Thought process on Network Protocol Attack I'm preparing for an introductory information security examination in university and this is one of the tutorial question on Network Protocol attacks. I tried (a) and came to this conclusion:

Since the EPbX() is a public key encryption operation, C can decrypt any encrypted message to get back its original message, m as though it is anyone in the pair of people exchanging messages.

However, when I re-read the question, the decryption requires the use of private keys, which means it might be impossible to get the message unless C impersonates as the other to each of A and B, and is involved in the key exchange, generating 2 pairs of private keys, which seems repetitive. This confusion prevents me from doing the later part (b).

Can anyone suggest the thought process and solution to the above problem?

Here is the question description. Sorry the actual paper document is not formatted such that it allows copy over.

The protocol does not mention any random padding, which means that E(P,m) is a deterministic function. It means that, given the same public key P and message m, the result of E(P,m) is always identical.

If the attacker C can sniff E(PA, m) and E(PB, m), then they can try all possible values for m, and see which m results in the same encrypted message.

The viability of this depends on the entropy of m. If the contents of m can be reasonably guessed, then this is a viable attack. If m has high entropy (e.g. a randomly generated encryption key), then this attack is not viable. In that case, I wouldn't know how C would be able to recover the message, though I would love to know.

Question (b) is asking how this attack can be prevented. The simple answer is by including a random padding, which is distinguishable from the actual message.

So by modifying the encryption algorithm to be like E(P, m||pad), with pad being chosen randomly, the encryption function can't be exploited in the same way anymore. The attacker C doesn't know the padding, so even if C would happen to have the correct m and calculate E(PA,m), the result would not be identical, as C does not know the padding being used.

In regards to the padding: The padding requires two things:

The padding must be sufficiently long and random so that is infeasible for the attacker to try every message with every possible padding. What this actually accomplishes is to guarantee that every message sent has high entropy.
The padding and the message must be sufficiently distinguishable. This can be accomplished by making the padding a fixed length. The recipient would know that the padding is this length (e.g. 256 bit) and can remove the last 256 bit, and before sending a new message, create a random 256 bit padding.


Can DUKPT BDK be 192 bits? All examples seem to be with 128 bits.  Can it be 192 bits?

Maybe sort of.

The DUKPT algorithm is defined to use "two-key triple-DES", or formally TDEA Keying Option 2 from SP800-57 or originally FIPS46-3. Every key in this algorithm (BDK, device initialization key(s), future keys, and working key(s)) is a "double-length key" consisting of two classic-DES (DEA) keys, each 56 real key bits plus 8 bits reserved for parity and today often ignored, stored and transmitted and used as 64 bits, totalling 128-bits.

Some implementations of triple-DES aka TDEA aka DESede (possibly including yours) require you always represent the key in full-length 192-bit or 24-octet form. Given a double-length key, you create a triple-length key by duplicating the first half, i.e. if the double-length key is (k1) (k2) then the triple-length key is (k1) (k2) (k1) . The result occupies 192-bits but only contains 112-bits of "real cryptographic keyosity".


Protection against command injection with modsecurity I want to know if modsecurity can protect against command injection and file inclusion.
I tested modsecurity with free version and run dvwa which is vulnerable page .
But command injection is possible even if modsecurity rules are included in apache.conf.
Please answer me.

Check inside file: modsecurity_crs_40_generic_attacks.conf and if your WAF is properly configured than it should react when you try to trigger command injection.

#
# OS Command Injection Attacks
#
# -=[ Rule Logic ]=-
# These rules look for attempts to access OS commands such as curl, wget and cc
# These commands are often used in injection attacks to force the victim web
# application to initiate a connection out to a hacker site to download, compile
# and install malicious toolkits such as those to participate in Botnets.
#
# -=[ References ]=-
# http://projects.webappsec.org/OS-Commanding
# http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
#
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?i:(?:[\;\|\`]\W*?\bcc|\b(wget|curl))\b|\/cc(?:[\'\"\|\;\`\-\s]|$))" \
        "phase:2,rev:'2',ver:'OWASP_CRS/2.2.8',maturity:'9',accuracy:'8',capture,t:none,t:normalisePath,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'950907',tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%{tx.0},skipAfter:END_COMMAND_INJECTION1"

SecMarker END_COMMAND_INJECTION1

#
# Command injection
#
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?:\b(?:(?:n(?:et(?:\b\W+?\blocalgroup|\.exe)|(?:map|c)\.exe)|t(?:racer(?:oute|t)|elnet\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\.exe|echo\b\W*?\by+)\b|c(?:md(?:(?:\.exe|32)\b|\b\W*?\/c)|d(?:\b\W*?[\\/]|\W*?\.\.)|hmod.{0,40}?\+.{0,3}x))|[\;\|\`]\W*?\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\b|g(?:\+\+|cc\b)))" \
    "phase:2,rev:'3',ver:'OWASP_CRS/2.2.8',maturity:'9',accuracy:'9',capture,t:none,t:cmdLine,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'950006',tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%{tx.0}"

SecMarker END_COMMAND_INJECTION


Can an unloaded malicous.dll placed on the "drive by download " directory be remotly exploited? Some programs can be downloaded to the drive-by download directory through the browser , the easy way is to unpack the program on the /download directory (It is the default path if the user doesn't specify a custom path to extract the program) , the scan online will report the malicious.dll as vulnerable.

To more understand the situation , the program isn't installed yet (never) on the system and the malicious.dll isn't loaded .:

Can the malicious.dll placed on the /download directory be remotely exploited?

Following on from communication in comments you seem to be asking about standalone executables. I.e. if a user has downloaded a zip file containing an application, extracted it directly to the Downloads folder (i.e. not in ~/Downloads/Program/).

Assuming a loaded dll is in the same directory then if it were to be replaced with a malicious copy odds are that the exe would load it without realizing. There are mechanisms - such as signing - to avoid this risk. Its also worth noting that to replace the file from most mainstream browsers without user consent should not be possible. Not to mention if you can replace the library why can't you just replace the exe?

When an executable attempts to load a library if an explicit path/manifest is not given the system is going to search a list of potential locations in a somewhat standardised order. This is documented for windows here - https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586(v=vs.85).aspx

If for some reason an executable attempts to load a non-system shared DLL that it isn't shipped with then there may be a higher risk. The directory the executable is in would usually be the first search location. This means that should this DLL be injected into the downloads directory then it would be picked up. I suppose an example might be a program that only offers certain features if another software package is installed - for example offering Microsoft Work integration if Office is installed.


Encrypted LVM as an alternative to TrueCrypt In a weird announcement on the TrueCrypt page it says that the software is unsafe so we should migrate to BitLocker.

If it is a prank it's sure not funny especially when it comes to data.

Since I want to switch to Linux as my primary OS, I was thinking about Encrypted LVM.

Is this secure just as TrueCrypt full-disk encryption ?
Is it susceptible to cold boot attacks ?
Are there any holes that can allow data recovery ?

Please shed a light on this topic because I bet the TrueCrypt message today raised a
lot of panic.

Well given that sourceforge recently requested a reset of users' password I would not be too fast to panic. It could still be a joke.

Nevertheless, regarding your questions:

LVM is as secure as any other software - until proven otherwise, i.e. until a vulnerability is found. There's no guarantee of security ever.
Cold boot attacks depend on how long your RAM stores data - regardless of the encryption software you use. One could use a cold boot attack to read your poetry, not necessarily your passwords.
The developers aren't leaving any holes intentionally for data recovery. They are working hard to avoid that - as it would be a serious vulnerability waiting to happen.

UPDATE Somebody pointed out in the comments that the key used to sign the latest "dismissal" release of TrueCrypt appears to be genuine, i.e. the same key used for previous releases. This is likely unrelated to the SF password compromise accident.


Yahoo! Messenger injection attack Just five minutes ago I had an injection attack through Yahoo! Messenger. The only visible effect was the change of my status message. I also got a dialog message saying that a script cannot continue running because the string was not terminated, or something like that; when I looked for the script at the specified path I could not find it.

How the attack was executed: a conversation window with someone I did not know popped up; it displayed a distorted box, the kind that appears when the other person is sending you a file (only there was no file to save). (The box was distorted as if the client had trouble rendering it.)

I tried saving the conversation (to see the text that was sent), but it was empty. I haven't restarted my computer. Any chance I could see what was sent to me?

Update

I searched the id through which the attack came and found it is affiliated with a site that has a public form for changing any person's status message: all you have to do is put in their id, the status message and you're done. (I don't think I should mention what site it is.)

I used the form to send attacks to my own self so I could capture them with a network analyzer. The exploit was sent through a malformed File Transfer Request. I also sent a normal FTR to compare and see what is different in the exploit. Among others, a FTR contains the following info:

(a) name of the file being sent
(b) size in bytes
(c) hash probably used to check if the transfer succeeded

The exploit had no file name, and presumably the size of the file is 4128 bytes (but there's no file you can actually download). The hash is somewhat more interesting. In a normal FTR, the hash looks like any other (a string of characters); the exploit FTR had this for a hash:

'<form><iframe onload=\"SetCustomStatus('mystatus');\"></iframe></form>

The SetCustomStatus function is from the YM SDK. This appears to be all, so there probably wasn't any real harm done. It would be interesting to know how they got Yahoo! to send that JavaScript code instead of a normal hash.

Anyway, I'll report the site to Yahoo!. (Edit: Except I can't seem to find where to report it... >:( )

I don't know whether it will be possible to save a log of what was sent to you, but if I were you, I wouldn't worry about it.  I would leave that to security folks to analyze the details of how you got hacked; if you got picked at random to be hacked, odds are there many others are getting hacked, too, so the professional security companies have a good chance of observing the attack in the wild.

Instead, I would focus on securing your machine so your don't get hacked again, and making sure you eliminate any access to your machine and Yahoo account that the hacker may have gained.  In particular, I would take the following steps as soon as possible:

Immediately change your Yahoo! Messenger password to a temporary password, ideally from another computer if possible but if not, from your own computer.  (This will be just a temporary password, because there's always the possibility that your attacker has infected your copy of Yahoo! Messenger or infected your machine with a keylogger.  We'll try to deal with that next.)
Disconnect your computer from the network.  Reboot.
Run a full virus scan of your computer (most will have an option to do a full scan of the hard disk on demand).  Fix any problems it reports.
Reconnect the network connection.  Ask your virus software to update its anti-virus definitions.  Run another full virus scan.  Hopefully it won't find any problems.
Reboot.  Run Windows Update.  Update all the software it will allow you to update.  While you're there, turn on automatic updates, if for some reason they're not already enabled.
Check for updates to Yahoo! Messenger.  Install any updates.
Download and install Secunia PSI.  Run it.  Fix any security problems it reports (i.e., update any software that it says is out of date).
Reboot if required by any of the previous software updates.
Now change your Yahoo! Messenger password a second time, this time to something permanent and hard to guess.  You might want to change the answers to any security questions, too, just in case.
Also, check over your Yahoo! account profile and details very carefully.  Make sure any email addresses in there are correct (e.g., that the attacker hasn't forwarded your email to another account).  Make sure the attacker hasn't added himself to your buddy list or anything like that.
If you used your Yahoo! Messenger password on any other site or with any other software, change your password for those sites/applications, and do the same with them.

While there are no 100% guarantees, if you follow those steps, I expect you will probably be OK.


Security impact of using a public password for free WiFi We have a WiFi network that we want to be public and free.

Does having a password that is known to everyone provide any additional security advantage to the people using this network as opposed to just leaving it without a password? i.e. Can a hacker do more damage on a WiFi network that has no password than he can on a network that does have a password that the hacker knows?

After some discussion with @epeleg in chat, I think I may have a more thorough and (hopefully) clear answer.

TL;DR: The protection afforded to a Wi-Fi network by encryption with a PSK is directly proportional to the complexity of the PSK, and the effort taken to safeguard that PSK.  For any environment, this requires striking a careful balance between security and usability.

Lowest Security/Easiest Usability: No encryption.
Highest Security/Hardest Usability: WPA2-AES, high-complexity PSK, MAC address filtering, Wireless Intrusion Detection/Prevention System.  Require user & device registration for access to PSK and addition to the MAC filter.

If you intend to provide free WiFi as a service to the community, the balance is probably somewhere in between these - and likely leans toward the former solution.  However, even the latter of the above options is very doable if you are willing to put in the effort.

Still, protecting a "free WiFi" network by any means doesn't so much prevent attacks outright as it does make them more difficult.

Encrypting network traffic on the WiFi connection is always more secure than sending the traffic in the clear.  While not impossible, it is very difficult and time-consuming for an outsider to translate WPA2-encrypted traffic into cleartext.  However, most encrypted SOHO and "Free WiFi" networks must rely on a passcode, or Pre-Shared Key (PSK) to protect the encryption mechanism.

The amount of protection offered by implementing a password in any system will always vary in direct proportion to the password complexity, and the effort taken to protect that password.  Wireless networks are no exception.

To try to simply express how this relates to your "Free WiFi" situation, I'll give a few possible configuration scenarios and the benefits/drawbacks of each:

Scenario:  Your network is left fully unsecured.  Anyone within range of the AP can just hop on and enjoy the free WiFi.

Benefit:  This is the easiest for anyone to use and requires practically no administrative overhead.
Drawbacks:  This is the most vulnerable network of all.  All traffic that does not otherwise use an encryption protocol (such as HTTPS) will be sent in the clear.  This network is easy to sniff, spoof, and otherwise manipulate to the benefit of even very inexperienced attackers.

Scenario:  Your network is protected with a strong PSK, using WPA2 for authentication and encryption.  You have posted the SSID and PSK in a publicly viewable location.

Benefits:  The data on your wireless network is encrypted, and nobody can read the data or connect to your wireless network without the PSK.  This network is also fairly easy for the end-user to join, and requires little to no administrative overhead.
Drawbacks:  Having the PSK publicly accessible in this manner makes it trivial for anyone within range of the network to just grab it and hop on.  Attackers will not likely be much deterred by this method.

Scenario:  Your network is protected with a strong PSK, using WPA2 for authentication and encryption.  You have posted advertisement of the Free WiFi service in a publicly viewable location, which includes contact information for potential users to obtain the password.

Benefits:  The data on your wireless network is encrypted, and nobody can read the data or connect to your wireless network without the PSK.  With this method, you have personal contact to one degree or another with every user - this helps to somewhat disenchant them of their sense of anonymity on your network.  This may help deter some would-be attackers who would rather move on to a less secure network, than go to the trouble of contacting someone for your PSK.
Drawbacks:  This requires that someone is available within a reasonable amount of time (include the timeframe in your advertisement) either via phone or e-mail to give users login credentials.  Users may also circumvent this measure by simply passing the PSK peer-to-peer.

Scenario:  Your network is protected with a strong PSK, using WPA2 for authentication and encryption.  You have posted advertisement of the Free WiFi service in a publicly viewable location, which includes contact information for potential users to request access.  You have also implemented a user and device registration process which includes an Acceptable Use Policy, contact information for registered users, and MAC addresses for all devices.  You have also implemented MAC address filtering on the AP, and monitoring/logging services on the network.

Benefits:  The data on your wireless network is encrypted, and nobody can read the data on your wireless network without the PSK.  Nobody can connect to the wireless network without both the PSK and a registered MAC address.  With this method, you have the ability to see if/when your network is being inappropriately used and by whom.  You also now have an agreement in place which informs your users that inappropriate use will not be tolerated, and which may absolve you of some legal responsibility if such use occurs.*  Potential attackers would much rather find an easier victim than go through such a thorough process, especially when they read the clause of the AUP that mentions monitoring is in use.  Users will not easily be able to circumvent the device registration by simply passing along the PSK.  You can also revoke a user's access if necessary, by de-registering their MAC address(es) and/or changing to (and distributing via registered user contact info) a new PSK.
Drawbacks:  Of all these scenarios, this requires the most administrative work.  This will require that someone is available within a reasonable timeframe to perform the complete user registration process - gathering personal information, gathering device information (helping users who don't know how - and most probably won't), archiving the paperwork, and registering new devices with the network.  To be fully effective, it will also require that the logs be checked on a regular basis for suspicious activity and/or having some form of IDS/IPS in place.  Attackers who obtain the PSK will easily be able to spoof the MAC addresses of other registered devices to either bypass the device filter, or pose as that device's user on the network.

In all scenarios, there are a few things that should be kept in mind:

By providing unconditional Free WiFi, there is always the possibility that you may be allowing a malicious user onto your network regardless of what registration or PSK distribution process you put in place.
For all PSK-secured WiFi systems currently existing (WEP, WPA, WPA2) there are known attack vectors that allow an authenticated user to sniff the traffic of other users on the network as if it were in the clear.  (Provided, of course, that the traffic is not encrypted by other means such as HTTPS.)
Make sure the administration interfaces of all your network equipment are protected by strong, non-default passwords which are not similar to any PSKs you distribute.
Depending on your local jurisdiction, you may be held liable for the actions of those who use your WiFi network.*
Your contract with your ISP may not allow promiscuous sharing of your Internet connection.

Lastly, to address your final query:

  Can a hacker do more damage on a wifi network that has no password then he can on a network that does have a password that the hacker knows ?

When it comes to unconditionally Free WiFi networks, it's not so much a matter of how much damage the attacker can do as it is how easily he can do it.  I hope I've clearly addressed the latter, above.

*I am not a lawyer, and this is not legal advice.


Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)? Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or what? I've tried to run the exploit without unsetenv and the terminal was "hanging" not receiving ^C ^Z ^D.

Environment variables such as LD_PRELOAD are inherited by child processes. The linked example overrides the _init symbol to invoke a shell using system("/bin/bash"). If the environment variable would not have been cleared, then it would effectively be stuck in an "infinite loop" when invoking system.

If you watch your process list (using ps aux for example), you will see a bunch of shell processes. The system library function creates a new process and executes /bin/sh -c "....". Every time, _init is executed.


Virus Encoded in Video So I'm not familiar at all with IT Security, but I'm a bit curious about something. I was watching a TV show and at one point, a virus spreads through an office. They investigate and find out that the virus was encoded in a video and it was "activated" when the video was played. So my question is, is this possible? Could that actually happen? Once again, I'm not at all familiar with either IT Security or video encoding/codecs, so forgive my ignorance.

EDIT:

Thanks for all your answers. They were very interesting and insightful. If you're interested, the show in reference was White Collar Season 3 Episode 7 "Taking Account".

Yes, that's possible.

The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine.

These types of exploits have been common amongst popular document formats, e.g. PDF. Their proliferation makes them a good target for exploit writers, because people use them a lot and assume they're safe. At the end of the day, any file type could potentially contain an exploit, since an application that runs executable code is involved at some point.

Exploits like this are usually buffer overflow attacks, which alter control flow by overwriting data structures outside the normal memory range of a buffer.

More info:

Buffer overflows on OWASP
Buffer overflow protection
Exploit Writing 101 on CoreLAN


Which keys are transferred to Apple during an iCloud backup? The iOS data protection implementation and the implementation of iTunes backups are both reasonably well documented, on a high level by by Apple, and on a much more detailed level by third parties.

However, I'm wondering about the implementation details of iCloud backups. Apple's document only mentions the matter very briefly in a paragraph on the iCloud backup keybag.

According to that information, and unlike for a local iTunes backup, the data is read from the device still encrypted (except for files with the protection class NSFileProtectionNone, for which the class key is readily available at all times). On the other hand, Apple is clearly able to decrypt an iCloud backup even without the user providing the original Apple ID credentials or the phone with which it has been originally created, thereby passing (or failing?) the mud puddle test.

This seems to imply that at some point in the backup process, the actual class keys are transmitted to Apple (otherwise, there is no way for an iCloud backup to work while the device is locked - some files are protected with a class key that is only available as long as the screen is unlocked). (For local backups, the files are decrypted on the device, using the keys contained in the escrow keybag, thereby not exposing any long-term keys to the computer performing the backup.)

While it is already known that Apple has full access to iCloud backups stored on their servers, this would imply that by enabling iCloud backup even a single time, some encryption keys that otherwise would never leave an iOS device are transmitted and stored to iCloud.

I'm wondering what an adversary would be able to do once they gain access to an iCloud backup, using some third-party software to download everything to a computer:

It would seem like they are not only able to examine the contents of the backup itself, but also gain enough information to decrypt everything in the device's NAND, if they were able to physically acquire it (in addition to the Apple ID credentials), since the class keys are contained in the downloaded backup file.

Can anybody share some knowledge on how the iCloud backup process actually works, and if the scenario above is plausible?

There is a newer security guide published by Apple than the one you referenced that contains a list of non-migratory keys, keychain items for which the class is protected.  The word Privacy occurs in the 2012 guide once.  Twenty-one other references were added in the 2016.  Inquiries of this nature are common, especially when iOS users hold medical, financial, intellectual property, and other confidential information.

As you deduced, it is not possible to deserialize the keychain AND provide privacy from internal Apple attackers unless a secret is held on the client and used to encrypt data prior to entering the backup process.  There is no mention of any mechanism that allows the iOS user to install a certificate or set a backup password that Apple cannot access.

If you wish to have highly secure privacy, you need client side encryption at the user interface level.  It is not clear whether an app could reach the App Store with such a privacy device.  Such code would probably be considered a potential source of malware or viruses by Apple.  (See the Commitment to Security section of the new guide.)

Although various comments can be found on your topic, none are from within the Apple development or security teams, as server-side information is surely considered Apple company confidential.  The API for client-side apps is black-box, core services transparency is low, and the Core Backup API is not granular enough to provide hints.

You can read more about the class NSFileProtectionNone and related classes in the API documentation, but no sequence diagram or description is provided.  I was unable to find a sequence or action diagram with any detail to it.  We only know that the transfer is via TLS.

A packet sniffer would produce details, but the second paragraph above would hold regardless of operational details.


Cloud application Vulnerability assessment Do you think server side assessment of application is important when application is hosted on a cloud like Amazon?

Assessment on software used to host the application not the actual application, e.g. assessment of nginx webserver using nessus or nexpose. Security of this software should be taken care by Amazon. If there is any vulnerability in nginx webserver then the security issue should be with Amazon not the actual application. Please clarify my doubt. Is my approach correct?

Whilst it might be the case that Amazon have done proper configuration testing of their servers, and have full security auditing in place, do you really want to risk your operational stability and security by not testing it for yourself?

The bigger question is why you want to use "cloud" anyway, if you've got anything that's worth keeping secure. The single positive thing that comes from cloud computing is that it's cheap. Everything you hear about improved uptime is a fallacy - just look at how many long blocks of downtime major sites have had due to S3 outages. Then, from a security perspective, you have these issues:

You're outsourcing blame, but not responsibility. Amazon have no contractual agreement with you to provide adequate security testing in a way that's applicable to you specifically as a customer. You can blame them for security failures as much as you like, but they will not be held contractually responsible.
You're putting incident response in the hands of another company. You'll have absolutely no luck getting full-disk images that'll stand up in court if you get hacked. Amazon don't have the resources, inclination or legal clout to provide forensic-level copies and logs to customers.
Once you put data on the cloud, it may not even be yours any more. Various governments, including the USA, have passed legislation saying that "cloud" data no longer carries ownership, and can be taken or removed.

Real security and competitive uptime costs money. If you want proper security and high uptime, get a dedicated server with an SLA and have the full stack tested by a competent security tester.


How to do a privileges escalation with ping? I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file.

Is it possible to perform a privilege escalation using the ping command?

SUID bit is permitted for /bin/ping but I do not know how to proceed from there. Can anybody help?

A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow vulnerability that can be exploited for privilege escalation) or an administrator sets the SUID bit on a binary that should not have it set. An extreme example of the latter would be an admin setting vim to SUID with owner root, allowing users to execute bash commands as root within a vim session (:![shell command]).

A quick reference check on this led me to this article on Linux privesc. You may find the section 3. Exploiting SUID Executables helpful.

The ping utility requires the binary to be owned by root and the SUID bit set because it sends/receives ICMP requests using "raw sockets" which only root can do. You would need to find either a vulnerable version of ping (I assume this is why @Arminius asked for the version) or a way to inject code/commands. Personally I have never been able to leverage ping in pentests or CTFs for privilege escalation, but that certainly doesn't mean it's not possible :)

A famous similar example is older versions of nmap which supported the --interactive mode. If the SUID bit was set (many scans such as the default syn scan -sS "require raw-packet privileges") then you could drop to a root shell from the interactive mode. More info is in the privesc link above on this if you're interested.

If you are looking at a CTF challenge, I typically start looking for obvious non-default SUID programs (ex. /opt/myprog/test.bin) first, and then come back to the "normal" suid programs like /bin/ping as a last resort after other checks are fruitless.


What is the etymology of "Salt" in relation to password storage? Simple question:

When talking about appending a random string to a password before hashing in order to defend against dictionary attacks, we call it a salt. Why do we call it a salt?

If you want to talk about salt and keep things simple, think about a pizza:

Because you can not expect a better answer from serious and smart people:

  Does anybody know the salt's etymology in this context? Rob.desbois
  14:45, 5 June 2006 (UTC)

  Nope. But I expect it's connected to the concept of salting a site with something, as in mining fraud. I got curious about this long ago
  and seem to remember the OED has an entry of some antiquity. ww 18:53,
  5 June 2006 (UTC)

  I would guess salting the earth is the most likely source. The actual data is "spoiled" to make it more difficult for an adversary to
  use. JRM · Talk 12:17, 1 July 2006 (UTC)

  Ah, nice suggestions you guys have. Here's the way I usually think of it: Salt is our most common spice. So I tend to think
  of it as the salt "spices up" the password/key. Of course, then
  perhaps it should be called "pepper" instead. But also, salt is a well
  known flavour enhancer. That is, adding some salt to food makes the
  other tastes in the food stronger. (I don't know why it works like
  that, but it is a well known fact). And the salt in cryptography does
  make the password/key stronger. So I think "salt" is an excellent word
  for it in many ways. And it is a short word, easy to spell and
  pronounce, easy to translate to all other languages and doesn't change
  cultural meaning when translated. It's perfect! --David Göthberg
  11:58, 25 October 2006 (UTC)

  Hmmm... I suspect we have here some folk etymology which is nearly always plausible -- else it wouldn't have been
  proposed and paased around -- but is often off the actual mark. The
  first point I'd make is that, to my sense of the language, salt isn't
  a spice. Spices are exotic (or were exotic once), tend to be plant
  products (shredded tree bark, for instance), are used in quite small
  quantities, and are entirely optional, nuitritionally. Salt doesn't
  meet any of those tests, but perhaps my sense of 'spice' is at
  variance with that of other English speakers. I can burn water without
  half trying, after all. I wonder if there is a similar distinction in
  other languages; there appears not to be one such in Swedish
  (Davidgothberg's native tongue if I understand correctly).

  My personal, completely unsubstantiated guess is that it comes from the phrase "take it with a grain of salt".
  Tomfelker 23:22, 22 October 2007 (UTC)

  But I like the etymology/analogy whether folk or not. ww 14:06, 25 October 2006 (UTC)

  I've always presumed that the origin of "salt" is as a sort of back-analogy with the fact that you seed a PRNG=Pseudorandom number
  generator. The bit of gibberish that you feed to PRNG is a seed
  because it's the start of things and what it is determines everything
  that then happens (what plant grows out of that pot depends on whether
  the seed is a geranium seed or a sunflower seed.) So you try to
  generate a bit of unpredictable gibberish as a seed. However, when you
  generate a similar value, but if it is input not to a PRNG, but to a
  hashing algorithm, you're not actually using as a seed to anything.
  So, salt is a nicely similar-sounding word (phonologically: each
  starts with an 's', has a double-mora syllabic nucleus, and ends in a
  consonant that differs from the other only in voicedness, otherwise
  just being alveolar stops)— and it has a sort of sense of "aptness"
  that invites folk etymologies like we see here. Compare: "spice" in
  "Hasty Pudding cipher: Encryption_and_decryption". --Sburke (talk)
  12:11, 17 March 2013 (UTC)

(Talk:Salt(Cryptography))


System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables.

Since it's a kernel related topic, at the very first time of hearing it the only thing sprang to my mind was SELinux whilst we can use it to manage our networking security solutions such as Labeled Networking (Labeling Packets passing between machines over the Network) amongst all other options it provides.

So is it something same as what we can do via SELinux or it is different? If not so, does anyone know why we may be in need of using NFTables and Libnftnl? Do we need it at all?

Any form of network labeling for remote connections requires a robust Authentication system: SELinux uses IPSEC to achieve this;
though you can apply IPSEC without SELinux and local port labeling without IPSEC.... what are you trying to achieve?


Is it safe to generate the longest password possible? Context
In another question about password generation, I have read an answer suggesting something along the line of:

Let your password manager select characters from all the accepted categories (lowercase, uppercase, digits, standard punctuation, extended ASCII characters) and choose a very long length.
If the target has a shorter maximum length, just generate the longest they'll accept.

Question
Is choosing the maximum-authorized password length a safe strategy?
My reasoning is that — assuming the maximum-authorized password length is long enough (say ≥24 characters), so that high-entropy passwords can still be generated if their length is smaller than the max — choosing a password of length m is much more limiting than choosing a password among those of length m, or m-1, or …, or 25, or 24.

Besides dictionary attacks or other possible techniques (like timing attacks, etc.), an attacker might try bruteforcing all the combinations (if possible), or just try some combinations at random (until they give up because it's not worth continuing).
Suppose you have a 24-char alphanumeric password (allowed characters: a-zA-Z0-9), for example 4LZB7NFjpFW6sjtuIaBel9hZ.

If the attacker knows the length of your password, the possible combinations to try will be 62^24 = 1.04 * 10^43, which is about 143 bits of entropy.
If the attacker does not know the length of your password, the possible combinations will be 62 + 62^2 + ... + 62^23 + 62^24, which is a geometric progression and the result should be ((62^25 -1) / (62 - 1)) - 1 = 1.06 *10^43, still about 143 bits of entropy.
If you make the password 1 character shorter and the attacker knows this length, the possible combinations to try will be 62^23 = 1.7*10^41, which is about 137 bits of entropy.

As you can see, even if the attacker knows the exact length of your password, the advantage they might get is negligible. Also, if your password is already very strong, adding or removing one character won't have a significant impact on your security either (anything above 128 bits of entropy is still considered to be uncrackable, even with an enormous amount of computation power).


Speed issues with VPN to cooperate network in Europe from Asia - is it possible to attach a local VPN server to the europe network? Got this situation where we are forced due to security reasons to only be allowed to connect through VPN to our network - which is fine when you are in Germany (GER) where the main office is located, and absolutely horrible when you are located at the branch office in the Phillipines (PH) due to really slow connection to Europe from there.

We wont allow people to go directly on the internet without going through the internal security measures thats setup on the company network.

What i was thinking but simply havent been able to find any answers to if it this model would be able to work :

The idea is that we setup a local VPN server in PH that we connect to - this server is 100% managed by the German IT department, they setup whats allowed on this machine and what is not but it would give us the benfit that it would then be able to use the local internet instead of having to channel all traffic back and forth to germany.

Since we also besides internet traffic would require to access the company network there should be a link from this VPN server to the main office network in germany ( a secondary VPN ) and im thinking there could be set up some routing tables or something between the two to direct traffic between them ?

Would this be possible at all and would it be OK from security perspective if the machine is absolutely locked down to only allow Germany to adminster it ? wouldnt the only safety issue then be if someone physically broke into the machine ?

It should route internal network traffic, ex if we want to access a shared drive on the network across the tunnel between germany network and our local vpn server, but internet traffic it should channel through the local internet line ?

Is this possible at all or am i totally on the wrong end here ? and if its possible whats something like this called ?

Yes, this is definitely possible and is likely a good solution to your problem, assuming it is set up properly. Firewall rules and routing should solve most of the usability and security issues.

I don't think there is a particular name for this, as it is still just a VPN configuration. Maybe split tunnelling works to describe it?


Attacks against windows kiosk software I am interested in potential/actual attacks against kiosk software.

I am not talking about physical access, or specifically designed kiosk operating systems or shells, bur rather software that runs over windows and attempts to prevent access. All too often this software runs on top of explorer and I wonder just how secure it could be, given that is the case?

One product for example, ShellPro I have had experience with. Just out of curiosity and playing around I managed to get task manager and a command prompt up. I could not access drive contents at all, but it was a custom dialog preventing access.

Running something on top of the OS like this would not seem to be a secure way of denying access, as if you can tap into any OS functionality then you will have access AFAIK.

What about running a script through an allowed application? JavaScript in the address bar? Windows Script Host? Macros?

Are there not many simple attacks against these kinds of software, or can they actually serve the purpose for which they are designed? Such software always seemed to me only useful against people who didn't have basic Windows knowledge, but I don't know if that perception is accurate at all.

Just how effective is such software and what ways can it be bypassed?

It will always vary depending on the application and implementation, however some of the ways in which these applications function can be quite effective at slowing down malicious users, and preventing breaking out of the Kiosk interface.

At the end of the day, physical access will always prevail with sufficient time and resources.

Kiosk countermeasures:

Whitelisting - processes, dialogs, windows
Process watching - checking running processes,
terminating unknown and relaunching the kiosk app if it ends
Restrict execution of .exe's
Disabling commmon hotkeys and shortcuts
Disabling host functionality - e.g. Task Manager in Windows
Reducing underlying attack surface by removing unrequired software and applications, such as Java libraries
Restrict locations users can access, e.g. sites/domains in a web browser to only local or specified hosts. This could be implemented at a network/NAC layer rather than on the Kiosk host.

Possible Kiosk attacks will vary depending on the product and deployment in question, but some general ideas:

As you mentioned, bypass executable restrictions by launching through batch files (commonly restricted as well), flash, java, macros.
Where the user is restricted to a specific graphical application (e.g. browser), it may be possible to crash the browser through known vulnerabilities, such as in flash player.
Exploring gaps in restrictions for underlying host functionality, such as in IE Kiosk mode: (1) Save File/Target As, (2) Default Feeds in History, (3) Print to file, (4) New tab, link to help pages, (5) help functionality may allow launching of apps and services.

During a recent pentest on Internet Explorer in Kiosk mode I found this resource useful which references the iKAT Kiosk Attack Tool (note: NSFW image on iKAT page).


Why does scrypt need HMAC? I don't understand how HMAC can be used in the scrypt algorithm. For what purpose does scrypt use HMAC?

The scrypt function utilises a key-derivation function (KDF) in a manner which is expensive in terms of both CPU time and memory. It does this in a way which allows a time/memory tradeoff, where implementations which use less memory require more CPU time.

The KDF used in scrypt is PBKDF2. The underlying pseudo-random function (PRF) used in PBKDF2 is user-selectable, but must take two parameters. As such, a HMAC hash is ideal, due to its two input parameters (message, key) and it being safe as a cryptographic PRF.

The immediate answer to your question is that scrypt requires a HMAC hash because PBKDF2 requires a PRF with two inputs, and a HMAC hash is a commonly chosen function type for this, so it made sense for scrypt to take that option. The scrypt specification itself defines HMAC-SHA256 as the PRF.


Deriving 2 keys from user password - one for login - one for encryption? Context

We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines.

Problem

The User needs an encrypted vault on the server to store cryptographic keys in such a way that only the user on the client device can decrypt and recover the keys for temporary usage.
So not the server or anybody else should have access to those cryptographic keys. Only the user on the client-side should be able to recover it.

Solution ??

Client: User registers with email and password
Client: Derive Master-Secret (MS) by using bcrypt(password, salt)
Client: From MS derive Login-Secret (LS) by using HKDF(MS, salt)
Client: From MS derive Vault-Secret (VS) by using HKDF(MS, salt)
Client: Sends Email + LS to server.
Server: Stores LS by bcrypt(LS, random_salt) in DB (as with any other passwords too).
Client: Can use VS to decrypt crypto-keys and send them to server.

The 3 salts used in steps 2-4 could be derived from the email by using SHA3-512 and take the necessary length of bytes needed for those functions?

I was thinking it is important that the server has no information how to decrypt the vault. Thus should never know in any point in time the secret key for the vault. By just using one password for login and encryption sounds not reasonable? How would someone approach this problem?

I think the duplicate I proposed should tell you "yes, you're going about this in a reasonable way", but there are a couple points that I think are worth addressing separately.

  The 3 salts used in steps 2-4 could be derived from the email by using SHA3-512 and take the necessary length of bytes needed for those functions?

Salts should not be reused, and they should not be predictable. By using a hash of the username, the same salt will be used whenever a user changes their password. It also allows an attacker to trivially predict the salt that will be used and start generating a rainbow table in the hope that a future leak will allow them to make use of it.

In the case of the login key salt, since it has to be used client-side prior to logging in, anyone who knows the username must be able to retrieve the salt from the server anyway, so generating the salt from the username may not be a deal breaker here, however it would still be best to avoid using the same salt when a user changes their password. The encryption key salt should be randomly generated in order to prevent pre-computation of rainbow tables, which means it needs to be stored on the server (unless you're ok with users not being able to change browsers/computers).

If you compare this to a normal app that just sends the password to the server, this isn't really any less secure to outside attackers. For a rainbow table using the login-key salt to be useful, someone would have to obtain the user's login-key, which in other apps would be the password itself.

If the encryption key salt is only sent to authenticated users, then the only rainbow table that could be generated would be for the user's login key. If there is a database leak, then the server-side bcrypt hash of the login key will have a separate random salt that the rainbow table won't be useful for, and the encrypted data will be encrypted using the encryption key salt that the attacker wouldn't have prior access to, so allowing anyone to access the login key salt shouldn't pose too much of a threat.

Of course, if the server itself is malicious, nothing prevents it from trying to crack the password, but this isn't really avoidable.

  I was thinking it is important that the server has no information how to decrypt the vault.

While that certainly sounds nice, unless your users take extreme measures (ie auditing the code and verifying it hasn't changed every time they load the page) they'll still have to trust the server to some extent. It's the server that sends them the JavaScript every time they load the page, and it would be easy for someone malicious in control of the server to modify the code to have it send them the encryption keys.

Client-side encryption with a key known only to the user is useful to mitigate the damage done if the server is compromised in the future, but if a user connects to the server while it's compromised/malicious they're probably going to be out of luck.

  Thus should never know in any point in time the secret key for the vault. By just using one password for login and encryption sounds not reasonable?

Running the password through bcrypt and then HKDF client-side with separate salts for the encryption key and authentication should be sufficient to solve this problem. Just be aware that, historically, JavaScript hasn't been a good choice for password hashing due to its speed. If a native implementation is 10x faster than a JavaScript implementation, the JavaScript will have to run 10x longer for the same security. A WebAssembly implementation may work better, but benchmarking is recommended.


3 byte address of system call and exit call i am trying to exploit a buffer overflow vulnerability in ubuntu (kernel version 3.0.0-12 generic i686) by using the method return to libc and the stack is not exploiting ?

By while exploiting i figured out that the address of system call and exit call is of size 3 byte due to which i think i am not able to exploit the stack in the proper way.. can anyone one help out how can i figure out this?? should i add a 0x00 in address

I'm not sure what you mean with the "address is 3 bytes" (unless you're on a 24bit system?) :)  The memory addresses are probably 32 bit (4 bytes), but the addresses have probably a null byte in them, so you want a way to introduce a null byte in your shellcode.

What you can do, is a bit-shift on a register.  This will - as the name implies- shift the bits to a direction that you want; right in this case, and fill up with zeroes.  (0x11223344 -> 0x00112233)

The following code will make EAX into 0x00112233

05 44 33 22 11    add    $0x11223344,%eax
c1 e8 08          shr    $0x8,%eax

And as you can see in the hex codes, there's no null byte introduced in the shellcode.

Alternatively, you can work with lower registers (ax, al, ...) and rotate all the bits around.  Of you can calculate the inverse value using a bitwise NOT, for example: 0xffedcba9 is the bitwise NOT value of 0x00123456.  Or you could XOR 2 values to get to your address.


Patterns in password creation over multiple passwords Lets say I create 100 separate passwords, consisting of around eight random characters followed by two constant ones that are the same for all passwords:

Generated password = 8 random characters + `.p`

If I do this for all 100 passwords, does adding the same .p for every password make them more or less secure? How much of an impact would it have if two of all those passwords were compromised?

It depends on what kind of attack you are trying to protect against:

If your password is one among millions in a data breach where the attacker isn't targeting you specifically, then your password is effectively 10 random characters long instead of 8. It will be harder to crack.
If an attacker is targeting you, and knows about your pattern, then it gives you no protection at all.
If an attacker is targeting you, and doesn't know about the pattern, it could help until the attacker finds out about it. Breaking one account would give a little help, breaking two would make the pattern obvious and hence useless.

So your system could be helpful sometimes, but not always. Or in other words: your "effective" password length will be somewhere between 8 and 10 depending on your threat model. But unless you have some specific reason not to, I would just forget all about clever systems and just install a password manager instead.


Best resources to learn web security attacks? Can anyone suggest good resources to learn about vulnerabilities in and attacks on web sites, in a hands-on way, for someone with limited programming experience?

OWASP has a couple of very interesting resources of this kind:

Hacme Bank: a banking application built with some vulnerabilities for you to find and try to exploit
The WebGoat Project: web application with several vulnerabilities. Every possible attack is explained in a specific lesson, so that you can concentrate on one technique at the time


Methods used to reverse a hash I know that a hash is a one-way-function and that therefore there isn't a reversal function. By reversing a hash I just mean to find some plaintext that gives the hash.

I think that I understand that to reverse a hash one can

use dictionaries, that is, one generates a list of pairs of plaintexts and hashes. Given a hash, one then searches the dictionary for the related plaintext. I a certain sense I would say that this seems a lot like the method of just brute-forcing where one computes a lot of hashes until there is a match.
use rainbow tables. I am not entire sure that I understand how this works, but I see this question/answer.

My questions:

Are there any other methods used in practice?
Are there  any methods that target the underlying algorithm?

With a serious hash, the only way to find a preimage is to make a guess and verify it. “Serious” means not somebody's homegrown method, but even MD5 which is broken for some uses still counts as serious here, as does Unix's traditional DES-based password hashing which still has the resistance that it was supposed to have (it's just that this amount is too little for today's computing power). In other words, if I have H and I want to find P such that Hash(P) = H, then the only way is to find P is to make a guess, compute the hash of this guess, and see if it's equal to H.

All password cracking methods can therefore be classified as brute force. Brute force can still use clever tricks. You can compute hashes of a lot of potential passwords and then look up many hashes in the resulting tables — that's a dictionary. You still had to compute all the hashes you're going to crack (and more). Rainbow tables consist of computing a humongous number of hashes and storing them in a clever way. A rainbow table is method for compressing a dictionary. These dictionary-based methods rely on precomputation that can be shared among many cracking attempts and are rendered useless by proper salting.

Password crackers always work by enumerating all possible passwords. The cleverness comes from enumerating the most likely passwords first — p@ssw0rd and 1loveYou before navpbtbf and homechasebogbigamy.


Is this bank website secure enough? No https in login page Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/

I noticed it doesn't use Https protocol (neither is that page nor in the landing page where you can buy stocks etc).
Moreover your password can be at maximum 10 characters long and there's no 2 step verification...

This is the page where they explain their security (it's Italian, maybe you could translate: https://www.directa.it/pub2/it/altreinfo/sicurezza.html).

Thanks for any input.

It's a large broker company so it seems strange to me they don't care that much about security (however I'm no expert).

doesn't use Https protocol

The website you provided does support HTTPS, but not HSTS or HTTP to HTTPS redirect. That is why you could be directed to an unsecured HTTP site. SSL Labs analysis.

  Moreover your password can be at maximum 10 characters

Oddly this is common of online banking. I have experienced a bank which defined the following rules for a password {az-AZ-09} with a character limit less or equal to 10.

  there's no 2 step verification...

Despite this becoming a norm in security. Some still have configured their infrastructure with primitive security, given modern attack vectors. 2FA should be a must. Most banks will either provide a "secure key" or access to a one-time password from their mobile banking app.

My personal advice. Avoid online banking with this bank, and look for an alternative which can satisfy your security (OpSec) needs.


What type of content better not to transfer by email? Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure?

I have always wondered how sensible it is to use email, for example, for sending:

e-tickets (transportation,
entertainment and the like)
software license files (even Microsoft used this way of sending licenses in plain open format)

I don't mention transferring passwords by email, which, I think, is always not sensible.

So, to boil down my question:
 how insecure it is to use email for transferring potentially sensitive information from the practical point of view?

To answer your boiled-down question: How insecure is email?  Practically speaking email is subject to attack by DNS spoofing, WIFI interception, and untrusted network administrators just to name a few.

To mitigate this you need to consider the different aspects that need security.  It's likely most companies will fall short in security in at least one of the following areas, so anything you send could be in clear text and visible by someone other than your intended recipient.

Under each facet of security I listed relevant products grouped by how they are technically implemented.  Ask yourself these questions based on the content you're sending over email:

Message Sender Verification

Does the recipient need proof that it was you who actually sent the message?

SenderID/SPF Records (weak verification)
Domain Keys / DKIM (strength depends on implementation)
DMARC (Strong validation of the display from user... hybrid of SenderID and DomainKeys)
PGP or s/MIME (may cause compliance issues if journaling or message auditing is required)
Portal-based products (Voltage, Proofpoint, Zixmail)
Microsoft RMS server + Outlook

Message Transport

Do I need to prevent unauthorized reading or modification of the email sender's MTA and my MTA?

Enforced TLS, with certificate validation.  Non-validated certs are subject to MITM attacks.
Zix-based TLS is a private TLS network that doesn't require manual configuration
PGP or s/MIME (may cause compliance issues if journaling or message auditing is required)
Portal-based products (Voltage, Proofpoint, Zixmail)
Microsoft RMS server + Outlook

Reading the message

Must I ensure that only the intended recipient is able to read the message content?

PGP or s/MIME (may cause compliance issues if journaling or message auditing is required)
Portal-based products (Voltage, Proofpoint, Zixmail)
Microsoft RMS server

Must the client endpoint be secure? (applies if above 3 products aren't used)

The target network administrator is delivering email using a secure transport (Encrypted MAPI, POP3 over TLS, etc)
The target device is secure.  This applies to workstations, and mobile devices.
Microsoft UAG adds features to OWA where the endpoint is audited and will delete left-over attachments in %temp% and restrict or deny access to features as policy dictates
An alternative to UAG is to block attachments from reaching the client (as Henri first mentioned)


What is the algorithm for ARJ encrypted files? I came across some password protected ARJ files.
What is the algorithm for ARJ encrypted files ? How to decrypt them ?

By going to the vendor's site and looking up the manual, I found the different types of "encryption" they used:

       "0" indicates XOR garbling (archives created before 2.60).

       "1" indicates XOR garbling (archives created at 2.60 and greater).

       "2" indicates GOST encryption with a 32 byte password limit.

       "3" indicates GOST encryption (ARJCRYPT.COM version 2.1).

       "4" indicates 40 bit encryption limit.

GOST:

       This version of ARJ provides a new encryption scheme based upon
       the Russian encryption algorithm (GOST 28147-89 cipher).  This
       algorithm is similar in design to DES; however, GOST is designed
       for software implementation.  GOST 28147-89 uses a 256 bit key
       and 32 rounds of encryption.  This implementation uses the 64
       bit cipher feedback mode.

You will have to read the rest of the manual because there are numerous configurations for the encryption used that might affect you.

Wikipedia entries for GOST Encryption


How do proxy servers protect their SSL certificates? Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL with the proxy server and connections terminate at the proxy. Since the proxy is deployed outside the firewall, there are chances of its certificates and private key getting compromised. How is this problem prevented in proxy servers?

What you describe is not what is usually called a "proxy". The normal "proxy" is a machine which is close to the client, not the server; communications between the client and the proxy are not normally encrypted (they can be, but that's rare); and when the target server uses HTTPS, then the SSL is between the client and the server, the proxy seeing only the encrypted flow.

(There are setups in some organizations where the proxy does the SSL itself, as the client; such a proxy also rewrites URL in Web pages so that clients see only http:// URL, not https://. This has become less common nowadays because it breaks many applications and sites, in particular sites who assemble URL through some client-side Javascript.)

In any case, it would be wrong to think of firewalls in such a clear-cut way. A firewall does not ensure absolute security. Similarly, a machine with no firewall is not a free-for-all. A firewall is really a method to cope with sloppy administration on the machines themselves: it blocks access to some ports when the server to protect listens to these ports, while it should not.

The nicer way to say it is that a firewall simplifies administration since it allows blocking incoming connections at a single unified place instead of requiring strict regulation on each machine. Yet, a well-administered server needs no firewall to be secure.


Token generation and random numbers I have a swift server, where currently authentication is handled through a simple email+hashed password combination. I want to replace this with an access token ( + expiration ) so I can remove the storage of email/password on the end-users device to slightly improve security, by making it easier to revoke access from specific end points.

Currently the implementation is cross platform, so I can develop locally ( xcode, macOS ) but run it on my ubuntu box. Therefore I need a cross platform way of generating random numbers.

After some searching obviously I came across /dev/urandom, so my question is is this safe enough to use? Or should I look into using something like arc4random+chacha20 and if so, why and is this implementation any good?

I am planning on using 128bits as a length, as I have read about 64bits simply not being secure enough ( though probably on my scale it would be. )

for reference, here is my current demo-implementation:

func random_data(_ length: Int) -> Data? {
    let stream = open("/dev/urandom", O_RDONLY)
    var buffer: [UInt8] = [UInt8](repeating: 0, count: length)

    let result = read(stream, &buffer, length)
    if result < 0 {
        return nil
    }
    return Data(bytes: buffer)
}

I have a secure strcmp function in my codebase to prevent timing attacks, but in any case I'll most likely be splitting it up in 2 int64's for verification.
P.S. I still need to figure out if i want to zero out the memory of the randomly generated token after its work is done. This is a tedious task in swift.

Yes, /dev/urandom is safe. There is no reason to use /dev/random instead - It's really not safer.


Are all OSes vulnerable to local password reset attacks It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine
Same thing applies on any Linux distro, it's possible to reset the root account password
This means without encryption you have no security what soever on your PCs unless you make sure nobody has physical access to them.

Isn't this considered as a major security issue?

Law 3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

It's a security risk, yes, but refer to this rule and read the link I posted. Actually, it'd be good to read that rule (Law 3) in addition to the rest of the Immutable Laws.

I'm not sure your question, "Are all OSes vulnerable to local password reset attacks" is within the scope of what we can answer; for instance, some popular operating systems might be, but perhaps there are a handful somewhere that aren't.

Passwords are sort of like locks. Locking your door might prevent a crime of opportunity, but it certainly won't deter a determined criminal. That's why you don't leave valuables in plain sight and you install an alarm system.

Think about it -- you can boot from a USB and read the data on the hard drive. That's a very possible attack vector. It accomplishes pretty much the same thing, yet saves them from having to go through the trouble of resetting the root/admin password. So, really, it's helpful for people who forget the root password, and isn't too much of an added vulnerability, because if it is an issue for you, then you have bigger issues in the first place (somebody with physical access to your machine's unencrypted data).


Can I say "session data is available on the client temporarily for surfing period but stored permanently on server"? While I was searching for the differences between cookie and session, I came across two of the following statements

session data is stored on the server, while cookie data is stored on the client.
session data available for the browser run, after closing the browser we will lose the session information.
Source Link

They appeared a little-bit contradictory to me.
Can I say "session data is available on the client temporarily for surfing period but stored permanently on server"?

No, you may not.   Well, you might, of course, if you were so inclined, but that would be incorrect.   Session data, server-side or otherwise, is not ever supposed to be permanent.  I think it may be the absurd overloading of the term "session" which is causing you confusion.

To wit:

A session cookie is something stored on the client side, and does not have an expiration date but expires (and is deleted) when the browser session ends. (The browser is closed, in other words.)
A persistent cookie  has an embedded expiration date which may (amusingly enough) cause it to expire before the browser session ends, or more generally be persisted across multiple browser sessions by saving it to disk for re-use.
Session state (or server-side sessions, or session variables) is data that is persisted for a short time (usually a sliding 20 to 30 minutes, by default) that is associated with a client (browser) session, and referenced by a session id that is both the key for the server side session data object and the value for a session cookie that the client sends with each request.   If the browser does not make a request within the timeout period (again, usually 20 to 30 minutes by default) or even potentially before that, if the application requests that the session for that client end, then that data will be deleted from the server.

Session state data is often stored in memory on the web server, and thus will not be permanently persisted, and in many cases will not even survive a restart of the web server process, even if the sessions are technically still valid and alive.

This can be mitigated by using a dedicated session state process, or storing session state in a database, but in no case is it ever intended to be a permanent data store.


Intercepting video in real time with arp spoofing Is it possible to intercept video for example a netflix stream in real time if you are connected to the same LAN? Is it possible to know when the target computer pauses and plays the video so you know so you know what's on their screen at any moment in time?

ARP spoofing only allows the redirection of traffic through your device. Netflix claims to have been using HTTPS secured video streams. This creates a secure connection between the user and Netflix of which ARP spoofing does nothing but simply redirect traffic through your machine on a LAN. It cannot decrypt the traffic, unless the traffic is WPA2 encrypted in which case you and all users on the LAN have the key, unless it is Enterprise. But decrypying the WPA2 still leaves HTTPS. HTTPS encrypts the HTTP data that goes by, thus you cannot see their actual video. Netflix stated they would add SSL back in April

It is possible however to use tools such as SSLStrip , or its variants to trick the user into not using SSL. If it is successful you CAN view their video. There are other sorts of SSL MiTM  attacks such as SSL interception proxys, where you trick the user into installing your SSL certificate as a CA in which you can make them think any site is secure. Then you can view all HTTP traffic as you have the decryption keys. You can turn your ARP spoofing machine into an SSL interception proxy.


Are encrypted files safe in Windows 10 when using PINs? In Secrets and Lies, Bruce Schneier writes:

  Many keys are generated from passwords or passphrases. A system that
  accepts 10-character ASCII passwords might require 80 bits to represent,
  but has much less than 80 bits of entropy. [...] This is why it is laughable when companies like Microsoft tout 128-bit encryption and then base the key on the password. (This describes pretty much all of Windows NT security.) The algorithms they use might accept a 128-bit key, but the entropy in the password is far, far less. In fact, it doesn't matter how good the cryptography is or what the key length is; weak passwords will break this system.

As I understand, things such as Windows' file encryption (not BitLocker, but the actual encryption of individual files on a machine which doesn't necessarily have TPM) are based on user's password and probably something else, stored on disk. If an attacker gains access to the hard disk, he won't be able to read encrypted files, because he doesn't know the password.

The security will be good if the user have chosen a passphrase. If the user has a poorly chosen password, the attacker would be able to brute force the encrypted data and gain access within days or weeks.

Now, with Windows 10, Microsoft is promoting the usage of PINs instead of passwords:

  Create a PIN to use in place of passwords. Having a PIN makes it easier to sign in to your device, apps and services.

But doesn't it invalidate all the security? As I imagine, it would take seconds to bruteforce data encrypted with a four-digits PIN.

Am I missing something and there is something else which protects the users? Or the PIN feature targets users who think that they don't need any security and won't encrypt their files anyway?

The Hello PIN is only usable on systems with a TPM, and is tied to that TPM.  Most likely, a high-security secret is stored in the TPM, and the PIN is presented to the TPM to unlock the secret.  TPMs typically allow a finite (and relatively small: 3-10 is typical) of tries to access the data before it is destroyed/reset/overwritten.  Unless someone chooses '1234' or their birthday as their PIN (in which case an attacker is likely to guess these early on), this effectively blocks any attempts to brute force the PIN.

Even if the drive is removed from the device, the data would be encrypted with a high-entropy key stored in the TPM, making it impossible for an attacker to recover the data.  (This does make me wonder about data recovery on such a device.  I assume there is still a "normal" password that can be used as an alternate to the TPM secret, but I am not sure.)


Is my PC safe after DSA-4371? I used

sudo apt-get update
sudo apt-get upgrade

before I read  https://www.debian.org/security/2019/dsa-4371

There was I change that my PC got exploited/hacked/virused.
So I used

chkrootkit

and deleted all that was infected
After that I reinstall all packages with changed debsums

sudo apt-get --reinstall install $(debsums -c 2>&1 | grep -E -o 'from [^ ]* package' | cut -d\  -f2 | sort -u)

Is my PC safe now ? Is it possible to have some virus or stuff like that running on my PC ? How to remove it ?

The DSA-4371-1 is a vulnerability that requires a man-in-the-middle between APT and a mirror. Of course this can happen, but it's not the only possible source of the infection. Reading the article made you extra cautious, and you ran chkrootkit, which then found something. If you didn't run chkrootkit shortly before, it may well be that those problems have been there longer. First thing is to rule this possibility out.

It's hard to know what has happened on your mirror unless they have published finding malicious content. If you have a snapshot backup of your system from time before 22 Jan 2019, you could test that version again with chkrootkit or similar. If the backup was clear, then this vulnerability in APT is likely the cause for your infection and you can run the system safely after recovering it from the clean backup.

If there's no clean backup, reinstalling the whole system is the only option, no matter how it was infected.


With whom does my PC communicate at startup? I've been reading about Windows 10 and its incessant desire to call home.  I've tried putting some firewall rules in place.  I am sure they are working but I got to thinking that many events probably happen before my firewall kicks in.

What I'd like to do, if it is possible, is to get a list of IPs my stand-alone PC calls starting at boot time.  I have WireShark - although not installed - and have been reading the manual but it is not clear yet what I have to do.  I've tried playing around with my router (Netgear AC1450) but while I can turn on logging the router produces no logs.

So I have a ways to go in this learning curve.  I've been playing around with Tails and that seems to work ok but then I realized I had the same question.  With whom is my PC communicating with before I get control of the PC?  I really get tired of everything I do on the internet becoming public property and have decided to learn enough about it that maybe I can stop or at least control the flood.

Here is a suggestion for your case.
You need an extra laptop with both cable connection and wifi connection. You, then bridge the two connection and enable the Internet Connection sharing function from the cable to the wifi. By that way, your laptop's wifi become an access point.
Next, you install Wireshark on this computer and set it to monitor the wifi interface. You now connect the computer that you want to monitor to this access point and log all the packets. You will know all the IPs that your computer talks to.

Since you mention Tails, I also suggest that If you have some time, you can have a look at this paper:(A Tor-Based Anonymous Communication Approach to Secure Smart Home Appliances). In the paper, there are some experiments done exactly in the manner that I just explained above with WireShark.


Sensitive data enumeration via HTTP error codes Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user  Bob a message to his cell phone which he registered on our site (hypothetically speaking, for the sake of this example):

curl --header "Authorization: JWT $someTokenForAuthz" \
     --header "Content-Type: application/json" \
     --request POST \
     --data '{"phone":"+43 123 456","msg":"some text"}'
     http://example.com/text/send

Let's assume that we classify the phone number as sensitive (PII) data and let's assume, that the API returns the following response in case a phone number is submitted, which was not registered at the site:

{"error": {"code":404,"message":"Phone number not found"}}

Imagine Eve writing a script that iterates through the cell phone numbers +43 000 001 to +43 999 999 (ignoring real world phone number limitations). With the error code and after 1 000 000 iterations of her script, Eve has enumerated all numbers which are registered at the site and can e.g. target site users in a more specific way.

Is it a security issue to return an 404 HTTP error code when sensitive data like a cell phone number was not found in our system? What would be a better way in terms of error handling (as a backup strategy in case request limits/detection mechanisms that already in place might fail) to prevent such sensitive data discovery? A more general 401 - not authorized error or something completely different?

So the vulnerability is that returning an error code allows enumeration of the registered phone numbers. If allowing the registered numbers to be disclosed is bad, then this is a security issue.

  A more general 401 - not authorized error

No, you've just changed the text - you haven't changed the behaviour.

There are lots of things you might do to make the solution more secure - but we have no basis for knowing which are appropriate to your fictitious model, e.g.

always report success
don't use phone numbers - use a surrogate identifier (with much higher entropy) and require the client to maintain their lookup tables
require authenticated access and revoke that access based on failure rates
seed the data with honeypots and revoke clients access when it attempts to use one
limit the rate at which a client can make requests
charge the client for each POST
require recipients to opt-in to receive messages from a given client - return the same error for a missing number as one which has not granted permission
...

  assuming that request limits/detection mechanisms are already in place

So you are saying that you have protection mechanisms in place, but they don't protect against enumeration? Then your question is an oxymoron.


Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well? We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA roots as well in any JVM updates? Was there any indication of such move?

Oracle page https://java.com/en/jre-jdk-cryptoroadmap.html mention only TLS server certificates being distrusted. Does this mean that JARs signed by certificates rooted in one of the affected CAs are still OK to be used?

According to Oracle JRE and JDK Cryptographic Roadmap Symantec Root CAs will be removed in April 2019 release:

Date: 2019-04-16
Releases: 12, 11, 8, 7
Action: Distrust TLS server certificates anchored by Symantec Root CAs.


How secure will EME be? EME is a technology to allow proprietary code to be run in browser to frustrate piracy.

What are the security implications of this? Will it have full access to my computer (like the good-ol' ActiveX plugins?), and will it have any security benefits over Flash?

EME doesn't "allow" proprietary code, that's a misinformation of Wikipedia based on this four years old post , a post which does not provide real information, just the assumption that at some point a full DRM solution will be integrated into the browser.

The EME is just an API to interact with the license server and the Content Decryption Module. This CDM is the one responsible for decrypting the video. It runs in a sandboxed environment, so no access to your computer is needed.

The whole purpose of EME is to not need a plugin to use a DRM system, so you don't need to rely on third party plugins (Flash, Silverlight...). Therefore, you are removing an often vulnerable point.

In summary, the EME doesn't add any security at all from the server side, but it provides security in the client side removing the need of installing a third-party plugin.


What types of hacking attacks happen alongside a DOS or DDOS attack? I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.

Spoofing. When the actual services go down, attacker tries to spoof as if he's the service provider and starts collecting secret information. For example, within an enterprise network, one could DoS a DNS server and start dummy instance of DNS (with same ip, but probably different MAC -- even same MAC sometimes by spoofing) and wrongly resolving the domain names to malicious IP and then further installing a honeynet to collect various secret info. At Internet scale DDoS generally is done only to bring down certain services, but if a targeted attack is being carried out then probably the assumption at application level of availablity of certain service might not hold and hence may lead to certain specific security hole (its very situation specific, one needs to study the application architecture to understand implication of certain services going down).

Found that this is a duplicate of Does a DDoS attack have other purposes beyond a lack of availability? (which is in itself a duplicate of another question, pls follow link)


gpg: How do we Cross-Sign Keys? (--default-key vs. --local-user) I'm trying to figure out how to cross-sign two keys.  One reference says we should use:
gpg --local-user 0xfedcba98 --edit 0x76543210 sign
gpg --local-user 0x76543210 --edit 0xfedcba98 sign

That's an old reference, so I assume we should be using --edit-key now.  When I try, I am able to get the first key to sign the second, but the reverse fails....
Edit:  After repairing one error having to do with proper quotation of passwords on the command line, I tried Esa's suggestion with --default-key, and which appears in his first linked article by Daniel Pecos Martínez.  I was still unable to sign the first key by the second.  I was getting this error:
$ gpg --default-key 76543210 --edit-key fedcba98 sign

[snip]

gpg: Warning: not using '76543210' as default key: No secret key
gpg: all values passed to '--default-key' ignored
"MyName <me@mine.com>" was already signed by key fedcba98
Nothing to sign with key fedcba98

The solution I found, and this is necessary whether using --edit-key ... sign, --sign-key or --quick-sign-key, is to use --local-user as stated in the link above.  --default-key does not work!
The man page says that --local-user overrides --default-key, so I am guessing that the key database has some notion of default which will not be overridden by --default-key but will be by --local-user.  I am uncertain, but this may be complicated by the fact that both of my keys have the same UID.  If anyone can confirm and maybe even offer a way to change the database's default, perhaps they might add it in the comments.
I am running:
$ gpg --version
gpg (GnuPG) 2.2.4
libgcrypt 1.8.1

You don't need the 0x prefix when specifying a key, and you could use --sign-key.

--sign-key name Signs a public key with your secret key. This is a shortcut version of the subcommand sign from --edit.

gpg --local-user FEDCBA98 --sign-key 76543210
gpg --local-user 76543210 --sign-key FEDCBA98

OR
gpg --default-key FEDCBA98 --sign-key 76543210
gpg --default-key 76543210 --sign-key FEDCBA98

as used e.g. in Daniel Pecos Martínez: How to rotate your OpenPGP / GnuPG keys. Never stick with the first tutorial you find, as there are plenty of recent documentation available, e.g.

GnuPG documentation, 4.1.3 How to manage your keys
Debian Keysigning
Jeff Carouth: Signing PGP Keys
Francis Chuang: signing-gpg-keys.md


Crawling for Phishing Websites OBJECTIVE:
We have a requirement to run active scan for detecting and monitor phishing websites for a particular brand.

We want to be as real-time as possible. That would mean that using sites like Phishtank would not suffice.

APPROACHES WE ARE THINKING ABOUT:

We are thinking to do this based on some parameters including, but not limited to images, content, security certificates, etc.
Are there any existing tools which can be worked upon or modified to run active crawling and enlisting the websites that match our phish pattern?
Not sure if quite feasible or even possible - is to monitor public DNS Servers for new domain registrations (is this possible? How?) and crawl these websites, run our phishing detection algorithms.

UPDATE:
I am even open to ideas to achieve the above objective.

Note: I am assuming you are working for/with that brand.

Most phishers perform the minimum work they can to create the fake page, which means they leave links pointing to your javascript, css, images…

By watching the server logs and the referrer provided by your visitors, you will be able to detect new phishing sites using that code in almost real time.

Also, you can intentionally put absolute urls in the html, css and javascript to increase the odds that it leaves some references to your servers.


Can anyone DDOS my server with jmeter? Do they need a powerful server for that? Is there a way to DDOS my web app through jMeter? Can anyone DDOS with a simple PC?

I couldn't find any answer here. I would appreciate if anyone could help me out.

DDOS (Distributed Denial Of Service) implies that the attack is distributed, meaning from many sources. So by definition, one cannot DDOS from a single source; "a simple PC" as you put it. If the traffic came from one source it would be a DOS (Denial Of Service) attack. So, yes, if your jMeter implementation is distributed across many nodes it could be used to DDOS your web app.
Also, yes someone could possibly DOS you from a single source but it would have to be a very powerful server to bring down your web app (Depending obviously on the safeguards you have in place and the design of your web app).
The whole thing about DDOS is that it is able to direct a lot more traffic at your server since the traffic comes from multiple sources (Like an NTP server or misconfigured DNS server).


Comparing two Linux system clones - what about non-regular files? Could you please help me to understand the best approach to compare two filesystems / hard disks?

As a practical learning exercise I created a clone of whole hard drive a month ago and again yesterday (it’s Ubuntu Server and I cloned it on Debian just using DD on disconnected hard drive). The point is to compare known state and unknown that was potentially compromised.

After DDing (sudo dd if=/dev/sdX of=/tmp/my_image1) I attached both clones:

sudo losetup --partscan --find --show /tmp/my_image1

I changed FSID so I can mount it and I mounted it:

sudo mount /dev/loop0p3 /mnt/0a -o ro

sudo mount /dev/loop1p3 /mnt/0a -o ro

After that I simply compared both filesystems to find possible change / malware:

sudo diff --no-dereference --brief --recursive /mnt/0a /mnt/0b

It was just for learning, I didn’t assume to find anything else then new logs, Bash history...

But strange thing that I discovered are non-regular files:

sudo find /mnt/0a -not -type f,d,l -exec ls -l '{}' \;

crw-rw-rw- 1 root root 5, 1 Apr 23 07:32 /mnt/0a/dev/console
crw-rw-rw- 1 root root 1, 7 Apr 23 07:32 /mnt/0a/dev/full
crw-rw-rw- 1 root root 1, 3 Apr 23 07:32 /mnt/0a/dev/null
crw-rw-rw- 1 root root 5, 2 Apr 23 07:32 /mnt/0a/dev/ptmx
crw-rw-rw- 1 root root 1, 8 Apr 23 07:32 /mnt/0a/dev/random
crw-rw-rw- 1 root root 5, 0 Apr 23 07:32 /mnt/0a/dev/tty
crw-rw-rw- 1 root root 1, 9 Apr 23 07:32 /mnt/0a/dev/urandom
crw-rw-rw- 1 root root 1, 5 Apr 23 07:32 /mnt/0a/dev/zero
crw------- 1 root root 10, 236 Apr 23 07:34 /mnt/0a/dev/mapper/control

Could anyone please help me understand:

1) Hurpose of character devices on disconnected hard drive - system is not running, I thought that these files are created by system when it’s running (like files in /prod and /dev) and the purpose is to interface with the system, not to store data

2) How am I suppose to compare it? I can compare standard file (bit by bit), I can compare directory names and I can compare symbolic link (by comparing targets) but I have no idea how to compare this.

1) Hurpose of character devices on disconnected hard drive - system is not running, I thought that these files are created by system when it’s running (like files in /prod and /dev) and the purpose is to interface with the system, not to store data

While /proc is completely generated by the kernel, /dev does have some real contents. While a devtmpfs does usually get mounted over it, early boot tasks that run before that happens need some of the devices. Even though character devices are to interface with the system, they still exist on disk; they just don't store their contents there.

  2) How am I suppose to compare it? I can compare standard file (bit by bit), I can compare directory names and I can compare symbolic link (by comparing targets) but I have no idea how to compare this.

Compare the major and minor device numbers (e.g., 1, 3 for /dev/null). If two character device files have the same device numbers, then they point to the same device and can thus be considered identical. If not, then they point to different devices and should be considered different.


Will Users of Intermediate CA1 trust Users of intermediate CA2? I have my own CA(CA) and 2 intermediate(ICA1 & ICA2) CA's(generated using the root CA).
Using ICA1, generated a server cert(for server S1) and 2 user cert(for user U1 & U2).
Now, user certs is distributed to the user-U1 & U2(including chain trust ICA1 & CA) and they are able to successfully connect to S1.
Similarly using ICA2, generated a server cert(for server S2) and 2 user cert(for user U3 & U4).
Now, user certs is distributed to the user-U3 & U4(including chain trust ICA2 & CA) and they are able to successfully connect to S2.
Since the chain trust is distributed and both have same root CA.
Can User - U1, U2 connect to S2 and User - U3, U4 connect to S1 ?
If they can, I want that User U1 and U2 can't connect to S2 and User U3, U4 can't connect to S1.

Granular access policies are enforced by using application (Access Control Lists, for example) and/or by using directory service (such as Active Directory).
Though, you can specify custom certificate policies in client certificates for U1, U2 and another policy for U3 and U4. Configure authentication/authorization services used by S1 and S2 services to accept only respective policies.


Why/how is browser inserting inline SVGs at end of body? Chrome is inserting the following SVG images at the bottom of pages:

<span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/Pjxzdmcgd2lkdGg9IjI0cHgiIGhlaWdodD0iMjRweCIgdmlld0JveD0iMCAwIDI0IDI0IiB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiPjxkZWZzPjxtYXNrIGlkPSJtIj48cmVjdCBmaWxsPSIjZmZmIiB4PSIwIiB5PSIwIiB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIHJ4PSI2IiByeT0iNiIvPjxyZWN0IGZpbGw9IiMwMDAiIHg9IjUiIHk9IjUiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxNCIgcng9IjEiIHJ5PSIxIi8+PHJlY3QgZmlsbD0iIzAwMCIgeD0iMTAiIHk9IjAiIHdpZHRoPSI0IiBoZWlnaHQ9IjI0Ii8+PHJlY3QgZmlsbD0iIzAwMCIgeD0iMCIgeT0iMTAiIHdpZHRoPSIyNCIgaGVpZ2h0PSI0Ii8+PC9tYXNrPjwvZGVmcz48cmVjdCB4PSIwIiB5PSIwIiB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIGZpbGw9IiNmZmYiIG1hc2s9InVybCgjbSkiLz48L3N2Zz4=&quot;) 50% 50% / 14px 14px no-repeat rgba(0, 0, 0, 0.4); position: absolute; opacity: 1; z-index: 8675309; display: none; cursor: pointer; border: none; border-radius: 12px;">
<span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/Pjxzdmcgd2lkdGg9IjI0cHgiIGhlaWdodD0iMjRweCIgdmlld0JveD0iMCAwIDI0IDI0IiB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiPjxkZWZzPjxtYXNrIGlkPSJtIj48cmVjdCBmaWxsPSIjZmZmIiB4PSIwIiB5PSIwIiB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIHJ4PSI2IiByeT0iNiIvPjxyZWN0IGZpbGw9IiMwMDAiIHg9IjUiIHk9IjUiIHdpZHRoPSIxNCIgaGVpZ2h0PSIxNCIgcng9IjEiIHJ5PSIxIi8+PHJlY3QgZmlsbD0iIzAwMCIgeD0iMTAiIHk9IjAiIHdpZHRoPSI0IiBoZWlnaHQ9IjI0Ii8+PHJlY3QgZmlsbD0iIzAwMCIgeD0iMCIgeT0iMTAiIHdpZHRoPSIyNCIgaGVpZ2h0PSI0Ii8+PC9tYXNrPjwvZGVmcz48cmVjdCB4PSIwIiB5PSIwIiB3aWR0aD0iMjQiIGhlaWdodD0iMjQiIGZpbGw9IiNmZmYiIG1hc2s9InVybCgjbSkiLz48L3N2Zz4=&quot;) 50% 50% / 14px 14px no-repeat rgba(0, 0, 0, 0.4); position: absolute; opacity: 1; z-index: 8675309; display: none; cursor: pointer; border: none; border-radius: 12px; top: 5142px; left: 1901px;">

Only noticed it because I had the dev panel open, and knew the page's code well enough to know they weren't supposed to be there. I confirmed it was happening to all sites after I found it on my own site. It's not present on tabs that'd been open for a couple of days, but appeared if I refreshed them.

Restarting the browser has stopped the behavior, at least for now.

The fact that the second SVG was positioning itself way offscreen and z-indexed high certainly seems like the actions of something malicious.

It's probably not Chrome itself doing this, but a browser extension. Extensions can be given permission to modify the content of open pages - this is usually needed for them to be able to do whatever they were designed to do. Off course, a malicious extension could also use this permission for all sorts of evil.

So what extension is this and is it malicious? I have no idea. You'll need to check what extensions you have installed. If you only have extensions you installed yourself and that you trust, everything is probably fine. However, if you find some unknown extension it might be a sign of a virus infection.

This is what the image looks like (on a grey background). If you recognice it as a UI element from some extension you use, I'd say everything is fine.


"Same origin policy" and XSS I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port.

This explains what SOP is and why it is important, but not so much how it helps in preventing XSS.

An attacker could craft a malicios link http://www.store.com/sale/products?id=<script>script stuff..</script> and making the user click on it. Vulnerable site would reflect the code back to clients browser. If I'm understanding this right, SOP would prevent the js code from accessing data in the clients browser that belongs to another origin (say, facebook.com) and stealing a session cookie.

Now, If the malicios code was coming from facebook.com, as it would in a stored xss attack, the SOP would apply?

TL;DR :
I guess my question is how does the 'Same origin policy' prevent XSS attacks, and if there are types of xss it doesn't prevent. Also how does SOP translate to cookie security, specifically, the case when an attacker steals users session cookies and uses it to perform actions on users behalf.

how does the 'Same origin policy' prevent XSS attacks

It doesn't.

The SOP works when there is no XSS vulnerability.

It ensures that evil.com cannot read data with your authentication from eg facebook.com. This holds true as long as facebook.com doesn't introduce it's own vulnerability which allows bypassing of the SOP.

And that is where XSS comes into play. It essentially allows bypassing of the SOP, because now an attacker can execute their script from the same origin as the application (eg facebook.com).