Is 'Bring your own Identity' as the only authentication option a valid practice? This question is mainly aimed at OpenID Connect, when it is fully realized.

I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed to finally allow developers to simply implement OIDC once and have it work with every provider.

Once this happens and people have the option to sign in with a non-social-network, and see the options like Symantec and realize that 'oh, this Identity thing isn't just about sharing my email contacts and friends list with the entire planet', I believe that much of the distrust will evaporate.

So ignoring the hesitation to oauth with a social network, and moving onto the question:

Is BYOID as the only way to authenticate, and thus completely outsourcing authentication, a valid security practice?

Yes this is a reasonable approach.

It is not a zero risk approach. If a user does not already have an OpenID Connect account, or they do not understand the concept, the sign up process becomes more difficult and you risk losing that user. Because you are doing something that is non-standard you will get some smart alec users who pester your support guys with pedantic complaints. And if there is some future compromise, perhaps a flaw in the OpenID Connect protocol, you may look foolish compared to the sites that never pursued this approach.

But on balance I believe this is a good thing to do. Most users will already have an account with one of the major provides and will be happy to use that, just as I happily use my Google account to log in to stack exchange. A smaller number of users will have an account with a minor provider, who they've chosen because they like their privacy policy. And some will even run their own OpenID Connect server. I believe this covers everyone's needs, so there is no need to provide a fallback to user name + password authentication.

Edit - rereading my post I realise I have made two assumptions:

That OpenID Connect becomes a widely-used, defacto standard. If it doesn't then you certainly need to provide alternatives.
That your site is not highly sensitive. If it is then you should probably be using multi-factor authentication.


Is there any hope of getting my pictures back after an iPhone factory reset some day in the future? Four months ago I lost all my data after an iTunes update automatically restored my phone to factory defaults. I lost all the pictures of my newborn.
I understand that when you do a factory reset the decryption key is discarded so the data is unretrievable. There's nothing I can do now. But is there any chance I'll be able to recover the pictures in the future? I have kept the phone in my drawer.
I have created a group with so many moms like me; we all lost photos of our little one due to unexpected factory resets. It's not an isolated issue.
**This question is about iPhone data decryption in the future but not how should I find my lost data with my laptop, backup file, etc. I have tried all methods.

Modern encryption is strong enough that there is no way to retrieve the lost data without the key. Although it's possible that it could be doable in the future in theory, consider that even the cipher 3DES, a trivial modification to a cipher designed nearly half a century ago in the 1970s, cannot be broken in the manner you want, and that was cryptography in its infancy. Modern iPhones use AES which has held up to 20 years of analysis and is showing no signs of meaningfully weakening.
Ciphers are never secure one day and fatally broken the next. There is virtually never a massive breakthrough that renders a cipher useless, as attacks are improved incrementally. If AES ever gets broken badly enough that you would be able to recover the encrypted data without the key, there would have been decades of slow improvements to the attack and we would all have known for years that it's too weak to even consider using. If that were the case now, I'd tell you to wait a few decades and maybe, just maybe, a key recovery attack would be released, but that's not the case.
The data is gone. Plan for keeping backups in the future to avoid a repeat of this issue.


Connecting to a compromised server There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as completely compromised.

Often you utilize the server unknowingly until you discover the hack. Sometimes you have to connect to the compromised server to investigate.

What possible risks exist from utilizing a server in its compromised state from another machine?

I mean everything from visiting a compromised webpage on a site hosted on the server to SSH'ing directly into the server from another machine. What malicious actions can be run against the remote machine accessing the compromised server or what potentially sensitive information can be used to aid an attacker in then taking over your remote machine? (RSA keys for example, or utilizing an active SSH session)

Let's start with eh two examples you gave:

Accessing a compromised website means you may be browsing malicious web pages. If your web browser is vulnerable and the attackers have modified the web pages to take advantage of that, you may be pwned.
Recently, we had an OpenSSH vulnerability that allowed an attacker to potentially steal your private key by using a "roaming" feature. Essentially, it lets a malicious server begin siphoning memory from your machine if you connect to it. If your client is vulnerable to this you may be pwned.

More info on the roaming vulnerability in OpenSSH


Google's Mobile Authentication for REST APIs So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using PhoneGap/Javascript/HTML. We could very well use HTTP Basic but I wanted something a little more advanced and secure. I do not want to use OAuth or Amazon's AWS security as those seem to be mainly for opening up your API to the public or a 3rd party.

I'm really new to REST APIs and security, but after doing some research I plan to use this
implementation as written by Google. I'll sum up the general idea:

User sends the server credentials through a secure POST
If the credentials match. The server creates a token, saves it in the database, then sends it back to the user. The token will be based on the user's UUID and a timestamp.
The database will store the last time the user changed their password and will only validate calls with tokens that were issued after that time.
The user then sends this token in the header with each API call

How secure is this implementation? How do I stop brute force attacks on my authentication method? Any other suggestions or recommendations are appreciated.

The security of this solution depends on the security of two elements:

The connection: If you're using SSL then the problems linked to connection security are well understood (if not always easy to evaluate): client-side root store quality, proper key exchange, use of secure protocols, etc.
The token itself. First, it needs to be generated in a way that makes it difficult to guess and impossible to reuse. It also needs to be protected while on the client system (this is more of a problem in a web application than on a dedicated client but needs to be mentionned).

Assuming that both aspects of the problem are properly handled, then yes, such an implementation is pretty secure.


DoS attack blocks website while in another connections show website run normally I am learning Ethical Hacking.
I create my own website on a cloud hosting service for testing purposes.
I run DoS attack from my local VM and it shows that website is down.
When I sent a link to my friend he told me that the website runs normally. When I change network and connect to another WiFi it really shows that website is running normally.
What is the point here? What do I need to be focused on?

You wrote that you attacked a hosting provider. The first thing you lean in ethical hacking is that you should not attack systems without the consent of the owner and of the service provider. This includes not (D)DoSing Internet hosting providers.
Anyway, the most likely explanation in your case is that the hosting provider answers your attempted DoS with a static page, which for him requires almost as much effort as blacklisting you at network level.


How can cloud service providers know that they are being used for launching a DoS? Can cloud service providers like Amazon, Microsoft etc. detect that they are being used to launch a DoS/DDoS against any target? If yes, how?

I am guessing that if they attack a single machine, a good IDS can detect it. My doubt here is, can the IDS detect a scenario where the cloud system spoofs the IP address and floods several different machines to DoS the target.
On a similar note, can the cloud service provider detect if it's hosted machines are being used in botnets?

Source of inspiration: http://www.networkworld.com/article/2858874/cloud-computing/sony-may-have-used-amazon-s-cloud-to-launch-a-counter-dos-attack-after-its-breach.html

First of all, IP spoofing can and should be detected and blocked. The provider's firewalls shouldn't allow packets that have a source IP different from the legitimate netblocks assigned to the server, and raise an alert as IP spoofing is a pretty reliable indicator that some idiot is trying to use the server for DoS or similar nefarious things (I can't think of any legitimate use case for IP spoofing).

For simple bandwidth-exhaustion DoS, assuming the former method didn't catch it, the provider can try to detect common indicators such as whether the packets correspond to any known DoS tool or malware, whether packets are similar (1Gb/s of exactly the same UDP packet seems suspicious for example), and can finally apply advanced neural-network based pattern matchers that try to look for anything unusual just like banks do for credit cards (a server who never sends out much traffic suddenly sends out 1Gb/s -> raise an alert).

For higher layer attacks such as HTTP, etc I do not see much solutions I'm afraid. The first issue is a legal and ethical one. Comparing the source/destination, size and entropy of packets (as described above) is one thing and personally I would be fine with it, on the other hand having a proxy that would try to parse any packet sent out and break it down into a list of HTTP headers, DNS requests, etc is another thing and would be equivalent to wiretapping and besides being potentially illegal, I bet most people wouldn't like it, even if it is used for legitimate purposes (but once you get the potential to parse and understand any packet, it's only a matter of time before someone decides logging that data for whatever reason).

Assuming the legal/ethical concerns are out of the way, it would be really difficult to tell legitimate and malicious packets apart. There are some applications that can be brought down with just a handful of requests to the search form with the right query. How will a system like this tell legitimate search form usage from malicious abuse?

In my opinion, higher-layer attacks are best dealt with at the attack's recipient, as only they can tell a malicious request from a legitimate one, and can easily implement countermeasures on their own, as opposed to bandwidth exhaustion attacks where cooperation of the attacking network's provider is necessary since getting enough bandwidth to sustain an attack is sometimes impossible for a medium-sized company given a large enough botnet.


Why OpenVPN is using both certificates and DH? I am reading about OPENVPN and I am a little bit confused. In the OPENVPN howto website, there is a step by step setup guide for generating certificates and diffie-hellman (DH) params. However, I cant see why the certificates are used in conjunction with DH.

I think about this in the following way: The certificates and private keys are used for asymmetric encryption (so all the encryption is done asymmetrically which is not practical), while DH is used to generate the secret key in order to use HMACs to ensure message authentication.

I am not sure about my thinking. Could someone please clarify this for me?

Key pairs are used for two things:

Encrypting a secret value for symmetric encryption
Signing data for validation

Both RSA and DH are based in asymmetric algorithms.  So we have two cases for a secure exchange to occur.

RSA

Alice signs a message to Bob, and encrypts the message with Bob's public key.  Sends message to Bob.  Bob decrypts with his private key.  Verifies the signature to ensure that Alice sent it.  The message is going to be a symmetric encryption key.  This is what's used to secure the connection.

DH

The Diffie Hellman exchange relies on two separate entities generating a secret value.  Through some math magic they're both able to generate a common secret value.  This common secret is what is used as a symmetric key or to derive symmetric keys.  But these secret values that are generated by each side are generated at the time of need.  They don't have an identity associated with them.

That last part is why you might need both.  Using RSA you can have a key pair that will do both encryption and signing.  With DH you only perform the encryption, there is no signing mechanism.  So you need an RSA certificate in order for you to validate the DH data that you're sending.

So why use Diffie Hellman?  Because DH is the basis for Perfect Forward Secrecy.  Which is better explained in this answer.


Encrypting important context vs data sets associated with context I am looking for an example in the real world where only a portion of the entire data set is encrypted even though the entire data set is considered sensitive. Specifically the portion that gives context to the rest.

For example (maybe a weak example). If you had sets of data on personnel, some of the raw data associated with each person may not be encrypted, because its easier to transfer if it isn't, but the identity of the person or any other critical context-providing data is encrypted.

The purpose of this would be to make manageable the transfer of the majority of the data across unsecured platforms easy. The encrypted context data could be carried separately and married back only when needed.

Example:

You are a doctor, and you want to use data from patients in a research project (Hospital research, not academic...). Part of the work is showing and comparing data with other doctors. This means you email ppt and excel spreadsheets with patient data. Most of the time the other doctors don't care about who the patient is (identity+more complete records) while they look at the data sets (maybe at the end, when they need to decide next steps). When they do, you want them to use their own access to get further patient records. But in order to do that, they need to have keys for each patient. These keys would be carried with the decrypted data.

You can't send and share the data encrypted. It doesn't work. one guy has a ipad, another has a windows netbook. And the engineer turned doctor has a linux distro running on an old mac laptop which he takes great pains to tell everyone works much faster than it did with OSX.

Excel is not secure. Even if you could deliver it encrypted, as soon as it is readable, it is copyable.

Generally speaking, encrypting only part of the data can potentially be a security risk, because (depending upon the situation) it may be difficult to be certain that the part you leave unencrypted is completely free of anything sensitive.  I am sure examples exist, but that doesn't mean they are necessarily the best practice to follow in every setting.

Why do you want an example where some of the data is left unencrypted?  If you tell us more about why you are seeking such an example and what problem you are trying to solve, maybe we can help you with the real problem you have.

P.S. You seem to believe that unencrypted data is "easier to transfer" than encrypted data.  I am puzzled by that belief.  Data is data.  It is just bits.  It doesn't matter whether it is encrypted or not; either way, you are just copying bits and bytes.  Doing a file transfer of an encrypted file is no harder than of an unencrypted file; it is exactly the same command (e.g., scp, or whatever).


OpenVPN -cipher vs -tls-cipher? I'm currently using the -tls-cipher command on server to only allow the cipher I want (TLS-DHE-RSA-WITH-AES-256-GCM-SHA384) but there is the command -cipher too, and OpenVPN's man page is not really clear with the differences between them. Googling also returned no useful information. Many websites also tell me I should use the two too but don't say why, I wanted to check here first.
Do I need to use -tls-cipher + -cipher to make sure I only use AES-256-GCM to encrypt the connection?
I'm on OpenVPN 2.3.

'Modern' OpenVPN (2.x, using the TLS mode) basically sets up two connections:

The 'control channel'. This is a low bandwidth channel, over which e.g. network parameters and key material for the 'data channel' is exchanged'. OpenVPN uses TLS to protect control channel packets.
The 'data channel'. This is the channel over which the actual VPN traffic is sent. This channel is keyed with key material exchanged over the control channel.

Both these channels are duplexed over a single TCP or UDP port.

--tls-cipher controls the cipher used by the control channel. --cipher together with --auth control the protection of the data channel.

And regarding security, OpenVPN uses encrypt-then-mac for its data channel, rather than mac-then-encrypt like TLS. All the CBC-related issues you hear about are due to the combination mac-then-encrypt + CBC. This means that AES-CBC for the data channel is perfectly fine from a security perspective.

(And there is no GCM support for the data channel yet. That will arrive in OpenVPN 2.4.)


Is installation id secure enough to authenticate device's user against a Web Service API? ...or interactively asking for password / or having some certificate is inevitable?

Context

My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my user with asking/registering passwords, neither asking to install certificates.

So here is a proposed solution, but I have serious doubts about it can not be faked.

Proposed solution

The connection between the my Android App and my server API is constrained to HTTPS
Before the App first communicates with the server it queries my App installation Id. All subsequent API call will have this unique id as first parameter.

Question(s)

Is it possible that any 3rd party (criminal, hacker) get know this installation id, (say installing an other malicious app on the very same device) so then can send fake requests to my server using any custom tool say a desktop app?

What an Attacker can do is , in a rooted device, decompile your apk and understand what is being communicated with the API to do Authentication or Identify the user in your back end. They can re-engineer that communication process in any application(Desktop or another mobile platform).  Remember once some one installs your Android application in their devices , you do not have any control over that application.

Your solution would work in a controlled environment such as corporate network(Assuming you are installing the app only in known trusted devices). In public, I highly doubted your solution would work.

And according to the industry standards, it is not recommend to open up a public API (if your API is public) without any Authentication mechanism.


How does one exploit cross scripting? In my computer science class, my professor provided the following example...

Normally, a user would provide a link by typing the following in chatroom...

[Example Website](https://example.com)

And receive a output of...

Example Website

(highlighted in blue and click-able)

However, if the input was modified to...

_[Example_Website](https://example.com)_

Then the output would be...

Example_Website_

(with the blue clickable link ending after the e in website, but before the last _)

My task was to attempt to figure a ways to exploit this, but im quite lost on how to do so. Ive attempted to add in more as follows...

_[Example_Website](https://example.com/>">&)_

Which resulted in...

Example_Website</script>&)_

(blue clickable link now ending after the e in Website)

I noticed some of my code disappeared, does that mean it was executed on the remote server? Is there any other simple test that should be used against this to find out if its exploitable?

So the answer to this is that there is no exact right answer unless someone here has exploited the same exact issue in an almost exactly similar way before. Unless there are absolutely no protections against XSS on the site, then it’s usually a bit of a cat and mouse game between the server admin and the attacker (you). The server admin will attempt to thwart your attacks using methods such as HTTP headers set on the web server, Content Security Policy (CSP), escaping user input, validating user input, sanitizing user input, and many more.

In this case, it appears there are certain protections in place, so you need to learn how the code is working to be able to properly attack it. I would recommend looking at source code, using a proxy such as Burp Suite, looking at HTTP headers, and doing a bit of googling.

Since I’m lacking the surrounding information in this case, I’m unable to tell you exactly how to leverage the site with XSS.

But addition, any of the edits you are making are not being processed on the server. XSS is a client side attack that is loaded and executed in the browser, but in the case of persistent XSS is merely stored on the server and served to clients.


Firewall says that a program that I'm developing is trying to connect to the Internet I'm seriously confused about this, since the program is entirely developed by myself and has no means/functionality to connect to any network/the internet whatsoever.
I'm a software engineer but not knowledgeable about computer security, so while I have it running in the debugger of Visual Studio on Windows XP Professional my Comodo Firewall shows an alert that let's call it "MyProgram.exe" is trying to connect to the Internet.
Since there's no reason for this program to connect to the Internet I choose to block it. At the end in the firewall logs, 5 connection attempts of MyProgram.exe are logged in a time-span of a few minutes listed and the whole incident is listed as "Firewall has blocked 1 intrusion so far".
(Btw the real name of the program and residing folder is very unique and I can definitely not mistake a different program for this.)
The complete source code is written by me except for a parser and lexer that were auto-generated by antlr. The source from which they are auto-generated is written by me as well.
A reverse lookup of both IPs, it seemingly tried to connect to, is listed as belonging to the same big internet company.
(I'm using an up-to-date virus-scanner and I never had virus problems with this pc. I checked the running processes with process explorer and didn't find anything unusual.)
Could that be a bug in the firewall, like a false positive?
Could it be that the connection attempt was actually coming from a different application and got mismatched with my program due to it being run in the debugger?
What would your thoughts/steps be in such a situation?
I assume that a lot more information is necessary to answer this but I'm not sure what's relevant and what's critical or uncritical to post, so what would be important?

Update
Thanks a lot for the answers.
I'm writing a little more verbose about my findings in case someone else has a similar problem so that this is easier to find.
The main thing that had me confused was the combination of the following:

It looked random; in other words I couldn't match it with something I did which might have triggered it
I couldn't reproduce it (neither with the debugger nor with the standalone exe)
I'm developing this program for over a year now and this has never happened
Shortly before that another program (which I downloaded just a few days ago) tried to connect to the internet, which didn't seem necessary/not triggered by me as well.

To keep it short, the other programs connection attempt was definitely unrelated to that and very likely just an update check.
The company the IPs belong to was Akamai and after searching again I found an article describing an "alliance between Akamai and Microsoft" and "service available to ... .NET developer tools such as Visual Studio(R)"
So after that I thought it's very likely that it was Visual Studio and tried again to reproduce it and finally accidentally did so when clicking on the +-symbol to expand a CommonTree-variable in the watch-window during debugging.
Since I can now always reproduce it with that, this must have been what triggered it the first time as well.
So with hindsight what happened the first time I would say is me clicking on it triggering the connection attempt and since I block it or let it timeout these five tries all belong to one connection attempt by visual studio and expanding or collapsing the CommonTree-variable after such a connection attempt does not trigger another one, which makes it look very random.
All this and the fact that a "debug-run in itself" (without the click) doesn't trigger it is the reason why I couldn't assign it at first to this very specific trigger:
"during debugging expanding a CommonTree-variable in the watch-window".

A couple questions first:

what do you mean by "the same big internet company"?
Is it MyProgram.exe or MyProgram.vshost.exe trying to connect?
What happens when you run the application in release mode without the debugger?

It could be that the Visual Studio debugger is trying to download debug files for CLR assemblies and the firewall is mistaking the request as coming from your app instead of the debugger hosting your app.


Web app and database on same server, what is benefit of encrypting database data? If a web app and a database are on the same server, what is the security benefit of encrypting database data?  Obviously passwords should be hashed either way.

I assume that if an attacker can inject some SQL or server code he would be able to view database data.  Could somebody more precisely outline the security implications?

Edit: To clarify I was talking about encryption of data. The encryption method is not deterministic so enc(data1) != enc(data1)

The pro's:

Encrypting the database will ensure that should the database files be leaked they will be inaccessible by the attacker or any other party they are shared with (given the attacker did not also obtain the key/password/user privileges). This means if the server is stolen or old backups are lost or the database files are obtained otherwise the data should remain confidential.

The con's:

There is a performance overhead associated with encryption/decryption of the data in the database. This depends greatly on the database system you are using and the type of encryption. It can be ascribed to the fact that every data set that is queried from the database would have to the decrypted to be usable by the web application and similarly all data written to the database would have to be encrypted. These operations can take a long time, especially on large data sets. This performance overhead can be negligible or significant depending on your use and expectations of the database.

The caveat's:

Encrypting the database does not protect the data in it if the attack vector is your web app (like the SQLi you mentioned). Your web application accesses the database as a privileged user that can decrypt the data in the database, thus any attack that is executed through your web application will be able to access the encrypted data. This means that a determined attacker would still be able to extract all the data from your database via a SQLi vulnerability.


XML external entity - Local file enumeration (Impact assessment question) I had come across an XML request-response pair while testing a web application and attempted to inject XXE payloads. Note that in this case no XML parameter sent in the request was getting reflected in the response. However as the request and response were in XML I decided to try XXE payloads.

Though I was not able to include any local file from the server in the response, I received different HTTP responses for request containing valid and invalid file names. e.g.

<!ENTITY file SYSTEM "file:///etc/hosts" (valid file)
<!ENTITY file SYSTEM "file:///etc/hosts1" (invalid file)

For each of the above cases different HTTP responses were received. The valid file name returned an XML response without any errors and the invalid file name returned an XML parsing error clearly stating - 'file not found'.

I am finished with my report for the activity and have reported this issue as "File name enumeration due to XML parsing errors". However I was curious about different ways in which this vulnerability can be exploited to obtain more information about the back end server and would like to receive any inputs to assess the technical impact of this vulnerability.

Not a complete answer, but it's worth noting that XXE can often be a DoS bug as well as an information disclosure bug. Try reading from /dev/zero or \\.\pipe\atsvc or any other kind of special pipe/socket/file that either never ends or will simply block for approximately forever. Of course, if XXE works then you can usually also do recursive entity expansion (a.k.a. Billion Laughs, which is also a pretty easy DoS.

XXE can also be used to pivot a network scan behind the server's firewall. You don't have to specify a file: URI scheme; http:, https:, ftp:, and so on work too. You can also specify non-standard ports, which is helpful when looking for things like certain admin interfaces. This is, of course, more useful when you have access to the contents of those URLs, but just knowing the services are there is often helpful.

It's very odd that you weren't able to get the file contents. Usually that's possible in one way or another, be it via an error message or by specifying the file contents as user-supplied input and then reading them out using another function (as in, "why yes, my home address is the contents of your TLS private key!").


What happens if a pro-censor ISP has Telex key(s)? I've been watching more and more people jump on the idea of Telex as a way to prevent internet censorship (e.g. http://www.technologyreview.com/communications/38207/ -- not my comments at the bottom of the article).

  Halderman says the design is such that it doesn't matter if the location of ISPs employing Telex stations are known to the censors. "The key thing is that we want to put the stations at enough points in the Internet so that blocking all the routes that go through those would be tantamount to making the Internet unavailable," he says.

I've gone over the basic design and it's a pretty neat idea, I'll admit.  But I'm a little confused...

What happens if an ISP that already has Telex keys (for instance if a government takes control of the ISP) goes rogue? It seems that they haven't solved for determining who a trusted ISP would be?

The Telex scheme seems impractical. It seems to be designed for a scenario like this:

There is an area AreaA with a represive governing authority. In AreaA a individuals ability to speak, write, travel, and meet or associate are restricted. AreaA has internet access but the access is monitored and controled by the governing authority.

There is an area AreaB with general liberal democratic freedoms: freedom of speech, publication, travel, and association. AreaB has internet access and the access is not (or very loosly) monitored and controlled by a governing authority.

The governing authority in AreaA allows limited access from AreaA to AreaB, and from AreaB to AreaA. They monitor communications in both directions.

The governing authority in AreaB allows unrestricted or lightly restricted acess from AreaA to AreaB, and from AreaB to AreaA. They rarely monitor communications in either direction.

The scheme depends on creating significant number of Telex stations. The Telex stations must be in AreaB and allowed by the governing authority of AreaA. The governing authority of AreaA must not be able to identify identity the Telex stations or they will remove access to those stations. However, the Telex stations must be able to handle a moderate amount of traffic, and most be powerful enough to handle the cryptographic and processing requirements without a detectable difference in traffic patterns. If the governing authority of AreaA blocks access to enough Telex stations the availability of the system degrades and traffic flow decreases.

Providing clandestine information channels is a difficult problem. See Embedding Covert Channels into TCP/IP.

The distribution problem:

The software needed to create Telex messages must be distributed to users in AreaA. Given that the governing authority (GA) of AreaA is monitoring and potentially blocking messages from AreaB to AreaA. It is difficult to get software to the AreaA users. I think it is a logical addendium that the GA of AreaA is additionally monitoring and blocking postal mail and package delivery. Likewise, we can assume that GA of AreaA is monitoring and blocking PSTN as well as GSM/CDMA. The effectiveness of each channel will determine how to distribute the software.

Key distribution can be combined with the software distribution problem. The Telex messaging software can be distributed with a Telex station public key. The software could generate a public-private key pair for each user and send the user's public key to the Telex station in a covert message.

The bandwidth problem:

The larger the bandwidth the system provides, the easier it is for the governing authority in AreaA to detect Telex stations. The smaller the bandwidth the system provides, the less useful the system is to people in AreaA.

The innovation problem:

The Telex messaging relies on standard protocols to covertly deliver messages from AreaA to AreaB. If non-standard protocols were used then detection would be easy. What happens when the protocols change or improve? Will Telex messaging be forward compatible, backwards compatible? Will the carrier protocol need to change? The Telex messaging software will need to be revised and updated. Every update or revision puts the users in AreaA at risk of discovery when the attempt to acquire a new revision or update. However, failure to modify the software for too long a period will also put the users in AreaA at risk of detection as the GA in AreaA refines their detection methods.

The station identity problem:

If the Telex stations remain static, then after some period of time the governing authority (GA) of AreaA will be able to detect the stations. If the Telex stations change then the system needs to inform the users in AreaA of the change. Even if the users in AreaA don't know the real station identities, they will need to know approved sites in AreaB that will allows their messages to be routed through the Telex station. The more frequently the stations chanage the fewer users in AreaA will know the identity of the Telex stations at any given time. There is also the problem of the number of AreaA users. The more people know the Telex station identities, the more likly GA of AreaA will discover the indetities.

If hierarchical scheme is used to distribute the station identities (most users know one station id, some know two or three, and a few know eight or more), then GA for AreaA will attempt to find the users in AreaA who know the most stations. It may take longer to find users who know many stations but discovery will severly impact the system by cutting off many stations at the same time. If a flat scheme is used (stations identities are distributed uniformly) then stations will be discovered and blocked at a more steady rate.


Benefits to client-side password hashing on top of other security mechanisms We live in a world where password reuse is common and most of the internet users are not using password managers, while hacks and breaches are becoming more common. The importance of those breaches lays not only in an access to the compromised website, but in a fact, that leaked passwords are commonly reused for social media, emails or bank account, and to access all kinds of vulnerable information which can cause havoc in one's life. The question is about benefits of client-side to the regular user, not the highly educated one.

Are there security benefits of client-side hashing, when combined with TSL, strong server side salted hashing and all other kinds of security measures?

I have read on multiple posts, that

  client-side hashed password becomes the password.

and that

  ssl solves all problems during transportation

But I try to imagine a scenario when the password can never be read even by someone controlling the server.

But isn't there a benefit to not ever knowing the password, which might be weak or reused? Isn't it an additional layer of protection against malicious admins, leaked logs, or breaches like a recent one that happened to Cloudflare?

Or am I missing something that makes client-side hashing completely useless?

Additionally, I can imagine an ideal scenario, where a browser by default wouldn't let a website (nor it's JavaScript code) access the value of a password input box, which would eliminate the developer-tampers-with-client-side-code attacks. Wouldn't security by default be better than security by choice (password managers)?

Besides @Sefa already providing a great read, there is a benefit in the sense that if the server is malicious and doesn't salt+hash your password (or an admin intercepts the traffic) and you are foolish enough to use the same password on many sites, salting and hashing your password client side will prevent a malicious server from stealing your password on other sites.

Besides this scenario I cannot think of any use of client side hashing when combined with TLS and strong server side salted hashing on a trusted server.


How to handle improper key sizes (AES encryption) I couldn't find the right answer in specs how to handle improper key sizes which are greater than AES_KEY_SIZE. (I found that keys which size are to short will be right filled with 0x00 values).

So for example, if a 144-bit key (instead of 128-bit key) would be used for AES-128-ECB, what should be correct behavior?

returning an error ?
truncating the key to 128-bit ?
treat the key as password and use some kdf function?

This is an API question, not an cryptography question.  The AES standard (FIPS 197) is silent on how nonstandard key sizes are handled.  The AES implementations I've seen all reject nonstandard key sizes with an error; however a higher level crypto implementation (that does more than 'just AES') might choose to provide more services (depending on the job it is designed for).

On the other hand, the question typically doesn't come up; we most often generate an AES key with a key derivation process, where we specifically ask that process "give us 128/192/256 bits of key", and that's how much key it gives us.

As for your alternatives, IMHO, silently truncating the key value is Evil; what is the right thing would depend on what you're actually doing (and who's actually generating the key, and why might it not be a standard size).

Also, ECB mode?  Unless you know exactly what you're doing (and if you have to ask this question, you don't), you should avoid it.


Corporation Best Practices for Encrypting Locally Stored Email Data Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an organization that size, they likely use some sort of Exchange or OWA service. I was curious how data that was related to email accounts was stored locally. It appears that the data is stored in an OST file at the following location for our network.

C:\Users\%USERNAME%\AppData\Local\Microsoft\Outlook

This document appears to be unencrypted, however, it is reliant on the user or admin credentials to access the file location. Microsoft recommends using EFS for encrypting files, such as this, to protect it's contents. The problem with EFS is a large scale deployment of a company Sony's size would make this difficult to complete a roll-out due to the complexity of creating individual certificates and storage locations for each individual user. Without using EFS, are there easier to implement solutions that incorporate into Outlook to protect User's OST files from prying eyes in the event of a major breach?

EDIT: To clarify, the data I am trying to protect is data at rest. Outlook has the option enabled for Data Encryption between Microsoft Outlook and Microsoft Exchange.

Encrypting the OST wouldn't necessarily mitigate a breach. If user credentials are compromised, those could be used to decrypt an OST and whatever other files were encrypted, whether at rest or in-transit. There is no silver bullet.


2FA why not to ask the code before password So in most websites on login page you have to input username and password for e.g. Facebook where you input username and password and then submit form. Other websites ask you each separately e.g. Google where you input username and submit, then password and submit etc.

In case the second scheme is used - username then submit etc. Why not use the SMS code first?

My idea is that this would prevent users from guessing or bruteforcing the password, which commonly is used on other services like email, which then often can be used to unlock account from SMS authorisation.

Another reason is that this would provide the user straight with information about login try.

Edit: I realized that I did not mentioned that 2FA is not required, but rather optional, similarly to facebook or google.

I also would like to assume that the 2FA process is not flawed itself - the user can not set invalid number and the number is checked upon setting. The number would been checked by sending test OTP which would be required to confirm that the number is correct.

TL;DR Security is hard and making even small changes to the way security protocols work can open up unexpected attacks. While it may seem at first glance like putting the 2FA before the password helps to protect the password, it actually opens up much worse attacks. Let's have a look!

The problem we're trying to solve

According to your question, the problem you're trying to solve is password brute-forcing. This is a bit of a red herring because people crack passwords against stolen or leaked databased of password hashes, people don't brute-force against live servers because things like rate-limiting already do a pretty good job of solving this problem. That said, let's take a look at different types of 2FA and what would happen if the 2FA went before the password.

Code generation Apps

aka Time-based One-Time Password algorithm (TOTP), for example, the Google Authenticator:

I agree with you that I can't, off the top of my head, think of a reason why putting this first would weaken the authentication protocol.

Notification Apps

Some 2FAs are designed to pop up a notification on the phone rather than hiving you type a code, for example the Blizzard Authenticator:

Doing what you suggest of putting this before the password would actually be dangerous because it leads to a denial-of-service attack: the attacker hammers a user's account so that there are near-constant notifications on their phone, either preventing them from being able to use their phone, and / or forcing them to disable the 2FA in order to make the notifications stop (and weakening their account).

SMS Codes

aka sending a One-Time-Password to your phone by SMS.

This has the same problem as Notification Apps in that it leads to an obvious denial of service attack, but it's worse because in some places, phone carriers charge for incoming SMSes, so the attacker can force the user to pay huge cell phone bills.

Summary

Of the three types of 2FA apps I mentioned, your proposal is neutral for one, and detrimental for the other two.

Also, putting the 2FA step first would advertize to attackers which user have enabled 2FA, and which have not. Basically telling them who the easy targets are.

Finally, the notification and SMS based 2FAs server another valuable purpose: an alarm to tell you when your password has been cracked. If I get a 2FA notification that I did not expect, it's time to change my password.

I like that you are thinking outside the box and challenging the way things are. Security is hard, but don't be discouraged from asking more questions, this one was fun to answer.


FoundStone scan + URI filtering I have a server that is protected with a firewall with URI filtering rule.
So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use different protocol (not http) FW will block you.

I would like to run FoundStone against this server via FW.
(It's apache server)

Is it possible?
How should I do it?

If you want to run FoundStone against the server through the firewall, you make sure the URI filter won't drop it, so either add the required bits to the traffic or add an exception to the firewall.

They both have pros and cons:

Running FoundStone with an exception in the firewall - lets you fully test your server, but is not a realistic test, and it opens up a new hole in the firewall, which may increase your risk
Tweaking its scan options to include the URIFilter will not get as wide a scan, but will be relatively realistic.

My preferred option - use something else as well from inside the firewall, whether it be quarterly automated scans, annual penetration tests or whatever.


Why does a web site operator need to trust an openid provider? I am working on a web site and am considering using OpenID for authentication.  The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, just saved game state.  From my point of view, my main concern for authentication is that the person who paid for those services is the same person using those services.  I don't care about verifying that user belongs to a particular email address or other public identity.

What risks do I open myself up to if I allow using johndoeblog.com/openid versus a well-known provider like Google?  Perhaps the user himself trusts his own private server more than Google?  Why should I force him to trust the same auth providers I trust?

The one factor I can see is the user either voluntarily sharing his credentials or them being compromised, thus allowing multiple people to access the premium services, but that's a problem I have to mitigate no matter what auth provider I use.  What am I missing here?

Basically, you don't need to trust an OpenID provider: the user does.

Let's compare, from the strict perspective of authentication, passwords with OpenID.

Password: User: “hey, server, it's me! You know it's me because no one else knows the magic word correcthorsebatterystaple, which I told you when I created the account.”
OpenID: User: “hey, server, it's me! You know it's me because johndoeblog.com/openid says it's me, and I told you to trust johndoeblog.com/openid when it says it's me when I created the account.”

In both cases, as a server, you rely on the user's willingness and ability to choose a reliable authentication method. With passwords, the user must choose a password that nobody else knows. With OpenID, the user must choose an OpenID endpoint that nobody else can use.

For authentication purposes, there is no reason, as a server operator, to prefer one OpenID provider to another. You may (or may not) prefer to recommend OpenID providers who you know to be reliable, but you do not need to trust the OpenID provider in any way to authenticate the user.

Both cases rely equally on the user's cooperation to ensure that the user who paid is the one who uses the service. A password-authenticated user can share their password; an OpenID-authenticated user can allow the use of their OpenID endpoint.

All this is because you only care about the user's identity as account #1234 on your server. It would of course be completely different if you wanted to know that the owner of account #1234 is known as Joe Bloggs to the government of Syldavia: then you would need to trust the OpenID provider to provide you with Joe Bloggs's real name.

One minor reason to trust an OpenID provider is to offload the work of limiting account creation rates: if you know that Myriad has measures in place to restrict the account creation rate, and you only accept Myriad OpenID accounts, then this automatically restricts the account creation rate for your service. This doesn't apply to you: given that you're running a for-pay service, account creation rate restriction is built in.


Linux/ssh - Forensic question In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I  disconnected and I closed the terminal.

Is it possible to find on A, informations about which commands were used on B through the ssh connection.

Sorry for the noob questions, but thanks for any help!

It depends... you can set things up so the commands are recorded on the client side.  By default the sent commands are not logged by the client though, if that is your question.  A much more common configuration (security-wise), if audit logging (via pam or some such method beyond just simple ~/.bash_history) was enabled they would see that ssh was run and then could review logging on "B" and find what was run on the "target".  This is all "if" things are configured for this, it may be possible to track down the info.


Do you know any .xry reader for MacOS/*BSD or Linux? I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?

Xry only works on XP sp3, and 32 bit Vista or Win7. It doesn't like 64bit OS.


Is IP spoofing still a threat in the Internet? I heard that IP spoofing is now mostly blocked by ISPs, especially on the consumer-grade links. Is there any research on the number of networks that still allow users to spoof an IP packet with an address outside originating ISP?

Yes there is some statistical data about that: http://spoofer.cmand.org/summary.php

// Quoting the referenced Pages FAQ:

  Actually, our measurements clearly show that spoofing is still
  prevalent among approximately 25% of the autonomous systems and
  netblocks we survey. More importantly, a single entry point for
  spoofed traffic provides attackers a means to send spoofed traffic to
  the entire Internet. ISPs can employ filtering [RFC2827] to ensure
  their outbound traffic is not spoofed. But there is currently no way
  to ensure that inbound traffic is legitimate as long as there exist
  entry points for spoofed traffic. uRPF [RFC3704] does not work, and is
  not used, in the core of the network where routing asymmetry renders
  it useless.


Why do inflight wifi networks display a captcha? When you log on to Gogo Inflight Wifi or similar, Gogo displays a captcha:

A CAPTCHA is usually associated with preventing automated traffic from accessing your network; however, to connect to Gogo you need to be on the plane, thirty thousand feet in the air. It doesn't seem like this is exploitable by bots (or what the advantage would be from doing so).

What am I missing?

I suspect this is to prevent inadvertient activation of service.

Imagine you have bougt a one-hour pass to use at a later time. When you start up your computer, your computer might try to update its antivirus, or may try to download some windows updates, thus prematurely starting your one-hour pass when you dont want.

Thus, they have a captcha to activate a pass (regardless of its a pre-purchased pass in your account or a pass that you purchase on the spot) just so you don't inadvertly activate the pass without your consent.

For example, look at these roaming "accidents", where a phone in the background, decides to download a software update or whatever, causing bills long above € 10 000, without the consent of the end user.
Thats why EU have done legalisation in the whole EU requiring all operators to require confirm each € 500, eg for each € 500 spent, the account must be blocked and require re-confirm to start billing again.

A captcha is not only to prevent "bots", its also used to make it clear you are doing a sensitive action, for example lets say deleting some important files, some software might ask you to type "Yes, I really want to delete this file!" in a text box or just ask to "enter 4252562 to delete the file".
To prevent auto-complete from kicking in, it can be good idea to use captcha or whatever.

So this captcha is more as a "confirm activation of pass" so you can't come and complain after this like "wtf? My pass is gone and I haven't activated it" (but in the background some software on your computer activated it). Its a service from the Company to you as a customer.


Where should a team store server credentials Imagine we are working in a team of around 5 people. We all install new servers on a monthly base and need to find a better way of storing and sharing the server credentials (offline-location/webadress, root login, db login, ...) somewhere where the whole team can access them, read/write.
This location does not have to be accessible through the internet, but is a can if someone can provide a safe way of doing that.

At the moment:

currently the one who setup the server has the credentials: remembers them (usually connected to very unsafe standard passwords) or writes them in an email, exchanges them via skype, puts them in a local word document, writes them on a sheet of paper
ssh-keys are already in use, but it just happened that the service was not available and we needed the root login, but it was hard to find and that should not happen again

What is a safe and best practice of storing and sharing credentials in a team?

Paper only? Samba share with documents? As emails only? Some kind of database? Third party software?

Your issue is quite common and in general referred to as Privileged Account/User/Identity Management short PAM/PUM/PIM/PxM.

Keepass for sure is a solution used quite often, but from security, compliance and audit perspective not the best one. Since you are a team of five it's hard to tell if you have to comply with any policies. But if you have to, a commercial solution would be something to look into. It addresses more than just the password management and sharing passwords across a team, but also individual accountability, reporting and such.

So really it depends on your requirements, what way to go.
From my experience I can tell you that there are many different ways used in enterprise environments, starting from paper in a secure location, down to files on shares. Especially regarding files on shares, e-mails or other 'online' storage always remember that there might be some administrator being able to access those who is not intended to.

HTH.


How to locate IP for a computer trying to login to my Wikipedia account? A few days ago, I received an e-mail from Wikipedia that said: "Login to Wikipedia as you from a computer you have not recently used." Initially, I ignored the message, but after next few days, I got few more such messages. I changed my Wikipedia password after that.

However, the intruder is still trying to login to my account and failing each time. He tried around 30 times after I changed the password. Unfortunately, Wikipedia does not tell me anything about the intruder, including IP address, country or anything else.

Now, I want to locate this person. What can I do? Does Wikipedia provide the information on request? Does another way exist if this is not possible? Why could they be trying again and again even after failing? What could be the aim since they haven't edited anything? Can it be a virus and not a real human?

Any help is highly appreciated.

Without identifying information such as an IP and/or http-agent information, you will not identify that person.

And even if you had that information, it would be highly unlikely to actually trace back the human originally responsible for those actions, and for a few reasons:

VPN and/or
infected jump hosts serving as a proxy chain and/or
TOR.

Additionally, this seems more like your username and password combination (possibly alongside the information that there is a Wikipedia account for those) has been compromised and possibly checked for validity for black market trading purposes.

You should check if your account has been used to modify any Wikipedia entries and change all accounts’ passwords where these credentials have been reused.

Other than that, you might hand this over to law enforcement if this is representing a crime in your jurisdiction - but they will face similar problems to those outlined above.


Pentesting - is there a way to check file permissions on linux remotely - KALI I'm trying to modify a PHP file through a plugin on wordpress. Everything goes well, but I had to modify the permissions to 666 manually via terminal on the victim's machine, cause even when I'm trying to change this file through the admin panel, it says that permissions are too low to overwrite the file. SO, as I discovered, it only happens when the webserver is set on 'lighttpd'. On apache/xampp it works well, I don't need to overwrite permissions, they're set during installation.

The main question. Is there a way to discover if the file on a remote machine has >=666 permissions, without the manual access to it's console? I'm using kali, ubuntu, windows, everything. Every suggestion would be perfect.

I'm trying to modify a PHP file through a plugin on wordpress. Everything goes well, but I had to modify the permissions to 666 manually via terminal on the victim's machine ...

The plugin has access to check the permissions of the file. Whether or not you as an end user can obtain that information through the plugin is a different matter.

  Is there a way to discover if the file on a remote machine has >=666 permissions, without the manual access to it's console?

Usually this is not the case. While most Wordpress plugins and webapps have access to this information, they will not usually give this information publicly.

Now, you did mention that you have an Admin login. In that case, some plugins may publish this information, or allow you to enable some type of directory listing with permissions. However, looking for a plugin that does this is a more specific question than what you have asked so far.

  I'm using kali, ubuntu, windows, everything.

The OS of the attacker's computer is not really relevant. Any attack that can be made from Ubuntu can also be made from Windows, usually with the same level of difficulty.

The OS of the server sometimes makes a difference, but I don't think that is what you are getting at.

I hope this answers your 'main question'. :-)


Questions about A Monitor Darkly In his presentation, A Monitor Darkly, Ang Cui demonstrates how to manipulate images on the monitor by getting the firmware to execute commands embedded in a pixel contained in an image being displayed.
At first, he mentions that this is being done to a monitor with an firmware implant with the firmware acting asthe command-and-control, but later he says
We take this pixel, we put it on the internet... We can put this pixel on photos... videos... movies... And once we do this we can distribute this pixel down to millions and milions of monitors and we can update them all at the same time and we can have direct command-and-control down to those exact monitors.
Does getting this exploit to work require physical compromise of the device, i.e., having had the monitor manually installed on the device?
Whereas in the presentation, he the code he executes are used to change images on the display, are other kinds of code execution possible with this? Would the only possible effects from using this exploit be relegated to the images displayed with no permenent changes to disk/operating system? What's the worst that can be done with this exploit?
Finally, if I suspect and implant were loaded onto my monitor, are there any ways of detecting it and would reflashing the firmware be enough to get rid of it?

It's an interesting presentation, I had not seen this before.
My reading of this is:
step #1 is modify the display controller firmware. So yes, physical compromise of the device, but it could conceivably be done via classic imported malware.
Only after the display controller firmware is modified is there a capability to have the display altered under the direction of custom encoded pixels.
The modified controller could then be commanded to display Red as Green, or insert custom text to appear at designated screen coordinates.
He does rather cavalierly talk about distributing custom pixel code in pictures and videos, but he is overly casual in his speech. This is essentially a form of steganography. The existence of the steg content does nothing without external code running to extract and parse it. In short, the monitor has to already be compromised.
I don't believe there is any mechanism for the compromised display controllers to write back and compromise the main computer OS or memory but can not state that with complete confidence.
As far as dealing with a compromised display controller, yes re-flashing the firmware would eliminate the compromise. Can it be detected? I don't know if the display firmware is even readable. If it is, you'd still have to have a reference to detect it.
Bottom line is that the threat vector is firmware flashing, and even then it's limited to altering the display.


Mitigation Strategies for Response Spliting Attack I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET HTTP Response Splitting Attack.

My question rather confusion is that there exist a view in the community that such attacks are no longer possible and are mitigated by the underlying framework. What are the mitigation strategies? are they client side or server side etc. I also find lack of authenticated reference in this regard.

As to Response Splitting, vulnerable application allows injection at http response headers level. So there have to be an attack vector in app that allows unfiltered input to be appended to headers section of response.

Today frameworks (like .net or J2EE, and probably others) offer programmers an API which can be used to mitigate/eliminate such attacks (in server side code). But as we all know "It's impossible to foresee consequences of being clever", so developers can avoid those protections entirely, leaving application vulnerable to such attacks.

So there isn't a strict yes/no answer. It depends on developers imagination.


does the hash function matter when using it to stretch a password to use AES? My algorithm is basically as follows :

input password
hash(password)
AES on file using the hash

in this case, does the hash algorithm matter as long as it's distribution is somewhat uniform?

would some weak algorithm like md5 be fine, or should a better algorithm be used?

in the case someone tries to brute-force, slower algorithms will perform better, so I'm not taking this into account as it can be offset by using more rounds.

I'm doing that because AES needs a 128 bit key (or 192 or 256), and the user might not want to input a password this size.

You shouldn't be using a hash function to derive a cryptographic key from an user supplied passphrase. Instead, use a Key Derivation Function such as PBKDF2.

The following topics explain the topic in more depth:

https://crypto.stackexchange.com/questions/4033/whats-the-difference-between-a-key-derivation-function-and-a-password-hash
What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?
What is the specific reason to prefer bcrypt or PBKDF2 over SHA256-crypt in password hashes?

TLDR; Hash functions are very fast (therefore easier to brute force) whereas key derivation functions are generally much slower and their speed can be adjusted.


Simple, malware-resilient, automatic Windows backup (or: How should the average small company protect their Windows server?) I am trying to devise a backup strategy for a Windows server, and I'd like it to satisfy the following criteria:

It should be resilient to malware: If ransomware takes over the server, it should not be able to destroy the backup.
It should be automatic, i.e., it should not rely on people manually attaching and removing USB HDDs.
It should be as simple as possible given the two criteria above.

This is what I have already thought of:

Automatic nightly backup to some external storage: not malware-resilient. The server needs write access to the storage; thus, the storage can be wiped once the server has been compromised.
Automatic nightly backup to rotating USB disks which are stored externally: not automatic, since it depends on humans not forgetting to do that.
Automatic nightly backup to rotating USB disks which are switched by a robot: not simple.
Automatic nightly backup to the cloud using Azure backup: not malware-resilient.

Another option would be a backup server which pulls backups from the main server, but I guess harding the backup server such that the main server has no access to it (even if the malware gains domain admin access) qualifies as not simple.

Any other option that I've overlooked?

Apart from the new-ish requirement for malware resistance (specifically ransomware resistance), what you describe is the definition for backups though it is missing the requirement for backups to be in multiple locations.

Backups aren't really Backups unless they are fully automatic. They need to be capable of operating for years without manual intervention.

The malware issue is dealt with in two ways:

Backups need to be versioned so that if one or more files have been encrypted by ransomware, you can reach back in time to a previous version. Of course, the additional requirement is that the backup media itself must either be versioned or immune from ransomware.
Backups must not be susceptible to corruption or deletion by malware (or by anything else for that matter!)

Any decent commercial backup tool will give you all of your requirements. Where things get tricky is where you are trying to shave costs and use semi-pro or consumer level backup tools. In that case, you may need to take some steps for yourself and this appears to be what you are describing here.

An example of a consumer solution that delivers all the requirements of a secure backup service both in the cloud and on private servers is CrashPlan. An example of a client tool that can be used with multiple storage locations is SyncBack Pro. There are many others.

SyncBack Pro can be used with many different storage locations including Amazon, Azure and others but do watch out for the backups becoming susceptible to corruption from malware, don't mix backup locations with file-sync locations for example. It also allows you to keep versioned backups though you have to remember to configure this yourself as it isn't the default.

You should be aiming for at least two different locations for backups no matter what tool you use. Ideally backup locations should not be accessible directly as file-systems as this leaves them vulnerable to a lot more malware.

As an example, for myself and family, I use CrashPlan to backup both to the cloud and to a local NAS. In addition, some critical files are also copied to versioned filing systems, generally both locally (NAS again) and in the cloud.

Bottom line is that, if you value the data, back it up using a recognised, trusted, commercial backup tool to multiple locations which are not accessible as a filing system and make sure the tool lets you keep multiple versions.


Is it a good idea to hash a string and use it as a passphrase? Is it a good idea to hash(SHA-512/whirlpool) some simple memorable string and use it for passphrase(for LUKS/TrueCrypt container), instead of using just a string like t4k#La93Fs(5w5) as a passphrase?

If this means you're effectively using the same passphase everywhere, then: this is a very bad idea.
If you're generating a new password each time anyway (as you should), why not use an actual random string, like in your example?

——

Also, in real world usage, a sha512 hash will be too long for many sites (that is: you can't set a password that long)


What does "Change your password everywhere else" e-mail from compromised service mean? I've recieved an e-mail from ubuntuforums.org a couple of hours ago:

[...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum database.
If you have used this password and email address to authenticate at any other website, you are urged to reset the password on those accounts immediately as the attacker may be able to use the compromised personal information to access these other accounts. It is important to have a distinct password for different accounts [...]

For me that piece of text sounds like:

We do not use salts, and we use MD5 to hash passwords, so you should change your password everywhere on the net because a lot of services do the same "hashing method".

So, the question (compared to "We use strong password encryption methods with salts and such, so here's your one-time login, you will be asked to change your password upon signin, no need to change your passwords everywhere") is: do that kind of reaction from a compromised service tells you about how bad their security is?

No, this is standard practice and a liability limitation attempt by lawyers.  It is entirely possible for someone to reverse a weak password even from properly hashed and salted values if they feel like spending the time.  Salts make it slower, but they don't prevent it from breaking on weak passwords.

If your password gets compromised, they don't want to be liable when the hacker logs in to your bank account and clears out your life savings, so they suggest changing any accounts that shared the username and password.

Personally, I generally don't worry too much about this notification as long as you have a secure password that can't be easily brute forced, but the message verbiage is par for the course.


Avast antivirus found Malwaregen[trj] on Mac I was running an Avast scan and I found Malwaregen[trj] in the utorrent section. I never used utorrent. Never. And suddenly this comes up. Does this mean someone was spying on me through a rootkit?

Malwarebytes never showed anything. However, the interesting thing is when I ran malwarebytes, it said "scanning adware", etc. And in-between, there comes "scanning trojan". And it comes up with nothing.

Avast says that it couldn't scan 18 files or something. Is my Macbook hacked? Is someone spying on me?

And by the way, I did install utorrent.

It might be more probable that you downloaded a torrent that had some malware in it. I doubt the guys over at uTorrent would risk putting malware in their binaries :) (unless you downloaded uTorrent from an unofficial source).

A trojan can be used for spying, but more often than not, unless it is a targeted attack, it usually means other things such as stealing your credentials, stealing files, adding your computer to a botnet to mine bitcoins or click ads etc.

Antiviruses could be wrong. But better safe than sorry. Unless you can eliminate the threat, you might want to consider reinstalling your Mac OS.


Is external vuln scanning sufficient? Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it?

From the original Area51 proposal.

Sure automated checks are not sufficient, and believed that never will be. Well, until some AI is made. As for example fuzzers - they can cover only checks that fails for harsh input. Logical bugs will be missed. Source code analysis shows good results when the talk is about really severe bugs and those vulnerabilities that requires several conditions to meet. Binary analysis might be daunting for not so experienced person, but it is possible to inspect closed source code application and besides, it takes into account compiler specifications that are impossible to diagnose during source code analysis. So, every method has it advantage and should not be used alone.


openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter.
The parameter accepts a string of slash-delimited values in the form of:
"/UPPERCASE_ABBREVIATED_KEY=VALUE/.../"

i.e.
"/C=IT/ST=Italy/L=Milan/O=myservice/CN=localhost"

I could not find a complete list of the allowed keys, and I need to create a certificate with the following extentions:

organizationName       (O)
commonName             (CN)
uri                    (?!)
organizationIdentifier (?!)
countryName            (C)
localityName           (L)

of which uri and organizationIdentifier I have no clue on how to include.
to my knowledge (fairly limited, i am just starting in the digital signature world), the values this parameter can incorporate are:

Country Name (C)
State or province (ST)
Locality (L)
Organization Name (O)
Organizational Unit Name (...)
Common Name (CN)
Email Address (...)

Is there a place where I can find the complete list of possibile attributes and their abbreviation?
or maybe something other than openssl that allows to build the certificate ?
Is it possible that to add the extra fields (uri, OrganizationIdentifier) the addtext argument must be used?
Thank you in advance for your time and understending.
Best regards

In an X.500 distinguished name the "keys" represent Object Identifiers abbreviated OIDs. This includes the Subject and Issuer names in an X.509 certificate and also the Subject name in a PKCS10 CSR, and quite a few other things.

I could not find a complete list of the allowed keys.

There is no complete list. The OID assignment scheme allows unlimited hierarchical expansion -- this is like asking for a complete list of all URLs in the world. OpenSSL predefines a fixed but large set of OIDs that have been standardized or at least widely used; see the header obj_mac.h on your system if you have a 'development' version of OpenSSL installed (i.e. headers and libraries suitable for compiling your own code, rather than merely running precompiled code) or if you have source code the crypto/objects.txt file from which obj_mac.h is derived or in the repository. In the former file the LN_ string is the 'long name' and SN_ is the 'short name' or abbreviation, if different. In the latter file these are just columns on one line, with the short name first or empty to indicate there is no distinct abbreviation.
For example CN is the short name and commonName the long name for the OID 'X509 3' which, using other definitions in the file, expands to the actual OID 2.5.4.3.
If you -- or (more likely) someone or something you are interoperating with -- needs an OID outside of OpenSSL's predefined set, either because it's standard but rare and/or new, or because it's not standard at all, then you can still use it in OpenSSL by defining it in your configuration file; see the oid_file and oid_section items in the man page for req or for ca or the generic config for other commands like x509.
Typically the OIDs defined in X.509, and those defined for X.509 in PKCS9 (such as emailAddress), are commonly used in X.509 subjects, but technically any OID can be.
As you can see in the predefined list(s), there is an X509-scope OID for long name organizationIdentifier with no different short name -- this MAY be what your specifier wants, although it may not. There is no such obviously applicable OID for a URI, or URL; ask them to be precise about what they want, or to give/show you an example that shows precisely what they want.

I need to create a certificate with the following extentions:
Is it possible ... the addtext argument must be used? [You mean -addext in req]

These are not extensions. X.509 certificates have name fields containing attributes, which are one thing and the thing you want, and separately (but similarly identified by OIDs) they have extensions, which are a completely different thing that you do NOT want. Or at least not for this purpose; as you proceed you may find you also want extensions for something completely different that the specifier 'forgot'.


Is it possible to encrypt persistence in metasploit? What I generally do, is I encrypt my payload with Veil-Evasion

But then after I get the shell, I keep on migrating of course; But when I enter the
command

run persistence

in the meterpreter shell, the vbs script generated is being detected by almost all anti-virus. Is there any way I could encrypt it ?

I would like to have longer time persistence

Well, i'm not sure if that's possible or not.

But i think the reason that the persistence is detected by almost every antivirus, is caused by the heuristic analysis, so even if you encrypt the persistence ... it is possible it will be detected in any case.


How to remove ssh rootkits? I checked my linux server with rkhunter, I got following warning messages,

  ...

  [00:35:35]          Found file '/usr/include/gpm2.h'. Possible
  rootkit: Trojaned SSH daemon

  [00:35:35]          Found file '/etc/rpm/sshdOLD'. Possible rootkit:
  Trojaned SSH daemon (original sshd binary)

  [00:35:35]          Found file '/etc/rpm/sshOLD'. Possible rootkit:
  Trojaned SSH daemon (original ssh binary)

  ...

  [00:35:57]          Found string '/usr/include/gpm2.h' in file
  '/usr/sbin/sshd'. Possible rootkit: Trojaned SSH daemon

  [00:35:57]          Found string '/usr/include/gpm2.h' in file
  '/usr/bin/ssh'. Possible rootkit: Trojaned SSH daemon

  ...

After I Googled these details, I understood that these all are SSH rootkits. I need to know how to remove these things from server and make it secure (CentOS with SSH remote access).

Removal? Forget about it. There is unauthorised root access to your server; anything could have been installed by now and you would have no reliable way to detect it.

Even for a forensic expert with local access, it would take a long time to completely audit a system to ensure no trace of extant malware.

The only reasonable and responsible course is to wipe the disc and reinstall/reimage the OS from a trusted source.


How to look up a file that has been split into segments in a memory snapshot I have a snapshot of the memory of a device loaded up in FTK Imager.

I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the memory snapshot, but it is split in several different fragments (about 80 of them).

Each segment is exactly 4096 bytes long (except for the last one, probably).

I can manually look them up by copying the entire 4096 fragment in hex with FTKi, then searching it in the snapshot, and exporting the fragment.

The problem is, this takes a lot of time. Is there any way to do this faster, either using FTK or another software that allows reading and carving from ad1 snapshots?

Furthermore, how would I "fuse" the exported segments in the end, to show that the picture is still complete?

I don't know that there is any way to know where the fragments are stored within memory (or the memory snapshot) like there might be if it were in a file system. So searching on each may be the only way there. As for automating that process, I don't know of anything available.

You can use hex editing software to do the searching, copying out blocks of data into separate files, and then putting them together into a single file. It will be a lot of manual work, but not overwhelming for just 80 blocks. We've written software that will do similar in an automated fashion (and actually that middle step is not needed when offsets are used), but it isn't publicly available unfortunately. However, I mention that because you may want to consider a custom software solution if you do this many times. But if you just are doing it once, manually would be just fine.

I put a couple hex editor links below. I believe FTK Imager is a Windows software so here are some Windows choices-

Hex Workshop http://www.hexworkshop.com/ (this is mentioned in FTK Imager user guide)
WinHex https://www.x-ways.net/winhex/


Can my network admin examine files I upload on a HTTPS site? I have been working in a big company for the past 4 months.
I have two machines that i work on, my personal laptop and my desktop workstation (company property). Occasionally, as all my colleagues do, I visit some safe sites for personal reasons. Such cases include news sites, blogs, tutorial sites etc. This practice is not strictly forbidden but surely there will be some filtering monitoring for preventing an employee visiting dangerous or offensive sites.

I have also used my laptop to upload personal files to Google Drive such as pictures or documents.  Since my browser connects to Google Drive via HTTPS is it possible for my network admins to view any of these uploaded files?
In general when a browser connects over HTTPS to a location and pushes (POSTS) data packages that consist a media file, is it possible to "recreate" that file from these packages?

The difference between this question and Can my employer see what I do on the internet when I am connected to the company network? is that i specifically ask about UPLOADING data (the given file) instead of surfing-downloading data (http code-files etc)

No, it is not possible to listen to your network traffic and reconstruct the files you're sending over HTTPS, provided the HTTPS connection is good.

That "provided the HTTPS connection is good" is a fairly significant caveat, though.

HTTPS works on a certificate signing basis. Your computer will have a relatively small number of root Certificate Authorities that are trusted to verify that a given site is owned by who it says it is. That means that when your computer gets a certificate saying it's for Google Drive, it can be confident it really is from Google Drive, and nobody but the Google Drive servers can decrypt the packets and recover your data.

Your company could intercept your traffic and replace Google's certificate with theirs. They'd then decrypt your data, do what they want with it, then re-encrypt it with the genuine Google certificate. Provided your laptop is secure, you'd normally get a warning about an unexpected signing authority or certificate pinning or similar if this were happening. However on your work desktop, since it's not your computer, it would be entirely possible for your network admins to set it up to trust their own Certificate Authority, at which point it would be more-or-less indistinguishable from the genuine Google certificate, at least without paying very close attention.

Unless your company is very security paranoid, I think that's unlikely. But at the point at which you're worried about them intercepting your traffic and decrypting it, you should probably be aware that that's a method they could use to do so.


Denial of Service on SSL services When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server?

Could such an imbalance be exploited to produce a DoS with greater efficacy? Are there any academic papers or proof-of-concept implementations of this?

Yes, a CPU-based DoS on SSL servers is easy. Consider the two main types of cipher suites, as commonly used in SSL:

RSA key exchange: server sends its certificate with a RSA public key; client generates a random blob (the pre-master secret key) encrypted with the server's public key; the server decrypts it.
DHE key exchange: server sends its half of a Diffie-Hellman key exchange, signed with the server's private key. Client sends its own half of DH. Server completes DH key exchange by applying its DH private key (a modular exponentiation).

Either way, the server must perform a relatively heavy cryptographic operation: an RSA decryption, or a DH modular exponentiation (for DHE, the server can reuse its ephemeral DH parameters, as long as it does not reboot, but it cannot evade the final modular exponentiation computed over what the client sends). On the other hand, a client who tries to DoS the server does not need to do any work at all: it just needs to send a blob of approximately the right size. Decryption on the server will fail, but the CPU expense will be lost nonetheless.

(Already with honest clients and RSA key exchange, the CPU cost is higher in the server, because RSA encryption is much faster than RSA decryption. But an evil client, intent on DoSing, can totally avoid work.)

Such attacks have been observed in the wild and it does not take an academic paper to explain how they work.


What are the risks posed by "pass-through authentication" and how are they mitigated? Related:
  Local Admin has Domain Admin rights

"Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one another, even though they may not be intended to have the same privileges.

Example:

  Say we have a standalone PC, not joined to any domain. The PC is called MyPC, and it has an account called MyAdmin. The password for MyAdmin is, unoriginally, password.

  Then we have a domain called MyDomain. The network administrator decided to call a Domain Administrator account MyAdmin and, in a demonstration of sheer incompetence, gave it a password of password.

  For whatever reason, a completely unfiltered network connection exists between MyPC and all of the computers on MyDomain.

  Any person who can log in to MyPC as MyPC\MyAdmin can exercise full Domain Administrator privileges on any system in MyDomain, as if they had actually logged in as MyDomain\MyAdmin, without being prompted to enter any additional credentials.

Intuitively, this seems wrong because (though they may have the same basic username & password) MyPC\MyAdmin and MyDomain\MyAdmin are two different user accounts, created in different scopes, with different permissions. However, what actual security risks does this pose? How can those risks be mitigated, or how are they already mitigated by design? Does the risk change if the "rogue" MyAdmin is a local account on a computer that is joined to the domain instead of just a random standalone system?

Here's the tricky part about the problem in your question: It doesn't exist.
No no, I'm not being snarky. Hear me out.

You have a Domain administrator account with the password password (or any password of that sort), and the attacker created a local account with the same username and password. Without needing to create a local account, the attacker can simply user the username MyAdmin and the password password to login and use MyDomain\MyAdmin.

The problem has nothing to do with the pass-through authentication scheme, the problem is with using such passwords. Even if you, for example, disabled the whole functionality, the attacker can still use the username and password combination.

If it makes you sleep better at night, you can completely disable incoming NTLM authentication traffic by setting the following security policy in Group Policy \Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Incoming NTLM traffic to Deny all domain accounts.


Why does my digital bank need my phone date and hour to be correct? I'm not from Information Security or any IT related area. But I want to know if there is any security reason for my digital bank to demand my phone to be on "Automatic Date & Time"?
For example, if I'm abroad, I cannot transfer some money to a friend, because a dialog box says that my date and time is incorrect.
Is that a badly programmed software or does it have a purpose?

One of the reasons can be the usage of the digital signature. If the time on your phone differs essentially from the actual current time, this may cause your phone to reject signatures done by the bank server, or your bank to reject signatures done by your phone.
Why is "Automatic Date & Time" important? Of course, the internal time representation on the phone (milliseconds from 01.01.1970 till now) does not depend on the time zone. But it depends on what you do with this. Suppose you are in the time zone ACT = GMT-5. Suppose your local time is 4:00 ACT, which is 9:00 GMT. Now suppose you disabled "Automatic Date & Time" and set the current time zone explicitly to GMT. Your phone shows immediately not 4:00, but 9:00. The internal time representation remains still unchanged, only GUI representation changed.
But now you see, that 9:00 on your phone differs from the time on your friend's phone. So, you manually set time to 4:00. Now both your phone and your friend's phones show 4:00. But your friend uses ACT = GMT-5, where as you use GMT. Thus, the internal representation of the time on your phone is 5 hours behind the real time.
In such case, even if the bank allows tolerance +- 1 minute, this will be not sufficient. Any operations where time comparison is involved will fail.


How dangerous are phishing links really? Some phishing links contain random digits / codes (e.g: https://refno1234.example.com). For such links, is there an increased risk by clicking on them because the unique code could be matched to your email / mobile number and therefore verify it exists?

Is it possible, by clicking on a phishing link, to run malicious scripts in the background to steal your personal data/files?

Yes, there can be unique identifiers in links that will pair you with that "campaign" and you will be hit again with a more sophisticated attack, now that you are a known "clicker".
Yes, scripts on the webpage you click can steal your credentials, launch malware, encrypt files, etc. I did a video on how I investigated a sophisticated version of this and what exactly it did.


Can someone hack my phone by sending me a file (e.g. PDF) via Whatsapp? My work requires (and depends on) Whatsapp for daily sharing of files with many people (PDF, PowerPoint, Word, Images, Web links...), and I was wondering if it is possible that someone can hack our phones by sending us malware via Whatsapp.

For example, let's say they send me a virus that pretends to be a legitimate PDF. Is it okay to "just install it" on Whatsapp? What happens if I installed it but never opened it? Can that affect my phone or I have to open/view it?

This is extremely important to me and my team, and I will share your answers with them because we seriously need more awareness on this. Thanks!

I recently read Hackers can use a WhatsApp flaw in the way it handles video to take control of your phone, so theoretically it is possible via PDF as well, depending on your OS and possible flaws in WhatsApp and your phone’s OS.


How does a client know that a DNS zone is DNSSEC protected? Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter.

However, I have a question to which I couldn't find an answer anywhere: how can a client know that a DNS zone is supposed to be signed? If machineA never resolved the name example.com, how can DNSSEC prevent an attacker from intercepting the DNS query leaving machineA and replying to that query with a well-formed DNS reply holding a malicious IP address, but which seems to to come from the resolver?

In other words, I can't understand how DNSSEC prevents Man In The Middle Attacks. If the host never resolved the name before, how can it know that the reply is supposed to be signed?

I understand how DNSSEC can protect against cache poisoning, and how the integrity of the messages is assured, but it all seems to fall apart if someone simply sits between the user's machine and the resolver to strip out dnssec information.

DNSSec does not prevent against MITM attacks. This is also mentioned in the following answer and a bit more explanation of how DNSSec works and some of its limitations.

In this paper author discusses ways to circumvent DNSSec in Section VI, including  'intruder-in-the-middle' attack.


Is Amazon's app store vulnerable to external storage race condition? There's been a load of kerfuffle about how Fortnite on Android saves APKs to external storage and how they can be overwritten before they are installed. (The press is awkwardly calling this a man-in-the-disk attack.)

I've heard from a couple of people that Amazon's Android app store also downloads APKs to external storage before installing them. Is it not vulnerable to the same attack?

Edit: To be clear I am talking about when you install the Amazon app store yourself on a normal Android device, not when it comes preloaded on a Kindle device. Obviously in that case they have complete control and can easily do things securely.

Amazon Store app actually controls the download and installation process, so it doesn't expose exactly this vulnerability. Note that the Google Play Store does essentially the same. Protection of the temporary disk space where the APK is being downloaded, may be compromized by a hacker; but at least both stores don't rely on the end user to manually install the file. Samsung devices have access to Galaxy apps, but this is again controlled by a preinstalled system app.

This is a limitation to Fortnite's model: no app on Play Store may become an alternative installer of APKs. Therefore, at some point, to achieve independent installation, you must use the unsecure manual installation of a downloaded APK.


Do you need to update a router that is set in bridge mode? Since a router in bridge mode works like a modem, do you need to even update it?

You neeed to keep up today any software device, so if your router contains software is a good idea to keep the software update to the latest version in order to get fix issues on it.


Applications of probability/statistics in IT security? What are some areas of computer security that utilizes statistical modeling?  I ask b/c I'm a studying statistics at school and have become interested after reading a few papers.. some of the areas I'm aware of are anomaly in network traffic, IDS's, spam filtering (though not strictly security)... one of the neatest ones I've found is of inferring keystrokes in SSH traffic by building a time series model of typing.  What else is out there?

Intrusion Detection Systems indeed are a natural fit for statistics.

An interesting example I've come across:

At host based IDSes, track and statistically analyze the system calls of an application. An interesting approach is to group the system calls in pairs, triples etc. and then observe their behavior when the application encounters an attack.

Have a look at this:

P. Astithas, V. Pappas, B. Maglaris, "Detecting Intrusions by Monitoring System Processes", in Proceedings of the 8th HPOVUA Plenary Workshop on Network and Systems Management, Berlin, Germany, June 2001. (it's a postscript file)

You may also find interesting analysis work done with high speed networks where specialized network processors capture enormous amounts of traffic. Theoretically such analysis can reveal ongoing DDoS attacks and be used to deploy dynamic filtering.

I would also suggest to take a look for interesting ideas at the proceedings of RAID, the International Symposium on Recent Advances in Intrusion Detection. From what I have seen much of it is available online with free access


If malicious sw has been given root access on Android device, is that phone forever compromised? If for example your super user app is compromised(for real life example, supersu app was bought by an unknown company a while back, which could have malicious intentions) is there any way to make the phone secure again? Will flashing a new ROM remove all traces and make the phone safe again? Or does root go deeper?

TIA

When malware has root access it basically means it capable of modifying system files and bootloader. If you trust custom firmwares such as Cyanogenmod you can consider wiping partitions and installing Cyanogenmod alongside with some custom recovery and bootloader. After reflashing /system /boot and /recovery I see no reason to be worried.