Adding Floating point operations to fuzzing? During analysing a software testing paper I read

  We plan to add floating-point operations in order to extend fuzz testing capability.

What kind of benefits I can expect from adding floating point operations to fuzzing techniques?
What are the advantages of floating point operations for software testing?

Floating point support in fuzzing is useful if the target deals with floating point numbers. This not the case for all, or even most fuzzing targets, but it is for some. In those cases, many traditional integer fuzzing techniques might not result in the test coverage you want. Take for example the popular AFL fuzzing tool. In its documentation, it describes how it uses integer arithmetic to improve coverage:

  Simple arithmetics: to trigger more complex conditions in a deterministic fashion, the third stage employed by afl attempts to subtly increment or decrement existing integer values in the input file; this is done with a stepover of one byte. The experimentally chosen range for the operation is -35 to +35; past these bounds, fuzzing yields drop dramatically. In particular, the popular option of sequentially trying every single value for each byte (equivalent to arithmetics in the range of -128 to +127) helps very little and is skipped by afl.

  When it comes to the implementation, the stage consists of three separate operations. First, the fuzzer attempts to perform subtraction and addition on individual bytes. With this out of the way, the second pass involves looking at 16-bit values, using both endians - but incrementing or decrementing them only if the operation would have also affected the most significant byte (otherwise, the operation would simply duplicate the results of the 8-bit pass). The final stage follows the same logic, but for 32-bit integers.

Obviously, this isn't going to be helpful if the fuzzing target expects floating point numbers. After all, a 32-bit chunk of data will mean something completely different if it's treated as an integer, as opposed to a floating point number. A fuzzer that is floating point-aware will be able to take advantage of this.


Hubs, Switches, and Bridges - Flaws and Security Superiority It just isn't clear to me which choice is good for creating small/intermediate networks.

I know one of flaws of Hubs is that they send all packets to all nodes connected to it, in contrast to Switch which can decide where each packet needs to be transmitted.

Please explain to me what are the differences between each of them, and what are pros/cons for for each of Hubs, Switches, and Bridges.

I am not sure if that's the best place to post this type of question. Sorry if it's not.

Regards.

Switches are NOT a security feature.

That's the important part. A switch is an optimization over a hub, meant for better performance, not for security.

When a hub receives a packet (an ethernet frame), it dispatches it on all the other links. This is inconvenient in large networks, because this means that when two machines talk to each other, they monopolize the whole network. To avoid this issue, switches try to remember which machine is on which link, so that they may propagate a given frame only on the relevant link, thus leaving most of the network free for other simultaneous communications. This is only a best effort and in no way a guarantee that a given packet will be sent on the single "right" link. The switch works on an internal cache memory which has limited size. Thus, it is easy for an attacker to spam the switch with lots of packets from "fake" systems so that the switch can no longer decide which is the right link for a given packet; at this point, the switch falls back to "hub mode" and broadcasts the packet on every link.

So you should use a switch for performance but certainly not for security reasons.

A bridge is a general-purpose computer which believes it is a switch. It has several network interfaces, and relays ethernet frames as a switch would do. Bridges can also do some intricate filtering since a general-purpose computer has a CPU and RAM; that's actually why you would still want to setup a bridge instead of using a much cheaper switch. Some switches are also, internally, computers which can run elaborate filters on transiting packets; so the distinction between a "bridge" and a "switch" is now quite blurry.

When in doubt, use a switch -- but do not assume that it will do you any good security-wise.


bin_random_table and RANDOM_BOOT_ID The Linux kernel has a few sysctrl's related to random devices packaged in a bin_random_table (http://lxr.free-electrons.com/source/kernel/sysctl_binary.c?v=3.2):

static const struct bin_table bin_random_table[] = {
        { CTL_INT,      RANDOM_POOLSIZE,        "poolsize" },
        { CTL_INT,      RANDOM_ENTROPY_COUNT,   "entropy_avail" },
        { CTL_INT,      RANDOM_READ_THRESH,     "read_wakeup_threshold" },
        { CTL_INT,      RANDOM_WRITE_THRESH,    "write_wakeup_threshold" },
        { CTL_UUID,     RANDOM_BOOT_ID,         "boot_id" },
        { CTL_UUID,     RANDOM_UUID,            "uuid" },
        {}
};

I believe RANDOM_UUID is useful in cases /dev/urandom is not available, for example, in chroot environments. But I don't know how RANDOM_BOOT_ID is used.

What is the purpose of RANDOM_BOOT_ID?

While RANDOM_UUID a type 4 (randomly-generated) UUID that changes every time it's read, RANDOM_BOOT_ID is a similar UUID that changes exactly once per boot. This is useful for configuration or instance differentiation to keep straight properties for your application that should change exactly once per boot.

This value is not typically significant for security or cryptography, but instead is used simply for instance management.

Also, RANDOM_UUID is not a replacement for /dev/random, but rather a source of properly-generated type-4 UUIDs. See how the first digit in the 3rd group is always "4"?

See also:

/proc/sys/kernel/random/uuid
/proc/sys/kernel/random/boot_id


Does Microsoft's "Password Ban" list insecurely store user passwords? Supposedly, Microsoft is banning common passwords, and their list will dynamically update:

  Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. […]  Microsoft is seeing more than 10 million accounts being attacked each day, and that this data is used to dynamically update the list of banned passwords.

Is this based on actual passwords for other people's accounts, or just passwords used in brute force attempts?

Could a secure system be built that checked password updates against other people's passwords and rejected them if a password was too common?

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these passwords unless the attacks change.

The attack lists generally derive from studying breaches. Attackers are smart enough to look at lists to figure out high probability passwords, then do their brute force, etc. around those high frequency words. We look at the same lists plus the attack patterns to determine our ban lists.

Hope this helps.


Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.

I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I have one step in my build process where I need to restart my nginx using sudo.

According to this solution, it suggests to allow jenkins to use sudo without password.

And also, it is not entirely sure about the security implications for such an arrangement.

I want to ask whether I should go ahead with this arrangement.

I installed the jenkins on the same server as the production code.

The linked solution allows jenkins to run any command via sudo without a password.

A better solution is to allow jenkins to restart nginx without a password, but nothing else. This way you have root permission for the command you need to execute, but you're not granting blanket permission for jenkins to do anything and everything.

Use visudo to stick this at the bottom of your sudoers file:

Defaults:jenkins !requiretty,!lecture
jenkins ALL=NOPASSWD:/etc/init.d/nginx


What gpg defaults can be improved, when performance is not an issue? gpg has some preset default settings, which I assume were selected as a compromise between speed and security. I understand that these are good enough for most people.

But, in a situation where speed / performance was not an issue, what defaults could be changed, to make gpg use stronger parameters, and use even stronger encryption ?

For example, I have read discussions about the s2k-count default value being not sufficient. I really don't care if my gpg operation takes 50 milliseconds or 200 milliseconds. I would rather err on the side of safety, even if it is overkill.

Specifically, I would like to use the strongest possible values for:

password hashing iterations
size of asymetric key
algorithm for symetric key

What else could be changed from default values, to make gpg more secure ?

I am using gpg (GnuPG) 2.2.12 on Debian Buster.

1) password hashing iterations

If you don't care about waiting a little longer, you can use the maximum count value, which is 65011712. This isn't strictly the number of iterations so much as the number of bytes to be hashed. S2K works by repeatedly feeding the password and salt to a hash function for a specific number of bytes. The more bytes, the longer it takes. This is what the s2k-count parameter specifies.

  2) size of asymetric key

The maximum key size that most implementations of GnuPG are capable of generating is 4096 bits for RSA. This is a result of the memory limitations placed upon the software. In order to prevent secrets from being leaked into swap, it has to "lock" memory. The operating system provides a limit as to how much memory a single process is allowed to lock. GnuPG would need to lock more than it is allowed to generate a key larger than 4096 bits. Luckily, 4096 bits is plenty for an RSA key.

  3) algorithm for symetric key

AES256 is already plenty. It's most certainly not going to be your weakest link.

There are other things you can do to further harden your GnuPG implementation, although the complete list is too vast and dependent on your situation to list here. A few improvements would be to add to your gpg.conf file a few settings like with-fingerprint to display fingerprints by default. This doesn't improve security unless you actually verify that the fingerprints match what you expect, of course.

You can also use a stronger digest for signing keys. Avoid using SHA-1. You can use SHA-256, or even SHA-512, although that's a little overkill. This can be set with cert-digest-algo SHA512.


Can an iOS 7 app access either device camera without user knowledge? This statement in the iOS 7 release notes implies that non-China devices do not need user consent:

  iOS now requests user consent for apps to use audio input on all iOS
  7 devices. For devices sold in China, iOS will also request user
  consent for apps to use the camera hardware.
  iOS SDK Release Notes for iOS 7 GM

Is there any protection against an app accessing either camera without the user's knowledge and/or consent?

This is a follow-up question to the comment on device fingerprinting (and other iOS privacy vulnerabilities) here:
What unique fingerprinting information can an iOS7 app collect?

As of iOS 8, apps do need to request access to the cameras. When an app on iOS 8 attempts to access a camera, it shows a system alert and requests the user to accept the access before the app is allowed. Denying the access will prohibit the app from accessing the camera.

For iOS 7 in your question, yes, an app can access either camera without requesting the user's permission (except in China as you found out). All apps have unrestricted access to view the camera feed of either the front-facing or rear-facing camera and take pictures/videos.

However, access to the Camera Roll to save such media does require the user's consent. Most apps on the App Store request access to photos immediately so as to not interrupt the user whilst they take their first picture, however this is simply to gain access to the general location for saving the media, not for accessing the camera itself. Apps are fully able to capture pictures and video from either camera at will without requesting permission providing it saves the media within the app's sandbox.


How resistant are barcodes and QR-codes against attempts to change stored data? Assume we want to protect a document against manipulating and forging. So, we encode some sensitive information of the document and store it in a QR-code inserted in the document.

Can we be sure that an attacker is not able to change and modify the stored data in the QR-code? And if it is possible to modify it, how difficult is it for an attacker to do so? In other words, how secure is a QR-code?

... how secure is a QR-code?

Data in a QR code are kind of protected against accidental damage by having some error correction but they are not protected against deliberate manipulation. Also, an attacker might completely replace the QR code in the document with a different one.


How is DOM XSS possible here? I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661

     Show Here

Showing Message1

     Show Here

Showing Message2

This page is taking input from an untrusted source, and directly outputs it in the browser as HTML.

In this case, the untrusted source is window.name. To the inexperienced programmer, this may seem harmless, but in reality, it can be set to any arbitrary value, because it's derived from the name of the frame:

<iframe
    src="http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661#message"
    name="<script>alert(0)</script>"
></iframe>

In the code you've given, there's another glaring hole: The selector is also taken from an untrusted source (the URL), which allows attackers to output the HTML in whatever place they desire. This doesn't need to be a frame, just visit the following URL:

http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661#whatever],body,[whatever

t is set to "whatever],body,[whatever" (from location.hash), and is used to construct a jQuery selector ("div[id="+t+"]"). Together, it results in a selector that selects (e.g.) the <body> element:

"div[id=whatever],body,[whatever]"

Though not as harmful as window.name, it might be worth fixing.


Giving a PFX cert to a 3rd party email service for DKIM? My organization is working with a vendor that needs to send emails on our behalf. They want us to import a PFX certificate into a DKIM key. We want to understand the implications first.

What precautions can/should we take?

I presume that if some attacker got hold of the key, they might be able to use it to impersonate our email messages. But is there anything else they can do with it?

Can the original cert be extracted and reused in other ways (e.g. converted to a web server or app signer cert)?

DKIM does not work with certificates, it works with plain RSA keys. The private key is used for signing and the public key for validating the signature. To make this possible the public key must be accessible using DNS, i.e. it is stored in a specific DNS TXT record.

While you could in theory use the key pair associated with an existing certificate there is no need to do this and it is probably much better to create a new key pair so that the key for an existing certificate does not get compromised at all. Since only the plain public key is stored in DNS there is also no need to create a certificate with this key and let a CA sign it.


Modifying shell code to bypass Windows Firewall As part of my OSCP's training, I'm supposed to get a shell on a Win7 machine using browser's exploit (MS12-037) with Windows firewall on.

I have an idea but I'm having hard time applying it.

What I'm trying to do is to insert a code that will turn off the firewall before running the shellcode.

First I wrote a C program which turns the firewall off:

#include "stdlib.h"

int main ()
{

int i;
i=system ("netsh advfirewall set currentprofile state off");

return 0;

}

Then I compiled the the program and de-assembled it, and I got this:

004013a0 <_main>:
  4013a0:   8d 4c 24 04             lea    ecx,[esp+0x4]
  4013a4:   83 e4 f0                and    esp,0xfffffff0
  4013a7:   ff 71 fc                push   DWORD PTR [ecx-0x4]
  4013aa:   55                      push   ebp
  4013ab:   89 e5                   mov    ebp,esp
  4013ad:   51                      push   ecx
  4013ae:   83 ec 14                sub    esp,0x14
  4013b1:   e8 6a ff ff ff          call   401320 <___main>
  4013b6:   83 ec 0c                sub    esp,0xc
  4013b9:   68 24 30 40 00          push   0x403024
  4013be:   e8 c5 01 00 00          call   401588 <_system>
  4013c3:   83 c4 10                add    esp,0x10
  4013c6:   89 45 f8                mov    DWORD PTR [ebp-0x8],eax
  4013c9:   b8 00 00 00 00          mov    eax,0x0
  4013ce:   8b 4d fc                mov    ecx,DWORD PTR [ebp-0x4]
  4013d1:   c9                      leave
  4013d2:   8d 61 fc                lea    esp,[ecx-0x4]
  4013d5:   c3                      ret
  4013d6:   90                      nop
  4013d7:   90                      nop

The part I'm interested in is this:

  4013b6:   83 ec 0c                sub    esp,0xc
  4013b9:   68 24 30 40 00          push   0x403024
  4013be:   e8 c5 01 00 00          call   401588 <_system>
  4013c3:   83 c4 10                add    esp,0x10

This is where the program allocates space for the address of  the string netsh advfirewall set currentprofile state off on the stack, and passes it to system() and cleans the stack afterward.

I want to insert these instructions  before my shellcode so they will turn off the firewall before the bind/reverse shell kicks in.
Since the command in the C program is located in the memory, the program had to push its address to the stack not the actual string.

To make the exploit work, I need to push the actual string on the stack and passes it to system() so I used Corlean's script to get the instructions which will push the actual string onto the stack.

String length : 46
Opcodes to push this string onto the stack :

"\x68\x66\x66\x20\x00"    //PUSH 0x00206666
"\x68\x74\x65\x20\x6f"    //PUSH 0x6f206574
"\x68\x20\x73\x74\x61"    //PUSH 0x61747320
"\x68\x66\x69\x6c\x65"    //PUSH 0x656c6966
"\x68\x74\x70\x72\x6f"    //PUSH 0x6f727074
"\x68\x72\x72\x65\x6e"    //PUSH 0x6e657272
"\x68\x74\x20\x63\x75"    //PUSH 0x75632074
"\x68\x6c\x20\x73\x65"    //PUSH 0x6573206c
"\x68\x65\x77\x61\x6c"    //PUSH 0x6c617765
"\x68\x76\x66\x69\x72"    //PUSH 0x72696676
"\x68\x68\x20\x61\x64"    //PUSH 0x64612068
"\x68\x6e\x65\x74\x73"    //PUSH 0x7374656e

So now I need to allocate space for this string on the stack

\x83\xEC\x41  \\sub esp,65

call system()

\xe8\xc5\x01\x00\x00        call   401588

Then clean the stack

\x83\xC4\x41            add esp,byte +0x41

I have two problems here:

The instructions I'm using contains bad chars "00"
the total size of the modifications plus the shell code, exceeds the buffer size in the original exploit

So my questions are:

Is there a solution to the mentioned above problems ?
Is this way of solving the problem correct/feasible ?
Are there better ways to handle this ?

You are mistaken in your approach entirely, since you are exploiting IE which is a lower privileged process by default you will not be able to disable the firewall. furthermore when attacking with a client side exploit you can make no assumptions about network configurations, there might be more than one firewall between the host and you, a NAT might block your shell connection, and the port you end up listening on might not be open.

my suggestion is to go for a reverse shell payload, this complements client side exploitation limitations and supports more use cases. furthermore default windows firewall configurations allow outbound traffic without any limitations, meaning that essentially windows firewall is "bypassed" - as in not blocking your shell.


What's the difference between Systems security and Information Security? I'm trying to differentiate between the the three.

What is Systems Security?

What is Information Security?

What's the difference between Systems Security and Information Security?

I'm trying to understand the difference between these three security terms. I could not find much that strongly differentiate between the two. I did find a clear explaination on Network Security though. Any help is much appreciated.

System security : how easy is to break into a system and compromise it, thus having access to the information behind it (access from both inside or outside). Remember that on a system most things can be accessed by root/Administrator.
Information security: how do we best keep our information? Is it safe from disaster (geo distribution)/hardware failure(backups, raid, snapshots, etc)/ hackers(public exposure)/unintended uses (access policy)?
From this perspective, system security is just one aspect of the many that you have to account for when you talk about information security.


How would I give an encryption key to only one person? Let's say I have an encrypted message. I want to make it so that someone is able to decrypt it. The only way of giving it to them is online. For the purposes of this question, I can't call, mail or meet them in person.

I want to ensure that only they are able to decrypt it. I know that the method of communication (whatever you want it to be) isn't monitored yet,  but the message could be read at any time. How would I do this?

The answer to your situation, presented as it is, is that it is impossible unless you make certain assumptions.

You have two problems you need to resolve for this to work. For this example, I will use Alice and Bob as examples.

You need to have Alice and Bob exchange keys in a secure fashion. This is the easy problem. Any key exchange method like Diffie-Hellman or RSA will do.
Alice needs to know that she is performing the key exchange with Bob. This is the difficult problem which is impossible to achieve under your scenario without making some assumptions. Let's explore some of the options we have.

Bob publishes a public key that Alice will use to encrypt the encryption key with. However, how would Alice know that this public key belongs to Bob? Historically, there are two ways to accomplish this.

X.509 certificates. The X.590 standard is a centralized trust model where you have to rely on a Certificate Authority to verify Bob's identity. Alice has to trust the Certificate Authority that this particular public key belongs to Bob and not a malicious attacker. This is the model used in TLS/SSL.
PGP/GnuPU. PGP uses a decentralized trust model commonly referred to as the Web of Trust. This works by having many different users sign Bob's public key, essentially endorsing that the particular public key belongs to Bob. In this model, Alice has to trust that only the real Bob is able to garner enough endorsements from users.

I know that your question assumes that there isn't an out-of-band means for Alice to verify Bob's identity. In the hopes of making this answer more comprehensive though, I'll cover this situation a little bit as well. If Alice can meet Bob even once, the situation gets a lot easier. Alice and Bob can simply exchange public keys through a medium like USB drives and use the public keys to encrypt further communications.

Essentially, what you are asking after is a Public-key Infrastructure. As usual, do not reinvent the wheel outside of academic purposes. Use either TLS/SSL or PGP/GnuPG in practice.


What is the best way to reissue user certificates after configuration change in a template? I have setup my MS-ADCS environment in my company and configured auto-enrollment. i have everything working great, but found out that I want my "Subject Name Format" to have a different value.
We are not using the certificates yet in any service, so there's no real problem removing them and reissue new ones.
My question is - what the the best way or the right way to remove all issued certificates (~200) with the wrong subject value and deploy the new certificates with the new (and right) subject value? All users are in AD and I can use scripts or group policy if needed.

Thanks.

EDIT: just to clarify my intent - I prefer to remove/delete the issued certificates with the wrong subject format and don't care at this point about revocation list (note - I am aware to the consequence).

ADCS has a feature for this.

Assuming you have the Certificate Services Client - Auto-Enrollment group policy configured, simply create a new template in the MMC with the correct SAN configuration and add the original template name to the Superseded Templates tab.  Group policy will enroll for a new certificate with this template and delete the original for you.

There's no need to revoke anything as nothing's been compromised.


Encrypting only a small part of my hard-drive In Windows 10, I can encrypt the entire hard-drive with bitlocker. However, it makes some programs run too slowly. In fact, most of my hard-drive is not secret: these are just data files and documents that I intend to publish anyway. The only thing I can think of that is really secret is the file in which my browser keeps the passwords. For such a small file, it seems wasteful to encrypt an entire hard-drive. My questions are:

Are there other parts of a standard Windows system that should be encrypted, besides the browser password file?
What is an easy way to encrypt only those files, while keeping the rest of the hard-drive unencrypted and fast?

Method 1:

Right-click on the folder you want to encrypt and go to Properties

On the General tab, click the Advanced button

Under Compress and encrypt attributes section, click on Encrypt content to secure data encrypt files windows 10

Click OK and close Properties window

Apply changes to the folder, subfolders, and files when prompted
That’s that, your folder is now encrypted and its text is shown in green color.

Source.
Method 2:
Use a tool to do it like Gilisoft File Lock Pro for example


Which PCI DSS SAQ applies when you don't store store but transmit CHD? We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't stored at our servers.

Which PCI DSS SAQ applies to us? Which PCI DSS requirements should we conform to?

If your systems touch the cardholder data during transmission but you don't store any data, you will be an SAQ C.

For more guidance on determining you SAQ type, see the PCI DSS SAQ Instruction Guide v2.0 page 12, Selecting the SAQ and Attestation that Best Apply to Your Organization.


Local server applications using a web frontend on multi-user desktop environments Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment.

But I'm a bit concerned about the increasing popularity of applications applications using a localhost port to communicate between parts (for example back-end in python and front-end opened in a browser, ex: https://gdbgui.com/ )

On a unix multi-user desktop environment localhost is accessible by any user.

And worst, even if that kind of application would want to implement a secure connection between the web front-end and the back-end there is no really perfect solution:

use HTTP over unix domain socket (AF_UNIX): not currently supported by popular web browser
use a "user" private network interface "localuser": inexistant, localhost is the only standard
use a tocken in the url launched by the browser: http://localhost/?tocken=xyz : the tocken can leak to other user through the command line argument if procfs is not mounted with hidepid=1 option
have a password set during program installation, ask the user to enter the password  and set a session cookie: not the most user friendly for a desktop application...

So I can't even report bugs to the devs of these applications and hope for fixes !

My conclusion is that it seems that unix multi-user desktop environments are nowadays considered harmful for this use case (and I'm pretty they are for others use cases where multi user envs are considered harmful). And that I should consider switching to VDI (1 virtual machine per user) as soon as possible. But it would be a lot of work to migrate from multi-user environment to 1 virtual machine desktops per user.

But I want to be sure before changing my infrastructure: I am right in my reasoning or too much alarming ?

  N.B: I know it is an unclear question, it a result of a long search on securing localhost connexions on my multi-user unix environments without any successful solution, so I'm hoping for interesting opinions about this problem...

I don't have a good answer, but I note that the question does not mention container technology as a potential isolation mechanism to explore.

I would encourage that exploration. The container ecosystem has enormous momentum, thousands of engineers across hundreds of companies, containerizing all the things. There is no reason in principle that it would not be a perfect solution for this problem.

A production quality solution might not be available at the present moment, but I have already seen on several occasions the kubernetes ecosystem deliver a solution from a standing start before an org that needed the solution was able to get out of a planning process to ramp up on its own.

Quick googling on this finds a POC:

https://www.researchgate.net/publication/314070005_GUIdock-VNC_Using_a_graphical_desktop_sharing_system_to_provide_a_browser-based_interface_for_containerized_software

I don't believe the k8s machinery at present supports vnc, but I remember seeing ports of the vnc protocol to web sockets, which is directly servable from k8s cluster.

Hopefully someone with direct knowledge of the state of play here will chime in.


Random salt - necessary for a single user? Based on:
https://security.stackexchange.com/a/33520/42220
and
https://security.stackexchange.com/a/41630/42220

I can see the benefits of a completely random salt per user.

If I am implementing an application that will only ever be used by one user per database, is there any point in having a randomly generated salt?

If the salt was a string, e.g. a permanent, non-changing GUID, that is generated when an initial password is provided for the first time, can this safely be reused for this user every time?

Surely if the salt was randomly generated, it would need to be stored alongside the encrypted user password and user ID, which would mean the attacker has access to the salt from the database, which is just the same as if they reverse engineered the source code and saw a single, hard-coded salt in there?

Both using a random salt and several hash computations or another delaying strategy (bcrypt, scrypt, whichever) make sense not only for many users, but certainly also for one user.

Salt prevents an attacker from trivially entering your hash into Google to get an instant password without even using a tool. A good random salt makes it less likely that you've chosen one that someone else has built a rainbow table for the value anyway (such as for some obvious salts that you might see, like user IDs).

Having a different, random salt for every user prevents an attacker from reusing hashes in a rainbow table (or using a rainbow table for a specific salt that already exists readily). It forces to brute-force each individual user. You can't prevent someone from continuing a brute-force attack, and it will eventually be successful (since even "strong" passwords are relatively weak). But the longer it takes to brute-force one user, the safer the remaining ones are (if it takes 2 seconds to brute-force one user, you can do 1000 users in a few hours -- if it takes a week per user, things look much better). That is the whole point of using something like bcrypt.

Now if there is only one user, brute-forcing the first user means a 100% compromisation.

Therefore, using a strategy that delays brute-force is at least as important as with a many-user database (but conceptually more important).

Something like a GUID will do fine, it does not matter whether you store the "string" somewhere or whether you reuse it when the same user changes password. A salt needs to be accessible in some form so you can validate the password. Sure, it would of course be nice if you could keep it secret, but that is neither possible nor necessary for its purpose. Also, if someone can steal the salt, they will also have the hashed password, since that is usually stored in the same place. Insofar, there is no "additional risk" that someone might maybe prepare a rainbow table ahead of time for that known salt (before stealing the actual password). With that said, if you feel uneasy, it does not really cost anything to also change the salt every time the user changes password.

The purpose of the salt is not encryption of some kind but to thwart rainbow tables, which make inverting the hash function a trivial operation.

In principle, hardcoding a "randomly chosen" salt directly as you propose would be just as good for your one-user scenario. However, this is a bad approach since there is the possibility that you will eventually reuse the code for something else (a different project of yours) or that you will eventually have more than one user.

You may not see this coming right now, but it is generally a possibility.

Now the thing about things that may happen is that eventually they will happen. So if you directly hardcode a single salt since there's only one user anyway, you will eventually have a security hole, maybe in 10 years from now when you don't even think about it any more.
As soon as you use the same salt for several users or for a single user in several projects, it is pretty useless. You should simply not make it possible for that to happen.

The same applies, of course, to the approach of having a "permanent" salt which you use everywhere, say, for the remainder of your life. This is an open invitation to building a rainbow table, since doing so will save computional work. Attacking one of your passwords will be more or less the same workload as attacking all passwords in your lifetime.


Getting an employer to secure their website immediately I'm employed as a consultant at a big tech consultancy. I recently noticed a major flaw in their website, they send my login credentials in plain text over HTTP. I verified this by doing a outbound packet capture and lo and behold there were my credentials plain in view for anyone to see. What's worse the credentials were sent back over the wire once again in plain text if the login failed.

On the upside, they're not affected by heart bleed because they don't even allow HTTPS traffic...

I have read Reporting vulnerable sites and similar but I believe this question is a bit different as first of all I'm personally affected and forced to use the site regularly as I'm employed by the company owning the site (albeit not responsible).

I have informed the IT department and got a response in the form

  We have prior to your e-mail contracted a security firm that has done an
  extensive pen-test and among other things found your reported vulnerability.
  We're assessing the situation and will take action shortly.

Which to me means:

  Hi we know we're leaking your passwords and we might patch it up in the coming
  months or maybe next year. Meanwhile, why don't you go down to the church and pray
  that no one empties your paypal account.

Motivated by the fact that I could just park my cellphone on wifi outside their office with wireshark running to grab the credentials of most people in the office. To me, their response is not good enough. Further more, all they need to do is to force HTTPS for all traffic as a stop-gap. This doesn't take more than a few hours for a system administrator who knows what they're doing. And it doesn't have a negative impact other than some performance (provided they have patched OpenSSL if they're affected).

My question is, how do I get them to first enable HTTPS for all traffic immediately and then inform all affected parties that their username/password credentials may have been compromised and that they need to change them at all places they use that combination. Without loosing my job.

For the record, yes, I have changed my passwords already. And I had a random 128bit password to their site to begin with because I got a feeling it was dodgy from first sight.

There should be an entity responsible for security, such as an (chief) information security officer. It's a usually their job to take reports like yours and find the quickest way to solve the problem without compromising business. Giving it to the IT department often makes it a "support request without stakeholder" meaning you can still work so it's not that bad from their POV.

If you don't have that, you should write a friendly mail to management on the C-Level and inform them about the business risk that problems like this pose if they don't get attention right away. They can give that role of watching over these issues to an employee who is already working in the IT department so they don't necessarily need to hire someone.

Worked for me ;-)


Technical requirements applicable to IT department for GDPR In order to prepare for GDPR, what is required from an IT department to ensure Data protection for the business.

The general Data Protection Regulation doesn't require a massive amount of technical understanding. They would need to know about the technical Infrastructure of the organisations and all the locations personal data is stored, processed and in transit, making it easier to handle Subject Access Requests.

The company would need a reasonable understanding of security, ensuring adequate security controls and procedures are in place. This also goes for personal data stored on paper, ensure they are also secure.


How secure is the getapassphrase.com approach to password generation? getapassphrase.com is a website that generates passphrases. The user sets a complexity in bits, and the site spits out results like:
liberal panda and ill asp decline young suit in Kansas
or
rowdy whale and tired DJ build brown harp in Berlin
(For 64 bits, they all pretty much seem to follow the pattern of [adjective] [noun] and [adjective] [noun] [verb] [adjective] [noun] in [location])
I am not concerned at this point with security as it pertains to any specific implementation details of the site (i.e. does the website carelessly leak its results somehow over an insecure connection,  can an attacker reproduce the PRNG state based on e.g. knowing the exact time a passphrase was generated...) - instead, I want to ask about the complexity of guessing passphrases which are generated following a particular pattern.
I am aware that focusing on making passphrases longer generally provides more security than focusing on introducing weird characters. However, if an attacker knows (or guesses¹) that my passphrase was generated using getapassphrase.com, does it typically become feasible for them to crack it by brute force?
¹ Probably a decent guess, given that I'm posting about it on a public forum...

Probably better than any password you can come up with.
The idea is very similar to Diceware, where you take a word list and a few dice and you generate arbitrary long phrases, such as hotel qz juan shinto may. This is easier to remember than a truly random password, but still has the entropy of the dice throws behind it. In fact, it has roughly 64 bits of entropy.
The downside is that it is still somewhat hard to remember for some people. I, for example, like to visualize these things, so that's a bit difficult for me. As such, patterns might be able to help. By ensuring passphrase always follows a grammatical structure, we can make a passphrase easier to remember, while still maintaining the same level of entropy.
How is that still secure?
When calculating the randomness of Diceware, it was a relatively simple formula: Take the number of individual words and take it to the power of the number of words. Since there are 7776 possible words, and I chose 5, that's 7776^5. The base-2 logarithm of that happens to be around 64.
For words with a pattern, it's similar. If the pattern is [adjective] [noun] and [adjective] [noun] [verb] [adjective] [noun] in [location], then we can multiply them all together, which means the formula is
[Nr. of adjectives]^3 * [Nr. of nouns]^3 * [Nr. of verbs] * [Nr. of locations]

Those are 8 individual tokens, a number I am certain was not chosen arbitrarily, which means we can feed 64 bits of entropy randomly into it, which means 8 bits of entropy can be used for each field.
That means there need to be 256 different adjectives, nouns, verbs and locations and you will get a passphrase with 64 bits of entropy.
How could this work?
I don't know how the system works behind the scenes, but here is one possible way:
The system begins by drawing 64 random bits from a random number generator, such as:
0101011111011110011110000100110000101111101100001010101011010010

If this were your password, you would have exactly 64 bits of entropy, even if an attacker would know it was just 0's and 1's.
Next, the system splits the bits into groups of 8 and assigns each "token" 8 of these bits, as shown below.
01010111 11011110 01111000 01001100 00101111 10110000 10101010 11010010
[adj. 1] [noun 1] [adj. 2] [noun 2] [verb  ] [adj. 3] [noun 3] [locat.]

Then, the system checks its list of adjectives, which has 256 entries. 01010111 to decimal is 87, so it checks the corresponding entry. Let's say the first adjective is excited. Then it checks it's first noun, which is 11011110 222. Let's say the corresponding noun is racecar. The process continues until all groups of 8 bits are assigned.
Should I be using this now?
I'd give it a 3.6 / 5. While it is certainly better than ThisIsMyPassword or 1234abcd!, it has the downside that you still need to remember it, which can be hard for some people, especially seniors.
Furthermore, it means you have to trust the service that creates these passphrases. The owner could, for instance, store all the passwords that were ever generated, and since one password would only be 8 bytes in size, that'd just take 61 GB to store the password of every person on earth. Is that likely? Probably not, but you also can't prove that it's not the case. There are some bad actors out there after all.
In both of these cases, an offline password manager may be advantageous. This would allow you to generate your passwords locally, and store them locally as well. A simpler, less complex passphrase can then be used to secure that local password database.


Sketchy traffic from port 3030? I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student).

On scanning one of his servers, I discovered an odd open port (3030) that had an odd output I've never seen before. I did as much research as possible on the internet (supposedly, the service is called arepa-cas), but I couldn't find explanation for the output of my netcat. I also discovered it was a relatively well known port for certain viruses to communicate on, and I immediately recognized in the output some sort of encoding, and was wondering if I should be looking further into this. Here is sample output from a nc bind to the host & port:

root@localhost:~/[struck]# netcat -v -v [struck] 3030
DNS fwd/rev mismatch: [struck] != [struck]
[struck] [struck] 3030 (?) open
Aoe3Nc34iOc09HezzugEtiyLqqbUrR6ne57cfd6b7cd349bc8e08a5b83bdf5ee4>help
aX6JWsHFW47DOv7hOrdwSMgJMYVXYoGBwvJjE+c516rUW6bFP7DVBmgRWkLPHGTM>?
3r9DrxDy/kWdMA5VjtxnrA==>ls
3r9DrxDy/kWdMA5VjtxnrA==>^C sent 10, rcvd 180

I am not really asking for much other than where to begin, first of all trying to decode these messages (I tried base64 decoding, among others, as a wild guess, but yielded nothing. These look SUPER similar to JWT's, but then again, what encoded data doesn't), finding out what their context is, etc. Any nudging in the right direction would be super appreciated!

Determining What Is Running
Locally, Ask The Host
The most definitive way to determine what is communicating on port 3030 is to ssh into the server and run netstat.
netstat -nap | grep 3030

Will display connections and listening processes -n skips DNS resolution of IP addresses, -a shows the state of all sockets, and -p shows the PID of the process bound to that socket.
If you are using windows, check out this SO post.
Determining Remotely
If you can't get access to the server, there are other things you can try.
Run nmap against the port. nmap has pretty good service detection and if what is running on 3030 is a well known protocol, nmap will likely determine it.
nmap -sV host

You can find out more about nmap service detection in Chapter 7 of the nmap book.
What if nmap can't determine the service?
It may be that you are looking at a legitimate custom service for that application. Though you could also be looking at malware.
Determining the functionality of the service
If have permission to interact with the service, here are a few things you could try/notice:

It appears that each response is base64 encoded, and ends with a >. This to me suggests that it is a shell of some kind. Base64 decoding gives garbage, which suggests that this could be encrypted, although it could also be a custom base64 alphabet.
Enter various text. Does the same output get produced for the same input?
Is there a correlation between input length and output length?
Is output length always a multiple of some number? For example, in the four lines you showed in the question, the lines decoded to 48,48,16 and 16 bytes long. This could suggest a block cipher of some kind is being used.
Does the initial response to your connection change each time you make the connection? This could suggest the server is using a one time encryption key (or base64 encoding) for each connection. Thus, the first response likely contains the information necessary to interact with the service.
If you start to get common strings, start googling them. If you get a hit, you may get your answer.
Note, if custom encoding or encryption is being used, it is unlikely that your input will do anything, as the input will probably need to match the same encoding scheme.


Is my Password Hashing Secure or not? I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number.

#include <string>
#include <cmath>

int mod(int x, int y) {
   return x - floor((double) x/y) * y;
}

int crypt(string str) {
   int z = 0;
   for(int i = 0; i < str.size(); i++)
      z += mod( ( str[i] * -(str[i]) ), ((i*29) + 2999) );
   return z;
}

int password = crypt("Password1");

bool auth(string pass, int x) {
   if (crypt(pass) == x) return true;
   else return false;
}

It is not. There are bunch of problems here:

You has function produces 32-bit value, which is nowhere near sufficient for password hashing. For such short hashes it's feasible (and easy) to simply find colliding password (i.e. password that's different from the original but still hashes to the same value);
Function looks simple enough to be "reversible" in the sense that for given hash value it might be easy to compute matching password (again, this will be not the original password, but a colliding one);
Function is fast and doesn't require much memory, which is considered a disadvantage for password hashing, as it allows use of GPUs/ASICs.

It's almost never a good idea to invent your own crypto, including password hashes. There are various well-studied alternatives that are considered secure so you should probably use them (examples: PBKDF2, script, bcrypt). If those functions don't work for you for any reason please specify why and what other constraints you may have. This information is important as it gives context for your question which is currently missing.


Difference between different proxy types While using VPN handler apps I have come across terms such as

real host
dual real host
reverse proxy

These terms appear under the proxy type tab. What is the difference between them and what is their use while using proxy servers?

I'm not really familiar with the term real or dual real host but I'm assuming that means a normal (forward) proxy which essentially functions on behalf of one or more clients to shield their identity (among other purposes) from the internet at large.  The dual part is maybe a dual-homed proxy?  dual-homed means it has more than one network interface for redundancy.

As for reverse proxy it is the reverse of a forward proxy...it functions on behalf of the internal network of a collection of servers to make it appear as one single point is servicing clients when it may in fact be an entire network of servers providing services.


Has the POODLE SSL vulnerability ever actually been used? Is there any evidence that the the POODLE SSL or TLS has actually been proven to be a risk for file transfer like SecureFTP etc...?   ...or is it just a theoretical exposure?

The POODLE attack is actually very hard to pull off in real world conditions. A SecurityMetric blog post lays it out well:

  Here’s an explanation of how an attack would have to take place in order for an attacker to exploit POODLE and assume the user’s identity on the target site.

  The victim must be logged into a site using HTTPS (and the session cookie must not be expired)

  The victim must browse to another website over HTTP before the session cookie expires

  The attacker must write a custom JavaScript code to exploit POODLE. To date [OCT 22, 2014], no prepackaged tool has been published to exploit POODLE

  The attacker must inject ~5,000 requests in order to decrypt the session cookie

  Basically, this attack is extremely difficult because both the merchant and the user have to be vulnerable.

So to answer your question, this risk leans heavily to the theoretical side. I haven't found any news stories, blog posts, or security advisories saying that this exploit has been confirmed in the wild. POODLE has a high barrier to execution, and it's paid off.


What security boundaries exist in Windows? In an old article, Mark Russinovich defined a security boundary as:

  [A] wall through which code and data can’t pass without the authorization of a security policy. User accounts running in separate sessions are separated by a Windows security boundary, for example.

Other than user accounts, what security boundaries does Windows have? Also if you run a program as a different user within your desktop session (e.g. by using the runas command), does this undermine that security boundary?

Microsoft recently shared its Security Servicing Criteria that explicitly defines security boundaries of Windows and its applications:

  Network boundary: An unauthorized network endpoint cannot access or tamper with the code and data on a customer’s device.
  Kernel boundary: A non-administrative user mode process cannot access or tamper with kernel code and data. Administrator-to-kernel is
  not a security boundary.
  Process boundary: An unauthorized user mode process cannot access or tamper with the code and data of another process.
  AppContainer sandbox boundary: An AppContainer-based sandbox process cannot access or tamper with code and data outside of the sandbox based on the container capabilities
  User boundary: A user cannot access or tamper with the code and data of another user without being authorized.
  Session boundary: A user logon session cannot access or tamper with another user logon session without being authorized.
  Web browser boundary: An unauthorized website cannot violate the same-origin policy, nor can it access or tamper with the native code and data of the Microsoft Edge web browser sandbox.
  Virtual machine boundary: An unauthorized Hyper-V guest virtual machine cannot access or tamper with the code and data of another guest virtual machine; this includes Hyper-V Isolated Containers.
  Virtual Secure Mode boundary: Data and code within a VSM trustlet or enclave cannot be accessed or tampered with by code executing outside of the VSM trustlet or enclave.

User boundary says "without being authorized": by running runas, you give the authorization (by providing sufficient credentials), so the boundary is not violated.


XSS from JSON outputs In the book "XSS Attacks - Exploits and Defense" Jeremiah Grossman writes:

  The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the calling script.The developers never realized that attackers could send users directly to the JSON output. While AJAX and JSON do not generally introduce new holes per se, they definitely can increase the attacker’s surface area.

I thing there is no way for the attacker to force victim's browser to run javascript from JSON directly. Is there any example that shows the authors intended purpose?

By surface area, Grossman is referring to the principle that the probability of successful attack increases as more of a system's security boundary is identified. 1

In the question, the surface penetration for the an attacker to run JavaScript from JSON (whichhttp://blog.watchfire.com/wfblog/2011/10/json-based-xss-exploitation.html may arrive at the browser through an asynchronous RESTful GET or POST) may require two breach points.

The ability to inject JavaScript into the RESTful JSON stream
The ability to transfer execution to one of the objects instantiated during parsing

Depending on the conditions prior to the attack 2, one or both of those mechanisms may already be in place, therefore not requiring that particular breach. 3

The direct answer to the question is that the various documented XSS attacks can be used to accomplish either or both of those breaches.  Which ones that might be used will depend on the details of the surface Grossman mentions.

There is an example in the comment from @rápli-andrás, and here is a good overview with more code examples.

[1] Once a breach occurs, if there is no further security surface, the attack is complete.  Otherwise it is partial, which still may facilitate the attacker's objectives.

[2] Conditions include the design of the system and its current execution state in the browser and server.

[3] This may have contributed to the vulnerability with the Google Reader.


Comparing Session Hijacking, Fixation and Riding How do I differentiate between these Session Hijacking/Session Fixation/Session Riding. I find it difficult to understand when read about all three at the same time. I get very confusion between when comparing Hijacking with Fixation because there's sort of thin line deference. Can someone provide a technical yet easy to understand explanation?

In session hijacking the attacker somehow gets hold of the victims session ID and uses it to impersonate the victim. The attacker essentially takes over the victims session - hence the name.

To do this the attacker needs to find out what the victims session ID is. This can be done in many ways, e.g. MitM or XSS.

In session fixation, the attacker picks a session ID and forces it on the victim. For example, if a website accepts session ID:s in the URL, the attacker can fool the victim to visit http://example.com/?session=123456. The victim does this, and then logs in. When the attacker now browse the site with the session ID 123456 she will be logged in as the victim.

Note how this is sort of the opposite of session hijacking - the attacker sets the victims session ID instead of getting it - but the end result is the same. The attacker knows the session ID and can impersonate the victim.

Finally, session riding is just another name for cross site request forgery (CSRF). See this old answer of mine for an explanation of what it is.

The main difference from the two above is that the attacker does not know the session ID. Instead she abuses the fact that the browser will always send the session cookie with all request the victim makes, even if the victim did not intend to make them.


What security considerations should I take when planning do to Incident Response in my hybrid public cloud environment? I am trying to compile a list of areas one should be aware of when doing Incident Response on public cloud environments, e.g. a hybrid public cloud, where some services are provisioned in local data-center, while is in the cloud.

Some thoughts:

Pulling RAM to do memory forensics will be hard, if not impossible, to do on a SAAS, PAAS, or similar service.
Physical access to devices will in most cases be impossible. If you have to get the physical disk that stored illegal material, you are most likely out of luck.
The service you are using may be limited, altered or in other ways different than what you are normally using. E.g. Azure SQL as a Service, you don't have a fully fledged database as you are used to. Plan for this.

Some concerns that is not directly impacted by Incident Handling, but my cause it to happen:

Isolation vs. Multi-tenancy. In some way, you are going to share resources. Your cloud service may have other clients ruining it for your systems.
The above may also apply to security. Compromise of one SAAS client, might lead to compromise of others if the vendor is not configured properly.
VM Escape is a dreaded possibility. A compromise in the underlying hypervisor might compromise all hosts.
If you're not familiar with the cloud service's ACL's, you may be unsuspectingly exposing services on the open internet, that you otherwise thought to be internal only.
Cloud vendor may not be as dilligent as you when it comes to limiting physical access. #BadUSB
Your data may be susceptible for e-discovery, even if you had nothing to do with the incident.

Does anyone have any other thoughts or concerns on how a public cloud may impact our incident handling? Preferably we could keep in mind the 6 phases too:

Preparation
Identification / Analysis
Containment
Eradication
Recovery
Lesson Learned

A lot of this comes down to partnership, identification of responsibilities and communication between you and the cloud Service Provider (CSP)

Preparation

Identify who is responsible for monitoring suspicious activity. Do you capture logs, monitor and review logs and alerts? Does the CSP?

Identification/Analysis

If you suspect an incident, do you know who to talk to at the CSP?
If the CSP suspects an incident, will they contact you? If so, is this standard or an escalation path? i.e. are you informed in a timely manner or too late?

Containment

Do you have the tools to do this? Do you know what resources you're sharing with others? As a hybrid cloud offering, do you have other facilities, environments you can rely on? How do you identify infection and propagation thereof?
Who do you inform? Do you have to tell the CSP before you contain the problem? Must they take action on your behalf?

Eradication

Do you have resource available to eradicate when also containing?
Can you confirm eradication? Can CSP confirm or vouch for same?

Recovery

Do you have backups, clean images? Do you need to re-synchronise with other environments? Do you have mechanisms to achieve this and verify the integrity of your systems, applications, data once complete?

Lessons learned

If this happens again, can you reduce all the workload above? Based on how the situation was managed, should you give more or less responsibility to the CSP? Can you improve communication and transparency of activities? Is it possible to change those issues you identify require change or must alternatives be identified?


iPad stolen with LastPass, Should I be worried? Unfortunately my iPad was recently stolen and I had LastPass installed on it. Both the iPad and the app are protected with TouchID and passcodes. However, LastPass keeps an encrypted offline cache of the passwords and other stuff including secure notes for bank accounts and cards, etc. I understand that it should be very unlikely for someone to get through TouchID and the master password for the app. Just in case, I can go ahead and change the password for all the critical websites, but I can't change anything about the bank accounts and other secure notes already in there. Should I be worried about someone getting the vault decrypted? I'm assuming the everyday petty thief wouldn't go through all that but some advice could still be helpful.

LastPass promises to that your password database can only be decrypted if the attacker knows your master password. So if you trust LastPass, you don't have anything to worry about.

However, given that LastPass is closed-source software, there is no way to actually verify this promise, and hence the security is based upon your trust in the company.

Still, given that you trusted the company enough to become a paying customer, there is no need to change any of your passwords. They simply cannot be uncovered without knowing the master password.


how to associate a public key with a user of a website I need to generate a keypair for each user registered with my website. The user already has an assigned username and password (let's assume that these credentials were assigned to the user and that he did not have to sign up to the website).

Upon first authentication i want to generate a keypair for the user such that he produces a keypair (maybe using SubtleCrypto), retains the private key and send the public key to the website server. I have these questions:

Where do I store user's private key ?
How do I ensure that the public key received by the server is actually from the user that claims to send it and there has been no man in the middle attack ?

how to associate a public key with a user of a website

To map an entity (a user in your case) to a public key, you can use a digital certificate. For example an X.509 certificate. The user details should typically reside in the Subject part of the certificate, while the public key resides in the Subject Public Key Info part.

Otherwise, you can simply store the public key in the database and link with a user id.

  Where to store a user's private key?

With the user. They can store it anywhere on their computer. However the private key should be protected with strictest file permissions (that is how ssh keys are stored typically). Other alternatives include a keystore (see Java KeyStore), or even a password manager (e.g. 1password), or a hardware security module depending on how precious the private key is.

  How do I ensure that the public key received by the server is actually from the user that claims to send it and there has been no man in the middle attack ?

To prevent man in the middle attack, you should be using TLS. To make sure that the public key is actually from the user who claims it, the server must make sure that the user is authenticated before accepting the public key.


Is there a need to define "language safety"? Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe now, is Java version 7 "safer" than Java version 2?

A language can be said to be "safe" if it is possible to implement its interpreter/compiler/runtime environment efficiently, in full respect of the language specification, and still forcibly preventing "bad things" to happen. Then it depends on what "bad things" you are talking about.

Java is "safe" if you want to protect the machine from the code written by the developer. Array bounds are checked, types are unescapable, and memory deallocation is handled by a garbage collector, which means that it is not theoretically feasible to make a Java applet, however poorly written, execute attacker-chosen native code. In the same conditions, C is "unsafe" because it cannot be fully implemented with checks which prevent arbitrary code execution.

Of course, in practice, things change a bit: C code can be made "safer" with various techniques (like DEP and ASLR) and the OS can "contain" native code under some specific access rights (a "normal user" process is not root). And Java actuality shows us that while Java is theoretically safe, the implementation of the Java Virtual Machine and its runtime environment can have holes. To some extent, the exact JVM specification ensures that implementing Java safely is hard (that's a misfeature of the Applet model: it forces per-method control throughout the whole standard library).

You cannot have a one-size-fits-all definition of language safety, unless you are content with a subjective slogan (COBOL sucks ! F# rules ! Prolog forever !). It all depends on the context.


TCP Sack panic proof of concept? For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies?

[1] https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md

[2] https://access.redhat.com/security/vulnerabilities/tcpsack

[3] https://isc.sans.edu/diary/What+You+Need+To+Know+About+TCP+%22SACK+Panic%22/25046

There appears to be a proof of concept on github:
https://github.com/sasqwatch/cve-2019-11477-poc


How to modify a certificate using getTBSCertificate() method I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). I'm stuck in the case that how to do the modification on the certificate using getTBSCertificate() method. My following code does the verification process perfectly BUT I tried to make it fail using bit or byte modification's idea but it doesn't work. Note that this idea that I proposed is to proof that any modification on the certificate will make a failure while signature verification

 public class VerifyX509 {

private static Certificate getCACert;
private static Certificate[] getCert;

public static void main(String[] args) throws CertificateEncodingException {
    setURLConnection("https://www.google.com");
    X509Certificate x509cert= (X509Certificate) getCert[0];
    byte[] b= x509cert.getTBSCertificate();
    b[0] = (byte) ~b[0];
    // HOW TO UPDATE getTBSCertificate() after flipping the b[0] to make Verify() in my method verifySign() return false!
    verifySign();

  }

public static void setURLConnection(String link){

    try{
        int i=1;
        URL destinationURL = new URL(link);
        HttpsURLConnection con = (HttpsURLConnection) destinationURL.openConnection();
        con.connect();
        getCert = con.getServerCertificates();
        for (Certificate c : getCert)
        {
            if (i==2)
            {
                getCACert= c;
                return;
            }
            i+=1;
        }
        }catch (Exception e1) {
        JOptionPane.showMessageDialog(null, "Error while connection! Check your Internet Connection.");
        e1.printStackTrace();
        }

}

public static boolean verifySign()
{

        try
        {
            getCert[0].verify(getCACert.getPublicKey());
            return true;
        } catch (GeneralSecurityException e2)
        {
            return false;
        }
}

Mr. Mike, all what you have to do is to get the row data DER-encoded certificate information (TBS part) and you can extract it as below

URL url = new URL("https://www.google.com/");
HttpsURLConnection con = (HttpsURLConnection) url.openConnection();
con.connect();
Certificate userCert[] = con.getServerCertificates();
        X509Certificate x509cert = ((X509Certificate) userCert[0]);

    byte[] tbs=x509cert.getTBSCertificate();

Then copy the content of the array tbs to another array bcopy through a loop and do what ever modifications you want (i.e by using the masking technique Anding with x55) after that you can get the hash value through

 String sha1 = "";
MessageDigest crypt = MessageDigest.getInstance("SHA-1");
        crypt.reset();
        crypt.update(bcopy);
        sha1 = byteToHex(crypt.digest());

private static String byteToHex(final byte[] hash)
{
    Formatter formatter = new Formatter();
    for (byte b : hash)
    {
        formatter.format("%02x", b);
    }
    String result = formatter.toString();
    formatter.close();
    return result;
}

at this point you have the hash value of the modified certificate, you can go now and extract the signature from the original certificate [ byte[] sig= x509cert.getSignature(); ]  and decrypt the signature to get the hash value and compare it with the modified hash value, good luck ;)


Is OpenVPN secure if both the certificate and private key, are publicly known? My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test.

It gives you the option of OpenVPN and provides a guide for Ubuntu.

Part of the guide involves downloading a certificate and its private key. You download it over SSL but the certificate isn't unique to you the user. Anybody can go to that page and download both halves of the key.

This question really comes from not understanding how OpenVPN uses TLS but...
How is the connection secure if a malicious party knows the encryption details and keys?

(Can somebody add the openvpn tag to this? That seems like it should be a valid tag here.)

I've just been talking with the IPredator guys on IRC and it's quite interesting. I've made some incorrect assumptions.

As part of the installation process you add their CA. That's fair enough. So the whole connection happens through RSA (or similar) public-key encryption.

The key-pair is just an additional TLS encryption layer for authentication. They freely admit it offers no additional security for users but it does mean that anybody trying to connect needs that pair of keys. Requiring them has meant a sharp drop in connection-style DDoSes.

So it is still secure. The key-pair is just some additional security-through-obscurity.


I need to download and open an email attachment but how to check if it's safe before? Someone sent a 39 kb file email attachment.
A strange picture appears over the attachment. I didn't open it.

I would need to check the file but I'm afraid it's a scam.
I was planning to log into my email account from a Linux live distro (like LPS, delivered for security purposes, which does not allow to explore files from the media installed in the hdd or ssd) and open the file from there, so if it's a virus it will not attack my system I think...Is it still safe? Or should I avoid opening it at all?

How may I check if a file attached to an email message contains
viruses/malwares/(...) without risks?

An online virus checker would be good. Some e-mail clients such as gmail automatically scan attachments for viruses. Alternatively, you could download, but not open the attachment and scan with a program like Avast! or some similar antivirus.

However, those scans can't possibly cover every single type of malware.

I would say, if you are expecting or have reason to suspect an attack from the attachment, either don't open it all or go with your Live Linux Distro Option if you must.


GNU C Library getaddrinfo() Flaw As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs  domain name lookups, contains a buffer overflow bug(see the link here).

The consequences of this seem to be quiet horrific and it will take time to even have an overview on the size of the list of vulnerable hardware and software which uses this library.

While the extension of the damage and the fixes to follow will hopefully come sooner rather than later, there are some mitigation's which may prevent the attack advised by Google researchers:

  Google has found some mitigations that may help prevent exploitation if you are not able to immediately patch your instance of glibc. The vulnerability relies on an oversized (2048+ bytes) UDP or TCP response, which is followed by another response that will overwrite the stack. Our suggested mitigation is to limit the response (i.e., via DNSMasq or similar programs) sizes accepted by the DNS resolver locally as well as to ensure that DNS queries are sent only to DNS servers which limit the response size for UDP responses with the truncation bit set.*

And Glibc maintainers provide the following mitigations:

    Mitigating factors for UDP include:

  A firewall that drops UDP DNS packets > 512 bytes.
  A local resolver (that drops non-compliant responses).
  Avoid dual A and AAAA queries (avoids buffer management error) e.g. Do not use AF_UNSPEC.
  No use of options edns0 in /etc/resolv.conf since EDNS0 allows responses larger than 512 bytes and can lead to valid DNS responses
  that overflow.
  No use of RES_USE_EDNS0 or RES_USE_DNSSEC since they can both lead to valid large EDNS0-based DNS responses that can overflow.

  Mitigating factors for TCP include:

  Limit all replies to 1024 bytes.

At the moment I am trying to find a way to limit the size of responses via iptables and the use of the limit module. But so far I have only found ways to use the rate-limits which are not applicable here. Any ideas how this could be translated into an iptables rule(s)?

I am also currently looking into how to have a dns resolver to drop non-compliant responses, so any thoughts/ideas are most welcome.

trying to find a way to limit the size of responses via iptables and the use of the limit module

What you probably need is the iptables length module which can match packets which have a specific length (or range). See http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.html#toc3.7.

Note that this only helps with UDP where the full payload is contained in a single message (you should drop fragmented UDP packets though). With TCP the response can be transferred using multiple packets and a single TCP stream can also contain multiple requests and responses. Thus limiting the length of a packet will not help much.

  I am also currently looking into how to have a dns resolver to drop non-compliant responses, so any thoughts/ideas are most welcome.

The best would be to have a application level gateway which sanitizes responses, i.e. a local DNS server which gets accessed from the resolver library. Something like dnsmasq could help although I'm not sure if dnsmasq really sanitizes responses enough for this specific case. Other options would be setting up unbound or bind, although bind has a bad history regarding security itself.


How to create ssh tunnel using netcat? I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell me how to it?

What's up?  Here's the meat and potatoes:

nurf@sessmacheen $ ssh -f -L localport:localaddress:remoteport \
    user@remoteaddress sleep 10; nc localaddress localport

This is assuming that sshd is listening on the remote box, which I think I can infer from your post.

Ok! So ssh is passed -f, which just backgrounds it after the connection is made, and -L.  I remember -L as 'Link'.  It creates a tunnel, wiring up a port locally to a port on the remote host (the localport:localaddress and :remoteport user@remoteaddress parts, respectively).

So ssh is reaching out and holding hands with sshd on the remote host (for 10 seconds, anyway), and it's sitting locally with it's hand outstretched waiting for something else to grab hold.  So we nc localaddress localport.  Et voila!

Granted the one liner above doesn't actually do anything except establish a connection and then run sleep 10 on the remote box.  Here's a more practical example, totally ganked from this article.

## let's pull a back up image  over the wire!                   ##
## first we set up the image for grabbing on the remote machine ##
## by piping it to nc which then starts listening on port 9000  ##

dude@remotebox $ cat backup.ico | nc -l 9000

## and now we tunnel! locally, ssh opens up on 9001, and        ##
## connects to 9000 on the remote machine where nc is waiting   ##
## with cat, ready to go.                                       ##

nurf@sessmacheen $ ssh -f -L 9001:127.0.0.1:9000 dude@remotebox \
    sleep 10; nc 127.0.0.1 9001 | pv -b > backthatthangup.iso;

## this is pretty sweet because after nc gets done with the     ##
## connection, ssh finishes running sleep and closes it so you  ##
## don't have to fool with it.  nice and tidy.                  ##

## pv is a handy little utility that tracks data across a pipe  ##
## and will show you a progress bar and whatever else you want  ##

Naturally, to create this connection in 'reverse', you just, you know, do it the other way 'round.  Backwords, if you will.  Let me know how it works!

Oh yeah, also: nc won't bind to 22 because sshd's oh-so-privileged self is already sitting there.  Hence the use of arbitrary ports outside the reserved ports range (i.e. anything above port 1024).  Since 22 is one of the reserved ports, you'd have to be root to bind to it anyway.


How to know when a pen test is complete? Specifically considering client websites where we have been asked to execute a pen test; at what point do we stop and say we're done?

We have access to various tools (some automated, some manual); but if we say "we tried all our tools, and couldn't make any progress", that could be construed as us saying that we're not clever enough (and there's always some hacker out there who could be cleverer).

So; how do we protect ourselves against upset clients who claim that we didn't work with due diligence? Is there a standard report framework we can work within?

So this is actually a very interesting question for the industry in general.  The way I would suggest you handle it is

Have something in your contract that disclaims liability for vulnerabilities not noted during testing. Reason for this is, it's basically impossible to be sure that you've found every exploitable issue in a website, or any other system.  To pick one example, think of all the sites that were sitting vulnerable to shellshock for years and years, should all the pen test companies who touched one of those sites be liable for not telling their customers?
Have a methodology, saying what you will do. This should cover the general areas of testing that will be completed.  For websites, consider basing on something like the OWASP Top 10 as a starting point. This gives you some common ground with the customer on what you'll be looking at.
Make sure your company covers the basics with a checklist.  as @rapli says above document all the little things, but don't overblow the severity. Whilst it's important to make sure your test isn't just a checklist, using one can avoid embarassing mistakes where basic tests get missed.

The problem you might/will run into is unrealistic expectations from customers.  that one is a case by case to address.  If you get a customer that expects that their complex application will be completely reviewed in like 5 person-days of testing, well you should explain why that's not a practical concept :)


Controlling where a program crashes I'm missing a part of the process for preparing a payload for an overflow exploit. To crash a program using an overflow vulnerability, lets say the heap. How can we control the memory address it crashes at and how can some code be sent to control how it executes? E.g. ROP, does the payload contain the shellcode that crashes the program and perfectly replaces the content of the return pointer address of the function with the executable function of the exploit?

I dont get the link between the overflow, controlling the exact memory offset to place the exploit inside the corrupted memory, and the key, how to return the execution to that point, without crashing the application?

Steps to Exploitation

Finding the Vulnerability

This is probably one of the hardest steps.  There are various ways to find vulnerabilities, and none of them are quick and easy.  This takes time normally on the order of months.  But lets say you're doing this on your own so you write your own bad piece of code:

  1 #include <stdio.h>
  2 #include <string.h>
  3
  4 int function(char **argv) {
  5     char buf[8];
  6
  7     strcpy(buf, argv[1]);
  8
  9     return 0;
 10 }
 11
 12 int main(int argc, char **argv) {
 13   return function(argv);
 14 }

So here the vulnerability is copying an arbitrary string from the command-line arguments.  Compile the code with stack mitigations turned off.

gcc overflow.c -o overflow -z execstack

Triggering the Vulnerability

Now you need to trigger the vulnerability.  You know what it is.  The strcpy blindly copies whatever string is contained in argv[1].  The buffer that the argument is copied into can only contain 8 bytes.  Anything past this will overflow the stack.  See this answer about how stack overflows work.  So you can trigger the vulnerability by running it like so:

./overflow 01234567ABCD1234

Now if you read the link on how stack overflows work you'll know that you've overwritten the saved stack frame pointer with 0x41424344 ("ABCD").  And you've overwritten the return address of the function with 0x31323334 ("1234").  This is great right?  You can now control the return address of a function which means you can now tell it where in the program to start executing.

This seems easy, but in reality triggering a vulnerability can be frustrating.  Determining the exact path can be straight forward depending on the resources at hand.  But nudging and poking execution to take the path that leads to a vulnerability to trigger it can be very difficult.

Exploiting the Vulnerability

You've triggered the vulnerability and the code segfaults.  Now what?  Now you need to write your shellcode to do something useful.  This is purely up to you.  Writing shellcode is an art in itself, but exploitation comes down to being able to write your shellcode into memory, and then executing it.

Back to our example.  We're overwriting the stack.  So keep on writing!  After the return address is overwritten write your shellcode onto the stack.  So now you have something like:

./overflow 01234567ABCD1234<SHELLCODE>

Remember how memory is oriented, and make sure the shellcode is aligned to the stack.  You know the size of your shellcode.  We're working in an example where program memory is not randomized so we know the address that we overwrite (You can find this by running your program in gdb and witnessing the address for yourself).  With the address and the size you can calculate the address at which your shellcode starts.  Rather than using 0x31323334 use 0x<address of shellcode>.

Now you have something like: ./overflow 01234567ABCD<address of shellcode><SHELLCODE>

The function will return to your shellcode, and begin execution.

Reality

That was fun, but in reality there are a lot of things you need to take into account.

Stack Execution

The program was compiled so that the stack was executable.  In reality it might not be if DEP is turned on.  This is where return oriented programming comes into play.  ROPs help execute portions of code at a time in executable portions of memory.  Generally a ROP's job is execute instructions that will mark the area of memory the shellcode is in to executable, and then jump to the shellcode.

ASLR

ASLR will randomize the address that a program is executed or a library is loaded.  You can see how this works by running the piece of code in the previous link.  You'll be able to see how each time a program is run the address changes.  This means you can't rely on that pre-calculated address.  Generally you'll need a separate vulnerability to leak an address or get the address of a library in order to calculate where you are running in memory.

Stack Overflow

In a stack overflow you just blew away the stack!!  You possibly overwrote other return addresses, and key pieces of memory that the program needs to run.  Yes the shellcode was run, but what do you do when your shellcode is finished?  Cleaning up the stack correctly, or closing the program gracefully is another challenge.  Or maybe you just don't care, because now you full access to their box anyway.  Just something to keep in mind.

Lots of ways to skin a cat

Gaining execution can occur in lots of different ways.  This post only goes over the one example.  As you begin to grasp these concepts you can start to get into other techniques for gaining execution after triggering a vulnerability.  But that would be well outside the scope of this answer.

I'm sure I'm missing something in all of this. At least this will give you an idea of how difficult exploitation is, and how much you need to take into consideration.  Hopefully you can use this as a base, and perhaps later if you have more questions you can ask a more specific question.


What are the disadvantages of using Shamir's Secret Sharing to implement a Partial Password scheme? Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three characters of that password:

I have previously asked about implementing this and it is obvious that simple approaches such as hashing individual characters fail completely. Suppose we are also barred from implementing a hardware authentication module that will store the password and just gives you a correct/incorrect answer for your input.

Another potential approach is using Samir's Secret Sharing, as described in details here with regard to the idea of partial passwords.

Roughly, we are providing an ability to recover a secret password (or its hash, which is better) by providing let's say 3 out of 8 chunks of data.

Is this scheme secure against brute force by an attacker who obtains access to the database, and by secure I mean secure at least to the same degree as a database of traditional salted and hashed passwords?

The source you cite actually already points out the problems, although it does actually considers these as problems but as advantage. To cite:

  Pros and Cons
  The highlights of this solution are:
  ...
  5. Faster to compute - verification is several multiplications of 32 bit numbers that is much much faster than computing a hash value.

The attack you are trying to prevent is that the attacker can guess correctly provided that the attacker knows the secret information stored in the database.

In your example you have a secret with 10 alphanumeric characters where the attacker needs to guess a specific 3 characters. This means 363 guesses are needed when only upper-case characters are allowed or 723 with also lower-case characters. Given that the check is very very fast the attacker can quickly find out these values (i.e. likely real-time) if the secret stored in the database is known.

If the attacker must choose more than 3 characters it gets harder to do in real-time but it can be easily precomputed. If 5 out of 10 characters are needed than 10*9*8*7*6/(2*3*4*5) possible "masks" for entering the characters must be precomputed with each has at most 365 (or 725) possible values, i.e. at most  10*9*8*7*6/(5*4*3*2)*725 really fast computations must be done. Assuming that 10000 computations could be done in a second this would take the attacker a day if he has a botnet of about 600 machines - which is not unreasonable. And it could probably be optimized. With 4 out of 10 characters one would only need 6 machines for a day and with 3 out of 10 a single machine could do this in less than 1.5 hours.

Note that this estimates also assume a random secret. If it is a user chosen secret it gets much worse since the search space is smaller. But, if the user can not chose the secret then he probably needs to write the random secret somewhere - defeating your original idea why this additional secret should be given (i.e. prevent shoulder surfing and storing in password managers) in many cases.


Self-signed certificates in mobile and desktop applications - are they enough? I want to secure my data transfer using TLS between my own mobile and desktop client applications and my server. I am not at this time interested in web-based applications, so I don't really care that my browser will think my self-signed certificate is dodgy and display a bad message to that effect, because there is no browser to do that in my client applications.

I'd like to self-sign my certificates if possible purely for convenience and cost, although I know certificates aren't really that expensive.

My question is, for mobile and desktop client based applications, are self-signed certificates enough? Are they safe?

For the safety of the data your key matters. As most people do not know your (public) key certificates are a way that some trusted instance can verify your key and sign a certificate "the key indeed belongs to domain X".

For when you don't need a public CA, it is to costly, or unavailable for other reasons, you have the option to create a self-signed certificate which is signed with the key itself. Users have no direct way to verify it as they do not know the key and have no indication if it is your self-signed certificate or some rogue one.

But there IS a way to trust the certificate and that is validation via another way. Look at the certificate details: There is a fingerprint which can be compared against the fingerprint of the right certificate. If they match, everything is okay.

When you use self-signed certificates just for yourself it is easy to do this verification as you know both sides of the connection. When you are writing an app you can use a hardcoded fingerprint to verify the certificate, which may even be more secure than checking against a CA (because you only need to trust yourself).

What you lose is flexibility. When you want to change the key you need to change the certificate fingerprint in your application. Using the CA system you just let a CA trusted by your application sign the new key and the application will accept it.

To answer your question: They are safe as long as you verify them in some other way which works without a CA. When you disable checking certificates you are way less secure.


Can malware be dangerous even when quarantined? I am reading a book on network security and when talking about user confusion it writes:

  "It is not uncommon for a user to be asked security questions such as
  Is it safe to quarantine this attachment? With little or no direction, users are inclined to provide answers to questions without
  understanding the security risks."

Could someone please tell me, a confused user, what are the dangers of quarantining an attachment? My understanding is that a file in quarantine cannot interact with the OS in any way, thus it isn't a security risk but we also cannot analyze it to see if it is a virus.

No

Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them).

This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage.

In most anti-virus programs, the quarantine files are stored in internal binary formats. Since there is no physical connection between the infector file to your system (your anti-virus program works as the storage format is also a plus point), it is not dangerous.

Analyzing:

Regarding analyzing an infected file, yes it is not possible after quarantine. If you want to do that, you either try disinfecting it or restoring it to its original place (you have to disable your anti-virus program to do this and this is the place where you are opening the cage) and then analyze it. But remember the zombie might eat you up (unless you are good with shotguns)! So it is at your own risk.

Why not just send the infected/suspicious files to the anti-virus program team? They might give you a better picture after inspecting it with their updated virus signatures.

Bottom line: A quarantined file is not dangerous. But analyzing them yourself might be.


Is it a good idea to host a SFTP server within a dockerized environment with mounted host directories? For platform hardware independence, a proposal to host a SFTP server within a containerized environment was being considered.
A container or pod would have the server running within it, with mounted host directories for file related operations.
I am not certain how secure this proposal could be, both from SSH and docker perspective. While I can see the merit in hosting a shared service or a webpage within a container, and modifying files within that container using SFTP, here though, the users of SFTP are expected to be the host users - not sure yet how it'll translate into the container - with mounted directories having write permissions, so that the sftp service inside the container can modify files outside on the host.
I was also concerned about the login credentials of the host users (auth_keys files) being present inside the docker container, though those are public keys, so should be OK everywhere maybe...
The host platform is a Linux platform with STIG guidelines conformance, and I am not sure whether there is something which would offend STIG guidelines with this implementation either. I didn't find anything explicit there...
Therefore I wanted to ask if there was anything in STIG guidelines for a RHEL type OS which would prevent this mechanism from being implemented, if so, then I'll research and learn and this becomes moot, if not, then is it at least something which can be considered alright from a security perspective?

It's important to note, when considering container security, that standard Linux containers are literally just Linux processes with some isolation techniques applied to them.
There are security considerations relating to them, but they're really similar to what you would have for any other process running on a host.
In this case, when you mount files inside a container, you're giving the contained process rights to operate on them, in the same way as you would if you gave an SFTP daemon running on the host access.
Key security concerns are likely to be :-

Ensuring the container image comes from a trusted source (e.g. you control the image building process)
Ensuring that the image is patched. Generally container images come with Linux base files to support the running daemon, so ensuring patching is maintained is important.
Hardening the container image. Important issues include making sure your container isn't running as the root user (many images default to this) and only installing packages that are neded for the operation of the daemon
Controlling what files can be mounted from the host. The Docker daemon runs as root, so if you let a user define what directories they can mount, it's possible fo them to mount sensitive directories inside the container.


Question about AES-CBC IVs I'm writing a Java program that encrypts strings with AES-CBC encryption. (Eventually I'm going to add steganography functions too).

As you are well aware, CBC needs an IV in order to encrypt the first block since there are no previous blocks to inherit from.

I have done some research on IVs, and from what I can find:

The IV should be random
The IV should change from message to message

Currently, for ease of testing/debugging purposes, I'm using a fixed IV.

However, now that I have most of the bugs worked out in my program, I'm looking to improve the security by removing that fixed IV.

What I'd like to know is: Is it secure use a second key for the IV?

For example, my program currently prompts the user for a key of the appropriate length for the encryption process.

What If I prompted the user for either:

A) 2 keys (of the same length; one for IV and the other for the actual encryption)

B) 1 key twice as long (splitting it into two parts; the first for the IV & the second for the actual key)?

Would that be secure?

The IV is a random non-secret value. Its sole purpose is to prevent two similar blocks from yielding the same ciphertext as it could give information away about the structure of the plain text.

In general you just generate the IV randomly and concatenate it to the ciphertext. The IV must be of the same length as the block for AES-CBC, which is 128 bits. You can just concatenate it the to the ciphertext (e.g. IV+ciphertext). You know the first 16 bytes will be the IV.

EDIT

  If it's common to put the IV directly in front of the ciphertext, isn't it a security risk to do it like that?

The sole purpose of the IV is to randomize the ciphertext to prevent two similar plaintext blocks yielding the same ciphertext. This is especially important for files with a fixed structure. Have a look here on why this is important.

In CBC you XOR the ciphertext version of the previous block with the current block before applying AES on it. The reason you have an IV is because the first block doesn't have a block-1 to be XORed with. Hence you just generate 16 random bytes. It's similar to salting passwords.

  What makes putting a random IV in front of the ciphertext more secure than choosing a static IV?

A static IV would defeat the purpose as you would still have all similar first blocks yielding the same ciphertext.

  In both cases the IV would be plainly visible. Doesn't having the IV
  allow you to quickly brute-force the first block?

The IV is not part of AES, it's part of a mode of operation which AES supports.

I see you are quite confused about these concepts. If you want a good read and introduction you should have a look at Keith Martin's "Everyday Cryptography". It's a good book that explains everything step by step. Cryptography is complex, hard and mistakes can have devastating consequences. Be careful when implementing existing ciphers, if it is for use in application you are better off using established, vetted libraries.