nmap - Difference between "Filtered" and "Admin-Prohibited" I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem related to firewall or network restrictions in general.

As I understand (but maybe I'm wrong), the "filtered" word is used when a port is behind a firewall, for example:

Nmap scan report for 10.0.0.2
Host is up, received user-set (0.026s latency).
All 500 scanned ports on 10.69.72.3 are filtered because of 438 no-responses and 62 admin-prohibiteds

In this case, nmap has been launched with the -Pn parameter in order to perform a host discovery, so that's the reason for the "user-set" and the relative filtered ports.

But I don't get why (and especially how) are those 62 admin-prohibited ports shown, so are they the same thing as "filtered"?

"Filtered" means "I sent something, I never got a response, it just disappeared, so I'm guessing that something is filtering the packets out and quietly dropping them."

"Admin Prohibited" means "I sent something, and I got back an ICMP 'Admin Prohibited' packet, which clearly indicates that I'm being actively blocked."


SAML without certificate A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes?
Is this a correct answer or have I missed something?

Not signing a SAML-ticket would be a very bad idea because you would be an easy target for "Man in the middle-attack", Am I correct?

There is an in-depth analysis of the security of SAML in the PhD thesis of Thomas Gross (Bochum):

http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/GrossThomas/diss.pdf

His analysis led to the revision 2.0 of the SAML standard. It is very clear that certain communications have to be encrypted to keep the protocol secure, and that you need to know that you communicate with the right server.

While there are other possible solutions than server certificates, certificates are the standard way to do it. Note that only the servers need to have certificates, it is not necessary that the users/browsers have certificates.


Checklist for configuring WinRM Security settings on servers WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited.

In other words, insecurity though obscurity.

What security settings should I pay attention to when configuring WinRM on a server?

Here is an incomplete list of security-related items I discovered:

Be aware of new defaults

WinRM used to run on ports 80/443 in Vista and Longhorn.  That has changed to port "5985" and "5986" recognized by IANA as the new management ports (more info bottom of this page)

Helpful commands

The command winrm g winrm/config lists most of the WinRM configuration settings
Inbound listeners are shown here: winrm e winrm/config/listener

Configuration

Many MSFT support documents recommend running the command Winrm quickconfig, which creates a http listener.  A possible vulnerability is that your token is sent unencrypted on port 5985.  The alternative is to run: winrm quickconfig -transport:https.
Ensure that "EnableCompatibilityHttpListener" and its HTTPS counterpart is set to false on all servers, especially public facing web servers.
For machines in the DMZ, or multi-homed machines you may want to prevent a listener on certain interfaces and not others. See winrm help config for more info

Todo/research

The wording of this MSFT page indicates that client or server might downlevel negotiate to unencrypted traffic within the HTTP transport.  This creates room for a MITM to access credentials.  I'm looking into ways to ensure the client always uses SOAP encryption regardless of the transport being used.


How to encrypt data on flash drive to decrypt on another system? I have a Mac OS X and a flash drive and I would like to store some files as a backup to carry with me in case I completely lose access to my computer (e.g. theft). I would like to encrypt these files. I know close to nothing about how encryption works. It is possible I will need access to these files on another system, OS X or Windows, etc.

How do I encrypt them on one machine so that another one will understand how to decrypt them? (of course, given that I remember the password I used to encrypt them).

I have found solutions like FileVault native to OS X (but I don't know if it will decrypt on another machine) and GPG (which I did not understand that well), I tried using AESCrypt (but it only encrypts file-by-file or a zip archive, which is awkward), I've read that TrueCrypt has been discontinued, etc. What are my options?

Unfortunately all the slick methods of Full Disk Encryption are all native to the OS, and so only available on that OS, so if you need cross-platform support you have to use a more nerdy solution like GPG.

In my experience the easiest way to achieve something like this usually ends up, as Matthew suggests, to be an encrypted zip file. You can find plenty of tools to open these on any platform. 7zip is what I usually point people to.

One important point: make sure you always use AES 256 as the encryption method, and not the older native zipCrypto method.


Why are password boxes always blanked out when other sensitive data isn't? So far as I know, password boxes and PINs are always obscured in some way in order to prevent people from looking over your shoulder when you enter it. However, other important information that I type into a web form (credit card number, social security number, etc.) that I would also like to protect from rubbernecking is hardly ever obscured.

As a concrete example typing your login password into Steam or Amazon is properly blanked out but typing in your credit card number when making a purchase is revealed as plaintext. Intuitively, it feels like you would want to blank anything that could be stolen, credit card info included.

Is there any particular reason why only passwords and no other sensitive data is usually obscured?

I don't think this is about secret vs sensitive information, eg "secret information is masked and sensitive isn't." (the distinction is problematic; many secrets need to be shared too).

I think cc and ssn information isn't blanked for several reasons. They're not hard fact, but still, here are a few:

Doing what everybody else is doing, not surprising the user. Passwords came long before web forms and were already masked. So when they were used in login forms, they were masked too. When online business and administration came along, prior art (paper forms) required unmasked entry of sensitive information (obviously), so web forms made the same choice.
It would be very easy to make a mistake and enter a wrong number if you didn't see what you typed. In the case of a wrong password, this is only mildly annoying and you get instant feedback; in the case of other wrong sensitive data, this might have further consequences which isn't immediately clear (such as a request to a government office being denied because of a wrong SSN or a payment not going through - although in the cc and ssn cases, this is usually  hedged against by looking if the checksum is right and providing immediate feedback if it wasn't)
Many people don't know their cc number from memory and copy it down from the actual credit card. So the number is there to be seen by a bystander anyway; blanking the entry field wouldn't help much to protect the number at the client end and thus doesn't merit the additional difficulties caused by 2.
Impact - A stolen cc number doesn't necessarily have the same impact as a stolen password, especially if you consider that information stolen by looking over your shoulder would most likely be stolen by people who know you (collegues at work, family members, classmates etc) and want your password for a very specific reason that would have personal consequences. OTOH, even if they were interested in your cc number, you wouldn't have to take the financial damage because the cc company would probably cover it. For the same reason, you don't mind letting a waiter or store clerk see your credit card, even though he could copy it and sell it to someone else...

Number 4 may not apply to other kinds of sensitive information, though.


Unmasking passwords during sign up, is it a good idea? I just read this article about unmasking passwords at sign up for usability reasons. On the surface it seems reasonable to me, but I'm wondering what additional security concerns that might generate, if any.

Masking password fields is designed to prevent shoulder-surfing, where an attacker watches you type in a password. Unmasking is a bad idea in public, but it's not so bad in signup scenarios when the user is alone in the room. Whilst I personally disagree with the assertion that users are incapable of typing in a password correctly twice in succession, I'll go along with it for the purpose of this question.
I think the security concerns are covered quite well in some of the comments.
Luca Rosaldi said:

Another good approach (IMHO) would be including the “show password” checkbox, but checked by default. This way, if I’m alone I could check my password without concerns for security, or if I’m not I could uncheck the box and type my password.

To which Ray McCord replied:

It should be exactly the opposite.
It must be masked by default and the user must have to take an explicit action to unmask it — and even then that choice should be honored only very temporarily before reverting to masked.
Why?
Because this password form is acting as your agent and it, therefore, must be made to act in your best interest first — like a bodyguard.

This is a decent compromise - the default is to provide the user with the maximum possible security. If the user decides that it's just too damn hard to put their password in correctly, they can opt to sacrifice security for usability. This has the extra benefit of not patronising users that are perfectly capable of typing properly.
The biggest problem isn't really a security one, but rather a confidence one. Tesmond put it perfectly:

Simply displaying the password field is very uncommon behaviour, it instantly creates cognitive dissonance and perhaps even instant panic as your “secret” password is displayed for all on lookers. You may worry that your password will be visible in all places within the application and may even make you change your password to a less memorable one.

This actually creates a security problem. If you saw your password appear unmasked, you'd be a little confused as to why the site decided to buck the trend. Perhaps they don't care about security? Perhaps they store it in plaintext?! Perhaps your password will be visible on every screen!!? The user will then pick a terrible password that they don't care about having compromised, which puts their account at risk.


Does not having https moot this entire site? On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone number to the bank and get me to dial a fake number.

Now, I'm realizing that we're providing a TON of information here at stackexchange, but that even this site isn't over HTTPS. How do I know I can trust any of the information here? How can I know it hasn't been tampered with and changed? How do I know that the answers to this question are not being intercepted and MIM'ed?

I know the information here is crowd-sourced, so how can I trust it in the first place, but if we assume the system is working, and that the best answers are generally right, how can we know we can trust them?

If attackers are doing a MitM to inject good answers in the stream, I certainly won't mind...

More seriously, StackExchange counts on most people being basically honest, and most attackers being basically people, i.e. lazy. It takes quite some effort and resources to maintain a working wide-scale Man-in-the-Middle attack so we can just assume that the overwhelming majority of connections to SE sites will not be tampered with. Not very reassuring, but the whole concept of Civilization builds on even flimsier foundations and we have learned to live with it (and, occasionally but not that rarely, to die for it).

From the SE managers point of view, this is a trade-off: what would they gain with site-wide SSL, and what would they lose ? Site-wide SSL increases CPU load, but not by much: according to Google, a mere +1% CPU and +2% network bandwidth. This was in the context of Gmail; an SE site has different usage patterns, and in particular serves a lot of "public and mostly static data" which could be cached (e.g. by transparent proxies installed by ISP). The biggest cost might be referencing: although search engines now index HTTPS content, it can be imagined that they handle it differently from what they do with HTTP content. Search Engine Optimization is the Life Force of free Web sites. To sump up, there seems to be some costs or risks (which are, economically, the same thing) to switching to full-site HTTPS.

On the other hand, what would SE gain from full-site HTTPS ? They don't guarantee anything about the veracity of the data, and it is public. What sense would it make to guarantee the confidentiality and integrity of the data in transit, while it was not confidential and not provably genuine to begin with ? And, even more importantly, would SE make more money out of it, to recoup the extra cost ? Remember that StackExchange is a private business. They are not Mother Theresa. They want to, one way or another, make money.

Thus, logically, SE managers will envision full-site HTTPS only when they believe that it will bring sufficiently extra readership. This seems dubious to me. I don't say that I don't want more SSL generally; but I cannot blame SE maintainers for choosing otherwise.


What security layers of protection are available over XMPP? I have been working on an application running over XMPP. I would like to know which all popular security layers are available over the XMPP protocol, similar to SSL over http.

The core XMPP specification defines how it integrates with TLS for transport security, and SASL for authentication.

There is also a standard end-to-end signing and encryption protocol that can be used to ensure protection of messages from sender to ultimate recipient, whereas TLS only protects up to the next relay host. This end-to-end protocol builds on S/MIME.

Also, depending on the context, you may have the option to put clients and servers in their own VPN, which will protect the traffic against outsiders. This is generic to every networked application and is done at the OS level.


How do you organize a code review / static analysis report? Recently I get involved in a security code review.

I found many format string, buffer overflow and dangerous libc function call.

Right now I need to write down a report with all the stuff founded in a clear and useful way.

I want to know your experience in how you organize this kind of report .

I need to caveat this with - there are a million different ways to do this, and most organisations have their own. Most of my experience in global professional services firms aims to deliver these sort of reports to heads of IT Security, CISO's and Executive boards, so your mileage may vary. A quick summary:

First: think about your audience

If delivering to IT devs and support teams, all they are going to want is a prioritised list of issues, the steps to fix, and a link to the vendor description (eg MS KB page)

If delivering to heads of department, they will want a prioritised list with an estimate of risk and likelihood of exploitation, time to fix each one, and possibly issue owners (although that may not be your responsibility)

There are other audiences, but those two are probably the most common. So it is often useful to deliver a report that is suitable for both.

What I usually prepare is an executive summary listing why the work was done (eg for an audit), high level implications of the results (usually Red/Amber/Green indicators for the board) and an estimate of time to fix. This helps senior management prioritise budget and resource. Wording here needs to be suitable to take to the board if necessary, so no technical detail!

In addition I'll include a technical appendix which has the information the remediation team will actually need in order to make the relevant fixes. This may be as simple as an excel spreadsheet.


Ali Express hijacking my Chrome So randomly every now and then, when I click on a link - instead of opening it normaly, a new tab is opened and some website with "tracking" in the name (I haven't caught the full name yet, it's quite quick) a site called trackingclick.net redirects me to www.aliexpress.com.

I assumed it was because the websites I visited were fishy or something, but then it happened while I was developing a site on a local server. So it's clear this is something internal on my own machine. How do I track down what's causing this?

Maybe relevant info:
I'm running Elementary OS Luna. My current enabled extensions are: Hola, Ajax Debugger, Chrome Currency Converter, Chrome Apps & Extensions Developer Tool, Dimensions, Edge: The Web Ruler, JSON Viewer, Project Naptha, User-Agent Switcher for Chrome.

This sounds like a browser redirect virus.

Does the same thing happen when you use a different browser?  If no, then there is something in Chrome.  I would start removing or disabling your extensions one by one STARTING WITH, God help us all, HOLA, until the problem goes away.

If other browsers have the same problem, then the issue is not with an extension or Chrome, but with something in your OS.

I suggest you use an intercepting proxy (Like Burp or Zap) to intercept the requests so you can have more information.  At least it will reveal the identity of "some website with tracking in the name".  This might help identify the virus and lead you to steps to remove it.

If those steps do not resolve the issue, I would also try Clam AV on Elementary OS.  Instructions are here.

Since you say it happens when testing your locally hosted web app (I assume this means addresses like http://localhost/foo are being redirected too?), it is probably like you said, local to your machine.  There is a chance that what ever is causing this has made changes to your hosts file to even redirect localhost.  So, if you open the file /etc/hosts, what do you see in there?


Does Windows Subsystem for Linux provide additional security (VM-like isolation) over running native Windows programs? On a Windows 10 machine, is it safer to run the Linux version of a browser using Windows Subsystem for Linux instead of running the Windows version?

I'm asking because I've read the Wikipedia article on Windows Subsystem for Linux (WSL), and I'm not sure of how it works security-wise. It says that

  WSL provides a Linux-compatible kernel interface developed by Microsoft (containing no Linux kernel code), which can then run a Linux userland on top of it

and

  WSL uses fewer resources than a fully virtualized machine

Is this Linux userland well separated from the Windows one? That is, is the WSL a sort of virtual machine, isolated from the rest of the system? Assuming I use the Linux version of Firefox to visit a malicious website which fully compromises it, would the malware's effectiveness be reduced by being confined in this WSL, or would the result be the same as having the native Firefox for Windows compromised?
Or, to put it differently: if I want an isolated system that I can use to visit potentially insecure sites, is it enough to use WSL, or do I need a full-fledged virtual machine?

I've found a similar question, but it is about the attack surface, that is, before the system is compromised. Instead, I'm asking whether WSL implies any mitigations after the system has been compromised. Moreover, that question was asked before WSL was released, and some details weren't clear back then.

In a nutshell, WSL is just a Linux ABI compatibility layer, i.e. a set of libraries that translate a Linux system call into something Windows kernel is able to do.

The general idea is to have this compatibility layer as thin as possible to ensure Linux binaries run under Windows almost as fast as natively. Thus it's nowhere near a virtual machine. E.g. all Windows filesystems get mounted in WSL under /mnt for your convenience, and so on. Except for limiting the attack surface somewhat (as you've pointed out already), WSL doesn't provide any secure isolation.


Protecting form post values when on https I am dealing with a multi-step form, and I need to pass information from step 1 to step 2, then from step 2 to step 3, and so on.

Step 1 contains a membership number and ID number entry, as well as another identifier (3 fields to complete to identify the visitor). At this moment I use RIJNDAEL encryption to encrypt the data before passing through to the next step via hidden fields, but somehow, I am corrupting the data (it does not decrypt again). I will fix it, but:

My question: Is it really dangerous to leave these items unencrypted in the first place if you're using HTTPS?

If you are using HTTPS, there is no reason to encrypt anything in your forms. This is because HTTPS is already encrypting all of your traffic. If you have a properly configured HTTPS connection between your server and the client, there is no way for an attacker to see the data being passed between the two. If this was not the case, encrypting your data client side would only be marginally beneficial, since a determined attacker could intercept your javascript code used for encryption while it is being sent from the server to the client, and replace it with a compromised version.

Generally speaking, there is no reason to encrypt data on the client side, since HTTPS is required to ensure that you have non-compromised encryption code, and if you have HTTPS you don't need any additional encryption.


Fixing the high-bit problem in PHP's crypt() implementation I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not processed properly, and it may be possible for an attacker to reduce the brute-force space. There's a fix in 5.3.7, but I'll need to support earlier versions.

In order to work around the issue, I'm thinking of Base64 encoding the password prior to running it through crypt(). The idea is that base64_encode() is binary safe, and the output will never contain any characters whose most significant bit is set.

Is this a safe assumption, or should I look at an alternative method?

Base64 output is limited to ASCII digits, letters (lowercase and uppercase), '+', '/', '=' and newline endings (CR and LF). All of these fit in the lower 7 bits.

Using Base64 encoding has the unfortunate side-effect of enlarging the data by about +33%. Since bcrypt has a size limit of 55 characters, so with Base64 encoding you are down to about 39 bytes.

Also, non-ASCII password characters open up the murky business of code pages (Unicode, UTF-8, Windows-1252...) and Base64 does not solve that; it just pushes the problem under the rug.


Comparing Man-in-the-Middle with Man-in-the-Browser According to OWASP the Man-in-the-Browser (Malware-in-the-Middle) attack uses the same approach as Man-in-the-middle attack, but the differences is that interception is done at the application layer by exploiting bugs in the browser.

So My question is that defenses like HTTPS,SSL which operates below the application layer are ineffective against Man-in-the-Browser attack since malware can modify and intercept application calls?

Secondly From Application developer perspective if the application developer knows that application is bound to run on untrustworthy OS then what are the defenses or access control measures he can take? i.e. banking applications in particular

Malware which got into the browser can grab and alter any data that the browser contains; if you see it or type it, then the malware sees it, and the malware can "type" other values. That's your doom.

SSL (HTTPS) only protect data in transit, between the browser and the server. It ensures that no outsider may peek at the data and/or alter it. But malware which is in the browser (or in the Operating System itself) is an insider and SSL is not relevant for it.

Best defence against malware, arguably the only defence, is not to let malware enter your machine. Don't install software which is not from a trustworthy source; keep your OS and browser fully up-to-date with regards to published security fixes; and pray. Oh yes, pray a lot.


Is pinning global root CA almost same as not having any certificate pinning at all? I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?

Considering the classic coffee shop attack scenario where the owner of the network has a certificate issued for his domain (*.evilcoffee.com signed by DigiCert)

Now if the mobile application is trusting any certificate issued by Digicert then you can effectively MiTM?
Am I missing something?

Pinning a Root CA can prevent risks posed by other trusted Root CAs in the default certificate store. As mentioned in the link you shared (thank you), it's a deployment decision as to how high (or low) in the chain you would pin the certificate.

Check out this Security.SE post for more information for the underlying threat and some mitigations.


How to calculate our application security debt? Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be paid off. I would like to know how to calculate security debts in our bank applications?

The best advice I have heard is to figure out a list of all of the different types of events that could occur as a result of your security debt.  Next, try to estimate the cost of each of those events.  Next, figure out the likelihood of those events occurring per year.  Your final formula should look something like

Probability(event type 1) * Cost(event type 1) +
Probability(event type 2) * Cost(event type 2) +
... +
Probability(event type N) * Cost(event type N)

For example, let's say you determine that there are two issues which could be exploited by your security debit: SQL Injection + CSRF.  (I've made up numbers to make the math easier):

We expect 5 successful SQL injection attacks per year, each of which would have a recovery cost of $100,000
We expect 10 successful CSRF attacks with a recovery cost of $25,000 apiece

Your estimated cost of security debt for the year in question would be:

(5 * $100,000) + (10 * $25,000) = $750,000


Trying to understand/use openssl for decryption There are many questions around this topic, but I haven't found one that explains exactly my issue.

I am encrypting data with AES 128 CBC, but using python and pycryptodome (should have used the python openssl, but couldn't find it) and specifying the key and iv (which is generally random). So, the key is not salted.

When I try using openssl 1.1.0g with ... | openssl enc -aes128 -d -K <key> -iv <initialization vector>, the operation fails with the 'digital envelope' failure after decrypting most of the string. If I add `-nopad', then it works completely, without error. The output difference is 11 bytes.

The original input is padded with binary 0s to a multiple of 16 bytes before encrypting, the encrypted string is converted to hex, then the hex iv is prepended and everything is base64 encoded.

Can anyone shed any light on why I need the -nopad option? I thought that with the -K and -iv options, openssl wouldn't process the salt at all for the decryption.

According to man enc:

  All the block ciphers normally use PKCS#5 padding also known as standard block padding

PKCS#5 padding (technically PKCS#7 here) is done by adding N bytes of value N to the plaintext so that it is evenly divisible by the block size. If you don't specify -nopad, enc will expect that, for example, a 30 byte plaintext would be encrypted to a 32 byte ciphertext, with the last 2 plaintext bytes each having the value 2.

PKCS#5 padding requires that there always be at least one padding byte, so in the worst case you'll have an entire block of padding, but the upside is that when decrypting the last byte can always be checked to see how much padding needs to be stripped. This prevents any ambiguity between padding and data.

In your case, you've padded the plaintext with bytes of value 0, which causes the decryption error. This is called zero padding or null padding, and isn't generally used as it's not possible to distinguish between padding and data if the data can contain null bytes. When using -nopad, enc will require the input to be evenly divisible by the block size when encrypting, and when decrypting it won't attempt to strip any padding, leaving you to deal with it yourself (which is why you're getting those 11 extra bytes).

As @dave_thompson_085 noted, the salt is only used by enc to derive the key and IV when using a password. When specifying the IV and key directly, there is no salt.


What is a viable time-frame for links that expire? Links that expire can be found anywhere from Email Verification to Password Reset procedures, I understand in most cases this is considered "security theater", but wanted to know what a viable time-frame is for a link to be valid?

Is 10-15 minutes acceptable? With all the unknown factors of email delays etc?

Is a shorter duration considered more secure? Thanks.

IMHO 10-15m is too short for almost all cases.
It practically excludes almost all delayed deliveries e.g. due to

greylisting (quite widespread anti-spam technique)
temparary overloads or temporary network problems

RFC1123/5.3.1 recomends delivery retries no more often than 30 minutes.
Anyway very short timeout (2-5 minutes) may make some sense in higher security procedures.


BLE 5.0 security vs. 4.2 Is there any material improvement/difference in BLE security controls/requirements in BLE 5.0 spec as compared to BLE 4.2 spec?

I skimmed through the BLE bits in the huge Bluetooth 5.0 core spec but that didn't help.

I am aware that there are significant security control improvements/additions in BLE 4.2 vs its predecessors BLE 4.0/4.1.

You'll find that most of these attacks still work in both BLE 4.2 and BLE 5.0 -- https://security.stackexchange.com/a/100444/140

As the last link in the comments alludes to, some BLE 5.0 is implemented in both firmware and hardware while others don't have the firmware capability to push a formerly-4.x device to 5.0.

It also notes that Bluetooth is commonly-imperfectly implemented.


How does anti-phishing software work to identify phishing sites? To clarify, my question isn't on how to protect myself from phishing. What I'm curious about is how exactly software can identify whether or not a website is designed for phishing, ignoring word identifiers/scanners to looking for spam/phishing sounding material.

Often times phish detection on email and web sites is detected via keywords.  It's looking for text that is attempting to convince a user to input credentials, submit personal information, or even uploading documents.  The anti-phish technology can also detect strong persistent language and use of hyperboles that is consistent with pressuring a user into submitting the requested information.

  Examples: "enter your account information now", "your account has been
  disabled", "you have reached your email quota", "reply to my email
  immediately", etc.

Also, some very sophisticated anti-phish software can detect common typosquatter domains.

  Examples of typosquatter domains could be: wellfargo[dot]com or
  gooogle[dot]com


What is the technique to determine if a user is "reading" a page called? (similar to "infinite scroll") When I read an article at Salon.com I notice that the "overflow content" (where I need to scroll down) is loaded on demand.  I can't imagine this being a useful bandwidth savings technique, so the only reason it might exist is to collect information about the end user.

Is this feature more focused on analyzing user behavior than saving bandwidth?
What is this technique called?
What do providers do with this information?

Is this feature more focused on analyzing user behavior than saving bandwidth

I think the original goal of it was to increase responsiveness by reducing the amount of time until the browser is fully able to render the page.

  What is this technique called?

Effective leveraging of AJAX

  What do providers do with this information?

It probably provides a more accurate view of dwell time and reader behavior as one of those side-effects that became a driving force.


Has cryptography reached the development level where social engineering is the only reliable method of attack? Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not.

Simply put: Do cryptographic methods exist that are so strong and easy to use that attackers - be they individuals or organizations - make no attempts to crack them, and instead immediately focus on comprising the human link as the only possible attack vector?

More colloquially, is there any encryption scheme out there that can be readily used (not super slow to generate) and upon detection will make the NSA throw up its hands and say "well, screw it"?

Strong: yes; easy to use: no.

A cryptographic algorithm provides a precise functionality, and for most functionalities we do know algorithms which, when implemented properly, are strong enough (which means: nobody has a clue about how to break them with non-sci-fi hardware). However:

It turns out to be quite hard to implement any given cryptographic algorithm "properly".
Assembly of cryptographic algorithms into protocols is still hard. You do not automatically get a secure transport protocol by slapping together AES, HMAC/SHA-256 and RSA; you still need to take care of an awful lot of tricky details. SSL/TLS, as of version 1.2, is believed "reasonably strong", but it took more than 12 years of breaks and fixes.
Even when the algorithm is utterly strong, it still has a limited scope. For instance, if you use 2048-bit RSA signatures, nobody knows how to break that; but the signature only binds that which is signed to "the private key corresponding to a given public key"; whereas the system's security would require a binding to "a specific human user". Cryptography does not do the whole job, only a part of it.

Since a given system ultimately contains a human being at some point, it necessarily is somewhat weak. When a three-letter-agency wants to break a code, it costs at most about one million dollars: either to fund some hardware effort which exploits a weakness in the implementation or usage of the cryptographic algorithms, or to bribe the operator. Whichever is cheaper.


PRF, IKE and hash function The term PRF is mentioned in the documentation of the IKE (Internet Key Exchange) protocol.

What is a PRF?
What is the difference between a PRF and a hash function?
What PRFs are used in the IKE protocol?

PRF stands for PseudoRandom Function.  A PRF will map input to output in a deterministic fashion (same input always maps to same output for same PRF) that appears indistinguishable from randomness to an attacker who doesn't know the internals of the PRF (and hasn't seen the PRF already process that exact same input, even if they've seen the PRF process many similar inputs).

Generally PRFs are taken at random from a PRF Family.  You can think of PRF Family as being a function taking an additional input (a random seed, also sometimes referred to as a random key) which selects a particular PRF (that maps input to output).  So if you have a 128-bit seed in your PRF family then there are 2^128 (340,282,366,920,938,463,463,374,607,431,768,211,456) possible PRFs that you could be using from that family.  This is contrast to hash functions, where there are only dozens of commonly used hash functions (MD5, SHA-1, SHA-256, SHA-512, etc).

Let's say you knew that "Hello" mapped to 8b1a9953c4611296a827abf8c47804d7 (in hex).  An attacker can quickly figure out that I'm using MD5 and could then generate outputs for any input they wanted.

However, HMAC - hash-based MAC is a family of PRFs.  So if you take the HMAC construction: H(K1 ++ H(K2 ++ m)), where ++ means concatenation, H is an ordinary hash function, and K1 and K2 are two keys which are defined to be derived from the same key using K1 = K XOR 0x5c5c...5c and K2 = K XOR 0x3636...36.  Now if I told you that my PRF (a HMAC using a particular key K) maps "Hello" to 53a7e60d93a6853780d622f3b5bd641f there would be no way for an attacker (who doesn't know K, but may know I'm using HMAC-MD5) to generate the output for an input they've never seen before.

The actual PRFs used in the IKE protocol are negotiated between the client and server.  The ones specified in the RFC for IKEv2 are HMAC_MD5, HMAC_SHA1, HMAC_TIGER (three HMACs generated from different hash functions), and AES128_XCBC.  In the original IKE RFC, the PRFs to use were not defined: "There are currently no pseudo-random functions defined.".

Note the difference between a PRF and a PRF family will often not be explicitly made.  In the literature you will often two inputs (a key, a plaintext) and generate one input.

In cryptography two related concepts come up - the PRP (PseudoRandom Permutation) and the PRG (PseudoRandom Generator).

A pseudorandom permutation (PRP) is a PRF that is one-to-one - that is a specific type of PRF where each output of the PRF (using the same key) can only be generated from exactly one input.  This allows one to invert the function and undo the effect of the application of its application -- thus you can apply the PRP (requiring knowledge of a secret key) to plaintext to create a ciphertext, and then apply the inverse of the PRP to the ciphertext (using the secret key) to decrypt it.  For example, a block cipher like AES-128 is a PRP -- it takes a block of input that is 128-bits as well as 128-bit key, and maps the plaintext block to a unique 128-bit ciphertext block.  Then these operations can be reversed to map the ciphertext block to the original plaintext block (using the inverse of AES-128 with that secret key).

A pseudorandom generator (PRG) is a function that emits a stream of bits that appears random based on some initial seed (e.g., a random key).  This bit-stream can be XORed with a long plaintext message to encrypt it (so the ciphertext appears random), and then you can decrypt it by XORing the PRG's bit-stream with the ciphertext.  One way to generate a PRG is to take a block cipher like AES-128, and use it in CTR mode.  That is you encrypt successive blocks incremented by one with the same key, and then concatenate the output together, e.g., PRG(K) = AES(K, 0) ++ AES(K, 1) ++ AES(K, 2) ++ AES(K, 3) ++ ... (where ++ means concatenation).


Security concerns of RADIUS based server/workstation auth So I'm using WPA2-EAP for a few years now with FreeRadius server. And it's pretty okay, I mean I don't really consider wifi access to be so super-duper critical break in success because it's pretty restricted anyways on other levels so I accepted any potential risk (which is still significantly lower than PSK). But I always wondered... How about server or workstation authentication? How secure RADIUS client <> server connection really is and how easy it is to deploy rogue RADIUS server authenticating everyone to everything?

Let's focus on 2 scenarios that come to my mind first:

Evil dude connecting between server and radius server:

[server] -> [switch] -> [evil dude] -> [switch] -> [RADIUS server]

User workstation outside of company network with disabled VPN:

[workstation] -> [dodgy hotspot] -> [evil dude]

Questions are following: Is in 1st case possible to inject rogue RADIUS allowing access to server with credentials like root:abc123?

Is 2nd case equivalent to workstation having no user credentials and unrestricted admin access? What is necessary to deploy rogue RADIUS and can it be mitigated by hardening auth between RADIUS server and client?

I don't consider accessing data available on RADIUS server real issue because if someone has access to it then it's game over anyways. But I'm a bit concerned about security of using secret for RADIUS client <> server connection and I'm not sure if it's valid concern from exploitation point of view. Always certificates made me more confident in this field than PSK.

If it helps you feel better, 99% of our encrypted communication uses symmetric cryptography (Like PSKs). We only use asymmetric cryptography (Certificates) to transfer symmetric keys and sign hashes.

Situation 1 is completely possible under three conditions:

The "evil dude" has presence on the network between the two switches (In most cases, to pull this off, he would actually have to be between them, and using a MITM
He would already have to have compromised the PSK(Not a simple feat, and if he was capable of pulling that off, he could probably have done worse while he was at it.)
Your RADIUS server authenticates with an insecure protocol.

If your RADIUS server authenticates with certificate based encryption, then even if they pull off 1 and 2, they'd also need the private key from the authentication server to pull off the MITM.

So, technically possible, but if your keys are compromised, you have bigger problems anyway.

Situation 2 is one of the reasons we have VPNs in the first place. Consider an Always-on VPN to mitigate the risk from leaving the VPN off, and NEVER EVER EVER click through to a web page that flags your browser's security feature.

Unsafe means UNSAFE.


Intercepting HTTP requests from a Java Application I was wondering if anyone knew of a way of capturing and modifying the requests sent out by a Java application over HTTP. I can see them in Wireshark, but I also want to be able to modify them in transit (modify destination/POST data).

Many thanks.

You could do that with a Http Proxy.

In this related question you will find a list of proposed http proxies How can I intercept and modify HTTP requests?


Someone is bothering me by messaging through websites message services Someone is sending me sms from last few weeks through 'SMS sending websites' who don't publish the sender name in the message. Sometimes it shows ' sent through websms' in the message. Please help if their is any way to know who is that person? And if it is not possible to know, is their anyway to stop these unwanted sms?

Unfortunately there is no way to tell who it was sent from, at least without police involvement (such as a warrant to the SMS website). Even if you got this far, the most that the website would give the police is an IP address, and it would be even more difficult for them to tie this to a specific person. So realistically, unless these messages are threatening someone, there is no way to tell who these SMS messages were sent from.

As for blocking these SMS messages, you will likely need to approach it in 2 ways. If you get messages repeatedly from the same number, you can block messages from that number with either your phone or service provider. If the phone number changes each time but you know what service they're coming from, sometimes the service allows you to enter your phone number into a "do not contact" list. Otherwise, there's not much you can do to block these messages. You could change phone numbers or maybe set your phone to block text messages from numbers that are not in your contact list.


Online backup of secret keys in crypted zip I want to have an online backup of my private keys and other sensitive information.

Which realistic attack vectors do I expose myself to by:

making a zip containing the keys
symmetrically crypting the zipfile (ccrypt in my case)
sftping it to my server?

Your keys will be exposed if an attacker

is able to get hold of the encrypted key information and
is able to actually read the keys.

The scope of (1) is not different from any other information on the server. To read the keys (2) several things might happen (also be aware that the private keys are already encrypted by GnuPG if protected with a passphrase, so an attacker will have to get around both ccrypt and the OpenPGP private key encryption):

keys not encrypted properly due to user mistake
passphrase exposed due to user mistake
passphrase can be brute-forced
issue with the encryption algorithm
issue with the implementation in ccrypt

Only you can decide whether these risk seem acceptable. Personally, I would not upload key backups, also not in encrypted form but store them safely and disconnected (they don't change often, anyway).


Cost of PCI DSS Compliance (SAQ A) I'm having a hard time figuring out / finding answers to determining the cost of becoming PCI DSS compliant for SAQ A.

The system will use PayPal Express Checkout. This means that it should be eligible for SAQ A (i.e., cardholder data and transaction processing happens on PayPal server).

Completing SAQ A is mostly a paper exercise and no vulnerability assessment is required from an ASV.

It's a self-assessment questionnaire so I can fill it out myself, right? Additionally, for SAQ A our payment brands and payment acquirers do require us to submit the completed SAQ as proof of PCI DSS validation.

Does this mean I complete the document and store it away until it's needed again?

I can't see where any cost of incurred. Am I being naive - can anyone shed any light, please?

The system will use PayPal Express Checkout. This means that it should
  be eligible for SAQ A

I don't believe* PayPal Express Checkout is an iframe implementation, so it would not be eligible for SAQ A, but rather SAQ A-EP, which has a more significant number of questions.

*I'm open to be corrected on this point.  But the merchant is the one who needs to be crystal clear on it as per DSS §12.8.5, which is part of SAQ A.

  It's a self-assessment questionnaire so I can fill it out myself, right?

Correct.

  Does this mean I complete the document and store it away until it's needed again?

You will need to update it and re-attest it annually, so you have - and may need to submit to your processor - a new document every year.  And the signature on it comes from "Merchant Executive Officer," so unless you're the Big Boss, you're filling out something the Big Boss has to put their name to.

Granted that most of the answers are likely to stay the same, you are still expected to research them.  Some of them deal with annual practices you're expected to do, such as monitoring your service providers' PCI DSS compliance.  You should expect to review the document each year and verify it is still true, rather than simply dusting it off and altering the dates.

  I can't see where any cost of incurred. Am I being naive - can anyone
  shed any light, please?

The work involved to do it right is more extensive then the tone of
your question suggests you appreciate**.
The crux of the SAQ is responsibility; the signer is responsible for representing the truth of the questionnaire, and in the event of a breach the penalties are likely to be worse if the SAQ is found to be slipshod or misleading.

**tone is difficult (reading and writing) in text, and no slight is intended.


Implement GPG Verification (Bitcoin-OTC) I'm looking to implement a "Verify with Bitcoin-OTC" feature for my web app. The general idea is the user would prove he owns a particular account on the external site Bitcoin-OTC and my app would accept/deny him based on his rating there.

Here's how I'm thinking of implementing this:

User provides Bitcoin-OTC username.
My app looks up his GPG fingerprint using this bitcoin-otc gem.
My app presents the user with his encrypted one-time password and asks him to decrypt it.
User provides decrypted password.
My app verifies it with the gpg everify command on Freenode and accepts/denies the user.

The part I'm struggling with is step #5. I'm doing it this way because I'm not sure Bitcoin-OTC exposes an API. I'm not sure how to programmatically communicate with the bot on their IRC channel.

Steps 1-5 are basically how a user would verify himself on the Bitcoin-OTC IRC channel except my app is acting as a middleman.

My questions are:

How can I achieve step #5?
Does adding my app into this flow introduce any security risks?

Edit:

I've been doing some research and I've realized I can probably just get the user to sign a message stating he owns the Bitcoin-OTC account in question.

If the message is signed with the fingerprint tied to the Bitcoin-OTC account and the signature is trusted, then can I be sure the user is who he says he is?

Here is my proposed flow in an ad-hoc Ruby script:

require 'bitcoin/otc'

account = Bitcoin::OTC::Account['mhluska']

message = Time.now.to_i.to_s + " I am the owner of username #{account.nick} on Bitcoin-OTC"

puts 'Run the following command to sign a message using your GPG fingerprint #{account.fingerprint}:'
puts "$ echo \"#{message}\" | gpg --clearsign"
puts "Paste it back here and press Ctrl+D"

$/ = "\0"
message = STDIN.gets

response = %x[echo "#{message}" | gpg --verify 2>&1]

if response.include?('Good signature')
  if response.include?('This key is not certified')
    puts 'Good signature but untrusted'
  else
    puts 'Good signature and trusted'
  end
else
  puts 'Bad signature'
end

Rather than going through the whole #bitcoin-otc login procedure on behalf of your users (which, in the case of an existing session, may either be denied or attempt to replace the current session), you could have a bot present in #bitcoin-otc and then either require the ident-verified users to message it with a randomly generated token, or have them request a token from the bot to use on the website. You could decouple the bot from your main backend as well by providing the user with an encoded message that includes the verified response from ident signed by your bot — you would not need to implement any communication between the bot and your main app components since it would just endorse responses from ident. I believe that users would feel more secure with some of these approaches, as there may be some concern about a remote agent performing this auth within a largely security-aware community.

Most languages have established IRC libs, so it should be pretty straightforward once you get familiar with one for your language of choice.

EDIT

If you just want to verify ownership of a GPG-verified account, then just roll your own GPG verification. If you prefer Ruby, you can use https://github.com/ueno/ruby-gpgme to encrypt a signed/timestamped token for the user's public key. You wouldn't have to keep state, just verify that the token provided has a valid signature applied by your server. There may already be an open implementation like this today.


How is this OpenPGP key displaying in a non hexedecimal format? Looking at a GnuPG manual on openskills, I notice that the main key id GEBV933F is in a different format than the usual hexadecimal (G is no hexadecimal digit).

How is this done?

tl;dr: these are made up key IDs of somebody trying to hide the actual information. They're not valid OpenPGP key IDs.

OpenPGP Key IDs

Following RFC 4880, OpenPGP, 3.3 Key IDs, a

  Key ID is an eight-octet scalar that identifies a key.

12.2 Key IDs and Fingerprints further specifies the calculation, but again no representation of those lower 64 bits to be used. Often, 32 bit values ("short key IDs") are used in practice. An example describes pretty well how the key IDs are related:

fingerprint: 0D69 E11F 12BD BA07 7B37  26AB 4E1F 799A A4FF 2279 (160 bits)
long id:                                    4E1F 799A A4FF 2279  (64 bits)
short id:                                             A4FF 2279  (32 bits)

XAF476E9 and GEBV933F form weird key IDs. They can't be hexadecimal, which wouldn't allow X and G. They're probably using a digit range matching pretty much including all decimal digits plus letters up to X, which means eight digit numbers would allow to store about ld(36^8) ~= 41 bits -- not enough for a more compact representation of (long) key IDs.

Digging Deeper

Well, you don't really need to dig deep. Let's assume the documentation was written by somebody using real keys, who at the same time tries to hide his identity and either has a bad understanding of key IDs, or wants to reveal manipulation of the key IDs to the skilled eye.

The quoted manual also provides examples of encoded signatures. Let's have a look at those! A string This is some text. gets signed, probably using the author's key. And we also get the quoted result, which the author stored as test.txt.asc:

  The signed version will look something like this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is some text.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: 'Email me for my public key'

iD8DBQE+ycRnF1uP4b67kz8RArZdAJ9e98RkcYICyJktEpah5/RoQX93vgCfUuOh
1I3aTPTGXitruRjhms3Kx7Y=
=ju77
-----END PGP SIGNATURE-----

The output showing the weird key IDs actually verifies a signature of exactly this file:

[you@tiger]$ gpg --verify test.txt.asc
gpg: Signature made Tue 20 May 2003 04:00:07 PM EST using DSA key ID GEBV933F
gpg: Good signature from "fbloggs@openskills.com"

Now, what happens if we run this on our own?

gpg: Signature made Tue May 20 08:00:07 2003 CEST
gpg:                using DSA key BEBB933F
gpg: Good signature from "[uid removed]"
gpg:                 aka "[uid removed]"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3318 D8EC 1EAD 3771 3B54  2893 175B 8FE1 BEBB 933F

I removed the user ID as the user might have tried to stay anonymous. I didn't care about his key ID/fingerprint, as he indeed posted it anyway and everybody can query the information if he wants.

Surprised about a close-match of the key IDs?

   real key ID: BEBB933F
claimed key ID: GEBV933F

Obviously, the two non-hexadecimal digits have been scrambled. Now, what about XAF476E9?

$ gpg --list-keys BEBB933F
pub   1024D/BEBB933F 2003-04-09
uid                            [uid removed]
uid                            [uid removed]
sub   1024g/CAC476E9 2003-04-09

A new subkey! Again comparing the keys:

   real key ID: CAC476E9
claimed key ID: XAF476E9

Again, two digits differ.


Mobile Phone "Activation" Every mobile smartphone I have owned has required a first stage of "activation". This process requires an internet connection; alluding to a process aside of a CDMA or GSM connection, or cellular network registration. Both the iPhone and the Google-biased Android devices require this internet-based communication process. An android phone having activation software removed will authenticate and function normally within a mobile network, for example.

What is the purpose of requiring "authentication" of a mobile device? What are the security and privacy implications of distributing a device requiring such a process; with no explanation as to why the process is required?

Modern mobile OSes rely on services provided by the OS's developer like notifications, maps/location services, app stores, iMessage (for iOS), etc.

Activation registers your device with those services - in the background the device gets a token or client certificate it then reuses when talking to those services.


VM production server and low entropy I'm monitoring a VM functioning as our production server.
I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail).

On average our server(which among other stuff does SSL, session-key generation etc) runs with about 100-200 bits of available entropy.

Is this anything to be concerned with?

That sounds normal for a vm.  You don't typically worry unless available entropy drops below that 100-200 average.  The key measure is the sequences that come out of that entropy.
You should use the ent program to test your random sequences.  You worry when you start seeing tests fail here.
This site has a good process for testing randomness.

We can collect random data from /dev/random using "dd". This command will collect 8,192 blocks from /dev/random and output the results to the text file we will call "random_output". NOTE: if your /dev/random generator is too slow this command will take forever to finish. The random_output file should be around 1 to 4 megabytes in size depending on how large a chuck is on your system. For now, if the dd command does not finish in 3 seconds or so hit Ctrl-c to kill dd.

dd if=/dev/random of=random_output count=8192
Then, after you've built your ent program:
./ent random_output
Analyzing the results is a little beyond the scope of your question, but what I linked can fill in the ancillary details.


Safe to consider webapp user's email as implicitly confirmed after a password reset? In my system, a new user must confirm his email.

But there is an edge case:

he registers
does not confirm
forgets password, performs password reset (which involves a mail loop)

At that point I know his email works - so I'm inclined to reset his password, and then simply mark his email as "confirmed".

Are there any risks I've not considered?

No added risks if you use the same communication protocol to/from user's email, your database, or any other part in these two cases, I.e at the point of registering and at the "forgot password" steps.


Where to disclose heuristic bypass There's one software, let's call it an anti-malware, that uses a heuristic to detect some types of attack. However there's a very simple to stay under its radar. Where may I report that kind of "exploit"? It does not require patching anything at runtime or any interaction with that software, so I don't see it really as a vulnerability, just something they've overlooked.
Where would I report that? Does that qualify for CVE?

You have not described a vulnerability or an exploit. You've described a weakness in the operation. Every single anti-malware detection process will have weaknesses. These do not qualify for CVEs.


Can I generate multiple PGP key pairs for later use I was just wondering if I can generate couple of PGP key pairs and save them for later use or backup. In addition can I be sure that other wont generate and use some of my key pairs in the meantime. I mean is there any guarantee that anyone anywhere in the world haven`t generated the same keys?

Realistically, the chances of generating the same key pair are non-existent unless there is an issue with the pseudo-random number generator.  The keyspace of most keys is so large that you could randomly make 1000 keys a second on every computer in the world and not get a collision for millions or billions of years or (much, much) more.  For larger key sizes, you could probably generate a million a second on every computer in the world and still not get a collision on any of them by the heat death of the universe (assuming the PRNG is good at producing random numbers anyway).

If there is a flaw in the PRNG, then yes, the same seed could get used and the same key would be created, but that would be a significant problem in the particular version of the software you are using then, not a problem with the system itself.

As for making multiple keys and saving them, there is no reason you couldn't do this, but there are several reasons you shouldn't.  The only reason you should need to change key pairs is if your private key becomes compromised or may have become compromised.  It is often a best practice to periodically change your key pair just in case your private key has been compromised, however if you have generated your key pairs in advance, it doesn't stop those private keys from aging.  The key pair you haven't used yet is just as likely to have been compromised as the key pair you are currently using, so replacing one with the other makes no sense.  You gain no precautionary security.

Instead, if you want to do precautionary replacement of your key pair, you should use a freshly generated key pair where you know that the private key is secure because it was not previously available.


Can you tell me if my design is secure? I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows.

I'm running three separate servers with three separate roles. Server 1, the web interface (Which I will refer to as El Jefe), takes requests from users and processes them, and returns the appropriate information as needed.

Server 2, the cryptographic interface (Which I will refer to as the Bagman) receives information via SSL from El Jefe and encrypts it (Using the Halite interface from Paragon Initiative Enterprises), then passes it on to server 3.

Server 3, the database (Which I will refer to as the Stash) stores the encrypted information it receives from the Bagman. It does not have the encryption keys from the Bagman or anything else like that.

Right now, the data at rest is secure. If the Stash somehow gets broken into, none of the files mean anything and none of the entries in the database mean anything because they're all encrypted, and none of the keys are stored on that server.

However, if the Bagman gets broken into, then all information that gets passed through him can be stolen.

Additionally, if El Jefe gets compromised, he can issue instructions to the Bagman to retrieve, decrypt, and return anything located in the Stash.

To mitigate against this I had the following plan: To minimize any damage from a breach of either El Jefe or of the Bagman I was going to salt the encryption key with a SHA2 hash of the user's password, so even if someone breaks into the Bagman, the keys are worthless without the additional hash of the user's password. However I feel like this falls into the realm of "Rolling your own crypto", which based off my readings for the past 2 weeks is a No-Go. Additionally, I would run into the issue of if a user forgets their password then there is no way to recover their files. Or if they decide to change their password I would have to decrypt, then re-encrypt all of their files.

I apologize for the corny names of the servers, by the way. It helps me remember their roles and visualize what they're doing in my mind. If you can point me in the direction of any resources or additional readings or whitepapers on designing a secure system like this, it would be much appreciated.

SQLCipher is an option.

You need to use threat modelling to really secure your service as there are many ways apart from classic hacking, such as outlined in OWASP Top 10. Particularly SQL injection or CSRF that could also compromise the PII.

Encryption prevents someone from stealing the DBMS either logically or physically, it doesn't stop holes in your programming/implementation allowing someone to steal the data.


Does "/phpmyadmin/setup/index.php" present a security risk? I found that in several websites, [HOSTNAME]/phpmyadmin/setup/index.php is accessible by default without authentication. However, it seems impossible to modify anything or to do security damage. Also, the website database is not accessible via this panel.

Is there any security risk with that? If not, what is the purpose of such thing?

Well this is a huge security risk. Even though it is impossible to modify data if nobody can view your database structure though this security panel they can use zero day security flaws in phpmyadmin to get your information.

Generally speaking you should manage your database through an endpoint that is not accessible to every visitor of your website.

You should move this to a secure location. Some other subdomain that is protected by some filter or something like that.


How to build a secure affiliate network I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book store.

Affiliate Network Manager provides an API that enables a publisher's web site (an affiliate site) to get the logo of the book store's web site, so it can display the book store logo on the publisher's web site.

Let's assume the following scenario: There is a publisher web site A, with Unique ID 123. An end user visits the web site, clicks on the logo, is redirected to the online book store and buys a book.
The system gets the unique ID from the request and knows that this request comes from publisher A. Then, it remembers that the client visited the book store from publisher A. So, publisher A receives a commission based on the amount of the transaction.

This works, but there is a security issue: Assume we have another publisher B, with Unique ID 456. Then an attacker from publisher B can capture a request from publisher A and change the unique ID to 456. So, publisher B will receive the commission of publisher A.

How can I solve this security issue and make sure that the attacker can not change the unique ID when the request is transmitted? Or in other words: How can I do authentication in this case?

What you basically need to do is:

Verify that a request is coming from an authenticated user, i.e. a user (or service) that's allowed to use your API; and
Ensure a request isn't altered while in transit, commonly known as a Man-in-the-middle attack.

You could install X.509 certificates on each publisher's web site and use this to authenticate them over a HTTPS connection. This doesn't seem to be commonly done, however.

I recommend doing some research on the OAuth 2.0 standard. It solves both problems, and software libraries exist for most web application frameworks.


In the Netherlands, is there danger in my name and bank account number being public? I know of the question Bank account number and account holder in check exposed? , but the answers to it are quite US-specific (checks and such) and I live in the Netherlands.

Dutch banks are introducing Contactless payment on a wide scale; all customers of my bank (ABN Amro) will receive new cards with this ability in 2015. An opt-out is not possible, but on request a radiowave-blocking card holder is available.

The accompanying leaflet explains that it is possible for people with the right equipment to read out the account number from the card from close range, but that
that is not in itself dangerous.

According to the linked Wikipedia page, in the US "the major network guidelines do not allow a contactless card to contain the cardholder's actual name, instead a placeholder name is used". In my case I don't know if my name can be found electronically, but it is clearly printed on the card and the attacker is standing at close range...

My gut feeling is that a bank account number should be more or less like an address and therefore doesn't need to be terribly secret, but are there any real risks involved if my name and account number do become known to criminals?

In Europe the common way to send money is by giving the International Bank Account Number and the Bank Identifier Code, so no problems there.

If your name is available, they might find your address if it's publicly available, e.g. on  social networks, blogs... The only risk here, is if they find the email related to your account you can get spear-phishing emails, most of them will end up as spam. And as long as you don't click on anything weird nothing will happen.

As long as they don't have your credentials, the login and password and PIN code, and the two-factor authentication Code (single-use code for online transactions if you're using online services) you are safe.


Secure communication protocol for equality test I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ.

Easy solution is to encrypt both numbers and compare these encrypted messages. In this case, it is still, in theory, possible to compute/to guess the other secret number (even if is very improbable).

Is there any protocol that is 'totally safe' - meaning that an entity cannot guess the other secret number regardless of its computation power?

There is no need to encrypt anything in this use case. Hashing with a non invertible algorithm is enough. In order to avoid to give a constant hash, you could imagine a challenge protocol:

each part builds (separately) a random string and sends it to the other
each part concatenates the received random string with its own secret, computes a strong hash (sha512 is generally considered as strong enough)
each part concatenates the produced random string with it own secret and computes the hash
each part sends to the other the hash produced with the other's random string

If the secrets were identical, the hashes should compare equal. If they are not, no part can guess the secret from its peer because only non invertible hashes of one time messages have been exchanged. Even if a man in the middle could intercept the messages, he could neither guess the secret, nor pretend to know it later because of the random part


Scam link in "from"-links on my blog traffic I have a blog on blogspot (google), which is mostly visited by my friends and occasional wanderers on the internet. In the statistics I can see "reference-url"'s which are supposedly sites that link to my blog because people come from there before visiting the blog.

In these reference-url's, there's a lot of redirect-links. They look like a twitterpage or a whatever-page (many different sites) and always end in redirect.php?to=some-scam-site or some variation thereof. Always the same scamsite.

I don't visit the links and no-one else can see them (except perhaps some employees of google). My blog is also not a high traffic one, with less than 10 visitors per day. This makes me wonder what the point is.

Does anyone know where these redirect-links are coming from and if on purpose, what these persons are hoping to accomplish?

This is known as Referer spam, here is short description from Wikipedia:

  Referrer spam (also known as referral spam, log spam or referrer bombing) is a kind of spamdexing (spamming aimed at search engines). The technique involves making repeated web site requests using a fake referrer URL to the site the spammer wishes to advertise. Sites that publish their access logs, including referer statistics, will then inadvertently link back to the spammer's site. These links will be indexed by search engines as they crawl the access logs, improving the spammer's search engine ranking. Except for polluting their statistics, the technique does not harm the affected sites.

It is possible to prevent them via .htaccess, WP plugins or by setting a filter in your Google Analytics. The .htaccess file will look something like this:

 RewriteEngine on
 RewriteCond %{HTTP_REFERER} traffic2money.com [NC,OR]

For making a filter in Google Analytics, check this article. And if someone is interesting in blacklist, read this.


What Certification(s) to look for in Hard Drive destruction? Many vendors exist to pick up old (enterprise) Hardware for recycling and offer services including sanitization and destruction (shredding).

The concern is that media could potentially still contain sensitive information (through data remanence or simply human error forgetting to sanitize the media before disposal).

Is there any certifications (e.g. ISO) that a vendor should possess to be entrusted with old storage media (especially hard drives and SSDs)?

You could look for a company that uses DoD 5220-22.M standards for data destruction : http://www.dss.mil/documents/odaa/nispom2006-5220.pdf

I use a company that says they meet that standard.


How to automate Nikto output? When I run Nikto, its output details all the tests it ran, but I just want the bits where it found problems. How can I set it to only show errors?

JohnFF

Go on their website: https://cirt.net/nikto2-docs/options.html, and you will easily find how to specify output.

Inspiration for this kind of answer was a quote:

  If you give a man a fish he is hungry again in an hour. If you teach
  him to catch a fish you do him a good turn.


Reccomended way to securely erase SSD storage of a smartphone? As far as what I understand there are different approaches and I have a few doubts regarding each of them:

On the one hand, it seems that factory reset does not securely erase itself data from SSD storage for certain operating systems and devices. However, in case data are first encrypted and then the factory reset is executed, the data will remain in the storage as encrypted, thus they cannot be recovered (as long as the encryption scheme remain secure).
My doubt is that this approach does take into consideration the fact that a portion of data may have been deleted before being encrypted, so they are not involved in the encryption once executed and they are recoverable. Is this a potential problem?

On the other hand, it seems that for SSD the traditional method of filling the whole storage with zeros or random data is not the reccomended approach because intense writing may reduce the life of the device and the reccomended approach is one exploting some magic related to the physics of the hardware that "erases" the electrons used to represent data at once. While the traditional method of filling the whole storage is not reccomended, is it still secure (as secure as the reccomended one)?


How can I make sure my master password is as strong as possible? How can I make sure my master password is as strong as possible?

The password manager I'm using is Bit Warden.

Is creating a passphrase a good idea?

I know it's good to include characters, numbers and words in it, and its stronger if it's longer.

What else? Any tips?
Thanks!

There are several ways to create a strong master password:

Diceware

Diceware is a simple concept. You take a big wordlist and roll a set number of dice. You then look up the word that corresponds to your dice roll. For example, 21131 can correspond to clock. Repeat this process until you have enough words, such as

flagstick mystic reenacting football pain sightseeing paris

How secure would that be?

A wordlist for 5 dice would be 7776 words (6^5) long. The strength of the diceware password in bits is log_2(w^n), where w is the length of your wordlist (7776) and n is the number of die. By using simple math, we can modify that term to be n * log_2(w). log_2(w) is a fixed number for our wordlist and is roughly 12.9 bits.

That means that for every word you add, you get about 12.9 bits security. This means 6 words give you almost 80 bits of security, and 10 words give you 128 bits of security.

Advantages

One clear advantage of diceware is that the process is purely random. That means any cracking attempt based on human behavior will not be more successful than a pure brute force attack.

Disadvantages

A disadvantage is that not every diceware password is easily memorable. Wordlists contain words that are not very common or even sound like "real" words to non-native speakers (e.g. "cleft", "accra", "gorse", "livre" or "twill"). This makes them potentially hard to remember

Passphrases

Passphrases are simply put very long sentences, that can't easily be guessed. An example for a passphrase would be

Blue Light shines from the small Bunny onto the Lake.

Old advice used to be to take the first letter of every word, but that's very bad. Take the whole sentence. Sure, you'll type for a while, but entering your password twice a day (once in the morning, once after lunch) is not that much of a problem.

Advantages

Sentences can be as memorable as required. The best possible passphrases are ones that can be visualized, but that don't make any semantic sense.

Disadvantages

It's easy to make a bad passphrase. Many people will pick quotes from movies, song lyrics or bible verses, thinking "Nobody would ever think of that". Guess what, I don't need you to tell me how fucking good my coffee is, okay? is not as good as a passphrase as you may imagine.

Passphrases are in general more difficult to get right, whereas diceware guarantees uniform security.


Why is Amazon's home page not encrypted? I've been working on my very first web application and I usually refer to Amazon.com as my role model.

I'm very interested in deploying my web application with SSL/TLS. However, there is one thing that I can't understand. Why isn't Amazon's home page address bar colored green? Shouldn't it be encrypted with SSL/TLS to secure the site?

Would it be enough to secure only the payment pages?

Amazon apparently believes that the overhead of TLS is high enough to justify not encrypting traffic when not performing sensitive actions (like placing orders, payment processing, account management, order history, login, etc.). While the server-side cost of TLS is nearly insignificant with today's hardware, it does still have a non-zero cost. Client-side impact can be much worse, especially over high-latency or unreliable links like some mobile connections; TLS can cause significant delays in page loading, which can lead to customers going elsewhere.

I'm personally of the opinion that it's better to use TLS for all traffic until and unless you have a reason not to do so - and there aren't many of those, not that I'd call valid - but I'm a security guy first and foremost. Amazon exists to make money, not to be a role model of secure web development. If all-TLS-all-the-time costs them more than using HTTP sometimes does, then they'll go with the second option even though it exposes their customers to certain types of attacks.

An example of such a risk: although the login form is served over HTTPS, the button that takes you there is served over HTTP. An attacker could use an SSL Stripping attack to modify the home page so that the login button linked to HTTP instead of HTTPS, and the attacker could then spoof the login page when the user tried to log in. The attacker would then get to see the user's credentials. Amazon could prevent this by using the Strict-Transport-Security header, but then they would have to serve the whole site over HTTPS all the time.

As a security role model, Amazon does some stuff very well. For example, their SigV4 scheme provides AWS with authentication, integrity, and a limit on replay attacks. It's good enough that, assuming there's no inherently sensitive data (a credit card number is inherently sensitive; an identifier string that maps to a credit card number is not) in the request or response, it can actually be safe to not use TLS on some AWS functions (though in general they mandate TLS for most of AWS anyhow). Their retail site, however, makes some tradeoffs that sacrifice a little security for the sake of slightly more profit.

If you're looking to emulate Amazon's business success, then copying their security choices might be wise... but also bear in mind that the Amazon.com retail site is old, and has undergone a lot of changes over the years that add more and more security. Given how much it costs them to have any downtime on the site, they are probably very hesitant to mess with it more than they need to. If they were designing the site from scratch today, they might well use TLS for everything, with pre-loaded HSTS. Or maybe they wouldn't; after all, I'm sure they've considered doing that, and have reasons for not (yet) implementing it.

One final note: the site certainly works over HTTPS-all-the-time. My browser actually defaulted to using HTTPS for the retail site, even though I hadn't previously used it on this computer and certainly hadn't logged in or anything. Please don't be one of those sites (looking at you, Slashdot) that redirect users from HTTPS back to HTTP even if the user specifically prefers to use HTTPS.


Can a survey website viewed in Firefox trick the user into sending stored passwords? Firefox stores passwords (I am not referring to the Master Password feature) and I would like to know if a survey website can steal those passwords.

I was typing a URL and perhaps I mistyped it and ended up on a strange website that wanted the user to take a survey for a prize.  It showed a dialog (floating on top of the regular Firefox currently active tab) in the middle of the screen saying something to the effect that as an "FB user I am invited to take a social networking survey".  I am not an FB user so this was obviously a malicious website.  The dialog wording was confusing so that a user intent on declining the offer would click on buttons that seemed to invoke another dialog that had a button to lead back to the first dialog.  It wasn't possible to just exit the dialog on the first try.  Once the dialog is exited, the browser tab itself was not exitable.  I answered about 3 questions before I was able to close the browser tab.  (I think the questions were: your gender? how many social networking sites do you use?  your age?).

The survey was in the form of perhaps one command button to start the survey and then "auto-enter" radio buttons for the 3 questions.  The survey was presented in the normal part of a Firefox browser, not a dialog floating on top.  Both the regular Firefox tab and the dialog appeared to use a fairly standard looking motif for Ubuntu/Firefox (I don't know where appearance settings are grabbed from: OS, app, or combination) but I am not completely sure since Ubuntu with the Gnome desktop to my eye does not look as distinctive and harder/hardish to fake as, say Windows 7.  In other words, I think the dialog appeared to be implemented in a standard way, but obviously it was not fully standard in that you could not exit it.  The browser tab I am less certain about because graphics can be made to deceive.

Concurrent with this browser tab, I was signed on to gmail and stackoverflow.

I am on Firefox 3.6.20 and Ubuntu 10.10.

So the way that saved passwords work is that the password you store is associated with a specific domain where you've manually entered the password, and then chosen to save it for future use.

So, if I choose to save a password for https://login.example.com, and that's the only password I've ever saved, it's not going to auto-populate on any domain or protocol other than https://login.example.com. Not for http://login.example.com (unsecured) or https://www.example.com, and certainly not for some random malicious domain that is attempting to emulate the UI of the genuine login in an attempt to trick you into entering your credentials.

There is the potential for attacks if malicious users can figure out how to inject form fields into pages that are served by a domain where you've chosen to save credentials, and I believe there was an in-the-wild exploit based on this approach on MySpace a few years ago, but I'm not aware of any currently know risk to saved passwords from malicious third-party domains.


What should I have prepared for a PCI compliance onsite assessment? The company I'm working for is about the undergo PCI compliance onsite assessment. The PCI DSS has a kind of checklist, but it is all very vague and abstract to me. So I'm not quite sure what I need to have prepared for the QSA, when he comes.

More specifically, I'd like to know what exactly the QSA asks for in terms of documents, software, configuration files, scripts etc. In the case of documents, how detailed should the information be? Just general guidelines or specific procedures for each item?

For example, is it acceptable to write only something like this on my policy document?

  Procedures must include periodic media inventories in order to validate the effectiveness of these controls.

Or should I provide details about what these procedures are, who will perform them, how long is the mentioned period, etc?

That depends on several things.  Unfortunately, the PDI DSS is a bit vague in some areas, and different auditors interpret things differently.  Expect your first audit to by 80% figuring out what you need to prepare, 20% actually getting it together, and then expect future audits to go more smoothly.  But your QSA will tell you what he/she expects.

In general, though, you should have written polices for how you protect your data (backups, live, etc) and be able to produce logs and evidence that shows that you follow procedures.

For example, to satisfy section 6, developers need to have a documented development process.  We do, and our process includes steps like code reviews (so we provide copies of completed code reviews) procedures for asking admins to publish a specific tagged item from source control to address separation of concerns (so we provide change request tickets that specify which version of source code gets published on what date/time).

The same goes with the rest of the audit.  Have your procedures documented, and provide proof that you follow those procedures.

As for how detailed the policies should be, you should build your paper trail into the policies, so that the auditor knows what to expect for documentation, and so that you force yourself to collect the documentation throughout the year.  It makes things a LOT easier.  Include things in your polices like "All changes are logged in (name a system)" and then actually log your changes in that system.

Odds are, your current practices won't 100% meet the requirements, or you won't be able to provide that documentation.  Generally that seems to be expected on a first audit (or so I gather from our auditors) and the first audit is sort of an eye-opener.  It teaches you where you need to improve your polices (and improve them right now).  You will likely have the opportunity to provide what you have, and start drafting new policies under the guidance of your auditor. In subsequent years, expect less leniency.


Mozilla Firefox: "Builtin Object Token" vs "Software Security Device" Navigating to about:preferences#advanced in a recent version of Firefox presents a View Certificates button. Clicking that button brings up the Certificate Manager window. The Authorities tab in that window displays details of the certificate authorities (aka CAs) whose public certificates have been installed in the particular Firefox instance (or perhaps just the particular Firefox profile) currently in use.

This tab contains a table with two columns: Certificate Name and Security Device.

For each such CA, at least one entity exists in the table. At a glance, all the entities appear to be certificates, but I will continue to refer to them simply as "entities" here, as I have not (yet) checked them all. Each entity has an entry in both the Certificate Name and Security Device columns.

There appear to be only two valid values for entries in the Security Device column:

Builtin Object Token
Software Security Device

What is the (intended) difference between these two kinds of entity?

In response to a similar question posed by David E. Ross in 2011, Brian Smith (Mozilla developer) and Kathleen Wilson (Mozilla CA Program Manager) confirmed that:

Builtin Object Tokens are root certificates in the default Network Security Services (NSS) database as installed on the user's PC when the user installed the software (e.g., Firefox) that uses them.
A BuiltIn Object Token will continue to be [a Builtin Object Token], even if
the user changes the trust bits.
A Software Security Device can hold all kinds of certificates, not just root certificates.
For the Authorities list in the Certificate Manager, the certs that
are  labeled "Software Security Device" are root and intermediate
certs that  have been imported (e.g. not in the default list). The
intermediate  certs are often automatically imported, such as when you
visit a website  with an SSL cert signed by an intermediate CA.


Received a Kindle from a stranger, what are the risks? While getting a coffee today, a man walked up to me and offered me a kindle. he said he no longer wanted it and that he was looking to give it away. An avid reader, I accepted. It has no accounts on it, for when I start it up it prompts me to make a new account. Obviously, I don't want anyone stealing my credit card/other information, so is there anyway to know if it has been compromised? As well, is there any way to purge the device's contents so that I can be completely sure?

It is possible that the previous owner was one of these ultra-rich people for whom money no longer has any meaning, and he honestly believed that giving the Kindle away to the nearest stranger would be the easiest and most environmental-friendly way of getting rid of it.

It is also possible that the Kindle was some highly incriminating piece of hardware that the owner was anxious to distance from his own person in the swiftest possible way. The Kindle might be stolen, or might have been involved in hacking attempts, or might contain data of questionable legality which could direct the device holder to the nearest jail (e.g. pedophile pornography, which is highly frowned upon in most countries). If that is the case, using the device, storing the device, or even resetting the device contents to factory defaults might be the source of legal trouble.

The safest course of action might be to go to the nearest police station, tell them the story of how you got the Kindle, and leave the object to them.


How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis? I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode.

Then, I search in the mounted drive for a file but in the search appear files inside directories of my system. In the mounted drive D: there are links to my C: drive, for example, in D:\Users\All Users appear my users too!

How can I disable temporarily these links in order to perform the forensic analysis of the NTFS filesystem?

Windows naturally tries to deference NTFS junction points, much like Linux automatically dereferences mount points and symlinks. You can't get around this directly in the Windows OS, as Windows needs junction points to operate correctly, except possibly when using an alternate shell in Safe Mode, although this would probably have some interesting side effects while logged in. The only way to "disable" a NTFS junction is to delete it entirely, not something you could do in read-only mode.

What you can do, however, is not use Windows directly. For example, boot your system in Linux, possibly using a cheap USB stick and a Linux-on-a-stick, and you can mount the image directly into Linux, and perform all the find operations you want without worrying about it wandering into your hard drive, since your drive won't be mounted, and Linux has no notion of drive letters anyways. Your mileage may vary here, as NTFS support, while quite excellent, is not quite as good as Windows' own NTFS support. Personally, I would just as soon whip out a copy of Ubuntu USB version, boot it, mount the image, and go exploring.

Another excellent alternative would be to simply mount the drive in a VM running Windows. You probably qualify for Windows XP Mode if you're using almost any modern version of Windows. Install, mount the drive, and examine to your heart's content. Since you're in a VM, any damage done to the drive will only harm the VM, and not your computer. You can reinstall it as many times as you need, and as long as you've backed up that hard drive image, you can "reformat" back to that image as often as you desire. At that point, you could recklessly experiment with deleting those junction points, assigning a new letter to your boot drive, etc.


Login from a desktop application to a web application I have a desktop application and a web application. The user is loged in on the desktop application. With a click on a button or something the browser should open and the user should be logged in.

Now I'm a little confused how to implement this in a safe way. My first thought would be to generate a nonce on the server, pass this to the application which in turn then generates a URL for the browser. (The whole communication is over HTTPS).
But since the nonce would be in the URL couldn't a MITM just grab it and then login as this user?
I guess the browser would show a certificate problem in case of an MITM attack but some of the users aren't very savvy so I assumed that they just would dismiss any certificate error.

This is a problem because some of this users are sort of an administrator (the create users) so it would be very bad if an attacker can login.

Is it possible to automatically login a user from a desktop application to a web application in a secure way?

I had this problematic a few weeks ago.
I simply resolved it by making a webservice accessible via Https.

The user login from a local client application via a login/password form which is sent by https.
The server get the data and send a Token to the client.

The Token is stored into the application for login purpose and expires after 2 weeks. When the Token expire my client has to login again.

My request are https based, so it takes care of the handshakes,encryption,etc.

A large amount of WebAPIs use this method to make secure transactions.

If you notice a large amount of login fail tentatives on server side, block any upcoming tentative from the client for a given amount of time, which will increase after futur failed attempts.


How can I prevent someone from carrying out a file from a machine Assume the following scenario:

You have to set up a machine in a way that a user is unable to bring out a certain set of files (or a single file only) from that machine while he has to be able to access the file on the machine itself.

The user has physical access to the machine when he is unobserved. He has no Admin privileges.

The machine runs Windows 7 and has built-in devices to read and write optical mediums as well as flash storage. It has USB ports, too, as well as a wireless network adapter.

There are however a lot of ways to gain that stuff if one truly wants to do it.
Here is what I have listed so far:

Uploading to a server. So i need to disallow any network access.
Copying to a medium or booting another OS from one. I would have to disable all devices.
Physically removing the hard disk. I would have to encrypt the device.
Copying the file to the RAM, then freezing and moving it. I can not think of a solution.

Are there other methods of gaining a copy of the desired file? How can I fully prevent all the possible methods?

Footnote:

If you wonder why the heck anyone would like to do this: Due to the trust issues of my boss.

Well, you're going to have to fix your boss's "trust issues."  I know of a defense contractor that removes optical drives and fills USB ports with a glue gun.  Classified information is on an isolated network with no outside access.  But, the real thing they do is address the "trust issues."  Their employees who work with classified data must have security clearances.  Even that isn't perfect, but it has apparently worked for them so far.

If I can see a file, and I'm sufficiently motivated, I can make a copy with a pencil or even commit parts of it to memory.  (Edit: I wrote this before seeing your comment on the value of a transcription.)

What you are looking for is something called "originator controlled access control," ORCON, and as far as I know it doesn't exist except in contrived proof-of-concept situations.

The best you can do is reduce the possibilities.  How far you reduce the possibilities, and how much you spend doing it, are business decisions.  The boss needs to assign a value to protecting the file: "How much would you pay an insurance company every year to cover the file against copying?"  That's your budget, and you can then tell the boss what you can do within that budget, which is far better than saying you can't do anything.  You can't absolutely protect the company vehicles from automobile accidents, either, but you can reduce the possibilities through careful maintenance, driving record checks on new hires, driver training, etc.  How much you can reduce the risk depends on how much you're willing to spend.

You, and maybe your boss, should read Ken Thompson's Turing award lecture, “Reflections on Trusting Trust”.