What are the risks of providing my fingerprint to a theme park? I recently visited Epcot Center and was surprised that they asked to scan one of my fingerprints before I entered the park, even though I already had my ticket in hand. I don't believe they require a specific finger. This seems to be a two-factor authentication method called Ticket Tag, which sounds very similar to what the TSA says about your body scans: "We don't store the scan, but you can use a 'less convenient' method if you want (most of the time)."

Am I right to worry? What are the most likely, and the worst-case, risks here?

I'm afraid I do not have a good answer, but I do have some thoughts to consider that might help others to find a good answer.

You leave your fingerprint behind everywhere already. However if someone wants to get your fingerprint, they currently have to spend the time and energy to get physically close to you and find a spot where they can lift a good fingerprint off of something. This means it's more expensive to do it for a random person, and it means it cannot really be done on a massive scale.

Phones and other devices these days also have the helpful feature of reading your fingerprint. This increases the odds that someone can get access to a database of them somewhere, and decreases the relative risk of leaving a fingerprint at the theme park.

We seem to be moving towards a society where it's normal to use your fingerprint as identifier. "It's a username and not a password," people say, and in some way they are right. However it's slightly more than a username since it's not trivial (doable without any tools) to lift and reuse a fingerprint, like a username would be. This is why it's so popular as a fairly trusted identification method, like on your phone and as second factor of authentication.

This trend also means that, as fingerprint storage gets more common, they can be trusted less and less. The public perception should trend towards "everyone has a copy of my fingerprint already, who says it's still safe to use as authentication method?" This causes the fact that anyone has a copy to be less of an issue, since it will not be solely relied on.

Some existing answers mention that the fingerprint is probably stored as a code, not as a very accurate picture or representation of your fingerprint, and that different devices would encode it in different ways ("abc" vs. "123"). I think this is partially true: a derived code is usually used in authentication, making it more difficult to recover the original fingerprint. However I would expect it to be a deterministic and at least partially reversible process, where if you know the kind of fingerprint reader, you can reverse the derived code back into something resembling the fingerprint. Further, I'd expect the fingerprint reader industry to converge on the most effective way to read and encode one's fingerprint, removing the need to reverse engineer every fingerprint reader's method individually.

Summarizing:

A database, like a theme park would have, is valuable if you mean to hack an individual at a lower cost and/or if you mean to do so at a greater scale.
Your fingerprint is digitally read in more and more places. As these systems and databases become more frequent, they should become less trusted.
Even though they probably don't store your original fingerprint (easily duplicated), the encoded version can probably be reverse engineered back into something resembling the original. Once done, this can be used for every fingerprint made with that device, or at the very least for everyone ever in the theme park.


Detecting malicious domains/URLs Do state of the art commercial URL threat intelligence feeds ( for example, one's by Symantec, Intel-security etc) miss malicious domains? (i.e. domains serving malware,exploit code & phishing domains - to make the discussion specific.) If so, why? What are the technical challenges people are facing in solving this problem?
I understand that there are many methods people use to do detection including a combination of machine learning, capturing data with honeypots,etc behind the scenes to generate such feeds.
I want to specifically understand what technical obstacles limit the effectiveness of these methods and why they miss what they miss.

Domain names are cheap. Attackers are quite happy to register a domain to use in a single campaign. At some point thereafter the domain will be red-flagged by reputation services, but by that time the attacker has moved onto the next one.


Is it possible to encrypt a download twice, once with a different encryption method? So without giving too much away, the basics are that I have a board that needs an operating system, so I go to an IPL server to supply that operating system.

I have a verifier in the middle and my idea is to encrypt the download from the IPL and send it to the verifier, then the verifier encrypts it again with a different encryption method so that when it gets to the original board, the board decrypts it twice.

Short question is it possible to encrypt a download twice, once with two different encryption methods so that it would be even more difficult to break/easier to verify if there was tampering involved?

Yes, absolutely.  You can re-encrypt an encrypted file however you'd like.  For example, if you'd like to encrypt it once with asymmetric (public-key) encryption, and then again with symmetric (password), you'd need both a password and a private key to decrypt it.  The same would be true if you encrypted it multiple times with symmetric encryption (multiple passwords, a new one each time a layer of the onion so to speak is peeled back), or keys (multiple public keys, again, onion-esque).

That said, I think any benefit to the multiple methods of encryption is only going to be marginally beneficial.  A strong cryptosystem in the first place sounds like the best solution, e.g. 4096 bit rsa, or 256-bit elliptic curve.   I'm not sure this approach solves your problem though.

Remember, each board needs to have a different key and you can't share the same private key or symmetric key with each piece of hardware without creating a huge security hole.  In such a way, updates should be signed with a private key only you (the master code distributor) possess and the boards should validate the signature in traditional code-signing fashion.


Why is WPA/WPA2-personal Entropy different? Why is WPA/WPA2-personal passphrase entropy different than other entropy measurements? Is this because of the way WPA/WPA2 is implemented? For example:

A passphrase of 15 lowercase letters has an entropy value of 15 x 4.7 = 70. I understand how we came to this number because it's the length of the passphrase multiplied by the entropy bits per character (which for lowercase characters is 4.7 bits).

But in my book (CWSP Certified Wireless Security Professional Official Study Guide) it says that WPA/WPA2-personal passphrases typically have 2.5 bits of entropy per character and the formula looks something like 2.5(n)+12. So, using the same number of characters as before (15), it would be 15 x 2.5 + 12 = 49.

Also, it seems like it generalizes the entropy bits per character and doesn't differentiate lowercase from numerals, etc. So I would assume this means all characters used for WPA/WPA2-personal passphrases have the same entropy value of 2.5?

I'm sure this is as clear as mud, so please tell me if anything I put doesn't make sense or needs clarification.

If you kept reading past the point where it quotes the 802.11i standard, it explains that the lowered entropy is because of the method of choosing a password.

It's not about the amount of raw entropy per character (i.e. 4.7 for single case letters) but the effective entropy as a result of a human needing to assign and remember the password later (and enter it on a tiny keyboard for a phone).

So, the math per character is the same. The effective entropy is a lot lower because people choose easy-to-remember passwords. Purely random passwords retain their stronger entropy.


What TLS session resumption percentage? I would like to plan a system and I am asking myself how is it going to influence my performance if I am not going to implement TLS session resumption.

Does anyone measure how often is the use of TLS session resumption?
Is it browser dependent?

Does someone have a link of worldwide statistics regarding what's the overall session created by abbreviated handshakes (out of the overall TLS/SSL sessions)?

Session resumption really depends on what you are pushing through the SSL. Since you talk about a Web browser, then I assume that you are talking about some sort of Web server, serving pages written in HTML.

How things go typically looks like this:

The browser opens a first connection, with a full handshake.
The browser may open one or a few extra connections, so that several requests may be issued concurrently (to load images and scripts and other elements). The number depends on the browser version, OS, HTTP protocol version, and maybe other parameters (see this for a summary of how these things went in 2008). The new connections will use session resumption.
The browser will try to keep the connections "alive" for as long as possible. Usually, the server will close connections which have been inactive for one or two minutes, but this depends on the server type, load, and configuration. Also, the client may be behind some NAT router that will kill connections that have been inactive for some time (typically 20 minutes or so).
When opening new connections, browser will try session resumption. A browser will remember session parameters for hours, as long as its process was not terminated (i.e. the browser forgets all session parameters when all its windows are closed).
The server will typically remember SSL sessions for 5 to 20 minutes after closure of the last connection that was using that session. This can be configured; it depends on the server type, version, configuration, and (notably) its use of session tickets.

The bottom-line is that a typical client will perform a new handshake only when it opens a new connection, which normally occurs rarely; you will get a few connections at the start, and then whenever the client interacts with your server after having not-interacted with the server for a minute or two. Under normal conditions and typical servers, only the very first of these handshakes is a full handshake; all others are abbreviated handshakes (session resumption). From the description above, you see that new connections occur at a rate which is no more than a couple of times per minute, and less so if the client is "active" (i.e. clicks more than once per minute).

By forfeiting session resumption, you make all the handshakes full, with server certificate sending and asymmetric cryptography.

The other half of the question is how much these extra full handshake will cost you. A full handshake implies mostly three extra costs:

The latency is increased. A full handshake implies an extra round trip:

Client sends ClientHello
Server sends ServerHello, Certificate...
Client sends ClientKeyExchange, ChangeCipherSpec, Finished
Server sends ChangeCipherSpec, Finished
Client can begin to send the HTTP request

To compare with what happens with a session resumption:

Client sends ClientHello
Server sends ServerHello, ChangeCipherSpec, Finished
Client sends ChangeCipherSpec, Finished
Client begins its HTTP request (crucially, this can be done over the
same IP packets as the ChangeCipherSpec and Finished messages)

Whether the extra latency is tolerable or not should be measured. Latency is usually what matters most for user experience.
The full handshake implies more network traffic, the bulk of which being the server's certificate chain (say, 2 to 5 kilobytes).
The asymmetric crypto involved in a full handshake requires a bit more juice from the server CPU. Note that a quad-core 3.1 GHz server from a few years ago (that's my server) can do more than 3000 RSA private key operations per second (for a very decent 2048-bit key).

Since we are talking about a couple handshakes per minute and per client, the extra network and CPU costs are probably negligible (although it should be measured, like all things related to performance). The extra latency, though, may be more problematic, because it is part of what the user sees, and it depends on how the user is connected to the Internet (in particular, people with satellite Internet access tend to have a high latency and dearly feel the cost of each extra round trip).

Summary: for a Web site, the influence of using or not using session resumption will mostly be a question of user experience with regards to latency. The most important parameter will be how long the server accepts to keep inactive client connections alive.

Since all of this depends a lot on how your site is organized (e.g. number of extra images, CSS and scripts to load; whether interactions are mostly in the client with Javascript, or imply client-server activity; how long a user is expected to stare at a page before clicking anywhere...), how the users behave (how many pages they look at, how often they come back...), and the expected peak load (how many users connected at the same time), statistics obtained on sites other than your own are unlikely to offer an accurate vision of what will happen for you.


Decrypt cipher texts encypted with the same one time pad key I have two pieces of ciphertext encrypted with a stream cipher using the same key.

How do I recover the plaintext of both ciphertext messages without knowing the key used?

If the two encrypted messages are using the same stream cipher and the same key,

C1 xor C2 results in M1 xor M2 where C1 and C2 are the respective ciphertext and M1 and M2 are the corresponding plaintext.

You can then recover the plaintext using a technique known as crib dragging. You take a common word or phrase that may appear in the plaintext (such as " the ") and xor that against the result of M1 xor M2. If one of the plaintexts had the text of the crib (" the " in our example), then the result of the xor is what the other plaintext had in that position. If neither plaintext contains the text of the crib, it is very likely that the result of the xor is just gibberish.

You just continue this technique until you recover enough of the plaintext to intelligently fill out the rest.


Is ntpd running purely as a client vulnerable to the recent ntp vulnerabilities? There's been 3 recent vulnerabilities in the NTP reference implementation.  Namely:

CVE-2014-9296
CVE-2014-9295
CVE-2014-9294

Is ntpd, or ntpdate, running as a client vulnerable to any of these exploit if the server it's connected to can't be trusted?  Assume ntpd is configured with the default configuration on most Linux server and thus doesn't use any sort of "cryptographic protection" and can't itself be queried by untrusted peers.

This means connecting to volunteer ntp servers provided by ntp.org, which can't be trusted.

"Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(), ctl_putdata(), and configure() functions. A remote attacker could use either of these flaws to send a specially crafted request packet that could crash ntpd or, potentially, execute arbitrary code with the privileges of the ntp user. Note: the crypto_recv() flaw requires non default configurations to be active, while the ctl_putdata() flaw, by default, can only be exploited via local attackers, and the configure() flaw requires additional authentication to exploit." Source

If you're just doing  server ntp.org in your ntp.conf, then no, you are not vulnerable.

As long as you have the default configuration and don't accept authenticated commands (sounds like you don't), then no.
And if your ntp.conf file has no lines active starting with "crypto".  (you said you didn't), then no.


Is there a PAKE algorithm where the passwords can be tested in the first round? I want to use PAKE for key exchange between two parties (Alice and Bob) which share a low entropy secret (a password they exchanged on a piece of papers).

Alice and Bob use a software on there computer, and log in only occasionally.

Alice gives the password to Bob on a piece of paper, which Bob than (at home) inputs into the Software.

Now, if I would use for example J-PAKE, the password could only be verified at round 2.

The Problem is, if BOB inputs the wrong password because he makes a typo, I want to tell him that right away. The next time Alice logs in could be 24 hours or more later. For reasons of user-friendliness, giving Bob an error at that point is just to late.

Is what I want possible at all? Maybe with a different PAKE algorithm?

If the password would be compromised and could not be used afterwards anymore, that would be a price I would be willing to pay.

No, since that would let passwords be tested without sending anything.

You could have the parties [do PAKE with the server] with

independent passwords and let the server be a key sever.

There probably exist protocols in which

Alice chooses a probability p in [0,1] and

even if the server knows the password, the server can't do non-negligibly better

at distinguishing different choices of p than just trying incorrect passwords

an incorrect password will have probability p of passing the honest-server's test

if [the server isn't separately given the password] then the server can't distinguish between

the real password and other passwords which pass the honest-server's test
.


Interpreting anti-hacker-alliance analysis One of security tools available for web browsing is (http://anti-hacker-alliance.com)
Please find below two readings:

a) Reading for IP 205.x.x.x that state among other-things "you are using proxy server"

b) Reading for my IP 41.x.x.x show 100.0 % loss at the hope before my ip.

Before calling ISP and asking foolish questions sought to check with people who have experience using this tool for possible misconfiguration.  Am connecting one PC directly to the Adsl router.

I have been having issues such those listed at:
https://superuser.com/questions/831181/mr-google-com-at-email-header

and

https://superuser.com/questions/863502/website-does-not-load

and

https://superuser.com/questions/837243/different-traceroute-endings

And another one where Apple ID was seriously compromised where Apple-specialist consider it unrecoverable due to the fact that it was professionally done.

At some earlier point MS-tunnel was discovered active with ip6 encapsulation via a toll called athtek netwalk.

when used different operating system there has been no answer to:
https://askubuntu.com/questions/466502/different-output-between-network-tool-3-8-1-and-terminal-traceroute

One should suspect a dual configuration at the data-link-layer. Similar to identity theft scenario.

Would someone with experienced knowledge evaluate these results?

Screenshots here and here.

This is just a lame site doing basic checks (ping, traceroute, whois, geo IP lookup) on some IP you entered in the search form and presents all of that in a scary looking webpage, I definitely wouldn't call that a "security tool", it's more of a toy for script kiddies.

They for some reason assume that you're using a proxy, they can either guess that based on the presence of a Forwarded or X-Forwarded-For header or just because your IP is in some outdated open proxy database - you probably have a dynamic IP and happened to be allocated the IP of someone else who deliberately ran an open proxy or got compromised.

Just forget that horror, here are some (real) tools if you are worried about the security of your computer :

http://icanhazip.com/ - to get the real IP of the host requesting the page (this will be the proxy's IP if you're using one)
http://nmap.org/ - port scanner, run this from a remote host and point it at your IP to scan all open ports on your computer
http://mxtoolbox.com/diagnostic.aspx - open mail relay test, to see if a badly configured mail server is running on your computer and can be abused to send spam
http://www.webmastify.com/resources/proxy/ - open HTTP proxy test, I've not used it myself so I don't know if it's reliable, I prefer to test manually using telnet


OpenPGP: Sign-Verify workflow without Encrypt-Decrypt? Is it a good and/or frequent practice to sign a file (with your own private key) without encrypting it (with the intended recipient's public key?) I haven't really been able to find a direct answer to this question anywhere.

Such a signature is good for two things:

It protects the email against alteration (i.e. any modification will be, at least, reported as such by the recipient's software).
It gives to the recipient a proof that you the message is really from you; that proof can be shown to a third party (that's a signature, not a mere integrity check).

In email context, we usually encrypt when we sign, because if there is an attacker who is willing to modify the email contents, he is probably interested in reading the email as well, and you probably want to prevent that, too. A signed-but-not-encrypted email is still a rather common occurrence, for the side effect of making the recipient aware that you are using OpenPGP; some people systematically sign all the emails they send, even those that they cannot encrypt because the recipient owns no key whatsoever.

In other situations, signing without encryption can be common and good practice. The typical example is software distribution. In some Linux distributions such as Debian and Ubuntu, software packages are signed (indeed using the OpenPGP format), so that you can be sure that you are installing genuine packages without backdoors inserted by malicious third parties; but the packages are not encrypted because they are, ultimately, public data.

Note that a signature from you can, be essence, be used as proof against you. Therefore, from your point of view, signatures are good as long as they are signatures from other people when they send messages to you, and not the other way round.


Getting more information about a PGP Signature I've asked this question here: https://stackoverflow.com/questions/42170000/read-pgp-signature-using-bouncycastle but I'm hoping to be able to get more information about the format of a GnuPG signature and how to decode it.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBBABCAAGBQJYnkPxAAoJEBFjzYGyXBOsXRoH/3O4bwKK45aUN+m0N4jsZ+n5
W8R/aGti/llvJ62tHBCO5BIp/pp+b1Gdv99xtnJXHu/f0TqPYj+fwq4vfaorNTtA
Vtq8MaMesw1OWZEfu/lyjNOwdg81FUlYkw0Bjo3H/MxWjWYUiHmJo+OGriyf5dv/
433ZqitZMxLHCfZsuoU5teZ0BPUSoNjF6hOFK3ZI7QXsgYUyohzW2goy9bDVCKRq
e73CHpnMKCrnDc+/4+sK349bD/cZp6/c0T8b7cBCeBGGilPD6ovJUQE5vhGTKnJM
lgyxhA87tw9wqFwpZXDr0nzOP+MFfE9WRGecVYZ9G+LP/biefSe5iWRaPIcZIi0=
=qUHb
-----END PGP SIGNATURE-----

When I try to verify using JCA, I got an error that says:

'Signature length not correct: got 287 but was expecting 256'

I'm hoping to get some more light on how the signature is encoded and how to access the actual bytes that are used for verification.

Try to use gpg commandline:

$ gpg -vv
gpg: Go ahead and type your message ...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBBABCAAGBQJYnkPxAAoJEBFjzYGyXBOsXRoH/3O4bwKK45aUN+m0N4jsZ+n5
W8R/aGti/llvJ62tHBCO5BIp/pp+b1Gdv99xtnJXHu/f0TqPYj+fwq4vfaorNTtA
Vtq8MaMesw1OWZEfu/lyjNOwdg81FUlYkw0Bjo3H/MxWjWYUiHmJo+OGriyf5dv/
433ZqitZMxLHCfZsuoU5teZ0BPUSoNjF6hOFK3ZI7QXsgYUyohzW2goy9bDVCKRq
e73CHpnMKCrnDc+/4+sK349bD/cZp6/c0T8b7cBCeBGGilPD6ovJUQE5vhGTKnJM
lgyxhA87tw9wqFwpZXDr0nzOP+MFfE9WRGecVYZ9G+LP/biefSe5iWRaPIcZIi0=
=qUHb
-----END PGP SIGNATURE-----gpg: armor: BEGIN PGP SIGNATURE
gpg: armor header: Version: GnuPG v2
:signature packet: algo 1, keyid 1163CD81B25C13AC
    version 4, created 1486767089, md5len 0, sigclass 0x10
    digest algo 8, begin of digest 5d 1a
    hashed subpkt 2 len 4 (sig created 2017-02-10)
    subpkt 16 len 8 (issuer key ID 1163CD81B25C13AC)
    data: [2047 bits]

As you can see, the signature can be decoded. Without the signed data however I can´t give you more information, specifically if the signature is valid. I do not find the issuer/signer on https://pgp.mit.edu/

Try to paste the whole message including signature into gpg -vv and see if it gives you more information.


Can I use /dev/urandom for generating cryptographic keys? I need to generate thousands of cryptographic keys. Can I just read the bits from /dev/urandom on a Red Hat system, or do I need to run it through a PRNG? My understanding is that /dev/urandom should be good enough, but I've had some push-back, so I'm ideally looking for solid academic references to say that /dev/urandom is good enough.

Note this paper: https://eprint.iacr.org/2013/338.pdf

/dev/urandom is a good choice, but the getrandom system call would be ideal, using the default flags.

As for references, this article is not strictly speaking academic but it's a reasonably easy read, and cites a number of experts in support of its explanations.  I think this passage, which the article quotes from Daniel Bernstein, is well worth reproducing:

  Cryptographers are certainly not responsible for this superstitious nonsense. Think about this for a moment: whoever wrote the /dev/random manual page seems to simultaneously believe that

  we can't figure out how to deterministically expand one 256-bit /dev/random output into an endless stream of unpredictable keys (this is what we need from urandom), but
  we can figure out how to use a single key to safely encrypt many messages (this is what we need from SSL, PGP, etc.).

  For a cryptographer this doesn't even pass the laugh test.

The article you've linked is more of a theoretical concern than a practical one.  What it means isn't that the Linux RNG design is bad strictly speaking, but that it's not optimal in a number of regards, which however only apply in a very narrow scenario: when an attacker has managed to see the RNG's state at some point in its execution but (a) is no longer able to see the newer states and (b) is able to influence its entropy input.  That's very specific—it lies at a very precise distance from normal operation (when the adversary hasn't seen the RNG state) and worst-case scenario (where the attacker has completely compromised the RNG and is able to see the state repeatedly).


How to verify personal information (identity)? I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers.

I am trying to figure out how/where companies get information to ask you to verify you have not stolen someone's identity. For example:

  Which of the following cars have you owned?
  Which of the following addresses have you lived at?
  What color was your xyz car?
  What city were living in, in xyz year?

Generally the only information entered is your social and name. I would like to be able to provide this same verification in my service but don't know where to find it. I would prefer to build it myself if that's possible, but if there is a service for it, that could work too.

As for building it myself I am curious how companies even have access to that kind of information. To get the color of my car for example, you would need to verify based off of very confidential DMV records or I guess possibly insurance companies. Do they have a contract that allows them to use said information for these purposes or how do they get their data?

There are professional services that do background verification/auditing of individuals and gather the information to cross verify it. So it itself is a service offering apart from the application you want to use it for (long story short you don't wanna do it just for the sake of your app/service, if you think of it as new business opportunity then it's a different ballgame and out of scope for this question)

There are two major types of background verifications 1. Criminal/personal records 2. Financial/credit verification records

Based on the requirements the details comprising of these records vary.

I am unsure about service providers for criminal/personal records your area (as these will be domestic/country specific agencies) however for financial/credit verification records you can tie up with Experian, Equifax etc service providers(again country specific considering the legal aspect of capturing part of PII).

Oh and be advised when you will be embedding/engaging their services in your application you need to adhere the guidelines for how you'll protect the data at rest and in transit, have to go through their independent audits like Experian Independent 3rd party assessment (EI3PA), Equifax audit etc which are as strict as PCI audits and need to be executed by independent QSA annually.

Finally following are some of the companies (with better SEO at least) who will be able to do the job for you.

(Might be deprecated) Consumer Authentication Service by VeriSign - http://xml.coverpages.org/VerisignCAS.html

Experian: http://www.experian.com/decision-analytics/identity-and-fraud/identity-verification-screening.html

MiiCard: http://www.miicard.com/

Trulioo: https://www.trulioo.com/

i-Verified Background Screening Solutions: http://i-verified.us/

ACCESS BACKGROUND SCREEN LLC: http://www.accessbackgroundscreen.com/id9.html

AAIMCheck: http://www.aaimea.org/AAIMCheck/Background-Verification.aspx
Credit Verification: http://www.creditverification.com/

einvestigator has a list ofprivate investigators if required: https://www.einvestigator.com/missouri-private-investigators/

A parting gift, few valuable links which may be helpful either now or in the future.

https://en.wikipedia.org/wiki/Identity_verification_service

http://www.businessnewsdaily.com/7638-best-background-check-services.html

http://www.businessnewsdaily.com/7636-choosing-a-background-check-service.html

http://insurance.mo.gov/consumers/faq/creditScoring.php


How to make users trust my website? I want to convince them that is all, 100%, fully open-source without any hidden additions Say I have a website that handles data from another provider/service that my users use. My users log in through OAuth with the foreign provider. They need to add an additional key, which I'll save, which in turn allows me to do all kinds of nasty stuff with their account.

My entire site is (going to be) open-source, without, obviously, API keys and environment variables, like BASE_DIR and the likes of it.

How would I convince my users that the code they use, is exactly the same as the open source one, without any additions whatsoever, so other people who know what's going on can say "Yeah, this code is legit, no worries"? A simple message at the bottom "This code is the exact same as the one found here" can be faked. Most likely everything can be faked - even then, what would be the most trustworthy way? Is there a third party tool that checks the server contents to a GitHub repo?

You can't, unless the code that runs is entirely client side and interpreted directly from source, in which case they can verify it trivially with standard file comparison tools.

The reason is that you would have to prove that the entire software stack of the system was trustworthy, and that the entire hardware stack was trustworthy, and that every point on the network between your system and the client system was trustworthy. Oh, and that the client system was trustworthy.

Even with a third party system, you could potentially serve different files to that and to users - see this article about detecting the use of Bash pipes for an example of this. You could silently redirect the third party service to a "good" version of your code, whilst sending users the "bad" version, unless they are attempting to download the files for inspection, when you send the "good" version.

You could fake the third party system entirely, and actually control it yourself, claiming that every set of files was identical. You could intercept the response from a third party, changing it so that it appeared to show that all your code was safe. You could do that through malicious code which runs on the client system upon first load, so they never get a true response from the third party system, or just turn off the third party verification so they don't even know about it.

You can't even verify with complete confidence that a compiled application was generated from a specific set of source code, in the general case. See this answer from 2010 for some details on why - it's the same for any other compiled code, so don't be afraid of the VB6 references.

Basically, you have to behave in such a way that they trust that you won't do anything bad, and be prepared that some users won't have that level of trust. There are some people who won't use any software they haven't compiled themselves, on systems they built themselves, using hand written compilers, and even they might fall foul of malicious instructions buried in chips. We went past the point where it is possible to fully verify computer behavior a long time ago (read up on Ken Thompson's evil compiler for an example), and the client-server model doesn't help with that.

On the other hand, most of the time it doesn't matter - people trust systems all the time without this level of reassurance.


Are disabling TLS 1.0, enabling RC4 or using TLS1.0 with AES only, the only ways to mitigate BEAST server-side? I understand that BEAST is very hard to exploit and mostly fixed by modern browsers already.

Also, enabling RC4 will introduce other risks.
So, if you still want to mitigate the almost impossible exploitable BEAST attack, at the server-side only! Is the only way to stop supporting TLS 1.0? Or would using TLS 1.0 on AES only, fix it as well?

In both solutions, which would cause the smallest reduce of browser compatibility while mitigating BEAST server-side.

Yes. Several years ago, Qualys covered mitigation techniques, and notably several methods that you might think would work (like "enabling the empty fragment technique server-side") are ineffective because the attack is client-side.

However, TLS 1.1+ is much more common these days. Additionally, most clients added mitigation years ago (even Apple, who was slow on the take).  Between these two factors, BEAST really isn't much of a worry any more.


What shell binary should I use for the root account on a Linux system? Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?

Depends. If there's a different set of attacks that can replace /bin/bash than some other files on your filesystem, then maybe there's a case for it. I used to make my root shell on Solaris a statically-linked /bin/sh. The reason was that /usr/lib was on a different physical disk than /, so in single-user mode it might not be possible to start a dynamically-linked shell. The fact that this also avoided touching any compromised shared objects was merely a side-effect.

In other words, if /bin/bash and your proposed alternative root shell are on the same partition, with similar permissions, there probably isn't much point. An attacker who can trojan one can trojan both.


How to make it harder for a VPS provider to access my data? I know it is impossible to completely prevent a host from accessing the data  of a virtual machine (as noted here, here and here), but I think there is value in making it harder to do so. Bare metal servers aren't always an option, and they are much more expensive.

Here is the threat model I have in mind:

Buy a VPS from a fairly small company, maybe even one managed by a single person
Harden the VPS as much as reasonably possible
Rogue government entity demands all the server's data
The company may not have the time, knowledge or resources to circumvent the hardening
The company provides only the encrypted data to the government entity

Of course, said government entity could simply demand direct access to the host machine, but even then, it may still require them a good amount of time to figure it out, by which point the VPS owner may have caught on to what's happening and wiped it clean.

This leads me to my question. Given the typical steps a system administrator may take to obtain data from a virtual machine, what could one do to make this process harder?

Edit: Here is what I have done so far: encrypt the boot partition (GRUB bootloader supports encryption), encrypt the root partition, encrypt the home directory w/ unmounting on logout, use linux-hardened, disable USB via kernel parameters (I am unsure if this helps?)

Buy a VPS (the StorageVPS), create a 50GB file full of zeroes, export this file using SSHFS.
Buy another VPS (the ApplicationVPS) on another jurisdiction, mount that file, use LUKS to create an encrypted filesystem.
Use different identities for each one, so neither one nor yourself are on the same country (or group of friendly countries).

If the admins on StorageVPS get that 50GB file, it's just a large blob of unreadable data. They don't have the LUKS key, so they cannot decrypt anything. The admins on ApplicationVPS can have the key (they own the server after all), but being on another jurisdiction will complicated things a little for the government trying to read your data.

You will have latency issues, but your data will be a little safer.


How to delete a C# variable value permanently from memory? I have created a variable in C#. Now I want to clear the variables value from the computer memory. Is there any way to do that?

Below is my current attempt at deleting the value of recordLine, but I can still read the value from memory with DumpIt even though I set the variable to null and call garbage collection.

private void Extract_SLST_VariableLine()
{
      StreamReader file = new StreamReader(FilePath + FileName);
      while (!file.EndOfStream)
      {

            string recordLine = null;
            if ((recordLine = file.ReadLine()).Trim() != string.Empty)
            {
                  console.writeline(recordLine);
            }
            recordLine=null;
            gc.collect();

      }
}

Just setting a string to null or calling the GC will not help here. It might delete the reference to the value, but not the value itself. After GC, it may be overwritten, but there is no guarantee that it will happend anytime soon.
What you need instead is something aking to a SecureString, that implements a Dispose method and some obfuscation. However, the security it provides is limited:

We don't recommend that you use the SecureString class for new development. For more information, see SecureString shouldn't be used on GitHub.
SecureString is a string type that provides a measure of security. It tries to avoid storing potentially sensitive strings in process memory as plain text. (For limitations, however, see the How secure is SecureString? section.)

The problem here is that if there is sufficently advanced malware with sufficiently high priviliges on your system, no secrets are safe no matter what fancy C# types you wrap them in. So I am not sure this is a problem with a solution.
If you do use a secure string, think about how you get the value into and out of it. If it passes through an ordinary string, you have gained absolutely nothing.


Does an attacker need to guess or brute-force a password for TCP spoofing? From my understanding, TCP spoofing can be carried out if the attacker can correctly guess the sequence numbers from the response packets (to mimic the real client). The attacker may even obtain this sequence of numbers via sniffing. Furthermore, a trusted connection must already exist between the target client and the server in order for the attacker to intercept/spoof
However, I was a bit unclear as to whether the attacker would need to gain initial access to the system or network (by guessing or brute-forcing their password). In order to send the sequence numbers from response packets to the server, does the attacker need to have access to it? I am not sure whether this attacker can just send the SYN packets to the server without any access to the system/network. My concept of these things is a bit blurry right now and I would greatly appreciate some advice.
Thank you!

TCP Spoofing is a technique used by attackers to mimic your source connection to any target host.
Whether the attacker would need to gain initial access to the system or network...
Yes, the attacker would need to gain access either to your network or your system to initiate the attack. The attack carried out over WAN can the the IP Spoofing attack, but that too has limitations.
The attacker, once infiltrated into your network, can sniff down the traffic and (apparently) your device's connections to the external hosts and can yield down sequence numbers of your TCP endpoint.
Sequence numbers can have lower entropy, thus they can be bruteforced easily. The attacker can spoof down your TCP endpoint if the sequence numbers are predictable. Many Operating Systems have tried to patch this and make the sequence numbers as random as possible, but still the threat remains of getting TCP-Spoofed despite this randomization.
LAN routers can have Source Routing enabled, which can enable traffic to route from one local device to another local device inside the network. This can be the main reason for the attack to accomplish. If source routing is disabled, the attack would not succeed.
How TCP Spoofing works?
Let's say I'm an attacker X, my victim is Y and the target host is Z. The attack mostly initiates in the in.rshd daemon in the destination header Z. Systems accept the socket options via getsockopt(), and can drop any malicious requests on the socket with setsockopt().

If I want to request to Z by the source address of Y, I will need to first feed the destination header request with the sequence numbers of Y. (which I can fetch from requests beforehand)

I will send the SYN packets to the destination header and the server will initiate the second handshake and send SYN-ACK packets to Y. The server Z will initiate a PCB(Protocol Control Block) to handle the connection.

I again will spoof the packets pretending to be Y to the destination server using the sequence numbers. This time, source routing isn't required on this step. Sometimes, I'll need to flood down ports of Y inorder to send a large amount of data, to prevent Y from responding with an RST(Unavailable or Unreachable).

After sending the ACK packets to the destination header, now the accept() call completes and the destination header (Z) checks for the IP options associated and if the connection is source-routed, it disables the connection and now Y is connected to Z without any interference of X.

Now if I know the next sequence number of Y, I can request other destination headers again from the sequence numbers.
The impact of the attack can be the execution of arbitrary code in a request as root depending on the configuration of the target system. It is necessary that the TCP endpoint and the destination header involves trust, either by using .rhosts files or hosts.equiv files.
To prevent TCP Spoofing to occur,

Prevent any suspicious IP Address to lure around in your network other than the devices connected. This can be done by monitoring the network's activity often.

Disable Source Routing from your admin panel so no rogue requests could be made/routed across the network.

For any further reference, check out this presentation by CasoDiStudio.
Hope this helps!


Running open relay smtp in company network We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the Internet.

Now we need to decide (as part of the product management) if either emails without authentication should be allowed or if username and password should be required.

Our questions are:

Do security policies generally recommend to just run closed relays requiring authentication?
Or do these policies enforce open relays motivated by GDPR requirements in order to avoid tracking employees?

Open relays = bad. Anything that can access the relay can send out emails using your domain. Closing relays, like not choosing "password1" as your password is a basic protection.

Only use an open relay if you have other mitigating controls that prevent other nodes from accessing it. Authentication is the easiest way to do this.

But, if you can control network access, there can be ways to create a pseudo-open relay (no auth on the relay, but access controls on other layers). In the past I have used VLANs, NAC, switch port configuration, IP whitelists, etc. with added monitoring and alerting for anomalies. Not the best option, but a risk-based approach if it's the only way forward.


Differentiate normal flow and broadcast attacks How do you identify whether a broadcast traffic is normal or is considered an attack such as a DoS attack?, There is some information that the plot or the source that allows me to differentiate between an attack and a normal flow?

You'll want to capture the packets with a sniffer, such as Wireshark, and look at the payload and source addresses, and see if it is expected traffic.


How Generate Custom Dictionary Password list I want to generate a password list that has 8 characters like this:

Characters are: Pp|Aa|Ss|Ww|o0|Rr|Dd

First character only can be Pp, second Aa@, .... to end.

How can I make this list using crunch or similar scripts?

You could use a tool that expands regexes, such as exrex:

$ git clone https://github.com/asciimoo/exrex
$ cd exrex
$ python exrex.py '[pP][aA@][sS$][sS$][wW][oO0][rR][dD]'
password
passworD
passwoRd
passwoRD
passwOrd
passwOrD
passwORd
passwORD
passw0rd
…


Facebook iOS SDK Authentication The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app.

If I find out an app's app ID, can't I just create another iOS app with that app's bundle ID? Sure, I may not be able to distribute my app on Apple's App Store (since it requires every bundle ID to be unique), but can't I distribute it other ways? Shouldn't the iOS app also need to know the app secret? I guess Facebook figures allowing an attack to extract the app secret from the iOS app would be worse? What about storing the app secret in the iOS SDK Keychain Services?

The iOS app ID includes a team specific prefix that can not be changed nor set by the developer; it is automatically used when signing a build (which you even have to do when using ad hoc distribution or development builds)

So unless Facebook ignores that part when checking the App ID to be equal, you cannot create an app that passes as another app.

There you go:

  App ID
  A string that identifies one or more apps from a single team. An App ID consists of a bundle ID search string preceded by the Team ID, a 10-character string generated by Apple to uniquely identify a team.


Email Account under attack (really) - anything I can do? Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.

My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.

Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?

EDIT: After about 9 days, I suddenly stopped getting locked out and the ticket got closed. I guess they finished "testing" the new policies/systems and hit the rollback button?

I'm not happy that support insisted on so much troubleshooting at my end when the whole thing seems to have started after a security overhaul at their end, but that's how it always goes...

A few thoughts:

Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.
If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)
Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.
Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.


How to secure a company CA certificate? We've been using third party issued certificate both for public TLS encryption and internal communication. We also use issued certificates to encrypt persisted passwords.

Problem is that te certificate is valid for 1 year only and we have to redeploy it and reencrypt passwords everywhere every year.

I thought of using self signed certificates for internal communication (where I can use my own CA) and to encrypt passwords. I'd use 10 year expiration or even longer.

My question: how to safely store CA certificate? What is a reasonable expiration time for the self signed certificates derived from our CA? Are there tools to make this whole process simpler and secure?

Problem is that te certificate is valid for 1 year only and we have to
  redeploy it and reencrypt passwords everywhere every year.

Actually, you should be able to get a new certificate while reusing the old keypair. That way you would still have a valid certificate while still beeing able to decrypt any data without reencryption.

  how to safely store CA certificate?

The easiest and cheapest (and least secure) way is to have the CA private key in a password encrypted file on a server you consider secure.
One step up would be to buy a smartcard or crypto token which features a PKCS#11 interface for storing the key and doing CA operations.
The most secure option is buying a Hardware Security Module (HSM) which is technically just a very fast and very secure (and very expensive, thinks thousands to tenthousands of Euros) smartcard.

  What is a reasonable expiration time for the self signed certificates
  derived from our CA?

keylength.com gives an overview how long keys with a certain size can be considered secure from todays perspective. You should not exceed these limits.

  Are there tools to make this whole process simpler and secure?

Of course. A small and easy tool would be XCA for instance. If you plan to issue a lot of certificates or more advanced PKI features, the best open source solution out there is EJBCA. Very powerful, but it need considerable more time to get used to it.


Password security, "hacking" of web pages (hydra) Our lab at the university was about password security, "hacking" of web pages (using hydra)
So using the command below you manage to get the admin password.

hydra -l root -P /home/ubuntu/rockyou.txt -t 1 192.168.159.130 http-get /whmcs/admin/

My question is, what if i don't know this part /whmcs/admin/ is there a simliar command that can get the password without this part ?

192.168.159.130 is the IP address of the server you want to crack and http-get is the protocol which is used to send passwords, in this case plain HTTP authentication, and /whmcs/admin/ the directory on the server. Webservers can have multiple sites and configure different users and passwords for them. So the accounts which are valid on /whmcs/admin/ might be different than those on /phpmyadmin/ or /plesk/.

That's why you need to tell hydra which directory exactly you want to crack. There is usually no way to tell how many directories with individual http password protection are configured on a server and what other functionality there is on the server which could be called an username+password authentication (like login forms).

Usually you wouldn't run a tool like hydra blind. You would try different URL paths and different protocols on a webserver until you get prompted for a password, find out what technology is used to implement that password prompt, and then run hydra on it.


HMAC-SHA256 for JWT Token Signature I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server and the other the application server.

I am reasonably well versed on Computer Security concepts, threats, common vulnerabilities and their counter-measures, but one question I have not found an answer to is whether or not you need multiple rounds of hashing when using HMAC-SHA256 to sign a JWT token.

Since for something such as hashing a password using SHA256 the general rule I understand is to run 2^(year-2000) (give or take based on performance needs) rounds of hashing, I struggle to believe a single round of HMAC-SHA256 is good enough, yet I have not really seen anybody ask this question when I have researched the topic.

Therefore, given a secret key and a JWT token header and payload, which of the following is considered best practice for the token's signature:

A single iteration of HMAC-SHA256 is considered secure for a JWT token signature.
It is recommended to run HMAC-SHA256 many times over and over reusing the same secret key.
Run HMAC-SHA256 once then run SHA256 hashing iterations on the product from HMAC's calculation. (This is what I would assume is best practice)
I am totally wrong and it is something different.

Thank you very much for any help. Just want to make sure the system is designed as well as possible.

HMAC and password hashing solve very different problems. With HMAC the secret is expected to be high quality (ie 128 bits of entropy), whereas passwords are expected to be low quality (30 bits of entropy is optimistic for most people).

A single round of a quick hash function is bad for passwords because it allows attackers to quickly attempt many common passwords, or do a brute force attack on a low entropy password. For HMAC that risk doesn't really exist (as long as the secret is generated by a CSPRNG), so one round is sufficient.

Side note: you didn't specify, but you shouldn't use SHA-256 directly for hashing passwords, even if you use many rounds. It's much easier to use PBKDF2 with SHA-256 from a standard library so you don't run into any pitfalls.


UEFI secure boot and rootkits I heard that with UEFI secure boot enabled a custom kernel module that is not signed will not run, hence a rootkit might be difficult to install.

Can a secure boot really block rootkit modules from being installed or is it just capable of blocking rootkits from loading during the system bootup?

secure boot : http://www.webopedia.com/TERM/M/microsoft_secure_boot.html

UEFI secure boot ensures that the UEFI firmware loads and executes only signed UEFI applications (including bootloaders) and drivers. So an attempt to modify them by introducing a malware would be detected and rejected. A vulnerability or malware (including rootkits) could possibly be also signed in the loaded code or the components loaded next.

  Can a secure boot really block rootkit modules from being installed or
  is it just capable of blocking rootkits from loading during the system
  bootup?

Secure boot does not protect your system from introducing a malware after the boot process finishes then the system behaves the same as without secure boot. To keep the boot process safe the signing chain of the loaded code must be ensured because there could be multiple stages of booting. See below.

Chain of software components

The overall security depends on the chain of the individual components:

hardware - Security of all the software depends on the hardware it is running on.
UEFI - The firmware takes care of secure boot including the management and storage of cryptographic keys used for code signature verification. The certificates stored in the UEFI variables are trusted by the UEFI secure boot.
bootloader - This (with possible UEFI drivers and applications) is the only software (except UEFI itself) in the boot chain directly validated by the secure boot signature. All the next components listed below are not secured by the UEFI secure boot specification. To keep the whole booting procedure secure the bootloader and possible next booting components must implement code signature checking mechanisms similar to secure boot.
second stage bootloader - optional component
OS kernel - As the most complex component running most of the time offers the largest playfield for vulnerabilities.

Trustworthiness of the signing certificates

The trustworthiness of the signed bootloader depends on the signing keys which are loaded into the UEFI variables with trusted signing certificates. For example in some distributions of Linux a small bootloader called shim is being used to overcome the secure boot and load an unsigned second stage bootloader or kernel. So anyone who can write to the medium with the bootloader or kernel image could introduce any vulnerability or malware into it.

Shim in many current distributions is being used to load a code signed by a different key so usage of shim alone does not mean that the whole boot chain is not protected by signatures.

References

Fedora UEFI Secure Boot Guide
UEFI Secure Boot in Modern Computer Security Solutions
Secure Boot in Ubuntu


KARMA attack does not require for an attacker to be in range of the target network? I have recently read about the comparison between KARMA attack and Evil Twin attack. The article states that contrary to an Evil Twin attack, in which the attacker is required to be in range of the victim's network, the KARMA attack can be performed even if the attacker is far away from the targeted network.
The article states:

For example, if I am using a client system that is vulnerable to KARMA, my client may associate to a wireless access point that identifies itself on-the-fly as "coffeeshop," even if my real "coffeeshop" network is hundreds of miles away.

How is this possible? Did the article omit to specify that you can do that only if the target has connected to the rogue AP before?

Target has connected to some AP before
The KARMA attack requires that you have connected to some AP before, not necessarily the rogue AP.
Many wifi devices broadcast the SSIDs of known access points because, among other reasons, it allows faster [re]connecting and thus better user experience. So if you have connected to VerySecureWorkWifi earlier and have set your device to automatically reconnect to it, then your device (if it's vulnerable to KARMA) will be repeatedly broadcasting that to the world.
So any attacker can listen to that broadcast, and respond with "Yes, what a lucky coincidence! Now my SSID is VerySecureWorkWifi, please connect!".


What is the difference between MITMproxy and SSLsplit? I am aware that MITMproxy only captures HTTP/HTTPS protocols where SSLsplit is a transparent proxy and therefore can capture also other non-HTTP protocol communications. However MITMproxy can operate as well in as a transparent proxy. Hence I would think that MITMproxy and SSLspit are exactly the same?! I tried to google it but I couldn't find a clear answer.

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)]

sslsplit

sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped into logfiles. sslsplit is written in C and thereby pretty performant.

mitmproxy

mitmproxy is a tool that has much more features and is thereby much more complex. In contrast to sslsplit, mitmproxy has an interactive user interface and allows you to pause, inspect, edit, replay, or drop flows. While it can be used as a transparent proxy, mitmproxy can also run as a HTTP, SOCKS, reverse or upstream proxy. Additionaly, there is a simple Python scripting interface. As you already mentioned, mitmproxy speaks HTTP primarily, nonetheless it also supports logging arbitrary TCP connections (although that's not a first-class feature at the moment).

To sum it up,

both mitmproxy and sslsplit perform the same kind of man-in-the-middle attack on TLS
mitmproxy is more powerful and has more features
sslsplit has a more dedicated purpose, is simpler, and faster.
both are (IMHO) excellent tools


Differences between Burp request and Browser - Has different responses So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different to when I request it in the browser (Firefox & Chrome - both with the security measures, such as XSS Protection, turned off). I also tried to "Request in Browser" through Burp, but to no avail.

At first I assumed it was a different UA, so I made sure that they were both the same (even tried removing it from Burp), and eventually I did this with all of the HTTP headers just to make sure there was no difference there.

With Burp I get the page back with a successful XSS payload in the source, in the browser I get a 404. Obviously as this is a work engagement I cannot provide specific details of the host/target.

My question is, why would burp give me a 200 response with the source code and the browser throw a 404 error?

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">

  <frameset>
    <frame src="http://host/injection_point_here">
      <frame src=""></frame></frameset>

Thanks

Intercept the request using a browser and send that request to the comparer.  Then take your original Burp repeater request and send it to the comparer.  Compare the two. If nothing is different, then you must have something set that updates requests.  I know there are options to automatically update content-length and things like that.


Why Skype discloses my IP address to anybody? Apparently there is a Skype exploit that allows people to obtain your IP address through your Skype username if you're online. The problem has existed since 2012. There exists countless websites which resolves Skype usernames into IP addresses.

So why hasn't this been fixed yet?

I believe they already have if this article is correct:
http://community.skype.com/t5/Security-Privacy-Trust-and/How-to-protect-your-IP-from-skype-resolvers/td-p/3874291

Skype uses peer-to-peer instead of traditional client/server connections to make the calls happen though. Since there's no sole middleman the data needs to know where it's going between each peer through an ip address. A traditional server can have both users connected and control the flow of information so that the IP isn't exposed to either user.

I am curious what this fix does to circumvent needing the destination IP address. Someone else could probably clarify better.


Checking SSL/TLS servers for NULL encryption support I have a web server supporting SSL 3 and TLS protocols, the following are the supported cipher suites:

TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

How can I check if the server supports NULL cipher ?

openssl s_client -connect www.example.com:443 -cipher NULL

You might also want to have a look at this blog which details how to test for different ciphers.

To test for 64-bit ciphers or lower you can use:

openssl s_client -connect www.example.com:443 -cipher LOW

To test for 128-bit ciphers:

openssl s_client -connect www.example.com:443 -cipher MEDIUM

To test for anything more than 128-bit:

openssl s_client -connect www.example.com:443 -cipher HIGH


How does advanced firewall scan data (check for signature etc) if it is encrypted? Let's say for normal web browsing, since it's using HTTPS, all the data will be encrypted.  In that case, how does the firewall/IDS/IPS check for signatures to detect anomaly/virus/malware?

For actually applying signatures to the decrypted traffic the firewall needs to have access to this traffic. The typical way to do this is by essentially doing a man in the middle attack, only that the "attacker" (the firewall) is considered trusted in this case. See Is it common practice for companies to MITM HTTPS traffic? for more.

Another way sometimes employed in firewalls/IDS protecting a specific server (like in web application firewalls) is to not make this server the TLS endpoint. Instead the firewall itself or some device in front of it is the TLS endpoint so that the firewall can see the plain traffic. A variation in this scenario is to provide the firewall the the private key of the servers certificate so that it can decrypt the traffic. But this works only if RSA key exchange is used while today DH key exchange is recommended.

And then there are attacks which can be detected without decrypting the traffic. These signatures for example rely on specifics of the TLS handshake like the kind and the order of ciphers and TLS extensions used or information about the certificate send by the server. Since the certificate is send in plain text in the TLS handshake one can determine the CA which signed it or if it was self-signed and similar by simply passively sniffing the traffic. See Deciphering Malware’s use of TLS (without
Decryption) for a nice paper about how one can detect malware communication this way.


Why does integrity exclude confidentiality? I'm trying to understand the CIA triad. I read that all three parts of the triangle exclude each other, but I don't understand why you can't have full integrity and full confidentiality?
I figure you get integrity with encryption and maybe some other restrictions, but how does that hurt confidentiality?

Thanks.

You can have both integrity and confidentiality. There is no such "exclusion". However, you must remember that they are different things provided by distinct algorithms. Piling layers of encryption does not provide integrity.

Integrity is normally obtained with a MAC, while confidentiality relies on encryption. Combining encryption and a MAC algorithm properly is known to be tricky; e.g. SSL/TLS got it wrong and it generated an endless stream of attacks that can be thwarted only with extreme care in their implementation.


Encrypting data for Android mobile app I am creating a mobile app for Android. This is my first mobile app by the way.

I have decided to store data used in my app in a SQLite database in the target Android device.

The data I am storing is about user's financial data so I have decided to encrypt data before storing into the database. But I don't want to drain all the mobile phone resources to do the encryption and decryption.

BouncyCastle will do the trick. But I am worried if someone de-compiles the code, get the security key and decrypt data. Is there any alternative for this. Any of your ideas are welcome.

Don't embed a hard-coded key into your application; that provides little more than a trivial obfuscation for anyone that reverse-engineers your application.

To generate a key for encryption, use a key-derivation algorithm such as PBKDF2, which essentially performs hundreds of rounds of a hash function on a password, combining the results together to produce a secure key. To help understand why you need a key-derivation algorithm, take a look at this other answer.

The benefits of PBKDF2 are:

Configurable number of rounds, to tailor computation speed to your device whilst maintaining a reasonable security margin against brute-force.
Provable security, i.e. it is at least as strong as the underlying hash function.
Can produce any size key.
Easy to implement (there's already a Java implementation for you)

Essentially you let the user put his/her password in, then compute the key using PBKDF2, then use that key to decrypt/encrypt the data.

Now, as far as the actual encryption goes, I highly suggest sticking to something easy if you've not dealt with crypto before. Block ciphers have to be used in a mode of operation, and require an initialisation vector (IV) in order to be secure. There's a lot of implementation details that have to go exactly right in order for it to actually be secure, so in this case I suggest reading various other questions around here to understand them further.


Can CVSS score be different from that calculated from vector In most databases, there two fields: CVSS vector and CVSS score. It's logical that if we calculate score from vector, it's supposed to be equal to the score field.
But, can it be manually 'tuned' and therefore be different?

No, it can't.

The score is calculated based on the metrics in accordance to the CVSS specification. There are no custom metrics one could use to adapted the score.

For many issues, there is of course some room for interpretation (mainly regarding attack complexity and the three impact metrics), and I have the feeling that sometimes the metrics may be fudged a bit to get the desired result.

Regarding the separate display and storage: Displaying the score is of course for usability reasons, and storing the score in the database may be done to avoid having to recalculate it each time.


Network Routing through Proxy to VPN (This is *somewhat* of an extension to this question.)

I've come to enjoy (yes, I know) using a VPN for all of my internet usage (specifically Freedome), but I don't have a lot of money to buy subscriptions for every single device. I'd like to just purchase one subscription, install it on a single computer/server, and route all traffic through that LAN proxy. I believe this would have the additional advantage that I can set up a firewall on this machine and protect my whole network.

I'm rather new to network security though, and I haven't tested any of this yet. Is there a better method that could be less of a bottleneck? Or does this sound like a good approach for routing traffic?

Update: In the case of Freedome, it appears that this would be a breach of the usage terms:

  If the Software and/or its services are shared through a network or the Software is used to filter traffic at servers, firewalls or gateways, you must have a license for either scanning capacity or for the total number of users whom the Software provides services to. Source: Freedome License Terms

Well as you've discovered, firstly you need to find a VPN that allows you to do that in the terms and conditions.

But in general terms, this is a common way of working with VPN's, just not so much with the type of VPN you are using. VPN's are commonly used to connect "branch offices" to a head office in enterprises. In this case, the router is the VPN end-point rather than each PC since the latter would be very inefficient.

In your case, the best way is to get hold of a VPN that supports being an end point (VPN termination) rather than just being a VPN "passthrough". Of course, the router needs to be able to terminate the type of VPN your service provider supports - OpenVPN, IPSEC or whatever.

If you can't do that, you need to set up a computer as the VPN end point and as a router. Then connect the other computers on the "inside" of the router. There are lots of ways to do that but the most performant way would need a computer with 2 network cards, Linux can be used to create a router and there are several versions of Linux that are pre-configured for that purpose.


Does Thunderbird send IP address? I send my gmail emails from thunderbird (on Ubuntu machine). I am wondering whether thunderbird sends out the IP? If so, how can I hide my IP from the outgoing emails?

Email clients (like Thunderbird) generally don't insert origin IP addresses (or other header lines) into sent emails.

Usually, if such a change takes place, it's done by the mail server that the email client connects to.

In this case, I tried a test email (Sent via Gmail on Thunderbird), and my IP does not appear in it. You should verify that this result is the same for you - Gmail will have multiple mail servers, and they may behave differently (e.g. for testing).

Edit: Oops, I'll address the "how to hide" part of the question.

Short answer: You can't hide your IP from the email server you connect to.

Long answer: You can't hide your IP from the email server you connect to, because by definition, you need to connect to it to send your email, and once you do that, it knows your IP address. Once it has that information, it can do anything it wants with it - log it, store it, alert the police, or insert it into the email header.

The only thing you can do is to connect to the mail server from an IP address that can't be linked back to you. So this means using a privacy-oriented network tool like Tor, or a trusted VPN. Or, use public WiFi, e.g. at your local library or Starbucks etc.


When is a password “secure enough”? Suppose you have a lock on your door with a keypad 0-9. A person can enter a digit combination of maximum 10 characters. They get three attempts before the door is locked for 1 hour.

If you had that door on your house, how long of a password/code would you choose? 4-digit, 6-digits etc?

When is secure secure enough? What is the lowest one could go and still consider it secure? What does it mean to be secure?

Real world: A client has requested that we minimize the password requirement on a system for users accounts, preferably down to 4 digits digits and have other measures such as ratelimits/account lockout etc but it feels that a 1 / 10000 chance of entering a correct password is too high of a probability even if they only get X(few) attempts per day. What is the lowest / simplest one could go with additional measures in place and still consider it secure, assuming that an attacker gets three attempts before the account is locked?

Addition:

The service is a Skype-like service
The lockout would work like no new logins would be allowed for the duration of the lockout
If a correct password is provided upon a login when a lockout has occurred in the past, an SMS would be sent to the user with a second token that they would need to enter to login
Any client that is already logged in wouldn't be logged out during a bruteforce of their account, hence the chance of them having to go through the SMS secondary validation is slim

I think your client needs to update their threat model.  Online password guessing is not the only thing which should drive password complexity.  The client needs to understand how  how password cracking works.   If your password hashes are ever compromised (via SQL injection, improperly stored database backups, etc), an attacker is going to try cracking those passwords offline with a tool like hashcat, rather than guessing them against the website itself, where account lockout could come into play.  4 digits is NOT enough security for any system.  Even the slowest hashing algorithm can complete that work in under a second with a modern video card.
If there are concerns about usability regarding passwords, I would suggest that users use a password manager. If that's too much effort, all modern web browsers can also save the user's password if portability is not an issue.


In Tor, what stops the end server from following the breadcrumbs back to their origin? This would probably require knocking on people's doors, but — couldn't the endpoint ask the exit node what the relay node was, and then ask the relay node what the entry node was, and then ask the entry node what the origin was?

Is it just not logged long enough for the NSA etc. to show up at the Tor nodes' doors?

I am looking at these diagrams...

https://www.eff.org/pages/tor-and-https
https://www.torproject.org/about/overview.html.en#thesolution

...and trying to read the original paper, but not understanding much.

As others have pointed out, "knocking on people's doors" can be difficult when the said doors are spread over the World, in locations which are geographically remote and, more importantly, legally remote. If all the Tor nodes are under in scope of a single law enforcement agency (e.g. they are all in China, or all in the USA), then that agency may indeed knock on all doors and have them opened. In an international context, this becomes harder.

Further complicating the issue is that "honest" Tor nodes (those who follow the protocol faithfully) do not keep logs, so even if they want to comply to a demand for information on a past connection, they simply do not have it any more.

Breadcrumb following is not the only way to unravel Tor, though. As the metaphor goes, if Hop-o'-My-Thumb had been smarter, he would not have brought bread, but a compass. In the case of Tor, information can be obtained by correlation in time and size. When a Tor connection occurs, the data goes through a randomly chosen sequence of nodes; as the theory goes, as long as one of these nodes is honest, the original client cannot be traced back. Or can he ?

If the evil attacker runs several nodes (and I expect big agencies to actually run a lot of Tor nodes, if only to remain "in the loop"), then it may happen that both the entry node and the exit node are attacker-controlled. These two nodes can then notice the case when a data packet entered the entry node, and a packet of the same size exited the exit node a few milliseconds afterwards. A normal connection entails several successive packets back and forth, further strengthening the correlation. The exit node can see the packet contents (and, at least, their final destination), while the entry node knows the client's identity (well, at least its IP address). That's all that is needed to destroy anonymity -- and that attack works regardless of the honesty of the nodes in between, in flagrant contradiction with the overoptimistic theory alluded-to above.

("One honest node is sufficient" is the theoretical framework for Mix networks as used in electronic voting protocols -- but that works only in the context of voting, where a node can accumulate all packets and send them en masse at the end.)


Intercepting Android app traffic with Burp I am trying to understand what do Burp and Android apps do when the traffic is https. I did not install the Burp CA to the phone.

Some apps completely refuse to work. They display an error message or think the phone is not online. Is this because of SSL Pinning?
Some apps work normally but Burp does not capture any packets. How is this happening? Without burps CA how can the phone and server communicate? Is Burp just relaying the traffic?
Some apps work normal but Burp only intercepts packets for a few operations. Intercepted operations are probably using empty trust managers or something like that but still how is the rest of the code communicating with the server?

First thing to remember is that Burp is a HTTP(S) proxy. It doesn't do anything about any data which isn't HTTP(S) (OK, except websockets). Android apps, on the other hand, can use any protocol they want. Lots do use HTTP(S), just because it suits the type of data they're sending, but it's not actually required.

Where an app isn't using HTTP(S), that traffic won't appear in Burp. The most obvious example of this is DNS traffic - you won't see any DNS lookup requests showing up even if you're using a browser via Burp.

So:

Apps which completely refuse to work. They could be using certificate pinning - two options here, though. First type, they're looking for a valid certificate for the target site to be installed on the device. In this case, installing the Burp CA cert would make them work again. Second type, they're using some custom pinning, which requires either a specific certificate to be provided by the server, or a certificate signed by a specific entry in the trust chain. These ones won't be fooled by the Burp CA cert.
Apps which work without any packets being captured. They're probably not using HTTP(S). This could be things like SSH clients, messaging services like Whatsapp, or games, where the loss of a packet is less important than most packets arriving fast, which would better suit a UDP based network connection than a TCP based one like HTTP. They might also be ignoring any proxy settings which are in place, especially if you're just intercepting using a HTTP proxy app. To view this data, you'll need a tool like Wireshark, which can handle other types of data, and a wifi card which supports monitor mode.
Apps which only show some traffic. If the traffic you're seeing is stats packages or adverts, they probably fall into class 2 above - most stats systems appear to use HTTP(S) because it's relatively easy to implement in anything, and you generally have to have some kind of HTTP connection open to download adverts anyway.
Apps which don't actually connect out. There are some applications which look like they should be connecting to the internet, but actually don't, or only do so on an irregular basis. These can include timetable apps, some games (where the high scores are updated daily, for example) or anything where it's possible to store data locally for the most part (mapping apps may store the "usual" area locally, and make calls out for reviews of attractions or more distant places). In this case, you might not have seen them try to connect whilst you were watching.

I'd suggest looking at the traffic with Wireshark, if you can, and see what protocols are being used, then dig into interesting ones using appropriate software, bearing in mind that some are intentionally difficult to inspect - encrypted packets from Whatsapp should be unreadable, else they've got something badly wrong!


Can my SIP conversation partner identify my location? Is it possible that after establishing a SIP phone call my conversation partner is able to identify my location? If so what are the prerequisites and how accurate would he be to do so?

SIP separates call signaling and voice data, to allow SIP routers to remove themselves from the data path. Some software does this, some doesn't, so whether the remote party is given your IP address depends on the SIP routers on the way.
In the easy case where your SIP client is running on a machine with a global IP address, it will open a random local port for voice traffic, and send an INVITE packet containing the global IP and the port number, which is forwarded verbatim to the client on the other side, which then uses it to establish a connection. This method works even if the other side is behind NAT, and routes actual voice traffic in the most direct way possible, but both sides of the conversation learn the IP address of the remote party.
If both sides are behind NAT, software may attempt to configure NAT traversal, if it succeeds, we're back to the first case.
If NAT traversal doesn't work and a proxy is available, or a router on the path is configured to route all traffic through a proxy, it will modify the address given in the INVITE message, do the same in the reply, and both sides will only learn the IP address of the proxy.
IP addresses are not accurate locations, but allow some educated guesses. IP geolocation is its own topic, so I've focused on the SIP specific aspects here.


Reverse engineering malware/viruses Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already done.

It would be good to know what has been compromised, as well as look for routes to successfully remove it.

I have found tools such as IDAPro and OllyDbg, which are proving to be useful, however, I won't lie and pretend I understand what to look for, or what the data shown in each means.

What are some good resources for learning and truly comprehending the data shown in these debuggers, as well as some resources for general reverse-engineering of malware?

I am not just looking for removal tools, I'm trying to dig into the malware and see what it does.

Thanks!

Malware is a tricky one stuff - Malware RE is not only about disassembling or debugging - it is also about behavior, changes monitoring, etc.

I suppose you will be interested in some blogs that describes malware analysis, then you could look for them here: https://code.google.com/p/it-sec-catalog/wiki/Malware. Don't know if it is worth to mention resources about RE - there are really a lot of materials all over the internet.

Also you should consider buying following book: http://www.amazon.com/Malware-Analysts-Cookbook-DVD-Techniques/dp/0470613033/ref=wl_mb_recs_5_dp


Does disabling .htaccess improve security? I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it includes:

Placing apache's www folder in a separate, noexec partition
Running apache as a user with read-only access on the folders
open_basedir disabling access to folders above WP's structure
Permissions (640 or 740 if I recall correctly) on most folders and subfolders (except wp-content/uploads/ and a couple others). Whenever a new plugin needs to be installed, updates applied or changes made to the files, a script applies recursively more relaxed permissions temporarily.
Apache ignores .htaccess files.

I have not defined those policies and I'm not aware of its efficacy. However, the last item (disabling .htaccess) is causing me at least two problems:

Stops "pretty permalinks" from working (the user-friendly URL rewrites).
Prevents the BulletProof plugin from working (basically a collection of .htaccess directives that are supposed to protect WordPress against XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection hacking attempts, and prevent access to files such as readmes that might give away WP's versions, other config files, php .ini files and directories listings).

My question is: does disabling .htaccess present some advantage from security viewpoint that might justify losing those above listed points?

Disabling .htaccess doesn't in itself provide any additional security benefit to your website. As @Xander mentioned the primary reason I've seen .htaccess disabled is performance (although I would suspect the performance improvement is negligible in many cases).

However from the hosts perspective it could provide some security benefit, in that it may help protect the host (and any other users on the box) from you. If you the "untrained" user misconfigure a directive in .htaccess it could cause problems for other things running on the box. And in that sense it also helps prevent you from accidentally compromising your own site.

Now whether this is of any practical value, given that there are better ways to handle this, is an entirely different question.

In addition to the options mentioned by @gowenfawr. You could ask your host to add the configuration directives that you want in the .htaccess directly to the server config of your site. That would allow them to confirm that the configuration won't cause a security compromise.


How well does FDE protect against disk firmware malware? In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives.
I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect you, if at all.

This article describes how a certain hacking tool, which could be deployed by a hard-drive's firmware-based backdoor, can be used to grab crucial information from RAM and then store it on a small area on the firmware, to be retrieved later in order to aid in decrypting the drive.

For instance, if using bitlocker, such crucial information might be any file called "Bitlocker Recovery Key*" (the user is prompted to save such file(s) when enabling encryption). A more sophisticated technique would be to get the surrogate key from memory, in the same principle as a cold boot attack.


Is there any way to use Nuget securely? Visual Studio now includes a Package Manager that downloads and updates software packages from the internet.  The common name for this is "Nuget"

The problem I have is that anyone can pretend to be someone else, by spoofing the owner field.  This opens up a whole can of worms with regard to updates, and verifying the authenticity of every patch.

Are these valid concerns? (did I miss any?)
What technical and procedural controls can we implement to limit risk?
Is there any way to use Nuget in a secure manner?

NuGet does not currently support code signing for package or nuspec files, so the author of the package cannot truly be identified. This issue was raised as a feature request in 2010, but it didn’t get much attention and hasn’t been implemented. See http://nuget.codeplex.com/workitem/79.

Currently an already existing package NuGet can only be upgraded by the same account that it was originally uploaded by but this does not verify the actual author of the code which I believe is what you are getting at.

Outside of NuGet, code signing for assemblies still exists. Based on this I would suggest that you ideally:

Only use signed assemblies from a trusted publisher.
Use strong name references in your projects (which binds the project/assemblies to a specific public key).
Verify the signature for each assembly you download.

Possibly another concern is that a NuGet packages can have PowerShell install/uninstall scripts attached to it which are automatically run when using the NuGet package command-line. NuGet 1.4+ does support code signing for PowerShell scripts so I would suggest leaving PowerShell execution policy to RemoteSigned.

Alternatively don’t use NuGet and download the .msi/.exe from an official release and verify the signature on the file.


Do I need to salt PBKDF2 when it's used for AES encryption If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?

Absolutely! It's even right there in the PKCS #5 v2.0

  A salt in password-based cryptography has traditionally served the
  purpose of producing a large set of keys corresponding to a given
  password, among which one is selected at random according to the salt.

By using a secure salt, password p1 = tomato will not produce the same key as p2 = tomato even though they're the same password. This has two benefits:

Protection against rainbow tables.
Only one password can be attacked at a time. The same computational effort can't be utilized to "reverse" more than one password.