How safe is it to put your 1password file on Dropbox? There's an answer on superuser to this question, but I'd rather have an authoritative answer from a security perspective.

Is it generally safe to host an encrypted master password file (such as that used by 1Password) on a cloud storage provider (Dropbox, iCloud, etc.)? What are the relative risks inherent in doing so, and can those additional risks be effectively mitigated?

Disclosure: I work for AgileBits, the makers of 1Password.

Short answer

The safety of your 1Password data on Dropbox depends on the quality of your 1Password Master Password.

Long answer

The long answer is just an explanation of the short answer and a couple of other things.

We designed 1Password under the assumption that some people would have their encrypted 1Password data stolen. Whether it is stolen from their own computers (someone walks off with a laptop) or from something like Dropbox doesn't really matter. It is possible for the data to be stolen, and this is why it is encrypted with keys that are encrypted with keys that are derived from your Master Password.

Now we make heavy use of PBKDF2 to slow down automated Master Password guessing in the event that the 1Password data is captured, but PBKDF2 and the like only present a speed bump to the attacker; it does not provide a solid barrier. So it is important you pick a good Master Password.

More than five years ago, we offered some advice on picking a good Master Password in Toward Better Master Passwords. This advice was picked up by XKCD and made famous, but it satisfies what I call the Kantian Principle of password creation advice: Password creation advice should remain good advice even if everyone follows it.

Do not reuse your Master Password. In the three known (to us) cases in which someone's 1Password data was compromised, the user used the same password that they used elsewhere for both Dropbox and for their 1Password Master Password. Don't be like them.

Beyond Dropbox

At the risk of descending into a sales pitch, I should point out that with a 1Password account, you no longer need to manage your synching through something like Dropbox. We have even designed this with Two-Secret Key Derivation (2SKD) so that even if your data is captured from our servers, an attacker would not be able to launch a password guessing attempt against that captured data. Please see our white paper (PDF) for details of how that is managed.

But as the question was specifically about 1Password data on Dropbox, let me return to that ...

OPVault v Agile Keychain

Depending on when you started using 1Password and on which platform, you may be using the Agile Keychain format on Dropbox. The Agile Keychain Format was designed nearly a decade ago and has some shortcoming for a today's world. It exposes much more "meta data" than is appropriate and it does not include any tamper detection.

So the one thing I would recommend to those synching 1Password data with something like Dropbox is that they switch their sync format to the OPVault format. OPVault encrypts far more meta data, and uses authenticated encryption to defend against a wide class of attacks that involve tampering with the data.

But with either data format, the safety of your 1Password data depends on the quality of your 1Password Master Password. Make it unique, strong, and memorable. And you may wish to write it down and keep that in a safe place because there is absolutely nothing we can do if you forget your Master Password.

With a 1Password Account, a good Master Password is still needed to protect you if data is stolen from your local machine, but 2SKD does protect you if data is stolen from us.


Cert Pinning on mobile app - does it really require a public SSL cert on the server side? To implement Cert Pinning on a native mobile app on (e.g. iOS), a new API end-point is being established (e.g. api.example.com). This URL will be setup with a self-signed SSL certificate.

This API end-point URL is meant to be consumed only by this mobile app (and not via Web or other UA). On the mobile app, the "cert not trusted" warnings, if any, can be transparently suppressed to make it seamless for the mobile user.

Is the Cert Pinning validation on mobile app sufficient for the security of data-in-transit (with self-signed cert)?

Do we really require a public SSL certificate in this scenario?

Would a public SSL cert add additional value from a cryptographic standpoint to mitigate MITM (one of the goals of cert pinning)?

A certificate is used in TLS for making sure that the client talks to the correct server and not some man in the middle. To check the certificate the client either has to know exactly which certificate to expect or has to find another way to trust the certificate. In a typical setup with web browsers as clients it does not scale to distribute the expected certificate in a secure way to all clients and thus a PKI is used instead where the browser does not trust the certificate directly but it trusts the certificate because it trusts the issuer and the subject of the certificate matches the URL.

But in your case of a mobile app you actually can distribute the knowledge about the certificate with the application. In this case it is enough to have a self-signed certificate and pin to this certificate or its public key. But note that you cannot simply revoke the certificate in this setup in case it gets compromised. If you need this it might be easier to use the existing mechanism with public CA in addition to pinning.


Is it safe to auto-fill credit card numbers using Chrome? Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the credit card numbers:

My questions are a few :

Is it possible for to breach Google Chrome and take my credit card information?
As per my understanding the credit card number is not stored with any type of encryption, so is it really secure to store in autofill data?

How does Chrome handles this type of data? I agree it's good in terms of usability to store and fill the credit card details, but I doubt its not good in terms of security.

Is it possible for breaching google chrome and take my credit card
  information?

Yes.

As long as Chrome can use your number for auto completion, it has to be possible for Chrome to access it. If one program on your computer can do this, another program or a least humans can do it too.

  it's not stored with any type of encryption

Even with encryption, the statement above holds. Chrome would need the key, and this key has to be somewhere on your computer so that Chrome can use it.

As long as someone can physically access your computer, few things actually help. Encrypting your whole hard drive and taking the key away with you is one possibility. Downside 1: It´s a pain to insert flash drive and password each time to turn it on. Downside 2: If someone gets your computer while it is turned on, everything is futile again.

If you only want to protect against attacks form the internet, this is much better, but nonetheless there is no 100% protection. Not entering your card number (or any sensitive data) in the computer is the only reliable way.


Is possible to track people using Whonix? How can an attacker track someone using Whonix like tor-gateway?

From the tor homepage:

"Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit."
https://www.torproject.org/about/overview

Also, tor & other tools, such as a browser used while on the tor network, can have vulnerabilities which can de-anonymize you. These have been actively exploited by government agencies.
Recent example:
http://arstechnica.co.uk/security/2016/12/tor-releases-urgent-update-for-firefox-0day-thats-under-active-attack/

Older, similar example:
http://arstechnica.com/security/2013/08/attackers-wield-firefox-exploit-to-uncloak-anonymous-tor-users/


Is Using VPN Useful For Strictly Personal Use? I understand the necessity of using VPN when connecting to the work network from the outside.
What I want to know is there any benefit for a strictly consumer computer that is connected to the internet but only for non-work things? Does it protect against viruses or people taking over your computer for example?

What a VPN does for you is establish an encrypted channel to another location and then pass all your internet traffic through that second location. In effect, you can consider your internet traffic as originating at that second location. Whether that has any benefit for you depends on the specifics.

In general it does not provide any additional security to your specific machine- if you engage in risky behavior on the internet like downloading random executables or visiting sketchy websites then doing that same activity through a VPN does not help keep you safer.

However, whoever provides the VPN can theoretically make you safer. For example, my workplace runs an internet filter and has a dedicated security staff to maintain it, so it can catch and prevent a lot of risky online behavior. When I connect to my workplace VPN then all my web traffic runs through that filter- that makes my online activity safer, but it's not because of anything special about VPN, it's because the people on the other end of the VPN have taken the time to provide security mechanisms beyond what the VPN provides.

However, a major non-commercial use of VPNs is hiding your true location (if you trust your VPN provider to keep that secret for you). If you don't like the fact that web services can tell where your traffic originates from then you can establish a VPN link to a provider in another area, and then it appears as though all your traffic originates from your provider. This is exactly analogous how people with offline privacy concerns can get a PO box from the post office in order to hide their true home address.


How to protect source code that resides on virtualbox web server which starts at boot? I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can connect to the server.

The idea is to hand this to someone on a flash drive, let them install virtualbox on their computer and run the image to start the server.

The server software is written in an interpreted language and the source code also resides on the image. The problem is, we don't want someone to hack into the disk and get the source code that is plainly lying around.

Since we want the httpd to start at boot without giving anyone any passwords, we can't encrypt the disk. Disk encryption also leads to complications since httpd will have to start after encrypted volume is mounted etc.

Considering these constraints, what options do I have in order to protect the source code inside the virtual drive?

Virtual machine, but real CPU. Regardless of how you elect to see it, the code for your server still runs on the machine of the supposed attacker. Similarly, disk encryption of any kind would not help either, even if you personally typed the password yourself upon boot: at some point, the data is still decrypted, on the attacker's machine.

Virtual machines don't offer any protection against that kind of inspection. VM protect the host operating system from the guest, not the other way round.

This is one of these situations where "go Cloud" is a good advice. Don't give a USB Flash drive; instead, host the code on a server somewhere. That way, you keep control of the whereabouts of the data and who reads it.


Snort Alert - What is PROTO:255? My Snort alert output is like below. The first element of 4th row of each alert indicates Protocol. However, in the alert (portscan) TCP Portscan, the protocol is PROTO:255. What does it mean?

Why Portscan use PROTO:255 instead of TCP ?

Thanks

...

[**] [1:10001:1] Possible TCP DoS [**]
[Classification: DoS was detected] [Priority: 1]
07/20-21:10:29.392535 172.16.116.44:10331 -> 198.199.206.217:80
TCP TTL:63 TOS:0x0 ID:35766 IpLen:20 DgmLen:44
******S* Seq: 0xC8A50927  Ack: 0x0  Win: 0x200  TcpLen: 24
TCP Options (1) => MSS: 1460

[**] [122:1:1] (portscan) TCP Portscan [**]
[Classification: Attempted Information Leak] [Priority: 2]
07/20-21:51:21.251815 207.136.86.223 -> 172.16.114.50
PROTO:255 TTL:254 TOS:0x0 ID:28488 IpLen:20 DgmLen:160

[**] [1:648:7] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
07/20-23:51:08.158403 172.16.114.148:20 -> 194.27.251.21:26637
TCP TTL:63 TOS:0x8 ID:61880 IpLen:20 DgmLen:1500
***A**** Seq: 0xC8C20948  Ack: 0xF05AC8A1  Win: 0x7D78  TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS181]

...

The one byte wide protocol field in the IPv4 header has all of its bits set.  This doesn't mean anything in particular as IANA (Internet Assigned Numbers Authority) hasn't assigned that protocol number. Refer to the Protocol Numbers page on IANA's web site for more information. The packet may have been sent in an attempt to elicit an ICMP protocol unreachable message from the target network which could be analyzed by the scanning party, i.e. to check for data leakage or fingerprint the IP stack that generated the ICMP datagram.


Diffie Hellman prime attributes If I generate a Diffie-Hellman prime openssl dhparam 512 -text (deliberately of small size to keep the paste size below small; I know minimum is 2048 and up), what are the different parts of the output:

    PKCS#3 DH Parameters: (512 bit)
        prime:
            00:84:f7:d4:6a:96:54:da:8e:b0:68:4d:8f:42:fe:
            52:a1:4f:dc:05:f7:0b:f1:4a:fd:dd:0a:27:b7:b4:
            c4:09:db:4d:80:c2:b0:46:e0:f6:dc:fe:e2:9a:d2:
            5c:e8:7c:6e:9f:81:aa:bc:4b:8c:6e:67:b5:e5:b2:
            03:b6:56:d3:c3
        generator: 2 (0x2)
-----BEGIN DH PARAMETERS-----
MEYCQQCE99RqllTajrBoTY9C/lKhT9wF9wvxSv3dCie3tMQJ202AwrBG4Pbc/uKa
0lzofG6fgaq8S4xuZ7XlsgO2VtPDAgEC
-----END DH PARAMETERS-----

I understand the generator is the base number that's usually either 2 or 5. The question is the prime number and the DH parameters.

What is the prime represented in?
How can it be converted to an actual prime integer?
What is encoded (and why?) in the DH parameters section?
How do different applications (such as httpd) use this output?

What is the prime represented in?

Plain base 16 encoding of actual number.

  How can it be converted to an actual prime integer?

Just convert from base 16. Like so:

$ echo "ibase=16;0084F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDD\
D0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B\
203B656D3C3" | bc
69641036876619088755613794741049804861416084108574896892562277663292\
07662129683124275184714669456043499786144904245391117269209586570225\
834561454877365187

And, yes, it is in fact a prime.

$ openssl prime -hex 0084F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3
 84F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3 is prime

  What is encoded (and why?) in the DH parameters section?

Same as the plain text description.

PEM version:

$ cat dh.pem
-----BEGIN DH PARAMETERS-----
MEYCQQCE99RqllTajrBoTY9C/lKhT9wF9wvxSv3dCie3tMQJ202AwrBG4Pbc/uKa
0lzofG6fgaq8S4xuZ7XlsgO2VtPDAgEC
-----END DH PARAMETERS-----

Parsing that file with openssl for human consumption:

$ cat dh.pem | openssl dhparam -noout -text
DH Parameters: (512 bit)
    prime:
        00:84:f7:d4:6a:96:54:da:8e:b0:68:4d:8f:42:fe:
        52:a1:4f:dc:05:f7:0b:f1:4a:fd:dd:0a:27:b7:b4:
        c4:09:db:4d:80:c2:b0:46:e0:f6:dc:fe:e2:9a:d2:
        5c:e8:7c:6e:9f:81:aa:bc:4b:8c:6e:67:b5:e5:b2:
        03:b6:56:d3:c3
    generator: 2 (0x2)

And parsing the actual ASN1 encoding:

$ cat dh.pem | openssl asn1parse -i
0:d=0  hl=2 l=  70 cons: SEQUENCE
2:d=1  hl=2 l=  65 prim:  INTEGER           :84F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3
69:d=1  hl=2 l=   1 prim:  INTEGER           :02

  How do different applications (such as httpd) use this output?

I guess they just link against the OpenSSL library and pass in the relevant files. And allow OpenSSL to take care of it.


Tamper-proof BIOS password & settings storage with Trusted Platform Module? In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS.

My question is: On modern PCs equipped with a Trusted Platform Module (TPM), how tamper-resistant are BIOS passwords and BIOS settings generally? Maybe TPM design specifications mandate a certain level of resistance against removing BIOS passwords, obtaining BIOS passwords in plaintext, or changing the drive boot order?

(I'm assuming a business class HP/Dell laptop where TPM is advertised as a core feature, and that the attacker has physical access to the PC motherboard.)

The TCG Trusted Computing concept devices the BIOS into two parts. The initial BIOS is assumed to be secure and will initialize the TPM. This so-called CRTM will then measure the remaining BIOS components and log their values in the TPM. From the spec it appears that CMOS data is part of that measurement and is stored to PCR1. But since a changed BIOS password or other setting would invalidate things like Bitlocker, I don't think this register is actually used. Or the implementations don't actually measure this configuration space. Best try it out and see what happens. If it is measured, you can use a system like Bitlocker(or a linux initrd plus shellscript) to protect your OS data against a manipulated BIOS.

Note however that the TCG specification explicitly excludes hardware attacks. Also, the TPM is always dependent on the BIOS to correctly program and protect SMM and TXT, so you should always verify the BIOS measurements.

Note also that full disk encryption and protection of passwords against brute-force attacks are the only practical use-cases of a TPM today. Everything else is generally impractical due to the huge configuration space of the OS(infinite valid measurements..) or not as secure as one might think(SVM/TXT/VT, though they still present an advancement over the state-of-the-art).


How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way? Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the details for the instantly granted (approved) Credit card so that customer can start using it for eCommerce?

IANAQSA, and you seem to be getting into the Issuer business.  You really need a QSA.

You are asking about the requirements upon issuers (most PCI-DSS questions are from the POV of merchants, acquirers, and processors; the other side of the equation).

Issuers are also held to the PCI-DSS, but obviously they have different constraints.  For example:

  3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only
  personnel with a legitimate business need can see more than the first
  six/last four digits of the PAN.

For an issuer, it is a legitimate business need to communicate a cardholder's card number to them.  Most commonly, this is done by shipping a plastic card to the cardholder's mailing address.  So Issuers clearly get a pass on the requirement to Mask per 3.3 when business need requires them to disclose the full card number.

You're asking about virtual / electronic only cards, and there is precedent that Privacy.com displays full card data - PAN, expiration, and CVV - as soon as a user allocates themselves a new card.  So my best answer is - yes, you can display those details per business need.

To address followup from the comments:

QSA is Qualified Security Assessor; the auditors recognized by PCI as authoritative.  Since I Am Not A QSA (IANAQSA) what you get from me are opinions, but not worth anything when audit time comes.

All the MFA/2-factor requirements in PCI revolve around administration, not end users or customers, so that should not be an issue.

Privacy issues legitimate card numbers; I believe they do fall into pre-paid bins, but they aren't really pre-paid cards, as they're backed by ACH and can have sophisticated limits.  But, yes, to a merchant they look like pre-paid cards.


OpenSSL: best way to get sha256 hash of two sha256 hashes I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730

now I want to create a new SHA256 that depends on these two hashes (for a merkle-tree structure). Any two hex representations of the same hashes should in any case always result in a representation of the same binary hash (so for example if I go off the string representations, then it must be some canonical form of it, like ascii encoded lower case)
I know that I need to use an injective function, but what's the best way to go?
should I use the string values and some delimiter and then hash the binary representation of that string (and rely on bash using ASCII encodinng for it)?
NEW_HASH=$(echo -n "${HASH1,,},${HASH2,,}" | openssl dgst -sha256 | sed 's/(stdin)= //')

Or is it better to convert the hex representations to binary first and then just concatenate the binary representations (since the two hashes have fixed length, the result would be unambiguous)?
BIN1=$(echo -n "$HASH1" | xxd -r -p -)
BIN2=$(echo -n "$HASH2" | xxd -r -p -)
NEW_HASH=$(echo -n "$BIN1$BIN2" | openssl dgst -sha256 | sed 's/(stdin)= //')

What's the better approach and why?

Hash is a set of bits. If you really want to work with hashes, you should use their binary representation, not the text representation.
For instance, "b5" in your example means that the first byte of your hash is "10110101". But if you consider it as a text, it will mean that every character will be considered separately, so "b5" will be represented as "0110001000110101" ("b" -> 98 -> "01100010", "5" -> 53 -> "00110101").


Firewalled bots in UDP p2p botnets? One thing that I don't understand about peer to peer botnets, is how a bot stays connected to the network considering the protocol used is UDP.

Since the UDP is connectionless, and the bot is behind a firewall, the packets wouldn't reach it. What would happen then?

P2P botnets deal with firewalls the same way as all the other P2P applications (like Bittorrent, Skype and other VoIP, ...) do:

Simple NAT firewalls can be passed with UDP hole punching techniques
With more complex firewalls, like application layer gateways which only allow HTTP traffic, it either fails or it uses some outside server as a relay for communications.

Failing in case of more restrictive firewalls is actually not that much of a problem for P2P bots because most users are either not protected by any firewall at all or only by simple and easy to bypass packet filters.


Security implications of download attribute The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users want to download a (e.g. jpg) file instead of having the browser visualise it.

Click here to download

Some browsers block the download attribute when the file is not accessed by the same protocol, on the same host and over the same port. This to me sounds a bit pointless while it breaks a lot of good use cases to prevent something that can be circumvent in other ways.

What are the security implications that browsers try to protect? Any useful real example?

This is actually described in the HTML living spec:

  If the algorithm reaches this step, then a download was begun from a different origin than the resource being downloaded, and the origin did not mark the file as suitable for downloading, and the download was not initiated by the user. This could be because a download attribute was used to trigger the download, or because the resource in question is not of a type that the user agent supports.

  This could be dangerous, because, for instance, a hostile server could be trying to get a user to unknowingly download private information and then re-upload it to the hostile server, by tricking the user into thinking the data is from the hostile server.

The scenario, described here is:

You are on my onlineexcel.attacker.com website that allows to make Excel files
You click a link in there, stating like "download your excel sheet". This is actually a link that downloads your facebook profile, say <a href="https://facebook/myprofile/" download="your-sheet-from-onlineexcel.xlsx">
Later on, you wish to restore your excel sheet/load it online, so you click the upload button of my è onlineexcel.attacker.com, say` and you select the file that you thought was from onlineexcel.attacker.com (because it was a link in there)
You actually have uploaded your FB profile to my website

So the hazard here is that user do not know whether link is downloaded from the same origin or not.

That's why spec advises:

  Thus, it is in the user's interests that the user be somehow notified that the resource in question comes from quite a different source, and to prevent confusion, any suggested file name from the potentially hostile interface origin should be ignored.

But I suppose that since this is a bit difficult to properly tell to Mom-like users, then browsers preferred to block such downloads.


Is it safe to put my own router in my neighbour's DMZ? I use my next door WiFi for a small charge as I am unable to install my own broadband connection.  I have a 300Mbps WISP router connected with a fixed IP to my next doors router (192.168.0.2).

My WISP router has its own firewall, so was wondering if it would be safe to place my router on the neighbour's DMZ, and would this cause them any issues.  I want to do this because I want to be able to access services on 'my network' from the Internet.

Yes that would be fine. However what ever ports you expose on your router your neighbor will be able to access as well. To minimize risks you could block access to that port from your neighbors ip range and also your external ip. This would minimize risks of them discovering your services however would not stop them from connecting from another ip or preforming a port scan from a remote host. To clarify things setting up a dmz will expose your router to the Internet the computers behind your router will be fine unless you have ports forwarded. For further questions I would go to Super User forum as your question only just makes it on the on-topic list for this forum


Is this a phishing link? I saw the link below on a Facebook group and someone commented that it's a phishing link. I checked the domain info and found that its owned by Facebook but I am not sure if that information's trustworthy. So please tell me if it's safe to open it?

The links was: https://lookaside.fbsbx.com/file/ScheduleforGATE17%20%28modified%29.pdf?token=AWxCUR8U84mktJ0xpKwdqePJLLRT9dabZhYmFbL-GnVvyoVJT_veNLO2swRQOelWDkGEfPw38PLyM-7U6iin-ng9vwB-HX4QPBP-QhouuRhePuobFE6zGc9HFWSlK0-46ratVPHxqBK7DdE_v0jZweE_uI4pbk-n8dDfpKUzP0R71Q

There are several techniques to check whether the domain fbsbx.com is owned by Facebook.

WHOIS record

Let's check the WHOIS record for fbsbx.com:

Registry Registrant ID:
Registrant Name Domain Administrator
Registrant Organization Facebook, Inc.
Registrant Street   1601 Willow Road,
Registrant City Menlo Park
Registrant State/Province   CA
Registrant Postal Code  94025
Registrant Country  US
Registrant Phone    +1.6505434800
Registrant Phone Ext:
Registrant Fax  +1.6505434800
Registrant Fax Ext:
Registrant Email    domain@fb.com

fb.com is one of Facebook's domains, and the registrant organization is Facebook, so that looks legit.

DNS record

dig NS fbsbx.com

;ANSWER
fbsbx.com. 52794 IN NS a.ns.facebook.com.
fbsbx.com. 52794 IN NS b.ns.facebook.com.

The nameservers are on the facebook.com domain, which also looks legit.

TLS certificates

https://lookaside.fbsbx.com/ delivers a certificate issued for the following domains:

*.facebook.com
*.facebook.net
*.fb.com
*.fbcdn.net
*.fbsbx.com
*.m.facebook.com
*.messenger.com
*.xx.fbcdn.net
*.xy.fbcdn.net
*.xz.fbcdn.net
facebook.com
fb.com
messenger.com

So whoever owns fbsbx.com also has access to a valid facebook.com certificate.

The domain is legit.

Be warned that the PDF linked in the post may still link to phishing sites.


How can you trust that there is no backdoor in your hardware? We know that Intel processors have one (ME) so it is definitely possible.
In general, how could you even trust a piece of hardware like a CPU or network card, even if the manufacturer says there is no backdoor?
For software, it is easy since you can access the source code verify it and compile it. But for hardware?

The short answer is, you can't. The longer answer: there are a few things that can be done to increase your trust in hardware, though they also just shift the root of trust elsewhere.
A first interesting question you pose is the software/hardware distinction. To not go into the discussion about the possibly blurred boundary between the two here, I'll understand "hardware" to be non-reconfigurable logic implemented in some physical device (i.e. I'll exclude firmware such as the intel ME or microcode).
Backdoors can be inserted into a physical device in a number of stages: from conceptual architecture, through logic design, up to fabrication. To ensure no backdoors are inserted, you would need to validate the whole process from the end product to the beginning.
The good news is that the initial stages are very similiar to software - in fact, logic is usually designed using hardware description languages (HDL). These designs can be audited in the same way software can be audited. The step from here to fabrication involves multiple conversions e.g. to lithography masks using synthesis software, in a similar way to how software is compiled using a compiler. These too can be audited just like a compiler. (As a tangent - the bootstrap problem is a really interesting problem where you consider the possibility of the compiler compiling your compiler being untrustworthy)
So this leaves the last step: fabrication. Validation at this stage is usually done both by inspecting the fabrication process, and by randomly sampling devices from the same production batch (produced using the same lithography masks). For instance, the masks used can be compared to a validated trustworthy copy to ensure that no backdoors are inserted at this stage. Similarly, randomly sampled devices can be delayered and inspected under an electron microscope.
However, as a consumer, these steps are usually not available to you. For most chip producers, this whole process involves a lot of closely kept trade secrets, and aren't publicly available. This is why there is a movement towards creating open-source hardware toolchains and HDL implementations of common logic modules and systems - though there are a number of problems here too.
Finally, as @knallfrosch correctly points out in the comments, backdoors may also be inserted after production, either at a distributor, while the product is being shipped to a customer, or in-place (c.f. evil maid attack). An example of such practices by the NSA has come to light through the Snowden affair. Tampering at this stage may range from hardware implants added to the device to editing the circuit on a silicon die e.g. using a Focused Ion Beam (FIB).
Mitigations at this stage usually rely on these kinds of tampering leaving externally visible traces, which may be additionally enforced using e.g. tamper-evident packaging (something every-day users can do is the glitter and nailpolish technique). Furthermore, minute device-specific imperfections that are a side product of fabrication may be used to create so-called Physically Unclonable Functions (PUFs) which may be designed in a way that tampering will most certainly alter or destroy the PUF and therefore be detectable.


How to prevent a web application from accessing local URLs (SSRF) In our web app the users can specify a URL that the server will access later (POP3 access and browser push notifications).
This means the web app does a network request to a user-chosen server. The web server might have access to parts of our internal network or some services might be running on localhost.

              +------------------+
              |                  |                  +------------------+
internet  ----+     web server   +----[Firewall]----+ internal network |
              |                  |                  +------------------+
              +------------------+

What is the best way to prevent users from specifying internal URLs and only specifying servers accessible through the external internet?

... prevent users from specifying internal URLs and only specifying servers accessible through the external internet?

I doubt that this is securely possible to proactively filter user input for this. An attacker can easily setup a DNS server which points to some internal IP address or domain, either by A/AAAA record or by CNAME. And given that this DNS server is controlled by the attacker the result of the DNS resolution might be changed whenever the attacker likes.
This means that to check only when entering the domain is not sufficient. Instead the check need to be done whenever the service uses the user-controlled data, i.e. whenever the user-specified URL is accessed and the domain name gets resolved in this process. See also Time-of-check to time-of-use bugs.

The web server might have access to parts of our internal network or some services might be running on localhost.

It might be easier and more secure to fix this design. For example one might put the service inside a container with no other services inside and allow only access to the internet for this container. This approach would provide robustness even against bugs in the application since by design no access to internal sites would be possible.
Another (less secure) option would be to setup a DNS resolver like dnswall which only returns external IP addresses and make sure that only this server is used by the application. Of course one need also be sure that no direct IPv4 or IPv6 can be specified by the user.
A similar approach is to enforce the use of an external proxy server which just based on its location can only access external sites.


Microsoftonline.com, is this legit? A couple weeks back I went to google and type in Office 365 to login and download the suite from my account after restoring my PC.

https://www.google.co.uk/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=office%20365

The top link I clicked very aimlessly as I did not assume for it to be anything else other than Microsoft on top was this link here.

https://login.microsoftonline.com

I entered my details and notices it failed to log in so went back found the other link and logged in successfully.

Here's the deal though, YES I have 2-step verification so my phone is needed to log in to websites from new devices, however I've noticed strange happenings on my newly reset PC.

The first one being errors in programs not being able to read files in %AppData% although they are right there.

Secondly my action centre pops up randomly asking me to enable Window Defender which it is and when I click the notification it simple opens my System32 folder.

Thirdly, my Adobe Creative Cloud application will sign out without command every 5 minutes, I log back in, continue working and then the icon goes grey again and signs back out.

Fourth, Applications like Photoshop and Illustrator which can get preview boosts using my GPU keeps flagging up none detected and I need more than 512mb or vRAM to do such actions which I do actually have as I'm playing games smoothly on high graphics with high fps.

Finally, when going to my system info page it says:
Processor: Not Available
RAM: Not Available.

Yet my Task Manager shows they are working perfectly.

Is it possible my PC is infected with some annoying piece of software screwing with the data around my computer? Drivers and such?
Also how legit is the website mentioned in the title because I have Windows 8.1 and I load up my PC using the account I entered blindly into this website.

Any advice?

Certainly the domain name is correct. That is the generic login page for all Microsoft Online services. You might not always see it depending on how you normally log in.

The nature of the login service means that it takes a noticeable time after you enter your ID before you can enter your passcode. Sometimes this can be several seconds. What is happening is that the login service checks your ID against its master list and works out whether it is a Microsoft account (such as business partner or live.com/outlook.com) or an enterprise tenant account. When it works it out, it may actually change the look of the login page (for example, we have a customised login page for Office 365).

As to the problems with your PC. Hard to say. Certainly you should run a couple of malware checkers to see if they find any issues though I have to say, those kinds of problems are more normally associated with hardware issues, particularly drive errors.


What are ways I can analyze malware in an infected machine, not just clean it? I often run into infected devices in  my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I was thinking of taking an image of the device and creating a virtual machine so I could run tests, kill it and create a new infected vm from scratch.

Malware analysis should be done in a VM preferably disconnected from the Internet.  This is mainly to protect your system, and stop it from spreading (if the malware has that capability).  You can also use snapshots, or sometimes you can setup a VM to never keep state.  VirtualBox is free and will do the job.  VMWare Player is also free, but limited.  Doesn't allow the use of Snapshots unfortunately.

There are various tools out there to help you with malware analysis.  Being disconnected from the Internet can sometimes stop the malware from executing its malicious code.  There are a couple of sandboxing tools that will listen on ports, and respond to network requests appropriately in order to coerce the malware into continuing its operation.  The one recommended by Practical Malware Analysis is FakeNet.  With FakeNet you can even design custom responses to proprietary protocols, and/or non-standard ports.

Cuckoo Sandbox is an open source tool that can provide analysis reports on the malware during its operation.  It can track system calls, keep copies of files created (even if they're later deleted) by the malware, and give memory dumps of the entire system.  A very powerful tool.

Most malware is packed so you'll want to make sure that you can unpack binaries, extract resources, etc.  UPX is the most common.  CFF Explorer is pretty handy for analyzing resources, and includes a UPX utility.  You might want to checkout these 5 tools recommended by MAMB.

These tools will give you a great look at what the malware is doing on a system.  However, if you need to get down to the gritty details you'll want your ever popular IDA Pro.  This is mainly for more complicated malware that you can't coerce into running.  Some malware will start up in suspended threads to run later.  Some just know that you're not connected to the Internet via their own checks.  So you'll have to depend on the disassembly for figuring out what they're trying to accomplish.

Other tools that are helpful, debuggers.  Windbg or Ollydbg are the two most common, but there are lots of options.  Allows you to attach to the piece of malware while its running, set breakpoints, inspect memory, etc.


Permission to a user in a subfolder inside a folder to which he does not have access I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario:

I have a folder called X where only a few groups have access, inside that folder there is another one called Y.
I want group DP_Preven to access with full privileges to the folder Y, but with no privileges or just read privilege to the folder X.
Inside X folder there are more subfolders, but DP_Preven should not have access to those folders.

I need to know which privileges I should give to DP_Preven in X.

Always use the Advanced Security Settings, where you can see the inheritance options, too.

Your DP_Preven needs:

Allow Read & Execute to folder X\ in order to traverse to Y\
Allow Modify to Y\*
since Z\ doesn't inherit permissions from X\, there's no need for additional Deny.

Here, the Principal DP_Preven permissions for F\ & file are inherited from Y\:

               Access       Inher.  Applies to

X\             Read & exec  None    This folder only
├── Y\         Modify       None    This, subf., files
|   ├── F\     Modify       X\Y\    This, subf., files
│   └── file   Modify       X\Y\    N/A
└── Z\         ---          ---     ---

The Modify is better than Full control as it doesn't allow deleting self i.e. folder Y\.

If Z\ had Allow permission inherited from X\ or its parents, then you need to either disable inheritance or add a Deny that always overwrites any Allow, but I This folder only easier to manage, since you don't have to remember to change the settings for every new subfolder separately.


Forgot your password: "New password must have a minimum of 4 characters different from the previous password" This was found on a password reset feature of a government website, where you enter your username, then it takes you to a screen where you can

enter a new password
enter confirmation of new password
answer a security question (about your first pet's name)

And then submit the form, which changes your password.

My questions:

How do you securely store a password, but still be able to do this kind of validation, checking that a new password is at least 4 characters different from an old password stored in the database. I'm after a technical explanation of this.
Am I correct in saying that this flow seems insecure to begin with? The only thing you need to know to change someone's password is their username and a single security question.

It is mathematically possbile do what they are doing securely to store passwords in a manner that would enable that feature but would not have the old password stored in plaintext. But just because it is mathematically possible, does not mean that it is likely.

Homomorphic encryption

At Eurocrypt 2004 Michael Freedman, Kobbi Nissim, and Benny Pinkas presented a paper that explicitly addressed how to efficiently find the intersection of two sets without revealing the contents of either set (other than the intersection) to anyone who didn't have it before. It is also possible to find an estimate of the size of the intersection without even revealing (much about) the intersection itself.

Now that was in 2004 (and was based on previously work). So there have been improvements since then in this and related algorithms. So there are known techniques for finding out how many characters are common to two sets without revealing the contents of either set. (In the case you are asking about, it is only one set, the old password, that needs to be concealed as the system is given the full new password.)

Bloom filters

If we are talking about overlap of sequences of four characters (instead of just characters in both passwords), then a reasonably secure way of doing this is with a Bloom Filter. A Bloom Filter is a special sort of hash table. Each four character substring of the original password could be added to the Bloom filter when that password given to the service and then all four character substrings of the new password can be looked up in the Bloom filter.

Note that Bloom filters are designed for when there are lots of members of the set and are probabilistic. They can give false positives.

The obvious answer is sadly correct

I would be astounded if the site in question is using homomorphic encryption or even Bloom filters. They are almost certainly doing it a manner in which the operators of the site (and anyone who breaches them) have access to the plaintext passwords.


Are GIAC exams open book (Unlike CISSP)? I am currently CompTIA A+, Network+, and Security+ certified.  As part of maintaining compliance with the DoDD 8570, I will also be sitting for the ISC^2 CISSP exam in the near future.

I have noticed that GIAC offers certifications with open-book exams that are regarded by DoDD 8570 as in equal standing to the CISSP.  Given this, my boss was recently surprised to find that the ISC^2 CAP exam he took was not open-book!

Are the GIAC exams actually open-book?  If so, is the test itself more difficult, to compensate for this?

According to the GIAC website:

  GIAC exams are open-book/open-notes, therefore you are allowed to bring any non-electronic resources you may need during your test (this includes a notepad for writing). You are allowed to bring as many of the chosen materials as you are able to fit in a standard-size bookbag (roughly).

http://www.giac.org/exams/preparation/allowed-materials

For the CISSP, page 11 of the registration form states that:

  Reference materials, except as indicated below, are not allowed in the testing room.

The only exception is this:

  ...word-to-word language translation dictionaries are permitted
  for the English examination, should you choose to bring one to assist you with language circumstances.

https://www.isc2.org/uploadedFiles/Downloads/exam_reg_form.pdf

It may be worth adding that most certification exams do not generally permit examinees to bring their own resources to the test.  I personally have sat for CompTIA, Microsoft, and Cisco examinations and am looking at taking an ISC^2 test in the near-ish future - none of these allow the test-taker to take anything more into the testing area than whatever the proctors issue.  Typically, the only things issued are a marker and whiteboard, and perhaps a simple calculator.  Sometimes, a pencil/pen and paper are issued instead, but the paper is shredded after the exam.

Though this is wandering into the realm of subjectivity, I personally would wonder if a certification that allows open-book testing is truly regarded (by the industry at large, hiring managers, etc.) as having "equal status" to those that require candidates to rely only on their personal knowledge.

According to some colleagues of mine, and others here in comments, it seems that the GIAC exams do hold a good bit of weight on their own.  The Silver exams alone are difficult enough that having open-book resources on hand is a practical necessity to pass.  However, at the same time, the examination period is short enough that one cannot solely rely on the books for all the answers and still finish in time.  Additionally, the Gold-level exams require you to write an original paper, better demonstrating a deep understanding of the material.


Using MAC Filtering in addition to WPA2 Encryption I've been trying to find some answers regarding using MAC filtering on my router in addition to having WPA2 encryption but I couldn't find any clear ones. I understand that using MAC filtering solely is bad security practice since anyone can spoof any MAC address by using certain tools and use that MAC to connect to the network.
If I have WPA2 enabled and someone uses one of my whitelisted MAC addresses, will they be able to connect to my network without providing the password?

If your network uses WPA2, then clients must connect using WPA2 and the appropriate authentication method (e.g. PSK). MAC filtering doesn't really have to do anything with WPA2, it just adds another layer of access control that determines which devices are allowed to connect.


I want to create a website, what aspects of security should I really care of? I'm going to create a website with Wordpress.

I'm a junior software developer myself and I have experience working with servers and with the Magento Ecommerce software. But I'm not a systems administrator or either a junior web developer, all what I have learned has been through practice and more Magento (PHP) related.

I'm afraid my lack of experience in cybersecurity could affect the website. I would like to hire a server and put the website there. I'm sure there must be lots of tutorials and I do know how to transfer the files with Wordpress.

With the server, should I get support and security or some kind of similar service?

But as title states, what aspects should I really be aware of?

And definitely a certificate for the website, which I think it gives proper info for the visitor.

I have read this other post, which I think it has similarities with my question, but It differs a bit.

When you're dealing with WordPress, the most important thing is to do their updates very often. WordPress brings out security patches every few days-weeks and you should think about the workflow of doing updates on a regular basis.

The most common vulnerabilities when dealing with web development, are things like SQL Injections, Cross Site Scripting (XSS), wrongly implementing authentication and session management, Cross-Site Request Forgery (CSRF) and things like this.

You can find more about these topics on the internet, I would suggest you take a look at the top 10 OWASP vulnerabities. OWASP (Open web application security project) has lots of resources available for you to learn about vulnerabilities and how you go over fixing them. This blog articles explains the current top 10.

If you want to learn more about security by design, which is the topic you should really explore more, you can take a look at the OWASP Security Knowledge Framework. This framework gives you a lot of information and examples about secure programming in several languages.

You should indeed use a SSL certificate, not just because it gives proper information to your users, but because it makes the connection between your website and your users secure. You can read more about SSL and why you need a certificate on this website.

  With the server, should I get support and security or some kind of similar service?

Most services that let you rent servers, have a managed solution. They are more expensive but if you are new to security and securing servers, this is your best option when you are in production. Obviously I would recommend you setup your own server and learn about security along the way, but not in production.

To add on to the subject of server security, this answer does a great job at explaining the difference between you as a web developer and system administrators:

  But it's a different thing when you rent a virtual server which
  provides you with a naked operating system (or not even that) and
  expects you to set up everything on your own. In that case you are
  responsible for updating everything. When you require this for your
  project, you should consider hiring someone who knows how to harden a
  server properly, who knows which components need to be updated and how
  this is done. But the person you are looking for is not a software
  developer. It's a system administrator.


is there any solution to manage network forensic, SIEM and intelligence analysis and investigation in a enterprise network? Anyone have experience in a solution to manage in an integrated view this functionality ?
- network forensic
- SIEM
- intelligence analysis and investigation

Like Niksun or Solera solution do ?

I'm talking about a SIEM and record solution of a entire network with intelligence investigation features, this tool of course can also be used sometimes for lawful interception in an ISP for example.

I found on the web some network solution from niksun or websense or for example on Solera.

I'm searching a solution to:
- record traffic from 1 day to 36 month and have it on a accessible storage for analysys
- features to make post analysis of the content from layer 4 to layer 7 (ip view but also content view of common protocol, chat communication, mail communication and any related traffic ).
- alerting features triggered on rule based about traffic. example i can made an alert on detecting of a common word in a communication on a subset of the traffic (example only mail or chat traffic from a specific ip address)
- Must have high bandwidth support, protocol identification at every layer, statistic reports and a common way to navigate the data.

What i'm asking for is not for a list of tool when an incident become but about solution to record all the traffic and to analyze all the traffic to identify data leak, misconfiguration and no-policy related utilization of the network.

anyone have experience on its solution and can share information and talk about it ?

Have you looked at NetWitness? Also, check out some of the posts and books from TaoSecurity on the topic of network security monitoring. There you'll find some methods that use open source technologies, but of course they'll require more work on your part.


VirusTotal desktop file uploader seems infected I wanted to scan my process with VirusTotal.com and for this I downloaded vtuploader2.2.exe from their website.

Before executing, I uploaded it to VirusTotal.com and scanned it for viruses to make sure this file was clean.

To my surprise it showed it was infected with a virus Trojan.Nsis.Agent.eaudhx. Detailed analysis report is on this page.

Can anyone tell me if this is a false alarm or is it actually a virus? I had never heard of Antivirus NANO-Antivirus.

How can I upload all of the active processes for scanning?

What makes you think that's a virus? Ok, according to VT there is only one detection by NANO-Antivirus. In cases like this one, I like to check file in sandbox to see what's happening.

So based on static and dynamic analyze with cuckoo sandbox, I don't see nothing which indicate to be a malicouse file.

File Name   vtuploader2.2.exe
File Size   142744 bytes
File Type   PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

MD5     43cd42fe47af2256e4414264f49af1a8
SHA1    3ccbbfffd0da76f72dd99ac39afcfdfacd5f16e2
SHA256  0918fa4b22d3e212a13fa449a5a7b5c3ec97759dd87db6d281f387b1570e13c9

Here is fresh report:

https://malwr.com/analysis/NmIyYWM4NDI1YThmNDc3ZWEzODQ3ZjIzNWRiNDJmN2E/#

  Probably harmless! There are strong indicators suggesting that this file is safe to use.


Let's take your big integer, and convert it to binary, big-endian unsigned encoding (i.e. in Java, I call new BigInteger("...the big numer...").toByteArray() and I write that in a file, removing the leading 0x00 byte which toByteArray() added because it enforces signed encoding, and thus insists on a leading bit of value 0 if the value is positive). I get, indeed, a sequence of 1107 bytes which begins like this:

$ hd blob
00000000  30 82 04 4f 02 01 00 30  82 01 b9 06 07 2a 86 48  |0..O...0.....*.H|
00000010  ce 3d 02 01 30 82 01 ac  02 01 01 30 4d 06 07 2a  |.=..0......0M..*|
00000020  86 48 ce 3d 01 01 02 42  01 ff ff ff ff ff ff ff  |.H.=...B........|
00000030  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000060  ff ff ff ff ff ff ff ff  ff ff 30 81 88 04 42 01  |..........0...B.|
00000070  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
000000b0  fc 04 42 00 51 95 3e b9  61 8e 1c 9a 1f 92 9a 21  |..B.Q.>.a......!|
000000c0  a0 b6 85 40 ee a2 da 72  5b 99 b3 15 f3 b8 b4 89  |...@...r[.......|
000000d0  91 8e f1 09 e1 56 19 39  51 ec 7e 93 7b 16 52 c0  |.....V.9Q.~.{.R.|
000000e0  bd 3b b1 bf 07 35 73 df  88 3d 2c 34 f1 ef 45 1f  |.;...5s..=,4..E.|
000000f0  d4 6b 50 3f 00 04 81 85  04 00 c6 85 8e 06 b7 04  |.kP?............|
00000100  04 e9 cd 9e 3e cb 66 23  95 b4 42 9c 64 81 39 05  |....>.f#..B.d.9.|

The trained eye immediately recognizes the first bytes (30 82 04 4f 02 01 00...) as an encoded ASN.1 DER object (a SEQUENCE of length 0x44F, whose first element is an INTEGER of value 0). So that's not an integer at all ! Let's put it through OpenSSL:

$ openssl asn1parse -i -inform DER -in blob
    0:d=0  hl=4 l=1103 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=4 l= 441 cons:  SEQUENCE
   11:d=2  hl=2 l=   7 prim:   OBJECT            :id-ecPublicKey
   20:d=2  hl=4 l= 428 cons:   SEQUENCE
   24:d=3  hl=2 l=   1 prim:    INTEGER           :01
   27:d=3  hl=2 l=  77 cons:    SEQUENCE
   29:d=4  hl=2 l=   7 prim:     OBJECT            :prime-field
   38:d=4  hl=2 l=  66 prim:     INTEGER           :01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
  106:d=3  hl=3 l= 136 cons:    SEQUENCE
  109:d=4  hl=2 l=  66 prim:     OCTET STRING      [HEX DUMP]:01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC
  177:d=4  hl=2 l=  66 prim:     OCTET STRING      [HEX DUMP]:0051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00
  245:d=3  hl=3 l= 133 prim:    OCTET STRING      [HEX DUMP]:0400C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650
  381:d=3  hl=2 l=  66 prim:    INTEGER           :01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409
  449:d=3  hl=2 l=   1 prim:    INTEGER           :01
  452:d=1  hl=4 l= 651 prim:  OCTET STRING      [HEX DUMP]:30820287020101044201945<...>

Now this looks a lot like an elliptic curve public/private key pair, tagged as such (the id-ecPublicKey object identifier). This means PKCS#8. We notice the elements describing the curve, beginning with the base field size (which is p = 2521-1), then the a and b parameters for the curve equation Y2 = X3 + aX + b (a = p - 3, which gives a slight performance bonus over other values), then the encoding of the conventional base point G (the "generator"), which is a sequence of bytes beginning with 0x04 (uncompressed encoding: the leading byte is followed by the big-endian encodings of the X and Y coordinates of G). The INTEGER immediately afterwards is the curve order n. These parameters match the definition of the P-521 curve (see FIPS 186-3, page 90).

The final OCTET STRING contains the private key. Let's use OpenSSL again to convert this PKCS#8 object into the internal format which OpenSSL prefers:

$ openssl pkcs8 -inform DER -in blob -nocrypt -out key.pem

(the -nocrypt flag tells to expect a key which is not password-protected). The resulting key.pem file can be then inspected:

$ openssl ec -in key.pem -text -noout
read EC key
Private-Key: (521 bit)
priv:
    01:94:56:2e:83:db:2b:fc:26:ef:19:6a:7a:03:cd:
    68:63:2e:cd:2c:fd:43:45:ac:f7:e2:be:56:65:97:
    c7:72:93:97:3c:92:d7:96:55:af:98:f4:24:75:c9:
    2d:5b:15:4c:0a:cd:ef:30:91:47:97:52:5b:2d:c7:
    20:3e:f7:90:ec:36
pub:
    04:00:0b:05:86:60:82:b2:09:3f:2a:cc:1c:81:c6:
    14:3c:44:25:b3:02:09:de:03:0a:47:e3:1c:02:5c:
    7a:38:7f:33:8f:04:39:b4:5a:68:69:0a:e0:2c:c5:
    3e:08:13:0c:53:bd:02:a3:02:cf:29:4f:9e:93:44:
    a1:dd:39:15:00:e3:6c:01:1f:fb:38:27:37:23:33:
    60:d6:69:4c:ea:aa:6e:0b:35:6e:40:66:02:0b:42:
    6d:d6:bc:39:f6:0e:b9:36:ce:9b:2e:bf:00:40:6b:
    16:b1:18:1e:ee:c0:25:fd:c4:b7:2d:5c:5f:40:63:
    e2:b7:e1:be:d8:2c:e7:fe:82:2e:a4:f9:0b
Field Type: prime-field
Prime:
    01:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff<...>

so here are your private and public keys, followed by (again) the curve definition parameters.

An elliptic curve private key is an integer in the 1..n-1 range, where n is the order of the conventional base point. Normally, n is a prime integer (the curve has been selected for that). In the case of the standard NIST curves on prime fields, the base point generates whole curve, which has prime order, and n is close to p (indeed, |p+1-n| <= 2*sqrt(p) by Hasse's theorem). So the private key will be, in the case of P-521, an integer of at most 521 bits, potentially at bit smaller (but very rarely much smaller).


PHP File Upload Vulnerability I'm assessing the security of a webportal for a client and I found a vulnerability.

I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function is directly callable and it doesn't check auth. Anyway, here are the conditions:

Upload takes 2 arguments (lets say), ID (should be int, if its not int, it breaks the code and no upload), file object.

When file is uploaded, it checks for the extension of file using:
pathinfo['extension']. If extension is one of the followings:
"php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

it breaks the upload.

Otherwise, it means all checks are passed and it places the file in:
/uploads/$ID.$EXT

P.S. It reads entire POST/GET data (using php://input) if it finds "%00" (uses regex) in the POST/GET/COOKIE/... anything, it breaks the whole connection.

So to summarize, it does 3 checks:

%00 in POST/GET by reading php://input and searching for %00
$ID to be int
Extension of file, shouldn't be equal to "php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

It it a vulnerability? Can we bypass the tests and cause damage? RCE?

P.S. It's a Linux server.

I'm not sure what the value in their searching for %00 is.  (I mean, I guess truncating filenames on really old versions on PHP?)

If the webserver is configured to send all requests to PHP, you can use alternate extensions (.html) and try to get code execution that way.  If they've carefully configured to only allow PHP execution for the file extensions they are filtering, I would consider whether any other scripting languages are installed.  (e.g., mod_python)

Regardless of RCE on the server, if they're allowing HTML content to be uploaded on the same origin that they host the site, you almost certainly have an XSS vector...


How to do TLS on embedded devices in a home network? If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device manufacturers do to offer transport level security?

Assume the device gets some DHCP assigned RFC1918 address, like 192.168.1.123, and that a dedicated attacker with physical access can access all files on his own device.

If this is impossible, are there any other ways to offer secure access to an embedded device on a home network?

This can be done by certificates on domain names that point to RFC1918 addresses.

Each device gets its own subdomain (c12345.umbrellacams.com), and each subdomain has its own certificate. When installing the device in the network, it has to send its address to the server in order to update the DNS entry on the subdomain. When the user visits the camera in the browser, they can check the domain name against the serial number on the camera to make sure they are connected to the correct camera.

An attacker can buy a camera and extract the private key from it, but then he can only MitM his own subdomain, c98765.umbrellacams.com, and not other subdomains such as c12345.umbrellacams.com.

When on another network, the domain c12345.umbrellacams.com points to a different device, but since that device does not have the private key of the certificate it can't establish a valid TLS connection.

More details in my blog post, A method to do TLS on IoT devices.


Is my vendor vulnerable to sql injection? The company I work for has recently moved to an external vendor for payroll services.  We did an initial upload of data from our old system to the new vendor.  I noticed that our employees that have apostrophes in their names (O’Riley for example) were no longer matching up with other systems.  The new payroll vendor had removed the apostrophes.  We are able to manually add the apostrophe back in via the web based front end, and running a report immediately after the change shows the apostrophe, but the character is removed by the next day.

When I inquired with the payroll vendor about the removed characters, I was informed that "The system will automatically remove quotes as they are problematic in the database itself."  It was recommended that we use the grave (backward single quote) character instead because it looks similar to a single quote.

My question is this: Does the inability to handle quotes (single or double) in a database indicative of vulnerability to sql injection and is there a safe and legal way to prove or disprove this vulnerability?

This is a payroll system and I am hesitant to attempt to discover any vulnerability on the live system and I do not have access to a test system.

I haven't worked with payroll systems and I don't know how old the one you have is.  I do know that they often have to support ancient data formats so it could be that they need to do this for compatibility.  Even so, this is indicative of a flawed system and a company that does not have the resources to fix their software.  It does not immediately follow that it is vulnerable to SQL injection.  It is worth checking out, though.

It is written into the contracts we have with vendors that they allow a security assessment if we want to.

My advice is to ask them for documentation of their security assessments and if you are not satisfied, then tell them you need to do your own security assessment.  Unless they've hired an outside firm and have a complete report (longer than a page, say), and can show a history of assessments and improvements, then you probably shouldn't be satisfied.  Then you can hire someone to do it or do it yourself if you feel comfortable doing that.


Is adding encryption before hashing more secure? One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value.
Does encrypting the password || salt then hashing it make it more secure? Is it really necessary (or can I skip the encryption part)?

The general idea is that any secure process must be able to remain secure even if the process is known. In this scheme, you've just added a step: encryption.
But you have to accept that people will know that you've added encryption and what type. This means that you've only made the process of checking passwords just one step more difficult because there is that extra step.
This means that you've only made it a little more difficult to test passwords: hash(encrypt(password||salt))
Your better bet is to do what is suggested for best practice: multiple rounds of hashing.


MySQL Full Text Search Safety Is this code safe from sql injection?

$search = $_GET ['search'];
$query = $db->prepare("SELECT COUNT(*) AS num FROM table WHERE MATCH (id,keywords) AGAINST ('$search*' IN BOOLEAN MODE)");
$query->execute();

UPDATE:
According to answer below I changed my code and now it is:

$search = $_GET ['search'];
$tbl_name = 'my_table_name';

$query = $db->prepare("SELECT COUNT(*) AS num FROM $tbl_name WHERE MATCH (id,keywords) AGAINST (:search IN BOOLEAN MODE)");
$query->bindValue(':search', $search . '*', PDO::PARAM_STR);
$query->execute();

Thanks

The code is not safe against SQL injection because you neither use parameter binding nor you escape user input properly.

I recommend you to have a look at http://bobby-tables.com/ to get a better understanding of how SQL injection works and how to write code which is safe against SQL injection in the programming language of your choice.


Is the OData Protocol susceptible to Insecure Direct Object References? The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention (parameter &) to perform your query:

?productCode=14&date=20110101&$format=JSON

Let's suppose that this is the query to retrieve information related to a specific product in our repository. My point in that somebody could see this query format in a Web page and modify it to retrieve another product, even when it is not authorized to access it. This scenario can shows up when those OData Services are consumed using a Client Side approach like JQuery.

Does that make sense?

The key to Insecure Direct Object Reference is the insecure bit. While it's not always a great idea to use direct object references sometimes you just have to because thats the schema of the data and you can only use the schema of the data. OData is one of those cases. So here you are stuck with managing the insecure bit, and OData doesn't have any authentication or authorization mechanism built in. You have to build in the auth schemes.

So to answer your question, OData is only insecure as long as you haven't set up authn or authz for the particular objects.


TLS 1.3 Makes Security Tools Obsolete? I am a student and relative noob in IT security performing research for three reasons: school, my employer and personal curiosity, and I hoped maybe someone could answer a question for me.

In a video posted to YouTube by Akamai (https://www.youtube.com/watch?v=eW_A7tUuop4), the features and present direction of the proposed changes to the TLS protocol were discussed. While I am very much for the added security benefits that TLS 1.3 will add, I am also concerned as an interested party in critical infrastructure. There were three camps mentioned as being  represented in the implementation considerations of TLS 1.3 but the organisations who run critical infrastructure did not seem to be amongst them (except to say that the crypto warriors wish to obfuscate information from them). How or what is proposed for those of us who NEED to be monitoring network traffic in order to ensure our good intended employees aren't inadvertently bringing bad traffic into our networks, to continue to do our jobs effectively? As I understand it, our employee would still be able to travel to (lets say) Facebook and click away but the difference would be the inability for the network monitors to see if that link was from a malicious host... is this accurate (very simplistically to one degree or another)? Do you have any information or recommendations on how to handle this situation? There are some that I can think of but there are questions as to their ethical and legal ramifications... but this is all assuming I am interpreting the situation correctly.

To the best of my knowledge and extensive research on the web, I have been unable to locate discussions related to this topic. I found mention of it on one site where it read:

  There are security tradeoffs with encrypted communications, given that many of today's
  security tools can't perform their tasks if the network flows are encrypted. How do you reconcile that? (http://www.darkreading.com/perimeter/qanda-internet-encryption-as-the-new-normal/d/d-id/1317783)

Which was promptly blown off as an "We recognize that and will address it later" answer (and hasn't that been the problem with IT security to date? ... I digress). It could quite possibly be that I am not using the right search terms but so far the discussion has far been one of semantics (i.e. the price of encrypting SNI, version intolerance effects, Requiring OCSP for EV, etc.) as opposed to practical application from the security admin POV.

I don't see how TLS 1.3 should harm the current way TLS interception is done.

Currently TLS interception is done by having a man-in-the-middle proxy. Connections from client to server will be handled by this proxy the following way:

Create TLS connection between proxy and server.
Create a new server certificate (often just a clone of the original certificate) but sign it by the proxy CA.
Make a TLS handshake for the connection between client and proxy using the new certificate. Since the client trusts the proxy CA it will accept the new certificate. There are some limits when certificate pinning is used by the client, but browsers like Firefox and Chrome ignore pinning if the proxy CA was explicitly added to the system. Other clients like Dropbox simply fail.

With this setup the proxy can read and manipulate the traffic. This kind of setup will still work with TLS 1.3 because all it does is in effect to make two TLS connections out of one. And even if TLS 1.3 is not implemented by the intercepting proxy it will work in most cases because the TLS connection will then use TLS 1.2 or lower, same as it would do if a TLS 1.3 client talkes with a TLS 1.2 server or the other way. Only if client or server exclude all protocols except TLS 1.3 it will fail in this case.

If you think there are features in TLS 1.3 which make this typical TLS interception setup impossible than please point them out in your question.


Does ARP or DNS spoofing play a role when performing MITM in fake AP attacks? I have a test environment, where I try some wireless hacking tools and approaches, and lately I have been interested in evil twin attacks. I created a fake AP using airbase-ng, and specified the IP tables manually, at what point if the client connected had Internet access. Then, I fired the MITMf framework and ran it with the following command:

./mitmf.py -i at0 --spoof --hsts --arp --dns --gateway 192.168.0.1

Using this approach, I was able to get the credentials of the victim (myself in my test lab) from FB and GMail. It was redirecting the connection to some not secure subdomain, such as account.google.com instead of the original accounts.google.com.

On the other hand, I tried to use the MANA toolkit in order to create the fake AP automatically. It also comes with tools such as SSLStrip and dns2proxy (which MITMf uses too). But, once I ran the script that comes with MANA (start-nat-full.sh), it created a fake AP, and the connected client had Internet access, but if the client wanted to visit a website like FB or GMail, the page won't open at all.

I didn't spend time to go over the source code fully, but I believe one difference between them is that MITMf also offers DNS and ARP spoofing using the tool Spoof, which I used while running the attack. If I remove them, the attack doesn't succeed, while then it would open the secure version of FB or GMail.

Though, I don't exactly know whether this was the primary reason why it succeeded with one tool and not with the other one. If someone has had similar experiences I would like to hear. But, my question is, does ARP or DNS spoofing play role in doing MITM attacks (or bypassing HSTS)?

ARP Spoofing is mostly the basis of MitM Attacks. It is used to redirect the traffic initially. This is done by fooling the victim into beliving that your MAC address is associated to the routers IP address. This is called ARP-Spoofing or ARP-Cache poisoning.

DNS Spoofing is used to target specific sites. For example if you created a fake site that is looking like the one of a local bank you will then send fake answers for the associated domain to redirect the traffic to the site you controll instead of the original one.

Bypassing HSTS is done by manipulating the clients time setting. This can be done by manipulating the NTP traffic the client receives. There is a stand alone tool to do this called delorean. This will not work when the site is listed on the HSTS pre-load list.

I also had different experiences with different tools. For example arpspoof and bettercap did work great for me while ettercap did nothing but cause trouble.


IIS client certificates: do I need client certificates mappings? I created self-signed root certificate, ssl certificate and client certificate using makecert util. I created site in IIS, enabled settings "Require SSL" and "Require client certificate". This site uses my ssl certificate. Then I installed client certificate on client PC and it works fine without any client certificate mappings. When it's required to configure mappings and when it's not needed?

Under the mapping, you can map individual users to tokens which can then have permission to see things or do tasks (Admins, Personnel, Customers, etc). Without that you're just testing to see if a user has a valid certificate regardless of who he is.
You can authenticate the users further using mechanisms like form authentication but the mapping can automate this task for you.


How to store MFA secret I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and at the moment, that secret is being encrypted using the users password within a database field. We don't store the password itself but the hash of the password and use it to compare to the users submitted password at run time for comparison.

I'm now realizing that there's a flaw in this methodology and that's when the user forgets their password and requests a password change. At that point, we've no way of decrypting the users secret (using their old password) so that we can re-store the secret using the submitted new password.

I was wondering how others deal with this? To my mind we have the following choices:

We force the user to set up their mobile app again with a new secret
We encrypt the secret, not to the users password, but to another form using another encryption string

I guess that (1) is the easiest but not the best for the user - they'd have to remove their (former) account from the app before scanning a QR code (or equivalent) to set up a new account.

(2) I like the idea of, but wonder how we should go about that. I thought of perhaps taking a hash of the users email address and using that as the encryption string as we can programmatically restore everything without the users password, but not sure that's secure enough?

Can anyone give me some guidance here as to where to look for possible solutions?

I guess it all depends on your thread model and szenario. I am reading between the lines that you are afraid of what will happen if an attacker gets access to the table containing the 2FA secrets, for example by a leaked backup or SQL injection.

If this is the case, you can encrypt the secrets with a systemwide key, that is loaded into your application from some key vault. This decouples where the key is stored and where the encryped secrets are stored. But your application needs to have access to both.

If the key is derived from the user, there is always the danger that an attacker could do the same.

In my last project we decided to create dedicated MfaService, written in a different language and using a different datastorage compared to the rest of the Application. The service was written in a way that it can store the secret and check a code for validity, but never reveal the secrat again. The User Service only stored a reference to the MFA Credentials. Thus, an attacker would need to access both services, which was good enough for our usecase.


Network Adapter error on airgeddon I keep getting an error on airgeddon while using my Alfa AWUS036ACH network adapter (RTL8812AU chipset).

I can launch airgeddon successfully with all requisite tools installed, select my wlan0 network, put it into monitor mode then select the Evil Twin menu.

In the Evil Twin menu I select option 9.  Evil Twin AP attack with captive portal (monitor mode needed) but it gives me an error message of:

"The interface enabled you have already selected is not a wifi card. This attack needs a wifi card selected".

My interface is a wireless adapter (Alfa AWUS036ACH) which supports monitor mode and packet injection. Any ideas how to get around this?

Yeah, I can say that the problems you are experiencing are problems of the driver because they are printing a very different output on iwconfig commands than the rest of the drivers for the rest of the cards.

So, all the Realtek chipsets RTL88xx like yours (RTL8812AU) are having problems using airgeddon due this different output. Anyway, there are some workarounds:

Since the airgeddon v10.0 was released, there is a new awesome feature, a plugins system. Now users can develop their own custom stuff. More info here: airgeddon Plugins System. What is this useful for these kind of cards? because there is a plugin to handle that awful different behavior. You can find it here

So with the plugin, you can use safely that cards with airgeddon.

Anyway, check the list of the recommended and whitelisted cards: airgeddon Compatible Cards

For the next v10.01 airgeddon will have removed use of ifconfig and iwconfig commands (they are deprecated). Instead, ip and iw commands are used... so for v10.01 the plugin will be no needed.


Does having multiple email addresses increase security? With all the recent hacks and disclosures of email addresses that are happening recently,  I was curious if its a reasonable idea to have distinct email address for every  website which I have an account.  My reasoning is:

This would give some level of protection to my other accounts if my email was hacked by limited the number of other accounts that could be accessed using the reset password feature.
If I suddenly receive a spike in spam, (as has happened to me recently) I would have a better chance of figuring out where my email was compromised.

Are there any down sides to doing this?  Or am I overestimating the benefits from this approach? I am using strong passwords on all my website accounts and have two factor authentication on my current master email account.

Isolating resources is definitely a valid and widely used method of controlling security threats.

I can think of many scenarios where these benefits of isolation would apply to email addresses, including those you mentioned.

  Are there any down sides to doing this?

I don't think there's any real downsides, but I can think of a number of reasons it would be difficult for most people to derive the full security benefit of isolating their email addresses.

Firstly, you need to minimise dependencies between accounts as these weaken the isolation. For example, you'd have to avoid:

Using one account as a recovery email for another
Sharing passwords between accounts
Using the same domain across accounts (especially if it's your own domain)
Sharing an actual inbox (ie. destination for all your mail)

This creates many inconveniences:

It may take a lot of effort to setup many mail accounts, especially on email services you don't control (eg. gmail)
Having to check many inboxes
Having to maintain many sets of credentials
Having to constantly make decisions about which address to use in order to minimise risk

One common technique for people who own a domain is to have a catch-all rule that goes to a single inbox. That way they can invent an arbitrary email address every time they need one (eg. stackexchange@whatever.com) and if they get spam from a particular service they can easily block the unique address they used. This will help with the spam scenario you mentioned, but not if your account credentials are compromised seeing as all addresses will share an inbox and password.


Remembering email in login form After logging out Google remembers recently used email addresses in the login form so the user only needs to enter the password. See accounts.google.com.

How secure is it? What factors should I consider when implementing this in my own projects?

How secure is it?

If the username is already public information then I don't see a significant risk. An email address should be considered public information in most cases seeing as it must be known to anyone who wishes to use it.

  What issues can prevent me from using the same behavior in my own project?

Firstly, I feel in most cases this functionality is better delegated to the web browser. Most modern browsers have a feature to remember form data which the user can enable and disable as they choose.

If you do go ahead and implement it then you should be considerate of how sensitive the information is to threats such as an attacker having access to the client (eg. a shared machine) or physically seeing it while looking over the users shoulder.

These will be minor threats to most users but they will still exist for users on public devices, etc. so obviously you need to give them the option to disable it and avoid remembering anything that would significantly compromise your system if overseen this way.

One interesting case where you might want to implement your own "remember me" scheme is where it significantly conveniences the user to remember the value, but it would be too risky to let the users browser remember it and possibly display it in clear text.

In that case, you display an obfuscated value to the user but remember the true value without displaying it in the UI. You can then use an option such as autocomplete="off" or a randomised field name to prevent the browser from remembering it. This is commonly used by banks for randomly assigned usernames and account numbers which are at high risk of being overseen but aren't easy to remember.


Why are cross-domain POST requests allowed? I understand that best practice is to use tokens to prevent CSRF, but why do  browsers permit cross-site POST requests in the first place?  It seems like giving untrusted parties unfettered write access to your server is a bad idea.

The W3's site says that "Under the same-origin policy, cross-site sending of information is also dangerous since it enables attacks such as cross-site request forgery (CSRF) and clickjacking. The same-origin policy cannot address these security vulnerabilities in the same way it does those around receiving of information since prohibiting cross-site sending of information would prohibit cross-site hyperlinks." [1]

But this seems like a false dichotomy.  We could disallow cross-site POSTs while still allowing hyperlinks, which are GETs.

[1] https://www.w3.org/Security/wiki/Same_Origin_Policy

It seems like giving untrusted parties unfettered write access to your server is a bad idea.

I guess that would be true unless your entire business model depended on it:

https://disqus.com [comment on this]
http://Facebook.com [like this]
https://twitter.com [tweet this]
https://ads.google.com [support this]


What can hackers do with ability to read /etc/passwd? On the exploit websites I see security analysts and hackers targeting the /etc/passwd file when showing the proof of concept.

If you have a local file inclusion or path traversal vulnerability on your server, and hackers are able to access (view, read, but NOT edit) the /etc/passwd file, what are the repercussions of this? Aren't all passwords obfuscated in this file by design?

The only real repercussion is reconnaissance - the attacker can learn login names and gecos fields (which sometimes help guess passwords) from the /etc/passwd file.

One reason for this is that, 20 years ago or so, most Unix variants shifted from keeping hashed passwords in the /etc/passwd file and moved them to /etc/shadow.  The reason for this was that /etc/passwd needed to be world readable for tools like 'finger' and 'ident' to work.  Once passwords were segregated into /etc/shadow, that file was made readable only by root.

That said, /etc/passwd remains a popular 'flag' for security analysts and hackers because it's a traditional "hey, I got what I shouldn't" file.  If you can read that, you can read other things under /etc as well, some of which can be useful to an attacker.  But it's harder to test for (say) /etc/yum.conf if you don't know if yum's on the system; /etc/passwd is always there and is a reliable test of whether access worked.

Put differently, the implicit repercussion of getting /etc/passwd is that the attacker has circumvented controls and can get arbitrary readable files, which means "I win!"*

*No actual guarantee of win, express or implied


Securing application-application communication from devs and admin Scenario:
I have an application A which holds sensitive data.
I have an application B which needs to process the data.
A will provide a web-interface. B will make calls to get required data from A.

Requirement:
I would like to secure the system such that A transfers data only to actual instances of B. As far as possible I would like to prevent any human from being able to make a call to A, pretending to be B

Solutions Considered:
This question came closest to my needs:
How to make secure communication between servers
However, it involves storing some information on the client (shared secret, certificate, public/private key) either hardcoded or saved somewhere on the server. While this prevents external parties from attacking the system, admins or devs for service B will have access to these "secrets", and will be able to fake a call from B.

Question:
Is it at all possible to implement an application authentication scheme that even devs / admins cannot fake? I am open to solutions that involve procedural controls, separation of responsibilities and other techniques in conjunction with software / cryptographic controls

I have seen something similar to this done before, but there is a pretty massive downside: the only way you can guarantee it to work is by preventing all human access to the machine where B resides. It was accomplished like this:

System A is configured to only accept calls from System B. System B is a virtual machine image which contains only a single admin user, and on first boot a script runs which changes the admin password to a long random one using a cryptographically secure algorithm. At this point the only way to stop it is to shutdown the VM. Edits are made by changing the image and starting it up again.

This isn't a perfect solution, as an admin on the virtual machine's host could take a memory dump and possibly extract some of the "sensitive" data while it is being processed. (Thanks Philipp for pointing this out.)


Risk of removing the PIN from Bitlocker Microsoft's implementation of BitLocker for hard drive encryption/protection and integrity supports multiple ways to boot into the system. I will list 3:

TPM chip (those that support it) without Pre-Boot PIN,
TPM chip with the PIN, and lastly
Network unlock (basically no PIN but the second authentication is grabbing a key over the network).

In my understanding, there are trade offs with each of these.

No PIN = less security but it’s not a hassle to the user to type it in every time.
PIN = more security but more hassle.
Network unlock = more security and usability but requires management and infrastructure.

We are deciding which one to go with at my company. Management wants to remove the PIN because users are complaining that they have to type a PIN and then be presented to the login screen. I have informed management that requiring a pre-boot PIN stops the OS from loading the BitLocker encryption keys into memory before a valid PIN is entered (halts the boot process). If the PIN is removed, they will be vulnerable to side channel attacks. MS recommends the PIN for this reason. Network unlock turned them off because it requires infrastructure.

I said that if the hosts are not storing sensitive or confidential data and are backed up, removing the PIN is rather low risk because it requires a more advanced attacker (usually) and it's probably not worth it (yes, generalities are bad).

I have two questions.

Is risk a good way to approach this situation?
Does my reasoning make sense? I.e. No sensitive data, backed up, other controls, etc then OK to remove the PIN

Lastly I don't have much to stand on, our company is worried about compliance and encrypting hard drives meets that, even if you remove the PIN.

Is risk a good way to approach this situation?

Yes, a risk based approach is always a good idea. :)

  Does my reasoning make sense? I.e. No sensitive data, backed up, other controls, etc then OK to remove the PIN

Generally, using PINs vs not using PINs depends on your threat model and a few other factors/considerations.

Consider the external factors like the location and portability of the specific devices in question, as well as the physical security level of your company premises.

Laptops which will leave company premises have a different threat model than stationary desktops.

Laptops: once the device leaves company premises, it's basically out of your reach in case something happens to it. If it's stolen, it's gone and the thief can do pretty much anything with it. This is where pre-boot PINs come into play. They would prevent an attacker from even booting the device, severely limiting his attack surface.
Desktops: if your office premises are at least somehow secured (video surveillance, night guards, alarm systems, access control etc.) your desktops are much less at risk of being targeted by attackers. An attacker would first have to break into your office to access your clients. In that case, I'd say that pre-boot PINs are not that necessary because of the limited attack vectors. Just make sure to actually secure the desktops to their desks so no attacker can just walk away with some towers in their hands.

In short: laptops = higher risk = PIN necessary, desktops = lower risk = PIN not necessary (but advised).

All that being said, I think that enforcing your "No sensitive data on non-PIN clients" will be way harder to enforce and impelent than to educate your users and raise security awareness.

You already have a bad start, because users are actively complaining about security measures. This indicates that security awareness is not high enough in your company, especially when your users already have management on their side. If your users detest BitLocker PINs that much, chances are high that they will use very insecure PINs in case they are forced to continue using them, e.g. 123456 or 0101010101.

Find out why the users are complaining about PIN+Logon password and educate them and management on the benefits of pre-boot PINs on laptops, just make sure to leave the technical side out of the discussion - management and users won't understand your techno-babble. E.g. "If it's stolen, attackers cannot harm the company. And if the company is not harmed, your jobs are not at stake. You can do your part by keeping the company safe/secure", or something along those lines.

Since your company is compliance-driven, a clear policy for home office/laptop usage should have pre-boot PINs as a mandatory requirement in them from a risk perspective. If it's part of a policy, compliance will have to enforce it.

If your management still won't budge, remember that risk acceptance is also a valid risk treatment method (if it is documented in writing! With a risk owner, e.g. the manager in question, who will take the responsibility once something goes wrong.)


How does SSH client ensure that SSH server bears the private key, which is the pair of the public key in client's "known_hosts" file? An SSH client obviously authenticates an SSH server in some way. Because when the key of the server changes, the SSH client software gives us a loud warning about the key of the server being changed and this might be a MitM attack.

However, does the client do this authentication using a challenge? That is, does the SSH client encrypt a piece of randomly generated data using the server's public key, and expect that the server will be able to decrypt this using its private key and send back the decrypted data, in order to authenticate the server?

The Secure Shell (SSH) Transport Layer Protocol (RFC 4253) describes how server authentication is done. According to section 7 there is implicit and explicit server authentication. Implicit authentication requires a shared secret between client. Explicit authentication means that the "key exchange messages include a signature or other proof of the server's authenticity". This is the kind of server authentication one usually uses, i.e. where the server has a key pair, the public key is known to the client and it wants to verify that the target of the connection knows the matching private key.

How explicit authentication is included in the Diffie-Hellman key exchange is described in section 8. Essentially the server signs some data from the client using the servers private key to prove ownership of the key and the client validates this signature using the known public key. These client provided data include random data so replaying an older signature is impossible. For the much deeper details see the RFC itself.


Discovering a vulnerable service on a machine I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are:

port 25 tcp
port 111 tcp

For port 25, it is supposed to be running SMTP, however, I think that it is running another service other than SMTP since nmap and Metasploit auxiliary smtp scanner were not able to identify the SMTP service version. I tried also connecting manually using nc -nvv x.x.x.x 25 but got nothing, not even a single response or word !

For port 111 it was identified as

111/tcp open  rpcbind
|  rpcinfo:
|  100000 2-4     111/udp rpcbind
|  100024 1     57299/udp status
|  100000 2-4     111/tcp rpcbind
|_ 100024 1     46912/tcp status

I searched for public exploits for rpcbind and found nothing other than "DOS" exploit.Also tried the following command to see a clearer picture but nothing comes back !

attacker:~# rpcinfo -p x.x.x.x
program vers  proto  port
100000    4   tcp    111  portmapper
100000    3   tcp    111  portmapper
100000    2   tcp    111  portmapper
100000    4   udp    111  portmapper
100000    3   udp    111  portmapper
100000    2   udp    111  portmapper
100024    1   udp  57299  status
100024    1   tcp  46912  status

Any thoughts how to find a way in ? or a way to identify a service that is running on a non standard port like port 25 here?

Thanks guys for your help ! Stranegly I was able to identify what is running on that port just by opening this netcat connection "nc -nvv x.x.x.x 25" and waiting for a while without any interaction with the victim. After doing this, the banner popped up and it was running Sendmail.

It seems that it has been configured to slow the response to prevent automated scanners from identifying what is running on that port.