Distance between two passwords It is known that people reuse their passwords across different sites.
The reuse can be done in two ways:

using exactly same password for two different sites,
slight modifying the password of one site and using it on other. We call them similar passwords.

For case 1. comparing passwords directly reveals the password reuse.

For case 2. there is no clear measure as how to measure the distance between two strings. The most popular metric is Levenshtein or edit distance. For example the edit distance between "password" and "password1" is just 1 corresponding to the insertion of letter '1'

However, the Levenshtein distance doesn't always work well. For e.g, if the password of some site say x.com is "monday", and the password of site y.com is "wednesday", the edit distance would be 5. Assuming that the attacker knows the password of x.com i.e. "monday" and the positions where edits have been made for site y.com, atleast 26^5 variations of password monday should be attempted.

But conceptually "monday" is replaced by another weekday. There are 6 more weekdays other than "monday". So in this case, the intelligent attacker need to try just 6 different weekdays as opposed to 26^5 variations of "monday".

What should be the good way to measure the distance between two passwords?

There is no good way. What you say, is practically the measurement of the password distance in our mind. It is clearly impossible to have a direct method to do that.

Second thing, what you want to measure, depends heavily on the person, and contains often only for him known informations. For example, one of your collegues could use the name of its childs on the different company servers. It is not possible to build a software solution to find this, but some hacker / collegaues can have this information and use them to crack his account.

What you can do, were a step into the track of the NSA: although you can't spy peoples mind directly, you can use Big Data to emulate some very similar.

What you need: publicly available informations on the net. For example:

Thesaurus
Wikipedia (although there is no simple way to measure the link distance of two keywords, its database is simply downloadable and you can build a script to analyze its link connectivity).
Or simply you could do automatized google searches with the google search api, and get ratio of hits between the first, between the second password and between a dual query (for example, if the first password is "apple" and the second is "orange", then the Hits("apple")*Hits("orange")/Hits("apple", "orange")^2 had to be below an experimental limit set by you).

But beware: don't execute queries containing the passwords into an untrusted public cloud, it were a very serious security breach! Of course, it depends only on your viewpoints/considerations/responsibility, which public cloud is trusted for you. For me, none were.

In your place I did the following:

I get a wikipedia mirror (they have simple mysql database which is publicly downloadable)
Created a link distance map (it were very simple, although it were maybe big)
I created for the two passwords to compare to the their nearest wikipedia article title (it needed probably a massive levenshtein comparation, so you will need a lot of cpu)
Finally I used the following formula: D("pwd1", "pwd2") = Levensheiten("pwd1", Lev_nearest("pwd1")) + Wiki_Link_Distance(Lev_nearest("pwd1"), Lev_nearest("pwd2"))+ Levensheiten("pwd2", Lev_nearest("pwd2"))

Extension: wiki contains around of some 1million of text entries, which makes the shortest way search nearly impossible. You had surely implement this as a C++, and use very well optimized algorithms. Thus, it will be hard. As an alternative, you can do that you use from the wikipedia only the most common words (which can be found by getting their usage stats). Although the english wiki has around some million articles, a native english speaker knows only around some ten thousands from them.

Somebody should really write this, it were a wonderful opensource demon somewhere in the github :-)


Is IP whitelist sufficient to protect a server? I am currently using a server 1 managing incoming traffic from users and a server 2 managing database requests from server 2. Both servers are accesible via Internet. Would IP whitelisting be a sufficient measure of protection to prevent any traffic on server 2 other than incoming from an application running on a server 1?

If not, what are the risks?

IP spoofing only works for incoming, UDP traffic. If you need the return trip to work, network layer IP spoofing doesn't work any more.

While white-listing is a good defence in depth strategy and mitigates against many attack vectors, some attack vectors still remain, like MITM attack.

The traffic between the two servers can still be intercepted and modified (MITM attack). You need to use secure connections like SSL/TLS, IPsec, VPN, etc.


Should a session ID ever be sent over an unencrypted connection? I'm teaching myself a touch of the most basic information security while toying with web dev, so that I can get a better understanding of the whole picture.

Let's assume my website has user accounts that have nonzero personal information stored in them.

Is it ever appropriate to store session IDs associated with this connection over HTTP?

I ask beacuse I was looking through my own cookies and I see some of the ones under "google.com" are marked as "send over any connection"-- am I correct in assuming that these session IDs are not in any way linked to personal information that an attacker / sniffer could obtain or abuse?

In this question regarding Google's cookies and the HTTPonly flag:

  [Google] store the important stuff (for example, HSID, NID and SSID) as HTTPonly

Additionally, the SSIDcookie is marked with the Secure flag. This means that it won't be sent by the browser over a plain HTTP connection.

So to answer your question, if your Session ID allows access to personal information, you should set the Secure flag to ensure it is never leaked over plain HTTP. If not, an attacker could force a leak if their victim is browsing their website by including a plain HTTP reference in the page (e.g. <img src="http://example.com/foo" />) and then MITM the connection.

However, it may be acceptable for Session IDs that do not allow access to sensitive information. For example, you may set a cookie so you can let a user add items to their basket and then when they proceed to checkout the contents of the insecure session is transferred to the secure session which is over HTTPS only. An attacker can only intercept the insecure session and possibly add or change basket items, although as the site asks the user to confirm their order once contents have been transferred they cannot force the user to order something. Additionally, all personal details are protected as baskets are considered anonymous until the HTTPS checkout is reached.

I believe Google use non secure and non-http only cookies for items in a similar way. The SSID appears to be the important session identifier and this is protected by both flags.


User Credentials Android. Who can read the web traffic? Are User Credentials on Android such as "user key", "user certificate", and "CA certificate" only used to connect to a single specific network?

In other words, will the network admins be able to see my web traffic if i'm using cellular data and or a different WiFi network that doesn't use those certificates?

Are User Credentials on Android such as "user key", "user certificate", and "CA certificate" only used to connect to a single specific network?

A user certificate is used to authenticate a user against an HTTPS website and is totally agnostic of the network used to access this website.

A CA Certificate is used to ensure that the certificate provided by an HTTPS server has been signed by a legitimate authority and is also totally network-agnostic.

  In other words, will the network admins be able to see my web traffic if i'm using cellular data and or a different WiFi network that doesn't use those certificates?

As said previously, a CA certificate is used system-wide.

So let's say that:

Your boss requested you to install the CA certificate Toto.pem.
Your boss is able to run a MITM attack between your device (regardless the network used) and an HTTPS website you're visiting.

Then your boss just have to build a certificate for the website you're visiting and sign it with the CA certificate that he made you install on your device.
The connection will be reported as "secured" most of the time in basic HTTPS server setup. (exception are if more clever methods are used by the targeted website, such as HTTPS pinning, etc...)


Register an @yahoo.de email? Years ago I created an account and put my reset email as example@yahoo.de by mistake, it should have been @yahoo.com.
Recently, I tried to access my old account but could not remember the password. When I tried to reset my email it wanted example@yahoo.de, so I went onto the website but found out that Yahoo now only has .com domains, not country specific ones.
Are there perhaps any tricks or solutions to this?

The domain yahoo.de is controlled by whoever currently controls the Yahoo! brand. The mail server for this domain is also controlled by the same party. Any mails which should be delivered to this domain will check for the MX of the domain and use the given mail server to deliver the mail, no way around:
$ host -t mx yahoo.de
yahoo.de mail is handled by 10 mx-eu.mail.am0.yahoodns.net.

This owner of the domain explicitly states the policy regarding the domain name in the email addresses:

Most Yahoo accounts end in "@yahoo.com". The domain extension is the ".com" part. Some older accounts have a different extension depending on the location and language where they were created. You can no longer create accounts with Yahoo domains other than "@yahoo.com".
If you have a Yahoo ID with a different local domain, like "@yahoo.co.uk" or "@yahoo.fr", make sure you include the correct domain extension–the ".co.uk" or ".fr" part–when giving out your email address. If an email is sent to the wrong domain, it won't be delivered.

Thus, if this email was created in the past it might still work. But you will not be able to create a new email with this domain and you cannot use any tricks to somehow use such an email but deliver it to a different account, at least as long you don't control the system sending the mail (which you likely don't).


Use the same password on different (very secure) sites? I understand that one should not use the same password everywhere, as stated here for instance.

Using the same password on several non-valuable sites may be considered acceptable: we simply do not care if they get compromised.

My question is about sites that I consider (wrongly?) as "very secure". I think it is very unlikely that my password would get compromised on Google, Github or Twitter for example.

Is it ok to use the same password for all these "secure" sites?

If that matters, suppose the password is very strong (>90 bits of entropy).

Regardless of how secure any individual site/organization may or may not be the more places one uses the same password the more chances there are for unauthorized disclosure. A chain is only as strong as its weakest link.

Using unique passwords for each site isn't about the individual site's security. It's more about limiting your exposure should something happen to that password. Even if the sites themselves are perfect there are plenty of other ways passwords get compromised (key loggers, shoulder surfing, social engineering, ect...).

Yes maybe you use a password safe and are immune to all 3 of my examples but that's not the point. The point is that the more places that password is used the more possible exposure you open yourself up to. So the more places that same password was used the more places you have to change the password to and the more places you have to keep an eye on should your password be compromised.


Vulnerable link from Skype contact Last time I have got suspicious link from some of my Skype contacts. The link looks like:

  h**ps://www.google.com/url?sa=t&url=%68%74%74%70%3A%2F%2F%63%32%36%34%2E%72%75&usg=AFQjCNFczxOu-pqCubz7HJppKMWrNYbi5Q&id=[my-skype-account]

I have changed protocol part to * and remove my Skype account from link.

How does it works? And what do I need to do if I click on this link in my iPhone? I suspect that opening this link will infect me, but not sure that iOS is the target platform.

Update:

As I see this URL

redirect to option4life3.com site
use ip-api.com to get current location using my current IP
working with history API of the browser - I don't understand what it does exactly (here is a script: h**p://option4life3.com/media/bbo.js

Could be anything from referral stuff to password steal. %68%74%74%70%3A%2F%2F%63%32%36%34%2E%72%75" translate from hex as http://c264.ru .

From there, anything can run further (scripts, etc).


Address bar Spoofing The exploit explained by security researcher Rafay Baloch that using characters like '|' or unicode characters like U+FE70, U+0622, U+0623 could lead to reversing of the site url and leads to various types of web attacks. I tried on Firefox 49 on which it does not work. Is the browser already patched?

This was fixed in the Firefox 48 release, there is a security advisory on the Mozilla foundation's website. It seems that it only affects the Android version of the browser, so not only are you using a release that has been properly patched, but if you're using a desktop browser you would not have witnessed the vulnerability otherwise.

  Security researcher Rafay Baloch reported a mechanism to spoof the addressbar in Firefox for Android using right-to-left character sets when combined with left-to-right characters. This can be used to cause only certain portions of the loaded left-to-right character portion of the URL to be displayed, misleading users as to what site is loaded, possibly leading to phishing attacks.

  This vulnerability does not affect the desktop version of Firefox.

Link to source


Wifi pineapple "Karma" If a WiFi pineapple does a karma attack and a client connects to it, would you get the password (for the original WiFi) or would the client just connect to you? Is there anyway to stop it?

The client just connects to you. The Pineapple simulates an open wifi network, it can't simulate a password protected network. To get the password the Pineapple would require information to complete the handshake which is unknown to the device.


Security implications when setting the discard option in /etc/crypttab Setting the discard option in /etc/crypttab has security implications.

From the man page:

Allow discard requests to be passed through the encrypted block device.
This improves performance on SSD storage but has security implications.

Q: What are the security implications if this option is set?

A discard request, aka "TRIM", puts part of a solid-state drive into an "unused, ready to write" state.  An attacker can use this to figure out which parts of the drive are empty, something they couldn't figure out if those sections contained encrypted empty space.


What are the risks and effects of the feared "Killer USB stick"? A Russian security researcher known as "Dark Purple" has created a USB stick that contains an unusual payload.
It doesn't install malware or exploit a zero-day vulnerability. Instead, the customized USB stick sends 220 Volts (technically minus 220 Volts) through the signal lines of the USB interface, frying the hardware.

Source: https://www.grahamcluley.com/2015/10/usb-killer/ and original article (in Russian): https://habrahabr.ru/post/268421/. This short YouTube video demonstrates the attack, another YouTube video shows that the computer literally starts to burn..
The article from Graham Cluley ends with "Yet another reason not to plug a USB stick of unknown origin into one of your computers." and that seems legit to me.
I do wonder a few things about this:

Is there any way that you can protect against such attacks since a normal USB port will never be able to handle 220 Volts? Or is there any way to test if the USB stick is a normal USB stick of a "kill USB stick" before using it?
While this is only a physical attack and will probably destroy the whole motherboard. What other damage can this do? Will it destroy data on an (modern SSD) harddrive (or chip is Ultrabooks) or the memory? Will this cause any data loss at all and is this an availability risk only or also an integrity risk in case of data loss?

The risks and effects are that 220 volts of electricity toast your motherboard.

With that kind of voltage and (more importantly) current, assume that if this thing gets anywhere near your hardware everything is at risk. Especially if you have sparks jumping across boards or extreme heat. Granted, it isn't designed for destroying hardware other than the computer's motherboard, but the whole "how much more damage could it cause" question seems pretty ludicrous considering that no matter what, you're going to have a fried computer. And you don't want this thing anywhere near your hardware.

As far as protection against the attack goes? First and foremost, limit physical access to your machines and have policies in place designed to improve physical security. If you don't allow anyone to use a flash drive then it makes it a lot more difficult to nonchalantly plant a usb drive.

Of course, people are also people, and if someone sees a flash drive the first instinct will be to plug it in. It's a hardware attack, so it requires a hardware solution. Is this overkill/paranoia? Yes. But it is possible to protect against something like this. Consider something like a fuse in the computer that protects against large voltages/currents flooding through the USB port. Someone plugs in a drive they shouldn't and the fuse blows, not the motherboard.

Is it a solution? Yes. Is it necessary whatsoever in a personal or even corporate environment? No. Especially if you have offsite backups of your data if any drives are damaged, the attacker wouldn't really gain anything. Now, in a military setting or industrial plant like we saw with the Stuxnet virus: https://en.wikipedia.org/wiki/Stuxnet, this might be of concern. But again, physical security like guards, cameras, and locked doors would be the first step to protecting against any hardware based threat like this.


Using External Certificates on a network that doesn't permit outbound HTTP/S access Some highly secure networks and DMZs prevent all communication to outside hosts.  This can cause issues with validating externally signed data

I can guess that issues with signature validation occur when checking the certificates' CRL and OCSP data in many areas such as

Authenticode & signed Powershell objects
Authentication
S/MIME
Servers downloading and verifying patches, or signed AV updates
...?

How does one address the lack of external connectivity with regard to certificate revocation checking?

Revocation. OCSP and CRLs are pretty well irrelevant these days.  They are not very effective for security.  And if you can't reach the revocation authority, no problem, the browser happily ignores the network error and proceeds as if the certificates are unrevoked.  So inability to make outbound connections for OCSP or CRLs shouldn't pose a problem.

Updates.  The big one is downloading of updates (e.g., software updates, A/V updates).  I think you may want to add a whitelist to your firewall of allowed outbound connections, so that machines can still get their security updates.

For Windows updates, I think you want to allow access to TCP ports 80 and 443 on the following domains:

*.download.windowsupdate.com
*.windowsupdate.com
download.microsoft.com
ntservicepack.microsoft.com
windowsupdate.microsoft.com
*.windowsupdate.microsoft.com
wustat.windows.com
update.microsoft.com
*.update.microsoft.com
test.stats.update.microsoft.com

See also Firewall rule to allow access to windows updates or other resources on a CDN?.


Customer Email Hacked, Subject line "smtp-mail.outlook.com,587,," We've had someone break into our email mailbox - They have sent out spam to in an automated fashion. The only clues is that there is a sent email a few days before with a subject line of

"smtp-mail.outlook.com,587,," to Lm.semen@mail.ru

Would anyone know the attack/virus that would have caused this?

Any simple (even detected as legitimate) script can read the passwords stored by clients like Outlook and then login to your server and spam a lot until eventually external filters down-rep your server.

If the compromised account has administrative privileges on the server it's even more serious.


Is Adobe Flash Player installer redirect due to a malware? When I go to http://get.adobe.com/flashplayer/ 'Install Now' will redirect me to their homepage without downloading the update or any explanation.

What could be going on? Is some malware redirecting me?

(Running Mac 10.8.4 tried both Safari and FF)

Note: I have Ghostery and Adblock installed, tried disabling them. I do not think it's malware as no one seems to have the same symptoms after googling, and I would suspect a malicious redirect among other oddities.

I dont think this is any malware.
The Omniture tracker blocking in Ghostery will block Adobe Flash Player to terminate correctly (comment by anonymous user n° 34727, verified personally).
It does consider to track us more important than to perform a correct install.

Unfortunatly since many years and many versions of Adobe Flash Player installer, this is the way that this installer is behaving.
The core of the problem is that Flash installer is behaving as a typical malware:

you don't see which version you are installing;
you can't check if this is a valid installer;
you can't check if it is fixing any of your bugs;
you can't check if it risk to break something within your working environment.

Since all versions since many years have goten the same window look, it is too easy to make a fake one.
These are bad practice of course, since no user will be able to disambiguate a normal Flash Player installer from a real malware.
Personnal point of vue:
I consider this software as a basically risky one developped by a
company Adobe which doesn't care of customers, quality and security.


DSL Modem Compromised? Just found out that the primary & secondary DNS servers have been changed to 95.211.156.101 & 5.45.75.11.

I had the following setup in place.

  MAC filtering and WPA2 for WiFi.
  Administrator password was left at default. (Suspect this was the loophole exploited. Clickjacking I bet?)
  NAT & IPv4
  All the Services were turned off for WAN side, including ICMP.
  Only HTTP interface was turned-on for LAN side.
  Two other windows laptops connect to the modem via WiFi. Used by old parents and kids. Probably the easiest targets. Scanned for virus/trojan. Nothing found.

Would be helpful to know the steps I should  take to lock down the network from being compromised again. Also, what kind of data leak could have took place, besides the DNS names ? Are these IPs known to anyone ?

EDIT :

Modem : DSL-2750U

Firmware version : IN_1.10

Many DSL modems are open from the WAN side for use by the telecompanies (you can try telneting from the wan side and see if it's open on your modem, try default username/passwors [1]), while it could have been the ISP that changed the DNS-servers it seems unlikely as the IPs are not in the same range.

Like you said, the most likely intrusion vector is a simple cross site scripting attack. To guard against XSS is generally hard, usually there is not much a user can do other than keep the browser updated. Changing the password will of course fend off the majority of such attacks but still leaves you vulnerable while logged in to the modem.

Worst case scenario (probably(?) low likelihood) would be a change of the modem firmware, there would have been a downtime of a few minutes as the modem restarts. What you would be left with in terms of data leakage is anyones guess but the theoretical worst case would be a compromising of all network traffic that's not end to end encrypted with endpoint authentication (like SSL).

The change in DNS-servers in itself would have leaked all non cached domain name requests to the third party with the potential of the DNS owner to provid false DNS results. (Say for example giving the IP of fakebank.com when you requested the IP of mybank.com, or just giving you a the right site but with extra ads). This is a more likely scenario.

[1] http://internetcensus2012.bitbucket.org/paper.html


Does HSTS provide security advantages on private networks? For systems that only connect to the internet via a single dedicated private network (no WiFi hotspots), and assuming no systems or components on that network are compromised, does HSTS (HTTP Strict Transport Security) provide any security advantages?

and assuming no systems or components on that network are compromised

...and assuming that nobody who has access to the systems or the networks has any bad intentions and can be trusted with visibility of any data passing through the network....then no, it adds nothing.

But those are very big assumptions.


How to find a website behind a Firewall? Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher.

For my assignment, I received two IP addresses. I did a port scan with nmap and saw that both of these IP addresses pointed at SonicWall Firewalls.

The teacher said that these firewalls protect the website. When trying to gather information about these IP addresses, I only received information about the ISP.

For example, when I did a whois query to my target 179.96.___.___, I received information about "life.com.br". According to Google, they are an Enterprise Internet Provider.

I tried to gather more information about possible clients of this ISP, but I could not find anything. For instance, I tried to see the physical location of the IP addresses, but the result had not enough precision to give any meaningful information.

I tried to scan the entire IP range of the ISP (179.96.144.0/20) and saw lots of services, but my teacher said the other services have nothing to do with the assessment. Only the two IPs he has given us are relevant to the assessment.

I tried to make a reverse DNS lookup, but it's just a generic address of the ISP, which points back to the IP address (179-96-___-___.life.com.br).

What steps can I do now?

Penetration testing is done in multiple steps. From the information you have provided, you seem to have understood that the first step is information gathering.

However, you violated a core principle of ethical penetration testing: Never attack a system you don't own or have permission to attack!

Given that your teacher gave you two IP addresses to attack, it's safe to assume that the teacher either owns those systems or has permission to attack them. However, any address aside from those are out-of-scope of this assessment and have nothing to do with it.

Back to the scope: You claimed that you did an nmap scan of the websites, but you did not include the results of those scans. Here are some information you can provide:

Which ports are open?
Which services are behind those ports?
Which protocols are used by those services?

This is the essential information you want to gather. Depending on this information, you can proceed with your assignment. If you get stuck completely, contact your professor, explain to him the steps you have taken, why you have taken them, what you gathered from those steps and where you are stuck now.

Good luck on your assignment!


Is there a way to use clear key encryption for protecting media HTML5 media streams? I am trying to understand EME with Clear Key encryption.  I am using MP4Box. From the documentation here, you specify decryption keys in an XML file that is used to encrypt/decrypt your mp4 files.
https://gpac.wp.mines-telecom.fr/mp4box/encryption/common-encryption/

Basically, is there any point to EME with clear key encryption and is it possible to use this to protect content?

From my understanding, the encryption keys you specify in this XML, are the keys the clients need to use on the front end to decrypt the HTML5 audio/video streams. This means, at any time, the user could use a browser's dev tools to get the keys.

I suppose I could obfuscate the keys somehow, but anyone with determination would still be able to get the keys.

The other thing I could possibly do, is combine this with stream links that expire, but that also wouldn't project the keys.

I think you could also re-encrypt the media periodically, or encrypt the file multiple times with different keys, but that doesn't seem like it would scale well. Having a 1 time use key for each playback would be nice, but again, probably horribly inefficient.

Here is an example of an XML config for specific encryption keys:

<?xml version="1.0" encoding="UTF-8"?>
<GPACDRM type="CENC AES-CTR">
<!-- example for GPAC 'clear' DRM System - keys are listed after the     content and UL follows -->
<DRMInfo type="pssh" version="1" cypherOffset="9"    cypherKey="0x6770616363656E6364726D746F6F6C31"  cypherIV="0x00000000000000000000000000000001">
<BS ID128="6770616363656E6364726D746F6F6C31"/>
<BS value="2" bits="32"/>
<BS ID128="0x279926496a7f5d25da69f2b3b2799a7f"/>
<BS ID128="0x676cb88f302d10227992649885984045"/>
<BS bits="8" string="CID=Toto"/>
<BS ID128="0xccc0f2b3b279926496a7f5d25da692f6"/>
<BS ID128="0xccc0f2b3b279926496a7f5d25da692d6"/>
</DRMInfo>
<CrypTrack trackID="1" IsEncrypted="1" IV_size="16"  first_IV="0x0a610676cb88f302d10ac8bc66e039ed" saiSavedBox="senc">
<key KID="0x279926496a7f5d25da69f2b3b2799a7f" value="0xccc0f2b3b279926496a7f5d25da692f6"/>
<key KID="0x676cb88f302d10227992649885984045" value="0xccc0f2b3b279926496a7f5d25da692d6"/>
</CrypTrack>
</GPACDRM>

The point of EME with clear key encryption is to provide an easier to implement encryption for content that is slightly more difficult to steal and share. If you really need to protect your content, DRM is currently the strongest solution, ignoring the scenario of not sharing the content in the first place.

On the easy to implement and easy to bypass end is putting a single non-rotating key in the master manifest and trying to control access to the manifest. Once a user gains access to the master manifest it's all in plain sight and can be shared openly with others.

On the harder to implement and harder to bypass end is using short duration key rotation on each segment and utilizing short-lived signed URLs. This means a user has to deal with different keys for different segments and downloading the different segments with valid keys in a timely manner. A user could still pull all the pieces together to steal and share the content but it is no longer just a copy and paste away.

THEOplayer has a slightly more detailed post on the things that I have mentioned here if it's still up and you are interested https://www.theoplayer.com/blog/content-protection-for-hls-with-aes-128-encryption


How can mom monitor my internet history from a distance? This might sound like a funny question from a twelve-year-old. The less funny part is that I am 21 and currently studying at university (I don't live at University, although I am 15 minutes away. I do not use university network). You might or mightn't believe me, but I have more than enough information to know surefire that both Mom and the university are spying on me from a distance.

I know this sounds really paranoid, but let's not discuss it and instead assume that what I say is true. I am wondering in what ways it could be possible, and how I could counter it. Some information about my situation:

Mom pays for the internet.
Mom lives about 500 miles away.
Mom comes every week-end, but cannot physically access my computer (I am always at home, I would know if she did)
Mom is incredibly computer-illiterate, but I believe she gets help from people at my uni, as I am sure some of them know more than they should about me.

My first thoughts were:

My ISP: she might be calling my (her ...) ISP for internet history. I don't know if it is common practice, but it is theoretically plausible. After all, they can monitor my internet traffic, and since mom pays for the internet, she has legal rights to access history.
I don't really know if there is a way to counter it. Would using Tor work against it?
Wi-Fi and neighbors: she might have gotten the Wi-Fi key and sent it to neighbors, relaying information to her. However, I rarely, if ever, use Wi-Fi. I am directly connected by cable. It is on though, so I don't know if they can still access my computer.
If that's the case, can I just disable Wi-Fi and just use cable internet? Is there another way to counter it?
(Unlikely, but still): a trojan has been installed on my computer. However, Kaspersky doesn't tell me that anything is wrong. So I can't do anything about it if I don't find it. That probably won't happen because it most likely doesn't exist, and if it does, it is definitely well-hidden.

Would Tor solve this problem? Is it all I need? I'd really like to find an alternative solution, since using it for a long time would make me become suspicious even to the eyes of people other than mom.

@Matthew Peters: By spying, I mean virtually everything I look up. I don't download much. For example, she might know what youtube videos I watch, or what Wikipedia article I read, basically anything, whether HTTPS or not.

Be careful about assuming too much. You say that you know "surefire" that your university is spying on you, but your only evidence is that your mom is computer illiterate and you're "sure some of them know more than they should" about you (WARNING - this is a red flag for those of us not in your situation, you do indeed sound extremely paranoid).

If you don't use the university network (which seems unusual when you're on campus with your computer, but I'll take it as given), then your university has no interest in your browsing history, full stop.  If someone there in some way helped her get access to your activity, they could go to jail.

You wonder if your mom has conscripted your neighbors into her spying scheme (another red flag).  Unless your neighbors are the absolute pinnacle of unscrupulous busybodies, they have no interest in your browsing history - they could also go to jail.

Very few people could legally help your mother to spy on you, and no one is interested in breaking the law to spy on you.

The ISP could theoretically provide her some of your browsing history:

If they offer some sort of network monitoring service for child safety, then they would provide her whatever they offered to provide her, but it's highly unlikely that such a service actually keeps records, and more likely that it is meant to just block content - if you're not being blocked, such a system wouldn't care what you're doing.
If you fall afoul of the DMCA by downloading copyrighted content and the copyright holder both discovers you and sends a notice to your ISP, that notice would be forwarded to your mother as the ISP account holder.

... ISPs are big, they have a lot of customers, and storing browsing history takes up a lot of space they for information they don't want to be legally liable for (e.g. if they record browsing history, they can be subpoena'd for it), so it's unlikely that they could provide this information to your mother.

That's assumption 1.

You then say that she knows what you browse whether you access it over HTTPS or not.  This categorically rules out any sort of "from a distance" spying - once your request leaves your browser, no one knows what that request is until it reaches the server it's going to.

What this means practically is that if you use HTTPS URLs, someone (theoretically) could know that you went to YouTube, but they couldn't know what you watched.  They could know you went to Wikipedia, but not which articles you read.

If someone is capable of breaking HTTPS encryption, that person has far more lucrative opportunities than helping mothers spy on their sons.

Even if you're mistaken and only HTTP URLs are affected, it still requires someone to basically perform an illegal wiretap to access that information because, as we've determined above, no one who has direct access to your browsing history is interested in keeping it or showing it to anyone.

Which leaves us with what is by far the most likely scenario:
There are oodles and oodles of spyware programs out there that have varying degrees of legitimacy - as others have said, many are marketed as tools to give parents just this level of access.  Your mother could have found such a tool by typing full sentences into Google easily enough, and they're probably one-click installers just for people like her.  Have you confirmed that there is no hardware device like a keylogger installed on your machine?  All of these methods get at your history the moment it's created, before it has a chance to be encrypted or go over the wire.  They are also the most legally defensible ways for someone to view your browsing history.

A big honorable mention goes to the person in the other answer or comment that suggested that if you have a browser profile logged in on a computer that your mother has at her house, then she can view your ongoing internet history as if it were her own.  Simplest fix would be to browse in in-cognito mode (or equivalent for your browser if not Chrome), it won't record your history.

As for what to do about all of this, I'm going to go the tough love route:

Talk to your mother.  Tell her to back off, or if she won't tell her she's welcome to view your history but it won't change what you look at.  You're a big boy, act like it.
Pay for your own ISP.  As I've stated I don't believe this avenue is being exploited to see your information, but if she's paying for your service and using that as a justification to spy on you, then it's time to take the next step to separate yourself from reliance on her.
Reformat your computer.  If there's any concern that something is installed that you can't find, just backup your important documents, erase the thing and start over.  Don't put a bandaid on a bullet hole by using ways to hide your traffic from spyware.
This one I'm just throwing out there to see if it sticks, if it doesn't describe your scenario then sorry, I'm mostly keying in on the above mentioned red flags: if you're off your meds, get back on them.


attack/abuse notification email template I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.

Are there examples of templates used for this purpose that have been well designed or vetted or which otherwise reflect what is advisable/inadvisable to include in these notifications?

Put another way:

What information should be included in such a notification
What information should not be included in such a notification

It should contain all the necessary information about the attack and what action you would like them to take. Some key information would include:

IP address of the host performing the attack
The type of attack or activity coming from that host
The details of your server(s)

This could include the IP address/es of the server/s being attacked

Ask them to investigate the incident and report back to you
If the attack was damaging then tell them how it has affected you

They may take some time to respond to you so just be patient.


Do heuristics exist for modeling the "harmlessness" of a file? There's a file processing service that looks for some know attacks and sometimes returns messages like:

  Probably harmless! There are strong indicators suggesting that this
  file is safe to use.

Are there heuristics that model the likelihood that a file is harmless, and if so, what is a simple example of such a heuristic, and what is the best way to learn more about the topic in general?

Likely heuristics are:

File is a valid file of a known type (eg. a JPEG that falls within a strict reading of the JPEG spec).
File does not contain any extraneous data (eg. JPEG permits unformatted data after the image.  A safe file would not have any.)
File does not contain any known exploits for the format.

Other possible heuristics:

File does not use unusual features of the format (eg. a JPEG that uses unusual application-specific markers would be considered suspicious).
File does not appear to embed data of a different type (eg. a JPEG with something that looks like HTML in the comment field could be an attack on the Internet Explorer type-sniffing mechanism, though this is prone to false positives).

For learning more about this, I'd recommend reading up on the specs on a few file formats, and looking for exploits involving those formats.


What are the security implications of enabling CORS for images? The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the photo server is located on a different origin and when I add a fetched image to the canvas, it gets tainted, preventing me from working with the image.

Are there security implications in enabling CORS for images? What can a malicious person do?

Depends how you set it up. If you allow Cross Origin Requests from any domain, then an attacker who finds the image URLs can do anything you can do within your Javascript application - the security is exactly the same as what you have. If you restrict the requests to your specific application server, they shouldn't be able to do anything, just as you can't at the moment.

CORS is aimed to prevent client side attacks such as loading an image which the remote site can't see (with an image tag to a, for example, Facebook server), then copying the content to their server without the client being aware. Therefore, the situation you describe is exactly what it handles well.

In this case, it is more important that any functions to save the modified images to the server are secure, since these could result in server compromise, or simply in third party sites using your system as a way to store their images. Don't forget that even with CORS enabled, an attacker can easily load images directly from your server if you don't perform proper authentication steps - for example, by running a cURL command on the image URL.


One-Time-Passwords resist against bruteforce attacks? Immune Alternative? Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power?
If not, what algorithems are immune to bruteforce attacks against static data on a HHD or USB-Stick? Consider the data is stored on an USB-Storage and you loose the USB-Storage to the attacker who has unlimited computer power available to brute force the password.

You have two different questions. To answer your first question...

  Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power?

When talking about brute force attacks you have to differentiate between online and offline attacks.

When considering online brute force attacks, I refer you to RFC 4226 Section 7.3.

  Truncating the HMAC-SHA-1 value to a shorter value makes a brute
     force attack possible.  Therefore, the authentication server needs to
     detect and stop brute force attacks.

  We RECOMMEND setting a throttling parameter T, which defines the
     maximum number of possible attempts for One-Time Password validation.
     The validation server manages individual counters per HOTP device in
     order to take note of any failed attempt.  We RECOMMEND T not to be
     too large, particularly if the resynchronization method used on the
     server is window-based, and the window size is large.  T SHOULD be
     set as low as possible, while still ensuring that usability is not
     significantly impacted.

  Another option would be to implement a delay scheme to avoid a brute
     force attack.  After each failed attempt A, the authentication server
     would wait for an increased T*A number of seconds, e.g., say T = 5,
     then after 1 attempt, the server waits for 5 seconds, at the second
     failed attempt, it waits for 5*2 = 10 seconds, etc.

  The delay or lockout schemes MUST be across login sessions to prevent
     attacks based on multiple parallel guessing techniques.

Good implementations of HOTP and TOTP, which are the algorithms used in Google Authenticator should throttle login attempts, thwarting online bruteforce attacks.

When it comes to offline brute force attacks, the attacker has to guess the shared secret used.

RFC 4226 Section 4 has this to say about the secret.

  R6 - The algorithm MUST use a strong shared secret.  The length of
     the shared secret MUST be at least 128 bits.  This document
     RECOMMENDs a shared secret length of 160 bits.

Brute force attacks against keys of that length is considered to be impossible.

Moving on to your second question...

  If not, what algorithems are immune to bruteforce attacks against static data on a HHD or USB-Stick? Consider the data is stored on an USB-Storage and you loose the USB-Storage to the attacker who has unlimited computer power available to brute force the password.

Ordinary drives do not encrypt their content in any way. Loosing the drive means revealing all the data on it. You must encrypt the data on the drive if you are to have any hopes of it remaining secure. Some drives have encryption built in while you can use software like Truecrypt to encrypt others.

Assuming that the encryption is sound (AES with a proper mode of operation and all that...), it comes down to the password you use to derive the key from. In that situation, the encryption is only as strong as your password. Choosing a long, random password makes it very unlikely that an attacker will be able to guess it.

This is of course assuming that the attacker is computationally bounded which is what you will face in reality. Against attackers with unlimited computing power, you will need a very special class of algorithms known to be information theoretic secure. Some examples of such algorithms are the One Time Pad and Shamir's Secret Sharing.


Possibility of SQL injection by static or predefined values Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters.

$result->bindParam(":id",$_POST['id'],PDO::PARAM_INT)

but I am confused regarding the following situation, I have to use parameter or parameter doesn't roll in here.

Situation-1

When calling function

function fetch($id, $subid){
    $result=$con->prepare("SELECT * FROM......WHERE id=$id AND subid=$subid")
    $result->execute();
    .....
}

If we put static value in code, no user input, what about injection here?

fetch(3,4);

Situation-2

Variable come from another query

//first-query
$id = $row['id']

//second-query where first query variable is used
$result1=$con->prepare("SELECT * FROM......WHERE id=$id")

//Another Example

$id=$con->lastInsertId();
$result1=$con->prepare("SELECT * FROM......WHERE id=$id")

Here we use variable associated with a direct database.

Situation-1
It's a function. Which means it could be called with different parameters and you cannot foretell whether these will be predefined or not.
Besides, I just don't understand why you're asking at all. Is a prepared statement that hard to use to make you seek a shortcut for a deliberately rare use case?
Then ask how to make a prepared statement easier to use. It's not a rocket science and will make your code as simple as
function fetch($id, $subid){
    $sql = "SELECT * FROM...WHERE id=? AND subid=?";
    return $this->con->run($sql, [$id,$subid])->fetch();
}

so there will be just no reason to avoid a prepared statement.
Situation-2
This is called a "second order SQL injection", and being the very reason to use a prepared statement for any variable, regardless of the source.


Should EMV data fields be encrypted? Are there any EMV data fields considered to be sensitive data according to the PCI DSS standard?

After looking at this website article (https://www.pcicomplianceguide.org/will-emv-make-you-pci-compliant/) it looks like that yes, the data, specifically the PAN needs to be encrypted in accordance with PCI.


KeyChain Access and GPG Keychain - should those be running simultaneously? I have installed GPG Suite and found out also during this time that my OS X has some KeyChain Access app that stores all my passwords under my screenlock password - total news to me. Can I get rid of Apple app if I now have GPG? Thanks.

The OS X keychain app is a component deep in the core, and not only takes care of several login and account passwords, but also the Safari web password store and handles certificates for a broad number of OS X applications from both Apple and third parties.Removing it would possibly break all of those.

GnuPG only handles OpenPGP keys (it could also do S/MIME, but rarely is used for this purpose). GnuPG is not a replacement for any of the tasks the OS X key chain is performing, there is rarely any overlap in-between them (apart from they're managing keys, although different kinds of).


Hiding text string with steganographic method - practical problem I'd like to ask for small hint with following problem:

Using the steganographic method of the least significant bits, hide
the text string "Kra" in four pixels of color with RGB code
. Hide the text in the sequence of bits of the image
one character at a time, ie first hide the character "K", then the
character "r" and at the end of the sequence of image bits "a" will be
hidden. The text is encoded according to the Latin-2 character set, so
"Kra" = . Write the resulting pixel values in the
format .

I assume that (128)10=(10000000)2, individual characters converted from decimal to binary system as following:

(4B)16 = (01001011)2
(72)16 = (01110010)2
(61)16 = (01100001)2

At this point, I can start substituting bits in (128)10 values of R, G and B, starting at the least significant bits. However, I will get something like this:

R=(11001011)2=(203)10
G=(11110010)2=(242)10
B=(11100001)2=(225)10

and this is quite far from the original (128)10 values and it does not even meet the condition of unrecognizable color difference by the human eye. In addition, the last 4th pixel remains unused.
What's wrong with that method? Thank you for your explaination.

Your "Kra" is hex 4B 72 61
You have 24 bits of information to steg into your image.
You have 4 24-bit pixels of hex 80 80 80 to work with, or 12 color elements of hex 80.


What should be backedup periodically? I know of less than 10 data files I modify regularly that I want backed up. I did a full system backup and tried doing incremental backups every week but find it unnecessary and too long. For example Outlook syncs with all my e-mail accounts using IMAP. I don't want any media files to be backed up.

This may sound silly but I want to check: is there anything I'm not thinking of that needs backing up? For example are there any files that get modified without my knowledge that if I did a full restore, then restore with other files, the computer won't be able to run.

I'm using Acronis True Image 2013. Is there a way to create a schedule for an incremental backup that only backs up select files? If no is there a way to create a schedule for an incremental backup that excludes all media and Outlook files?

I suspect to get some down votes and close votes but could people say why? I think it's a pretty legitimate question "what do I need to backup" encase there's something I'm unaware of.

As with many of these things, the answer is, "Well, it depends"

If you are happy reinstalling the OS from disk, or rebuilding from an image and simply adding in your data files, then maybe you just need to back up your data files. But is your saved image up to date with patches and config changes? Would the OS require thousands of updates if you reinstalled from disk?

You need to look at what scenarios you wish to plan for. In some environments it may be enough to simply hold weekly backups of data, but for others you might want images of all servers backed up incrementally every hour or more frequently.

Determine what you need to keep your business running.

As an example, at home I keep a full backup of my main server every week, but I also keep 2 separate copies of my family photos as they are irreplaceable. I also keep images of my other live servers, but I only update them occasionally - worst case with them I just plan to reinstall from media and then patch. My older servers I hardly bother patching at all - many never get connected to a public network anyway. (And some never had network capability and haven't had OS updates in 25 years...)

So, to summarise, I think your question "What do I need to backup" is unanswerable except in general terms like this, as it is different for everyone.


Is there other vulnerabilities than CVE of NVD I am aware that there is the CVE list published by the NVD. Are there any other important vulnerabilities lists that show vulnerabilities other than the NVDs?

Thx

NVD covers a lot of vulnerabilities. Aside from those you also have:

Security Focus (bugtraq)
OSVDB

They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities.

Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which might not get disclosed.


If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site? Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn.

When the book club becomes popular, we discover that 3rd party apps want to read data from our database.  We store things like: the list of books each person has read, the queue, and what they thought of each book.  The third parties (Amazon, Barnes and Noble, etc) want to read that data, under the context of the logged in user.

Question

How should I design the OAuth login scheme for my website?
Can I rely on 3rd parties?  (Google, twitter, anyone else?)
Once logged in, how can I share a subset of my data with 3rd party apps
Is the only way I can achieve this is if the IDP (Google or Yahoo) adds support for this (say in OAuth 3)?

You rely on OAuth providers to have users share their identity with you. If you want apps to read info from the users from your database, you effectively have to become an OAuth provider yourself. Your apps should only deal with you and your user identities, not any third party providers that your book club uses.

How this would look if a user signs up and wants to use an app:

user clicks sign in with Twitter
Twitter asks user if it's okay to provide your book club with information
you have the link to Twitter and can create an account, read the tweets, whatever
your user wants to install an app on the book club
they go to the app, the app invokes the same process that you did with Twitter, but with your book club
Book club asks user if it's okay to provide app with information
user agrees and the app has your book club's user info and access token

What if the app wants to enable third party signin via your book club? Well the user has to click "sign in with book club". If they are not signed in, how do they sign in on book club? Right, by using Twitter, Facebook, etc. Effectively you are chaining different auth providers. But two steps should still be manageable for a user.


Create CSR for S/MIME certificate from existing OpenPGP key pair While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone).
I believe the CSR must be generated based on a truely private key, hence a CA generated one is unacceptable for me. Unfortunately, I struggle with finding the correct OpenSSL arguments needed for CSR generation based on my existing OpenPGP's public key instead of letting OpenSSL create an entirely new key pair.
Put simply, how to tell OpenSSL: "Take Thunderbird's 'Armored ASCII'-formatted public key export file & create a CSR based on it (and further provided details like CN, O, OU, etc.)"?

So, I'll admit, OpenPGP is not something I have much more than a superficial knowledge of.  I always end up back in the docs when I have to explain something - it's just not a useful technology for most of what I do (web app development in the cloud).
Go/No-Go Decision
Mileage will vary, somewhat, depending on your key type.  The CA will have a specific set of key types (encryption algorithm + key size) that it will accept.  That's non-negotiable.  If the OpenPGP key that you have is not of an acceptable type, then you won't get far with this procedure.
Getting the Key
Next, I would expect that you need some way to transform the OpenPGP key into a format that can be used to sign the CSR... unless it's already stored in a vialbe format.
I haven't tested it, but this looks like a reasonable procedure:
https://community.progress.com/s/article/How-to-export-a-private-OpenPGP-key-1307565960821
What I can't tell is what format this will export the key into.  Ideally, it'll have a nice clear file extension (.der, .pem, .p12 or .pkcs12 are all common formats that would fit with the notes in the next section).
Making the CSR
For Open SSL CSR generation, the command is nicely discussed here:
https://stackoverflow.com/questions/9471380/create-csr-using-existing-private-key
The core of it being:
openssl req -new -key key.pem -out req.pem

"key.pem" being your pre-existing key.  The PEM describes a way that a private key can be encoded.  DER and PKCS12 are also common formats, and converting between formats is described here:
https://www.digicert.com/kb/ssl-support/openssl-quick-reference-guide.htm
Open SSL being what it is, I would expect you could also use any of these 3 formats directly in CSR gen, though you may have to give some argument to specify which format.
... But should you
As I was writing this, the angel on my shoulder had some things to say.  It's one thing to be able to do this.  It's a different question of whether you SHOULD.  Private keys are the essence of security in asymmetric cryptography and handling them in a less secure way can compromise the protection.
I think this may be a case where you are better off doing this the easier way and generating a new private key for your CSR instead of trying to reuse your PGP key.  I don't have all the context, so I can't say for sure.  Instead, here's some things to think about:

Non-repudiation - the concern mentioned in the question about having a "truly private key" speaks to the idea that you want to have only your 1 system in control of the key.  In the sketch of the procedure above - you are making a copy of the key in exporting it from PGP.  You may also have a second copy in converting it's format for OpenSSL.  At the very least, be sure to clean up any extraneous copies.  But you'll likely end up needing 2 copies - one for the OpenPGP use and one for the purposes for which you are signing a certificate.

Limiting exposure risk - if you use the same key for two purposes and it's exposed, it compromises BOTH purposes.  That doubles the risk of exposure of cryptographic content.  If you had 2 keys and only 1 was exposed, the risk would be smaller.  For this reason, often different key is used for different purposes.

Ease of renewal - key expires.  Being able to rotate key easily (automatically!!!) minimizes the risk that you'll loose connectivity when the certificates that represent the key expire.  By connecting the Open PGP and the Certificate's private key - you make your rotation process more difficult, as you have (1) generate new key, (2) re-authorized the PGP side, (3) cut a new CSR, (4) get a new certificate.  That means you are almost certainly scripting something to do this, instead of telling each side to auto-renew on it's own.

I would argue that having 2 keys for these two separate mechanisms on the 1 system is not less secure.  Either way, the key is sitting on your hard drive, and could even be sitting in the same key storage system/drive location and thus afforded all of the OS level, hard drive level protections available on your computer.
Reasons that you would want to keep the key the same:

Trust distribution challenges - I have seen systems that would accept the authority of the PGP system or PKI hierarchies, and thus, your application must distribute a marker for it's key pair - and that single form of identity is how your system is authenticated.  I can't really think of why you would have such a situation that requires both PGP and X509 credential creation... but never say never.  If you are working in a system that imposes this restriction, then you're stuck trying to do what you're asking to do.
Suitable key generation is deemed a serious risk and as such, is very difficult.  The case that comes to mind is if you are hardware protecting your key, then getting access to the device that creates and keeps your key (not on your hard drive!) - can be difficult.  Doing it twice can be twice as difficult.  I've worked on a fair number of high level FIPS devices like this, and I'd still probably be inclined to make 2 different keys on that device, and use them for the 2 purposes... but mileage could definitely vary.

That's probably not a final list of either pros or cons.  But I'm hoping that it gets across that 1 key for all purposes is not necessarily more secure.


Fake a VPN service (MItM) Let's assume that I'm on someone others network where DNS etc is configured through DHCP.

So when I want to connect to the VPN service the DNS servers on the network that I am connected to return a local IP instead of the real one for my VPN service.

The MItM VPN service just happily accepts all credentials and forwards them to the real service.

I think that my connection is safe, but the MItM service have all traffic without encryption.

Is the above possible or does the authentication mechanism in VPN make sure that both parties are who they say that they are?

There are several kinds of VPN. But if the VPN in question does not use server authentication in some way (i.e. server certificate, shared secret...) or if the client improperly validates the server than this kind of MITM is possible. This is similar to HTTPS with a client not validating the servers certificate properly.

Edit: Actually, I think your question is already answered in Are VPNS vulnerable to active man in the middle attacks. Thus please study the answers there.


How to avoid abuse of web-server endpoint from a rogue client? I realized that once a user logs into the application and receives an Auth token there is the potential that they could use that token along with a rogue client to exploit an endpoint that they now have access to.

For example, they can make a million garbage posts or attempt to like something up a thousand times(trivial examples but you get the point)

Question:

What strategies can we use to guard against this type of exploitation from a malicious user and keep the endpoints use to what it was intended for?

For your examples you'd need a throttling mechanism in your application which checks some preconditions like the timestamp of the last user activity before the request is processed.

However there's no general purpose measure which prevents all misuse of your application. You must analyze the use-cases in your application and think about how the functionality could be exploited in order to develop and deploy security controls. A penetration test could help with this.

Your current approach sounds a bit like candy security (Authentication as single security layer).


Adobe Flash Inside Whonix Workstation It's known that Flash can give away your real IP address to web services if you use it in Tor Browser directly run by your computers OS. But what if you use flash inside a Whonix workstation (either in Tor Browser or in a "normal" browser like Firefox, Chromium, Google Chrome)?

The Whonix VMs are designed in such a way that all internet traffic of the Whonix workstation has to go through Tor. Is it possible to figure out the real IP address of someone if they're using Adobe Flash inside a Whonix workstation? Does using Adobe Flash have any other major implications for privacy such as making fingerprinting much easier?

TL;DR:  generally no, it is not possible to figure out your IP assuming the Whonix VM is congigured correctly as you describe, and ALL traffic tunnels through Tor.

Long story, there are several ways for Flash applets to find your real IP. As stated above, none of this applies to Whonix which protects against all of them. Those are listed here for the education purpose, and to explain why other Tor configurations (such as Tor Browser Bundle or Tails) still could be vulnerable to those.

The most obvious way is to request a specific URL from Flash itself, and see the IP in the server logs. If the Flash traffic is routed through Tor, this will return the IP of Tor exit node. Tails protects against this, but Tor Browser Bundle, as far as I know, does not (and this is why Flash is disabled in TBB).
It is possible (in Adobe Air 2.5) to enumerate local interfaces and find out the IP there. In your configuration this would probably be a nondescript IP such as 10.x.x.x which will give out no information. Same as above.
It is possible to use a browser exploit, and then run some code in your VM. This code will not be restricted by Flash policies, and could leak your IP depending on how tight the configuration is.

For example, Tails enforces routing of traffic through Tor via the firewall rules. If an exploit gains root privileges, it can flush the firewall rules table, effectively disabling this rules enforcement. Then every request (such as wget to whatismyip.com) would return the IP address.

However if the rules are enforced at the workstation itself (i.e. the VM can only talk to workstation no matter what the VM firewall/NAT configuration is), this will not work. Still, there are other possible ways. For example, if VM only firewalls TCP traffic, but passes ICMP traffic (Tor cannot really tunnel ICMP or UDP, only TCP), it is possible to send the information via ICMP. Also if DNS requests are not filtered by Whonix, it is possible to set up your own DNS server for a domain, perform DNS lookup for domains such as 192.168.0.1.yourdomain.com and log the requests on your DNS server. However with proper filtering - which I believe Whoenix is doing - this should not be possible.


Is AES encrypting a password with itself more secure than SHA1? This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using itself as the key. Does anybody have any insight as to whether this is actually more or less secure?

Some thoughts on the matter:

SHA1 is one-way, which should make it more secure than a function that preserves the data.
On the other hand, the hacker can't possibly take advantage of AES' decryptable nature because he doesn't yet know the password.
Unless he guesses it. But then he would be in no matter how I encrypted it.
Since you know the AES'd password is decrypted when the decryption key matches the output, it could be bruteforced on the hacker's computer.
But the hacker doesn't know how it's encrypted, so he wouldn't be trying that.
But the hacker could have got the encryption code as well, in which case it's simply a question of which data takes longer to brute force.
Most websites use md5 or sha1 (right?), so lookup tables for these hashes would be far more widespread than for the AES method. Thus making the AES method more secure.
But if we salt both methods, they would become equally immune to lookup tables.

Some common points in the answers, and counter-points:

  AES encryption is not designed to be collision resistant, and thus will probably have more collisions for the same hash string length.

If we're using a longer salt, then the encrypted password will be longer than a SHA1 hash. This may be enough to bring the collisions down to a comparable level - or maybe not.

  AES encryption tells you how long the password was, within 16 bytes.

We can add to the AES method: after encrypting it, we pad or trim to a reasonable length (which is longer than SHA1's so as to avoid collisions).

Short answer: bad idea, don't do it.

Longer answer: the point of the exercise is to store something which allows the server to verify a given password, but does not allow it to rebuild the password; the latter property is desirable, so that consequences of an illegitimate read access to the server database by an attacker remain limited.

So we want a one-way deterministic transform which converts a given password into the verification value. The transform shall be:

configurably slow, so as to thwart dictionary attacks;
distinct for every instance, to prevent parallel dictionary attacks, including precomputed tables (that's what salts are about).

A single invocation of MD5 or SHA-1 fails on both accounts, since these functions are very fast, and not salted. Slowness can be done through nesting many invocations (thousands, possibly millions), and the salt can be injected "somewhere", although there are good and bad ways to do it. PBKDF2 is a standard transform which does just that, and it is not bad at it (although bcrypt should be somewhat preferable).

However, MD5 and SHA-1 do at least one thing right: they were designed to be one-way. That's hard to do; it is not even theoretically proven that one-way functions can really exist at all. Cryptographers around the world are currently involved in a competition to design a new, better one-way hash function.

So what your professor seems to recommend is to replace a function designed for one-wayness, with a function which was not designed for one-wayness. It does not correct anything about slowness and salting, but it removes the one good thing about MD5 and SHA-1. Moreover, AES is known to be relatively weak with regards to related-key attacks -- that's not a problem as long as AES is used for what it was meant to, i.e. encryption, but it becomes an important issue when it is subverted into a building block for a one-way hash function. It seems possible to build a secure hash function by reusing parts of the AES design, but it requires substantial reworking (see for instance Whirlpool and ECHO).

So do not use a homemade AES-based password hashing scheme; for that matter, do not use anything which is "homemade": that's a recipe for disaster. Security cannot be tested; the only known way to make a secure algorithm is to have hundreds of trained cryptographers look at it closely for a few years. You cannot do that by yourself. Even a lone cryptographer will not risk that.

Instead, use bcrypt. PBKDF2 is not bad either.


Does the use of an on-screen keyboard give a false sense of security or protect against all types of keyloggers? Does the use of an on-screen keyboard (OSK) give a false sense of security? For example when people use the OSK in an attempt to prevent key-loggers from logging information like passwords, typed on an actual (hardware) keyboard.

Like the OSK of Microsoft as shown in the image below.

I assume using a OSK does prevent an attack with an hardware key-logger like in the image below, but do OSK's also prevent software key-loggers from logging information?

Another example is a website that has it's own OSK implemented on the password field, using HTML and JavaScript.

Yes, it is most often just a useless "security measure".

We need to define the threat model and then if an on screen keyboard provides a proper mitigation.

A OSK will protect against two threats:

A hardware keylogger
A software keylogger that is only looking at the keyboard state (does not attempt to defeat a OSK).

One should note the the difference however that not all on screen keyboard implementations are the same. For instance on Windows the OSK could be running at an higher User Interface Privilege Isolation (UIPI), or in Android where pretty much no implementation uses a hardware keyboard, such app needs a special permission.

What applications are implementing on screen keyboards? Websites.

That is, those that are forcing the usage of an on-screen-keyboard are doing so at their same privilege level, and as a result of the platform (the browser) they are running in, they can't actually do any better.

Now, on screen keyboards were useful back in the day, when banking trojans were stealing users and passwords through keyloggers. On screen keyboards on the web sites fixed that by having the user not to type their password with the keyboard. Then malware quickly adapted and started to also capture the screen, an image around the mouse, etc. overcoming the solution.

Banking trojans have been doing this for over a decade. Thus the security added by such keyboards has been nearly zero for years.

Given that the probability of the user having a hardware keylogger is negligible, they are only protecting from "amateur keyloggers".

At this point, you may be thinking that it may still be worth even for such tiny return. However, they have a number of drawbacks too:

Bad usability

Hard for people with low motor skills controlling the mouse (newbies)
Annoying for fast typists (experts)
Confusing for everybody when randomising the order

Accessibility concerns
Makes the password vulnerable to shoulder surfing
Doesn't allow entering the password with a pass manager
No muscle memory
Slower to enter
As it makes harder to "type" the password, it actually encourages using a weaker password

which in my humble opinion weight the decision clearly for not requiring an on screen keyboard.

Note that there's no problem with adding an optional OSK. And if your customers are likely to use an alphabet with characters outside the ASCII range, it may actually be appropriate to provide them an OSK so they can type them when using a foreign keyboard. But this is accessibility, not security (albeit it's indirectly supporting the use of special characters).


Datasets dedicated for SIEM systems I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for this system.

Some researchers used Packet Clearing House SKAION2006 IARPA Dataset, I have queried a request to use the dataset but unfortunately my request was denied (only US-based researchers, with some countries included, can use it).

Do you have any publicly available datasets for SIEM systems?
A friend recommended me the KDD99 dataset, but this one was designed to evaluate IDS/IPS systems in nature. I believe I can't use it for this reason, what do you think?

Bests,

Here is some links that may help you:

https://vizsec.org/data/

http://www.fukuda-lab.org/mawilab/data.html

https://mcfp.felk.cvut.cz/publicDatasets/

On the other hand, consider datasets from 1999 is not going to be very useful unless you are testing the stability of your system, but for detection/classification I don't think will help from my point of view


PCI Compliance Password time to die change requirement In the PCI DSS3 requirements it states that the user must change their password every 90 days, how are banks in the UK getting around this requirement? Is it because of 2FA?
As a new business we are analysing the requirements and what we need to do and this one in particular seems extreme when most companies aren't requiring it

I assume you are talking about customers of the bank not being required to change their password every 90 days.
Customers of the bank are not covered by PCI; PCI dictates what employees and others working on the infrastructure within PCI scope are required to do.  To quote PCI DSS 3.2.1 Requirement 8 (emphasis mine):

Note: These requirements are applicable for all accounts, including
point-of-sale accounts, with administrative capabilities and all
accounts used to view or access cardholder data or to access systems
with cardholder data. This includes accounts used by vendors and other
third parties (for example, for support or maintenance). These
requirements do not apply to accounts used by consumers (e.g.,
cardholders).


Mode of operation are availables with Camellia What cipher mode of operation are available using Camellia in a SSL certificate context ?

I'm mostly interested if XEX (Xor-Encrypt-Xor) or related mode (LRW, XTS...) can be used because they seem simple and very secure, if not implemented I would like to know why ?

No. CBC and GCM only.
IANA maintains a list of all official TLS/SSL cipher suites.
And they list two RFCs for definitions of Camellia cipher suites:

https://tools.ietf.org/html/rfc5932, Only CBC.
https://tools.ietf.org/html/rfc6367, Some CBC, some GCM.


Digital signatures in a corporate network I'm going to implement digital signatures for corporate use.
For that, I would develop an application for signatures, generate public/private keys for all employees and store private keys in the Active Directory database.

To sign the document in the application, an employee has to authenticate via LDAP, using his login/password. The application would get his private key from Active Directory, hash the document and encrypt it with the private key.

The generated cipher would be stored in the database. Users may download the signature list for a given document, and check the signatures if required (as public keys are known).

What are the cons of this method?

You seem to want to roll your own signature infrastructure. As @Chenmunka points out this is almost always a bad idea.

A few questions remain outstanding.

You want to store the private keys in LDAP but the signatures in a database. Why not just store the keys in the database? If a user gains more access than they should to the database they can just replace the signatures - so having the keys there is no less secure.
How are public keys distributed and verified?
How do you enforce your users actually sign documents and check signatures?

Without establishing your full use I can't know for certain but it feels like there is also no need for this system. What does it establish? It feels like it will be clunky and a pain for users to use - which means they will find ways around it.

If you just want to be able to prove who edited a document there are built in tools in Windows. See audit object access.

Alternatively if you want users to be able to easily check who authored a document there is support for this built into many common document formats. These bake the certificates into the documents and allow verification via certificate chains inside of the editor - i.e. you only need to add the root certificate to users machines which can be done via group policy. All office formats and PDF support certificate based publisher signing. You could create your own root certificate authority and issue each user a key (or ideally have them generate certificate signing requests - that way the organisation does not have to hold the users private key and administrators cannot easily forge signatures).


Topics for SecureCoding course in C So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around that...

However, I'm coming up a bit short on relevant topics, though I feel that there should be something else. It's been a while since I've done this, so these topics are admittedly not fresh in my mind...
Note that this is only one part of a larger series, the other parts are dealing with all the other aspects of a security course - principles, best practices, theory, SDL, etc etc. This part is only on the actual coding bits.

So, for a course on Secure Coding in C, what I have so far is (for each type of attack, the course will cover what it is, and how to prevent it) :

Buffer Overflows

Stack overflow
Heap overflow

Integer Overflows
Format Strings attacks
Race conditions – TOC-TOU
“Dangerous” APIs

Still waiting to hear back if databases are relevant; web issues are not.
What else would you suggest, specifically for C?

I would recommend to look into the table of contents of "The Art of Software Security Assessment" aka TAOSSA. It has everything in place, nothing to re-invent.

Also, I see in your list is missing one important thing - dealing with pointers. I suppose for that item there should be separate topic. That is a one real PITA and attention should be pointed to this issue from the early start.

Then, you could take a look here: https://code.google.com/p/it-sec-catalog/wiki/Exploitation#5._Vulnerability_explained to show "worst practices".

Finally, today is very important to point attention to x64 software. Good reading can be found here: http://www.viva64.com/en/articles/


Why does initial encryption take so long? I am encrypting my new 1 TB drive using VeraCrypt and AES encryption. It estimates 9+ hours just for the outer volume to be encrypted. I assume the inner volume will take just as long.

Why does this take so long? I am assuming that decryption should be much quicker. if not, this isn't usable.

Veracrypt and it's predecessor Truecrypt transform plaintext disk content to cyphertext disk content on the fly.

There is a one-off process to convert the plaintext to cyphertext when commissioning the hard disk.

So this is a full disk re-write which is limited primarily by the speed of the hard disk. A spinning hard disk is the slowest part of the typical memory hierarchy (CPU Cache, Main Memory, SSD Cache, Hard Disk) and there are very few ways to optimise this process (i.e. the cache will not speed it up).

The on-the-fly rewriting of content is practically unnoticeable in comparison, especially on modern CPU's.


How to force clients to browse Internet through Squid Proxy I am using Windows Server 2012 in which I have shared internet through NAT to a secondary LAN card using routing and remote service.
The problem is that when my clients are browsing through proxy 10.0.0.1:3128 everything goes  right, but when they remove this proxy from Internet Options then they are able to browse the websites which are blocked by the proxy.

How can I redirect the client traffic to go through the proxy server only?

If you set up a proxy as a filter, you should deny all requests that does not come from the proxy itself.

This will force user to go through the proxy or not having access at all.

Usually, user should not have access to the proxy configuration unless they are meant to change it.


How to prevent ddos and brute-force attack by restricting IP's on Wordpress website I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below

<Files wp-login.php>
order deny,allow
allow from 3.0.0.0/8
allow from 4.0.0.0/8
allow from 5.10.64.1/32
allow from 5.10.64.16/28
allow from 5.10.64.144/28
allow from 5.10.64.160/29
allow from 5.10.64.176/28
.
.
.
deny from all
</Files>

But this approach is not so clever one since server take too long time to even browse the page. My question is how to make wp-login.php accessable only from country specific so that it can't be access by other countries.

Another approach might be from mod_security by use of GeoLite City Database but I do not want to go there. Third approach might be using some plugins but I neither want to do that too.

All I am doing this is to prevent Brute Force Attack. If it is done from one ip then we can just block it, but if it is done from many ips then it result in server overload and Ddos. I am sure that all people in the filed of cyber security are facing similar kind of problems. What are your approaches?

I read that you don't want to install plugins, but there is no other practical way to do this given your other restrictions. Wordpress actually has some good info I found after doing a little searching:
https://wordpress.org/support/article/brute-force-attacks/
I don't have much experience with it so someone can probably suggest a specific plugin, but there is a list of them under the plugins suggestion you could test. This way a specific IP failing a specific amount of times will be locked out, which makes brute forcing impractical and shouldn't effect you at all.


How can I extract all required data to re-encrypt browser-decrypted requests identically? I want to be able to reencrypt the web responses that Chrome or Firefox receive from a HTTPS server, in a way that they are identical to the original sent by the server.
Is this possible? What would I need to be able to do it?

EDIT: To clarify, I think the first thing that would be required is the client's public key. But given that modern TLS uses forward-secrecy and keys are exchanged in a somewhat complex process, is there anything else required?

If you want to replicate only the encrypted messages than you would need the symmetric keys used for encryption and also the random initialization vectors used together with these keys. Additionally you would need to know how much data got encrypted in each SSL record so you could replicate it exactly.

If you also want to replicate the SSL handshake you would also need to know the client and server random values used in the handshake, the servers certificate including its private key and if client certificates are used the same for the clients certificate. Additionally you would need to know which extensions got used and in which order, the ciphers offered by the client (and their order), protocol versions used etc. If DH or ECDH key exchange is done it gets even more complex.

And I'm pretty sure that I've missed something you also need. But even to get all of the values I've mentioned is nearly impossible unless you have very deep control of client and server, i.e. deeper than the API of the usual TLS stacks offers.


Leveraging a shell from SQL injection As I understand it, SQL injection should only allow for the manipulation and retrievial of data, nothing more. Assuming no passwords are obtained, how can a simple SQL injection be used to leverage a shell?

I have seen attacks where this has been claimed to be possible, and if it is I would like to be able to protect against it.

Many common SQL servers support functions such as xp_cmdshell that allow the execution of arbitrary commands. They are not in the SQL standard so every database software has different names for it.

Furthermore there is SELECT ... INTO OUTFILE, that can be used to write arbitrary files with the permissions of the database user.  It may be possible to overwrite shell scripts that are invoked by cron or on startup. If the database server process is running on the same server as a web application (e. g. a single rented server), it may be possible to write .php files that can then be invoked by visiting the appropriate url in the browser.

The third way to cause damage is to define and execute stored procedures in the database. Or redefine existing stored procedures, for example a function that verifies passwords.

There are likely more ways.

The application database user should neither have permissions to execute the shell functions nor use INTO OUTFILE nor to define stored procedures.


What reason do we have to believe that AES is unbreakable? I'm learning about AES, and I haven't been able to find any intuition or justification about why we expect AES to be difficult to break. How can we be confident that there aren't techniques for inferring the plaintext from the ciphertext, much more efficiently than brute-forcing the key? (And to be clear: I'm asking for an intuition, not a proof. I'm aware that we don't really have proof that any encryption scheme is unbreakable).

Many of the public-key protocols I've learned about are grounded in some simple, well-studied problem that we believe is fundamentally difficult. For example:

  RSA: We believe RSA is secure because we believe it is fundamentally
  difficult to factor very large numbers.

  Diffie-Hellman: We believe Diffie-Hellman is secure because we believe
  it is fundamentally difficult to compute the discrete logarithm.

Is there anything equivalent for AES?

I disagree with your characterizations about RSA and DHE.  We believe they are secure because there are no significant known attacks on modern implementations with reasonable key sizes that cause either to break in practice; it's the same reason we trust AES.  No one has published a method to break secure implementations with practical attacks.

We do know that if given an oracle (or sufficiently powerful quantum computer running Shor's algorithm in polynomial time) that factors RSA moduli or solves discrete logs that it would be possible to break RSA and DHE.  This doesn't mean there couldn't be an alternative way to break RSA/DHE that doesn't rely on factoring numbers or solving discrete logs.

For instance, there are plenty of ways to break badly designed RSA (e.g., use a low exponent, don't use a secure padding scheme, choose p and q that result in a small d, etc.) and none of these require some advance to break integer factorization.


Should I use HTTPS on a domain that will only be used for redirection? If I have a domain, https://www.example.com. It has an SSL certificate for that domain only.

I also want to redirect people who only type example.com in their browser's address bar. Should I secure the second domain https://example.com and why, or HTTP only is enough?

I don't use a wildcard SSL certificate.

If you don't secure example.com and a user visits that site, a man-in-the-middle attacker can manipulate the traffic and keep the user on example.com, where he can intercept all traffic.

It doesn't matter that your version of example.com redirects to https://www.example.com/. The attacker can change this behavior and offer a HTTP version of your site to the user.


MITM a TLSv1 connection - have one side use SSLv3 I have a MITM setup between a client and a server - the client only supports TLSv1 when it comes to that server and the server support SSLv3 up to TLSv1.2.

There is a vulnerability on the server which only works on SSLv3 connections. Is it possible to convert each and every message between them so the client will view the connection and treat it as TLSv1 while the server as SSLv3? If so, how is that accomplished? If not, what prevents it?

If the client supports only TLSv1 there is no way to force it to use SSLv3 instead. You also cannot tamper with the SSL handshake by replacing the protocols since the handshake itself is protected against tampering.

This leaves only the classical man in the middle attack where there are two SSL connections: one between client and MITM and the other between MITM and server. This attack fails if the client properly validates the certificate snce the MITM cannot provide a certificate which is both issued by a CA trusted by the client and also properly identifies the original server.


Is it possiible to get a virus without running an exe file? I will often download .exe files and soon decide I do not wish do download them (just want to make sure I don't get a virus). Is it possible that I could get a virus from these downloads before I even run the executable?

It is possible for the act of merely downloading a file and doing nothing with it to be a security vulnerability, but this is true of any file type (not just exe files), and attacks of this nature are much more difficult than simply tricking random people into opening an untrusted file. This kind of attack would be exploiting some error in your browser or download manager's programming to execute arbitrary code rather than running a malicious exe file directly. This would essentially be equivalent to getting a "drive-by-download" virus from visiting a website, except it would be exploiting the download engine rather than the browser scripting or rendering engine.

Executable (exe) files are mainly dangerous because they run a program on your computer. If you run a program you are giving it permission to do anything your user account has access to do, including installing other programs, reading or destroying data, modifying system configuration, etc. If you do not run that file then it does not execute and you have not given it permission to do anything


Is the `ssh-agent`'s DSA signature deterministic? In my hopes to use ssh-agent to generate a signature as password I implicitly assumed a deterministic signature. DSA is however supposed to take random value k for signing. However that randomness is merely required for preventing attackers from obtaining the private key from the signatures of different messages. I used this Python script (slightly modified the output) to obtain the signature of a test message. However even after reconnecting or restarting the ssh-agent (OpenSSH_4.6p1, OpenSSL 0.9.8e 23 Feb 2007 from msysgit 1.7.11), the signature of that message remains the same. But is this a behaviour I can rely on or could this change randomly e.g. when using a different ssh-agent?

I do not observe this behaviour here. I use ssh-agent from the openssh-client package of Ubuntu 12.04, i.e. "OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012". I modified the Python script to select my DSA key instead of my RSA key (did you do the same ?) and I get, as expected, randomized signatures (no need to even restart ssh-agent, two successive signatures are distinct).

It is theoretically possible to make deterministic DSA signatures through a process known as derandomization, which basically means that the random value k is no longer generated randomly, but with a deterministic PRNG seeded with both the message to be signed (or its hash) and a secret key (which can be the DSA private key itself, or a symmetric key stored along the DSA private key, if there is room fur such an extra key). There are a few subtleties to mind, because the k value must be selected with unpredictable uniform randomness. There is a draft RFC on that subject, but it is still quite new: I wrote the first version on March 2011. I am not aware of any other standardization effort on derandomization of DSA or ECDSA. Usually, when a DSA signature system appears to be deterministic, it is because of a very serious flaw in the random number generator (such as happened to Sony for the ECDSA signatures used in PS3 software).

Are you sure you are really using a DSA key ? A DSA signature has length 40 bytes in SSH (two 160-bit integers, since SHA-1 is used as hash function), whereas a RSA signature will be larger (128 bytes for a 1024-bit RSA key).


How did the Tumblr worm spread? Recently Tumblr was hit by a fast-spreading worm.

How did the worm work?  What was the vulnerability in Tumblr that it exploired?  Did it exploit a XSS vulnerability in Tumblr?  A CSRF vulnerability in Tumblr?  Something else?

Partial information: Sophos has a blog post on the worm.  However, it is oddly silent on the exact details of the vulnerability that the worm exploited.  Apparently, if you visited a Tumblr page that had been infected (with malicious content), then malicious Javascript on the page would cause your browser to send a request to Tumblr to reblog the infected post on your own Tumblr page... thus propagating the worm further.  I still have to wonder, though: how was this possible, without user involvement?  Did Tumblr forget to include any CSRF protection in their reblogging feature?  And, don't they do any filtering on the content you post to your Tumblr page, to remove Javascript before posting?  I saw some speculation that the use of a data:// URL might have bypassed Tumblr's defenses somehow; did they have a HTML filter that tries to remove all Javascript, but inadvertently allowed Javascript if it appeared in a data:// URL, or something?  It sounds like it might be a combination of a CSRF vulnerability plus a XSS vulnerability, but I can't find any detailed technical explanation of exactly what's going on.  How did this thing work?

This story on ehackingnews says it was a result of stored XSS.
http://www.ehackingnews.com/2012/12/tumblr-worm-due-to-stored-xss.html?utm_source=dlvr.it&utm_medium=twitter


Should I worry about padding oracle? I have a PHP webapp which encrypts (by AES192-CBC) messages with a random key and a random IV. Everywhere people are saying how amazing are GCM, EAX and authenticated modes (does currently exist safe implementations of them for PHP?), but in my case I just don't need integrity check.

They say auth modes avoid padding oracles (black hat altering ciphertext and analyzing the decryption process) but I'm not sure that my app is vulnerable to that kind of things.

In fact, when asked, the server queries the database and returns the list of decrypted messages (so ciphers aren't directly provided by users). Padding oracles could only happen if the black hat compromises the system (but in this case he could just hijack new requests and storing plaintexts).

Did I totally misunderstood the problem?

Padding oracle attacks occur when the attacker is in position to submit encrypted messages and observe the key owner when it tries to decrypt them. The attacker then provides specially crafted messages (based from some piece of the encrypted data that the attacker would love to see decrypted) that decrypt to junk but occasionally decrypt to junk-with-valid-padding; in these cases, the attacker learns some information on the data he is after.

If you are in a context where the defender is a server that computes itself all encryption and decryption, and the encrypted messages cannot be altered by attackers, then the situation explained above does not arise, and padding oracle attacks are irrelevant.

So, in your case, you should be safe from these attacks, provided that indeed malicious people cannot get their hands on your database full of encrypted messages. This raises the question of why you would encrypt the data at all -- normally, you encrypt data to achieve some confidentiality that you could not obtain otherwise. Therefore, encryption on the server makes sense only if attackers are assumed to be able to at least have a look at the database contents. In many situations where attackers can see data, they can also modify the data; and this would bring back the issue of padding oracle attacks, or, more generally, the need for checked integrity.

To put it bluntly, if you encrypt the data but make no effort at maintaining integrity (with a MAC or a nifty authenticated-encryption mode), then you are betting that possible SQL injections attacks on your server will be read-only. It is up to you to decide whether you feel safe enough with that bet.