decrypt a string with a password, but unknown method I want to run through multiple algorithms against an encrypted string. I have the password and the encrypted string but not the method it was encrypted under?

what would be the best method to find out the method short of going through every method manually.

Easy way:

Write a script that tries decryption with openssl using all of the block cipher modes. I would consider using openssl in a BASH script or importing pyOpenSSL (or subprocess) and using try/except blocks in python (or the equivalent in whatever language you are most comfortable in) to get the right mode quickly.
Academic way:

Write a detection oracle.
If you have not read through the Matasano Crypto Challenges before, I would recommend starting at Set 1 and reading about implementing and detecting ECB. Set 2 goes into implementing/detecting CBC and also creating a CBC/ECB detection oracle. Once you understand how the block cipher modes work, it becomes easier to understand how to differentiate them from eachother.
Unfortunately this is where my knowledge currently gets hazy on the subject, so if an ECB/CBC detection oracle does not identify the ciphertext, I would suggest you take a look at this good answer to a similar question. The user explains what you would need to look for in order to identify OFC/CTR and EAX/GCM as well, which you could then use to create a more complete detection oracle.
Update 9-Mar-2016
I have been trying to tackle the problem of identifying block cipher modes of encryption, given ciphertext-only, over the last week. The problem with the answer I referenced (in relation to this goal) is that it assumes knowledge of the key/IV to be able to analyze error propagation. I have read through every cryptography book I own, searched the interwebs, and have asked a question specific to this on crypto.SE. From this research so far, I have tentatively come to the conclusion that:

ECB can be easily and consistently identified, given a ciphertext of a large enough size.
Stream Ciphers (CFB, OFB, CTR) can easily be identified if the ciphertext is not an appropriate block length, however I have yet to find a way to differentiate stream ciphers from each other given ciphertext-only.

With this information, a ciphertext of block length (AES=128) can be assumed with ~99.22% certainty (1/128 chance of stream ciphertext being multiple of blocklen = ~0.78 chance) to be a block cipher. From here, the aforementioned detection oracle will be able to detect ECB if it is used. If ECB is not detected, you are left with CBC and PCBC as the two main possibilities. This is the best detection analysis I have come up with so far.


Proxy Server advantage and public ip visible By using a Proxy Server like 'Cisco WSA' the end user does not need to know where a web service like facebook.com lives, the end user just makes a request to a proxy server and it does the work of locating the web service. With this action our LAN does not know any public IP address, only our private IP address.

Can somebody tell me what are the disadvantages of public IP addresses (web server like facebook.com) visible on our LAN?

The advantage of a proxy is not primarily that public IP are not visible on the internal LAN, but hat you have a better control of what the clients can do and what not. Just some examples to illustrate the advantage of explicit proxies:

User Centric Authentication and Logging

With an explicit proxy you can enforce proper authentication at the proxy, which means that you know which user is connecting. This way you can enforce user-specific policies, do user-specific logging etc. Without an explicit proxy you usually somehow associate the IP address of the client with a specific user which only works when each user has its own internal IP address (i.e. not with terminal servers or similar).

Independence from Target Ports

With a explicit proxy requests for all of  http://example.com/, http://example.com:8080 or http://example.com:8000 will be sent directly to the proxy and the proxy will connect to the given ports (80, 8080, 8000). Without such explicit proxy inspecting the traffic for malware etc is much harder. In effect you would need to have port independent filters like offered by some next generation firewalls. But these port independent filters are known to have problems, i.e. the firewall can often be tricked into assuming the wrong protocol and thus uses the wrong inspection.

Independence from Target IP Address

A common way to bypass "transparent" inspection is to send contradictory information. For instance if a firewall should block bad-site but should allow good-site one might try to set the Host header in the HTTP request to good-site but then connect to the IP address of bad-site. Lots of web servers don't check the host header at all and thus bad-site would serve the content even if the Host header does not match.

A typical transparent inspection looks only at the Host header and decide that the request can pass because according to the Host header the target is good-site. An explicit proxy instead gets the full URL, applies the policy to the URL and only if the policy allows access it continues with connecting to the given host, i.e. the target IP address is determined by the proxy and not the browser.

Better Separation between Internal and External Sites

If a browser is configured to do all requests through a proxy than the proxy could be used to separate internal and external sites. I.e. it could either deny access to internal sites or at least restrict cross-origin requests from external to internal sites and thus protect against typical Web 2.0 attacks from outside (CSRF, XSS, DNS rebinding...).


Encrypting email addresses in php I'm building a website and am trying to figure out a way to encrypt the user's email addresses. It would be nice if, in case my database was stolen, the emails of my users weren't in plain text. I figured the user needs the email to login obviously, so if I encrypt it with their password as the key, or even the email itself, then I could still build a login function, that would work.

Problem comes with situation when I need the user's email address. For example, in a situation as a password reset or sending out a newsletter.
I could have a second field in the database with the user's email address, encrypted with a key that I know.

Can I encrypt something, where two keys work? Like a master key..... or am I being stupid?

If you only need to verify the email when the user provides it, then hash it, like vidarlo suggests, in the same way you would hash a password. No need for encryption here. The flip side with this approach is that you can never recover the email, even if you really need it (e.g. to contact your users in case of a compromies, as suggested in comments).

If you need to be able retrieve the emails, then encrypt them once with a key you control. No need to encrypt the email twice for different purposes here - just do it once. The tricky part with this solution is where to store the key.


How to implement an API-Key-Mechanism first of all: I am quite unsure about the title of the question, so if you have a better idea, please feel free to tell (:

I would like to know about best-practise examples where services (like Twitter or co) which offer APIs and want you as a developer to use some API-Key prevent third parties from getting that key.

I will explain my regards with bad examples:

As far as I know, Twitter and FB require you to use API-Keys for API-requests. That's fine for server-side applications, but as soon as you submit your key from a web-app or desktop-application, the key is visible to others.

Because you have to submit that key, it doesn't make much sense to super-securely store it inside your app. For the request, it has to be plain.

One thing you might do is to host your own web-service or wrapper which appends the key server side and then routes that request to the target server.

But this is not possible if Twitter/or whatever service you are using is limiting API-requests per IP or want's to create IP-based statistics.

So to sum it up: If I was in the position to create an API for others and don't want them to use SSL, what possibilities would I have to make sure their key is safe and can not easily be stolen?

The best practice is:

The basic idea. Create an API key (a 128-bit symmetric key) for each separate user account.  This key needs to be securely stored on the server, and also securely stored on the user's client.

For each request made by the client, add an extra request parameter that has a "signature" on the entire request.  The "signature" should be calculated as S = MAC(K, R), where K is the API key and R is the entire request, including all request parameters.  Here MAC should be a secure message authentication code algorithm, such as AES-CMAC or SHA1-HMAC.

It is the client's responsibility to compute the signature and append it to the request; it is the server's responsibility to verify the signature and ignore any request with an invalid signature.  You may also need to include an additional parameter with the request that identifies the user account making the request.

This will provide authentication of the request, but not confidentiality or replay prevention, and the client does receive an authenticated response from the server.

I suggest sending all requests over https (not http).  This will provide an additional level of security against a number of tricky cases.  The performance implications of doing this are less than you might think -- SSL has less performance overhead than most people think -- so don't discard this idea on performance grounds unless you've actually measured the performance overhead and found it to be unacceptable.

Additional things to watch out for.  You may want to use a one-time-use nonce, to prevent replay of authenticated requests.  I suggest using a cryptographic-strength random value (at least 64 bits long).  This is unnecessary if you are using https.

Make sure your server is written to defend against host-parameter pollution (HPP) attacks.  For instance, it should reject any request with multiple request parameters of the same type (e.g., http://example.com/foo.html?name=x&name=y).  Also, when writing server code, be careful when creating new requests based upon a request you received.  For instance, before processing each request, your server code might validate that the request comes with only the expected list of parameters and nothing more; discard duplicate parameters or unexpected parameters before processing the request.

Watch out for concatenation flaws if you decide to protect multiple values with the message authentication code.


Why can't the SSL handshake be done in one step? I'm sure there's plenty of obvious reasons for this, but why can't an SSL session be started with one round-trip?

It seems like this would be enough:

Client sends their public key
Server responds with:

Its certificate (public key + whatever is needed to verify it)
A symmetric key to use (encrypted with the client's public key / signed with the server's private key)

The problems I can think of are:

You may need to know the version of the protocol beforehand.

It seems like the protocol could be designed so that the client first sends a version, then their public key, and if the server doesn't understand it, it sends a "try this version" message", which would be faster in the best case (client and server both understand the same protocol), and just as fast as SSL in the worst case ("version 2...my public key", "I don't understand, use version 1", "version 1...my public key", "my certificate...encrypted key).
To make the protocol more backwards compatible, you could have two versions, one for the public keys to be exchanges and one for everything else. Only the public key version would break compatibility and require the second round-trip.
Obviously this wouldn't be backwards compatible with SSL now, but why wasn't it there in the first place?

Maybe more work for the server, since it needs to (1) generate a cryptographically secure symmetric key, (2) encrypt that key using public key encryption, (3) sign the result of that using public key encryption. Is the problem that it would be too easy to overload the server?
Something I'm missing?

This has just been bothering me all day, since it seems so obvious, but there has to be some glaring flaw that I'm missing (and that's why I'm not a security researcher).

EDIT:

A link posted by @lour has this quote:

  In a TLS handshake, the "Finished" messages serve to validate the entire handshake.  These messages are based on a hash of the handshake so far processed by a PRF keyed with the new master secret (serving as a MAC), and are also sent under the new Cipher Spec with its keyed MAC, where the MAC key again is derived from the master secret.  The protocol design relies on the assumption that any server  and/or client authentication done during the handshake carries over to this.  While an attacker could, for example, have changed the cipher suite list sent by the client to the server and thus influenced cipher suite selection (presumably towards a less secure choice) or could have made other modifications to handshake messages in transmission, the attacker would not be able to round off the modified handshake with a valid "Finished" message: every TLS cipher suite is presumed to key the PRF appropriately to ensure unforgeability.  Once the handshake has been validated by verifying the "Finished" messages, this confirms that the handshake has not been tampered with, thus bootstrapping secure encryption (using algorithms as negotiated) from secure authentication.

So why not just have the server and client both sign their cipher-negotation messages with their private keys? I know, more work, but still faster than an RTT, right?

If I understand your proposal correctly, there are at least two vulnerabilities in it:

It allows replay attacks
It allows man in the middle attack

Replay attack

An attacker may be able to sniff an encrypted communication, record it and replay it at a later time.

There are two common approaches to prevent it: Usage of time stamps, which only works in a controlled environment in which you can be sure that the clocks are synchronized. Therefore the common approach In order to prevent this, both parties have to send a random number and require the other party to prove that it got this number, by either sending it back or using it in some mathematical operation.

Man in the middle attack

The browser sends his public key to an attacker. The attacker contacts the real server and sends his own public key.

The server answers with his certificate and the session key both signed with the private key of the server and encrypted with the public key of the attacker.

The attacker decrypts information, and re-encrypts it with the public key of the client. The signature stays valid because the attacker does not modify the certificate or session key. It stores the session key for later use.

The client verifies the certificate and signature of the real server, and is happy.

Other approaches

There is another approach by Google called SSL False Start, that does not have these issues.


Shared secret when using JWT with an HMAC for authentication I'm currently implementing user authentication on a REST-like API that is used by an Android client. After some research I think that JWT (JSON Web Token) is a good way to do it.

The basic procedure I have planned is: The user logs in using username/password (over HTTPS). The server validates the password and then generates a JWT that includes some kind of user ID, signing it with RS256 (asymmetric using RSA, so the client only has the corresponding public key), and sends it to the client. To do an API call, the client will send the JWT to the server. All the server does then is validate the JWT using its private key, and also checking that the signature algorithm is the one expected by the server. If the validation succeeds, the server can trust the user ID in the token. A client can't pretend to be a different user, because it would need the server's private key to generate a correct signature if the JWT's payload is changed.

Now suppose I wanted to use HS256 (symmetric using a HMAC) instead, maybe because the resulting signature is shorter. As far as my common sense goes, in this case, only the server is allowed to know the (single) key.

But here comes the confusion: Reading up on using HS256 with JWTs, some sites I have seen seem to suggest that the key is a "shared secret", meaning that both the server and the client know it. But if that's the case, the client could simply alter the JWT's payload and create a valid signature using the shared key. Any logged-in user could then pretend to be any other user by simply altering the user ID in the JWT, so that's no better than not validating a signature at all. Is there something I'm missing, or does it simply not make sense to allow the client access to the key when using HS256? Have I misread the sites suggesting that the HS256 key is shared?

The only way I could think about that would allow both parties to know the key is using a separate key for each user. But even then, any JWT payload data except the user ID (e.g. an "isAdmin" flag) could still be changed at will.

"Shared secret" in this case typically means between multiple servers, not between the client and the server.  Typically, JWTs can be done using symmetric encryption - in which case all servers that need to verify the token need to have the shared secret - or asymmetric encryption, in which case only the server actually doing the authentication needs to have the private key, the other servers can just use the public key to verify that the token is appropriately signed.

In no case should a client have the ability to alter their token - they receive the token upon presenting credentials, then use the token to obtain services, either from the same server, or from other servers who share a trust relationship with the authorizing server (either through the public/private key knowledge or through a shared key)


Can a MiTM essentially block a connection? If the target's traffic is going through the MiTM, then can't the spoofer find a way to just not traffic the connection? Or traffic the connection very slowly? Over all what I'm asking is that instead of a MiTM attack being for traffic analysis, could it be used to simply block a connection?

In the common understanding of a man in the middle attack, the attacker can actively tamper with the traffic, i.e. not only passive sniffing. There are typically no limits assumed of what exact modifications the attacker can do, which also means that they could simply drop the traffic and thus block communication.


Is it possible to track someone using their mobile number in the UK? This is something I've wondered for a while - is it theoretically possible to track someone using their phone number in the UK? It's a classic Hollywood trope and I'm wondering just how much truth there is to it and how feasible it would be.

Doing some basic research returns plenty of services and apps that claim to be able to do it. For example, here:

  Our location services use a variety of technology to locate a handset.
  Primarily we use cell-ID to locate a mobile phone to within a certain
  transmission cell. Accuracy is greater in areas of high population
  density (e.g. large towns and cities), and reduces as population
  density reduces (e.g. in the countryside)...

  Our service will not work with landline numbers. It will only give the
  location of mobile phones registered to a UK mobile cell network.
  The service does not require the user to install any apps or other software. The service works cross-platform, which means it can work
  on Android, iPhone, Windows Phone, and older basic phones.

...and here:

  So if you’re concerned about the location of your family members, want to know the location of your employees, find a lost phone, or want to track down a suspicious call, phone number tracking is as real as they show in the movies!

I also came across this which seems like it could be of interest.

Is it possible to track a phone using a UK mobile number, and if so, is it limited to corporate entities? How easy or hard is it to do for the average technologically capable individual?

At a technical level, the only entity that should be capable of performing this tracking is your carrier (as far as I know). They are able to locate your phone using the location of cell towers the phone is currently in communication with.

However, much to the unsuspecting consumer, that data can be sold to 3rd party entities. It is likely that the company in question is purchasing this data from the carrier(s), and/or has some sort of agreement with them. In the US, there have been rather questionable practices regarding who the data is given to.

So, it isn't that difficult, as long as you find a company/carrier willing to provide the data at a price you can afford.


Buffer overflow - terminator canaries I am reading an article on buffer overflow protection here.

For terminator canaries, I follow the part that if a terminator like a zero is used for a canary, the attacker would have a terminator in the overflow, which will cause the overflow to stop, preventing overflow of return address.

But the next sentence is not clear:

The undesirable result is that the canary is known. Even with the protection,
an attacker could potentially overwrite the canary with its known value, and
control information with mismatched values, thus passing the canary check code,
this latter being executed soon before the specific processor's
return-from-call instruction.

I am not able to follow this argument.

Does it imply that terminator canary can be bypassed in any way ?

The basic idea of a terminator canary is that when an attacker attempts a buffer overflow, they're forced to over-write the canary value.  The program can then detect that the canary has changed value and take appropriate actions.

The value 0 is somewhat special in programming: many languages use it as an end-of-text marker.  If an attacker is trying to overflow a text buffer, the use of a 0 as a terminator canary means the attack will fail: in order to keep the canary from changing, they need to include a 0 in the oversized input in a location that will cause almost all of the excess input to be ignored.

This has a problem, though: if the input is handled as binary data rather than as text, the fact that the canary has a known, fixed value means the attacker can simply over-write the canary with itself, producing an undetectable overflow.

Edit: code examples

/* This reads a length-tagged packet of up to 16 bytes length from an input stream.
 *
 * Note that since the programmer forgot to check the length of the input,
 * a packet of more than 20 bytes (give or take alignment) will overflow onto
 * sensitive parts of the stack.  If bytes 17 through 20 of the outsized packet
 * are 0s, this overflow won't be detected.
 */
size_t readPacket(char *stream)
{
    size_t length;
    char packet[16];
    uint32_t canary = 0;

    length = (size_t)(*stream++);
    memcpy(packet, stream, length);
    processPacket(packet, length);

    if(canary != 0)
        exit(0);
    return length;
}

/* This reads a username from an input stream.
 *
 * Note that since the programmer used strcpy() rather than strlcpy(), a
 * string of more than 20 bytes (give or take alignment) will overflow onto
 * sensitive parts of the stack.  However, since strcpy() stops copying once
 * it encounters a byte with the value 0, in order for overflow to reach a
 * sensitive part of the stack, it must change the value of the canary.  If
 * this happens, exit() is called and the changed stack is never used.
 */
size_t readName(char *stream)
{
    char userName[16];
    uint32_t canary = 0;

    strcpy(userName, stream);
    processUserName(userName);

    if(canary != 0)
        exit(0);
    return strlen(userName);
}

In a real-life example, the canaries and canary-checking code may be inserted automatically by the compiler rather than manually by the programmer.


Is it possible to have securely encrypt chat on server you don't trust? Let's say I have app that just runs some encrypted chat on server I don't own. Is it possible to have the chat securely encrypted without the owner of the server having access to the encryption keys ?

If the untrusted server is both hosting the software/web pages used for encryption and is relaying the encrypted messages then you cannot trust the encryption to keep your secrets because the software doing the encryption comes from an untrusted source.

If instead the software used for encryption comes from a trusted source and the untrusted sever is only relaying the encrypting messages then the server has no way to read or modify the messages, provided that the encryption was done properly. The server might at most try to disrupt communication by not forwarding some messages, duplicating messages or changing the message order. But properly done encryption should at least detect such manipulations.


Can a SSH jump host act as MITM? Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud").

Meanwhile the corporate/customer/whatever network(s) have firewall ACLs permitting SSH traffic from the bastion/jump host to the internal SSH server(s).

Is it possible for an evil actor to exploit the jump host to enable viewing of SSH traffic ?  Or is the traffic that flows over the jump host always end-to-end encrypted ? (i.e. the bastion/jump host always just sees an encrypted flow because the traffic between client and internal server uses the internal server's keypair).

For the avoidance of doubt over terminology, when I talk about jump host I'm talking about commands such as :

ssh -J bastion.example.com internal.example.com

or

scp -oProxyJump=bastion.example.com internal.example.com

From man ssh

     -J [user@]host[:port]
         Connect to the target host by first making a ssh connection to
         the jump host and then establishing a TCP forwarding to the ulti-
         mate destination from there.  Multiple jump hops may be specified
         separated by comma characters.  This is a shortcut to specify a
         ProxyJump configuration directive.

As it is creating a TCP tunnel from your computer, through the jump host, to the target, two ssh connections will be established, one to the jumphost, and another one inside the tunnel. The one inside the tunnel will be encrypted.

The jumphost could hijack the connection target, but then the key will not match.


Running jobs as local administrator vs domain administrator and their risks I know for best practices we should always give an account least privilege and use that account to run jobs etc. However our windows jobs often require elevated privileges in order to perform the required task.

How do you deal with jobs that must be run with elevated privileges using admin account? Will running the job with local admin be more secure than run with a domain admin account?
How do I secure the jobs that are run using admin account.

How do you deal with jobs that must be run with elevated privileges using admin account? Will running the job with local admin be more secure than run with a domain admin account?

Are you sure that the jobs must be run with administrator privileges. Do they really use every single ability delegated by that permission? Using a domain administrator account obviously allows the script administrator access or all of the domain computers (and servers). Also the ability to adjust domain membership and group policy. They might add another account to the domain administrator group for example. Local administrator is a lower privilege and is much safer.

  How do I secure the jobs that are run using admin account.

Prevent users from modifying them.

On a server computer with restricted access this is relatively feasible. If the jobs take non-trusted user input, they must be programmed securely to prevent remote code execution style vulnerabilities (not a small topic).

On desktop machines where the user can boot a thumbdrive or even take the hard drive out (evil maid attack) the protection of these scripts is less certain.


How does a server obtain the IP Address of a user? How does a server obtain the IP Address of a user? Is it possible to fool the server by spoofing the IP Address?

When you send a request to the server, the server need to know where to answer, it's with your ip address. This is directly based on the TCP/IP protocol and in a lower level than web servers.

For the reason why Firebug doesn't show your IP address, it's like when you receive mail (paper), you have your address written in front, and the sender in the back. Firebugs shows you the content of the letter, not the sender and the receiver address (IP in IT).


Why don't servers vulnerable to NTP and DNS reflection attacks get blacklisted immediately? With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore mitigate the attack?

I expect any decent DDoS protection service (Prolexic, CloudFlare, etc.) will do exactly what you suggest.

If you consider a basic web presence, where the site has limit bandwidth to the Internet, an on-site blacklist doesn't help. All that NTP traffic will saturate the link, so it doesn't matter that the on-site firewall immediately drops the traffic - it still interferes with legitimate users. This is why you need upstream filtering to mitigate a DDoS attack.


Does iPhone home button act as Secure Attention Key? On an iPhone, does pressing the home button act as a Secure Attention Sequence?

The home button is a physical button.  You can press the home button whereever you are and go back to the home screen.  Is this a secure, unspoofable way to get to the home screen?  Is it adequate to serve as a Secure Attention Sequence?

On Windows, Ctrl-Alt-Del acts as a Secure Attention Key.  Applications can't hook or intercept Ctrl-Alt-Del.  Instead, a Ctrl-Alt-Del keypress event goes straight to the OS, which takes control of the UI and displays a trusted login screen.  As a result, after pressing Ctrl-Alt-Del you can be sure you're interacting with the OS, not some malicious application that's trying to spoof you.  I'm wondering if the home button on the iPhone has similar properties, or if there is any secure attention sequence that works for the iPhone.

For instance, if there was a way that an iOS app could "hook" home button presses, so that pressing the home button doesn't take you to the home screen but instead notifies the app and lets the app respond appropriately, then the home button would not be a Secure Attention Sequence: a malicious app could hook it, and when the user presses the home button, display a screen that looks exactly like the home screen but it is actually presented by the malicious app.  However, I don't know enough about iOS to know whether those kinds of shenanigans are possible or not.  So, is the home button a Secure Attention Key, on iOS?

My brief research on the Home button showed two trends: (a) the user bypassing it with Accessibility options; (b) using certain features to prevent children from hitting it. It appears that it's a SAK in practice whether or not it's designed for it. Note that this applies to apps that haven't compromised iOS security somehow. If they do that, they might inject code to subvert the Home button or anything else.

So, the trick should help against problematic apps that can't hack OS or drivers. The next question, which I leave to comments on mine, is whether apps can successfully DOS the phone to the point they render it and home button unusable. I don't use iPhones so I'm not sure of their crash-resistance properties.


Default behavior cookie flags in 2021 I'm under the understanding that in 2019, Chrome and Firefox both planned to move to SameSite=lax default for all unspecified cookies. In addition, recently, Chrome decided to set defaults based on other information such as the 'secure' flag, and whether or not communications were sent over HTTPS. My understanding is that Chrome has since backflipped on this,
Can SameSite be relied on as an effective control against CSRF for HTTP POST requests? If a cookie does not have no SameSite directives and the website have no other anti-CSRF, should it be considered a vulnerability?
Are there any other impacts relevant to samesite in modern, and historic browsers? Does IE11 support SameSite? What about IE11 on Windows 7 (noting that for some reason, Microsoft decided to not implement/disable CSP on Win7/IE11), What about when using unencrypted HTTP or when the secure flag is not set (I ask because other Chrome cookie behavior seems dependent on this facto)? Is there any other unexpected behaviors of samesite?

The CSRF attack scenario relies on the victim browsers which are almost always latest greatest.  Having an outdated browser (even a Firefox of few major versions back) presents a greater risk than CSRF due to chances of breaching the browser itself.
The SameSite attribute (and the transition to the Lax value from None by default) guards applications whose UI is hosted by the same host with API or by a sub-host of API.  Such same-site UI hosting turns friendly to own API cookies. CSRF attacks rely on accidental surfing foreign (malicious or hacked) origins. Browsers will ignore SameSite=Lax and strict cookies when these origins send malicious requests to API.  (Surfing through a hacked sub-host of API will send the API cookies, so this less likely chance needs weighing).
The Lax or Strict value of the attribute (or its default Lax value) turns prohibitive for previously normal operation of applications where API is hosted by a sub-host of UI or by a sibling host of UI or by an unrelated host.  These disperse applications turn to using tokens.  Tokens are not sent by the browser's platform authentication in case of a CSRF attack.
I read that only HTTP GET requests were supposed to carry Lax cookies across sites (if resulting from a click, I guess). But the browser vendors permitted fresh Lax cookies to be sent with POST requests for some transitional period.
Finally, from my other reading, I suspect that Microsoft web apps and OpenID authentication implementations heavily depend on passing cookies across sites.  That is, they fail in newer browsers.


What are useful use cases for employing asymmetric cryptography in a database? I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) encryption. Given that access to an RDBMS and a specific database is typically protected and restricted, I cannot see the usefulness of this functionality. I appreciate that symmetric encryption of database fields guards their confidentiality, if the database leaks without the corresponding keys (which can presumably exist only transiently in the application server's memory). However, I fail to see what asymmetric cryptography can add. Some scenarios I can think of are the following.

Have one database client write data with the public key, and another one, running in a more secure environment, read and process data using the private key.
Store data that arrives to the application server already encrypted using the employed public key and exactly the same encryption method.

None of the two uses cases seems particularly compelling to me.  Am I missing something?  How are database fields encrypted with asymmetric cryptography used in practice, and what is the underlying threat model?

Suppose your web application needs to store your users' credit card information for automated recurring billing purposes.  For PCI compliance, you might decide to offload the the storage of the credit card information to a service like Authorize.Net that stores and tokenizes the credit card information in a PCI-compliant way.
However, you don't want to be locked-in to using Authorize.Net forever - you want to be able to migrate to another vendor if things go south with Authorize.Net.  But, you've seen from posts like this that Authorize.Net does not make it easy for you to export your users' credit card information from their system.
So, you decide that it's best to encrypt and store the credit card information in your own database, in addition to storing the information in Authorize.Net.  Asymmetric cryptography is ideal for this use case - the data is encrypted on the server using the public key, and the private key is stored offline.  This way, you have the ability to decrypt the credit card information if you ever need to (using the private key) - but if the server is breached by an attacker, he has no way of decrypting the credit card information (because the private key not stored on the server).


How to change the default/preferred SSL cipher in Linux? Is there any way I could change the default/preferred cipher for SSL, so that any application/process in Linux which uses SSL would have to use that specific cipher (RC4-SHA for example) for it's connection to the outside world?

I am using Xen hypervisor in Ubuntu 14.04 and I have installed openssl. Xen can use SSL in order to "securely" migrate (transfer) a VM to another host in the LAN. I need to be able to change the preferred/default SSL cipher and do some tests.

There are various SSL stacks used in Linux: NSS for the Firefox and Chrome and usually OpenSSL for the rest. While OpenSSL has its DEFAULT ciphers which are compiled into the library several users of OpenSSL use their own cipher sets. Notably languages like Python, Perl, Ruby have all their own preferred cipher sets coded into their various libraries.

Which means, that there is no central place where you could change the ciphers used by all application. You have to do it mostly for each application separately.


Can an individual get an extended validation certificate? I am not saying I am actually going to buy one but I am wondering if an individual can get an Extended Validation SSL certificate?

I know this is intended for companies / organisations but would this technically be possible?

According to Section 7.1 of the Extended Verification Guidelines a certificate verifies the following:

  (A) Legal Existence: The CA has confirmed with the Incorporating or Registration Agency in the Subject’s
  Jurisdiction of Incorporation or Registration that, as of the date the EV Certificate was issued, the Subject
  named in the EV Certificate legally exists as a valid organization or entity in the Jurisdiction of Incorporation
  or Registration;

Section 8.5

  The CA MAY only issue EV Certificates to Applicants that meet the Private Organization, Government Entity, Business Entity and Non-Commercial Entity requirements specified below.

I believe the answer is no.


Is cookie information stored on the server side? I thought cookies are stored on client side only, as files. Then  I realize if cookies are not stored on server side, how could a server match a cookie just received from a client to some session or other information created in the past?

So is it correct that cookie information is also stored on the server side?

How does a server store cookie information?

I have searched about "client side cookie" and "server side cookie" and reached   several discussions including

https://www.quora.com/Are-cookies-client-side-or-server-side,
https://stackoverflow.com/questions/6922145/what-is-the-difference-between-server-side-cookie-and-client-side-cookie.

Thanks.

This is a great security question. One must understand the mechanics of what they work with to ensure they are building secure software.

Security

There is no added significant security risk when a server has access to cookie information. Servers are already a privileged system that needs to be strongly protected.

  [Comment] ...how can [a] server identify a new request is from the same user as some
  previous requests, without memory of the previous requests coming from
  some user...?

If the server stores encrypted or signed data in a client-side cookie, the server can verify that. It can deduce that only an authorised server could have stored that cookie.

A good modern example of this is JWT - https://jwt.io/. They can be sent in a cookie, but typically they go into the authorization header for a Web API HTTP Request. If you understand JWT more, you can understand the cryptographic principles that can be deployed with simpler mechanisms for smaller amounts of data in cookies.

Knowledge

  how could a server match a cookie just received from a client to some
  session or other information created in the past?

Cookies are stored in the client's browser with a timeout after which they are deleted. Upon every HTTP request to the server, they are sent to the server automatically. The cookie is usually set by the server, not the client (but it's possible).

The server typically uses the direct value, or decrypts a value for a local database lookup. For example, the UserID value could be stored in the cookie encrypted.

A key architectural reason for using cookies, is to maintain a session linked to the identity of the user. They are also used as a type of distributed data store, so the server has this information already upon HTTP Request without having to look it up on disk/db which incurs latency.

A session might be associated with a key (GUID) in memory on the web server, or it could be a key for a new session record in a database. In both cases, the key is relayed by cookie.

  How does a server store cookie information?

The server MAY store them, but that's not how people view them conceptually. In a way the server does store the data - a session key is the primary key of a record (database or hashed dictionary lookup). For an encrypted UserID, the server-side does have they key too. In a way, the client isn't "storing" it, it's more like a copy of a key. But it is possible, and likely occurs, that clients store distinct information that isn't persisted on the server-side.

  is it true that a server always has records of cookie info?

No. Here are some scenarios where the server doesn't have records of the cookie info:

Javascript on the client-side sets a cookie. Eg. "OrganisationID=10" indicating that the user has changed organisation context across all browser tabs.
Server encrypts some data for the user to hold onto. Eg. "Roles=Admin,Developer,Staff" so that the server can enforce roles on functions without needing to do a lookup on the database

Although the server-side doesn't always have that information somewhere it usually does, because cookies are used for context. When there is a HTTP Request, the server needs to know who it's coming from, what roles they are authorized to use, and whether they have been seen before.


Eavesdropping on a specific port of machine in the WLAN from a different machine, possible? (using arpspoof) I'm using netcat -l 555 option to communicate between two computers(Linux) on port 555, is there any way I can eavesdrop to whats going on in that conversation from a 3rd computer?

After the second machine responds with netcat <First_machine_IP> 555 the port closes so the conversation remains "private".

Im arpspoofing and every packet is transfered through my machine first , can I exploit that to see the conversation? any tool to do so? I heard something about port mirroring but im not sure it works remotely.

I tried to explain in which cases WPA networks are subject to "spyability" by other users  in this answer. Short: If the attacker isn't on the same WPA2 network, you're safe. If the attacker is on the same network, you're only safe if the network uses WPA2-Enterprise, and not WPA2-PSK.

For unencrypted networks, you can obviously simply sniff off the unencrypted packets from the air – no need to ARP-spoof anything. It's simply like sitting in the middle of a conversation.

For WEP, it's the same when the attacker is in the same network. If the attacker's not in the same network, he'd have to crack the WEP encryption – but that's sadly pretty realistic, given that you can derive the key by triggern known plaintext in relatively short time. As soon as you have the key, sniffing is as easy as on an unencrypted network (or an Ethernet hub, if you remember these).

ARP spoofing is a technique to make other computers send data to you instead of their intended target – but that probably won't work in a simple Wifi – all the station will probably want to send packets to the access point, which doubles as router, and you'd have to convince that router that you are the legitimate holder of its IP address the moment you try to send forged ARP replies.

That'll simply fail, usually. In more complex networks, the access point might not be the router, but still, you'd very likely have to poison the ARP cache on the "backbone" side of the Access Point – a non-trivial problem.


Cross-certification between worlds like X.509 and PGP? Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert - say, a self-signed SSL or code signing certificate - and provide a detached signature with my PGP key. Someone who trusts my PGP key can then trust the X.509 cert, after verifying the signature.

This involves some manual steps but it is less cumbersome and less error-prone than telling people to compare long key fingerprints digit by digit. If they don't reduce the detailed comparison to a quick glance or skip the check altogether...

Are there any tools that support cross-certification directly - for example storing an 'alien' certificate as a property of a 'native' certificate - or indirectly? Any interesting papers that explore such uses?

ATM I'm investigating the problem per sé but where the shoe actually hurts is that the extortionate prices for code signing and SSL certificates (server and client) leave private people and small businesses in the lurch.

The trust systems of OpenPGP (web of trust) and X.509 (hierarchical) are not compatible, nor are the signatures (the "math behind" both of them in respect to the keys indeed would be, as long as the algorithms are defined for both, for example with RSA).

While you could easily map the hierarchical X.509 trust system to the more powerful (and complex) OpenPGP web of trust, the other way round is not possible for a general solution. What would be possible indeed is generating trusted X.509 certificates for all validated OpenPGP keys.

This would require proprietary software (in the sense that there is no standard defining how to do this) on each client computer that wants to validate, I'm not aware of any solution for this.

What is available is the Monkeysphere Firefox Add-On for validating against OpenPGP certificates in HTTPs, which tries to bring OpenPGP to the web -- but is propietary (with the same definition as above) anyway, and I've never seen it being used in the wild.


Extracting EC parameters to specified format I have ECDSA public key:

-----BEGIN PUBLIC KEY-----
//public key data
-----END PUBLIC KEY-----

I'd like to create ASN.1 structure like this:

Parameters:: = CHOICE {
    ecParametersECParameters, namedCurveCURVES. & id( {
                                                     CurveNames}
), implicitlyCANULL}

and extract Q value. It is possible to extract such parameters from public key?

You can do this using OpenSSL:

$> openssl ec -in /tmp/blih -pubout | openssl ec -text -pubin

read EC key
writing EC key
read EC key
Private-Key: (256 bit)
pub:
    04:b0:36:49:b9:76:9a:1b:fd:72:1a:cf:22:d9:eb:
    29:e8:b4:fe:0b:fc:93:e6:35:9e:cd:c4:a0:15:00:
    27:49:af:40:8c:94:6c:50:58:da:e9:9b:88:61:83:
    34:d0:21:6d:03:b6:18:43:41:65:50:d4:db:d0:bb:
    75:8c:cf:fb:6f
Field Type: prime-field
Prime:
    00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:fe:ff:
    ff:fc:2f
A:    0
B:    7 (0x7)
Generator (uncompressed):
    04:79:be:66:7e:f9:dc:bb:ac:55:a0:62:95:ce:87:
    0b:07:02:9b:fc:db:2d:ce:28:d9:59:f2:81:5b:16:
    f8:17:98:48:3a:da:77:26:a3:c4:65:5d:a4:fb:fc:
    0e:11:08:a8:fd:17:b4:48:a6:85:54:19:9c:47:d0:
    8f:fb:10:d4:b8
Order:
    00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:fe:ba:ae:dc:e6:af:48:a0:3b:bf:d2:5e:8c:d0:
    36:41:41
Cofactor:  1 (0x1)
writing EC key
-----BEGIN PUBLIC KEY-----
MIH1MIGuBgcqhkjOPQIBMIGiAgEBMCwGByqGSM49AQECIQD/////////////////
///////////////////+///8LzAGBAEABAEHBEEEeb5mfvncu6xVoGKVzocLBwKb
/NstzijZWfKBWxb4F5hIOtp3JqPEZV2k+/wOEQio/Re0SKaFVBmcR9CP+xDUuAIh
AP////////////////////66rtzmr0igO7/SXozQNkFBAgEBA0IABLA2Sbl2mhv9
chrPItnrKei0/gv8k+Y1ns3EoBUAJ0mvQIyUbFBY2umbiGGDNNAhbQO2GENBZVDU
29C7dYzP+28=
-----END PUBLIC KEY-----

I believe Order is the Q parameter of the curve.

Also Keep in mind that you might not have the same output because the public key might not include the EC parameters, if not it is said "implicit parameters" because the recipient knows what curve and parameters to use. In this case you are out of luck if you don't know what curve it is.

If you know the curve you can extract the parameters using OpenSSL again:

$> openssl ecparam -name secp256k1 -param_enc explicit -text

Field Type: prime-field
Prime:
    00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:fe:ff:
    ff:fc:2f
A:    0
B:    7 (0x7)
Generator (uncompressed):
    04:79:be:66:7e:f9:dc:bb:ac:55:a0:62:95:ce:87:
    0b:07:02:9b:fc:db:2d:ce:28:d9:59:f2:81:5b:16:
    f8:17:98:48:3a:da:77:26:a3:c4:65:5d:a4:fb:fc:
    0e:11:08:a8:fd:17:b4:48:a6:85:54:19:9c:47:d0:
    8f:fb:10:d4:b8
Order:
    00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:fe:ba:ae:dc:e6:af:48:a0:3b:bf:d2:5e:8c:d0:
    36:41:41
Cofactor:  1 (0x1)
-----BEGIN EC PARAMETERS-----
MIGiAgEBMCwGByqGSM49AQECIQD////////////////////////////////////+
///8LzAGBAEABAEHBEEEeb5mfvncu6xVoGKVzocLBwKb/NstzijZWfKBWxb4F5hI
Otp3JqPEZV2k+/wOEQio/Re0SKaFVBmcR9CP+xDUuAIhAP//////////////////
//66rtzmr0igO7/SXozQNkFBAgEB
-----END EC PARAMETERS-----

Note the -param_enc explicit flag.


Sqlmap: bypass website security filtering SQL reserved words I'm using sqlmap to get a website's DB and found out that the site is time-based boolean vulnerable; but the target is showing SQL errors, which made me think that it would be an injection error.

I was curious, so I turned on the  --parse-errors  option which showed that some SQL reserved words are filtered; something like:

AND became A_N_D, SELECT became S_E_LE_C_T ...

and so on...

Is there a way to bypass this with sqlmap? Some tamper option?

I had a similar situation with a test, the applicationn used SQL server, there was a WAF filtering the data input, then I couldn't use reserved words, because the WAF was blocking the reserved words. The solution was double encoding, you just need to apply double encoding to one letter, for example, you want to inject AND, if you encode letter A using URL encoding, you will have something like this: %41ND; the WAF will interpret those characters as A, then it will not work, then you have to apply a second encoding on the %, then you will have something like this: %2541ND; the WAF will interpret the %25 as % and the database will receive the %41ND, it will do a canonicalization process and execute the command AND. I exploited this SQL injection manually, I'm not sure if SQLmap has this bypass technique, I recommend you to review the tamper options, maybe there are something similar.

Good luck.


What, or who, exactly is a Certificate Authority (CA) for TPM attestation? I'm learning about and researching the Trusted Platform Module (TPM) to incorporate into a solution involving remote machines.

As I understand it: all attestation methods (AIK, DAA) still require someone to know your identity (well, the chip's identity) and issue a certificate based on this identity.  The anonymity only works because the CA is trusted not to reveal your identity in the process.  Your identity is only safe from the verifier.

In this case, who is the CA?  The manufacturer?  And if so, is it the motherboard or chipset manufacturer (e.g. ASUS (mb) or Intel (chipset) or Winbond (IC)?).

Also, how would one contact these CA's?  Do they have public facing interfaces?  What do I send them?

In short, how do I start using remote attestation right now, with respect to CA authority?  How do I contact them and who are they exactly?

I think you are certainly right, the verifier knows your TPM is trusted. In the DAA case the verifier cannot map TPM to user though.

In AIK certificate enrollment, the Certificate Authority may well be the same entity that verifies the AIK certificate.

Whereas in DAA, there is no Certificate Authority involved. There is an issuer which works with a TPM platform to create credentials. Your TPM platform later creates a AIK and signs this AIK with a DAA signature based on those credentials. This signature and the public key is made available to a verifier. The verifier cannot determine the owner of the TPM based on the information it receives but knows it's trusted. The issuer can be the same as the verifier. An application is some some subscription service where you want some privacy.

You can create your own CA certificate using openssl. web search is your friend.

the Trousers test suite tools can be used along with IBM's software TPM without a TPM hardware chip to try out attestation. I've used a real Infineon TPM using a beagleboard as the TPM and a Kontron with a custom X86_64 Yocto-built linux as my CA. I've also done DAA (I made a lot of fixes to my own copy of TrouSerS 0.3.10 code to get DAA to work) both with the hardware TPM and IBM software TPM. As for AIK certificates, testsuite has Tsp_TPM_CreateIdentity.c which creates an AIK and activates the AIK. Right after creating a AIK that is when you follow the guide in the link below to send out the identity proof to the CA. The identity proof contains the AIK that is created from Tspi_TPM_CollateIdentityRequest. Once the CA sends back the AIK certificate then you call Tsp_TPM_ActivateIdentity and keep the AIK certificate. The late Hal Finney ran a privacy CA but his web link has been inactive for a year and a half.

AIK certificate enrollment https://www.trustedcomputinggroup.org/files/resource_files/738DF0BB-1A4B-B294-D0AF6AF9CC023163/IWG_CMC_Profile_Cert_Enrollment_v1_r7.pdf


XSS inside CSS when " is encoded? I'm trying to make XSS work on one site.It allows me to edit CSS which is then included inside web page source , but it won't allow me to use " , only ' . Source is like this:

body {
  margin: 0;
  padding: 0;
  background-color: #EFEFEF;
  overflow: hidden;
  font-family: Arial, Helvetica, sans-serif;
}

Can't XSS inside CSS be exploited if " is blocked.Thanks

This policy might prevent breaking out of a double quoted style attribute as in

<div style="payload goes here">

or if this CSS is stored in a DB it might be a SQL Injection filter.

To answer your question though, yes, you can still attack the CSS itself with single quotes

margin-left:expression('alert(1337)')

which will work on IE7 and older or in some more recent IE quirks modes and it won't stop you from embedding double quotes visible to CSS as in

margin-left:expression('alert(\22 pwned\22)')


How did "tech-supportcenter" phishers trick Google? Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE
Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with much different security implications than misleading advertisement.

Rather, the displayed target URL of a Google ad is not reliable and may conceal the actual destination as well as a chain of cross-domain redirects. The scammers possibly compromised a third-party advertiser and hijacked their redirects to lead you to the scam site.

Masking link targets is a deliberate feature of Google AdWords. It is generally possible to specify a custom display URL for an ad link which can be different from the effective final URL. The idea is to enable redirects through trackers and proxy domains while keeping short and descriptive links. Hovering over an ad will only reveal the display URL in the status bar, not the real destination.

Here is an example:

I'm searching for "shoes".
The first ad link displays www.zappos.com/Shoes:

When I click on it, I actually get redirected multiple times:

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChXXXXXXXd-6bXXXXXXXXXXXXkZw&ohost=www.google.com&cid=CAASXXXXXp8Yf-eNaDOrQ&sig=AOD64_3yXXXXXXXXXXXXXYX_t_11UYIw&q=&ved=0aXXXXXXHd-6bUXXXXXXXXXwIJA&adurl=
-- 302 -->
http://pixel.everesttech.net/3374/c?ev_sid=3&ev_ln=shoes&ev_lx=kwd-12666661&ev_crx=79908336500&ev_mt=e&ev_n=g&ev_ltx=&ev_pl=&ev_pos=1t1&ev_dvc=c&ev_dvm=&ev_phy=1026481&ev_loc=&ev_cx=333037340&ev_ax=23140824620&url=http://www.zappos.com/shoes?utm_source=google%26utm_medium=sem_g%26utm_campaign=333037340%26utm_term=kwd-12666661%26utm_content=79908336500%26zap_placement=1t1&gclid=CI3vqXXXXXXXXXXXXXBBA
-- 302 -->
http://www.zappos.com/shoes?gclid=CI3vXXXXXXXXXXXXXMBBA&utm_source=google&utm_medium=sem_g&utm_campaign=333037340&utm_term=kwd-12666661&utm_content=79908336500&zap_placement=1t1

Obviously, Google has strict destination requirements for ad links in place and an ordinary customer won't get their ad approved if they set the link target to a completely different domain. But scammers do occasionally find ways around the vetting process.
At least, Google's policy about "destination mismatches" is pretty clear:

  The following is not allowed:

  Ads that don't accurately reflect where the user is being directed
  [...]
  Redirects from the final URL that take the user to a different domain [...]

Trusted third-party advertisers may be permitted to issue cross-domain redirects, though. Some of the exceptions are listed here, e.g.:

  An example of an allowed redirect is a company, such as an AdWords
  Authorized Reseller, using proxy pages. [...]

  For example:

  Original website: example.com
  Proxy website: example.proxydomain.com

  We allow the company to use "example.proxydomain.com" as the final
  URL, but retain "example.com" as the display URL.

One major weak spot is that Google doesn't control the third-party redirectors (in above example, that's pixel.everesttech.net). After Google has vetted and approved their ads, they could simply start redirecting to a different domain without immediately getting noticed by Google. It's possible that, in your case, attackers managed to compromise one of these third-party services and pointed their redirects to the scam site.

In recent months, there have been several press reports about an almost identical scam pattern, e.g. this report about a fraudulent Amazon ad whose display URL spells out amazon.com but redirects to a similar tech support scam.

(By now, your discovery has also been picked up by a few news sites, including BleepingComputer.)


Is it possible to exploit a server using an C library with a vulnerability? A server has an old libcurl with the vulnerability CVE-2013-2174. As the documentation says:

  it unlikely that programs allow user-provided strings unfiltered into
  this function.

My question is: If this library is set in root mode (but local user can execute), can someone write a C program  to elevate the privileges to root?

Edit

I mean the permission is: -rwxr-xr-x so the root own it, but user can read and execute it.

If this library is set in root mode (but local user can execute), can someone write a C program to elevate the privileges to root?

I'm assuming that you mean that the library is owned by root and can only modified by root but that a non-privileged user can use this library inside its own program.

It actually does not matter who owns a library as long as the non-privileged user who is trying to use it can read it. In this case the library is loaded into the process started by the non-privileged user and is executed in the context of this user, i.e. only with the permissions of the user and not with root permissions even though the library itself might be owned by root. That means that no privilege escalation is possible this way.


Obfuscating password LDAP AD I have my parameters in a properties file.

managerDn=cn=read-only-admin,dc=example,dc=com
managerPassword=69BPoqG3sWr/MNspi4ZsDw==
server=ldaps://server.local:636
groupSearchBase=ou=test,dc=example,dc=com
base=dc=example,dc=coms

My password is encrypted, but the client told me: all you have done is encrypt the password and we need it obfuscated i.e. so that no one can read it.

Any ideas?

Probably you need to have more clear the requirements of your client. If the password is encrypted properly you don't need to obfuscate the password again. May be what your client don't want to see is the name of the parameter "managerPassword" and that is what you need to change, ask him.


Shared floor space, cameras and HIPAA compliance I am a compliance associate at my company, which is a small call center. My problem is that two of our clients will have to share floor space. One client is tech support for high-end action cameras, while the other is a healthcare account that deals with ePHI.

My concern is that the setup is not HIPAA-compliant. The tech support client requires their equipment to be on the floor so that agents can replicate customer problems. I am worried that a breach might occur if one of the agents from the tech support team takes a picture with their equipment and accidentally captures an image with electronic protected health information (ePHI) from the healthcare team.

I brought this up with my superiors, but they seem to think that granting an exemption to the tech support equipment is enough to remain HIPAA compliant. For me, an exemption is just a piece of paper - it doesn't change the fact that there are unsecured cameras on the floor which could capture ePHI at any moment.

Can any HIPAA experts help out? I need facts to back up my concern. Or, if I'm wrong, at least my mind will be put at ease.Thanks in advance, everyone. Cheers!

To answer @john deters questions:

I report to a compliance officer, our department reports to the CEO.
Our department can make suggestions, which needs approval from the
executive committee (excom) before they are deployed.
We recently hired an external auditor for HIPAA compliance, and we passed the audit. Rather than consult with them, I want to resolve my concern internally because I don't want to make a big fuss out of this until I am certain that it is indeed a HIPAA breach or a potential one.
I want to be proactive, rather than wait for a breach to occur. I really do not want those two teams to share floor space for fear of a breach occurring. If I have facts or references to back up my claim, excom will be forced to move the healthcare team to another floor.

It's a HIPAA violation if the tech support team can even see the monitor screens. The cameras make it even worse.

What makes it worse is that they are separate companies using a shared work space.  I think auditors would have a field day with this situation.


zenmap "intense scan plus udp" lan port has unknown port ,but lsof netstat doesn't shown those ports I am new to nmap and I use zenmap "intense scan plus udp"  to scan my router lan port , there has difference unknown "UDP" port each scan ,but each time I use lsof or netstat doesn't shown those udp port. How is possible happened?

The following is my command
"nmap -sS -sU -T4 -A -v 192.168.0.1"

...like 21524 ,41702,42639,51554,60331 those highest udp port

There is probably a socket waiting for data on this port for a short time only. Typical examples are DNS lookups  where each request should use a different origin port to deter DNS spoofing attacks. And this socket (and thus the port) is immediately closed after the DNS response is received. Thus you will not find it with netstat or similar if you look a few seconds later.


Protecting Password Hashes with Stored Procedures? I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a password dump, even if a hacker found a SQL injection vulnerability.

What if the user the website was using to log into the database had more limited permissions. Let's say on all non-critical data the user had full permissions like normal (CRUD). But what if the user was denied all CRUD operations to the table that stored the login hashes, security questions, etc, and could only run stored procedures on that table. And let's say those stored procedures never returned the password hashes to the application layer, but rather you would pass the hash to the procedure and the procedure would return a boolean value indicating whether there was a match.

It seems to me that this setup would eliminate the possibility of a password hash dump through SQL injection entirely. Does this setup provide additional security, is it advisable?

Update

Please see this question for more details:

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

The scheme you describe is similar in concept to making a dedicated password verification server (local server, not open to the world at large) with its own, completely distinct database for the storage of hashed passwords. This can work. Actually you already have that under the guise of "system integration" when the user accounts are mapped, for instance, to an Active Directory server, or local Unix accounts.

Using a stored procedure in the database for that, relies on the database enforcing appropriate isolation -- a somewhat risky bet, since you are envisioning a situation where the attacker gets to include his own SQL statements.


Canonicalization & Output Encoding I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:

  If any potentially hazardous characters (<>"'%()&+\\'\") must be allowed as input, be sure you implement additional controls like output encoding. Utilize canonicalization to address double encoding or other forms of obfuscation attacks.

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it?
What is "double encoding", and why is it an "obfuscation attack"?
What is "canonicalization" and why does it prevent against double encoding?

For the third one, I found a rather vague definition for canonicalization provided by OWASP: The reduction of various data encodings to a single, simple form. But that definition doesn't really help me make sense of what they're talking about.

I'm strong with Java and Python but could follow an example in any language. I'm just trying to visualize what they're talking about here and am having a tough time seeing the "forest through the trees." Thanks in advance!

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it?

Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:Foo bar
If the name contains html characters, you want those to be encoded for, so the result is Foo &lt;i&gt Bar instead of Foo  Bar.

So, converting < to &lt; is an example of html encoding. However, if the context is an html attribute, you may have to also encode space-characters, since an  attribute may be unquoted, and a space may thus break the attribute and the input can create a new attribute:
<input value=data> is attacked with:
<input value=data onclick=javascript:alert(1)/>

What is "double encoding", and why is it an "obfuscation attack"?

When you type certain characters into a URL, these become URL-encoded (usually, though not in IE always):

Not encoded parameter: test
URL-encoded parameter: test%3Cscript%3Ealert%281%29%3C%2fscript%3E
Double-encoded parameter: test%253Cscript%253Ealert%25281%2529%253C%252fscript%253E

Depending on the handling of input parameters, double encoding may pass through some filters/validators and wind up breaking the context where they are echoed (thus leading to XSS).

What is "canonicalization" and why does it prevent against double encoding?

Canonicalization is the act of writing something in the simplest form, thus the canonical form of something is the "simplest" form to write it. To canonicalize in this context, it means un-encoding data until it does not change anymore.

A triple encoded <-sign, goes through the following transformations:

%25253C
%253C
%3C
<

Another example can be if input is written as e.g octal escapes, overlong UTF sequences and esoteric encodings, such as UTF-7. The canonicalization converts these into a common base, for the sake of disambiguation.


Handshake not recording I am trying to crack wireless WEP password of my wireless AP.

When I enable monitor mode and issue this command:

root#airodump-ng -w TESTFILE1 -c 1 --bssid 68:72:51:58:A3:14 wlan0mon

No handshake is recorded. I disconnect or connect any client with that AP, and when I start aireplay to deauthenticate client it simply disconnects the mentioned client and does not allow to connect until I stop aireplay.

What can be the reason for not recording handshake?

My wireless adapter is broadcom IEEE 802.11bgn.

Handshakes are different for WEP networks. The handshake you expect to capture is the "four way handshake" and that is only existing on WPA and WPA2 networks.

On WEP networks the handshake is different, is a challenge response handshake. This is how it works on WEP networks:

  In Open System authentication, the WLAN client need not provide its credentials to the Access Point during authentication. Any client can authenticate with the Access Point and then attempt to associate. In effect, no authentication occurs. Subsequently, WEP keys can be used for encrypting data frames. At this point, the client must have the correct keys.

  In Shared Key authentication, the WEP key is used for authentication in a four-step challenge-response handshake:

  The client sends an authentication request to the Access Point.
     The Access Point replies with a clear-text challenge.
     The client encrypts the challenge-text using the configured WEP key and sends it back in another authentication request.
     The Access Point decrypts the response. If this matches the challenge text, the Access Point sends back a positive reply.

On WPA/WPA2 networks is working in a different way. Look at this:

Extracted from here. On that link there are a lot of more info about it.

To crack a WPA/WPA2 key you need to capture the 4 way handshake, but for WEP is not needed. The WEP algorithm is bad designed and with enough captured traffic you can get the key. There are a lot of tools which can manage all of this (capturing WPA/WPA2, WEP decrypting, etc). I'll recommend to you this complete tool: airgeddon.

Hope it helps.


What are the security benefits of reset all fields if captcha was failed? Most of the sites will empty the password field when you fail the CAPTCHA, and often they reset all the fields as well.

Is there any security benefit on doing this?

Emptying the password field: yes, this is a standard feature for all form submissions, not just ones where CAPTCHA failure is involved. If you returned a page with the user's password in then would you have to worry about it being saved in the browser's disc/page/bf cache and being recovered by later access to the client machine.

Emptying other fields: no security benefit against an automated attacker. I doubt this is a deliberate measure. I would suspect the sites in question simply don't consider it a usability priority to ensure the form is preserved for the convenience of a user they believe to be an attacker. (They may have an inflated sense of confidence in their CAPTCHA and don't think a real user will fail very often.)


How to protect my code from “insider” threats when hiring my first employee? I quit my job to start my own SaaS product. I’m now looking to hire my first employee (another developer).
I will be taking appropriate legal precautions to protect my IP, but I’m wondering what other reasonable actions that I can take to further protect my code / data. The last thing that I want happen is what happened to Tesla where someone dumped the source code onto iCloud and ran off with it to a competitor.
I know that it is practically impossible to prevent this 100% from happening and that I need to make sure that I hire quality people and offer meaningful pay and have the appropriate legal documents signed. Apart from this, what else can I do to protect myself from inside threats? I am pouring in my entire life’s savings into this and I will be devastated to lose what I spent the better part of 2 years coding.
Here’s what I’ve thought of so far:

Buy a work laptop for them
Encrypt the hard drive (like with Bitlocker)
Disable all USB ports
Create a non-admin / limited user account with no install permissions and just the IDEs (e.g. Visual Studio) installed. I use Windows 10 for most development with the exception of a Mac for the iOS portion of the app development.
Install some kind of employee logging software.
Disable access to file hosting websites.
Somehow detect and stop when a certain folder is being uploaded or copied somewhere?
Somehow make the git repository only accessible from that machine.
Install some kind of remote admin management system? Azure Active Directory or something?

This must be a common problem for businesses but I must be searching for the wrong thing because I can’t seem to find a guide anywhere on this issue.

For the most part this is not a technical problem but a human problem. So while technology has a role to play it has limits.
If the employee will be working from home supervision is more difficult. If you'll be monitoring his/her activity you don't want to be in breach of applicable privacy laws.
The computer has to be secured obviously but the rest of the environment is important too. If you have a corporate LAN there should be adequate protections like an IDS/firewall. But the equipment is often useless without somebody keeping an eye on the logs and the alerts.
Since you mentioned Visual Studio, the developer may need to be at least a local admin to work in optimal conditions. If you cripple their environment they may be tempted and even forced to find workarounds and defeat your security measures which is what you want to avoid.
I'm afraid we all have to trust other people and take risks. The more you monitor your employees, the more you make it obvious to them that you don't trust them and make them feel untrustworthy. At some point the surveillance effort becomes counter-productive because you frustrate and demotivate them. They may become less productive, less loyal.
Security training may be beneficial too. The employee could be honest and acting in good faith but vulnerable to social engineering, and unwittingly jeopardize the company and its assets. Naïveté can be as dangerous as malicious intent. I would say that many developers lack cybersecurity awareness.
Perhaps you should order a penetration test against your company and learn from it. Thus your security posture will improve and you'll be better equipped to fend off attacks.
Employees are often the weakest link but you should also consider the threat of hackers and unethical competitors. In other words don't focus too much on your employees, but develop a 360° security approach for your company.
Physical security is important too. A lost laptop should be no big deal if the hard drive is encrypted and has a strong password. But your backups should be in a safe place. Consider the risk of burglary.
Yes backups are extremely important. Make sure you have a solid backup plan in place, test it from time. Prepare a disaster recovery plan. What would happen if your office burns with all your computer equipment ? You need to protect your source code but also plan for business continuity. Hint: insurance.
If you have valuable IP you could consider applying for patents. Again, this is a lawyer's job here.
Probably you can find insurance to cover the risk. The question is whether it's worth paying for a low risk.
I would also offer shares or some equity in the company. Then your employees have less incentive to go rogue and sabotage your enterprise.
To sum up: there are so many possible risks, I think you are putting too much emphasis on the insider threat. You are more likely to get hacked, than sack someone for misconduct.
Your employees must be your allies and considered as such - not as potential foes.


Router with good Firewall for office - total of 50 computers/devices including wifi devices I am looking for a good Office Router that can handle good firewall rules, have logs, and ca support about 50 computers/devices connected with wire and wireless.

We had different models before, and even installed dd-wrt, but sometimes when there is some restriction rules, the router just hangs or starts acting weird on some connections.

Router needs to have decent security and firewall.

Thanks

Daniel

As Lucas has noted, shopping/product suggestions are ... less than welcome(?) on stackexchange sites. I use http://www.smallnetbuilder.com and they are very good. For your wants, they have a security section: http://www.smallnetbuilder.com/security/security-reviews


Xbox and Playstation copyright protection vs PC AFAIK, both Xbox one and PS4 use x86 IC very similar to PC. The questions are:

1/ How can they keep those console systems protected from cracker and software privacy? What is the main method to protect copyright on those systems?

2/ Why not apply the same method to protect game/software on PC?

3/ Are those system Xbox and PS4 use another hardware protection not available on PC? If yes, what is it?

consoles these days are completely closed ecosystems, to the point where their components are not even interchangeable ( for example a Xbox internal hard drive cannot be inserted into another xbox, or the flash memory which stores the operating system and settings on the Nintendo 3ds is encrypted with a key which is unique to the console )

They are not user upgradable or servicible in the slightest , in addition to this there are many other protections built in ( for example on the Xbox 360 the majority of communication between major components on the motherboard are encrypted )

You are right in the sense that the majority of current console hardware is almost identical to consumer grade computers, but due to the fact that only signed code can be ran on the hardware ( and this is enforced via hardware and software )

Hell my 3ds is almost identical to my raspberry Pi at a low level, except for the fact that I can boot whatever the hell I want on my Pi

If a pc manufacturer was to enforce something like this they would loose the entire server market overnight .


Why does DISA STIG recommend "Deny access to this computer from the network" for Domain Admins? [Note: This question is regarding the technical description of what the STIG is recommending. It is not asking about whether enabling the setting is a good process that enforces other technical controls.]

For Windows systems, the U.S. DISA STIGs recommend enabling the Deny access to this computer from the network for the Domain Admins and Enterprise Admins groups:

https://www.stigviewer.com/stig/windows_8/2014-01-07/finding/V-1155

The stated justification:

  In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.

Connecting remotely to a system using only an SMB connection (this is what Deny access to this computer from the network blocks) does not expose credentials.*

Note that Deny access to this computer from the network denies only remote SMB connections; it does not prevent interactive logon or RDP access. Also, remote SMB connections do not create a cached logon verifier.

With this in mind: How does this setting mitigate a "privilege escalation from credential theft" attack, since credentials are not exposed to the potentially compromised host to which you are connecting? (In other words: How can this setting prevent credential theft on a potentially compromised host if there's no credential exposure on that host?)

[Note: I'm not asking for opinions about standard security practices. I am asking the specific question stated in the previous paragraph.]

*This is corroborated at the following resources:

https://digital-forensics.sans.org/blog/2012/02/21/protecting-privileged-domain-account-safeguarding-password-hashes - "......a network logon will not result in domain hashes being stored on the remote machine. This is a very important fact and one that I will demonstrate shortly."
http://www.ampliasecurity.com/research/wce12_uba_ampliasecurity_eng.pdf - page 25

@HallowProc has a good answer that I want to expand on more than a comment.

First and foremost, the Enterprise Admins groups should be empty and only populated for the rare administrative task.

The only location where Domain Admin credentials should be used is on the Domain Controller(s) or a dedicated administrative workstation. These systems should be of the highest trust level in the organization. Access should be restricted so administrative traffic (RDP, WinRM, etc) can only be exchanged by these trusted systems using IPsec (Server and Domain Isolation). Thus only exposing necessary services (Kerberos, LDAP, etc) to systems at a lower trust level.

Domain member systems are of a lower trust level and should never have a Domain Admin logon to the system. Further no domain account with a wide breadth of admin permissions should be allowed access. An example of this is an account with admin access on all domain member workstations. The breadth of admin access should be narrowed to a smaller subset.

By architecting Active Directory in this manner, the use of privileged accounts is limited to just a few systems. So implementing this security control achieves the following:

Defense in Depth - suppose there's a script that logs into the domain controllers to perform an adhoc task and there's a typo. Pointing the script to a member workstation of a lower trust level. While this should be stopped by IPsec rules and other controls, having a setting such as this would be another layer on the Defense in Depth onion. It prevents the elevated account from logging in where the credentials could be extracted and exploited.
Limit Lateral Movement/Containment - While your question is regarding Domain/Enterprise Admins, the actual setting also includes the local administrator accounts. This leads me to believe that the setting is aiming to mitigate exploitation related to Mimikatz (token/hash extraction --> Pass-the-Hash/Token). If Microsoft LAPS is being used (or something similar), I wouldn't be as concerned with limiting network access to local administrator accounts. As each system would have a unique password for the local administrator account. However, if a privileged account gets compromised on a workstation and attempts to access another system, the deny login event should raise an alert. Minimizing the time from exploitation to containment.
Process Improvement - While large enterprise environments are much better at segregating privileges, many still use Domain Admin level credentials to perform administrative duties on member systems. Having a setting like this improves the process as it directs sysadmins towards segregating permissions into multiple accounts.

In the worst case scenario where Domain Admin credentials are compromised on a low trust member workstation, containment is achievable. An alert should be raised showing successful use of those credentials followed by access denied events. Network access will be blocked to the remaining member systems (via this setting) and domain controllers (via Server and Domain Isolation).

Granted there are ways past this particular control especially when Enterprise/Domain Admin accounts are involved. However that means a much more sophisticated adversary. If that's the case, there's more to worry about then this particular setting alone. I believe this is aimed at scenarios where a low trust workstation gets worked on by helpdesk/sysadmin/one-person-shop. The adversary uses techniques such as those used with mimikatz to try and pivot with those credentials (privilege escalation).

The setting isn't perfect, but to get any more specific would be unmanageable for DISA. Every environment is different and comes with its own caveats. This setting aims to strike the balance.

I agree with your statement in regards to removing the Domain Admins group from the local administrators group. Instead, create a single Global Security group for the group of systems being administered. Something like gs-localadm-room-007. This achieves that narrowing of administrative duties so if that account were compromised, there would be no affect on other security silos.


Can I use a JWT for both Authentication & Data Transmission I think I have a high level understanding of what a JWT is and how it works.
I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing along some data with it.

eg - a request is made to the server, and the bearer token represents both authentication information and a payload in one trip. Is this in alignment with best practices for JWT?

Since JWTs are passed via headers, I would recommend a size of 5-7kb. For auth tokens, wrap them in http-only cookies, and use a seperate token for the payload. This is because http-only cookies are not readable by clientside JS. Sorry, would make this a comment but I don't have enough points. Hope this helps :)


Should the RTP feed from a surveillance camera be protected? I see a lot of camera system and they're either using RSTP over RTP or just RTP.  Most of the times they are on straight HTTP for the login, some will be on HTTPS, but unless forced (which I have seen), the video feeds do not tunnel through the HTTPS.  Should they be forced through HTTPS or implement SRTP or RSTPS?

Authentication/Login should always be done over HTTPS if its an viable option, consider just the amount of admins that uses the same passwords for different systems. There are so many reasons.

RTP is from 1989 originally, and to run anything over it today should almost be criminal. If it have any form of security perspective, a bad guy could DOS the camera feed or send a faked time-loop (like they do in the movies, yes we actually did that in our office for a demonstration).

I'd use one of those two, and make sure to enable both authentication and encryption (both optional).


Android security without updates I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation vulnerabilities, which are mainly used for legitimate rooting the phone, however as far as I can see there is nothing stopping an attacker from using these exploits to completely bypass the android permissions system. This is already done by the applications used for easy rooting of the device - they do not require any special permissions and are able to execute the exploits that give them full access to the system.

It seems like the only thing stopping a normal looking application in the market from bypassing all android restrictions and taking control of a device (which does not receive updates) is hoping that Google can catch all such applications and ban them from the market. This does not seem realistic to me. The other option is to run a custom ROM which often receives updates, assuming you trust the ROM developers and assuming that the ROM is fully compatible with the particular device.

So, the questions are: Is this accurate, or am I missing something? And what is the best solution for somebody who would rather not deal with custom ROMs?

Yes, this is accurate.  If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone).

This absence of security upgrades is a shortcoming of the Android ecosystem.  The ecosystem is reliant upon handset manufacturers and carriers to continue providing security upgrades, but many handset manufacturers/carriers have declined to do so, for economic reasons.  They treat the phones as disposable, and don't always show loyalty to older customers.  Once the phone is a few years old, they stop providing upgrades and focus on the latest shiny models that are being sold, prioritizing selling new handsets over supporting past customers.  This is not very eco-friendly and not particularly customer-friendly.  I think it is unfortunate, but it appears to be a fact of life.  And so it goes.

There is an excellent analysis of this phenomenom by Michael DeGusta.  Here is a infographic showing the results of his analysis:

Credits: Michael DeGusta at The Understatement.

Update (12/26/2012): Ars Technica has a nice overview of the situation with Android updates, a year later.  Unfortunately, it's not pretty: things haven't gotten any better, and many Android phones are not receiving updates.  The security risks remain.


Shouldn't netstat show connections from many different IP addresses during a DDoS, unlike this example? I just read this article from loggly (https://www.loggly.com/blog/how-to-detect-and-analyze-ddos-attacks-using-log-analysis/), and it got me wondering.

The author states that under a DDoS attack, netstat output on attacked server would show something like this:

TCP 192.168.2.104:00 216.35.50.65:60973 TIME_WAIT
TCP 192.168.2.104:00 216.35.50.65:60974 TIME_WAIT
TCP 192.168.2.104:00 216.35.50.65:60975 TIME_WAIT
TCP 192.168.2.104:00 216.35.50.65:60976 TIME_WAIT
TCP 192.168.2.104:00 216.35.50.65:60977 TIME_WAIT
TCP 192.168.2.104:00 216.35.50.65:60978 TIME_WAIT
TCP 192.168.2.104:00 216.35.50.65:60979 TIME_WAIT
.
.
.

Can anyone explain to me why would this happen? Since its a DDoS attack, shouldn't it have connections from several different IPs from botnet?

Great question. The answer is, maybe.

There are multiple reasons why an internal host might see 1 IP in place of many, a big one being load balancers. Load balancers have been a problem for internal monitoring for quite some time. They act as a full proxy (typically) and basically it's impossible to tell where any connection started from because all you see is the LB IP.

To answer a separate question in here, UDP would be most common also for connections in DDOS. TCP doesn't "reflect" in the sense of if you want to pretend to be a different server and try to TCP connect, the 3rd part of the handshake won't go to you, it will go to the spoofed IP and be dropped breaking the connection.


How does WikiLeaks(Julian Assange) get the US Embassy cables? How does this guy get these cables? Are those cables routed through a single node, where this guy got it? If so, How it is possible? I mean, how that single point came under the control of Julian Assange? If not, then how did he get them? Didn't they encrypted?

Thanks a lot.

The long answer is quite complicated, and up for legal discussion.

The short answer is: He (Wikileaks) asked for them, and someone sent them.


Were PGP/MIME and PGP/Inline equally affected by EFAIL? I saw this question about which out of those two protocols is more secure. The question was from 2016, but Efail was discovered late 2017. I understand that some email programs were affected while others were not, plaintext was somehow sneaked into the message but the pgp was in no way threatened by it. Would be interested to know if it were both PGP/MIME and PGP/Inline encrypted mails which were affected by the Efail attacks and if one may then be said to be less vulnerable to such attacks in the future.

Efail is independent of which protocol (Either form of PGP or S/MIME) is used.  It's a matter of what the client does with different blocks within the message body once they have been decrypted.

So if you use Inline PGP by cutting and pasting into an external program instead of something integrated into your email client, you are safe.  In principle you could also take PGP/MIME or S/MIME encrypted blocks extract them from an email and run them through an external decryption program as well, and that would be safe from EFail as well.  It's just not as common a usage as with Inline PGP.

If you are using an email client with built in support for PGP or S/MIME, then it's all about how the client displays messages.  If it displays images, loads scripts, etc, and doesn't sandbox blocks within the message from one another, then Efail is a possibility regardless of the encrypted email system used.

Now, a specific client may differ in how it handles messages depending on the encryption protocol so that it's vulnerable or not depending on the protocol, but that's a property of that client, not of the protocol.


Are there ransomware infections of Ubuntu Linux in the wild? Due to the recent media coverage of ransomware attacks several people for whom I've provided personal computer support in the past have expressed concerned. The majority of these people are running either Ubuntu or Kubuntu linux, but not all are fully patched and up to date.

Are Linux systems in general, and Ubuntu-derived systems in particular, vulnerable to any known ransomware attacks in the wild? I intend to help these people patch, update, and properly backup their systems. However, some of these will take time for me to get to so I need to know how much of a priority to put on this.

I stress that I have a personal relationship with these people, not a business relationship. All entities that I have provided professional Linux desktop support for already have backup systems in place, including test restorations to independent systems. I am evaluating now the possibility that the malware may encrypt the backups as well, of course. That is a priority!

Actually there IS a new ransomware (now, not when the question was asked) that is apparently a trojan that encrypts home directories and web root, then asks for a bitcoin to get the decryption key.  I can't find any information yet about what the trojan is coming in as, or how it's supposed to be spreading.  Basically, stick to the official Ubuntu repositories to get your software and you should be fine.

http://techcrunch.com/2015/11/06/linux-ransomware-is-now-attacking-webmasters/


Why is hashing a password with multiple hash functions useless? I read online that it's useless and basically impractical to hash a password with multiple hashing algorithms (and not just one) before storing them in a database. I don't really understand why that is. If someone gets their hands on a list of hashes and he doesn't know which hash functions were used, how can the passwords be cracked? It would seem that using a combination of multiple hash functions would make the passwords more secure... but apparently they don't.  Why not?
I'm referring specifically to the section titled "Double Hashing & Wacky Hash Functions" in this blog post.

The assumption always is, that any attackers will know the software used, including configuration like which hash is used. There is always a risk of that knowledge leaking, so robust systems must be safe even if their source is known. (Maybe the attacker bought the same piece of software) Also, if the attacker somehow obtains just one password, and the corresponding hash, it's relatively easy to find out which one of a set of plausible hash functions produces that hash.

As for using multiple hashes for one password at the same time, the problem is that it usually makes it possible to brute-force the hashes by just concentrating on the weakest or easiest to calculate (chosen by the attacker.)

There was no link, so I don't know exactly what situation it is you refer to, of course.


Does signing of HTTP requests have any benefit when using TLS? Signing HTTP requests is all the rage nowadays. The benefits of doing so when communicating over an insecure channel are clear. With signatures you can bring message integrity and authentication to such an environment.

But I'm struggling what signatures bring to the table when the communication channel IS secure. Like TLS. Message integrity is guaranteed by TLS and authentication could be a much simpler shared secret (like an API key).

The only thing I can come up with is a niche scenarios in which sharing secrets is not desirable or exchanging the secret needs to happen on an insecure channel. Perhaps it is security in depth which merits it?

TLS only protects the communication between the TLS endpoints, i.e. some client certificate will only be checked by the TLS server. With signed request the authentication and integrity is bound to the request and not the communication channel which means that it will be kept and can still be verified by the final recipient even if TLS terminating proxies like load balancers or other reverse proxies are involved.