees it. This is the case for pictures that exploit flaws in the picture-rendering libraries: the software processes the picture automatically (if only to show it as a thumbnail), triggering the exploit.
The gullible human user is induced into running the thing.

Most email virus follow the second path, since it is much easier. Flaws in software libraries are reported and patched by vendors; flaws in the human brain are never fixed. Typically, the file will be called ".zip.exe" (the user will just see ".zip" and think "this is a Zip archive, not an executable), or ".scr" (the user is not aware that "screensavers" are actually executable files in the Windows world). When the virus is of the second kind, downloading the file is safe, as long as you take care not to execute it. Beware of double-clicking it !

If you can arrange for a transfer without downloading it on your work machine, this would be safer. For instance, if you can access your emails through a Web portal, then do that from, say, a machine running Linux (could be a VM). As a rule, Windows  virus don't impact Linux, and vice versa.


Stun scripts/webRTC IP leaks I've been looking at webRTC and stun scripts in general and their ability to bypass VPN's. And have a few questions I hope someone can help me with.

1) Since using openVPN and other VPN protocols/methods normally sets the default adaptor to itself, (like makes the primary network device the TAP adaptor for VPN) how does the stun script/webRTC script actually leak real IPv4 addresses and other information as shouldn't it route via this VPN by default?

2) I understand programs such as skype and others implement stun scripts which to me seems like it could be leaking info. Is it possible to disable stun/webRTC scripts system wide, or at least monitor them and authorise them using a HIPS style system? And would this cause any serious issues?

WebRTC does not connect to another adapter
WebRTC have a method to enumerate all local addresses, so it can employ a wide range of NAT tunneling. It does not force a connection to use any adapter. The connection itself is handled by the OS, and WebRTC cannot change the adapter in any way.

Disable STUN/WebRCT system wide is not easily feasible
WebRTC is a technology embedded on web browsers, not on a system level. You can disable it on all your browsers if you want. Disabling STUN system wide is a lot more tricky. Every program have its own way of using it, some can be disabled by the user, some cannot.

You could try disabling UDP system wide, but this will give you a lot of headache, and you can expect innocent services failing for no reason. But you can run suspicious programs on a virtual machine, so even if some program leaks your local IP, it will only leak the internal networking used by the virtual machine, something like 192.168.1.10, and not your public IP.


Can an inaccessible uploaded PDF harm a server? Is it possible for an uploaded PDF file to harm an Apache server, if the filepath can't be found? That is, the PDF file can't be viewed from the browser or accessed by a known path once uploaded.

I have a feature within a Drupal site that allows anyone to upload a PDF file in order to have some ImageMagick processing done to it. The resulting file is a JPEG.

The PDF file is automatically deleted a soon as the JPEG is viewed. But I'm concerned that even during the short processing time, a malicious PDF could do harm to the server. Or that the IMageMagick processing can be interrupted and allow the PDF file to live on the server.

Here's the procedure:

User browses for and chooses the PDF file.

User Saves the node.

the ability to view the uploaded PDF prior to saving the node has been disabled (unset in the form, not just hidden)
on upload, the PDF file name changes, and the upload directory name contains a random string
there is a file size limit
supposedly the mimetype is detected using PHP FileInfo but I can't tell if that's working (a test indicates it's not)

ImageMagick processing occurs.

The new node is automatically displayed.

PDF file is automatically deleted as soon as the node is viewed
The new node contains only a link to the resulting JPEG

It could harm. Consider that a malicious user may build a malicious PDF in order to exploit your imagemagick implementation and gain access to your system.

Another question would be "can a file for its mere existence damage your business?". Let's take different security approaches:

Integrity: I can't see a file compromising the server integrity if nobody and no process uses it. Of course your original file set in your server will be different after leaving this file there. But it is somewhat fine...
Confidentiality: this is a point, if you tell your users their PDF is secret but it can actually be download if someone knows the path, then you are lying to them. And this will be a vulnerability in your service. Since you say it is unavailable to anyone, I can't see any vulnerability here.
Availability: normally it wouldn't but if eventually more and more PDFs are left there by errors you eventually will have no space in your disk to continue with your service so, here you have another vulnerability. Even only one could trigger this problem for some design error.
Non repudio: I can't see any problem here for this service.


Will HTTPS expose the IP address of the receiver? If I send a HTTPS request to a IP address directly will anybody spying on my network be able to see that IP address? For example if someone captures my HTTPS packets will they be able to identify which server I am connecting to?

Yes, they will. It doesn't make any difference which application layer (L7) protocol you are using for the communication, as IP addresses and routing is happening on lower network layer (L3). See e.g. List of network protocols (OSI model).

Anyone being able to capture your HTTPS traffic knows the site you are visiting:

The IP headers (L3) reveals both source and destination IP addresses.
From the destination port 443 in the TCP headers (L4) you can guess it's probably HTTPS, and it's easy to test whether there's a web server listening or not.
The HTTPS – or the TLS handshake providing the encrypted channel for HTTP – reveals even more. Among many things, the ClientHello has Server Name Indication (SNI) extension. This means that anyone capturing the beginning of the HTTPS session also has the hostname in plain text.


What are possible methods for calculating password entropy? I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question.

What are possible or commonly used methods for calculating password entropy?

For example KeePass is using a method to calculate some kind of password entropy. How do they calculate it?

Are things like repeating patterns or predictable/easy combinations somehow included in those methods?

The proper way to calculate password entropy is to look at the password generation method, evaluate how much entropy is involved in the password generation method, and then evaluate how much of that input entropy is preserved by the encoding method. As an example, throwing a fair 6-sided dice once generates approximately 2.5-bits of entropy (note that it's an open question whether or not real-life dice is truly fair).

Password strength meters are not entropy calculator, they estimate the maximum amount of possible entropy contained in a string by doing statistical analysis on the password, based on commonly used password generation and cracking methods. In all cases, entropy estimator can be off by quite a large amount. While entropy estimator can be good to detect obviously weak password, it is not a good way to determine whether or not a password is good.

A random looking string can contain little entropy, for instance the SHA1 of one ASCII letter only contain 7-bits entropy; but most password meters would think it is a solid password.


How to protect data of users in multi-user site? I am working on a system where people can make their accounts with few things being stored in database like id (that will be auto increment), first name, last name, username etc.

Now I am well aware of SQL injections, so I am using prepared statements, but is prepared statement alone enough to prevent attackers from tampering with my database?

Everybody knows the first name and last name of people on social networks and that could be used:

`delete from table where firstname='john'`

or can be done same with id as it is auto increment we can write down any number

`update table set firstname='joker' where id=555`.

So my question is are prepared statements enough to prevent sql attacks or professionals store such information in database in encrypted form.

Are prepared statements enough to prevent SQL injection attacks?

Doubtful, I would not rely on prepared statements only. Input validation is still required and highly recommended. Determine what input you expect in a field and act on it accordingly.

For example, in a name field you should not expect characters such as ">" or "<". However, a character like a quote is expected and should be properly dealt with.

  Do professionals store such information in database in encrypted form?

This depends on the type of data and its classification, generally not all fields are encrypted. In case of credit cards for example, they are required to be encrypted.

The location of the decryption key is another thing to consider. If the key is stored on the same machine where the encrypted tables are stored, an attacker could possibly get this key as well.

A SQL injection attack can also lead to shell access and does not necessarily always mean the extraction of the data located in the database. If the key is stored on the same machine, an attacker could retrieve both the encrypted data and the decryption key.

Note: Encrypting data in a database should not be considered a solution for SQL injection attacks.


Best way to test my home network from the outside I want to check that my router is working like it should. For example that certain ports which should be open on the LAN side and closed on the WAN side really work that way. So I would like to run a few simple tools like nmap and netcat, from the outside. But from which computer should I do this? I don't think that most shell accounts appreciate users running these tools? Or maybe there are providers that allow you to run these as long you run it against an ip that they know is yours? Another way would be to connect a computer before the router, and ssh into that.

This must be a common problem, how do people usually solve it?

I run scans on my home IP from a Linode account. Any VPS that doesn't filter your outbound traffic should work (just make sure it doesn't violate your TOS).

First run a full scan against your home IP address. Expect to find only the ports you know you have explicitly opened open. Expect everything else to be "filtered".

Then verify that it is your home router that is performing the filtering and not your ISP. To do this, open a port on your router and rerun the scan. Expect that the port you have opened is detected as open by your scanner. If you find that you still see this port as filtered, then your ISP may be blocking that port. If so, this isn't necessarily a problem, but it means that the previous test didn't test your router, it tested the network connection to your router. Don't forget to disable the port when you're done.

If you want to test your router in isolation, and your router isn't built in to the modem, then you can test it as follows:

Disconnect the router from your modem. (Where "modem" is whatever device connects from your LAN to your ISP's network.)
Connect a second computer to the WAN port on the router. Configure this computer with a static IP address that is independent of the LAN addresses used by your router.
You may need to turn on a DHCP server on the second computer so that the router's WAN interface gets an IP address as usual.
Perform the scans described above from the second computer.

As @logicalscope mentioned, if you decide to perform a scan from the Internet you may want to give your ISP a heads-up to avoid any trouble.


Root certificate key usage (non-self-signed end entity) This discussion does not include self-signed end entity certificates for hosts like web servers and mail servers.

OpenSSL's default configuration for a CA certificate has the following keyUsage:

cRLSign
keyCertSign

The Federal Public Key Infrastructure (PKI) X.509 Certificate and CRL Extensions Profile has the following keyUsage:

cRLSign
keyCertSign

Microsoft uses the following for its root certificates (from How to make a stand-alone certification authority):

Certificate Signing
Off-line CRL Signing
CRL Signing

RFC5280 defines CA or CRL issuer certificate key usage bits, and states the following MAY be present for a CA root using RSA:

digitalSignature
nonRepudiation
keyEncipherment
dataEncipherment
keyCertSign
cRLSign

For a DSA key under RFC5280, the following MAY be set:

digitalSignature
nonRepudiation
keyCertSign
cRLSign

And ECDSA keys under RFC5280, the following MAY be set:

digitalSignature
nonRepudiation
keyAgreement
keyCertSign
cRLSign.

And then RFC5280 goes on to say with respect to ECDSA:

  if the keyUsage extension asserts keyAgreement then it MAY assert
  either encipherOnly and decipherOnly

Why is the IETF so fast-and-loose with key usage?

Why is keyEncipherment and dataEncipherment allowed for an RSA root certificate?

Why is a key agreement usage allowed on an ECDSA certificate?

Is the IETF usage a case where the standard was crafted to fit the existing practices?

The Key Usage extension, when present, contains the exhaustive list of usage types that are allowed with the public key. When a system processes a certificate, it does so for a given purpose, and thus must verify that the Key Usage extension, if present, allows that usage. Specifically, when a system analyses a CA certificate and wants to use its public key in order to verify the signature over another certificate (that the CA purportedly issued), then this is a "certificate sign" usage; so if the CA certificate contains a Key Usage extension, then the system will require that the extension contains the keyCertSign flag.
Nothing prevents a Key Usage extension from containing other flags as well ! The verification is positive-only: systems check whether the flag they want is indeed there; they never check that a flag they don't want is absent.
Since a CA is supposed to issue certificate and CRL, it should have, on a general basis, the keyCertSign and cRLSign flags. These two flags are sufficient. If the CA does not intend to sign its own CRL, then it may omit the cRLSign flag; however, a CA without the keyCertSign flag makes little sense. One may want to include other flags if the CA key is meant to do other things as well (although this is not recommended: a general rule is that a cryptographic key should be used for one thing only). One may imagine, for instance, doing some key escrowing by encrypting the private key of issued certificates with the CA's public key, so that the CA may recover the private key under certain conditions (this is not a bad idea when the user's key is meant for data encryption).
Therefore, nothing prevents the Key Usage extension from containing other flags. Alternatively, the Key Usage extension may be missing altogether; this is equivalent to "all usages allowed".

Microsoft's "Off-line CRL signing" is just another name for "CRL signing". Indeed, the page you link to says this:

To apply this key usage if a CA certificate is requested, type the following at a command prompt, and then press ENTER:
echo 03 02 01 06>File_Name.txt

We here recognize the ASN.1/DER encoding of a BIT STRING of length 7 bits, with bits 5 and 6 set, and bits 0 to 4 cleared; this is the encoding of a Key Usage extension with flags keyCertSign and cRLSign. Though they use their own terminology, Microsoft actually conforms to the standard for that point (they did not invent a new, non-standard key usage flag for "offline CRL signing").

All of the above is the normal interpretation of certificates. It so happens that, as far as standards are concerned, "root CA certificates" do not exist. A "root" is called a trust anchor and consists in, mostly, a name (DN) and a public key. It is Traditional to encode trust anchor as "certificates", i.e. sequence of bytes which follow the encoding rules of certificates (such certificates are often self-signed, because the format for a certificate has a non-optional slot for a "signature", so there must be something in that slot).
Since this is non-standard, interpretation of certificate extension in such a certificate-like structure is open to local variants. Some implementations interpret the Key Usage extension in a root certificate in the ways explained above. Some ignore that extension altogether.
In general, it is safe (for interoperability) to fill root CA certificates with contents which would be perfectly valid if that "certificate" was a real one, instead of a convenient encoding vessel for a trust anchor.


securities concerns about calling REST API from multiple servers There is a master web application that needs to call REST APIs from servers of other applications. I can think of two ways to achieve it:

a). call APIs on the front-end of the master application(javascript)

// javascript code of master application
$.ajax(api_server1_url,{
  ...
})

b). call APIs on the server of the master application

// backend code of master application
call_api(api_server1_url)

Both a and b return json result for further user in master application.

If I have the access to the code and servers of all the applications mentioned above, is option a or option b a better practice security-wise?

very new to the security, but I'll list what I know(not much..):
a has cross-site-scripting vulnerability. I think it's possible to eliminate or limit it by changing code on API applications, but it will take effort.

That's why I prefer option b. Though code on API servers still need to updated to prevent attack, but it should be easier than option a. Only allow the ip of master application to access the API servers should be sufficient.

So my question is:

Is my assumption about b is better a right?
If not, what security measurement do I need to implement on API servers?

Thanks for any input.

Question Restatement:

In application architecture, what is the most secure way way to delegate calls between Javascript APIs:

To allow the end-client to call the hosting API directly; or
To delegate the end-client's call through a front end-server.

Possible Context: This concern could be most applicable to Node.js where application logic is implemented via Javascript -- otherwise, I am still not certain I understand the question correctly ... :

Quick Answers:

Here are some links about securing REST APIs, hopefully to help focus the question a little -- but I am not certain if this is the question:

OWASP Security Cheat Sheet
https://stackoverflow.com/questions/7238094/securing-rest-api-without-reinventing-the-wheel
https://securityledger.com/2015/08/the-challenge-of-securing-rest-apis/

Answers - Multi-Tiered Architecture is Not Security:

Application Architecture is very different from "Secure Application Development".

No matter how you architect / structure / partition the functionality -- it will not secure the application -- but only allow the basic framework so you CAN secure it.

In your question, you are actually discussing "Multi-Tiered Architecture".

And, if not architected correctly -- you do preclude yourself from being able to secure the application.

These are the main principles of Multi-Tiered Application Architecture, that I think you are referring to:

Loosely Couple the Client and Presentation Logic to underlying Business and Integration Logic -- Decoupling completely from all Data Logic.
Loosely couple the Integration Logic, (B2B interfaces, etc), to Business Logic -- completely decoupled from Data Logic.
Loosely Couple the Business to Data Logic.
Never allow access from one tier, to the tier above -- only down ONE tier, (Presentation to Business, and Business access to Data, but not Presentation directly to Data, nor Integration directly to Data, but Integration to Business is fine.

However -- even when properly implemented -- you must secure the interfaces between each tier, otherwise -- it is just as vulnerable as if everything was running on the client.


What are the security implications of allowing guest checkout using an email bound to known account? For a webshop, we allow customers to place an order either as a logged in user, or as a guest.

Guest checkout in itself is a quite common feature for webshops. The webshop in question is selling physical goods, so customers will still be required to fill in their name, email and address information. As such, a guest order is by no means an anonymous order.

Analysis of web traffic has shown that even if the customer has previously created an account, the may, for various reasons, not want to log in when they make a purchase. In these cases, the fact that they created an account on an earlier date, serves as a barrier to what they want to accomplish: place an order.

Because we would like to minimize barriers (in order to optimise conversion), somebody suggested that we could allow guest-checkout for customers with an email address, even if the email address has previously been used to register an account. Registered accounts are bound to an email address. This registration functionality already supplies a would be attacker with an attack surface for email address enumeration.

In other words: even if an email address is bound to a registered customer, a customer should be allowed to checkout as a guest, with said email address, without logging in.
Orders placed this way would be treated identical to any other guest order, whioh means that they would not be visible in the order history, etc. that is available for users that placed orders while logged in.

So, my question is:
Would the above scenario open up any unexpected security implications?

There is no concern if you are not disclosing anything to anonymous users. When the email address on a guest order matches an existing account, you should proceed as if that account didn't exist. Prompting for a login after getting that information can indicate that the account exists.

Always guide users to the ideal workflow. The use of an established account will make auditing easier for both you and the customer. The availability of order status and history are frequently useful for reasons not directly related to your security. If the customer is expecting order history, then a gentle reminder to login is actually helpful.

When in doubt, ask. I would give the customer the option to login or checkout as guest as the first option after proceeding to checkout. This option should be given before asking for identifying information such as name, address, or payment details. You could encourage users to login by populating billing/shipping information from their account, if you were so inclined.

Mitigate brute force attacks. Regardless of whether you implement a guest option, your process for recovering registered accounts should not indicate whether that user/email is registered. This is somewhat tangential to guest checkout, but it is related since users may checkout as guests because they forgot their credentials. Personally, I would rather reset my password and use saved info than dig out my credit card.

E.g., ask for the email address associated with the account, then display the same message regardless of whether an account exists, e.g.,: "We are searching our database for an account associated with the email@address.com email address. If we find an account, we will send instructions for resetting the password to that address. This may take a few minutes."

The email can explain/link your password reset process on a match, or it can advise them to choose between creating an account or checkout as guest in the absence of a match. As long as the existence of the account is only disclosed in an email to the account owner, there is no appreciable risk.


C Security Code Review I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are primarily related to how developers manage memory.

I'm aware of Microsofts list of banned functions not to use when writing in C -- and yes, these can be quite helpful when doing code review. I was wondering, when reviewing C code, if there are  any additional methodologies that are useful to follow or resources to use?

Without an understanding of the underlying language, one problem you may have is understanding context.

While it may be best practice to eschew these banned functions completely, I see a lot of projects where some of these functions are used, but in safe contexts. If you raise a red flag simply every time you see one of these functions in use, you may have a bad time.

Here are some examples using the infamous strcpy and its slightly safer version strncpy:

void foo_1(char* bar) {
    char buf[100];
    strcpy(buf, bar);
    puts(buf);
}

char* foo_2(char* bar) {
    char* buf = NULL;
    buf = malloc(strlen(bar)+1);
    strcpy(buf, bar);
    return buf; // freed later
}

void foo_3(char* bar) {
    char buf[100];
    strncpy(buf, bar, sizeof(buf));
    puts(buf);
}

void foo_4() {
    char buf[100];
    strcpy(buf, "This is just an example.");
    puts(buf);
}

If I did this correctly, these examples should be:

Unsafe (if bar is longer than 100 bytes, an overflow will occur)
Safe (buffer is created large enough)
Unsafe (produces un-terminated string when there are no null bytes in first n bytes of bar)
Safe (string is constant and smaller than buffer size)

From the strcpy manpage:

  If the programmer knows (i.e., includes code to test!) that the size
  of dest is greater than the length of src, then strcpy() can be used.

If these examples are challenging, you may want to brush up on your C programming, as these are by no means complex examples.

Additionally, while the "strn" family functions also may appear on the banned list, many projects use these safely as well by forcing a null byte at the end, often done with a wrapper function.


Should a windows IT shop have concerns about enabling WSL for users? I work in a place that only supports windows, and the folks in charge of IT are (1) very conservative, and (2) not at the bleeding edge of their profession.

I want the Windows Subsystem for Linux (WSL) to be enabled in order to facilitate data science work -- stuff that simply works better on linux.  I'm thinking specifically of forking for parallel processing, but also basic utilities like curl, tmux, htop, sed, awk, etc.

In trying to make the case to these people that WSL isn't a threat, I see conflicting things online.  Google "WSL security" and you come across articles about bashware.  Apparently a hacker who has gained access to a system can run WSL, install wine, and use it to install windows malware.

According to this FOSS article however, WSL is now integrated into defender.  Does that mean that the malware problem is solved?

I'd appreciate arguments for or against enabling WSL in a conservative, risk averse windows IT shop.  Is it actually risky?  Why or why not?

Depends how much they're trying to lock down Windows users, and how. If they limit which programs you can run, then WSL is a bypass for that; most tools that filter Windows programs will ignore Linux ones running on the same kernel. If they give you local admin, though, they may as well let you run WSL; you can't do anything in WSL that you can't do in Win32, with enough effort.

It's worth noting that WSL doesn't actually give any additional privileges. A WSL process launched as (Windows) Administrator has Admin privileges on the Windows filesystem (and any Windows processes it launches will inherit those Admin privileges), whether or not the WSL shell is running as root. Similarly, a non-admin WSL shell, even if elevated to root, has no more privileges on the Windows filesystem or kernel than the non-admin user that launched it. This actually caused bugs in early versions of WSL, where you got things like ping not working because its setuid root bit didn't actually give it the ability do anything extra with network sockets (which are controlled by the NT kernel's permissions).

Every Windows user gets their own, isolated WSL installation (if they use it), with its own users; you can't even attack other users on the same physical box using WSL (unless you'd be able to do that from within Win32 anyhow). The main things that WSL does for security impact are to confuse or bypass some monitoring and/or software restriction tools, and open up some additional kernel attack surface (as far as I know, nobody has used WSL as an exploit vector into the kernel, but I'd be surprised if there isn't one in there somewhere... just like I'm sure there's still more vulns to be found in Win32k.sys).


Is there a sms authentication that works like 10minutemail? I remember reading on this site a user recommending 10minutemail.com as a way to register or give email address to non-trusted websites.

Is there any similar site for disposable phone number for receiving a sms online?

I am trying to protect my phone number, while be able to still access websites without disclosing such information that I have reserved  for family & friends.

It's not really quick or disposable, but getting a Google Voice account will also let you accept SMS messages to that account, and that's what I use for all of my sms verification. It gets spam SMS regularly.


CSRF prevention understanding I was searching around about CSRF attacks and I am thinking about the "random form token" prevention concept.

Let's say every form has a "hidden token" inside and the server checks the token before anything else. Now let's say there is a form http://myWebsite.e.x/acccount/edit and it's supposed to be submitted.

The attacker can create an iFrame of this form to his website (token generated), hide it and then submit it using JavaScript (and victim's cookies).

What am I missing here?

You're missing the same-origin policy. In order for your scenario to work, the attackers needs JavaScript code from his page to be able to access the iFrame. That's not possible.

Remember this rule: A window/frame can not talk to another window/frame without the target window/frame allowing it (by the use of messaging, for example).

In your case, the target frame won't allow it. So the attacker won't be able be able to access the iFrame's DOM to grab the token. He can't programmatically submit forms or send requests through the iFrame either.


"Mousejack" a wired (non-wireless) mouse Is it possible a wired mouse can be a malicious device? For example, could a keylogger be installed within a wired mouse that captures keystrokes and sends these to an external server via the internet connection of the computer it is connected to?

I recently ditched my wireless mouse for a wired one after learning about the "mousejacking" risk. But why should we have more trust in a wired mouse (or any USB device for that matter)? The mouse I bought was not in a sealed packet, so theoretically it could have been intercepted at any point along the supply chain and had some malicious hardware device installed within it.

My question relates specifically to the security of USB devices - if a wireless mouse USB dongle can also accept keystrokes, can a wired mouse also contain a device that masquerades as a keyboard and sends malicious  keystrokes/commands?

The OS I use is Linux, so I am interested whether Linux is more secure in that respect (for example, not accepting keystrokes from a mouse). But I think the answer to this question would be useful for users of other OSes too.

There's actually an attack documented which fits pretty good to your description. The original post was deleted but you can read it for example here.

Short version: They (Netragard) managed to break into a corporate network in a penetration test by using a manipulated mouse which was sent to an employee as a faked lottery price. The USB connection was intercepted inside the mouse with a tiny USB hub where a rubber ducky or a similar device was connected.

This schema is called trojan devices. There's also a Blackhat talk about this topic.

  The OS I use is Linux, so I am interested whether Linux is more secure
  in that respect.

AFAIK there are no pre-configured defenses against this but you could harden your system by creating a whitelist of devices which are allowed on specific ports. (udev rules to the rescue!) When you have only one port whitelisted for accepting a simple keyboard without USB hub or re-programmable firmware you're pretty safe against any manipulated devices which are trying use trojan device techniques to emulate user input. Alternatively you could get rid of USB keyboards in your whitelist entirely by using the PS2 port instead.

I'm not aware of any build-in defenses in other operating systems. However there's some software around for windows which does a similar job like you can do with udev on Linux.


How does WebRTC bypass a VPN Tunnel While reading about WebRTC I was wondering how exactly the default route through an established VPN tunnel is being bypassed. If I'm not mistaken the VPN tunnel is normally represented in the system by a virtual network adapter to which the default route can be set to route all internet traffic through it (corrections and amendments welcome). So, does WebRTC have to choose the physical NIC used to connect to the internet instead of the virtual tunnel adapter to do it and if so, how is this being done?

WebRTC uses ICE to generate a list of IP address that can be used to reach your computer. This is important when trying to establish a direct connection. However, this list can sometimes include IP addresses that the user would rather not disclose. As explained here, this behavior is counterintuitive when using a VPN as their actual IP address can be discovered with WebRTC:

Many such users assume that using a VPN will obscure all their browsing and their real external IP address, which could be used to locate them.
However many VPN configurations don’t properly disable local interfaces, and so users of those VPNs might be surprised to learn that their real external IP addresses are exposed by ICE.

So, if your browser is giving out your real IP address, it becomes possible to create direct connections to that interface, bypassing the VPN.


Are there any objective reasons to use dedicated user/password instead of identity providers within a large organization? I work for a large organization (thousands of employees + maybe tens of thousands of external users that have partial access to a fraction of internal information) and many of these people authenticate using username/password (which expires regularly).

However, most of these people (for employees is certain regardless if they typically work on Windows, Linux or iOS) are provided with an Active Directory account (internal e-mail address) and AFAIK all of our systems allow signing in using ADFS / Active Directory/LDAP Identity Provider.

Even for those external users that have very limited access (e.g. for some reports) we can implement a solution using a major identity provider (e.g. Google Identity provider), if ADFS is not allowed.

Having usernames/password creates a burden for the users and many are using Excel files and e-mails to store them which poses a security risk. Also, I have heard of user sharing, so one cannot possibly know who actually used a certain user.

So, by exclusively using only Windows credentials and maybe some other identity provider, the user has to take care only of one pair of credentials when dealing with all company's systems. Also, credentials sharing will disappear.

Question: Are there any objective reasons to use dedicated user/password instead of identity providers within a large organization?

For most organizations, a comprehensive unified identity system is a positive thing. You asked if there are any reasons not to do this. I'll list a few which may or may not be valid in different organizations:

The system does not support the identity provider. You may have a legacy terminal-based mainframe system that it is not easy to link to AD. There are many commercial products to link legacy products to identity systems, although these can be costly. Alternatively, you may have cloud-based systems (like Salesforce) that you struggle to integrate with.
The system is sensitive and you don't want to expose it in case of a breach of the identity system. This may be valid for a small number of highly sensitive systems, although this argument is over-used in enterprise environments. If your identity provider is AD, a breach of AD is likely to mean a breach of all the workstations that people would user to administer these systems, so separation is little more than security theatre.
The identity provider is not accessible from the system. A common example is Internet-facing systems in a DMZ that are blocked by a firewall from accessing the internal AD. I've seen large organizations that create a separate AD for DMZ systems. A similar issue can occur with development vs production systems.
Some users are not part of the identity provider. The classic example is where you have a few external users accessing an internal system. You can deal with this by having the system support multiple authentication methods, or allowing the external users to be in your identity provider, with appropriate restrictions.

Whether the difficulties of integrating a system with the identity provider are worth the benefits is a balancing act. Most IT admins accept that managing a horde of credentials is part of the job.


Deniable proof of authorship The title may read like a contradiction, but I would like to know whether a cryptographic solution exists to the following problem:

Problem statement

Suppose Alice wants to write a document using a pseudonym, so that, in general, people cannot connect her with her work. However, Alice may want to convince Bob (with at least a high level of confidence) in certain situations that she indeed is the author. At the same time, Alice does not want Bob to be in possession of a proof linking the author to the work. That is, Alice does not want Bob to be able to convince Charlie that Alice is the author of the document.

Motivation

This may be useful in a setting where, say, a programmer might wish to publish code, or information pertaining to security research, without publicly associating himself with the information. Nevertheless, when hunting for a new job, the author may want to convince prospective employers of his abilities, but not give them proof that could de-anonymize him to the public at large.

Amateurish thoughts

I am not a cryptographer, but here are my thoughts so far:

Alice chooses a pseudonym, along with an RSA keypair, and sets up a public repository on e.g. github, which acts as a trusted third party, proving that certain data had existed at certain points in time, and recording all public manipulations thereof.
Alice signs all her commits with her private key, and at some point interviews with a new employer.

Alice might offer to log into her pseudonymous github account and make publicly visible changes, but the interviewer might argue that she shares her login info with someone else, who might use the account in other interviews.

So I guess that Alice would have to upload data early in her publication chain that is advertised as the only and definitive proof of identity (such that there are not multiple hidden proofs for various real names). She may, for example, upload a cryptographic hash of a string that contains her name, followed by a secret random string known only to her. However, if she gave that string to an interviewer, the interviewer might save that string and show it to others, who then would also be convinced of Alice's authorship. Alice could offer to enter the secret string into devices only she controls, but then the interviewer might object, as he has no proof that the program really does compute the intended cryptographic hash.

Is there a way to achieve what I am after? The fewer assumptions necessary (e.g. trusted third parties), the better!

I'm going start by summarizing your want.

You want to:

Publically share information
The cannot be definitively associated to you
Unless you are present to defend yourself
In a way that cannot be reproduced by someone else

The answer would be a hardware based security solution for authentication, and an authorization system that requires the hardware based authentication in addition to another authenticator type (Something you know, something you are). So let's play with Github, as an example.

Github today allows people to create a Multifactor logon experience with a device such as the Yubikey. By enabling this feature, the access to your account is secured with a private key which cannot be shared and exists solely within your device. This, in addition to your password will always be required to authenticate to Github which you could even set up with a pseudonym of your choosing.

Once this is set up, you will have the ability to provide non-repudiation at your demand. You logon when you want to, and the logs indicating account changes can verify you haven't just thrown on the key to be impressive. You can show explicitly when the account was MFA enforced and even the last few logons. All good things.

The benefits of this approach is that only the holder of the Yubikey can actually access the account. This provides you the opportunity to share the data publicly without losing the ability to control who owns the original repository. Your interviewer could not login as you to prove that they know who built it, though you won't be able to overcome any trust that may exist. Meaning, if I trust your interviewer and they share who you really are that's beyond your scope.

Let me know if this is heading down the right direction and I can ellaborate further.

(instructions for yubikey configuration: https://support.yubico.com/support/solutions/articles/15000006469-using-your-yubikey-with-github)


Why does "" in a JS string cause a broken page/denial of service for that page? I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>.

However I found a weird combination that still breaks my page. The text "Won't print" won't be output onto the page. The HTML comment alone is fine, the script tag alone is fine, but the combination of the two is lethal. Why is that?

<!DOCTYPE html>
Before
<script>"<script>"</script>
fine
<script>"<!--"</script>
still fine
<script>"<!--<a>"</script>
fine again
<script>"<!--<script>"</script>
Won't print

Will display as "Before fine still fine fine again". "Won't print" will be treated as part of the script tag, which will be treated as unclosed.

The correct answer to this is "because the HTML parser in the spec says so".

From the normal "inside a script tag" state, An HTML comment start (<!--) puts the parser into an escaped state, and from that mode a script start tag (<script>) puts into into a double escaped state in which script closing tags (</script>) are ignored.

Why on Earth does it do this? Backwards compatibility for inserting code into browsers that didn't support JS. Chaals gives a great answer on https://github.com/w3c/html/issues/1617, and I'll show his example of what was once normal code here:

<script>
  <!--    //hide from non-JS browsers
  function doSomething() {
    var coolScript = "<script>" + theCodeICopied + "</script>";
    document.write(coolScript);
  }
  // And if you forget to close your comment here, things go funnny
  -->
</script>

So now we're stuck with this page-breaking vulnerability unless you escape both start AND end script tags.


Security risks of file upload-download systems I know that there are many posts about these topic. But those posts usually talk about restricting the file types and sizes on so on. Hence non serves to my needs as my system does not have any constraints.

Let's say we have a web application, which accepts uploads from users logged in. These users are authenticated via Active Directory. Anonymous users are not allowed.

Users can upload any type of file to the system. Then users can preview the files uploaded via our multi purpose viewer. Right now we support some basic file types, like pictures, music, video, pdf files and office files. I decide for viewable types by checking a dictionary for viewable types, and if the type don't exist it won't be previewed but downloaded directly.

I am curious about the security risks I have, hence I will try to elaborate my system.

I have two different systems in terms of file keeping procedure:

An internet application where the storage is a structured file system where file names are changed with guids
An intranet application where the storage is an unstructured file system where files are directly on the network drive as the user uploaded them, and users can access the files via network drive too

For both applications the previewing strategy is the same.

All files are served from an action method which can only be accessed while authenticated. And logical path traversal for the uploaded files are allowed.

The non-office files are returned to the client, and shown in img, video and embed html tags.

On the other hand, the office files are first executed via interop libraries of the Microsoft Office, converted to pdf, then returned to the client, and again showed as a regular pdf.

I am wondering, through these processes am I compromising any security here on the server side? I know that user can upload malicious files, but is there any way user can harm my system upon writing or reading process of the files?

Usually regular path on web hacking could be in a quick summarized way something like:

Find a vulnerability (scanning, fingerprinting, etc)
exploit the vulnerability
Write some kind of evil payload/shell or whatever
Access/execute that evil stuff
More and more non-important for this question steps after this.

On your system, the third point is free!. I'm not saying you are going to be hacked. But with a system like this you are putting the things a little bit easier if previous steps are completed, that's all.

Remember that only one weak point and everything is possible. Of course the most dangerous is the direct command injection. If there is no present ok, but maybe after exploiting other vulnerability could be possible to launch some kind of command in the system, for example through SQL injection. Depending of the systems, databases and versions, could be possible to execute system commands from the database.

So, beware of ALL! XSS injection, SQL injection, command injection, CSRF, RFI, etc.

And of course, check the version of ALL your components (web server, kernel, operating system, etc). If you use one component with known vulnerabilities maybe you can be hacked even with a good development in the app side.


Authentication using a digital signiture I'm new to the world of digital signatures and encryption and I'm trying to learn more.

I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital signature or not.

I've thought of a scenario in which:

A user creates login credentials (username, password and PIN code).
The password and PIN are used to create a private key.
The user tries to login via username & password. The password is compared to the one stored in the database and used to generate a key, which is also to be compared. If both match, then the user can login.

Does make any sense or should a public key be used?

Client: I wanna login!

Server: Okay. Here's a piece of data. Do something to it that only you could do!

Client: Okay. Here 's your data back. I've added a signature with my secret key.

Server: Lemme just check ... Okay, welcome in!

This is a less than formal description of a challenge-and-response authentication protocol that uses signature. ;)


Why are primes reused in Diffie-Hellman key exchanges? Reading about the Logjam attack, I learned that Diffie-Hellman exchanges often* rely on the same particular 1024-bit key. I understand that back when DH was invented, even 512-bit keys were considered secure for decades to come. But did it never occur to the designers, or to many of the programmers who have worked on DH implementations over the years, that reusing the same primes could lead to an eventual (catastrophic) vulnerability?

Am I missing something with the computational difficulty? Generating your own p and g once, at the initial configuration of the service, ought to be enough and should guarantee immunity from any flaws with the standardised primes.

*: As in, two-thirds of current worldwide implementations often.

You can look the following questions about difficulties in generating your own DH key exhcange parameters and also using the standard DH group parameters: Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526? and Where do I get prime numbers for Diffie-Hellman? Can I use them twice?

  For plain Diffie-Hellman, what you need is p, q and g, such
  that:

  p is a big enough prime (2048 bits are more than enough nowadays);
  q is smaller, but still big enough (say 256 bits), prime value which divides p-1 ;
  g is a generator of a subgroup modulo p with an order that is a multiple of q.

In most situations, it is not easy, and also not applicable, to create a DH key exchange group before the actual key exchange occurs. Note that, logjam exploits small primes used in DH groups(512 bits). I think, you should be safe if you use a DH group with a p of 2048 bits even if the the group is used by others too.


Blackbox vs whitebox testing your own site? When performing a security audit of one's own site is one of these methods of testing generally considered better?  Would I be wasting my time by doing blackbox testing when I have access to information about the underlying system or are there benefits to blackbox testing one's own site?

Blackbox testing gives the perspective of an external attacker while whitebox testing generally gives the perspective of an internal attacker. Those perspectives have a big intersection but have exclusive coverages. Even whitebox testing tending to be easier to do and sounding more effective (not always true though, sometimes whitebox is much harder), tests created by an attacker with no inside information tend to follow a logical path that whitebox testing initially discard, creating a chance of overpassing a vulnerability.

Security is always a trade of cost and benefit. You need to put into balance the chance and the amount of damage of an internal attack versus the cost of whitebox testing. Also do the same thing for an external attacker and blackbox testing. Keeping this cost/benefit relation in mind you can choose one of the the approaches or even both


What is a secure way to use PHP tokens in a C# application I have a C# app that is sending post requests to and from a php script. I have token based authentication setup on the php, and I have my C# app sending the tokens, however, even with obfuscation, if someone gets my token string, having it there in the first place is useless. Is there a better way to do this kind of security? Is it impossible considering someone can just deobfuscate my source?

It sounds like you, as many before you have done, are trying to make it so only an "authorized" client can access your online API (presumably a web service). This, as you suspected, is impossible. You can take many steps to make it harder for somebody to write a functional unauthorized client (obfuscation, encrypting the tokens locally, blocking the use of an intercepting proxy by employing certificate pinning, various other DRM schemes, etc.) but at the end of the day, if you give users a working client, they can (and, if they have any reason to bother, will) duplicate everything that client does so that your server thinks it's legit.

The bigger question is, why do you care? There are generally only a few reasons people try to prevent unauthorized clients:

They are putting too much trust in the client. An example might be an online game where the client tells the server whether or not the user won, instead of the client telling the server what the user did and the server deciding who won. Never trust the client.
The service is expensive to use in some way (monetarily, computationally, storage-wise, whatever) and they want to limit how frequently requests can be made to it. The correct approach here is to require authentication of the user, rather than the client, and either charge the user or limit the number of requests they can make.
They don't want people automating interaction with the service, for example because it's a game with a lot of repetitive behavior and they don't want people writing bots for it. In that case, tough. There's only so much that can be done against this, and it usually comes down to some kind of human review of replays or something like that to detect cheaters.
They want to only support specific users (for example, they don't want to bother with a Linux app) and are worried that if somebody ports their app then they'll get bombarded with support requests for code they didn't write. Honestly, there's no good way around this one (aside from trademarking your service name and using legal threats against anybody who tries to publish something as you, but that doesn't stop them from publishing something that is "an unofficial YourService(TM) client").

If it's something else, please add the relevant info to your question and I'll address that. Overall, though, it cannot truly be done. You cannot give somebody the key to a door but prevent them from copying it or sharing it.


Understanding sqlite3 sanitization in python I use sqlite3 for my database and get data from untrusted source with
flask.request.get()

I insert all data with such syntax
c.execute("INSERT INTO table (e1, e2) VALUES(?, ?)", (V1, V2))

as recommended here. My question is
How does python-sqlite3 sanitize these requests? What happens in case the entry type is BLOB? Since BLOB has to be written as it is, what constraints will sanitization put on it?

This is making a prepared statement. It won't sanitize the inputs. At a low level, it's probably using the sqlite c api, and it would look something like:
stmnt = sqlite3_prepare("INSERT INTO table (e1, e2) VALUES(?, ?)")
sqlite3_bind_int(stmnt,0,V1)
sqlite3_bind_blob(stmnt,1,V1)
while((row = sqlite3_step(stmnt) != SQLITE_DONE){
    //do something with the rows
    ...
}

This is just pseudo-code but you get the idea. You can see the values being bound don't need to be sanitized because they aren't concatenated with the string. The sqlite c api is described here.


eset smart security root certificate injection I dont know a lot about this subject but - I am trying out ESET Smart Security version 9 which includes the nod32 product (antimalware/virus) and I received an error regarding the addition of a new ESET root certificate in all of my browsers. I am running Windows 10. Upon some basic research it seems that in order to monitor and protect the user from malicious SSL TLS connections, a root certificate is added for ESET. I believe this allows ESET to act as a "middle man" between the connections allowing the software to inspect the web traffic for further action. I'm guessing that this is related to the "internet security" aspects of the software bundle and probably is not included in the base "Nod32" option.

My questions and thoughts are around -

Is this common for modern day antivirus to inject its own root cert to preform MiTM?
ESET forums seem to indicate that I can disable this feature and remove the root cert as long as I accept the loss of protection. Would this be wise?
Is it accurate to say that since this root certificate exists, they (ESET) can see all of my web traffic in an UNencrypted format?
In order to obtain a state of security, does this now require that one abdicates some of their privacy?
Should I disable the feature or look for another product?

** related thread by another user: Kaspersky Antivirus "secure connection scan" as broken as Superfish?

** Since posting this question, I've contacted ESET and "complained" about the root certificate and asked for some clarification. Their only suggestions was to disable the feature in the settings and to remove the root certificate. For what it's worth, this seems to remove the majority of the functionality for the "network security" function of their products.

probably is not included in the base "Nod32" option.

AFAIK it is included too as also NOD32 scans the connections.
FYI in previous versions of NOD32 and ESET Smart Security this feature was disabled by default.

  Is this common for modern day antivirus to inject its own root cert to preform MiTM?

Well... At least there are some well-known AVs, which do this.
And it is a very controversial topic. Especially with the recent Superfish issue and similar ad software doing the same, it may be considered a bad thing.
Of course antivirus software has a different aim than ad software, but it deploys the same technology.

It is a very easy way for an AV to inspect all the (usually encrypted and therefore not analysable) ssl/tls traffic.

  ESET forums seem to indicate that I can disable this feature and remove the root cert as long as I accept the loss of protection. Would this be wise?

If you do not like that your encrypted connections are broken by ESET, yes. Usually all AVs also scan files when they are saved on disk, so you are not without malware protection in this case.

  Is it accurate to say that since this root certificate exists, they (ESET) can see all of my web traffic in an UNencrypted format?

Yes. At least if "they" is "the ESET software using this technique". What they do with this information is another thing.

  In order to obtain a state of security, does this now require that one abdicates some of their privacy?

Again, this depends on what the software MITM your connection do.

  For what it's worth, this seems to remove the majority of the functionality for the "network security" function of their products.

It only affects encrypted (TLS/SSL/HTTPS/...) connections. You can still scan and block all non-HTTPS traffic.

As for the general issue

The general issue is that you give all trust implied with HTTPS/SSL/TLS from your browser to the software MITMing you. This matters for privacy reasons of course and also for security reasons as the implementation of such a complex protocol such as HTTPS/SSL/TLS is difficult and there may be flaws, which seriously weaken your security.
Examples were e.g. Kaspersky. Examples of vulnerabilities are:

the private key for the certificate is reused (as it was the case with Superfish e.g.), this allows anyone to MITM the connection just as the software using the root certificate can
old, deprecated protocol versions (e.g. SSLv2 or SSLv3) are still supported although it is known they are insecure
they support old ciphers (RC4, ciphers with MD5, ...)
...

As also outlined in the article I linked above - which I recommend you to read - such security software quite certainly also decreases the security of your HTTPS connection as they might not support some bleeding-edge (or even not so bleeding-edge) technology, which improves the security of HTTPS.
Examples are HSTS, HPKP, HSTS Preloading, HPKP Preloading, Certificate Transparency and so on...
It all depends on the implementation. Browser vendors had years implementing these features correctly and are constantly improving it and implementing new features, so it is very hard for AV vendors to keep up and - which is import - implement it correctly.


What data leaks when an android apk is built? Scenario: a developer crates an android application using Android Studio and shares th APK file over the internet.

What data (if any) about the developer can be found inside the APK file? Host operating system, hostname, user name, key fingerprints..?
Is it possible to remove every reference (if any) to the application developer without breaking the APK file?

You can get Developer ID, name, location, organization from the certificate. Thou developer id or details may change in the play store, the original cert are always in use especially if the developer is providing and update to their apk.

Developer changing details in the play store does not change their original certificate.

Android requires that all APKs be digitally signed with a certificate before they can be installed.

A public-key certificate, also known as a digital certificate or an identity certificate, contains the public key of a public/private key pair, as well as some other metadata identifying the owner of the key. The owner of the certificate holds the corresponding private key.

More information regarding the certificate details can be found at android developer site


Does an ethical hacker need to stay anonymous? so I am currently following a few online courses about ethical hacking and really want to become a bug bounty hunter/penetration tester but most of them do not teach anything about stay anonymous online or staying anonymous when scanning so do ethical hacker really need to stay anonymous or not since they are granted permission to hack?
In addition to this, shouldnt they still stay anonymous in case the firewall triggers and get them in unecessary troubles or even real hacker messing with them? So I guess my main questions is do you guys stay anonymous during penetration testing/ vulnerability analysis,etc and what are the most popular way to do it.

When you find yoursel wondering whether something is or not ethical or reasonable in IT world, just try to transpose it in real life.
Searching for exploits or security flaws in an information system is like trying to enter into a closed building. Serious companies do hire specialists to show them possible problems in their security. But when they find someone that was not asked to do that trying to enter in their building, they call the authorities before asking the guy for his motivations.
Transposing it into the IT world means that if no bug bounty program was published, and you have no contract (whatever the legal form) that allows you to search for exploits into an information system, doing it is clearly an attack and can lead to legal action against you if you are caught. And only in that case you need anonymity.
Now for your question.
If you have a contract with a company to search security flaws in their system, anonymity does not really matter because they already know you. If there is a bug bounty program, anonymity will only make harder for them to retribute you. That is the real why anonymity is not really a concern for white hat hacking.
It is only in what I would call grey hat hacking: trying to find exploits more or less at random with no authorization even if with no bad wills. But as I said above, this is not allowed, is likely to be seen as offensive, and could lead to legal actions. My advice is to just avoid it.


Sell ebook online without disclosing my identity I write short erotic stories that I want to sell safely online.

Is it possible to sell an ebook while protecting my true identity from the buyers?

Say I use a free Wordpress + Stripe + SimpleGoods. Will my identity be protected from the buyers?

Stripe and SG will know about me but I guess they don't publicise there customer's identity.

First, I am not in the USA and I will pay my income taxes. Its all about content: there is no need for my neighbours to know what I am writing.

The books will be in ePub format and I will check for metadata!

Stripe is an online payment process. They will know who I am since they need to link to my bank account. At Stripe, they told me that all my personal data is hidden to the public. They also told me that I can put whatever name I want on the bank statement (or receipt). So Stripe should hide my identity to the public.

SimpleGoods (SG) is an online store for digital products. They store the file and see after the purchasing process (copy/paste a script). At SG, they told me that buyers will only see my "business name and email address". There again, my neighbour won't know who wrote that book since I can use whatever name and email.

SG works in HTML pages, Wordpress, etc.

I did some research and I came up with this "checklist". What do you think ?

use a second-hand computer,
only on public wifi connection (public library, etc.)
with Tor, Tails and / or VPN
use 3 different emails (Protonmail, Mail2Tor…) with names never used elsewhere (one for: Stripe, SG, WordPress)
open a free WordPress
publish the book under a nom de plume and watch for the metadata!
use temp emails for promotion

The second-hand computer and emails should disconnect the book from myself. I believe that Protonmail does not store IP addresses. The public wifi should further disconnect the book from me.

I don't know which is adequate: TOR, VPN or Tails.

WordPress is straightforward. But there may be something better than WordPress. There is Wix, Tumblr, etc. I have just discovered Write.as but I think that I cannot use the SG script (no HTML).

I think that you are concentrating on the wrong issues.

You want to sell, as in get paid.
You want to protect your personal identity.

Implied with selling and getting paid is “marketing”. It’s unrealistic for a new author to completely provide their own promotional marketing and expect to make any money. There are many ebook sales platforms available to leverage your sales and marketing, Amazon being the biggest, so plan to use one or more.

  I know you said “epub” format and Amazon is “azw”, but converting between them is trivial.

Protecting your privacy involves a “Pen Name”. As long as the purchasers see only the Pen Name that is your primary privacy.

In order to get paid, there has to be a path back to you. It’s just a question of how much privacy can realistically be maintained. Generally this privacy break for money is with the “Publisher”.

Many ebook sellers will provide this publisher break for you, but they will have all of your actual information in order to transfer payment.

If you feel you need another layer of privacy, you can become your own “Publisher”(Not “Seller”, you would still use Amazon or IndieBound or whatever.)

In the US you can create a limited Liability Corporation (LLC), as your “Publisher” (No Tell Publishing). Open a a business bank account under this publisher name, possibly with an additional “Doing Business As” addendum as another custom  name (“Late Night Reads”). Set up all the payments to the business publishing bank account.

The weak link is the money path. Just use a VPN, or Tor if you’re determined, to break the link between you personal machine and the sales platform when uploading books or otherwise interacting. A second computer or a VM or TBB to thwart fingerprinting should be sufficient. All the jumping around with public WiFi is completely unnecessary. A single anonymous email should be sufficient, compared to the money trail.


Changing private keys My question is a bit of weird one and doesn't apply to me so much as I'm just curious.

My question is:

If a large company (say, Google, Facebook, or a bank) were to have its private key stolen, how long would it take to re-secure communications?  How long does it generally take to detect an intrusion like that, and once it's detected, how long does it take/difficult is it to change the key?  How many communications could be exposed between the time a hacker stole the key and the company is able to re-secure itself.

Any articles you could direct me to explaining this would be much appreciated.  Thanks in advance.

Actually, your larger companies like Google or Facebook do, in fact, have a certificate. This is a CA-level certificate (able to sign other certificates and thus vouch for those holders' identity) which is either issued by an external CA, or whose public counterpart is registered as being implicitly trusted by OSes, web browsers, etc. Call it the Golden Key.

From this certificate, the company will generate additional "intermediate" certificates. These are also CA-level certificates, which are then used to generate end-level certificates that identify individual servers, endpoints and even internal workstations within the company's "private key infrastructure". Such an infrastructure allows the sysadmin to drastically reduce the amount of his network that has to be "trusted" (in reality such internal communications are only "trusted" because it's considered infeasible to secure them).

If an intermediate certificate is stolen, it's disruptive but usually not the end of the world. An attacker can do a lot with any CA certificate that has an unbroken "trust chain" up to a globally-trusted root. However, as soon as reports of a certificate for Google, signed by one of an unrelated company's intermediate CAs, becomes known, the jig is up; the company will issue a "revocation" of the signed certificate, and if it's believed that the CA has been fully compromised, will revoke the intermediate CA itself. A revocation is kind of an anti-certificate; it's signed in much the same way as a normal certificate, but tells any computer to which it is distributed not to trust certificates with a given signature, or that have been signed with a particular CA certificate. Now, this will revoke trust in all the legitimate certificates as well, which as I said is disruptive, but the company can recover, typically by re-issuing new certificates to all known legitimate certificate owners.

This happens from time to time. Notably, it happened to Comodo, a company whose primary business is issuing certificates to other companies. One of its CA certs was compromised and used to generate fake certificates for Google and other major sites for phishing and other nefarious purposes. As soon as it was clear that only one CA was affected, Comodo revoked that CA, transitioned legitimate certificate holders to new certificates signed by other non-compromised CA keys, then generated a new intermediate CA from its Golden Key to replace the revoked one, and it was back to business as usual.

If the Root Certificate, the Golden Key, of a company is stolen, that's the end of the world, for the company holding it at least. Root CA certificates are among the most valuable things in the hacker underworld. As such, there is usually an extreme level of security inherent in the storage of any device which holds the Golden Key (typically a Hardware Security Module). You can watch this video, showing just some of the rigamarole behind the generation and storage of the Root CA certificate for the DnsSec extensions to DNS, which add proof of origin and denial of existence capabilities to the standard DNS framework. If a Golden Certificate is believed to be compromised, everything underneath it in the hierarchy is suspect; there's no way to prove or disprove the legitimacy of any certificate signed by it. Therefore, the only thing you can do is revoke trust in that root certificate completely and deal with the fallout.

This is much rarer, but it has happened. DigiNotar, a Dutch root CA company similar to Comodo, was the victim of multiple attacks that compromised the company's trusted root certificate; the private key was then used to generate fake certificates for a number of major websites. DigiNotar could not reliably identify all the fakes, could not therefore guarantee they had all been revoked, and could not even guarantee that its root private key had not been copied offsite. As a result, the major OS and browser writers responded by simply revoking trust in DigiNotar's root certificate altogether. Hilarity ensued, as DigiNotar was the root CA for several Dutch Government websites, including the counterpart to the U.S. IRS. Imagine going to www.irs.gov and being told by your browser that the site may be fraudulent; that's exactly what happened to visitors of the Dutch Tax and Customs Administration website. The Dutch government quickly assumed control of DigiNotar's intermediate CAs, and transitioned all their sites to other certificate authorities. DigiNotar had filed for bankruptcy by the end of the same month.


Are there any risks to matching user-supplied regex against user-supplied inputs? I have an IRC bot written in python3 that parses user requests for search and replace. Is there any risk of DoS or other attack by doing this?

Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking.  This means that the regular expression will take exponential time rather than linear time when applied to a string.  An attacker could construct a regular expression that takes the maximum amount of time to complete by abusing recursive backtracking which can result in a DoS attack if the time to process these regexes is much slower than the possible frequency of requests.

To mitigate this problem I suggest using NFA compiling to DFA regex implementation which you may have to create yourself or find as a module somewhere. Did some preliminary searches and didn't find much to report.


Am I exposing myself to attacks when running my test server while connected to a commercial VPN? I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming malicious connections are changing 'Listen 80' to 'Listen 127.0.0.1:80' in ports.conf, allowing only local connections (the part with 'Order Deny,Allow') in my Apache configuration file and also blocking incoming connections with the ufw firewall (well, probably too much than really needed but I do it the first time so better safe than sorry).

However, I wonder if the fact that I am connected to a commercial VPN used to encrypt my connection matter in this case. I use it because apart from working with my local server, I want to use the Internet in the meantime and be connected to that VPN.

I don't know if this is true but my concern is that normally if I wouldn't be connected to the VPN, I would certainly be reachable only under my computer's IP. And usually routers for regular clients are configured not to allow incoming connections (not sure about that). But when using the VPN, traffic is still encrypted when it is passed through the router and it is only decrypted on my computer. So that would bypass the normal configuration of the router to disallow incoming connections. Correct me if I'm wrong.

My questions are:

Is the fact that I'm connected to the VPN increasing the attack surface or decreasing it? Would it mean that I am reachable both under my computer's IP and the VPN server's IP? Or only the VPN server's IP? Does this impact security in some other way?
Will the measures I took to block malicious incoming connections (i.e. listening only on 127.0.0.1:80 in Apache, etc.) that I described in the first paragraph still work when connected to the VPN?

Bonus question: if my setup is insecure, what could I do better? My idea is that I could have my server inside a VM with network adapter disabled and do my VPN browsing outside of it in the host OS, would that be secure?

as long as you access it over 127.0.0.1, localhost, or any domain that will resolve to localhost (because those are routed over the loopback interface and not through your VPN) and you have the proper protections you listed (which means it will be available locally only and not over the VPN) you will be ok.


How can I find the source of traffic allegedly originating from my IP address? I have a problem that has been going on for at least 6 weeks.

I have Time Warner for my Internet provider and some websites hosted at GoDaddy.

From what GoDaddy tells me the reason I can not view my websites from home office and can't connect to  their FTP server is because of a brute force attack on their FTP server originating from my IP address. I had my ISP change my IP address and within 15 minutes GoDaddy had blocked me again because their FTP server was still getting the brute force attack traffic from my new IP address.

I figured it was a problem with GoDaddy, so I set up a new hosting account with 1and1.com but after 4 hours they were blocking my IP address as well because they say they saw too many failed login attempts, just as GoDaddy had.

So, I did a complete shutdown of all my equipment (2 times) for 8 hours overnight, and even unplugged the cable from the cable modem and they still claim that they're seeing the attack traffic coming from my IP address.   Neither Time Warner (my ISP) or GoDaddy seem to be able to help me fix this problem. I have run AVG, Malwarebytes, and Rootkit, but nothing has been found. GoDaddy had me send a WireShark trace and they did not see anything, but they can not look at the packets hitting their FTP server because of the volume. I am at the highest level of support at GoDaddy, Time Warner and 1and1.com, but they are are baffled and keep blaming my machine even when I've had it shut down.

I would appreciate any help, as I am about to give up building websites because of this.

First and foremost FTP is very insecure and must never be used for authenticated file access.  It is in your best interest to never use ftp and always use SFTP or FTPS.  If a service provider only offers FTP,  use a service provider that actually cares about their customers.

Malware will attack FTP by sniffing the network looking for authentication requests and use this spread by infecting .html or or web application files.  Its is likely that your machine or another machine on your network is infected and carrying out attacks using your connection.


Disclosing used Libaries in App Me and a colleague were discussing the fact that due to licensing we need to disclose a couple of libraries we used in the development of an Android app we make. I said, from a security standpoint it would probably be better to disclose the bare minimum.(So not disclosing the libraries that didn't specifically require it). He said he was lazy and didn't want to remove the ones that weren't required.

My philosophy is: If someone were to find a vulnerability that would affect a specific library that could maybe pose a threat to our app

How much of a potential risk could disclosing libraries pose?

If someone were to find a vulnerability that would affect a specific library that could maybe pose a threat to our app

The defense against that is not to use the library. Using the library and not documenting it does not change the fact that your application is vulnerable.

Not documenting that you use the library makes is marginally harder for people to discover that your application uses it, but only marginally so. It might not show up in certain automated scans (e.g. a Google search) but it will come up in other automated scans (e.g. looking for certain symbols) and it will come up once somebody tests (even if your application wasn't using the library, people might test it for similar bugs). And once one person has found it they can make the information public.

On the other hand, if you don't disclose that you use the library, then your users won't have an easy way to find that if a vulnerability affects the library, there's a serious risk that it affects your app. By not disclosing, you're increasing the risk on your users.

So the net security effect of disclosing what libraries your application uses is positive.


Spam link returns empty redirect to google.com - am I missing something? In this question someone received what was clearly a spam link.  Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, although I'm on linux so I'm not usually susceptible to most such attacks).  I got this as the response from the website:

curl -v 'http://103.208.86.131/'
*   Trying 103.208.86.131...
* TCP_NODELAY set
* Connected to 103.208.86.131 (103.208.86.131) port 80 (#0)
> GET / HTTP/1.1
> Host: 103.208.86.131
> User-Agent: curl/7.56.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Date: Thu, 13 Sep 2018 18:27:16 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-Powered-By: PHP/5.5.9-1ubuntu4.25
< Location: https://www.google.com
< Content-Length: 0
< Content-Type: text/html
<
* Connection #0 to host 103.208.86.131 left intact

It doesn't return an actual response, but rather just a 302 redirect to google.com.  It doesn't even set a cookie.  From what I can tell it literally just returns a simple redirect to google.  This left me mildly confused as to what the actual purpose of this is.  Obviously scammers have their own technical problems, so this could be a sign of a screw up (or perhaps they shut down their actual pages for whatever reason), but I can't help but wonder if perhaps:

There is something else to this request/response that I'm missing?
There is a reason (other than "oops") why a spam link might return nothing but an empty redirect?

Obviously my IP Address is potentially now in their server logs, but I can't imagine they were just trolling for IP addresses...

My first guess was the site was probably using your User Agent string to identify if you are vulnerable or not. As you are using curl and not changing the UserAgent, the exploit kit would redirect you to a harmless page.

I used curl with an IE11 UserAgent string, and got the same redirect. Probably my IP is not on the list of desired ones.

Next guess: IP address.

The IP address is usually matched against a list of desired targets, usually tied to a country. It is usually meant to keep the exploit kit secret and only expose it to the interesting targets, avoiding it to be readily flagged by security companies.

So I tried again using an UK proxy:

http_proxy=88.211.x.x:8080 curl -A 'Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko' -v 'http://103.208.86.131/'
*   Trying 88.211.x.x...
* Connected to 88.211.x.x (88.211.x.x) port 8080 (#0)
> GET http://103.208.86.131/ HTTP/1.1
> Host: 103.208.86.131
> User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
> Accept: */*
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 302 Found
< Date: Thu, 13 Sep 2018 18:48:47 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-Powered-By: PHP/5.5.9-1ubuntu4.25
< Location: index2.php?&sessionid=08bcaee2029a8a766175c5c8cebc8bff&securessl=true
< Content-Length: 0
< Content-Type: text/html
<
* Connection #0 to host 88.211.x.x left intact

And it connected, redirected me to another page.


Securing a Ubuntu web server on cloud for a web application I am about to publish a python web application.
The server is an Ubuntu remote machine hosted by 1&1.

For now I start remotly the python server app with a console command.

Concerning the security, what are the must-do procedures with my Ubuntu machine, before making it public with a domain name ?

Thank you

Create a non root user run your app under that user.

Set up ufw (uncomplicated firewall) block all apart from SSH, http and HTTPS. This is much easier than iptables (imo).

Disable SSH password auth. Set up keys, use them only.

Additionally set up Fail 2 Ban to monitor logs and take any additional actions you might want (IP blacklisting etc).

There are lots of guides online for hardening Ubuntu, these would be my 'must do' steps. I would recommend the Linode guides they are generally good quality (https://www.linode.com/docs/security/securing-your-server).

Also bear in mind that even without a domain name, if your app was running on the remote chances are it has already been found and probed based on IP:port alone. I would do all these steps as soon as the server is provisioned.