SQL Injection on POST JSON request I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and filters:

data=[{
   "params": {
     "dsreq": "{
         \"version\":1,
         \"type\":\"SQL\",
         \"limit\":500,
         \"aggregates\":[
             {\"expr\":\"user()\"}
         ],
         \"partitions\":[],
         \"filters\":[\" 1=1 --\"],
         \"having\":[],
         \"dataset_id\":3}"
         }
     }
   ]

This payload returns the following SQL statement:

SELECT 'portal' user() FROM active_tab tab_0 WHERE (TRUE) AND ((TA_0.grp_id) = 'sqlgrp1')

The aggregates key in JSON corresponds to the columns section of the SQL statement and the filters corresponds to the condition.

This does fetch some data from the DB, but it only returns data from my group. Notice how the where clause includes 'TRUE' (my 1=1 statement), but then the application appended parenthesis around it and an additional AND statement.
My goal is to get around that so I can get data from all groups. My group id is sqlgrp1.

How can I trick the filter to stop executing the WHERE clause after the TRUE condition or not even execute the WHERE clause at all? Where condition is added if filters key is left empty.

I'm really just reiterating what @YourCommonSense said in a comment, but anyway:

There's nothing here to suggest that there is an SQLi vulnerability.  I've built systems like this that operate very similarly: they have a very expressive JSON input that allows the client to have more-fine grained control over their query.  This can be advantageous because it gives the client more control without having to adjust the server for every single use-case.  This definitely doesn't mean that there is an SQLi vulnerability.  As a for instance, in my systems each API endpoint (in this case the dataset might be the equivalent) is explicitly tied to a table and additional server-side-specified conditions that are always added to the query.  Any additional filters passed up by the client are explicitly joined in with the AND operator while the OR operator cannot be used at all.  Further, all client side conditions are explicitly white-listed: the client is only allowed to filter by a pre-defined list of columns and specifying the operator is not allowed: only the search value can be specified (the column itself explicitly determines what operator is used in the actual query).  Finally everything is built into a query that uses prepared queries for the actual execution.  All of this makes it just about impossible to have an SQLi vulnerability, while still allowing the client more fine-grained control over the actual API results.  I mention this not to talk about my system, but because what I built looks almost exactly like what you have, and the results you show are exactly what you would see with my system as well.  In particular:

You seem to have concluded that the WHERE (true) part of that query is the result of your 1=1 injection.  This is most likely not the case.  Making a parser recognize the 1=1 condition and auto translate that to true would be a lot of work and makes no sense - something like 1=1 would only show up due to SQLi, so I can't imagine this would be the desired behavior of any system.  Best guess is that the (true) part is added automatically to the query in all cases to make it easier to build the query (you don't have to keep track of whether or not you already had a condition and therefore whether or not you have to put AND in front of the condition you are adding on) and b) MySQL will ignore it anyway when it builds the query plan, so it will have almost zero impact on performance.
The fact that your comment didn't show up in the final query suggests that the system has parsed your condition and completely rejected it.  Again, your condition is obviously being processed by the system and not just being added straight on the end (hence why your comment is not in the final query), and there would be no reason for a parser to recognize your comment and remove it - those only show up due to SQLi vulnerabilities, so any system smart enough to parse a comment and remove it should (theoretically) be smart enough to recognize the SQLi danger and reject the request all together.
The condition on grp_id is there even though you didn't specify it.  This is likely a sign that this particular API end point (or dataset_id?) automatically adds in conditions that you will not be able to remove.
It does look like you got user() in the select, but it's hard to tell what (if anything) the significance of that fact is.

So I would say that without more details there isn't much to go on, but this doesn't look especially vulnerable from here.


putting my password in a php file (phpmailer) I'm using phpmailer and to use it you have to set $mail->password

I worry that my password is going to be accessible by hackers. Do I need to do something to protect it? I could put the password in the class file which is in a certain directory. Would that be secure? If I password protect that directory would the php script be able to access it?

Please excuse my ignorance on the subject!

Passwords do not ever belong in source code, triply so for source code that is ever committed to a VCS. Anyone who has or has ever had access to the file has the password, including contractors, former employees, any VCS hosting service you use, etc.

The simple answer is, retrieve the value from a configuration file (that is not stored in your repository) or, better, from an environment variable.


Advice on selecting programming languages to concentrate on? (2nd year IT security student) I'm in the process of considering which programming languages I should devote the majority of my coding studies to. I'm a 2nd year CS student, majoring in IT security.

What I want to do/work with:

  Intelligence gathering
  Relational databases
  Virus design
  Snort network IPS

Current coding experience (what I'm going to keep):

  Java - intermediate
  HTML5 - intermediate
  SQL (MySQL, Oracle 11g) - basic
  BASH - basic

I'm going to need to learn (at least) one of the following languages in order to be successful in my field.

Languages to add (at least 1):

  Ruby (+Metasploit)
  C++ (virus design, low-level driver interaction, computationally intensive applications)
  Python (import ALL the things)

My dilemma: If I diversify too broadly, I won't be able to focus on, and improve in a specific niche. Does anyone have any advice as to how I should select a language?

What I'm considering + why

  I'm leaning towards Ruby because of Metasploit support, despite lower efficiency when compared to Python.

Any suggestions based on real-world experience? Should I focus on Ruby, Python, or C++? Both Ruby, and Python have been regarded as syntactically similar to Java which my degree is based around. I'm going to be studying C++ in two years as a component of my malicious code class.

Thanks,
Tyler

If you want to learn about virus design, you will need some knowledge of assembly -- preferably for at least two or three distinct architectures (x86 is already two architectures, with the 32-bit and 64-bit modes; add ARM, Mips or PowerPC to that and you'll be all set). C++ is nowhere near low-level enough for that.

If you know assembly, you can grasp how C works (and why it works that way), and at that point all other languages become easy. And then you understand that the specific programming language is an illusion; it is not very important for security -- the concepts are important. Programming languages are just a way to express these concepts. The more languages you know, the less you will be distracted by the peculiarities of any particular language.


Can storing a secret in the client be considered "good enough" security? I have spent the better part of 2 weeks looking at a solution to secure my game. It's a game for Android/iOS that has its own server/database.

So far, the only security I have is salt+hash passwords. But anyone can call my API.

So I wanted to change this, one solution I found that is very simple is to hash my query when calling my API using a secret that is stored in both the client and server. Of course this means if someone decompiles my app, they can access my API.

Worst case scenario, they can give themselves free premium version of my game ($4), and increase their own rank (which I would see, and just remove the user). I am okay with that, it would become a problem if they could do it for any user, but that should be impossible.

In my opinion the solution is okay for this threat model, if they want to go through all that trouble just to save $4, I'm okay with that.

Does anyone with more experience see a fault in my approach? If it is good enough, what is a good way to obfuscate the secret in my client?

Reference: Answer by speedplane Here

The key to such questions is to have a threat model.  In a threat model, you capture what capabilities your threat has and what they want to do.  You can then balance it against your costs.

It sounds like you've gone down that path correctly.  You've identified that the attacker may be willing to disassemble the code to get a shared secret.  You've identified the cost is $4 or the possibility that you have to spend a little work erasing a user account on your server.  The balance is up to you.

Consider that, in the case of console game DRM, embedding the secret is all they can do.  They have gotten pretty clever about it.  A famous case was Spiro the Dragon which had many elements of DRM in it.  Some were easy to spot and cracked immediately.  Others were more subtle.  Some would just set a flag somewhere that would get checked 3 levels later.  If the flag was set, the map would have no eggs (an essential item for advancing to the next level).

Spiro was eventually fully cracked.  When they finally did so, the crackers actually thanked the dev team for giving them such an interesting challenge.  The DRM was considered a complete success.  Why?  It took more than 2 months for the crackers to finally get all of the cracks in place.  For console games, most purchases of the game occur in the first 2 months, so the piracy community failed to negatively impact sales during that key period.


Unrestricted File Upload - Possible exploits During a penetration test (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file.

So I have tried to upload a php shell using a passthru or an exec command but I have received the famous response "Unable to fork..." because, as far as I understand, the folder where I upload the file has some kind of security protection avoiding commands' execution.

Nevertheless I have upload a .php file in order to read a sample file using fopen, fread, etc command and I have done it successfully.

So my question is:
what specific files could I read in order to grab sensitive informations of any kind? In other words: I can upload a php file that can display a content of a file, but I don't know what files should I look.

Ending question:
do you know other exploitation methods for the unrestricted file upload vulnerability if uploading a shell like above is not permitted?

The specific files I would go after would be:

php.ini
PHP pages

These are very likely to have credentials embedded for database access or will give you clues as to where to look next.

my.cnf

MySQL configuration file

web.config

There may be some useful settings in IIS that can be retrieved by reviewing this file.

machine.config

Same as web.config but at the machine level.

Cache files

There could be some interesting data in the temp folder.

Those are the ones I can think of - once you start digging in these files, other ideas will probably emerge.

  Ending question: do you know other exploitation methods for the unrestricted file upload vulnerability if uploading a shell like above is not permitted?

You could try to upload a file that will be executed on next reboot or put it in a location that an admin may accidentally run the file.
You could perform a DOS attack by exhausting the disk space on the box.


Reverse engineering sgx executable Could it be possible to reverse engineer an intel sgx application executable to get any meaning  text? If yes, how it is secure if a adversary say a system admin could see the details of it?

Yes you can decompile the executable. That isn't what SGX is designed to protect against. Short of encrypting code in a way that only the hardware holds the key to decrypt it you can always reverse engineer an executable.

What SGX gives you is protection against a running program being read or modified by another process / user. Don't forget the executable does not have to be present on persistent media once it has been loaded into memory. You can run an entire system in RAM only. If it were loaded into SGX enclaves it should be protected from the rest of the system.


Is php DOMDocument::loadXML completely secure? Our application is using loadXML extensively to recieve data(input) from the users.
Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using loadXML?
The XML files are limited in size and will be under 2MB.

Could someone potentially create an XML files with a malicious macro?

https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
https://www.owasp.org/index.php/Testing_for_XML_Injection_(OWASP-DV-008)

I read these links but I am not sure if we could safely rely on loadXML or not?
If not, what methods should we use to sanitize or validate an xml as safe?

for XXE please read:

http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution
http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html

i can confirm a similar attack worked on Java/Tomcat

And then there is a Billion Laugh - Attack ( i think this was what Bruno referred to)

http://en.wikipedia.org/wiki/Billion_laughs


Backdoor under Akismet wordpress plugin my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's files. I don't know what is it. Is is dangerous? Please let me know with as much as details you can help me. Thank in advance!

The hacker used a publicly available shell MulCiShell v0.2. It can be configured to perform a number of functions including brute forcing passwords, downloading your entire site and replicating itself. You could take a closer look at mshell.php to see what it does.

Edit:

From your log files:

He tried to access /etc/passwd which contain a list of system users. He was probably trying to switch to a user with additional privileges. He tried from line 66-278 of the log and failed, probably because the web server was not running as root.

In line 300, he tries to access your .htaccess file. Probably trying to modify it to allow execution of CGI scripts so he can access /etc/passwd

Line 406, he tries to crack your site's password. $arr is a variable declared in line 473 of mshell.php. I suppose he left the auth_url post parameter blank.

Line 518, tries to access .htaccess once again.

Line 1272, last ditch attempt by trying to exploit some buffer overflow in apache.

I don't think he managed to compromise the machine, he used a publicly available tool and didn't seem to know what he was doing. I doubt he covered his tracks as well. His IP 117.7.198.84 originates from a vietnam ISP and furthermore the referer for some requests is http://www.google.com.vn. Although he could have compromised a machine in vietnam and used it as a platform to attack your site.


VPN server in a router I am new to using and configuring VPNs. I was thinking of setting up my router as an OpenVPN server, but as I understand that is to connect form the outside to my network. However, I want a connection were I can connect to my router securely but also encrypt all the information from my router to my ISP. Is it possible to do this? Do I have to get a VPN service?

You can do it both ways, by initiating the OpenVPN connection:

from a host on your network or the router, to an OpenVPN server.
You need a server on Internet to connect to. This is a service you usually buy, but not necessarily - it can be a free one, a friend, etc. The traffic from this host (or all hosts if you connect from the router) will be secured, up to the OpenVPN exit point (= the server you connected to)
from a host on Internet, to a server you control (the router, or a server in your network).
You need to set up an OpenVPN server yourself or possibly use a functionality of your router if it has one (some ISPs provide this functionality on their boxes)


Is it OK to create a new SSL certificate before the old one expires? Over the past year I have created multiple SSL certificates that are all valid for a year. In a week or so, the first will expire. I thought it would be practical if all my certificates would have the same expiration date. That way, I know of one day I have to renew all certificates; it's easier to not make a mistake that way.

So, is it okay if I would now renew a certificate that is still valid for half a year or so?

Should I revoke the old one? My certificates were free (via StartSSL), but revocation isn't. As far as I know nobody got hold of the certificates, so do I really need revocation? Wouldn't it be sufficient to keep copies somewhere offline and not revoke the certificates?

Is it OK to create a new SSL certificate before the old one expires?

Yes. There is nothing to technically prevent you from doing this. And if you are large company, then you may want to do generally do this as an insurance against CA-failure. If for example your CA of choice is hacked and suddenly revokes all its certificates, then you can just deploy the other certificate (from another large CA) that you have lying around for just such an unlikely event. (For example if you are FaceBook, you may want something like this.)

So, is it okay if I would now renew a certificate that is still valid for half a year or so?

If you want to warn people not to use this certificate anymore, then you should pay for revocation.
Expiration is the implicit "Don't use this anymore"-rule. Revocation is the explicit "Don't use this anymore"-rule.
Example: If your server was hacked, then you should consider your certificate's private key stolen. Then anybody who afterwards still encounters the compromised certificate in the wild should be warned.
Otherwise (if you can also vouch for the safety of your offline archival) then you can just let the certificate expire.
UI override for expired. But not for revoked.
Expired certificate errors are displayed differently in browsers. For example Google Chrome will currently allow the user to manually override an expired certificate warning. But it will NOT allow override for an explicitly revoked certificate.


Compare fingerprints of gpg --verify for files download with / without TOR From my understanding, except we meet the creator of an archive in person and verify the primary key fingerprint, we can never be sure, that the archive we download is really created by the person we think it is.
Therefore gpg warns us that:

  gpg: WARNING: This key is not certified with a trusted signature!

  gpg:          There is no indication that the signature belongs to the owner.

In case of this warning it is recommended to verify the primary key fingerprint with the issuer of an archive. However this is very impractical. Alternatively, could we download an archive and its corresponding signatures over two separate channels, i.e. normal web and TOR and verify if the primary key fingerprint is the same? If it is the same could we assume that it has not been tampered?

This is not what "separate channels" means.
Separate channels refer to different ways of communication. By using Tor instead of directly connecting to the server, you still communicate via HTTP with the webserver in the backend and ask it to deliver a file to you.
Imagine if the file you are trying to download was modified by an attacker with access to the webserver. They could easily create their own signing key and sign the malicious file with the forged key. If you have no way of verifying the key with the author, or by using the "Web of Trust" approach of PGP, then you would not detect the forged key, since they key you received and they key the webserver displays are identical.
So what does "separate channels" mean?
A separate channel is any channel of communication where compromise of one thing would not affect the other. For example, a letter sent via the post can be intercepted, but it would not affect what is sent via HTTP or spoken via a phone call. All of these are separate channels, and they can be used to verify they validity of a key.
For example, if you had downloaded a malicious file and a forged key, then called the maintainers and asked if the key was correct, you would have seen the key was forged and the attack would likely have been identified. This is impractical in person, because nobody aside from people trying to prove a point would call up the maintainers of a project to ask for the thumbprint of their signing key.
How can I verify this in practice?
In practice, this becomes a bit more difficult. One way to do this is to obtain the key from a different source. By spreading the public key as much as possible, the attacker can never be sure if people would download the (forged) key from the compromised web server or a different source, which was not compromised.


Is traffic not encrypted given ERR_CERT_COMMON_NAME_INVALID? If I am shown ERR_CERT_COMMON_NAME_INVALID, and I can see that the domains do not match (cert for *.example.com but I am visiting https://foobar.com), do I understand correctly that someone packet sniffing will still see encrypted traffic?

I'm trying to make sure I understand the threat of accepting these incorrect SSL certs. As I see it, it would be possible that a MITM is reading the traffic (decrypt it, then encrypt it correctly to pass it to the https site?) But unlike http it would still be encrypted traffic to someone "outside" - yes?

It's been a long sleepless night so forgive the stupidity.

You are correct. When you get a certification name invalid error, the piece of TLS that you lose is the authentication component; knowing that you're talking to the server you think you're talking to.  The encryption component is not affected.  So, as you suspect, you may not be (or may be, it could just be a configuration issue) talking to the correct server/site, but the encryption between you and whoever it is you are talking to is intact.


Can a running kernel be protected by underlying rings, BIOS etc? I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME.
But are there known examples where stuff runs underneath the kernel and can be used to protect it or the OS in general?
Regarding ring -1/ hypervisor mode I found some examples but could not really find anything else.
I'm not thinking about SecureBoot et al but more about exploit protection of a running kernel.

Yes, with varying degrees of success. Of these, only the first two are commonly used in production:

RKP (Real-time Kernel Protection) from Samsung Knox, which blocks unauthorized access or modification to kernel code by userspace, and monitors sensitive credentials in the kernel.
KDP, a Microsoft technology using a set of hypervisor-based features called VBS.
Various experimental hypervisors based on BitVisor, such as SecVisor, with varying goals.
Cappsule by Quarkslab, which runs a CoW copy of the kernel for each spawned process.
McAfee DeepSAFE, a hypervisor that provides a tamper-resistant view of system events.
Co-processor-based integrity protection such as the experimental Copilot.
VBH, an experimental and out-of-tree Linux hardening patch similar to Microsoft's KDP.

I believe there was also some short-lived custom Intel ME module ("ring -3") which was designed for similar purposes, but I forget the name. SMM ("ring -2") could also theoretically be used for integrity, depending on what events can trigger a SMI (System Management Interrupt). Note that these are not "true" protection rings, as I explained in greater detail in another answer.


Analyze / Sniff all packets from all devices connected to a router First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment.

I'm trying to analyze / sniff all packets which are sent or received from any device connected to my router which is exposed to the Internet. I'm currently using Wireshark on Windows 10, yet after filtering the packets that are being logged, the only ones I can recognize are the ones that are sent/received from my device, not others (I have access to router connected devices IP and MAC addresses).
I did some basic googling and I found out that if I enable monitor mode, it's possible to analyze other devices packets, which I still can't after enabling it.

So my question remains, is it really possible to sniff all packets from all devices connected to a router using a sniffing software like Wireshark? Because from my point-of-view that it's not possible since I'm a "device" and not the "device manager".

Depending on your router or (switch) if it supports port mirroring, where you will be able to duplicate the packets transmitted through Mirrored Port to Mirroring Port. This function allow network administrator to capture packets of a specific port to monitor the network or troubleshoot. So you can mirror the port of your internet connection to your laptop.

If you don't have this function in your router or switch, then use the following solution for temporary sniffing/analyzing:

1) I connect my laptop to the internet using Ethernet cable,
2) then share internet using WiFi hotspot,
3) connect all device I want to analyze to the WiFi hotspot,
4) open up Wireshark on my laptop and listen to the Ethernet port.


Mapping of encrypted to decrypted blocks in LUKS Section 2.4 What is the difference between "plain" and LUKS format? of the cryptsetup Frequently Asked Questions says the primary advantage of plain dm-crypt (no LUKS) is:

  ...high resilience to damage, as one damaged encrypted sector results in exactly one damaged decrypted sector.

I'm thinking of using LUKS, but I've got FUD about the effects of a damaged encrypted sector in LUKS, as i couldn't find this specified in the FAQ.

If I keep a backup of my LUKS header, will there still be an exact 1:1 mapping between damaged encrypted and decrypted sectors when using LUKS?

LUKS is built on dm-crypt. The format of LUKS is basically a header that precedes the encrypted data (the actual data being shifted by an "offset" (see man cryptsetup) to allow the header to be stored in frot of the data. The data is still encrypted with dm-crypt and it is possible (assuming knowledge of the key) to open a LUKS volume using only plain mode commands.

So LUKS only offsets the data - it does not change how the data is encrypted.

What LUKS gives you is a way to store up to eight copies of the encryption key securely in a header, with each copy encrypted by another key derived from a user-given passphrase.

The added strength of LUKS is it generates the master key and can therefore ensure that the key is stronger than one provided by the end-user. Also, it employs "PBKDF2" to derive the keys used to encrypt the data key from the passphrase and "anti-forensic key splitting" to more securely store that encrypted key material.

Furthermore, you can "detach" the LUKS header (i.e don't store it with the data) in which case the above-mentioned "offset" would be zero.

To settle your FUD, if the LUKS header is corrupted or lost then you will lose the encryption key for the data and, consequently, your ability to access that data. The solution to this is to take a backup of the header.

If the corruption is in the data itself then there will, as you say, be an exact 1:1 mapping between damaged encrypted and decrypted sectors.


Is it a good idea to use the entire Unicode range to generate a random password rather than limited ranges? I know for a fact that some sites/apps with low security restrict passwords to alphanumeric characters only, and some allow a slightly broader ASCII range. Some sites/apps also support Unicode.

Passwords are usually meant to be typable on any generic keyboard, so they are typically generated using the commonly available characters. But for passwords which will only be kept digitally, would it be a good idea to maximize the guessing time by using the entire Unicode range of characters? Or are there reasons to believe some or most Unicode supporting sites/apps could still limit their allowed character range?

This sounds a lot like Fencepost Security.  Imagine you're running a facility that has chain-link fencing around it that is 500 feet high.  How much would the security improve by making that fencing 3,000 feet high?  None - because anyone trying to get in isn't going to climb the 500 feet; they're going to dig underneath, cut a hole, etc.

Likewise, you've got a password that's, say, 20 random alphanumeric characters.  That's 62^20 possibilities.  You're considering changing it to 20 random unicode characters.  Which raises the possibility space much higher, except brute-forcing a 20-character randomized password isn't how things are going to get compromised.


What does having an internal two-tier PKI protect against? There are a lot of Best Practice documents that recommend having an offline Root CA and an Enterprise Subordinate CA that is signed by the root, for an internal Microsoft AD Certificate Services infrastructure.

I don't understand why having an offline root is recommended here. In the event that your subordinate CA is compromised, you'll be reissuing everything in your domain anyway, since the only thing that your offline root signed is the subordinate's signing cert. I don't understand what value having an offline root adds to this equation.

What is there to gain from this two-tiered approach in this type of situation?

Not sure about the particular implementation in Active Directory, but in general X.509 signing it allows for much easier recovery from a compromise.

Its assumed that an on-line CA is much more vulnerable than an offline one. So, let's say your online CA is compromised, and its private key is potentially copied.

You revoke the CA certificate. You go ahead and generate a new keypair, certificate, etc—you have a new online CA now.

Your next step depends on if you have an offline CA or not:

If you have an offline CA, you use your offline CA to sign your new online CA certificate. Fairly easy. More secure, too, as its easy enough you'll probably actually do it.
If you do not have an offline CA, you go install your new root CA certificate on each and every client machine, phone, tablet,…. (Actually, you don't: you set up an offline CA, and install that instead. Because you learned not to repeat this mistake!) Less secure, because you're going to do your best to avoid this work. ("Are we really sure the private key was stolen?")

Finally, you sign new certificates for the servers, and install them (possibly including the CA chain).

So, in summary, if you have an offline CA, you only have to re-issue certificates for authenticating side (typically, only the server). If you don't, not only do that, you get to install your new root CA everywhere.


Can identification imply authentication in biometric systems? I know the difference between Identification and Authentication, which are basically claiming who you are and proving that claim. In terms of a system, they are username and password in general.

But what's about biometrics like brain wave? It is somehow the username plus password which can actually tell a system who you are and at the same time prove that you are who you are (assuming such biometrics are impossible to be stolen).

I am not concerning about the feasibility or appropriateness of such biometrics system. My question here is - can I argue that, such identification process also implies / includes (or whatever better term) authentication?

Not sure about whether it can be used as a standalone authentication system but it can be used as a part of multi-factor authentication system.

Reference:

More info:

Identification

Identification is nothing more than claiming you are somebody. You identify yourself when you speak to someone on the phone that you don’t know, and they ask you who they’re speaking to. When you say, “I’m Jason.”, you’ve just identified yourself.

In the information security world, this is analogous to entering a username. It’s not analogous to entering a password. Entering a password is a method for verifying that you are who you identified yourself as, and that’s the next one on our list.

Authentication

Authentication is how one proves that they are who they say they are. When you claim to be Jane Smith by logging into a computer system as “jsmith”, it’s most likely going to ask you for a password. You’ve claimed to be that person by entering the name into the username field (that’s the identification part), but now you have to prove that you are really that person. Most systems use a password for this, which is based on “something you know”, i.e. a secret between you and the system.

Another form of authentication is presenting something you have, such as a driver’s license, an RSA token, or a smart card. You can also authenticate via something you are. This is the foundation for biometrics. When you do this, you first identify yourself and then submit a thumb print, a retina scan, or another form of bio-based authentication.

Once you’ve successfully authenticated, you have now done two things: you’ve claimed to be someone, and you’ve proven that you are that person. The only thing that’s left is for the system to determine what you’re allowed to do.


Search for existence of sensitive substring without revealing substring in cleartext I have a list of very sensitive strings and I want to ensure that these strings do not exist in a set of documents (potentially very large documents).

However, these substrings are so sensitive that I don't want the third-party performing the search to ever see or have any access to my substrings in clear text.

The 3rd party in this context is a system that I operate but I do not have authority to have this sensitive data exist on this system in cleartext nor do I have authority to have the data on that system exist elsewhere (like pulling down to a laptop and searching for cleartext).

I just want a simple yes/no answer from the algorithm as to whether my substrings are found.

A very naive poorly performing solution is to provide the substrings as hashes and the third-party can hash all substrings of the documents to arrive at an answer.

Is there a better way, is there an algorithm designed for this purpose?

If your sensitive information is formatted in a particular way (e.g. credit cards being 13-19 digits) you can search for candidates which MAY be your sensitive string, then apply your hashing idea to the candidates.

If you're searching for a specific phrase, like "UFO's are real", you could use regex to search for any string matching "[A-Z]{3}'\w\s\w{3}\s\w{4}", provided it's acceptable to leak information about the length and structure of the phrase. You can then compare the hash of each result with the hash of the original to see if it's present.


What prevents this session hijacking from occurring? (SMB/CIFS example) SMB/CIFS (file sharing, Windows environment)

I understand when a client connects to a server there is a challenge/response system in place.  However, once the client is connected that "connection" is authenticated.  At this point, couldn't a man-in-the-middle(like) [or rather a network level] attack spoofing the connected session's IP and port submit arbitrary commands.

Does the server consider the "IP:port" authenticated, or is there more to it?

If the connection is unencrypted then nothing prevents this, just a lack of generic toolkit. Metasploit can handle it as can SMBRelay (never used the latter). But for example, the metasploit payload can intercept (relay) the authentication then run arbitrary code on the server.

http://pen-testing.sans.org/blog/pen-testing/2013/04/25/smb-relay-demystified-and-ntlmv2-pwnage-with-python

I may have misunderstood your question though. I'm not aware of anything that modifies the files on the fly but I dont see why it would be impossible.

Addtionally: Encryption will only help here if the server is signed, otherwise the user will not be aware if they are connecting to the correct server or the malicious one.


As a mobile carrier, how do you defend against mobile attacks like Stingrays? I would like to know what ways there are (if any) to defend against Stingrays and similar interception if you are a mobile carrier and have full control of the base stations and SIM cards?

Can a SIM card be programmed to not downgrade to weak protocols (GSM/2G) or ciphers, or is it purely up to the phone and the SIM has no say in whether the phone switches to a less secure protocol?

Yes, acceptance of a specific crypto suite is up to the SIM/USIM application on the UICC smart card that is colloquially called "SIM card" these days.

Note, however, that categorically disabling weaker ciphers might inhibit roaming. Also note that carriers do usually stand under the influence of law enforcement - there might be very subtle political reasons for them to leave certain things unfixed, especially when it means that they don't have to get involved in surveiling someone themselves.


Risk associate with nonce and hash found in url I have came across a url with nonce and hash in placed which is an account activation link sent via email. The example is as followed:

http://example.com/competition/?r=user/activateaccount&ldapemail=pstinee@inboxdesign.me&source=account_activation&nonce=57b7890ce159e3c0f17493712b2ef6acb6db7477660b2f05edff442bd3&action_url=/user/activateaccount/&return_url=http://google.com&page_url=/competition/activate/CP&DUCATI=403d530c54fd23f0ce5eb7c3e508b4a4dc362518f26b17c51d98a85b&hash=a35c09b2e89610453ec9ba0a3ad75d454b634bacfa402cf26a498477c31471707095c8f6652e1ad27f4099b59a7042d50044a388e6f0ee369b0f354854b1e5b9

I am wondering is the activation link above expose any risk?

As long as the domain name corresponds to the expected one and that there is no blatant XSS included in the URL, the risk will most likely not depend on the URL itself but how it is handled by the remote site.

The nonce and hash as requested in your question are common in registration email and, as long as they are properly generated, do not present any security risk.


Is an encrypted connection to MS-SQL Server really safe? Quick intro: Small company, VERY limited resources. I pretty much do everything including  coffee. I am a programmer, not a security guy. That's why I ask you...

We have an MS-SQL 2008 Database running on our server and several C# Applications that connect to the Database directly using a connection string like this

"Server=example.org; Database=SomeDatabase; User Id=dbUser; password=**secret**; Encrypt=YES"

The applications do not run on the server, so the Database instance is facing to the outer world. This setup is running great, but I have some concerns.

1) What does the Encrypt=YES exactly mean? Is the whole connection (including logon etc.) safe (assuming nobody gets hands on the connection string)? Or should I have serious concerns? What are these concerns (keywords appreciated)?

2) What is a good strategy to distribute the connection string?

To explain the second question: It is very comfortable to connect just directly. The distribution of the connection string could be replaced more easily than wrapping all calls to the database into another more secure channel...

"Encrypted connections" to SQL Server use SSL. That's about as good as you can get. Remember, though, that SSL protects only the connection, i.e. the data as it transits between the client and the SQL Server. It does nothing about how the data is stored on the server. It also does nothing about isolating connected clients from each other; that part is entirely up to SQL Server.

In the "connection string", the password is of course the sensitive part. Each client should have its own user account and password, so that in the event that one password is compromised (a likely event in the long run, unfortunately), you can reset that specific password, without impacting the other users. For password distribution, don't send it as cleartext over the Internet ! Which means: no email; if done Web-like, use HTTPS, not HTTP. In some contexts, it could be reasonable to exchange the password over a phone call.


Reflected XSS in a JavaScript URL with some characters blocked I am new to the field of Web Security and am practising labs from Portswigger Web Security Academy. In this lab, we have to call the alert function with 1337 as the parameter.

The solution given on the website is
https://your-lab-id.web-security-academy.net/post?postId=5&%27},x=x=%3E{throw/**/onerror=alert,1337},toString=x,window%2b%27%27,{x:%27

The decoded version for reference is
https://your-lab-id.web-security-academy.net/post?postId=5&'},x=x=>{throw/**/onerror=alert,1337},toString=x,window+'',{x:'

From what I understand, there is a JavaScript statement like
 var a = "get_parms" and we are trying to break out of the string, close the block and execute our own code.

x=x=>{throw/**/onerror=alert,1337} is the arrow function which assigns alert as global error handler and throws 1337.

toString=x, window+'' assigns x to toString and then forces a string conversion on window.
Now, I have two questions:

Why does this work only when I click the back to blog button, in spite of forcing the string conversion on window?
What is the use of the bolded characters in the URL (the & and the {x:')?

https://your-lab-id.web-security-academy.net/post?postId=5&'},x=x=>{throw/****/onerror=alert,1337},toString=x,window+'',{x:'

I have just completed this lab and have the same question as you do with regards to what is exactly happening around the JavaScript mentioned in your Question 1.

As per Question 2:

The & is simply a parameter separator since we are passing our user values via a GET request. This is esentially creating a new parameter named '},x with the rest of the XSS payload x=%3E{throw/**/onerror=alert,1337},toString=x,window+%27%27,{x:%27 as its value. This way the URL does not break, while the whole payload makes its way into the  anchor tag containing the vulnerable JavaScript URL.
The last part of the payload {x:' completes the remaining JavaScript code '}.finally... ensuring that our injected payload does not break it, but allows it to execute properly.


String Comparison Timing Attack in Plain English Could someone please tell me what a string comparison timing attack is in simple terms? I have Googled this, but all the explanations are very technical. Also, is this attack an better than a brute force attack? Please correct me if I am wrong, but I believe this attack is used to crack passwords.

When checking strings for equality you need to check that every character matches. Most programming languages will take a short-cut and return False - or Not Equal - as soon as they find a single character that doesn't match. For example,

str1 = "1111111111111111"
str2 = "1101111111111111"

You know that they are not equal as soon as you hit that 0, why would you keep checking?

This is super exploitable. Imagine that I'm trying to crack a password (or a hash, or a MAC tag, or anything that needs to be compared for equality), knowing that the server will do a lazy string comparison somewhere inside, I might get the following timing results (completely made up):

Tried "aaaaaaaa", it took 0.2 ms
Tried "bbbbbbbb", it took 0.2 ms
Tried "cccccccc", it took 0.4 ms

Cool, now I know that the first letter is 'c' because it took longer. Now I can do the same trick with "caaaaaaa", "cbbbbbbb", etc. Cracking one letter at a time is HUGELY faster than cracking the whole password at a time.

This "lazy" string comparison is generally a good thing for programmers because it makes things run faster, but it's bad for security. Secure string comparisons will check all the way to the end, even if it found a difference so that there's never a timing difference.


Allowing user to access password protected website without disclosing the password A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial institutions websites. Also she has a part-time employee who helps her with some routine tasks. My friend wants her employee to be able to download the clients' data without having to disclose her clients' login credentials.

Not unlike most of the commentators below I would also much prefer for everyone on the planet to have their own unique accounts for everything and never share. Unfortunately that is not the case. So please concentrate on the task at hand.

I am looking for a way to set up a local proxy server so it would automatically authorize the user's browser session at the remote web site with predefined credentials.

I need the credentials database to be stored on a server in the local network (not in the cloud and not on a user PC) so the solutions like various browser plugins would not work.
The configuration should support multiple accounts at the same web site.

Well the problem started with your friend's clients giving her their credentials rather than creating a new account on their portals for her... That's bad.

Putting that aside there is one way to get the employee in without disclosing the password. You could use this chrome extension:

https://chrome.google.com/webstore/detail/edit-this-cookie/fngmhnnpilhplaeedifhccceomclgfbg?hl=en

and transfer the authentication cookie from the logged in computer, to the other employee's computer.

All of this is really sketchy, and flaky though. Sketchy because you're breaking so many security best practices, and flaky because you're setting yourself up for failure.

Bottom line: You need to be able to trust your employees. Maybe she can get the employee to sign some paperwork to make it possible to prosecute the employee, should he try to use the access to cause damage.


Tor: same exact entry node since a week ago Since a few days ago, my copy of Tor (4.5.3) keeps using exactly the same entry node every single time I use it. I am pretty sure that that's not how it used to be in the past.

I feel a bit uncomfortable about it, so I wanted to ask for advice if it's just another security improvement that came with v4.5.3 or if I should do something about it?

The documentation states that it's normal for Tor to use only a few entry relays, and not just a single one. That's what made me suspicious: Tor has been showing me the same IP address for the entry relay for almost a week now.

Here's a bit more information on my situation: I am using Tor in a relatively small country with a population of less than 10 million people. According to Tor, the entry relay I have been using the past few days is also located in my country.

In the past, however, Tor mainly selected entry nodes located in adjacent countries (which are multiple times bigger in size and population and thus offer more nodes in general, I guess). I remember very rarely seeing Tor selecting any relays (be it entry, middle or exit) located in my country at all (as there are probably not many relays in my small country in general).

So all in all, I am not quite sure what to make of this recent change and how to react to it.

Before I start changing the default behaviour of Tor, I'd like to know why it's behaving like it is. Maybe Tor is only selecting that particular entry node, because all other entry nodes "in the vicinity" are compromised or something like that. Forcing Tor to select other entry nodes would be a bad choice in that case.

Do not panic, that is the normal behavior you could expect. It is designed that way. But why ? As mentioned in the documentation:

  choosing many random entries and exits gives the user no chance of
  escaping profiling by this kind of attacker. The solution is "entry guards":
  each Tor client selects a few relays at random to use as entry points,
  and uses only those relays for her first hop.

That is why Tor uses only  very few entry relays so that it protects you from using compromised ones.


Source code security We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS).

Management is very keen to set up a system that completely secures the source code, since we are working on project for a customer who demands the same, i.e. no code leakage.

We do let some people take laptops home over the weekend to work remotely, since that has made them very productive.

I have been asked to come up with recommendations on securing the environment, so that no source code leaks.

We have a central Subversion repository, which developers are using. We can consider new repositories, if needed.

Someone suggested using Virtual desktops for all users where all copy options are disabled, means you cannot copy files between different virtual desktops or to any removable disks. Even remote users can login to their Virtual Desktop using a VPN Connection.

Is this the best solution, or is there something better? We would like to use open source tools as much as possible.

If you're looking for top-notch security of the highest kind - air gapping is the only way to make this work. Unfortunately, having absolutely no connections to the outside world under any circumstances can be prohibitive, especially as developers like to copy and paste code snippets from documentation and so on.

Ultimately, this probably also means taking laptops off site becomes a no-go also.

Assuming you can't do that (because let's face it, it's quite an ask) - firstly, mobile workstations. Definitely go with the VPN option. Ensure all of the internet traffic via those laptops goes through the VPN. This way, your architecture and security requirements (firewall policies etc) are definitely enforced, and more importantly you don't expose anything but the VPN endpoint to the public internet.

Encrypt the laptop hard disks as a minimum. If the laptop is stolen whilst powered down, the source code should be secure for a reasonable amount of time. If the laptop is not powered down, or the attacker can observe the password entry, you haven't done anything but make their job slightly more difficult. LUKS is supported in both Ubuntu and CentOS to my knowledge - it uses cryptsetup and gives you a choice of decent algorithms and multi-slot passwords.

Hardware based disk encryption would be better, simply because it means your /boot partition is not modifiable.

Virtual LANs for security receive mixed opinions. From the point of view of development, I'm expecting your team work with sudo, or root, access and as such would easily be able to reconfigure the VM software to allow their host access, should they wish. As mentioned in the blog post, VMs are used for cheap network segregation - which works when you can enforce the configuration. Here, it looks like a difficult sell.

That's not to say you can't use virtual machines, of course; I would simply carefully study exactly how hard it is for your developers to bypass.

One way I've seen this work successfully if you have a sufficiently fast network and patient developers is to use remote desktop to VMs available on the network - but not physically accessible to the developers themselves. You can even use full thin clients, rather than desktops that RDP. The thin client model also deals nicely with my next topic... physical security.

When I say physical security, I mean how hard is it for your developers to plug a USB stick in, svn co and walk out with the lot? "Taking the code home" can happen this way, but you'll lose the lot if the USB stick is lost. Generally, there are two solutions available to you - epoxy resin and removing the various hci.ko modules from the kernel - thereby making it not recognise USB at all. Unfortunately, this has the downside of disabling USB keyboards and mice, too.


how long does it take to actually generate rainbow tables? I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept.

Anyway, I was wondering, has anyone been involved in actually generating one? How is it possibly done? I just don't see how it is actually possible to generate every combination of every character.

If we exclude special characters, there are these amount of characters.

ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
1234567890

That sounds like there is 26+26+10 = 62 characters

That means that a password of length 8 has 62^8 combinations.

which is equal to 218340105584896

That alone sounds like it would take ages to generate. What about when we increase the number of characters to 12 and add in the special characters (say there is another 10 of them just by look at looking at the characters that you get by pressing shift - number)?

We would get 72^12 = 19408409961765342806016

thats a number that's big enough to take years to get.

A rainbow table is "just" a compact representation of a table of precomputed hash values. During the construction of the rainbow table, many possible inputs are tried and hashed. Each input which has been encountered during table construction will be successfully attacked with that table, and none other. The hash evaluation concentrates most of the table building cost.

So, basically, the cost of building a rainbow table which can invert N passwords is roughly equivalent to the cost of trying those N passwords through the hash function -- the point of the rainbow table being that you build it once and then can use it to break several passwords. (To be precise, due to chain collisions during table construction, the cost is in fact closer to 1.7*N, but let's ignore that for the moment.)

I have once made some experiences with SHA-1. A simple password hash with SHA-1 has the cost of processing a single "block" (SHA-1, like MD5, processes data by 64-byte blocks), which needs about 900 32-bit logical-or-arithmetic operations. An optimized implementation on an Intel Core2 x86 processor can do that in about 500 clock cycles. However, password attacks (whether directly or for rainbow table construction, it does not matter) are a highly parallel job, so one could use the SSE2 instructions which offer 128-bit registers, and where a single opcode can perform four 32-bit operations simultaneously. SSE2 has less kinds of operations available (in particular, it does not offer rotations, only shifts), so the operation count rises to about 1200; but, under some conditions, the SSE2 unit will execute several opcodes simultaneously. So we end up with 800 clock cycles, for four SHA-1 instances in parallel. Bottom-line: my PC is an Intel Core2 Q6600, with four cores running at 2.4 GHz. Each core can run my SSE2 implementation, resulting in roughly 48 millions hashed passwords per second.

I also have a not-too-small Nvidia graphics card, and the GPU can run arbitrary code through CUDA. This is a 9800 GTX+, with 128 cores running at 1.84 GHz. Each core may execute one 32-bit operation per cycle (there is a high latency, but, thanks to the high parallelization, this one-instruction-per-cycle throughput can be maintained). The cores do not know about rotations, so each code will use 1200 clock cycles per hashed password. The total performance is 160 millions hashed passwords per second.

My PC and graphics card are from early 2009 and are not top-of-line. One can find nowadays, for a few hundred dollars, a GPU which will hash passwords about three times faster than my 9800 GTX+. So let's assume that an attacker with a common PC (which costs less than 1000$) can hash half a billion passwords per second.

At that speed, all passwords with 8 alphanumeric characters (uppercase and lowercase letters, and digits) are gone through in about 5 days. With a 1000$ PC. If you use MD5, things are about 30% faster (MD5 uses a bit less operations than SHA-1). Good password hashing schemes do not use a simple hash invocation, though: they use iterated hashing with, say, 2000 nested hash invocations: this multiplies cost for the attacker by the same 2000 factor (so it turns the "5 days" into about 28 years, literally "ages" as you put it).


Is it worth it to get paid anti-virus software? With the rise in cybercrime, I am slightly worried about my computer security.

I have been using open sourced anti-virus AVG for years and it has been doing well. Are anti-virus software like Norton and McAfee worth the money to get?

It would be good if there are reports that showed how much difference a paid versus free anti-virus software would make or showed which areas of security are covered by paid but not free and vice versa.

Whether an antivirus is free or not has almost no correlation with its quality. The theory is that when an antivirus is expensive, then the vendors have more money to spend on maintaining the antivirus, and, given the theoretical impossibility to reliably distinguish virus/malware from non-hostile code, an antivirus can be effective only if it is continuously tuned and augmented, on a daily basis.

The theory breaks down on two points:

That the paid vendor makes money does not mean that he wishes to spend it on making a good antivirus. The ultimate goal of any commercial venture is to make a profit, so the vendor will prefer, all other things being equal, to pocket the money rather than spending it on exhausting antivirus maintenance. In theory, market pressure should evict antivirus companies of poor quality; however, it is known that the software industry is full of de facto local monopolies because of technical details (switching from one software to another incurs a noticeable cost, so competition is not fully effective at lowering prices).
The free vendor may be sponsored. An example is Microsoft's Security Essentials: it is in the best interest of Microsoft that Windows users don't get bogged down by malware, so they fund the development and maintenance of a good antivirus that they then give for free (it is now included in Windows 8, which is why there is no separate "Windows 8" download).
Banks sometimes sponsor antivirus packages for their online banking customers, since it is in their interests to ensure the security of their customer's computer, as the bank may be liable for some or all of any losses.
Either way, maintaining an antivirus is labour intensive and security engineers must be paid somehow. Free things are not actually free to create.

It may be possible that any specific third-party non-free antivirus offers some extra functionality which, from your point of view, makes it worth the cost; however, if you don't see it by yourself, then chances are that a free antivirus will be fine for you. Potential distinguishing qualities include ease of deployment in large infrastructure, scalable email scanning on the mail server, and other business-oriented features which are usually not relevant for home users.


May I install more than one anti ransomware on the same pc? I installed Bitdefender anti ransomware free tool, but as I read:

  It is only good against CryptoWall and CTB-Locker.

So I'd like to install some others, but I wonder:

Is it recommendable to install more antiransomware tools* or this may cause any incompatibilities with each other?

*I'm not referring to the antivirus tools (I have one installed as well), just tools which provide the anti-ransomware feature only, e.g. CryptoMonitor, AntiRansomware, Bitdefender Anti-Ransomware, ecc.

The reason some vendors recommend that you don't install multiple antivirus/antimalware solutions is because some of these solutions contain signatures used to detect the malware.  In this case other solutions may incorrectly identify the antimalware solution as malware itself, and attack it.  Now you have the system attacking itself, which may lead to stability issues or a false sense of security where you believe you're protected, but you really aren't.  Nobody but the vendors themselves can say which program combinations will cause issues.  Unless you're willing to install all of them and test it yourself.

The best solution against randomware tools is to have recent, full backups of your system.


Malware Execution Delay I am new to malware analysis and am currently using Cuckoo to understand some of the basics.

I am trying to figure the time that the malware delays its initial executions. I found a functional call NtDelayExecution in the API/System calls that had two parameters: Status => Skipped and Milliseconds => 1000. The status of the function call reads SUCCESS.

What does the argument Status mean? Does it mean that the call was skipped? Because there are other calls to NtDelayExecution that do not have the argument Status.

Cuckoo is an automated sandbox meant for malware analysis. It skips the first N seconds of delay functions when a program starts.

NtDelayExecutiom is commonly used to prevent dynamic malware analysis, so it's skipped at program start to prevent the analysis from taking a prohibitively long time.

The function call output is letting you know it skipped a 1000 millisecond delay (1000ms = 1 second).


SSL Mutual authentication Fails When I try to establish a Mutual authentication between server and client, I am getting the errors below.

The timing between the server and client is exactly same and also the certs are proper in server and client. What is the cause for this error and what are the possible ways to occur this error?

  Thread-10, WRITE: TLSv1 Change Cipher Spec, length = 1
[Raw write]: length = 6
0000: 14 03 01 00 01 01                                  ......
*** Finished
verify_data:  { 130, 243, 38, 76, 253, 223, 88, 181, 223, 28, 110, 123 }
***
[write] MD5 and SHA1 hashes:  len = 16
0000: 14 00 00 0C 82 F3 26 4C   FD DF 58 B5 DF 1C 6E 7B  ......&L..X...n.
Padded plaintext before ENCRYPTION:  len = 48
0000: 14 00 00 0C 82 F3 26 4C   FD DF 58 B5 DF 1C 6E 7B  ......&L..X...n.
0010: F5 44 95 0D 5A D0 8E 6F   40 89 10 2D 00 5F BB CF  .D..Z..o@..-._..
0020: 30 D1 C6 06 0B 0B 0B 0B   0B 0B 0B 0B 0B 0B 0B 0B  0...............
Thread-8, WRITE: TLSv1 Handshake, length = 48
Thread-8, waiting for close_notify or alert: state 1
[Raw read]: length = 5
0000: 15 03 01 00 02                                     .....
[Raw read]: length = 2
0000: 02 2E                                              ..
Thread-8, READ: TLSv1 Alert, length = 2
Thread-8, RECV TLSv1 ALERT:  fatal, certificate_unknown
%% Invalidated:  [Session-4, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA]
Thread-8, called closeSocket()
Thread-8, Exception while waiting for close javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
Thread-8, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
Thread-8, called close()
Thread-8, called closeInternal(true)

Your help is much appreciated.

Well, you say:

  the certs are proper in server and client

But at least one of the systems disagrees:

Received fatal alert: certificate_unknown

This message means that one party (you don't say whether you are showing client-side or server-side logs) received an explicit alert message from the server, of class "fatal" and value 46 (0x2E, aka "certificate_unknown"). As specified in the TLS 1.0 standard:

certificate_unknown
    Some other (unspecified) issue arose in processing the
    certificate, rendering it unacceptable.

The "other" means that it is not a problem of the certificate being expired or revoked, or using an unsupported cryptographic algorithm. There can be many causes for a received certificate being "unacceptable", foremost of which being the impossibility of building a valid chain from an a priori known trusted root CA down to the certificate itself (normally, systems should send an "unknown_ca" alert in that case, but many do not have such precision in reporting errors with certificates).

To further investigate the issue, you should:

Activate full logging on both client and server. You show logs from the system who received the alert message; you should have a look at the logs from the other system, who sent the alert message;
Verify the configuration of both systems, in particular, for the one who sent the alert message (i.e. not the one which threw the "received fatal alert" exception, but the other one) what trust anchors it is using to validate the peer's certificate;
Check what certificate chains the systems are actually sending. Since this occurs before the encryption is activated, the certificates ought to be visible to some network monitoring tool à la Wireshark. Notably, check the order: in SSL/TLS, the end-entity certificate comes first, then the CA which issued it, then the CA which issued that CA, and so on.

Remember too that client certificates make sense only as authentication, not as authorization. Even if the client sends a certificate that the server can validate with regards to a trusted root, this only tells to the server who is at the other end of the line. It is still up to the server to decide whether that specific client should be allowed to proceed or not. This normally entails mapping the client certificate to an identity or a role, e.g. by extracting some specific field from the certificate. This process is completely outside of the scope of TLS itself, but must still occur, so there is some software and, crucially, some configuration on the server side that you probably wish to check.

In the other direction (validation of the server's certificate by the client), the rules are specified in RFC 2818, at least in the context of HTTPS: the intended server name (as extracted from the target URL) should appear in the server's certificate. Outside of HTTPS, it is up the each client application to decide whether the certificate they got from the server is the right one, i.e. that the certificate is valid (properly issued by a trusted CA and so on), but also that the identified server is indeed the one the client should be talking to. There again, configuration.


Horizontal vs vertical authentication bypass I'm wondering if someone could confirm my thinking on the following. Despite googling I haven't found a direct answer, although have seen horizontal vs vertical terminology in other sec contexts...

Note I'm using the terminology from bugcrowd.com's VRT

https://bugcrowd.com/vulnerability-rating-taxonomy

My thoughts are horizontal authentication bypass means elevating or changing your privileges after logging into an existing account, whilst vertical means bypassing authentication entirely.

Is this correct or have I missed something?

Cheers.

Found the answer:

https://cwe.mitre.org/data/definitions/639.html

  Horizontal escalation of privilege is possible (one user can
  view/modify information of another user).

  Vertical escalation of privilege is possible if the user-controlled
  key is actually a flag that indicates administrator status, allowing
  the attacker to gain administrative access.


About windows services and service control Manager I was doing some study on Windows services, when I came to know that when an account other than Local System is used to run service, the SCM automatically grants the account certain security privileges like SeServiceLogon right and SeTcbPrivlige, well I understand it needs service logon right but what is this TcbPrivilege rights? Why is it needed?

Further, if service is to interact with the desktop additional four privileges are granted like create token privilege, Assign primary token privilege etc.  Please explain why is it needed?

TL;TR

This privilege can be used to create and run processes under another user (including SYSTEM) given proper access tokens for that user.

SeTcbPrivilege

Windows Services are programs that run in the background to perform necessary operations for the operating system to function.  When you say, "when an account other than Local System is used to run service, the SCM automatically grants the account certain security privileges", it should be noted that services can only be started by the following three Service User Accounts:

System
Network Service
Local Service

This means that to run a Windows Service you must already have the privileges of one of those three "users".  System is essentially an Administrator, and the other two are fairly high level user groups.

From the MSDN:

  C++ constant: SE_TCB_NAME string: SeTcbPrivilege

  Scripting short name: Tcb

  Required to act as part of the operating system. The holder is part of the trusted computer base.

Services are extensions of the operating system, so it is not really surprising that the SCM gives this privilege by default to services.  The Trusted Computer Base Privilege allows access to hardware device drivers and/or software components that are considered to be the "base" of the computer's (i.e. operating system) security.

Another exerpt from Microsoft:

  Allows a process to authenticate like a user and thus gain access to
  the same resources as a user. Only low-level authentication services
  should require this privilege.

In other words this allows a process to impersonate a user.  This does mean that you can run things as SYSTEM.  I know impersonate sounds terrible, but there is a mechanism built-in to Windows to "impersonate users".  This is how Run as Administrator performs its duties.  However, to grant this privilege you must provide Administrator credentials in some way.  If malware is already to the point of being able to assign itself this permission/privilege, then you're already in a lot of trouble.

Access Tokens

Access Tokens are Windows way of allowing threads/processes/users to access certain portions of the operating system.  Security Tokens are passed to almost every lower level function used in Windows.  Because services are generally running at higher privileges, they are granted privileges for creating access tokens.  When interacting with the desktop, they're probably interacting with user level objects.  They will need to access, modify, and create tokens for this.

All of this behavior isn't out of the ordinary.  Services are low level programs with high system privileges.  The privileges that you mention are all standard privileges for services to have.  A lot of malware will try to impersonate, or use services to gain access to the system because of this.  See my answer here for a bit more information on that topic.


Could modded versions of Kik messenger pose a security threat to other Kik users? I was on the Kik messenger app, and someone in a group chat posted screenshots of his modded Kik app that contains an "IP grabber". He said he could hack people easily, and was very fast to tell me my own IP address. He was able to tell when anyone in the chatroom was lurking (i.e watching the chat without typing), for how long, their last activity, etc. I have no idea how, but he was able to know my IP address along with 2 other people in the chatroom. Prior to this, he had sent me a picture which I downloaded a week ago. He has not sent me any links, and I have certainly not clicked on any links from him. We had a few messages back and forth, but that's it. He said that he would hack me, so I logged out a few hours later. I used AVG antivirus and Kaspersky to scan my phone, and there were no issues detected. I manually checked my downloaded apps on Android, and there wasn't any downloaded app that was new. I have since then logged out of Kik, but I am concerned: could he be spying on my phone, and what can I do to prevent this?

There is no indication they were spying on you. All information they had was publicly available. Saying they know your IP address is like saying they know your phone number after you called them. I mean yeah, you'd have to have a phone with a display to know the callers number, but that's not exactly a hacking tool.

Your IP address is no secret. To the contrary, everybody you connect to on the internet has to know your IP address, otherwise you cannot send or receive anything.

So can a random guy who tells you they know the equivalent of your phone number really hack you? Nobody knows. But it seems unlikely. Just imagine you get threatened by someone telling you "I know your phone number". That's not a credible threat for anybody knowing anything about phones. Sounds like someone played you.


Threema: Are received messages exposed, when sender's private key gets compromised? Note: This question is specific to the Threema Messenger, and relates to their implementation of encryption (using the NaCl ECDH implementation as per their docs).

I refer specifically to their "note on outgoing messages" in their validation document on their website:

  It may seem strange that outgoing messages can be decrypted by
  entering the sender's private key and the recipient's public key, i.e.
  without knowing the recipient's private key. ...

Now, consider this scenario:

Alice has received a message from Bob, while Eve records/intercepts traffic as person-in-the-middle on the way to Alice.
Alice's public key of course is public, but Alice never disclosed the private key.
Eve somehow gets the private key of Bob.

With Bob's key and the traffic, could Eve now decrypt all content Bob has ever sent to Alice?

In other words, with Threema, is the privacy of received content dependent on the safety of the private key of the SENDER?

For a Diffie-Hellman key exchange the shared secret created will be the same if the same key pairs are used. This means that if Eve gets hold of a private key of either sender or receiver then they can compute the shared secret and decrypt all past and future messages between Alice and Bob. The common way to get around this problem is to use ephemeral keys so that the shared secret is only valid for that specific session.

For Theema however they've decided not to use ephemeral keys on the end-to-end encryption and instead only ensures forward secrecy on the transport layer as stated on their cryptography whitepaper. Their stated justification is:

  The risk of eavesdropping on any path through the Internet between the sender and the server, or be-tween the server and the recipient, is orders of magnitude greater than the risk of eavesdropping on the server itself

So to answer your question directly, for Theema's messages there is only forward security on the transport layer so IF an attacker has the encrypted message AND either the sender's or receipient's private key then they can decrypt it.


What are the benefits of enabling antivirus full scanning? If AV auto-scan will detect and prevent the malware from executing why there is a need to enable schedule/full scans?

I'm asking because a full scan can create sometimes overhead on the machine and network, so I'm trying to understand the advantages of enabling full scanning if auto-scan will provide AV protection when a file is used.

Terminology:

Auto-Protect-- Auto-Protect is the first line of defense against threats by providing real-time protection for your computer. Whenever you access, copy, save, move, open or close a file, Auto-Protect scans the file to ensure that a threat has not attached itself. By default, it loads when you start your computer to guard against threats and security risks. It also monitors your computer for any activity that might indicate the presence of a threat or security risk. Auto-Protect can determine a file's type even when a threat changes the file's extension.

Full Scan--WIll scan each file by starting with A to Z its not real-time.

It is extremely common for Anti Virus software to continuously update their scanning rules/parameters to allow the software to cast a wider net and detect the latest varieties of malware.

Usually, this update works hand-in-hand with the scheduled-full scan. Before a full scan happens, the software will check for updates then proceed to do the scan.

'Auto-Protect' basically just detects for malware with the current un-updated checklist. Hence with the full-scan + updates, it allows them to be sure that the latest malware is being hunted!


Offloading private key operations to a trusted device If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of programmable smart card that I can use to store my private keys and also the NaCl code that operates on them?

I've read about Java Cards, but it seems that the only way to put your own code onto them was through the now defunct MUSCLE project, so that doesn't seem to be a viable approach. I'd love to heard that I'm wrong about this though, as it otherwise seemed promising.

My goal is ultimately to have some degree of trusted encryption on my cell phone (a BlackBerry 10, but a solution that works for Android and iPhone would be ideal), so I'm not tied to smart cards exactly, but just the idea of offloading the private key part of the encryption onto a trusted device. If there's some way to load NaCl onto a tiny linux device and talk to that from my blackberry through NFC, that would work too. All suggestions are welcome.

These days, Java Cards have competition: .NET Cards. The main principle is the same: user-provided code runs in a virtual machine hosted by the card itself. Your main problem will be of performance.

An important part of why such programmable cards are believed to be "secure" relies on this VM: the applicative code cannot escape the VM boundaries; for instance, it won't have a buffer overflow or be able to read or write arbitrary bytes in RAM. This feature comes at a heavy price: all the applicative code is interpreted. A smart card is already quite underpowered (a good smart card may feature, say, a 50 MHz ARM-like CPU) but the interpretation implies an additional slowdown factor of 10x or 20x, meaning that any cryptography you would like to perform on such a system will be slow as Hell.

To cope with that, these smart cards include hardware accelerators, i.e. native code and dedicated circuitry to do some specific operations, usually RSA. So such a card can still compute a 2048-bit RSA signature in less than a second, a performance which is quite a feat, given the hardware. But you won't have an accelerator for a not-yet-mainstream curves like the ones in NaCl -- you usually don't have accelerator for any curve at all.

Smart cards try to achieve tamper resistance: a secret stored in such a card should remain secret, even if it is stolen and the thief tries to pry it open. This kind of security tends to come at a heavy price. It may also be quite overkill in your case.


Can linux (be made to) detect foreign connections to the ram bus? I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus.

Can linux inherently detect an attacker connecting to the ram bus in that way?

If not, is there any open source software with this capability?

This got cross-posted to electronics.stackexchange. The short answer is that it's not possible to detect all of this kind of hostile hardware attack in software.

If you had a probing device on the bus that actively requested memory reads, it would be possible to detect it by observing delays in memory reads. You'd have to specifically go looking for it by setting up an uncached read with timing measurements before and after, but you could detect it.

However, if I were building this sort of attack system I'd simply have a shadow dual port RAM connected to the same write lines, storing a copy of all memory access since bootup. I could then read from the copy without disrupting timing of the main memory access. It's not trivial to build such a thing - it requires careful attention to avoid disrupting the electrical signals to the RAM - but it's quite feasible against socketed or soldered DRAM. It's not feasible against internal RAM of a SoC, or stacked chip RAM such as in the Raspberry Pi.

(This is not to be confused with "cache snooping", which is a normal part of a multiprocessor system)

Edit in response to comment: it's not especially different on a multiprocessor system; on a NUMA system you need one snooping probe per memory bus. It's certainly something that requires a lot of effort and physical access, so it's mostly used for breaking into devices that you own such as games consoles and mobile phones. It's not something I'd expect to see in a datacenter; high-value target machines are likely to be locked away in tamper-alarmed cases to defend against this kind of thing.

(References? Does this SE have a Wikipedia-style ban on original research?)


Clamping the array index - is this a good idea for the Javascript Spectre mitigation? From the Spectre document I learned that the attack can be successful because the compiler generates a memory read instruction that refers to the invalid array index. And even though the instruction is normally only executed after checking the array index, accessing out-of-bounds elements produces undesirable side effects through the speculative execution in some CPUs.

javascript:

  x=array[index];

assembler pseudocode:

  MOV reg,index
  CMP reg,array[length]
  JNC fail
  MOV x,array[reg]
  ...access probe array based on x

What if the compiler was changed to never ever generate invalid addresses?

assembler pseudocode:

  MOV reg,index
  CMP reg,array[length]
  JNC fail
  AND reg,array[bit_mask] <---| bit mask of all 1's lower than
  MOV x,array[reg]            |  2*length (might be an object member)
  ...access probe array based on x

This way, for the price of an extra AND, the address used in the speculative read is limited to less then 2*length. Next, for all array buffers, let's always allocate 2N bytes (N >= log2(length)) and the attacker will be only able to probe its own unused memory (alternatively, arrange the memory allocations so that the only memory available for probing is their own other buffers).

Is this a good idea?

A similar approach was taken by WebKit developers, among other means, to mitigate possible effects of Spectre.

See: "What Spectre and Meltdown Mean For WebKit", paragraph "Index Masking".

Note that index masking is different from your proposal in that it doesn't require to allocate 2N bytes for each array (in worst case, almost twice as much as required), thus still exposing a (somewhat limited) portion of information to an attacker, but reducing the amount of data allowed for an attacker to read overall and saving some memory for the sake of effectiveness. For large arrays, they might put some faith in ASLR which makes it less likely there would be an allocation within index mask reachability.

Nevertheless, what exactly could be exposed to an attacker this way in WebKit depends on their architecture and code base; yours may be different.

Regarding the effectiveness of allocating almost twice the requested memory in worst case, it is worth mentioning that the ideal array growth rate is close to 1.6 and the growth factor of 2 is widely used but much less effective.

However, assuming Linux, there's probably a trick that could be used to reduce the amount of memory being lost while still being safe from speculative out-of-bounds reads. You can try writing a custom allocator that, for arrays at least larger than 2*page size (the latter is 4K under most circumstances, but more strictly, sysconf(SC_PAGE_SIZE)), will firstly parse /proc/self/maps to find an unmapped memory region of a size at least 2N bytes, N >= log2(array_length), and then map only the required size via mmap(MAP_FIXED).

Some subsequent work would be needed to ensure that no memory would be mapped within 2*length of any array allocated before, but this is still not a rocket science.

The memory pages allocated and returned to you will be consecutive in virtual memory, but are not required to be consecutive in physical memory, thus this approach wouldn't cause the physical memory fragmentation. The subsequent virtual memory fragmentation wouldn't probably be an issue on a 64-bit system any time soon, as 16 Exabytes of total addressable memory ought to be enough for anybody.

Other operating systems probably have tools similar to Linux's.

Regarding WebKit, as it also features other mitigations, which are, as of now, meant to be enough for the effects of Spectre themselves, index masking is rather excessive mitigation for them, and their approach is fine for their remaining threat model.

Your threat model, however, could be different. That's all we know.


Paypal has red lock by https? This is what paypal says when I log in near the top left near https://.
Is this ok?

The worrying part is that the page includes resources which are not secure. Since this does not happen for me I don't expect a fault by Paypal itself. This can also not be done by a man in the middle attack so I expect the problem inside the browser. I expect that you have a browser extension which causes this problems.

Such extension can be innocent and still cause such errors but it can also be harmful (i.e. man in the browser attack). Note that in the past seemingly innocent extensions turned to the bad site later. Such a browser extension has full access to the page and could modify it or just grab the data (password) you enter. Therefore I would recommend to disable any extensions you have (only reinstalling the browser will not necessarily help) and also to change your access credentials for Paypal before an attacker uses these.


Presentation on Web App Security (ACM Student Chapter) I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding measures). The talk will be presented at the students of our computer science department and will last around one hour of theory followed by a demo/hands-on module (around 1 hour as well).

I want to ask for your suggestions on which topics do you think I should cover and how to demo some of them. I'm inclined to present the "TOP10 list of web security issues" by OWASP, talk about them and use the resources from "OWASP's guide to building secure web apps" for countermeasures and suggestions.

For hands-on lab I'm thinking of using a intentionally vulnerable app like WebGoat or something related. What are your thoughts? Thanks.

The OWASP Top 10 is a great idea for content - although as you may see from my other posts, I always recommend a piece around business practicality, so if you can combine the talk with information on implementation and business risk I think it can make a very powerful presentation.

For example, incorporating information on how complex remediation for each of the OWASP top 10 is can be of high value (eg the code changes for reducing the risk of SQL injection attacks is relatively straightforward in coding frameworks which have input validation and output encoding modules)

You may think that that may be off-topic for technical folks, devs etc., but it will help them if they are in a position to understand business drivers (or blockers) for remediation work.


Do we need to have a private key on load balancer We have the following scenario -

2 Load balancers serving traffic from multiple web servers
We have installed SSL certificate with private key on the web servers

Now, my question is, if we need to renew the same certificate on load balancers, do I need to -

Only install the certificate (.cer/.der) on the load balancer
Install the certificate with private key on the load balancer

I am surprised when one of my colleague told me to do step 2. Why should I need to have the private key on the LB, when we already have that installed on the backend server?

Either you need to install both certificate and private key at the load balancer or none of these.

You need to install both if the load balancer should also to terminate the SSL connection. Such termination is for example done for performance reasons in which case the SSL connection is terminated at the load balancer and forwarded as plain to the final server. Given that you've installed certificate and key at the final server (which would not be needed if it gets only the plain traffic) this is probably not the case in your situation. But it might also be needed for the load balancer to make decision based on the application content, for example to make sure that all traffic with the same cookie always ends up at the same server. In this case the server needs to terminate the SSL traffic too in order to get access to the content and then might talk to the final server either in plain or re-encrypt the traffic using a new SSL connection.

If the load balancer is instead just balancing the traffic based on layer 3/4 information (i.e. source IP+port, destination IP+port) or if it balances based on the server_name extension (SNI) in the ClientHello of the TLS handshake then it does not need to decrypt the traffic which means that it needs neither the certificate nor the private key.


Host Protected Area (HPA) Imaging I'm a student in the Digital Forensics department. I have to create an image of the HPA of my disk. I searched whole documents about creating HPA image ways but all of them are old methods. For instance, The Sleuth Kit version 1.7.3 allows to create it but it was released in 2003 and the newest versions of TSK have no option to do that. I wonder that is there any way to create and investigate HPA part of my disk.

It can be done with native Linux commands but HDAT2 makes life much easier.

From their documentation:

HDAT2


Block a file from being accessed over the internet I keep my client data in a password protected Excel file.

For added security, I would like to block access to this file from potential hackers on the Internet.

Is it possible to block access to a file from the internet?

I can only see how to block a program with Windows Firewall, not an individual file.

The file is not going to be accessible over the Internet. There is nothing offering the file to remote people.

What can happen, though, is that someone can hack in and gain access to your computer, and from that level of access, gain access to any file on your computer.

The most important protection for this is to do exactly what you have done: encrypt and password protect the file.

As an additional measure, you could store the file on a removable drive and disconnect the drive when you do not need access to the file yourself. This is not as secure as it sounds because once you connect the drive, then anyone who has hacked into your computer could then also access the file. But it is an additional measure.


What are the risks of remoting in (RDP) to a compromised system? Can the client be harmed in any way, and how?

A true story

When I was in grad school the computer systems in our department were hacked.  It turned out it was hacked because a malicious attacker got a hold of the username/password for one of our users, connected in, and then managed privilege escalation from there.  Being young and naive I made a comment to my advisor along the lines of "Who can be stupid enough to share their username and password???".  My advisor quickly answered with: "Actually, that was me." (which obviously left me feeling like the idiot, and taught me a valuable lesson about not jumping to conclusions or running my mouth).  He then explained:

He had been visiting a different institution and connected to their systems.  He did not realize that their server was compromised (they didn't know it yet either).  He then ssh'd into his own account in our system, and in doing so the compromised system had no problems at all reading his username and password and sending it back to the attacker (the ssh client on their machine had been replaced with a malicious one).  They were then able to use that to get into our system and go to town on our servers.  All that to say:

The biggest risk of connecting to a compromised machine is that you must assume that absolutely everything you do will be recorded and sent off to the attackers.  Do not connect to any other systems from the compromised machine.  Do not connect to your email from the compromised machine.  Do not connect to any websites at all from the compromised machine, unless it is the sort of thing that you wouldn't mind posting publicly on the internet along with all of your access credentials.  Granted, this probably goes without saying, but I've found that sometimes leaving the obvious things unsaid comes back to bite you later.

Your actual question

Of course this isn't exactly what you were asking about.  Presuming you don't do anything important on the compromised machine, there is certainly still some risk involved in connecting to it.  I would expect the risk to be low as it (seems) unlikely that the compromised machine will be able to directly infect your machine.  It's certainly impossible to rule out a zero-day vulnerability that may allow the remote machine to take over the client, but it is probably a lot easier to spread over network connections then hacking backwards through the RDP protocol, so I doubt there are really many viruses/rootkits/etc. that actually do that.  There are other resources shared between client and server that you will have to watch out for.  Still, given how easy it is to setup a virtual machine, I would consider it a reasonable precaution to connect through one:

Spin up a virtual machine
Use the virtual machine to connect to the compromised RDP server
Trash the virtual machine afterward.

Your mileage will vary.  We all have different level of risks that we are willing to accept, and different levels of "inconvenience" we are willing to undergo to avoid those risks.  I don't keep up on the RDP scene (I'm a linux guy), but in a quick search I found plenty of RDP security vulnerabilities but none that appeared to allow the remote system to gain control over the client.  An additional layer of security might not hurt, but remember to never trust anything from the compromised machine or do anything of any value at all while there.


Is the Gmail activity log still missing activesync? Is the Gmail activity log still missing activesync as described in this blog post?
As it is "someone with my credentials could be reading and sending [email] messages with my account" without that access being reported via the log.

I did some testing, using my windows mobile phone & activesync. The Activity Log, indeed does not log anything, only when just receiving mails. But whenever you do some change that can lead to an update operation, then it logs this attempt.

Say for example I initiate a sync operation and 10 messages are downloaded on my mobile as soon as the activesync finishes - 7 I have already read on my PC and 3 new unread.
This sync operation does not get logged in the Activity Monitor.

If I read one of the already read mails, and then sync, again it is not logged.

But I read one of the unread mails, and thus change its state, the next sync operation is logged (with name "Mobile"). The same happens if I send a mail - the sync gets logged.

So to sum up, a clever attacker that has stolen credentials can read all the emails of a person, without being noticed, by manipulating the active sync queries so no updates are sent, or by changing the state of the mails back to unread after reading them.


How does preventing automatic download of pictures help to protect my privacy? When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email:

  "To help protect your privacy, Outlook prevented automatic download of
  some pictures in this message"

I am unsure how preventing the download of images in an email will protect my privacy.  Is this mainly so people who might be looking over my shoulder can't see the visual contents of my email?  Or is there a more technical reason; for example, to prevent the use of some kind of exploit in the image format itself (something like What is the corrupted image vulnerability? How does it work?)?

If it's the latter, why would the notice specifically mention privacy, as opposed to security?  I guess this last question could come down to "because the guy/girl who wrote the notice wrote 'privacy'", or even "because 'privacy' is one of those terms that the general public can relate to", but I'd be interested to know if there's more to it.

First it is important to understand what kind of images the client does not show. In your case, as the message states, these are images which would have been "download" ed. That means these are not images which are embedded in the email (multipart, etc.), but referenced (HTML img, etc.).

Now imagine what kind of information the sender could gain if your client downloads an image specified by the sender from a server specified by the sender.

Of course he would get: The exact time and, very important, the confirmation that you viewed the message at all. He could easily track you.

Who could want such information and what for? Spambots could verify that the address is valid and active in use. ...

How does it work practically?
Say you are viewing a HTML-Mail and it would contain something like this <img src="http://sendercontrolledserver/didviewmail.jpg?address=youremail@yourprovider" width="1" height="1" />. Your client does not know what happens on the server if it requests that image, the resouce delivered by the server doesn't need to be an image at all, how could the client know before loading it. You couldn't see it with that size, too.

These are your private personal information and exposure of them would be a privacy threat.