How to start writing crypto software This is just an academic question, I do not intend to write my own crypto software.

Every time someone asks the question “How do I write my own Crypto?” the answer is don't.

I'm currently studying computer science, and there is no course offered by the university which seems to be helpful. There are some courses offered by the Math department that could lead to a research career in crypto algorithms, but nothing about implementing the algorithms and avoiding side channel attacks. But obviously there are some people out there writing good crypto.

Is it just reading about vulnerabilities and remembering not to do the same thing? Or where does the needed knowledge come from?

Mostly, yes, this is about writing code and remembering not to do anything bad. At its core, the crypto-code writing process really is a combination of understanding and updated knowledge.

To write crypto code, you have to fully know how the code you write gets translated into assembly, then machine code, then electric signals; it can help to have some notions on how a transistor works. You do not have to develop in assembly, but you must be able to think about what your code becomes. Observing the assembly output from the compiler (assuming you work in C or something similar) is very instructive.

The point of this knowledge is that most fashionable attacks nowadays are about side channels, that feed on subtle differences in execution time or memory access pattern or power consumption of code. Programming languages are meant to provide an abstract view that hides all these details; the successful crypto coder is one which can undo that abstraction in his head as he writes the code. A crypto coder must master his programming language to the point that he could write the compiler itself (not that he will do that, be he must be able to).

Then you have to maintain yourself up-to-date with all known attack vectors, which means keeping track of all discoveries on that subject. Experimentally, I find that this very site (security.SE) and the endless ramblings of the chatroom users is a good method to pick up some information -- however, once you know that a potential attack exist, you have to dig up a bit, including reading the academic papers and abstracts, which requires, of course, skills at reading academic papers (the kind of skills that you acquire when you do a PhD).

A crypto implementation can be considered as good only insofar as it can be reviewed, so, regardless of how well you write it, you still need to document it heavily. Security cannot be tested, so some code can be considered as secure only if it can be fully understood. The "burden of proof" lies on the developer's shoulders: it is not sufficient that nobody found a way to break through the code (yet); the developer himself must explicitly demonstrate why his code is fine.

All of this is about implementation of an existing, standardized algorithm. For instance, you are writing an RSA code. The standard is very specific about where each bit should go, so your job is "only" to make a robust implementation that does not leak information about the key or the encrypted data (which basically means using random blinding, or constant-time code with a fixed memory access pattern). When considering embedded devices with an external, attacker-controlled power supply (e.g. smart cards), the problem becomes a lot more complex and can be defined only as "high-level research" (and smart card vendors employ high-level researchers exactly for that reason). For more mundane software platforms, this is doable by a lone programmer, provided that he masters his tools and knows how to use academic research.

Designing your own algorithms, or your own protocols (a protocol can be defined as an assembly of algorithms), is another can of worms. A big one.

I am not sure whether it is possible to sum up all the required knowledge for good crypto coding as a teachable set of rules. However, some people are trying. That Web site might not be the ultimate answer, but at least it contains lots of good advice and pointers, and can at least serve as a list of things to watch for. Don't try to write production-level crypto code until you can read the coding rules and at least understand what each listed problem is, where it comes from, how it could be exploited, and why you should mind it (or not) in your specific context.

Ultimately, skills at good crypto coding are built on experience so the best you can do in that respect is to begin by writing some implementations yourself, then compare them with other implementations and see in what aspects they differ and why. Hash functions like the SHA family are a good starting point.


Can Antivirus scan office and PDF file types? I know antivirus software (like Kaspersky) can scan executable files for viruses, but can they scan office documents and PDF files for viruses?

On a basic level, an antivirus engine can scan any file type provided it has the capability to understand the application signature. In the case of Office documents, it has become a standard to scan them for malicious Macros that are used to execute a command compromising the user's machine. The same applies to PDF files which can contain scripts that also infect the machine and make callbacks to remote botnet servers.

AV engines these days scan all but the most obscure file types and some of them can even tell you if a certain file is exploitable (not infected but having a vulnerability that can be exploited by a threat agent). It has become common practice to scan Office documents and PDF files. False positives might arise sometimes though.


How can I determine what encoding is being used? I'm testing a webapp as part of a bug bounty program where the value of a product ticket given to clients is being encoded.

FYI, ticket number is given to an user for an adquired product. Webapp has an input field where ticket number can be entered for information on product's status. The ticket number entered is sent to server and encripted, page reloads while emptying said input field, requests ticket number to server, decodes it an puts it back on input field for results page.

For an arbitrary ticket number: 1111111111111, the encripted string looks like this:

  2c9VP8uK6VUJlJR4Lmonwk3wy1UGEBgO4VqUYjUqar6kU%3DvK1%2BrOrlrThJWBCPGY5f2vzfJOFMCGd%2FS5%2BaM%2FX%2F6No%3D

Or this (when decoding the URL characters in it):

  2c9VP8uK6VUJlJR4Lmonwk3wy1UGEBgO4VqUYjUqar6kU=vK1+rOrlrThJWBCPGY5f2vzfJOFMCGd/S5+aM/X/6No=

I've dissected this encoded string as follows:

1.

  2c9VP8uK6VUJlJR4Lmonwk3wy1UGEBgO4VqUYjUqar6kU%3D
                       OR
    2c9VP8uK6VUJlJR4Lmonwk3wy1UGEBgO4VqUYjUqar6kU=

This appears to be some salt or something like that, as it will appear pre-fixed in other encoded values such as client number.

2.

  vK1%2BrOrlrThJWBCPGY5f2vzfJOFMCGd%2FS5%2BaM%2FX%2F6No%3D                                             OR
    vK1+rOrlrThJWBCPGY5f2vzfJOFMCGd/S5+aM/X/6No=

This is what I would call the "dinamic" part of the encoding, as this varies with ticket number.

Upon testing, I've come to observe the following:

It doesn't matter if '%2f' or '%3D' are written as '/' and '=' respectively, as server will decode the string and return the given ticket number in both cases. On the counterpart it does matter if '%2B' is passed as '+' as server will return ticket number's input field empty.
The ending '%3D' are necessary for decoding, striping the string from it's ending %3D character will result in an empty input field.

I've triend with onlin decoders with no luck.

Sorry if I extended myself too much, but I wanted to give you as many info as possible as I am not familiar with encoding methods. I hope someone can give a hand with this. Thanks in advance.

It's a pair of Base64 strings with a two character prefix:

  2c9VP8uK6VUJlJR4Lmonwk3wy1UGEBgO4VqUYjUqar6kU=vK1+rOrlrThJWBCPGY5f2vzfJOFMCGd/S5+aM/X/6No=

Is equal to:

2c
9VP8uK6VUJlJR4Lmonwk3wy1UGEBgO4VqUYjUqar6kU=
vK1+rOrlrThJWBCPGY5f2vzfJOFMCGd/S5+aM/X/6No=

These encoded strings expand to the following data:

f5 53 fc b8 ae 95 50 99 49 47 82 e6 a2 7c 24 df
0c b5 50 61 01 80 ee 15 a9 46 23 52 a6 ab ea 45

bc ad 7e ac ea e5 ad 38 49 58 10 8f 19 8e 5f da
fc df 24 e1 4c 08 67 7f 4b 9f 9a 33 f5 ff e8 da

Both are 32 bytes, which might indicate encrypted data, but it is clearly data with some pattern to it, so I suspect it's not actually a block cipher.

My first though is that the "2c" prefix might be 0x2c for some kind of xor crypto, but I didn't get any results from that. I also tried modulo addition and subtraction, and doing the same between the two string pairs, again with no result.

Unfortunately there's no obvious way to break this without a significant number of plaintext-ciphertext pairs to give us more information.


One Input Two Hashes Suppose I have some password x, and two different hash functions h1 and h2.  I can then compute the hash y1 = h1(x) and y2 = h2(x).

Is there any sort of vulnerability in this case? More specifically, is it possible to get y1 from y2 and vise versa? Is there anything else I need to look out for?

This is more of a theoretical question, which is partly why I am not specifying any specific hash functions. Another way to phrase this question is as follows.

Does security in this specific case come down to the "correct" selection of the hash function pairs? Or does it not matter?
Now, replace "hash" in this question with "key derivation function". Does it make any difference?

Is there any sort of vulnerability in this case? More specifically, is it possible to get y1 from y2 and vise versa? Is there anything else I need to look out for?

You can construct a pair of secure hash functions where y1 can be computed from y2 and vise versa:

function#1: SHA-256
function#2: SHA-256 with the first two bits swapped

Both functions are obviously different and both are secure in that you cannot get the input from the output nor do collision attacks. But obviously you can compute the result from function#1 if you know the result from function#2 and vise versa.

  Does security in this specific case come down to the "correct" selection of the hash function pairs? Or does it not matter?

I think with hash functions based on completely different ideas the chances are high that you will not find a dependency between the outputs. But on the other hand lots of seemingly unrelated problems in math are found to be related at the end. Thus I think you would need to prove the independence for each pair of hash algorithms.

  Now, replace "hash" in this question with "key derivation function". Does it make any difference?

You can create a KDF with dependent outputs the same way I've created the two dependent hash functions. Also KDF are often based on hash functions so I would suggest that one can use the same argumentation I've used for hashes.


Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)? On Linux systems, /var/log/secure  (or similar, depending on distro) shows all SSH login activity.  Is there a similar log for SCP?  If not, what's a good approach to enabling logging of scp activity on my servers?  Is it SELinux through /var/log/audit/audit.log?

You need to adjust your sshd logging level to DEBUG in order to see scp client connections.

Look at the /etc/ssh/sshd_config for the "LogLevel" directive.

LogLevel DEBUG

Or the scp -o LogLevel for testing.


Can OSSTMM RAVs be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000? The calculation of RAVs in OSSTMM seem very useful as a security metric but, can they be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000?

ISO 27001:2013 risk assessment requirements are aligned with ISO 31000 so I think that we can focus on ISO 31000.

ISO 31000 establish the following phases:

Risk identification
Risk analysis
Risk evaluation
Risk treatment

I think that OSSTMM testing can be matched against risk identification (process of finding, recognizing and describing risks).

The risk analysis phase (process to comprehend the nature of risk and to determine the level of risk) and risk evaluation (process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable) can be matched with the calculation of the attack surface and RAV.

And risk treatment phase could be an additional phase where using the classification of vulnerabilities in OSSTMM we choose relevant controls that reduce the risk (attack surface, RAV).

Is this matching correct for you?

Is it possible to use OSSTMM, attack surface and RAV calculation as an ISO 31000 compliant risk assessment methodology?

There exist any fundamental requirement in ISO 31000 or ISO 27001:2013 that makes impossible the use of RAV as its risk assessment methodology?

I only have auditing & review experience for ISO 27001 compliance but not for 31000, so my answer will focus on this one. To summarize, the answers are:

Is the matching correct? Yes.
Is it possible to use OSSTMM as a risk assessment methodology for ISO
27001/31000 ?
It depends, see below.
Any fundamental requirement that makes it impossible? No.

ISO 27001 Risk Assessment Methodology

First, it should be noted that there is no requirement in ISO in the risk assessment methodology. The ISO standard typically defines what an organisation should do as opposed to how to do it. So you are correct and you can use the OSSTMM, attack surface and RAV calculation as your methodology for risk assessment.

For example in ISO 27001:2013, we can see in chapter 8.2 "Information security risk assessment", that:

  The organization shall perform information security risk assessments
  at planned intervals or when significant changes are proposed or
  occur, taking account of the criteria established in 6.1.2 a).

  The organization shall retain documented information of the results of the information security risk assessments."

And the criterias in chapter 6.1.2 are:

  6.1.2 Information security risk assessment

  The organization shall define and apply an information security risk
  assessment process that:

  a) establishes and maintains information security risk criteria that
  include:

  1) the risk acceptance criteria; and

  2) criteria for performing information security risk assessments;

  b) ensures that repeated information security risk assessments produce
  consistent, valid and comparable results;

  c) identifies the information security risks:

  1) apply the information security risk assessment process to identify
  risks associated with the loss of confidentiality, integrity and
  availability for information within the scope of the information
  security management system; and

  2) identify the risk owners;

  d) analyses the information security risks:

  1) assess the potential consequences that would result if the risks
  identified in 6.1.2 c) 1) were to materialize;

  2) assess the realistic likelihood of the occurrence of the risks
  identified in 6.1.2 c) 1); and

  3) determine the levels of risk;

  e) evaluates the information security risks:

  1) compare the results of risk analysis with the risk criteria
  established in 6.1.2 a); and

  2) prioritize the analysed risks for risk treatment.

Using OSSTMM RAV in an ISO 27001 compliant Risk Assessment

Now as you mention, the important part here is the probabiliy / likelihood factor. It is stated in ISO 27001:2013 that the methodology used for risk assessment must:

  2) assess the realistic likelihood of the occurrence of the risks
  identified in 6.1.2 c) 1);

The OSSTMM v3 describes RAV as a scale measurement of the attack surface. It is not intended to measure risk, instead it is used as an operational metric that is much more detailed and pragmatic than traditional risk calculation like:

  Risk = Threat x Vulnerability x Asset

OSSTMM purposely avoid the likelihood factor as it is very biaised and not necessarily objective. Then RAV cannot be used as-is to perform a probabilistic risk assessment, which is indeed a requirement of the ISO standard, and the answer to your second question would then be no.

However, based on my experience, companies tend to adapt the Risk Assessment methodology / framwework they are using, being OSSTMM or any other methodology (e.g. Octave, NIST framwerork, TRA etc.), to fit with their specific context and needs.

So at the end, you would have to integrate a likelihood factor to OSSTMM/RVA to use it as an ISO 27001 compliant RA methodology. It does not have to be complicated, again ISO doesn't say how you must do it.

Other considerations

On a side note, a typical recommendation is to align each department's methodology with the global/standard company risk assessment methodology, notably for calculation methods, as it basically makes life easier for management to evaluate risk on a homogenous basis. If you're not doing that, and have different methodologies in use within your company, you will have to harmonize results and sometimes will compare apples to bananas.

For this reason, I wouldn't recommend to use OSSTMM RAV as the methodology for Risk Assessment. It's too specific and operational to be efficiently matched and compared with other risks elsewhere in the company.


Why touching a message with this text freezes the phone? There is a certain text that, if appears on a text message and that message is touched by the user, causes the phone to freeze. The text is formed by many alternating right to left and left to right unicode marks and some spaces. If the message is not touched, the phone works as usual. I have tested this on Telegram and WhatsApp. I have not tested this with an iOS device. It has no effect on my computer.

Why does this text freezes the phone, but only when touched?

Is there any way to prevent this as a user?

NOTE: I have purposely omitted the exact message to avoid directly or indirectly cause trouble to mobile users.

How the message works

This video explains it best:

https://www.youtube.com/watch?v=jC4NNUYIIdM

Brief explanation

There are a lot of special characters in the message. They can be displayed without any problem, but when the phone tries to work out how to show the selection popup the calculation crashes, causing WhatsApp to crash.

At a guess, the 0 width characters create a massive amount of options for what you could be selecting, leading to a massive amount of checks, which take too long, crashing the app.


In CIA triad of information security, what's the difference between confidentiality and availability? I sometimes get confused between confidentiality and availability. This site defines confidentiality as

  Measures undertaken to ensure confidentiality are designed to prevent
  sensitive information from reaching the wrong people, while making
  sure that the right people can in fact get it

and availability as

  Availability of information refers to ensuring that authorized parties
  are able to access the information when needed.

What's the difference? Is confidentiality more about restricting and availability is more about permitting?

Confidentiality is concerned with ensuring unauthorised users cannot access a protected resource.

Availability is concerned with ensuring authorised can access a protected resource.

It is important that a resource is available, because otherwise an attacker might cause damage simply by preventing authorised users from accessing a resource, even without the attacker being able to access the resource themselves.

A physical metaphor for availability might be an attacker going to all the fire escapes on a building and bolting them shut from the outside. The attacker doesn't need to compromise the existing locks to do this (and therefore they can't get inside the building themselves), but if there's a fire the attacker can still cause significant harm.


Understanding Oracle 11g password hashing algorithms I'm trying to understand the Oracle 11g password hashing algorithm, I found this link explaining how it is done, however, I have some confusion on how they say it's done. According to that link it goes like this:

Random 10 byte salt string is generated by oracle
The password and the salt string itself become one
Oracle runs the string through an SHA1 algorithm
The output is S:<HASH(password+salt)><SALT>

So for example:

>>> import hashlib
>>> d = hashlib.sha1()
>>> salt = "test"  # random salt (not 10 bytes)
>>> password = "testing"  # password
>>> password2 = password + salt  # salt and password become one
>>> print password2
testingtest
>>> d.update(password2)
>>> data = d.hexdigest()  # hexdigest the password string (password+salt)
>>> hash_to_display = "s:{}{}".format(data, salt)  # return s:<HASH(pass+salt)><SALT>
>>> print hash_to_display.upper()
S:6B399DF23C6B76D667F5E043D2DD13407A2245BBTEST
>>>

Am I correct in assuming that this is how Oracle 11g does it's hashing?

What you have matches the documentation I found (both official and not).  Too bad, it's not as secure as it could be.  Even if using SHA-1 (perhaps to be FIPS 140-2 compliant), one could run the data through many iterations to make it much harder to brute force.


PHP mail() Header Injection Prevention This site nicely explains the problem.  Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks.  The referenced site gives a regex sanitation solution but I'm not satisfied with it.  Is there a built in header sanitation function?  What would one need to do to really protect against this sort of attack?

As a matter of fact PHP includes a function to check the validity of a provided address.

http://php.net/manual/en/function.filter-var.php

http://www.php.net/manual/en/filter.filters.validate.php

Ex: filter_var($_POST['from'], FILTER_VALIDATE_EMAIL) ? send() : die("You murdered me. D:");


How to prevent the following clickjacking attack? The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security scripts like frame busters, killers & etc.

For example, here are three pages:

Victims Page

This page contains a very poor frame buster, but good enough for this demonstration. In case the page is not the top frame in his window it redirects the window to the page location.

Page A

This page contains an example, what happens when the attacker just add the page using iframe, without enabling the security attribute on. The result of opening this page is a quick glance at the click jackers page and then the browser redirection to the page location.

Page B

Finally, this page demonstrates implementing the security attribute. The iFrame is loaded, and since the attribute is set to restricted the frame busting script is not redirecting the browser to the victims page location. Note this attack is viable only in IE8 and above.

Now assuming a malicious user can upload files to the victims web server*, (disabling by my understanding the possible use of X-Frame-Options) how can the victim protect his website from click jacking attacks against his IE users?

*This is an hypothetical question, of course if attacker has access to the web server domain he would attack differently.

The only way to prevent clickjacking on a version of IE too old to support X-Frame-Options is to make the page dependent on JavaScript, so that it breaks when run with security="restricted". For example:

       ...

       This site cannot be used in a frame or with JavaScript disabled.

Obviously this has strongly negative accessibility implications. If the site in question already doesn't work without JS it might be acceptable, but it isn't usually worth it.

(It also demonstrates the tactic of making your page unusable instead of trying to redirect the top page as in the 'very poor' framebuster. Indeed, the redirect option cannot be made secure.)

I'm not sure what your last comment is referring to - X-Frame-Options doesn't prevent file uploads, but it works fine to protect against framing from any site (third- or first-party), the only problem with it is the lack of support in old versions of IE.


How long does it take for Google to detect click fraud and suspend an AdSense account? Click farms can be hired to boost ad revenue. http://www.security-faqs.com/what-is-a-click-farm.html

  The click farm is made up of armies of low paid workers who’s job is to click on links, surf around the target website for a period of time, perhaps signing up for newsletters and then to moving on to another link. It is very hard for an automated filter to analyse this simulated traffic and detect that is it invalid as it has exactly the same profile as a real site visitor.

Google obviously tries to prevent click fraud. How long does it take (days, weeks, months) for Google to detect click fraud and terminate an AdSense account?

Here is more info: https://webmasters.stackexchange.com/questions/66892/where-are-these-suspicious-traffic-sources-coming-from-that-i-see-in-google-anal

Here are 2 examples side-by-side (top-to-bottom): http://imgur.com/a/4ndAp

When they realize that a big proportion of your clickers aren't buying anything, anywhere... if they have access to this data.

I guess they can have feedbacks from clients on where they obtain their sales, and if on your site they are really low, or non existent, they will surely compare it with the typical profile of the people visiting sites similar as yours. Then they will just need to reach a critical value of abnormal behavior to claim with confidence that you are hiring a click farm.

this question cannot be answered precisely as

As GdD said, it is counter-productive for Google to tell
It certainly depends on the type of site, the time, the type of visitors (and their buying habits), the number of visitors per month, and the few elements that click farms may publicly post (hours, duration of the click sessions, global localisation of IPs -do they match geographically with similar site's customers?-, how many of the clickers aren't on other cookie-enabled Google services compared to the average, etc.)

The only advice I can give if you decide to hire such services is:

Don't
If you still do it, be clever. Do it in a nefarious way that doesn't draw too much attention. Remember, you are still under the threat that the click farm may operate unstealthily and/or get busted, bringing down all its clients in the process.

Good Luck.

PS: This is merely logical reasoning. I neither work for Google, nor do I have a stake in the click fraud industry =)


How can one decrypt a SSL/TLS session? Besides the private key what else is needed? Suppose I have a non-DHE-based TLS session stored in a Wireshark or Netmon trace.  What is required to decrypt this data?

Is the private key of the certificate all that would be needed?
What tools enable this decryption?

Going a step further, what is needed to decrypt a DHE based TLS session?

For RSA or DH (not DHE) cipher suites, you just need the server private key, of type RSA or DH, respectively (DH certificates are exceedingly rare).

For DHE cipher suites, you would need the dynamically generated Diffie-Hellman private key. This key is never stored anywhere, and that is by design. Correspondingly, you cannot decrypt the data afterwards. This is called Perfect Forward Secrecy.

For the TLS cipher suite with a pre-shared secret: raw PSK cipher suites can be decrypted with knowledge of the shared secret; RSA_PSK suites need knowledge of both the shared secret and the RSA private key; DHE_PSK suites provide perfect forward secrecy.

SRP cipher suites also provide perfect forward secrecy. There again, this is by design: if knowledge of the password sufficed to decrypt a recorded connection, then this would allow offline dictionary attacks, precisely what SRP is meant to thwart.


What are the risks of using TLS 1.0 for web applications? I work with a company that has several web applications available to its customers via HTTPS.  Recently, client browsers will not access these web applications due to the HTTPS connection being made via SSLv3 when TLS 1.0 was disabled during an of audit.  I understand SSLv3 deprecation is primarily in response to POODLE (SSL3 "POODLE" Vulnerability) as of June 2015 (https://tools.ietf.org/html/rfc7568).  TLS 1.0 is not officially deprecated, but seems to be discouraged (e.g. by NIST for the US government, see http://www.nist.gov/itl/csd/tls-043014.cfm, and also at this question Should I disable TLS 1.0 on my servers?).

For these particular web applications, the data is not sensitive to the user or the company, so data confidentiality is not a big issue.  However, are there other risks?  For example, if users degrade their browser security to accept TLS 1.0, are they at greater risk from a man-in-the-middle attack from other sources?  Alternatively, is the company at greater risk from having its server impersonated as part of a man-in-the-middle attack?  From a layman's or manager's perspective, what are the risks to the user or company from continuing to use TLS 1.0?

EDIT:  The specific cipher suite used is TLS 1.0 with RSA server key for asymmetric exchange and AES 128 bit for the session key.  MAC is via SHA-1.

This version of the SSL protocol, was officially release in late 1995 by Netscape after the discovery of serious vulnerabilities in the previous version (SSLv2). It is, therefore, obsolete, and it contains, as well, various flaws. For instance:

No support for SHA256, SHA384 and AEAD (Authenticated Encryption with Associated Data) with GCM ciphers.
No Elliptic Curve (EC) support and therefore no Forward Secrecy (FS).
More recently, in October of 2014, it's vulnerable to a new attack named POODLE (Padding Oracle On Downgrade Legacy Encryption). Padding Oracle attacks surfaced in 2001 and explore the fact that [only] in CBC (Cipher Block Chaining) mode, the padding is not protected by the integrity validation mechanisms of TLS -- i.e. MAC (Message Authentication Code). A malicious person can, thus, perform a Man-In-The-Middle (MITM) attack and force the downgrade of the protocol version, which some browsers voluntarily accept. This type of protocol negotiation is needed to synchronize both parties.

If the user becomes the victim of a MITM attack, an attacker can simply use the trust that the user has in the server to create a phishing page, and possibly steal their credentials or some other sensitive information from the company.


Unencrypted connections between 2 people who use the same ISP, what's the risk? What is the risk, man-in-the-middle or otherwise, of unencrypted connections between 2 people who use the same ISP, in the same city? If we assume the ISP (and the copper wire that leads to them) is secure, is there a fairly limited risk level? (excluding government surveillance, NSA, etc.)

What do both parties use their computers for? If either machine is infected then it really doesn't matter if you live next door to each other or in separate continents. End points are leaky little beasts.

To be more specific, You need to share how the communications are taking place. Are you using Skype or some other IM program? Email? VoIP? Because some communications programs have encryption built in your communications Some content is transmitted and received more privately than others. Do you both use a VPN?

The next question is what is the cost of the content if it is discovered? If it has no value to either party, or cost to either party if it is revealed then you are pretty secure.

Security is about managing risk. If you're talking about valuable IP, etc. then you are pretty insecure if the communications application is not encrypted properly.

Ultimately the security/privacy is limited by the weakest link, typically the end point, which includes the user as well.


Is it safe to have a DNS record pointing to 127.0.0.1? My development server is on my local machine (127.0.0.1). I have created an A record in my DNS settings that points dev.mydomain.com to 127.0.0.1 so that I can use this domain name for accessing my local web app. I know I could use my /etc/hosts file but I feel it is easier to manage by using DNS and when we want to add a developer on the team, it removes the step of having to add a line in their hosts file.

My question is: is it safe to do this? Is there anything that can go wrong?

Is it safe to do this?

I see no security problem with this.

  Is there anything that can go wrong?

Possibly, though I am not sure I understood this correctly:
Has each developer their own development server and does each one work on their own local copy? Then this will work fine.

However if there is only one dev. server and you use this as your workstation then this might not work as expected since 127.0.0.1 is local host. As in each developers own localhost.

In ASCII graphics:

                                           Assigned IPs:
Your own computer                          127.0.0.1
(with dev.server)         -----------      ::1
                                           'Normal' static or DHCP assigned IP

Other developers computer                  127.0.0.1
(Just a workstation)      -----------      ::1
                                           'Normal' static or DHCP assigned IP

If the other developer tries to access dev.mydomain.com then DNS will successfully translate that to 127.0.0.1. No need to add anything to the hosts file. But the other developer will not arrive at your dev. server. Localhost for him or her will be local.


Does HTTPS protect against active attackers? I know that HTTPS protects against passive attackers, due to encryption. Which of course provides confidentiality.

So does it protect data(passwords, emails, etc) during traffic, against active attackers? If so, how?

TLS (the secure network protocol underlying HTTPS) specifies a large number of "cipher suites" (combinations of cryptographic primitives, like asymmetric and symmetric ciphers, hash functions, etc.). All widely-used cipher suites - the only ones that should be permitted either by clients such as web browsers, or by servers - provide the following:

Authentication of the server (so an attacker cannot present their own public key and get the client to accept it as the valid one).
Encryption of the data transferred in both directions (thus providing confidentiality, as you noted).
Integrity of the message text (to prevent bit-flipping attacks on the ciphertext, for example).
Replay protection (capturing encrypted traffic from one part of the conversation and injecting it into a later part will not work).
Sequence protection (an attacker cannot successfully take multiple message packets, rearrange them, and transmit the reassembled message; it will be rejected)

Some cipher suites provide additional protection:

Perfect Forward Secrecy (PFS), such that even if an attacker records a conversation and later gains access to the server's private key, the conversation can never be decrypted (save by brute force or breaking the cryptographic primitives).

TLS (including HTTPS) can be optionally configured to provide the following protection:

Authentication of the client (normally, the server supplies the client with a certificate showing the server's authenticity; it is possible for the client to also supply the server with such a certificate, which can replace the need for other forms of authentication such as transmitting a password).
Downgrade protection, preventing fallback to older protocol versions with known or suspected vulnerabilities.

TLS does not provide the following protections:

Length masking, beyond the limited degree provided by some primitives (if the attacker knows the lengths of the possible messages in either direction, and each possible message has a different length, the attacker can probably reconstruct the message traffic by watching message lengths).
Timing masking, beyond adding some overhead (if the attacker knows how long certain operations take, the attacker can guess when those operations have been requested / performed by monitoring the times between messages in each direction).
Availability (a man-in-the-middle can always just decide not to pass on the network traffic, resulting in denial of service).
Client or server anonymity (the client IP address, and the server's IP address and host name, are exposed in plain text to anybody monitoring the traffic).

In general, yes, HTTPS is secure against most active attacks aside from denial-of-service. However, there are limitations. TLS does not protect against exploitation of weaknesses in the cryptographic primitives it uses (for example, this is why cipher suites using the RC4 symmetric cipher are now deprecated). Its encryption leaks side-channels such as length and timing, which in some applications may enable an attacker to break the confidentiality (although a security-conscious application could normalize the lengths / timings of network traffic to close this side-channel).

Additionally, it possible to use TLS insecurely if you configure it wrongly. For example, certificate authenticity validation checks can be disabled or replaced with incorrect custom checks, invalidating the authentication check and allowing an active attacker to use a fraudulent certificate. If both client and server permit insecure ("NULL") cipher suites, it is possible to configure TLS to use no authentication, encryption, or integrity checks. Finally, TLS implementations themselves may have security vulnerabilities. The "Heartbleed" vulnerability of 2014 was due to a extremely severe security bug in a very common TLS library (OpenSSL); if insecure / unpatched implementations are used, the protections of TLS may be bypassed and/or other weaknesses may be introduced.


Ways to generate symmetric and asymmetric keys We are using Beaglebone Black based custom board, and want to use hybrid encryption for encrypting firmware file, i.e. symmetric for encryption big firmware file and asymmetric for encrypting symmetric key file. I refer to this blog for hybrid encryption idea.

Now regarding generation of the symmetric key and asymmetric keys (mainly in Bash script) I have the following doubts.

Symmetric key

Method 1:

openssl rand 128 > sym_keyfile.key

Doubt 1:

How does the length of the key, e.g. 128, 192 or 256, affect encryption and decryption? Is is only time taken for encryption and decryption?

Method 2:

cat /dev/urandom | head -n 128 > sym_keyfile.key

Method 3:

cat /dev/random | head -n 128 > sym_keyfile.key

Doubt 2:

Which method is more random, Method 1 or Method 2? I am inclined to think that Method 2 is random enough and the manual page of random, urandom suggest to use urandom in case one is not sure about it.
However we have seed enough entropy to generate more secure random number.

Doubt 3:

Can we ask OpenSSL to take random number from /dev/urandom?

Asymmetric key

Private key generation:

openssl genrsa -out keyfile.key 4096

Public key generation from private key:

openssl rsa -in keyfile.key -pubout -out keyfile.pub

Now when I read OpenSSL help regarding rsa it says:

  The rsa command processes RSA keys. They can be converted between various forms and their components printed out. Note this command uses the traditional SSLeay compatible format for private key encryption: newer applications should use the more secure PKCS#8 format using the pkcs8 utility.

Doubt 4:

Is OpenSSL help suggesting to use pkcs#8 for generating both the private and public key or only for generating the public key from the private key?

Doubt 5:

Do you suggest any other method to generate more secure asymmetric keys?

You seem to ask for a comparative study on the PRNG (pseudo-random number generators) used by default by OpenSSL and the Linux kernel. This could most probably fill a volume full of mathematical formulas, and to make it worse OpenSSL and the Linux PRNG are not independent since OpenSSL will use /dev/urandom as a default seed, and there are ongoing work to provide an alternative PRNG for Linux (you can see Stephan Müller work on the subject here and there and also his discussions on the linux kernel mailing list).

However, the fact is that in most cases both will share the same strengths and weaknesses:

Strength: both are mature and well audited code generally accepted as cryptographically secure PRNG,
Weakness: as their name state they both are pseudo random number generator, meaning they both are deterministic algorithms which, given the same seeds, will produce the same output. The unpredictability of the produced numbers is therefore directly dependent on the unpredictability of the seeds.

So, security-wise, your main concern here may not be which one from OpenSSL or /dev/urandom to use (especially when you know now that the former relies on the latter behind the scene), but to ensure the quality of the seeding. In particular, what you may want is one or several sources of TRNG (True Random Number Generator), ie. some hardware component specially designed to serve unpredictable random data suitable for cryptography.

This will guaranty you that the quality of the seeds used by the above mentioned algorithms will not be dependent on external factors as the system I/O, load, etc. (when available these entropy sources will most likely still be used, but merged with the TRNG input). In most situations, this will have more impact on your overall keys strengths than choosing between two well-established PRNG implementations.

Now to answer your doubts:

  Doubt 1:

  How does the length of the key, e.g. 128, 192 or 256, affect
  encryption and decryption? Is is only time taken for encryption and
  decryption?

Yes, it is: larger key require more computational power to encrypt and decrypt. The idea behind this is that, while it will require more efforts from the legitimate devices knowing the right key, it will also require "exponentially" more effort from any potential attacker.

Regarding the right length, you will already find a lot of discussions on this website on this subject (like this nice table), with some general cases and some taking some constraints into account (like embedded devices which have very limited computational power).

  Doubt 2:

  Which method is more random, Method 1 or Method 2? I am inclined to
  think that Method 2 is random enough and the manual page of random,
  urandom suggest to use urandom in case one is not sure about it.
  However we have seed enough entropy to generate more secure random
  number.

Method 3 may block suddenly and for an undetermined amount of time. If this not what you want (and usually you don't want this), then the choice is indeed between methods 1 and 2.

From there, the choice is merely a matter of personal preference. I would say that the syntax using OpenSSL is more portable, and easier which can help to avoid bugs (for instance using -n (number of lines) instead of -c (number of bytes) as parameter of the head command ;) ).

  Doubt 3:

  Can we ask OpenSSL to take random number from /dev/urandom?

This is the default behavior, but if you want to ensure this OpenSSL documentation is your friend and would advise you to add the -rand parameter:

openssl rand -rand /dev/urandom 128 > sym_keyfile.key

  Doubt 4:

  Is OpenSSL help suggesting to use pkcs#8 for generating both the
  private and public key or only for generating the public key from the
  private key?

As stated in LvB comment, this is about how the keys are stored, and not generated (this is like storing a file in either a .zip, .rar or .tar.gz archive).

In case you have a free choice, OpenSSL indeed advises you to use modern and standardized formats instead of the historical SSLeay format:

With PKCS8 you will store the private key in one (possibly encrypted) file, and the public key / certificate in another (plaintext) file.
With PKCS12 you will bundle both the private and public components in a single file (which may seem more practical but implies that if the .p12 file is encrypted, then even the public certificate will not be readable without deciphering the file first).

Practically, the choice will often be down to what is supported by the applications which will use the keys. Its documentation will often mandate you where and how to store the key material.

  Doubt 5:

  Do you suggest any other method to generate more secure asymmetric
  keys?

I already mentioned TRNG devices above, and I would also advise you to stay on known land by using mature and well known software implementations. Software implementing poor algorithms or good algorithms but with a buggy implementation can equally annihilate your security.

And at last, stay informed since mistakes can happen everywhere, but they are most likely to be detected and solved soon in well-established solutions than in exotic ones.


Create a page to experiment with SQL injection This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software (Advanced SQL Injection Tool) to study how it works.

After some time and tests, I know how to hack some of the information of a website. Now, I want to create my own page of the same kind as I found in the example of Havij software at http://www.target.com/index.asp?id=123. How can I make my own page to study penetration testing and hacking of my own information so that I can learn more from it?

From SQL injection to shell - this will walk you through manual exploitation of sql injection, download the vm and follow the step by step pdf.

there is a difference in understanding and doing. this will help :)


Which of the following studies is the most important for a penetration tester? I want to study cyber security in the future, but before I can do that I believe that I have to study one of the following educational programs:

Network Administrator
Application Developer
IT Administrator

Which of these programs is fundamental for a penetration tester?

Which of these programs is the fundament for a penetration tester ?

It depends what type of penetration tester but in general - All.

As a penetration tester it is your job to know all about the whole stack from the down up.

But if I would have to choose one to get started on I think that studying IT Administrator will provide you with a little of everything allowing you to get a basic concept of what you will be working with as a penetration tester.


How do high-performance web applications control permission to their content? So, I believe I understand the logic behind authorization standards like OAuth. The OAuth token contains information about the user (name, role, etc.), which I can use to secure my application.
It's about the last part of the previous sentence that I have a question. Let's say I have a web app with 1000 articles, how do I check whether or not a specific user (based on his/her OAuth token) has access to a certain article? I see several options:

I store all ID's of the articles that the user can see in the OAuth token (e.g. ID1, ID2, ID3, etc.);
Conversely, I can also store which users may access the article (e.g. Article 1 can be read by users 1,2,3). This is like an ACL;
For every article, I store which roles can access that article (e.g. Article 1 can be read by role: reader). This is like RBAC;
Do not secure your content at all, just like Facebook seems to do (although they do secure it, but they just check your friend list before giving you the direct url to the resource).

To clarify: I am not searching for an answer that explains that you can put claims in the token itself, so that you do not have to hit the db to retrieve your claims (stateless). I am looking for ways how the application back-end uses these claims to decide whether or not access to a certain content item is granted.

Option 1 seems bad practice, as the tokens will become infinitely huge for large providers.
If large providers use option 2 or 3, they will have a huge amount of database hits (check if that article can be accessed by that user), which can't be good for performance. This performance increase is one of the reasons Facebooks and Twitters use stateless authorization, instead of stateful authorization. I would assume that this performance penalty on content level is a blocker against using either option 2 or 3.
So, is the only viable option to go with 4?

A last option I see is to use option 3, combined with heavy caching. As content permissions are not as ephemeral as user rights, this is the option I would go for. But is this how large providers (Google, Twitter, Dropbox, etc.) do it? And how is it implemented practically?

Update
Someone told me about Spring's permission matrix which you can put in memory, but I'm not sure whether this would be the way to go..

Every article has an associated permissions object attached to it. That permissions object describes the code to be evaluated and any possible parameters. Most contexts are fairly normalized, such as in Facebook where the context might be friends.

Thus, the viewer's control evaluates its attached rules: if you're a friend, it succeeds. That's a pretty fast operation. You can go further, attaching specific data to the control (I share something with all my friends except Eve, or with a specific list). You can also set rules for a viewer: an editor might have a privacy controller attached to their context that returns true for all calls.

There are two good examples off the top of my head that can see some of the workings of. The first is Amazon AWS permissions: policies are attached to both users and objects and they describe permitted actions on AWS. In the case of AWS, the rule starts off with implicitly deny. All rules attached to the user and the service are evaluated, and the boolean logic is if permitted and not explicitly_denied. Check out the IAM policy simulator for a graphical view of how things evaluate.

The other view is PAM services for Unix, which lets you write any code you'd like taking the user into account and marking the result of that as required, sufficient, or a few other options.

For your specific case, every you might setup an evaluation for RBAC, an evaluation for specific

By the way, both Facebook and Twitter use stateful authorization. At least in Facebook's case regarding images, the actual access to a cached image isn't checked to allow remote caching, but it is during page generation. It is a database call every time. A typical page load on Facebook can generate over 100,000 database calls. Simple KV type stores, memcache, and strong parallelism really help make that work.


What are the threat models that using a VPN for mobile data can mitigate? Some VPN providers offer to encrypt mobile data. This goes beyond the typical Wifi hotspot mitigation paradigm.
So what exactly are the benefits of VPN over mobile data? What threat models can this mitigate? Does this depend on the protocol? (I assume yes based on first research stating for instance that 2G signal can be decrypted on the fly)
Thanks for your feedback

A VPN acts as an encrypted tunnel and protects the confidentiality and integrity of data between your computer and the VPN server. It removes your router, ISP, and any other middle-man on your end of the connection from the list of components that need to be trusted. This helps protect against ISP snooping, attacks over insecure wireless networks (public Wi-Fi, cellular networks subject to CALEA in the US, etc.), as well as compromised networking equipment. It additionally moves trust from your ISP to the VPN server, so you could perform activities that would otherwise be monitored or blocked.
While some VPNs advertise that they provide anonymity, this is largely untrue. Although it is true that they may give some level of casual anonymity sufficient for, say, questionable P2P activities, it will not protect against any sophisticated adversary and is not designed for that. It's necessary to use a true anonymity network like Tor to effectively hide your real IP address and location.


Is hashing the hash considered an extra level of security As in md5(md5(md5(x)))...

I can remember coming across that in some piece of code. If the attacker can somehow reverse md5(md5(md5(x))) into md5(md5(x)) then he certainly can reverse md5(md5(x)) into md5(x) and the x. However if it takes some good amount of time to reverse the first hash then hashing the hash can slow him down. I cant make up my mind on this issue hence the question

Assuming the hash is being cracked using brute force techniques, hashing the hash would mean that theoretically you will need more time and resources to crack that hash due to the fact that you need to execute multiple iterations of the algorithm.

However, having said that, if it is time you are looking for MD5 is most certainly not the way to go. In order to make a hash as difficult to crack as possible I'd recommend a "slow algorithm" like PBKDF2.

By doing multiple iterations of PBKDF2 you will make the process of cracking the hash so slow (relative to other algorithms) that it will become virtually impossible to crack the hash in any reasonable amount of time.

Edit: When I say multiple iterations I don't mean 2 or 10, I mean thousands or hundreds of thousands depending on the acceptable amount of time you are willing to wait for a legitimate hash to be generated or compared.


XSS chained with CSRF = Stored XSS? I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense.

I would say that it can stand true, if the XSS was "self-stored XSS" for which CSRF is used to get rid of the "self" part.

Other than that, I don't see any other potential way for the aforementioned equation to be true. Is there another case that I miss?

A site that has a stored XSS that can only be inflicted on a user's own account - a "self-XSS" - but that is also vulnerable to CSRF on the stored XSS injection point should be considered to have two problems: it is vulnerable to CSRF, and it is vulnerable to XSS. Closing the CSRF vector would mitigate that particular XSS risk, but both should be fixed.

"Stored XSS" doesn't require CSRF, however, Most of what gets termed Stored XSS is created by one user on a service to attack another user on the same service (so, same-site, not cross-site), and while victims could be directed to the infected page using a URL from outside the site (including cross-site links, iframes, etc.) they could also land on the infected page without the attacker sending them there at all.

For example, consider a social media worm. Somebody finds a way to inject script on a pubic social media post they create. The script looks up the friends of everybody who lands on the page and messages/tags all of them "hey, check this out". It also promotes the post itself with a "like" or "favorite" or whatever (it could also have some actually-harmful payload, beyond just spamming all your friends, of course). Thus, it could infect a huge number of users on the site - spreading through everybody's social graphs, plus infecting users who view this suddenly explosively-trending post - without ever having any cross-site element.

Getting back to CSRF + XSS, for the most part it's not really a meaningful combination. XSS (of any sort) allows making same-site authenticated requests, rendering CSRF irrelevant. Conversely, most CSRF attacks are to do the sort of thing an XSS payload would do, rather to inject an XSS payload (if there's a way to do that, you can usually just launch an XSS attack without needing to CSRF anybody). I suppose one could claim that most reflected XSS attacks are technically some form of CSRF - if you're attacking somebody by sending them to https://example.com/search?q=<XSS _payload>, you're arguably executing a CSRF against the search endpoint. However, searches are (usually) not state-changing, and thus are not considered a CSRF risk and don't require CSRF protection. The vulnerability in that scenario isn't that the search endpoint lacks CSRF protection, it's that the search query is reflected into the response without adequate encoding.


Vulnerabilities of IT system due to hardware? Is there any relation between specific hardware (like specific kind of CPU etc) or laptop manufacturing brands and the hacked environments run on? Can this be measured in any way like stolen data or get owned by sending any exploit to an owner of such a hardware?

My first thought - should be not since the OS system is the hub for exploits etc. I guess there is no way to run BIOS execution code from the layer of Windows OS or OS X, neither Linux (supposing exploit took control over our system)?

But what about hidden exploits built in by manufacturers? Has anyone in this field been caught red-handed? Should I avoid any particular manufacturer if privacy and security is my priority?

Modern CPUs often have layers that operate below the level of the operating system (eg system management mode in x86 processors) so if the firmware controlling that lower level is compromised then the OS can be attacked.  People with specific knowledge of the hardware design would have an advantage compromising such lower level modes.

Smart phones often have a baseband controller that can access the memory used by the Smart part of the smart phone.  An attack directly on this baseband controller would then allow the main OS to be compromised even if it was patched for all known flaws.


credit card security suggested scenario I need to know the best scenario for a merchant inserting client's credit cards and expiry dates to process recurring payment for these cards. What I have in mind (and want your expert suggestions please) is the following:

form to be filled with credit card information
normal post with https to a php page having function for encrypting the credit card with random encrypt key
saving the encrypted card and the key in different locations in mysql when processing the payment
getting the encrypted credit card and the key and use a decryption function to process the payment with curl to the gateway

credit card encrypt/decrypt sample:
http://www.walkswithme.net/credit-card-validation-and-encryption-using-php

do you have any comments on the above, or better scenario?

Your payment gateway should be able to provide you with a tokenized system for recurring payments where you submit the cc to the payment gateway once and they return an authorization code which you will use instead of a cc number for the recurring payments.

This is a far better solution than storing credit card numbers in any shape or form. Please contact your payment provider for advice before you consider copy/pasting encryption advice from the internets.


Hackers attack against wp-config.php my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors:

How can i protect my site from this attack? Help, please!
Thank in advance!

Remove wp-config.txt, wp-config.php.original, etc. (but not wp-config.php!)

If those files don't exist, then it's a bug in the scanner. If the file contains passwords (like a database password), change them immediately.

How your Wordpress got hacked and how those files were created is anyone's guess. Each installed Wordpress plugin can be vulnerable, as can Wordpress itself. Or you may have a weak password for ftp, the Wordpress admin panel, or something else. Even your hosting may be hacked.

Make sure your Wordpress installation and all plugins are up to date, and don't install untrusted plugins (like ones that have few or no reviews).


What does this Snort rule do? Rule-4:
alert udp $EXTERNAL_NET any
-> $HOME_NET 3333 (msg:"ET
EXPLOIT Wireshark ENTTEC
DMX Data Processing Code
Execution Attempt 1";

content:"|45
53 44 44|";

depth:4;

content:"|04|";
distance:2; within:1;
 content:"|FE
FF|";

distance:0; within:50;
content:"|FE FF|";
 distance:0;
within:50; content:"|FE|";
byte_test:1,>,11,0,relative;
classtype:attempted-user;
reference:url,www.exploitdb.
com/exploits/15898/;
reference:bid,45634; sid:2012154;
rev:2;)

The rule appears to look for a specific pattern of content bytes in traffic sent to port 3333/UDP.

The goal appears to be to detect an attempt to exploit a vulnerability in Wireshark, where parsing specific traffic causes a buffer overflow on the machine parsing the traffic.  The exploit-db link in the rule shows the details of the exploit for this issue.


How secure is a Kali Linux Live USB How secure for the host computer is a Kali Linux Live USB installation?

If I get a virus or any other kind of malware on Kali, can it also infect the computer to which it’s plugged into?

Could it only be a virus or malware that saves itself in RAM?

So you have a computer, running Linux from an USB, and you use a browser there.

Yes, exploits that can take over your USB Linux can also affect the rest of the computer, like hard disks, Uefi, etc. Why shouldn't they be able to? (=> No reason).


SQLi with quote filter? I'm doing some hacking courses, and in one of the lessons, I have a possible SQLi, but in the Python source code there's an if clause just before the SQL statement, which filters the quote symbol:

user="user"
pass="pass"

if "'" in user+pass:
  print "error"

else:
  db.execute("select * from users where username = '%s' and password = '%s'" % (username,password))

So when I try to inject asdf' or '1'='1 into any of the fields, the if clause stops me. I have tried to encode the quote symbol in different encodings (hex, base64, html, etc.), but it still does not work.

Any ideas?

Use a backslash as the last character in user. For example, for the inputs user\ and or 1=1 -- the following query is run:

select * from users where username = 'user\' and password = ' or 1=1 -- '

Where the string input is interpreted like this:

select * from users where username = 'user\' and password = ' or 1=1 -- '


Are password reset links that don't expire a security risk? I am currently working on a password reset flow.  We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new password of their choosing.

The current implementation we have in mind provides a one-time use token but not a timeout feature.  Currently the research I have done on the matter seems to suggest that expiring these tokens is in some way more secure than not.  However, people have not been citing why that is the case.

Can someone provide a use case where that token (while still being a one-time use) not expiring would be harmful security wise?

Additional Details:
I am well aware that sending a password reset link is not the most secure way to handle this problem.  Ideally we would not want to obfuscate this security to the email provider.  However, we have made the decision to go with a password reset link.  We are only trying to determine whether we want that to expire or not.  For more information on the matter:

http://www.fishnetsecurity.com/sites/default/files/media/10WP0003_BestPractices_SecureForgotPassword%5B1%5D_0.pdf

For example: if I remember my password, then don't reset it.

Now, if my email account is later compromised (or if I visit the link and anyone decides to peruse my browsing history), they can change my password at will and there is no way I can prevent it except to change my own password.

Unless, of course, you meant the token is only good for one page visit.  That's certainly secure, but also inconvenient if I close the page, my session expires, etc.


What forensic analysis can be done with physical access to a machine but without the hard drive? What forensic analysis techniques target computer components other than the hard drive once the device is powered off?

RAM contents

If it's soon after the device is powered off, there are attacks that may allow to recover RAM content, e.g. Cold Boot Attack on Wikipedia, Memory forensic data recovery utilising RAM cooling methods.

There are also some secondary things that come to mind e.g. serial numbers might be used to trace where and when (and thus by whom) parts were purchased; and there might be a firmware trace showing when the system was last used (which may be important evidence in certain cases) but that feels a very niche use case.


How to audit web servers for resistance/vulnerability to BREACH BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced.

I manage a few web servers.  How can I audit them to check which of them are potentially vulnerable to BREACH?  Is there a simple way to scan a web server to check this?

(The emerging advice for how to defend against BREACH seems to be: turn off HTTP compression.  So, a way to audit a web server to check whether it has disabled HTTP compression might be sufficient.  At time of writing, the Qualys SSL Labs SSL tester, available via the SSL Pulse page, does not seem to test for this.)

Stricto sensu, you cannot really have a generic test. In HTTP, the client announces whether it supports compression with an Accept-Encoding header line. The server will then feel allowed to use these compression schemes. @Adnan points to this blog post which describes how one can manually send a HTTP request to a server and see what the server responds with. As an audit method, to check for HTTP compression support, this has two problems:

There is no finite list of possible compression algorithms. At least gzip, deflate and compress are common. With TLS-level compression, at least, each "compression method" was specified by a single byte, so there was only 255 possible compression methods (not counting the "no compression" method), and it was possible to be exhaustive. This is not the case here.
The server is free to apply compression or not, as it sees fit, on any document. For instance, the Apache documentation shows how the decision to compress can be made to depend on the type of target document but also its emplacement in the site directory tree. IIS makes a distinction between "static compression" and "dynamic compression": static compression is applied only on pages or document which are physically files on the disk. In the case of IIS, the decision to compress, or not, is then taken depending on how the requested page is generated, so it can vary for each individual URL...

Not having much details on the attack yet, I still feel as if it is, by nature, very specific to each target site, so we have a few days before us; there is no need to already panic and declare a ban on compression. Let's first get some details on the actual attack. In other words, the "emerging advice" seems a bit premature to me.


How do botnets not get caught when using Gmail accounts for spamming? Botnets are Spamming through web-mail services like gmail.com,hotmail.com,etc. by compromising email-accounts

I read a post from this forum about how online accounts are compromised.
Following are some:

1.Same password to register everywhere

2.Common password

3.Phishing

4.Malware. Keyloggers

5.Secret question like (what's my name or my favourite color)

6.Malicious browser extensions,firefox user-scripts/plugins/extensions

These compromised accounts are mostly used by spammers/botnets to spam.

Could anyone kindly elaorate.

How do the individual bots of botnet not get caught for using the compromised accounts to send spam mails.Gmail,Hotmail are big fishes,how do these bots evade detection?

Thanks

Botnets often consist of thousands of machines. The largest ones count even hundreds of thousands. When one machine gets blacklisted by a service provider for spamming, another machine from the botnet is used instead.

Also, most members of botnets are machines at private internet connections which do not have static IP addresses. That makes them very hard to blacklist for two reasons: 1. the machine can start spamming again as soon as it got a new IP address and 2. the service can not hold up IP blocks for too long because they risk hitting a legitimate user when the blacklisted IP gets reassigned.


Interesting article on a vulnerability found in Tor This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out with a "malicious Tor exit node" so there's a lot you can do at that point. Isn't that kind of like saying "when your firewall is down your system is vulnerable".

One thing I don't understand is

  BitTorrent's DHT uses the less-common UDP protocol, forcing some of
  the traffic to be sent in the clear.

How come data sent over UDP can't be encrypted?

Its talking about bittorrent clients not protecting itself properly. Also the article got this wrong the vulnerability is NOT in tor itself but the client using it.

This quote is too vague

  The user's BitTorrent client then attempts to make a data connection
  directly to the honeypot without using Tor, thus revealing the user's
  IP address to the honeypot.

But the DHT part is something done over UDP which isn't protected yet the client still tries to make a connection to it. I skimmed the paper the article linked. It mentions clients connect to peers directly which sounds like nonsense or clients completely ignoring proxy settings. It then talks about analyzing traffic through tor so i believe clients do get some of it right.

A malice exit node isn't the same as turning off a firewall. Its more like visiting a site thats trying to use an exploit in your browser or phish you. The exit node adds extra peers to your connection and those peers are trying to figure out who you are. I didn't read it all so i cant break it down but thats the jist of it. Adding extra peers, hoping your client isn't implemented properly and it appears clients may leak information about other users/peers. The paper also mentions its not as easy when clients encrypt their data.


AES ECB Mode for single block/random data encryption I need to save random 16 byte keys to a database.
To encrypt these keys I currently use AES 128 with ECB Mode (because of smaller data to store, no IV needed), but now I read a lot about ECB being unsafe and should never be used.

I thought in this case (random data, just a single block) using ECB would be fine, but I'm no expert, so I would like to know whether this is right, or should I better switch to CBC to make it secure?

If you only have ONE block, using other modes such as CBC does not offer extra security. Remember, the only secret here should be the key to encryption/decryption. IV is usually a known entity. If you hope to achieve better security by making IV a secret, you are approaching it from a wrong direction.

Saying so, I would still not recommend ECB ;). Think about two users having a same password. Their encrypted passwords are also the same, due to the "code book" nature of ECB.

In your case, I would probably use CTR mode with the counter value being simply the ID of the user.


How to implement shamir's secret sharing algorithm using AES_ENCYRPT I am using MySQL AES_ENCRYTP() and AES_DECRYPT() to store sensitive details in a database, and currently storing the key in a php file outside of the web root with read access only. The key file looks like:

<?php
    define("CRYPTO_KEY", "SOME-LONG-KEY-HERE");
?>

After further reading, people recommend that the key should ONLY exist in memory and to use something like Shamir's Secret Sharing WikiPedia article.

How would this work in my case with php, and where in memory would the key be stored?

Thanks for the help.

Application written in PHP can be made memory persistent, i.e. run as a service and respond to requests of another local process that is or isn't persistent, for example by using FastCGI Process Manager. I'm not some PHP guru, but the FastCGI modules are standard across many platforms that I've worked with before, so it should be much the same. In a nutshell, using FastCGI you should be able to run a memory persistent service (or an Apache worker) that listens on a specific port for HTTP requests and sends HTTP responses back to the caller web application. So this is how I'd go about writing your Shamir's Secret Sharing:

Write a memory-persistent key server PHP application that will take some password (key A) as an input from the caller web application, and another password (key B) that you enter during key server application's initialization. You can make entering this key B remote enabled or local only, but that can be made with the same password entry form and just setup your firewall accordingly to your needs. Then concatenate these two keys A+B and hash this value (say bcrypt, what's in PHP named as CRYPT_BLOWFISH, either case use a slow hashing algorithm for added protection against brute-force attacks) to get the key C that you'll use to decrypt an AES encrypted database key D stored in a local file. Drop (overwrite with random nonsense or nullify) your key B variable, but keep key A and key C in memory.

You will use key A to check subsequent local requests of your non-persistent web application (you can hash this value, but using a slow hashing algorithm doesn't make much sense with frequent requests, and fast hashing algorithms won't help much), and use key C to decrypt locally stored database key D that you need to send back to the authenticated web application. Host this key server application as a FastCGI Apache worker, set the port at which it is to respond to HTTP requests (not HTTP(S) ports 80, 8080, or 443), and configure your firewall to only respond to remote requests on this selected port for the key B input URL, while the database key D retrieval URL should only be accessible locally on the same web server.

Then generate your encrypted database key file. Decide on two random passwords key A and key B, generate key C as a bcrypt hash of the two concatenated keys A+B, and use this key C to AES encrypt your database key D, and store it in a locally accessible file. Store key A, as you'll be using it in your PHP written web applications to retrieve, and memorize or otherwise safely store key B. Password protect / encrypt your database using key D and you're good to go.

This approach is in essence a 2FA, where the database key is only ever kept in memory, or strongly encrypted in a local file, and the decryption key is never sent in its entirety by a single mode of input. If the attacker gets a hold of all but a single part of this key chain, or even create a complete copy of your web server hosted files, applications, and the database, he wouldn't be able to decrypt your database. Provided of course, your approach is sound, and uses strong encryption and password hashing algorithms.


How can I strip sensitive data out of a Wireshark log report? I have a sync app that doesn't work and the developer asked me to try and perform a sync with Wireshark capturing the data and send the Wireshark log to him.

I noticed that Wireshark saves sensitive data in the log, like the MAC address of both my devices involved in the sync process. Is there a built-in feature with which I can strip all this sensitive data out of the log I need to hand over to the developer? Any external tools?

Bonus question: Developer has a good reason to ask for this data, but he didn't tell me anything about the fact that the log would contain sensitive data. What should I do? Are this data really that important? Should have he warned me?

Are you sure that the data in the capture is sensitive data?  If it's the MAC address that you are worried about, I can assure you that it is not sensitive, and not useful at all to any potential attacker.
MAC addresses are not traceable nor are they used for any kind of authentication (besides WIFI whitelists, which would require the technician to actually be within range of your WIFI network).
Infact, in the normal run of things, the MAC address never leaves your local network (I.E. It never gets to the internet).

Similarly, local IP addresses will not go out to the internet, and will be changed by your router/modem.


GPG key handling with Server I'm using a VPS as a development machine and need gpg a) for signing git  commits or e-mails (using mutt on the server) and b) for decrypting f.e. encrypted dotfiles and other files. But I don't feel really comfortable with uploading my private key to the VPS (even though it has a password). So I've read in the Debian wiki that you can create a subkey for signing - but not one for encrypting (which would be the ideal solution of course).

So is it possible to create a completely new gpg keypair on the VPS, so that I can use this one for b) but import the newly created signing subkey for a) instead of the "normal" subkey of the VPS keypair?

I'm no expert, but I think what you're talking about will work. For keys A = current keypair, B = new signing key, and C = new encryption keypair on the VPS:

From whatever machine holds your primary keypair

gpg2 --edit-key A8675309
addkey <follow prompts to generate signing key>
gpg2 -K <list keys, find new key's handle>
gpg2 -a -o signingKey.sec.asc --export-secret-key B8675309

I think you only need to import the secret key on the other side, might be wrong on that. Next get your exported signing key to the VPS, then

From your VPS

gpg2 --gen-key
gpg2 --import signingKey.sec.asc
gpg2 -a -o vpskey.pub.asc --export C8675309

After that you just need to get vpskey.pub.asc to your main box and

gpg2 --import vpskey.pub.asc

and use that key to encrypt anything you'll need to send to the VPS. You need to be careful with how you get the keys moved between machines, but personally I'd feel safe using SCP.


Java applet authenticity problem I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, how can I guarantee that is my applet who is communicating with my website ? and is not a script-kiddie that made an applet that simulates my applets behaviours in order to hack into my website.

I am having some difficulties to imagine a way to guarantee my applet authenticity to my website since this applet is developed in Java so code reverse engineering is easy and possible.

best regards,

Basically you cannot have such a guarantee. Your applet runs on the client machine, i.e. the attacker's machine. He can inspect the applet code as he wishes, and there is nothing which the applet can hide from the attacker since that's his computer. That the applet is compiled is no big hindrance; reverse engineering works in general, and for Java code in particular it works very well.

(A lot of people in the media industry -- movies, music... -- would be very interested if someone could come out with a solution to your problem. Right now they are still waiting.)

To ensure that only your code runs on the client machine, you have to make sure that the client machine is a closed environment, where the machine owner himself cannot insert arbitrary code of his own. That's the model of game consoles and iPhones (until jailbreak occurs, of course). You cannot have that on PC.


How does the attestation mechanism of U2F guarantee the provenance of the key material? I'm trying to understand Yubico's documentation of the U2F standard, and getting hung up on the PIV attestation piece.

The security claim appears to be that the authoritatively-signed attestation certificate sent by the device upon registration will allow the relying party (~= server) to verify that the keying material produced by the U2F registration has not been stored or copied outside of the device.

I'm confused about how this can be possible. How does the attestation certificate represent the association between the public and private key material? How can the attestation certificate be signed for every keypair generated on the fly?

The only code that I can find showing how the attestation certificates are generated is the (static, self-signed) certificate used by this SoftU2F implementation in Rust:
https://github.com/danstiner/rust-u2f/blob/master/u2f-core/src/self_signed_attestation.rs

There must be something I'm missing here, probably in how Yubikey specifically signs the attestation certificates, perhaps taking advantage of the fact that the keying material for every registration is in some way.

Can anyone help me understand how, for example, the attestation certificates produced by Yubikey's U2F devices and signed by this CA cert would allow a server to verify the provenance of the keying material used in the U2F registration, or the authenticity of the device model information?

Put another way: If I register a U2F device and receive its attestation certificate, key handle, and public key (as described in the protocol details), and I trust the root CA of the attestation cert... how can I use this to verify the provenance of the keying material?

The U2F spec overview says:

  The intention is that the public keys of all the 'Attestation' key pairs used by each vendor will be available in the public domain - this could be implemented by certificates chaining to a root public key or literally as a list. We will work within FIDO to decide the details on how certified vendors can publish their attestation public keys.

In practice most key vendors provide a root certificate somewhere that you can use to verify the attestation certificate. This works just like any other PKI.

Each authenticor contains an attestation private key that is used to create attestation signatures, and the associated attestation certificate that is sent as part of each registration the authenticator is used for. The attestation private key will be shared by at least 100,000 authenticators to prevent services from identifying an individual based on the attestation key. The purpose is to provide a way to prove which vendor manufactured the key, as the private key should be impossible to extract from the authenticator, and is thus known only to the vendor.

The registration response message includes an attestation certificate and a signature. The attestation certificate is a normal DER encoded X.509 certificate, and the signature is created with the attestation private key over the rest of the response message and part of the associated request.

To properly verify the attestation, first the attestation public key is extracted from the certificate and used to verify the signature of the response. Without this step, an attacker could simply take the attestation certificate from a known to be accepted authenticator and use it instead of their own device's attestation certificate.

After the response signature has been verified (tying the attestation certificate to the registration keypair), the attestation certificate itself must be verified. As an example, here is the certificate from one of my keys, decoded with the openssl x509 CLI:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 618376000 (0x24dbab40)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Yubico U2F Root CA Serial 457200631
        Validity
            Not Before: Aug  1 00:00:00 2014 GMT
            Not After : Sep  4 00:00:00 2050 GMT
        Subject: CN = Yubico U2F EE Serial 13503277888
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:02:b0:94:be:34:7d:47:79:41:c4:77:8e:be:c5:
                    ca:4d:ed:2a:47:9f:aa:1e:6f:ec:39:af:eb:de:0c:
                    20:70:cb:5b:d4:bd:69:c9:6a:78:e3:bf:87:51:fe:
                    b5:79:1b:8d:fa:ca:c2:94:01:75:1c:b1:57:b9:7c:
                    09:e4:39:1a:36
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            1.3.6.1.4.1.41482.1.1:

    Signature Algorithm: sha256WithRSAEncryption
         a3:63:ae:0e:98:3a:f3:0b:ba:f1:2c:8b:2d:f3:5a:59:bf:1c:
         bb:4a:1b:0f:cb:68:c4:84:55:84:90:f6:87:34:58:65:b8:db:
         02:69:c3:46:e5:53:88:4c:2c:56:07:af:0e:a2:7b:90:ac:8c:
         f1:ef:43:1f:72:ac:18:9d:b2:1c:82:49:14:bf:17:88:a5:51:
         1a:33:d0:7b:4c:8e:34:64:7c:e9:f6:1e:15:16:a9:a9:b3:6e:
         90:0a:40:20:61:f6:9a:a4:6e:12:c5:32:b9:93:f9:42:3e:fa:
         aa:4c:f9:a3:b6:54:b4:dd:de:f2:92:4a:54:8f:d5:99:95:51:
         0d:d4:f7:f4:d9:a4:d5:21:93:87:3c:71:c9:b8:7e:86:85:3e:
         9e:2d:a7:5e:8f:0c:6d:28:30:53:74:d4:ef:dd:5e:14:96:f8:
         c3:39:06:10:7b:d6:8b:d6:35:0d:aa:d2:c3:78:11:ec:a3:ca:
         43:bc:93:0b:73:40:97:de:f6:9d:68:8d:94:55:0c:4c:fb:18:
         a9:e2:4b:86:a2:e5:d8:8f:49:98:99:a0:9b:ce:5b:81:0c:53:
         6c:af:39:0d:c8:bd:de:96:0d:f3:30:ca:ca:bc:05:21:a1:83:
         23:95:7f:fe:bc:a5:9c:a9:0b:20:b1:0d:09:b5:23:1c:58:c2:
         7e:ba:67:83

The issuing certificate can be determined from the Issuer field, in this case it's Yubico's U2F Root CA. Assuming the application trusts that CA, it would take the public key from that root certificate (the root certificate itself would come from a list of trusted roots) and use it to verify the signature on the attestation certificate. If the verification is successful, the registration keypair will be cryptographically tied to the attestation certificate, and the attestation certificate will be cryptographically tied to the trusted root.

If you trust that the vendor has manufactured their authenticators properly so that the attestation private key and the key wrapping secret (or key storage depending on design) cannot be extracted, then you can be confident that the registered key is from an authenticator created by the vendor you obtained the root certificate from.


Can unencrypted keys & logins be kept out of program memory? No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will be stored there to perform encryption and logging in, and an attacker can physically read from RAM.

Is this true?  If so, is there any way to prevent keys & logins from being stored in memory unencrypted?

As DeerHunter points out, pieces of information that should never be accessed by anything other than a hard-wired set of instructions can be stored in a Hardware Security Module.

HSMs hold the key and can perform tasks that use the key, for example generating signatures, without the key ever being known outside the HSM. An HSM is not a box you keep an encryption key in, to be loaded out when it is used - the key stays in the box, the HSM is designed to never egress the key.

However, if your threat model includes attackers that have physical access to RAM, you have no hope. Thats like asking if it is possible to keep thieves out of your house while allowing them into all the rooms.

If all you are aiming to achieve is never having the encryption key present in RAM in its entirety, you could envision an encryption scheme that did not use the entire key at once, perhaps feeding in the key one byte at a time into an iterative algorithm. The result of this iteration would be a block cypher function.

As usual, the bear has provided an excellent answer that covers this topic, and there is no need for me to repeat his efforts.


Does an Embedded Content Security Policy (CSP) Enforcement ruin a "regular" CSP? I recently read a W3C Working Draft about the Embedded Enforcement of a Content Security Policy (CSP).

  This document defines a mechanism by which a web page can embed a nested browsing context if and only if it agrees to enforce a particular set of restrictions upon itself.
  Source: Content Security Policy: Embedded Enforcement

Unless I understood it completely wrong, does this Embedding-CSP not ruin the fundamentals of CSP completely?

In a case wherin you can inject HTML (with an iframe) or JS (XSS) you'd be able to set such "Embedded CSP" attribute? That overwrites the CSP from the original HTTP response? That seems undesirable.

Not at all.

Let's say I build my website supersite.com with a lot of JS, so I want it to be able to run scripts, but I also want to put some adds, but I don't want it to be dynamic and thus doesn't execute script.

The problem is that usually, my add provider do include script. To avoid this, I explically tell him that I do not want script, I'll then set the following iframe:

<iframe src="http://addprovider.com/?site=mywebsite" csp="script-src 'none'"></iframe>

While sending the GET request to addprovider.com, the following header will be set :

Embedding-CSP: script-src 'none'

From there, addprovider.com knows that if it puts script, supersite.com will refused to execute the script and thus decide to put some fancy images instead. While sending back the answer, addprovider.com shows that it accepts the given policy by setting the following header:

Content-Security-Policy: script-src 'none'

If addprovider.com try to cheat and send back that its answer is csp complient but doesn't, supersite.com the response will be blocked.
If addprovider doesn't return csp or return a csp that doesn't match or enforce the given csp, the response will be blocked too.

How is it usefull ? This are the 2 alternatives atm :

Set a CSP on supersite.com, with header or meta tag : <meta http-equiv="Content-Security-Policy" content="script-src 'self'">. Howewer, this CSP will not apply to the embedded addprovider.com !
Use sandbox attributes. Howewer, this it too broad. You can only block all script or none. You can't specify different locations while you can do with CSP


A simple example for showing the use of Data Execution Prevention (DEP) security feature I am finding it really hard to figure out why we need a DEP!

Microsoft states this about DEP:

  The primary benefit of DEP is to help prevent code execution from data
  pages.

  Typically, code is not executed from the default heap and the
  stack. Hardware-enforced DEP detects code that is running from these
  locations and raises an exception when execution occurs.

  Software-enforced DEP can help prevent malicious code from taking
  advantage of exception-handling mechanisms in Windows.

What does that mean?

Can you give me a simple non-code example for this!

Hardware DEP takes advantage of the NX ("No Execute page protection",
  AMD specification) or XD ("Execute Disable", Intel specification) bit
  on DEP compatible CPU’s, and will mark certain parts of the memory
  (which should only contain data, such as the default heap, stack,
  memory pools) as non-executable.

  When an attempt is made to execute code from a DEP protected data
  page, an access violation (STATUS_ACCESS_VIOLATION (0xc0000005)) will
  occur. In most cases, this will result in process termination
  (unhandled exception).  As a result of this, when a developer decided
  he wants to allow code to run from a certain memory page, he will have
  to allocate the memory and mark it as executable.

  http://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#hwdep

When you're trying to redirect code flow through a buffer overflow exploit, etc you want to redirect the flow to a custom shellcode/payload that will give you remote access, etc to the victim computer.

We do this by re-writing registers like EIP(Extended Instruction Pointer), ESP(Extended Stack Pointer), etc. By this technology we attempt to prevent redirecting code flow to unauthorized memory locations. Hence in order to invoke the shell, we'd need to get past the access violation in theory.

Essentially programmers have to specify memory locations that can have  executable code, the other locations have non-executable data on invoking which causes an access violation exception.

Read more about its technicalities here: http://msdn.microsoft.com/en-us/library/bb736299(VS.85).aspx


How isolated are files on a VirtualBox virtual machine from the host filesystem? When transferring ownership of a computer from one party to another, it's advisable to perform steps to clean out personal data from the hard drive. Depending on needs, the type of data, and/or level of paranoia, this can consist of anything from a simple format to using a program that replaces the disk with all zeros, formatting 6 times, or in the most sensitive of cases, destroying the hard disk and replacing it with a new one.

Consider that I'm not a government agency protecting sensitive data, but at the same time, I don't want the next person using the computer to be able to easily access my data.

If I have a laptop that I use, let's say, for work, and on that computer I use a virtual machine for personal stuff, when transferring ownership of the computer, would deleting the virtual machine be good enough security for the average person, or would I still need to format the drive? Where does using a virtual machine fit in on this scale?

The virtual machine usually stores its virtual hard disk as a normal file on the host operating system's filesystem.

Think of a filesystem like a warehouse. The warehouse contains a large number of boxes (files) and a manifest that lists all of the boxes (the file table). When you delete a file, it doesn't actually destroy the data, it just deletes the entry from the manifest. When the next box comes into the warehouse, the manifest is checked, and the file is put into a free location. If that location already has a box in it, that old box is thrown out. As such, if you can scan through the warehouse instead of the manifest, you could check for boxes that aren't on the manifest, allowing you to extract contents of the boxes even though you "deleted" them.

So, if you delete the virtual machine's virtual disk file, the data will still remain on the disk. Since the virtual disk file is structured in terms of its own headers and the internal filesystem, it shouldn't be difficult to find and extract file data from within the virtual machine's filesystem. Formatting often doesn't solve this problem, as it just overwrites the file table with an empty one - the data is still there.

There are two ways to properly destroy files:

Overwrite the disk sectors that contain the data with zeros.
Encrypt the file data at runtime, then destroy the key when you want to delete the file.

The first option takes longer when you want to destroy the data, and puts more stress on the disk, as you have to overwrite every sector. The second option provides fast secure deletion, and increased protection during day-to-day use, but has a performance hit on the CPU. In fact, SSDs use the second option to reduce write-wear on the flash devices during a re-format - they store a master key, encrypt everything on the drive with it, then destroy and re-generate the key when given a re-format command.

So, if you're looking to destroy data securely, either perform a proper low-level wipe using shred, or encrypt the disk using TrueCrypt and throw away the key when you want to get rid of the drive.


Why limit password length? This question is inspired by Is there any security risk in not setting a maximum password length?.
Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are recommended to avoid exhausting the server.
Also it seems to me that if the server is hashing your password to a n digit hash, there is no security advantage to having a password that is longer than n digits.  An entity that could reasonable brute force the n digit space, would not have to brute force the (n+1) digit space to brute force your (n+1) digit password.  In practical terms, a 1000 digit password is not really more secure than a 500 digit password.
However, what about double hashing the password.

The user enters a password of arbitrary length.
The client hashes the password to a fixed length.
The server can reject the client's hash if it is not the fixed length (protecting the server from resource exhaustion).
The server otherwise treats the client's hash as the password and proceeds in the usual manner (it re-hashes it).

In this way, if you want a 10,000 character long password go for it.  Your browser will invisibly to you, transform your 10,000 character long password to a 128 character long password (still very secure) and the only change in the server is that now the server knows that all passwords must be exactly 128 characters long so it can reject some logins more easily.
The primary benefit of this scheme is that no user will ever be told "your password is too long".  I personally find this message to be disheartening.  But I concede that this benefit is not monumental.  So if there are any security holes that I am not seeing, this scheme is probably not worth it.

As long as you are very careful about the client-side hashing function, it would seem like there is no reason you couldn't. But wait!
You do need to remember that not all passwords are for web-based applications with a single client written and distributed by the author.
Instead, it could be an arbitrary API. Adding the requirement that the password must be hashed using a specific function adds complexity to the implementation.
In yet other cases, the password could be set server-side (think SQL servers where the "set password" command is literally a SQL statement). Should the initial hashing function be poorly chosen (think md5 for postgres), you're now stuck with it until all clients support the new hashing function and all users have  changed their passwords.
It might at first seem like a practical reason and not a security reason. But this becomes a security issue 10 years later when your protocol is still being used and most clients still only support a terribly insecure hashing function (and yes, this is the case for postgres).


reading a file with other read permissions set For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file
A non-root user can techincally read that file but in practice to read it the process must be given the pathname to the file, and the kernel will check that the directory /test has the executable bit set. Because it is not set, the read will fail.
If the one does a chmod o+x /test, then a non-root user can do a cat /test/file and read the file. Is there a way to read the file without setting the execute bit on the directory /test.? For example, could one somehow pass the file to the fopen function in C without giving it the full pathname. You could if the process was running the test dir, but to be in that dir it would need the right permissions anyway.

If there exists a symlink to the file that is inside an executable directory, the user can still read the symlink, regardless of its type. I'm uncertain whether there are other known methods.