ClamAV Flagging application .swf files as malware ClamAV scans on our application servers are identifying some of our legitimate Flex .swf files as malicious, specifically citing CVE-2015-5548 (specifically, "Swf.Exploit.CVE_2015_5548 FOUND"). Relevant CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5548

Best I can tell, this is a vulnerability with Flash player itself, which we don't even have installed server-side. Any idea why Clam is reporting this?

In some cases, antivirus scanners can have false positives based on a similar appearance of some of the code in the files you are scanning.  You can rule out a false positive by scanning the files with another antivirus utility. For example, a trial version of ESET's NOD32.  Please try scanning with another AV solution and let us know the results.


How does CORS prevent XSS? I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place.

But if a person with malicious intent injects some JavaScript into a page to steal users' cookies and send them to a URL he controls, all he has to do is add the following header on the server side to make the request work anyway:

Access-Control-Allow-Origin: *

So how does CORS prevent XSS? Or did I misunderstand the purpose of CORS, and it simply has nothing to do with XSS per se?

TL;DR: How does CORS prevent XSS? It does not. It is not meant to do so.

CORS is intended to allow resource hosts (any service that makes its data available via HTTP) to restrict which websites may access that data.

Example: You are hosting a website that shows traffic data and you are using AJAX requests on your website. If SOP and CORS were not there, any other website could show your traffic data by simply AJAXing to your endpoints; anyone could easily "steal" your data and thus your users and your money.

In some cases that sharing of data (Cross Origin Resource Sharing) is intended, e.g. when displaying likes and stuff from the Facebook API on your webpage.
Simply removing SOP to accomplish that is a bad idea because of the reasons explained in the above paragraph. So CORS was introduced.

CORS is unrelated to XSS because any attacker who can place an evil piece of JavaScript into a website can also set up a server that sends correct CORS headers. CORS cannot prevent malicious JavaScript from sending session ids and permlogin cookies back to the attacker.


Is there any possibilities to bypass Chrome xss auditor in this case? I just expiremented with xss in my own server.
I wrote code like this:

<?php
    if (isset($_POST['data'])) {
        echo "Click Here
";
    }
?>

Here is a little vuln: as a post data we can send something like

   test' onerror=alert(1)

After sending we got line like this:

The question is:
Is there any ways to bypass Chrome xss filter in this case?

Here you could simply use the payload javascript:alert(1), as the auditor doesn't identify javascript URLs within a href attribute as XSS. Clicking the link would execute the code.

However, it will be much harder to execute JS by injecting an additional event handler attribute the way you tried, since your code sample directly reflects the input without additional processing. This is exactly one of the attack scenarios the XSS auditor is meant for. It attempts to identify reflected parts to prevent their execution. As @NickMckenna remarked, there is no general way to bypass the auditor in this scenario.

What you could do is inject other attributes that have side effects. For example, you can still use the style attribute and apply arbitrary CSS (e.g. ' style='background:red;). In combination with other technologies like AngularJS, injecting different attributes can still lead to XSS.

Be aware that the XSS auditor is fragile. Since it has no understanding of how the code is processed on the server side, a simple substitution in a more complex program could be enough to confuse it, e.g.:

<?php
    if (isset($_POST['data'])) {
        // Filter bad words
        $data = str_replace('BADWORD', '', $_POST['data']);
        echo "Click Here
";
    }
?>

In this case, a sequence like ' onBADWORDmouseover='alert(1) would bypass the auditor.

(Also note that the onerror attribute you tried to inject isn't valid for  tags.)


Investigating a downloaded certificate I used the below command to open a certificate of a website that I downloaded from Firefox. What part of the downloaded certificate indicates that it is a CA's certificate?
openssl x509 -in ca.crt -text -noout

What part of the downloaded certificate indicates that it is a CA's certificate?

A CA certificate can be used to issue other certificates by signing these. This signature is only accepted if the issuing certificate contains the extension CA:true:
        X509v3 Basic Constraints: critical
            CA:TRUE

If this extensions is not there or not TRUE it is either a very old type of certificate which does not support any extensions at all (X.509v1 not X.509v3) or it is a leaf certificates, i.e. the end of the trust chain which can not be used to issue new certificates.
Note that there are root CA and intermediate CA certificates. A root CA is usually self-signed, i.e. subject and issuer are the same. These root CA are placed as the pre-trusted ultimate trust anchor in the local trust store and used when building the trust chain to the leaf certificate. For more see SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?.


What type of data does Snort log? This is new to me, but what types of data does Snort log for Network Intrusion Detection?

I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. Is there anything else?

Snort supports several output formats for the Log Parser where CSV format is mostly used. To configure Snort to use the CSV output format add the following line in the snort.conf file:

output alert_csv: alert.csv default

There are by default 28 fields available for log analysis that include timestamp, sig_generator, sig_id, sig_rev, msg, proto etc. For understanding Snort Log Management i recommend to read "Managing Snort Alerts"


Is enabling PHP script execution on HTML document file extensions a security concern? I am working on a very old and messy site, which doesn't have a CMS, or a database. However, it has a lot of .htm and .php files. I need to add some PHP code to some of the .htm files, but want to leave the URL as is.

Long story short, is there any problem, or security concern, when enabling PHP script execution for .htm files globally, via Apache's .htaccess?

What could go wrong? Specifically, I am talking about this configuration change in my Apache web server:

AddType application/x-httpd-php .html .htm

Generally, configuring PHP to execute all files (as your title says) is a bad idea, especially if your website has an upload functionality. Someone could simply upload a PHP file with the extension .jpg then execute it on your server, and your server is gone.

However, in your case, if users can't upload .html or .htm files (or .php, of course) then there's almost no added security risk.


Why is the public key used on server side for an ssh connection? It is not clear to me why the SSH key authentication needs the public key saved on server.
Usually the steps involved are:

Generate a key pair on client
The public key is saved on server and the private key is used by client to perform authentication

I've never seen a solution like:

Generate a key pair on server
Public key saved on client

I think the last solution is possible but never used due to impossibility to guarantee access to a restricted number of user: the public key can be used by anyone during the authentication phase. Is this the case or other motivations are present?

There's multiple keys and encryption schemes used in SSH:

Server keys, to authenticate the server to the user. The server has the private key, and hands out the public key to anyone asking.
Client keys, to authenticate the client to the server. The client has the private key, the server the public.

Purpose of #1 is to authenticate the server to the user. The user can use the public key to verify that the server has knowledge of the private key. This ensures that there's no man in the middle-attack, as he would be unable to produce the same keys.

Purpose of #2 is to authenticate the user to the server. The server can use the public key to verify that the user has knowledge of the private key.

Authentication may be by the server using the public key of the client to encrypt a random number. If the client has the corresponding private key, it can decrypt the random number, and tell the server the value. This proves that the client has the corresponding private key, and thus authenticates the user - without revealing any information apart from that it has the private key.

The client can do the same with the server key; encrypt a random number, and transmit to the server and ask the server to decrypt it.

For encryption of data in transit, neither is used. A symmetric cipher, with ephemeral keys is used for encryption of data passing over the wire. The key for this is worked out using a key exchange protocol.

This is obviously a very brief overview, and it's simplified. More information can be found in this short and not-to-technical text about ssh authentication.


What are these two certificates I need to install - external CA root certificate I have to install 2 certificates on a computer and I am a little puzzled by the certificates.

The first certificate has these details:

Issuer:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

Subject:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

The Certification path is: AddTrust External CA Root

The 2nd certificate:
Issuer:

CN = AddTrust External CA Root
OU = AddTrust External TTP Network
O = AddTrust AB
C = SE

Subject:

CN = COMODO SSL CA
O = COMODO CA Limited
L = Salford
S = Greater Manchester
C = GB

The computer I need to install these certificates on could well be acting as a https server.  This is something I am unsure on at this stage.   But I am puzzled by the above certificates.

The first certificate has the same Issuer and Subject.  But I thought the Issuer should be the CA authority and the Subject should be the owner of the certificate which is being certified by the CA.  But they are the same?  Why?

The second certificate is a SSL certificate?  It has issuer Addtrust and Subject Comodo.  So here I am assuming AddTrust is the CA.  AddTrust is verifying that Comodo in Salford, GB should be trusted (and of course this certificate is valid).

But why do I need the first certificate?

What is the purpose of certificate 2?  I understand it is a SSL certificate.  But how could the computer I install it on potentially need this?

You do not have to install them. This is the certificate chain the webserver should provide for the clients so they are able to verify the certificate.

The CA's root certificate is in the browsers or OS' store of trusted certificates. CA's usually don't sign client's CSRs with the root certs, but with intermediate certificates, which are by themselves signed by the root cert. The browser receives the websites certificate and can also download the chain. The browser or any other client can then verify the chain by comparing the signatures until the program ends at the root certificate. The root certificate will then be compared to the certificate in the trust store.

The certificates should be put into a file together with the websites certificate. The webserver should then be configured to use this file as CA-file.


What is the difference between "web penetration testing" and "web application penetration testing"? I decided to start learning "web application penetration testing". But while I am learning I find there is another term "web penetration testing". Can someone tell me what's the difference between both of them?

For a customer I deal with, the distinction has been:

"web penetration testing" is testing the security of a web server as configured for production (for example, RHEL 7.4 with SELinux in enforcing mode running Apache HTTPD 2.4 fronting a Tomcat server with two servlets on the same machine where httpd is listening on port 443 for all traffic and Tomcat is listening on port 8443 for traffic only from localhost and iptables is blocking external access to  port 8443). This is looking for vulnerabilities in the overall configuration of the server.
"web application penetration testing" is testing the security of the design and configuration of the web application itself, absent other protections it may rely on. From the example above, this would mean penetration testing the Tomcat server and servlets after deliberately allowing traffic through iptables on port 8443 and disabling SELinux. This is looking for vulnerabilities in the application itself that might be completely, partly, or not mitigated depending on how the server it is running on is configured.


Capturing traffic on WiFi Network using Wireshark Is it possible to capture, using Wireshark, regular data sent by another machine inside my Wireless LAN?

Not really. Use airodump-ng for that. airodump-ng will provide PCAP-files that can be examined with Wireshark.

[edit] some explanation, because of downvote and comment:

Theoretically, you could put your Wlan card in monitoring mode

sudo ifconfig wlan1 down
sudo iwconfig wlan1 mode monitor

and use both tools to monitor the network. Ideally, you would use an interface that you reserve specifically for this purpose.

In practice though, we often see a factor more packets in the airodump output than in the wireshark output. This is not uncommon: others have reported this as well. Some have suggested that it might be a driver issue, but I have seen this on multiple Wlan devices (with different kernel modules).

So my advice is still: use airodump-ng for that.


Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys? Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat?

I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH parameter file in Tomcat, but its cipher list does use "DHE" ciphers. Yesterday there was a mention about a "SSLDHParametersFile" setting, but it was removed, possibly due to this bug, where it says Tomcat can only handle 1024 bit DH key lengths. But I'm not an expert on this, possibly mixing things up here.

At the moment, the WeakDH site says you should add this cipher list to the Connector in the server.xml file (for JSSE) to fix it:

  ciphers="ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-GCM-SHA384, DHE-RSA-AES128-GCM-SHA256, DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA, DHE-RSA-AES128-SHA256, DHE-RSA-AES128-SHA, DHE-DSS-AES128-SHA256, DHE-RSA-AES256-SHA256, DHE-DSS-AES256-SHA, DHE-RSA-AES256-SHA, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256, AES128-SHA, AES256-SHA, AES, CAMELLIA, DES-CBC3-SHA"

So I think I've interpreted your question correctly. If not, fire away in the comments.

Confusingly there are several factors in diffie hellman: are you doing it over elliptic curves or not, what size group have you got (let's assume "strong" and "not strong") and whether you generate ephemeral private/public keypairs or not.

The problem with logjam is this: if you have a plain old group variant of DHE, then if you can persuade the server to downgrade to the export (weak variety) level strength, then with some precomputations made before you can break the secret generated for a session in minutes.

This is conditional on being able to downgrade size variable to a smaller one - if you can do this over the plain old DHE variant, then you're in business.

This requires the cipher suite have DHE_..._EXPORT_... in it, such as TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA. Now that has a bunch of other problems like 40-bit DES and whatnot, but essentially, there could feasibly be some servers out there that support EXPORT variants of DHE with better symmetric ciphers. Or they could actually be negotiating 40-bit DES if persuaded.

The point is to perform a downgrade attack. The cipher suite list you've given doesn't allow for export ciphers.

You could turn off all non-EC variants of DH. However, this might limit client side support. Whether or not you can be so limiting is really up to you. But "DHE" in and of itself is fine, unless there's export in there somewhere. Make sure export ciphers are disabled, and follow Thomas' advice in the answer you linked.

Now on to SSLDHParametersFile - in DHE, the prime and generator of the group can actually be fixed ahead of time - the bit that is ephemeral is the private key chosen in that group. This way, by setting the parameters you can control what size group your server uses.

For example, the output of this might be:

openssl dhparam 2048 -text
<snip>
    PKCS#3 DH Parameters: (2048 bit)
    prime:
        00:bd:90:31:72:a5:bf:eb:96:b0:0e:1c:1e:3f:ff:
        cd:0a:e2:fc:14:72:50:19:f8:6d:e9:25:3c:3d:21:
        3b:3c:e3:93:9b:2e:a1:b5:98:dc:25:88:9c:9e:55:
        1a:78:36:a8:10:67:f2:f1:37:e7:6b:c7:b8:39:85:
        a7:ec:aa:e9:2f:4e:10:17:fd:72:e1:22:2e:ab:97:
        4b:bf:7b:a2:68:6d:94:a8:ae:df:e0:fb:66:ad:79:
        02:9c:09:ba:47:60:40:12:a8:27:46:ba:8f:a9:8b:
        bd:f5:d2:4e:67:0c:7a:49:f3:9d:80:98:50:4d:8c:
        72:38:47:91:4b:54:1f:3b:74:b5:81:30:c7:89:71:
        b0:87:8a:82:66:b0:06:f6:2e:a6:2b:e8:18:51:23:
        2d:09:d9:0a:87:03:7b:85:8a:27:c6:bd:fa:e9:16:
        70:b3:bf:ad:77:d5:55:72:22:e7:7c:6b:4e:31:2c:
        86:91:7a:51:11:ac:23:9d:5f:3d:f1:f2:83:02:98:
        72:a2:a4:c5:a8:26:40:25:02:59:00:80:22:37:ac:
        38:95:07:76:f5:31:3d:19:f6:81:36:6c:14:fa:d8:
        46:10:e1:b4:fa:5f:e2:9d:2f:a1:78:47:5d:9c:f9:
        ac:0c:06:83:dc:f4:2d:81:17:d4:34:1b:6f:c2:c7:
        2c:0b
    generator: 2 (0x2)

Tellingly, from your example bug, it sounds like it is not possible to use these parameter files quite yet with Tomcat. I'm not an expert on Tomcat, so, I can't really say but if you have instructed the cipher suites to not allow export, OpenSSL should default to a 1024-bit DH group, which is good enough for now.

You can, then, when the patch is available, upgrade your DH parameters as you see fit.


Tunnel ssh over http with custom headers I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel.

Does corkscrew support it? If yes, how can I enable it?

Answering my own question:

Since corkscrew doesn't support HTTP custom headers, i found out another tool which does it.

It's called ProxyTunnel and has a lot of support for custom data inside the HTTP payload.


Facebook ads affected by colleague's browsing on different computer I support IT systems for office with 2 workers.  Both workers use Macbooks on LAN.  The only other things on LAN are router and printer.  The only shared login the workers have is a Dropbox account.  Worker A does not have a Facebook account.  Worker B has a Facebook account.  Things Worker A searches for on internet (eg office supplies) promptly appear in Worker B's Facebook ads.  I can't figure out how Worker B's Facebook knows what Worker A is searching for.  Any ideas?

They are using same public ip address I guess. Is quite strange because usually, Google/Facebook shouldn't track your ip for many reasons:

Because Ip addresses cannot reliably identify an individual user, advertising services track visitors through small files on their browsers called cookies.
When you visit a website that is advertising with Google AdSense, it tells your Web browser to create a cookie with data to identify you as a unique visitor

Anyway, Google's advertising services is a "mistery" how it works and Google change its mechanisms constantly, like for SEO. Is like the "Coca Cola's secret". I've been in courses about SEO and they teach to you a lot of techniques to improve it and they work, but nobody knows 100%. There is always a small uncertainty factor.

So, usually the Ip addresses are don't used to track visitors, but if you are pretty sure this is happening, maybe Google changed something. Maybe they do use a visitor's current IP address to help select ads.

EDIT Yes, I can confirm it. I found this link on Google Documentation. Look at the paragraph which say:

  Even if you opt out of Ads Personalization, you may still see ads based on factors such as your general location derived from your IP address, your browser type, and your search terms

EDIT2 Thanks @TTT for your comment. You are right. Anyway, Facebook ads works in similar way like Google ads.


Shared Database and PCI Compliance Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a database for its configuration information.

Please note that the database only contains configuration information. No card holder or personal details are stored here. However, we also have a management portal that is accessed by clients. The clients can log in to the management portal, and change their configuration that is saved to the shared database.

So we have:

Application --> Shared DB <-- Management Portal <-- Client access

Is it possible for the Shared DB and the Management Portal to be out of scope if on a separate network, making the CDE the Application only?

From the PCI v3 standard:

  At a high level, adequate network segmentation isolates systems that store, process, or transmit cardholder data from those that do not.

Does the above appear to adhere to this recommendation?

The communication link between the application and the DB is the issue. If the application is what you consider your CDE then the database will be in scope because it is connected to the application. Depending on your access controls and other security controls for segmentation you might be able to remove the management portal from scope (assuming it sits on a different network segment from that application. This also depends on your QSA and what they will accept.

There are 3 things to consider when evaluating segmentation for PCI:

Whether or not a system stores, processes, or transmits Cardholder data
Whether or not a system has access to a system that stores, processes or transmits cardholder data
Whether or not a system can impact the security of the CDE

A systems can only be excluded from the scope of a PCI assessment by confirming that the 3  criteria above are false.


Is SSL still secure if SSL Settings in IIS is set to ignore or accept only? Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?

I have setup my https and I can access it in my browser even it is set to require ssl and clientCredentialType = Certificate but I am having a problem in my mobile as I take a web reference with require ssl settings. I don't know what to do since it says http status 403: forbidden.
So is it still secure if I only set the ssl settings to accept or ignore and my web config's clientCredentialType is set to none

<transport clientCredentialType="None"></transport>

because this is the only way (for now) that I can access my web service

Client certificates are not needed to keep the SSL/TLS connection secure. They are only used to authenticate the client. If your web application does not need to verify that it talks to the correct client or if it authenticates the client through other ways (like username and password) you don't need client certificates. And, since a client certificate needs to be distributed to and installed by the client first they are rarely used since they are considered too complex to handle in most situations.


Would introducing client certificates for a mobile app improve security? I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile application.

I have rolled my own token authentication protocol (see this question/answers) which is used for client authentication. The main reason behind this was to be able to generate secure/re-usable tokens which the client could store locally & re-use on subsequent requests. As I have control over these tokens server side I have the ability to expire/invalidate forcing the client to re-authenticate (i.e. generate a new token) and I am also taking precautions to avoid the likes of MitM/Replay attacks. For this to work there has to be some sensitive information passed across the wire in plain-text, however, everything is running over SSL so AFAIK there isn't anything to worry about here(?).

There are a couple of parts to this current setup that do concern me though:

For server authentication, when the app receives the server certificate (self-signed) I am only checking whether the certificate subject (e.g. CN=domainname) is the same as the API address i.e. if the API entry point is api.mydomain.com then it must receive a certificate with a subject CN=api.mydomain.com otherwise the SSL session will fail.
There is no protection from the servers point of view from anonymous requests. Client authentication only happens at the point where the header/post information is inspected. I believe this could leave the door open to Dos attacks. Ideally I would like the server to only accept requests which come from a known source.

My concern with the first issue is it's far too easy to circumvent, the api address is configurable from the app settings & anyone can generate a self-signed certificate so it would be fairly trivial to trick the app into thinking it's talking to the correct server. The second issue is more just a general concern, however, if I could filter out any non-authenticated client requests it would be a bonus!

The only thing that springs to mind to solve (at least the 2nd problem) is to introduce client certificates. My concern with this is implementation time, complexity of deployment and management of the certificates themselves. I guess what I am looking for is some advice on whether (based on the current setup) introducing client certificates to the device would gain me anything here?

Authentication is about make sure that whoever is on the other side of the connection is who you believe him to be. Since this is cryptography and computers and networks, "who you are" equates to "what you can compute" (that's all you can observe from a remote server), which itself comes from "what you know" (everybody can buy a PC, so the ability to compute anything is really the knowledge of the inputs for the computations). For instance, for password-based authentication, a user is authenticated relatively to his knowledge of the password.

Such knowledge is linked to an initial registration where the secret value, whatever it is, gains its special meaning. Still for the password example, this is the procedure by which the user chooses his password, and the server records it (or a hash thereof) in its entrails.

Certificates are useful in contexts where registration and authentication are done by distinct entities: the registration is done by a Certification Authority, who issues (signs) the client certificate, while verification is done by the server itself, who validates the certificate (verifies the signature from the CA) and then verifies a fresh signature computed by the client (that's how client certificates are used in SSL).

If you have only one server, who both decides who may connect, and then authenticates these clients, then client certificates are useless to you: they won't bring any additional functionality or security with regards to a simpler show-the-password protocol (as long as the "password" is a key with enough entropy, and the protocol is played within SSL).


The request was aborted: Could not create SSL/TLS secure channel Exception Let me explain my situation.

I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.

I then created two certificates using the self-signed certificate:

A certificate with subject name "localhost"
A certificate with subject name "test.com"

I then installed both certificates into the Personal certificates section in MMC.

I then deployed a web service as HTTPS (SSL with accept client certificates) in IIS.  The certificate used to deploy the web service is the one with subject name "localhost".

Now, I have a client who wants to connect to the web service.  I successfully added a web reference to the service.  This is the code:

            ClientServices web_service = new ClientServices();
            X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
            store.Open(OpenFlags.ReadOnly);
            X509Certificate2Collection col = store.Certificates.Find(X509FindType.FindBySubjectName, "test.com", true);

            if (col.Count == 1)
            {
                ServicePointManager.Expect100Continue = true;
                ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls;
                web_service.ClientCertificates.Add(col[0]);

                try
                {
                    string hello = web_service.HelloWorld();
                    int add = web_service.add(4, 31);
                    int sub = web_service.subtract(30, 10);

                    Console.WriteLine(hello);
                    Console.WriteLine(add);
                    Console.WriteLine(sub);
                }
                catch (WebException e)
                {
                    Console.WriteLine(e.Message.ToString());
                }
            }

            else
            {
                Console.WriteLine("The certificate was not found!");
            }
            Console.ReadKey();

As you can see, I am sending the "test.com" certificate along with the web service request.  Unfortunately, I am getting this exception:

The request was aborted: Could not create SSL/TLS secure channel

How can I solve this problem?  I have already wasted 3 hours on this issue.  Please help me.

X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);

You're using the LocalMachine store.  Either put your certificates are 'Machine Certificates' in mmc, (elevated MMC -> certificate snap-in -> Computer Account), or use the CurrentUser store.

Also this might be a better question for StackExchange since it's C#/Programming related.


Do any browsers support Server Name Indication (SNI) but NOT SHA-2? Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).

Chrome on XP SP2?
(Disclaimer: Conjecture follows.)
XP SP2 lacks the SHA2 capabilities that XP SP3 added.

IE8 can't SNI. -> so it's out of the candidate list.
IE9 can SNI. IE9 uses the OS-cert-mangement. But IE9 doesn't run on XP.
Firefox does it's own cert-management. And it has supported SHA-2 for a long time.. And it has also supported SNI for a long time.
Chrome uses the OS-level-cert-management. So it can only accept certs that the OS says are good. And if you run Win XP SP2 (no SP3), as many Chinese supposedly do, then this might mean you're out of luck. (Note: Google's support for Chrome on XP ends 2016-04.)

(Disclaimer: I haven't actually tested this.)


What is the most secure way to save user authentication: Cookies or Session Variable? I'm developing a web application that is basically for all our employees.
Right now we have 3500 employees and all of them will access this web application.

All of them will use really confidential information.
Right now I'm thinking how they all will authenticate.

But what is the best way to save login: with Session variable or with cookies?

Or maybe both?

Right now I'm working with ASP.NET and the session variables are saved in a base64 string (maybe this is a little bit more secure but I don't know).

Based on the way your question is structured, it seems like you might be confused about what authentication cookies and session variables are and what they should be used for.  It also seems like you are planning on rolling your own authentication/authorization functionality.

One thing that ASP.NET offers is that it will handle many of the details of authentication/authorization for you.  When used properly this is very secure.

I would recommend giving this article a read to get a better understand of how authentication/authorization worKs and what your options are with ASP.NET.

I would recommend reading up on how ASP.NET Session State (including Session variables) work by reading this article.

Best of luck!


How Can Phone w/ No Internet Service Get Downloads? (Hacked??) I have an LG phone with T-Mobile pre-paid calling services.

The pre-paid plans range in value from like $40 ...$100, etc., but the one I have does not have internet service included/enabled.

Yet, I occasionally see the phone say it has downloaded an update. How is that possible with no internet service on my plan?

Did I get hacked and someone is faking this?

Thanks!

Even if you don't have a plan which includes mobile data your phone has still the physical ability to get these data, both via mobile data or by Wifi.
Since updates to the phones operating system are usually pushed directly by your telecom provider you don't need a plan with mobile data to receive such updates. And even if you have switched off mobile data completely you are probably still be able to use Wifi.


Would designing a crawling bot to detect and inform vulnerable website owners be legal?[Heartbleed] Would designing a crawling bot to detect and inform vulnerable website owners be legal?

Assuming that you had the website owners express permission to test for the vulnerability - probably, depending on your location (UK/US/EU laws appropriate).

Having a crawler that scans for the vulnerability is (in my opinion) almost certainly breaking some law in whatever country. Not only this though, imagine it from the business/website owner's perspective - what's your real intention?

As a side note - You've got to be careful going down this route as, even though you're trying to do the right thing (presumably) and make a small amount of money (again, assuming) this can be interpreted in two different ways:

I know how to fix this issue, I'll let the client know and they can pay me a tiny fee for doing so (or free because I care about security).
I know how to fix this issue, I'll let the client know and force them to pay me a ransom or else I'll tell everyone about their flaw.

Almost everyone reading your email/letter or listening to your phone call is going to think they're being scammed. Further to this, if you inform a client that the vulnerability exists and that you've scanned their server/site and found it there - you've just sent them an email saying the following (in the eyes of the UK law, others might be different):

"Hi, I scanned your website without permission and discovered a flaw. I can bypass security/access confidential data. Please secure this."

What happens if within 3 minutes of sending that email, the server is compromised using the method your just described? Even if they know it's not you, they'll be ticked off that they've just lost data and assume it was you. Even if there's a lack of evidence it's still hassle you'd rather be without.

I'd suggest creating a website where people can test their own sites and servers by typing a hostname/IP Address into a box and agreeing to some t's and c's that make you non-liable.


How do I calculate md2 hash with OpenSSL? $ echo -n email | openssl dgst -md2
unknown option '-md2'
options are
-c              to output the digest with separating colons
-r              to output the digest in coreutils format
-d              to output debug info
-hex            output as hex dump
-binary         output in binary form
-hmac arg       set the HMAC key to arg
-non-fips-allow allow use of non FIPS digest
-sign   file    sign digest using private key in file
-verify file    verify a signature using public key in file
-prverify file  verify a signature using private key in file
-keyform arg    key file format (PEM or ENGINE)
-out filename   output to filename rather than stdout
-signature file signature to verify
-sigopt nm:v    signature parameter
-hmac key       create hashed MAC with key
-mac algorithm  create MAC (not neccessarily HMAC)
-macopt nm:v    MAC algorithm parameters or key
-engine e       use engine e, possibly a hardware device.
-md4            to use the md4 message digest algorithm
-md5            to use the md5 message digest algorithm
-mdc2           to use the mdc2 message digest algorithm
-ripemd160      to use the ripemd160 message digest algorithm
-sha            to use the sha message digest algorithm
-sha1           to use the sha1 message digest algorithm
-sha224         to use the sha224 message digest algorithm
-sha256         to use the sha256 message digest algorithm
-sha384         to use the sha384 message digest algorithm
-sha512         to use the sha512 message digest algorithm
-whirlpool      to use the whirlpool message digest algorithm

$ openssl -h
openssl:Error: '-h' is an invalid command.

Standard commands
asn1parse         ca                ciphers           cms
crl               crl2pkcs7         dgst              dh
dhparam           dsa               dsaparam          ec
ecparam           enc               engine            errstr
gendh             gendsa            genpkey           genrsa
nseq              ocsp              passwd            pkcs12
pkcs7             pkcs8             pkey              pkeyparam
pkeyutl           prime             rand              req
rsa               rsautl            s_client          s_server
s_time            sess_id           smime             speed
spkac             srp               ts                verify
version           x509

Message Digest commands (see the `dgst' command for more details)
md2               md4               md5               mdc2
rmd160            sha               sha1

$ man openssl | grep md2
       md2       MD2 Digest

So how do I calculate the md2 hash of something using OpenSSL? It says it supports md2, but it doesn't.

By default, OpenSSL is built without MD2 support. People have been complaining since 2010 that the option is still listed in the docs.

What you can do is build OpenSSL yourself with enable-md2. However, this doesn't bring back the openssl dgst -md2 option just yet.

For that you also need to add the following line in crypto/evp/c_alld.c:

void OpenSSL_add_all_digests(void)
{
    ...
    EVP_add_digest(EVP_md2());
    ...
}

(If you want it as a first-level option, you should also add the same line in ssl/ssl_algs.c.)

Then just build it.
 What I did:

$ ./Configure linux-x86_64 enable-md2
...
$ make depend
...
$ make
...
$ echo -n foo | apps/openssl md2
(stdin)= d11f8ce29210b4b50c5e67533b699d02
$ echo -n foo | apps/openssl dgst -md2
(stdin)= d11f8ce29210b4b50c5e67533b699d02

(You can download the tarball from here.)


Does IPv6 without NAT allow my ISP to identify/monitor/limit the number of devices in my network? Does switching to IPv6 without any NAT mean my that ISP can identify/monitor/limit the number of devices in my private network more than they can with NAT (which is a necessity in an a private IPv4-based configuration)?

Thanks!

If you are not using NAT, then they will be assigning an IPV6 address to each device and will be able to identify them.  You could still use NAT however and they would be unable to detect how many devices are behind the gateway device since only the one gateway device would make all requests.

A NAT conceals the information about your internal network because all Internet connections originate from the one IP and are mapped to your internal network.  There is no reason the same thing can't be done with a single IPV6 address and device.  IPV6 just makes it so that layer isn't necessary if people don't need/want it.


Email account password change via email-to-script I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password).

Does my scenario has security vulnerabilities?

usage:

from their email address, user send an email with the subject "password" and containing in the body the new password in clear to a special address that run a script.
This script read the new password in the mail content and change the user's password.

context:

Only the addresses of the domains managed by the mail server can send an email to this special address
SMTP and IMAP connection using TLS only
Mail are delivered locally to the domain and do not pass through an intermediate SMTP
After the change password, the script delete the sent email in the mail sent folder of the user account

EDIT:

the SMTP server accept only authenticated user
my script check the value of sasl_username provided by postfix

EDIT 2:

I hear that this is a bad practice. This technique was experimental purpose and test, but I wanted to check if there was no security hole (omitting the user side).

For the production I certainly will use a password change request with a temporary token to an https web form that passes variables in my script.

Is your script checking sasl_username in the headers or elsewhere?... if it's from the headers you may have issues with tampering:
https://serverfault.com/a/404885/146906

Overall this sounds to be frank, very fragile at best.  You're relying on a great many potential entrypoints remaining closed for this to continue working - were any of them to change - say someone messing up a mail config and allowing external mail in, the whole thing fails.

I have a very hard time believing passwords have any place being in an email, ever... they have properties which mean they should almost always not mix.  Even if a specific case is probably safe, it will be negatively educating users that the behaviour is sometimes ok, when it's usually extremely dangerous, even more so when it's being used like this to reset passwords.

Please do not do this.


Is it safe to store user-uploaded ID scans in S3 (with server encryption)? Currently my web app stores user-uploaded ID scans in S3. I am concerned about an eventual data leak.

The S3 bucket is encrypted with server-side encryption (AES-256) but I figure the next obvious risk is an attacker gaining access to the AWS account itself. I have secured the root account with 2FA but there are several user accounts which have full access to S3 still (such as a Travis CI account).

The solution I am thinking of is periodically moving the ID scans to a different source with client-side encryption (where only I know the private key). That way if a leak happens, there will be only a small amount of data leaked.

Is this a common practice or are there better solutions in this situation?

The common way to store these more sensitive documents is to encrypt them with KMS.

Unlike the AES-256 encryption (which AWS themselves claim to be slightly legacy), KMS encryption requires a separate permission to decrypt and encrypt the files.

Create a Customer Managed Customer-Master-Key(CMK) in KMS, and upload the files encrypting them with CMK in question (using the kms:Encrypt permission).

Then whatever needs to decrypt the files (e.g. a Lambda function etc), needs to have the kms:Decrypt permission on the CMK in question.

Travis can have access to the bucket, but can never access the content of the files, as it should never be granted the kms:Decrypt on the key.

CMKs cost a tiny amount of money, but generally worth-it if you're getting folks to upload IDs into your app.


Memory Mapped Files and AV Do you know if AVs scans non-persistent memory mapped file content in a Windows Environment ? (Or have the answers for some of the AV on the market) I would prefer, if possible, some real world testing or white paper, more than commercial speech from the AV developer.

ALso, do you know where I can find recent documentation about the in depth behaviour of MMF ? The one I have and the most complete is from 93', and since then I imagine some KB have updated some sec. holes in them.

Thanks in advance, I really can't find a lot of things ! :(

If not... will have to test myself :)

to question number 1, yes and no, there are virus scanners that utilize the OS-index for files to scan (almost all of them), and there are also scanners that can ascan your "flash" bios and RAM for infections (malwarebytes i.e.).

and then there are scanners that scan the complete disc, which takes far longer, and is not OS dependant (i forgot the name for this one, if you know it, yell it in the comments so i can add it!!).

most of those are run at boot, as in, as a boot-disc, take hirens Bootdisc for example, where i work, when we get a infected PC, and cant solve it in the OS itself, we use a bootdiscc with a virus/malware scanner that scans the whole DRIVE, and not just the INDEXED part (includes hidden volumes, but not encrypted ones, ofcourse).

and to the second question, no, i dont know where to find those docs, may the good god of google shine his eternal light on you


Interpreting CVE ratings: Buffer Overflow vs. Denial of Service vs. Remote Code Executing (RCE) If a CVE lists a buffer overflow vulnerability, but not a remote code execution, should I interpret that as:

This vulnerability has not been confirmed to expose RCE, or
This vulnerability has been confirmed to not expose RCE, or
Somebody (who?) thinks that it probably doesn't expose RCE.

Or something else? Is this information generally reliable?

Edit: Confirming an RCE vulnerability after the initial discovery can be very difficult and time-consuming. I imagine that researchers sometimes report segmentation faults without first confirming the full extent of the exposure, which led me to this question.

You should interpret it as such, an untrusted input is able to write to section in memory that it isn't supposed to write because application fails to check its size.

I think you are in the mindset of always categorising RCE as extension of buffer overflow when they could be different issues altogether. Take for instance RCE due to remote file inclusion, or flaws in web applications that utilise eval in scripting languages or take untrusted input to run an OS command. These are RCEs but not necessarily BOF.

I guess what I'm saying is, a buffer overflow can be treated as its own category that describes what a vulnerability is and how it happens. It could potentially be extended to RCE or DoS, but overflow is quite perfect to understand it.

When you see an overflow vulnerability, you can always check associated publicly released exploit code and read more about it to see if there's DoS or RCE. Most (if not all) BOFs are at a minimum already DoS. Also, it is possible to read that an overflow leads to RCE, but you can't find any public exploit. This is common, especially in software that are proprietary. This doesn't mean that it's unconfirmed, its just that the researcher(s) never released to the public and may be part of proprietary security tools.


openssl EVP_aes_256_gcm - what's inside? I have been reading about encrypting and authentication. Traveled the path from home made authentication to encrypt-then-mac approach and finally settled on GCM mode.

I am curious what resided inside  aes_256_gcm.
What is obvious from the name: AES algo and 256bit key length.
IV len I could figure out from EVP_CIPHER_iv_length() call = 12 (I can change that with ctrl)
Block size I could figure out from EVP_CIPHER_block_size() = 1

But what about "operation mode", CBC, OFB, CFB, other ?
In what mode does the GCM runs ? Can I select the mode ?

The Wikipedia page has some explanations and a nice schematic; and the GCM standard is reasonably clear. To make things simple, the actual encryption is done in CTR mode, but the MAC part uses extra operations (multiplications in a finite field of characteristic 2, and one extra block encryption). If you encrypt 16n bytes, you will use n+1 AES block encryption invocations, n+2 multiplications in GF(2128), and some XOR. It is not required to understand how GCM works internally to use an implementation of GCM; but it helps.

In particular, the IV can have about any possible length, but IV values beyond 96 bits are not really interesting for security, which is why OpenSSL will restrict itself to 12 bytes. The "block size" advertised by OpenSSL is 1 because, thanks to the internal use of CTR, encrypted message size will not be "rounded" due to some padding (there is a fixed size overhead, though, for the MAC).


Does it make sense to use a third-party VPN when working from home? I understand the need to use a VPN when connecting to public wifi. I also understand the need for a VPN when connecting to the company's internal network. However, I am less certain about the benefits of using a third-party VPN (NortonVPN in this case) when working from my home network. My employer is under the impression it is not safe to work from home without using NortonVPN.

Are there valid technical reasons to require a third-party VPN when working remote?

However, I am less certain about the benefits of using a third-party
  VPN (NortonVPN in this case) when working from my home network. My
  employer is under the impression it is not safe to work from home
  without using NortonVPN.

  Are there valid technical reasons to require a third-party VPN when
  working remote?

If your employer requires\advises it's employees to use VPN in order to access to work environment, even if it's simply accessing an admin panel to a publicly published website, then they have a valid point.

All your data going to the endpoint, pass through network\application of your network provider, and anywhere in-between it can be intercepted. Even https traffic is not safe, since simply deploying a proxy which requires download and installation of it's SSL certificate is enough to decrypt and view all the data you are exchanging with the endpoint.

Using third-party VPN solutions however may not be the best solution. They can be susceptible to the data leak, and it might be too late to discover that. Besides, there are no guarantee that third-party VPN vendors are absolutely self-conscious about the data that passes through them. It would be best for employer to use there own, internally deployed VPN solution.

In short - Using VPN for work, even from home is a must. Using third-party VPN for these purposes cannot be sufficiently justified.


Is it possible to use bitcoin miners to decrypt files/communication? My understanding is that miners solve complex algorithms (sha256 i believe) and receive bitcoins. With the amount of hash power all these pools get from miners couldn't they use the resources to decrypt a bunch of encrypted information?

No.

Modern ASIC miners are highly specialized for the "mining" task of Bitcoin: generating partial preimages of SHA-256 hashes through brute-force searching (to be precise, a value that, when hashed, produces a hash with a given number of leading zeroes).

Breaking SHA-256-based security requires complete preimages (ie. a value that, when hashed, gives the exact hash value being sought), and the world's collective mining power is many orders of magnitude too low for this (the current hash rate is 1.33×1017 hashes per second, enough to generate a complete preimage about every 300,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 years)

It might be possible to re-purpose Bitcoin mining rigs to break SHA-256 password hashes, since the search space is smaller.  The collective processing power could crack any eight-character password in under a second; ten-character passwords could be broken in an hour or two.  However, SHA-256 is an uncommon hash for passwords: most people use crypt, bcrypt, or MD5.  The mining rigs are too specialized to attack those or any other encryption algorithms.


Spammers bypassing the reCaptcha I'm using recaptcha on a very simple forum registration page. The script first of all checks if the recaptcha code is valid, then it process. As soon i did put the website live, it got lots of spam registrations (~30). I was very surprised that how the spam bots could bypass the reCaptcha.

Anyway, to make it more secure, I did implement the stopforumspam.com API. So, first the forum checks the reCaptcha, and then it checks the stopforumspam.com to see if the email is spam or not. However I'm still getting the spam registrations (with the emails which already exist in the stopforumspam database).

I tried to test my registration system by registering with a spam email that already exists in the stopforumspam.com database, and my system did not let me register.

So, now my question is that, is this weakness in my programming code? Or the spammers do not use the registration page, they some how inject the code in the database? Is it possible to check that? Is there coding practice to prevent this problem?
Thanks.

I've noticed issues with ReCaptcha not being a good stop for spam registrations on some of my personal sites as well.  In many cases, I try to use some bit of information that would be unavailable to the spammer but would be available to community members.  Since most of the sites I've put up myself are gaming related, it's typically been some question about the game that is phrased in a way that a simple Google search couldn't find.  (For example, leaving out the name of the game and asking an otherwise generic question or even asking what game it is for.)

I realize that this might not work in all cases, but there also isn't really a good one size fits all solution for fighting spam registrations.


Log Attacks in Different Files using Snort How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ddos.rules in one file and logs generated from log.rules in another.

Is it possible, and if so how can I do it?

The Bad News

Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together.

The Good News

Fear not, we can make it work. What you'll have to do is create multiple config files and have each log separately. Depending on exactly how you want to split up the traffic there are a couple of ways you can go.

MultiConfig

Snort has a mechanism built-in to allow for processing different packet streams against different config files. This can be useful if you segment your applications based on network or VLAN. That is, all mail apps are on one VLAN, web servers on another, etc. The full details are provided in Section 2.10 of the manual, but the most relevant bits to understand are that it's dependent on VLAN or network, and there can be no duplicates. Meaning this is a valid configuration,

config binding: /etc/snort/snort.conf-ddos net 192.168.100.0/24
config binding: /etc/snort/snort.conf-log net 192.168.200.0/24

but this is not.

config binding: /etc/snort/snort.conf-ddos net 192.168.100.0/24
config binding: /etc/snort/snort.conf-log net 192.168.100.0/24

To use this feature in your situation you would have to run ddos.rules against one set of hosts and log.rules against another. I doubt you want to take this approach.

Multiple Instances

To date snort is single threaded so when processing is intense enough to utilize one complete processor it will begin dropping packets. Thanks to this you will often find snort sensors with several versions of snort running. Generally this works by using something called PF_RING, which is like a packet load balancer, or by chopping up your network space and running one version of snort per block. So one instance of snortd monitoring 192.168.1.0/25 and another watching 192.168.1.128/25. In most cases each process will use the same config file but just only watch certain addresses.

We can take that approach and turn it on it's head a bit to work in your situation. Let's create two config files and set the relevant portions thusly.

/etc/snort/snort.conf-ddos

output alert_syslog: LOG_LOCAL0 LOG_ALERT
include $RULE_PATH/ddos.rules

/etc/snort/snort.conf-log

output alert_syslog: LOG_LOCAL1 LOG_ALERT
include $RULE_PATH/log.rules

Then we set up your syslog engine, restarting it after making the change of course.

local0.alert       /var/log/snort/alert-ddos.log
local1.alert       /var/log/snort/alert-log.log

Now when you run snort you do it twice, each using the -c option. The first time we'll use -c /etc/snort/snort.conf-ddos and the second with -c /etc/snort/snort.conf-log.

Now you should have two instances of snortd running, one only with the ddos.rules signatures and logging to LOCAL0 and one with the log.rules signatures and logging to LOCAL1. As long as syslog is behaving you should have your alerts logging separately with no co-mingling.


Understanding AirCrack output in Backtrack 5 First let me clarify that I was trying to crack WPA2 in my home for educational purposes. I followed some tutorials and the message I received was:

  key found! [ilovegod]

I know that this is not my WiFi password. Below that I can see
the Master key and transient key and EAPOL HMAC but I don't know how to
translate them.

Is there any way to crack WPA2 using Backtrack 5 or some other way?

As @Awhitehatter said, brute force is the only way to crack WPA2. It is based on the initial handshake and after that the key can be computed offline. The time necessary to crack WPA2 depends on the complexity of the key and your computational power. There are tools which can help you in cracking a relative weak key (common word(s)) by using so called dictionary lists. If not, you can use John The Ripper to compute all the key combinations.

Just to have an idea about the time it takes to crack a normal WPA2 key (actually a password) using brute force (computing all the combinations), let's pick a decent password containing 8 characters, lower and upper case and digits, with a speed of 600 keys/second on a Quad core, we will crack it in... 36 months! Take into consideration that this is the worse case scenario (100% chances of success). You can calculate other timings based on other given password details using the Password Calculator.

Also to answer your question, a step by step tutorial on explaining how you can crack WPA2 using Backtrack is available here and not only...


Password Manager use and safety I just recently read an article advocating the use of password managers, and while I understand why someone might think using these programs might be a good idea, it's my understanding that these types of programs can be a weakness to cyber security. I know that password managers generally store your password to an encrypted file, either locally or on a server somewhere online, but those files storing your password can be a target for an attacker, so you've essentially given him one target to get all your passwords. Am I correct in my understanding in this, and is there a secure way to use programs like this?

I would call it a security trade-off rather than a security weakness.

Password managers help solve the problem of duplicate passwords (mine scolds me if I use the same password twice, so I fix it.) and of easy passwords (mine makes it easy to generate 20 characters of gibberish and "remember" it) so I don't have to write them down or use variations of my dog's name for each one.

The possible duplicate that @BadSkillz linked to above provides a good answer to your question that details the trade-offs.

  you've essentially given him one target to get all your passwords

If I was a pentester, I would identify as many password managers as possible for the organization I was targeting and then start guessing passwords, hoping that somebody used an easy one.

  is there a secure way to use programs like this?

Risk can be mitigated by two-factor authentication as offered by Yubikey or SMS messaging.  This makes it less convenient, of course.

I've found that in an effort to compete, these password managers are adding convenience "features" (such as credit checks, autofill, syncing with other devices) that introduce complexity and therefore insecurity.  These "features" need to be evaluated seperately for security.  In this case, risk can be mitigated by turning off the extra features.


How will Certificate Transparency be enforced? The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018."

It's July 2018 now.  Is Certificate Transparency required now?  What changed?

The two main questions I'm trying to find an answer to:

Will certificates from corporate (or "internal") CAs be rejected by Chrome?
Will every certificate observed by the browser now trigger a query to Google's CT server?

Will certificates from corporate (or "internal") CAs be rejected by Chrome?

This is already answered in the exact sentence you've cited: "... require Certificate Transparency for all newly issued, publicly trusted certificates ". Since internal CA are not publicly trusted no certificate transparency will be required for these.

  Will every certificate observed by the browser now trigger a query to Google's CT server?

Certificate Transparency in Chrome describes the verification process as follows:

  Chrome may check that an SCT has been honoured by the CT log that issued it, i.e. that the corresponding certificate is indeed published in that CT log. ... Chrome does this by sending a specially-crafted DNS query that requests an inclusion proof from the log. Using DNS allows the user to remain anonymous from the CT log's perspective and enables caching of inclusion proofs.

From my understanding it will check always if the required CT information are in the certificate. But I don't think that this means it will check always that these information are correct and are reflected in the CT logs. My guess is that it will check not always but often enough so that certificates with fake CT information get detected.


How to identify hashing algorithm I want to identify the hash algorithm used by an online service. What I have now is thousands of pairs of original string and result hash.

Some examples:

62.152.39.195 25d10817d8d2836925
62.152.39.200 c20147df170843824c

The result is 18 hexadecimal characters, as you can see. Is there any algorithm for such identification? Perhaps something that's related to machine learning?

No, the best way is trying to try each hash function, encode as hex and find the result hash within that string.

From Wikipedia about additional properties for cryptographic hash functions: "Therefore, a cryptographic hash function should behave as much as possible like a random function while still being deterministic and efficiently computable."

That line also means that any good cryptographic hash function can easily be truncated to a smaller size without loosing additional security. The amount of security is still the number of output bits divided by two.

All of this is presuming that this is a cryptographic hash. If it is a normal hash, then it may be possible to find a match without brute forcing (but I would not bet on it). If it is a MAC instead of a hash then you would need access to the key.

I presume that you've already tried finding the documentation of course.


Understanding the philosophy of recovering data It can be understood that if i delete some data, those bytes may not be written by other data can be extracted because the data actually resides on those sectors/cells.

But i wounder how the bytes can be recovered from the sectors/memory-cells, when the sectors are already written.

Why people say that to be sure that your data can't be extracted from your media, leaving aside the encryption, physically destroying the media is the ultimate option.

Suppose i have a flash drive, it size is X-bytes and i write some random bytes to the whole X-byte cells, how can a person recover the previous data as the cells contains random data ?

I am not interested in the technique(s), but just curious about how recovery works in this kind of scenario.

As you said you were not interested in technical detail, I will give a rough, top level approach to answer your question.

First off, flash drives have a built-in process called wear leveling where the controller does select the sectors that will be written to level the wear on all available sectors (which are more than those offered to you to be written to, usually). Thus, when you randomize all sectors available to you, there might be still "old" data in the sectors currently not on wear leveling duty.

Apart from that, there are minor differences in between memory sections that contained a 0 before an 1 and one that did contain a 1 before another 1. (technicalities differ between magnetic disks flash devices) and thus, assuming you have written random data and the data written before wasn't random (i.e. has intrinsic structure), you can statistically remove the noise from the random data and have some good guesses as to what was written before the random data.

That is the reason, multiple rewrites with randomness are considered more secure than one single go. Yet, the capabilities to make out those minor differences mentioned before are sparse and usually consider a state actor of some kind being the attacker in your threat model.


How many bcrypt rounds are necessary? I'm making an app and am using bcrypt to encrypt passwords.

I've no prior knowledge about bcrypt and still don't know much, I know it supposed to be a secure cpu-intensive encryption.

After implementing it yesterday I noticed my sign up's becoming extreemeelyyy slow, taking about 5-10 seconds to complete. I'd thought it was just my slow computer (running the server) however after inserting a few break points on the server, I noticed it was stopping while hashing the password.

I tuned down the rounds from 15 to 1, and everything started working smoothly.

I also checked the database to see if maybe the password was the same/similar to the input password, it seem's just as random - then again I'm a human and not a brute forcing bot.

My question is, 15 rounds isn't going to cut it unless my computer really is just super slow, and the average server can hash 15 rounds in less than 10 seconds, and 1 is supposedly not secure at all, what is the best amount of rounds to hash?

I'm using bcryptjs which may not be helping with the speeds - being javascript.

Do you mean 6 rounds, or cost 6?
Because cost 6 is 2^6 = 64 rounds.

Nowadays cost 10-12 is considered the minimum.
However you need to look the maximum your hardware can handle.

The process of hashing should take approximetaly one second.


Client side certificates in IIS for accessing a web app only from an specific PC We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login.

Besides those credentials, we want to add more security for accessing that web app with this requirement:

  A user will access that web app only from its PC. If user goes to
  other place and uses other PC, then he/she will not be able to access
  that web app.

Our question is:

IF:

A client-side certificate stored in the user's PC
IIS is configured to accept client side certificates

THEN:

The user can access the web app only from that PC. If the user uses a different PC in which there is no client-side certificate, then user will not access web app.

Is that correct?

You can see the client-side certificate as a key. Wherever the key is installed, the client will be able to connect. At the opposite, wherever the key is not installed, the client will not be able to connect.

However, bear in mind that the client-side certificate is actually just a file a browser can import. It is not something hard-linked to a physical computer in any way. Therefore unless there are supplementary measures taken nothing prevents someone from importing their client certificate in several browsers running on different computers.


KeePass OTP plugin circumvents inbuilt protections? I have read the question on HOTP implementation in KeePass HERE. This question is however on the other newer plugin KeeChallenge.

According to the documentation, the a secret is encrypted and can only be decrypted using the TOTP. However if it is done so, isn't the weak link now the encrypted xml file (plus there is a recovery key backdoor) rather than the encryption algorithm of KeePass? As far as I can tell, things that KeePass does to keep itself safe from brute attacks (e.g. encrypt multiple times) is compromised by the use of this plugin. Am I right or did I miss something?

KeeChallenge is based on the predictable result of HMAC-SHA1 with a known key. The key in the XML file is encrypted using the result of performing HMAC-SHA1 on the challenge also stored in the XML file. To decrypt the key, the challenge is passed to the Yubikey which performs HMAC-SHA1 to generate the same value that was used to encrypt the key data last time. Once the key is decrypted, a new challenge is generated and the expected response (generated using the decrypted key) is used to reencrypt the key.

The source is pretty easy to follow.


Is this a safe way to identify users connecting to a chat server? Before I start, all information will go over HTTPS.

So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends and receives information from a Node.js server. I want people to only be able to send information if logged in, and only from their account.

So I'm planning on doing it this way:

User logs in (the forum not the chat client)
PHP sets a cookie with a security token that is a randomly generated HEX string (using the function mcrypt_create_iv, with a random length between 15 and 22 characters)
The token is also saved into a MySQL database, along with the user ID
When the user sends a message through chat, his user ID will also be sent, along with his security token
The Node.js server will compare the security token in the database to the user ID, and if they match, the user will be able to chat

Is this a good security scheme, if not why and how can i improve it? Thanks

You should ensure that your session token is random and at least 128 bits. Aside from that you just basically send a session token and a user id. To be fair, only your session token should be needed to identify a user since it is unique. Ensure also that you destroy the session token after the user logs out. Aside from that it seems similar to any other login scheme.


Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access? Requirement 8.1.1 of PCI DSS states:

  Assign all users a unique ID before allowing them to access system components or cardholder data.

Using Amazon IAM I can set up individual accounts for users so they do not need to log into the Amazon AWS console as the root account.

However, I don't believe IAM can be used to manage Linux and Windows credentials on the instances within our AWS account.

Does having root and administrator accounts running on our instances mean that we cannot meet this requirement using IAM? If need be we could put a policy in place stating that users do not log onto live instances and that the root and administrator accounts on these boxes are only used in order to alter the images (AMIs) that the instances are created from.

However, since the AMIs share the credentials with any instances created from them we cannot keep these private.

Installing an Active Directory server seems overkill in this situation and possibly unreliable due to the transitory nature of EC2 instances.

However, I don't believe IAM can be used to manage Linux and Windows credentials on the instances within our AWS account.

You can pretty much do this via OpsWorks for Linux instances. OpsWorks lets you register IAM users with a stack and then orchestrate creating their account and managing their public SSH key. You also have the option to let them manage their public SSH key if you want and control whether they have sudo privileges.

  Does having root and administrator accounts running on our instances
  mean that we cannot meet this requirement using IAM?

There's an option in OpsWorks to launch instances without a default SSH key which I believe means the only way to log in is via one of the IAM users. This can make debugging a little bit difficult if any issues occur before the OpsWorks agent has started though.

I'm not an expert in PCI DSS though so I'm not sure if there's any aspects of how OpsWorks manages instances which would prevent compliance.


Do i need SSL certificate signed by a CA for hybrid mobile apps? I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the webserver or webservice is actually the authentic web service what it says it is. But if in my mobile client i am actually hardcoding the webservice url then the client will always call the url unless the apk is modified. So a self signed openssl certificate should be enough right? or not...

Also do i need to put in some code in the client application to actually validate the certificate, because it seems if an attacker wants he can even modify the certificate validation code in the client application also if he has access and so can he modify the url to point to enirely different remote service.

Please guide me on what would be the best way to implement ssl for a hybrid app downloadable from app store or play stores. Or what is the best practice that i should follow. Thanks for any help!

So a self signed openssl certificate should be enough right?

Only if your mobile app only accepts that certificate and no other. That is, you'll need to update your mobile app if your website/web service's SSL certificate changes and your website/web service will be rejected by normal browsers as untrusted. So you save a small amount of money on a commercial certificate at the cost of no default browser or operating system accepting the web site.

  Do i need to put in some code in the client application to actually validate the certificate?

Most HTTPS libraries will look in a variety of places for trusted CAs. So as long as you have added the self-signed certificate or the CA that signed it to the application or library's trust-store, the validation process will occur automatically.

  What would be the best way to implement ssl for a hybrid app?

Answering every facet of this question would be... rather large. So I suggest these basics:

Buy a normal long-length SSL certificate from a normal provider. Obviously one whose Root CAs is included in the phone's default trust store.
If you want to lock down the trust to just your certificate, there are ways to do this but you'll need to ask the Android stack exchange. It shouldn't require more than a few lines of code with an appropriate HTTPS library/client.
If you want to lock down the web service to only your mobile app, generate a client certificate to be embedded inside your app. Not foolproof but it does raise the bar.
Don't grow your own. If a somewhat heavy open-source library exists for this purpose, use it. At least if you run up against problems you will have a decent developer community to ask questions of. I can't tell you how many times I've seen code-snippet questions on StackOverflow that would have been avoidable if the developer was using a standard one-line call to a popular library.

Oh. And regarding "modify the certificate validation code in the client application" - yeah you have no easy way to stop that as you have to deal with same piracy and reverse-engineering problems that every other software studio providing client-side applications has to deal with.


Need a software that can monitor and log network traffic of installed applications I need to monitor and log network activities of a specific software installed on my system.

I know there are lots of network monitoring software out there, even system explorer has one built in.

I need a Windows-based application I can run in the background, it should collect the network traffic of a process software or a set of processes.

Microsoft Network Mintor or NetMon for short allows you to monitor/log/analyze network traffic.

After you start capturing, you can specify a process and monitor the network activity of that process.

If you just want to know the IP addresses, ports, and protocols used by the process, you can try something like this in the command prompt

netstat -ano | findstr PID

You can get the PID either from your Windows Task Manager, or with the following command

tasklist | findstr /i PROCESS_NAME


How does Amazon secure its 6 digit one-time password? I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few retries (requesting OTP resend)?
It seems that they put a captcha ahead of this and probably have some timeout where the OTP expires or unspecified limit when too many attempts will lock the account from further retries. But nevertheless this doesn't seem like a very good idea to me. I think Google Apps uses 8 characters with multiple character sets (lowercase, uppercase, numeric, symbol), which seems like how I would implement something like this.
What are good best practices for implementing a similar password reset mechanism with 6 digit numeric PIN on my own web app? Or is this a bad idea?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few retries (requesting OTP resend)?

At face value yes it allows relatively efficient brute forcing. However they will have a) a limited time period when that code is valid and very likely b) a way to prevent repeated submissions (like a CAPTCHA test usually, but could just throttle responses).

It seems that they put a captcha ahead of this and probably have some timeout where the OTP expires or unspecified limit when too many attempts will lock the account from further retries.

So you do know the answer.

But nevertheless this doesn't seem like a very good idea to me.

Find a way to break it and disclose it to them. I find it is pretty solid as it is for this piece of functionality. One time codes can be simple to be used efficiently provided there's measures to prevent brute forcing.


How to add user entries with password field in LDAP over HTTPS? I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this.

An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user creation form can be provided as web service over HTTPS.

As per this mail chain, LDIF files should better have userPassword as plain text so that the LDAP server takes care of hashing.

Is it possible to get the userPassword as plain text, at the server-side, when the password is entered by an end user on client side with HTTPS being used ? Is it a good idea at all ?

Or should I leave it to the user to hash it in SSHA on client-side and give it to the server, which I would add in the LDIF file ?

Is it possible to get the userPassword as plain text, at the server-side, when the password is entered by an end user on client side with HTTPS being used ?

Yes. HTTPS is HTTP over TLS.  TLS stands for Transport Level Security, and, as the name implies, encrypts the transport layer.  That is, it's only designed to protect the data during its transfer over the network.

Generally there will be a TLS terminator (or SSL terminator) at the edge of your infrastructure; this software (or occasionally, hardware) decrypts the TLS encryption and passes the unencrypted underlying HTTP request on to the application server.  So yes, this is possible, and common.


If a host is infected is the sandbox environment infected? Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also?

If the answer is yes, what if I have an AV running inside of the sandbox.  Will it allow for a safe sandbox environment without having to remove the malware from the host?

It sounds like you are looking for concrete answers, but there are none.

If the host is infected, then it is possible that any program running on the host is also affected. But, just like any malware, it would have to be programmed to do that. Not all do.

Will antivirus allow for a safe environment anywhere? No, an antivirus provides a layer of protection, so you cannot assume that you are safe just because antivirus is running.

Can malware affect sandboxes? Yes. Is it common? No.

Can antivirus protect the sandbox? Maybe, it depends on a lot of factors.


Shoul I consider  as dangerous mixed passive content? From mozilla

Mixed passive/display content is content served over HTTP that is
included in an HTTPS webpage, but that cannot alter other portions of
the webpage. For example, an attacker could replace an image served
over HTTP with an inappropriate image or message to the user. The
attacker could also infer information about the user's activities by
watching which images are served to the user; often images are only
served on a specific page within a website. If the attacker observes
HTTP requests to certain images, they could determine which webpage
the user is visiting. Passive content list
This section lists all types of HTTP requests which are considered
passive content:
 (src attribute)
<audio> (src attribute)
<video> (src attribute)
<object> subresources (when an <object> performs HTTP requests)

It seems to me that the content loaded through HTTP within the HTTPS page is considered vulnerable. In this scenario the HTTP image (for example) is loaded without user interaction.
Should I consider dangerous also elements like More info which require a user to click on them?

Should I consider <a href></a> as dangerous mixed passive content?

While this is not considered mixed content (since it is not embedded into the page), it can of course still be dangerous: with a plain HTTP link an attacker could hijack the request or response and provide different content. And usually there is an expectation by the user that an offered link will not lead to some dangerous content (unless it is clearly dangerous based on the context). Thus, it is best to offer the links only as HTTPS.


API Key via Basic Auth: Send it as a username or as a password? In APIs that authenticates with a single API key (eg a long random string) via Basic Auth, I have seen that most (eg Stripe, Unbounce) sends the API key as the username, leaving the password field blank. The only service I have seen that sends the API key in the password field is Bing.

Is there any reason to choose to send the API key as the username field or the password field?

I know that both usernames and passwords are concatenated and encoded, so both are equivalent in the transmission. I am looking for reasons such as (for example):

"Well known client X expects non-empty usernames, so the API key has to go in the username"
"Well known client Y logs usernames and not passwords, so the API key has to go in the password"

The answer to your question will be opinion based.

In my opinion, the password should confirm that the requester is really the owner of the user ID he sent in the request. If one would treat API as a password, what user ID would it confirm? That's why I treat API in such scenario (Basic Auth) as a user ID. And this user ID is so secret that knowing it already allows you to use it, without additional password.

No matter how you treat it, non approach is ideal. Normally as a developer you will need a user ID (or some information that points to user ID) for at least two purposes:
- For logging, e.g. to analyze which user produced what load, or which user uses particular API end points
- For accounting: If in your business model you sell particular number of API calls or some volume of resources, you have kind of counters or other indicators, that show how much of the purchased resources the user has used so far. For this you will need a user ID.

Logs and indicators ideally should not contain sensitive information. When you use API key, that would be not good. So you may need some technical ID in your database, so that you map API key to a technical ID and use this ID in logs, for accounting and similar purposes.


Difference between Secure Simple Pairing and Secure Connections in Bluetooth? I would like to know what are the differences between Secure Simple Pairing and Secure Connections in Bluetooth v4.2.

Between BR/EDR legacy, BR/EDR, LE, LE legacy, I don't get it.

Most answers to your questions are given in the spec Bluetooth Core, VOL1.PartA.5

Timeline

The following suites exist:

BR/EDR

Prior to version 2.1 => BR/EDR legacy
Version 2.1 => BR/EDR (uses Secure Simple Pairing)
Version 4.2 => BR/EDR (uses Secure Connections)

LE

Version 4.0 and 4.1 => LE legacy (uses Secure Simple Pairing)
Version 4.2 => LE (uses Secure Connections)

Legacy

It all started with the initial security algorithms (BR/EDR legacy) for the following security features:

pairing
bonding
device authentication
message encryption
message integrity

The algorithms used in BR/EDR legacy were not FIPS approved.

Secure Simple Pairing

This was introduced in version 2.1. Secure Simple Pairing uses FIPS-approved algorithms for pairing and message integrity and so in essence it upgraded the security of BR/EDR legacy, which is why we call this new one BR/EDR security.

Version 4.0 ported the exact same security model as BR/EDR to Low Energy (LE), with the following exceptions:

no Numeric Comparison equivalent
Just Works and Passkey Entry do not provide passive eavesdropping protection, because ECDH is not used in LE 4.0.

Secure Connections

In version 4.1, the Secure Connections feature was added to BR/EDR. This was an upgrade to the existing Secure Simple Pairing algorithms for pairing, device authentication, and message integrity. See table for a comparison with the Simple Pairing method for BR/EDR (not LE!):

Version 4.2 then upgraded LE as well. One of the main improvements was the adoption of ECDH for pairing. It also modified the Numeric Comparison association model to be used on Bluetooth LE. LE pairing used in 4.0 and 4.1 is since then referred to as LE Legacy.  LE Secure Connections and BR/EDR Secure Connections are functionally equal.

One last word on the association methods

Numeric Comparison protects against passive and active attacks;
Just works protects against passive attacks IF ECDH is used, and never protects against active attacks;
Passkey entry protects against passive attacks IF ECDH is used, and should protect against an active MITM attack (although there are some doubts about that, e.g. Padovan .
Out Of Band security depends on the OOB method that is used.


Could a boot disc brute force a Bitlocker password? Normally Bitlocker is protected by a TPM chip that prevents guessing the password millions of times per second, but could this be bypassed by using OphCrack or some other boot disc or by taking out the hard drive and extracting the password hash, (and then typing the correct password in the Windows login screen)?

Depends what you mean by "password".

If the disk is protected by a "PIN" (which may actually be a full-typeable-character-set passphrase) but nothing else, then yes, you could brute-force that. It'd take a long time - BitLocker uses a very slow key derivation function to turn the "PIN" into a key, so each iteration of the brute-force search would take a relatively long time even if using hardware much faster than the CPU that normally does the operation - but if the disk has a guessable "PIN" you could brute-force it.

If the disk is protected by PIN+TPM, which is the usual case for non-removable drives with "PIN" protection, then brute-force is really not feasible. You need the TPM key as well as the PIN-derived key, which means you need the drive in the machine that has the TPM, and that means you can't do an offline attack. Enter the PIN wrongly too many times, and it will lock and force you to enter the "Recovery Password".

The recovery password is quite thoroughly impractical (only just barely, technically, misses being impossible) to brute-force. It is extremely long and randomly generated; enumerating its search space is a problem on the scale of "if you turned every molecule of Earth into a CPU and used the entire energy output of a hundred suns to power them, you still wouldn't finish before the heat death of the universe."


I think someone might be tring to hack my website. What should I do? I recently came across some log messages that indicated that someone was trying to compromise a website I manage.

They tried several times to access various url paths that end in /Telerik.Web.UI.DialogHandler.aspx

This page suggests that accessing that page may be used to compromise a site.

I don't use any telerik services in my site, but I'm still concerned that someone is trying to get access.

The client IP was 23.101.181.45, which I found to be a Microsoft server

My web app is hosted in the azure cloud, but I don't believe that this IP has anything to do with my service.  My best guess is that this came from an unrelated Azure-hosted virtual machine.

My question is does this analysis seem valid, and should I do anything about this?  I'm afraid of ignoring it.

Welcome to the internet.

This happens all the time. The last time I checked, it took around 20 minutes after connecting a server to a public IP address which had not been used for several months before someone started attacking it.

There is nothing you should do in direct response to these attempts. There are lots of things you should do when provisioning a server on the internet - the list is far too exhaustive to go through here. And simply reiterating that here is of little benefit. You need to understand what the risks are, and implement appropriate measures to mitigate them. Applying a whole lot of configuration and additional code/software you don't understand doesn't help much with security. Your biggest security wins come from knowledge, motivation and good patching practices.

OTOH a proportionate response for a server hosting 200 photos of your cat is different from a proportionate response for a host containing millions of users personal data and providing the livelihood of hundreds of staff.

The stuff you see in your logs will be almost exclusively attacks which failed. Proactively scanning your logs for signs of successful attacks is a good idea for high value assets, but well down the list of priorities.


Protecting a database against insiders Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is and has to be manipulated by the web-server.

Now, obviously, we want to make sure that only authorised changes are made to this database. This is largely implemented in the application and a part is handled by creating database users with limited amounts of authorisations.

There do remain gaps with this approach, however. For instance: the system administrator is not authorised to make changes to the database independently. Nor would any engineers with deployment rights. But, they obviously would be able to do so by grabbing the database credentials from the web-server and logging in from there.

Any changes made this way would basically be anonymous as they would be obscured by many other changes which would make it hard to detect.

It's (probably) not feasible or wise to implement something that will actually 100% prevent the sysadmin from being able to make changes this way. Sysadmin and others should be able to make data and schema changes using their own accounts as the application is actively developed. However, they shouldn't be able to do so without anyone noticing.

Here are some possible strategies to prevent insiders from changing data anonymously:

Implement audit logging on the system to report any programs executed. This would find any direct calls to mysql cli and maybe some sketchy looking scripts. Any successfully performed changes would still be hard to find as scripting would obscure the actual performed changes.
Use client-certificates on the database connection with pass-phrases on the private key. This means a sysadmin is no longer able to reboot a machine without the presence of an application manager. Other controls are probably needed to protect keys in memory, sysadm being root and all.
Implement audit logging in the database. The web-application causes a significant amount of database traffic, so any malicious changes with the application database user is unlikely to be detected. This means monitoring can only feasibly implemented for interactive database users.
Use IPTables to lock traffic to the database to the application user. Would at least create an audit-trail of sysadmin becoming the application user (sudo) or changing the firewall to allow traffic out. Not foolproof, since any changes made using application database user would still be hard to find.
Implement SELinux to limit database traffic (packet labeling through SECMARK) to the application domain and further securing the deployment and build chains to prevent/catch unauthorised changes. If sysadmin does need network access to database, this may be audited through auditallow but administrative access should be through another user which is audited. Any system changes or SELinux changes would be alerted upon. This is obviously a high impact change with a lot of extra requirements that requires a lot of knowledge.

Beyond just trusting the sysadmin, how would you approach this? Would the above things work? What other things could one do to make sure a system administrator or similarly privileged user can't access the database unnoticed?

As with any security related matter it boils down to risk and cost of mitigation. Below are some additional measures you can take, but some will be quite an investment.

This is actually a common problem. Some things you might do to reduce the risk is implementing sessions recorders like Centrify which also limit an administrators access and can re-play what he did. Technical accounts should never be used by administrator unless through a system which established accountability like CyberArk.

Access should be restricted and all logons should be reviewed and audited. Passwords or keys used for database connection should be limited. E.g. only allow the user with the technical account for the database server to connect from the DB's IP. Preferably these are set by the security officer and cannot be viewed by the administrator when inputting it using a two-eye principle.

The most important part here is to make sure people administering the servers are not the same people as the people administering the log collection and analysis servers.

There has to be some level of trust and you can implement several controls to prevent fraud, but in the end it's still these people's job to make the system work. Hampering them is also not beneficial for the adoption of new security measures in place. Detection is still easier to do than prevention and a bit more fool proof because you will always have a trail somewhere. You just need to make sure you can guarantee your log integrity by logging remotely.


Should I stretch the secret key in a secure cookie protocol implementation? I'm building an api authentication layer that basically works like the secure cookie protocol, where instead of a cookie I give the api client a token which they must provide on subsequent requests. That token is signed via HMAC using a secret key kept in memory on the server. The key is a 64 character random hex string. Currently I'm signing the tokens with the key directly, but based on what I've seen in the source code for ruby on rails, they sign their cookies with a secret key that is derived by stretching the secret key base with pbkdf2. What threat vector is this defending against? As I understood it, key stretching is supposed to help prevent offline brute force attacks against stored passwords. I'm not clear what it's purpose is here and if its something I should implement.

Key stretching basically gives a key with low entropy more strength, by deriving a hash from it created by multiple iterations.

A 64 character  hex string, assuming it is completely randomly generated will have 256 bits of entropy. When authenticating a string with a HMAC, anything 128 bits or greater is considered "unbreakable".

Key stretching mitigates the risk of having a weak key, because the only way an attacker can find the key is via an offline password guessing attack. With key stretching with say 1024 iterations, this effectively makes the password 10 bits "stronger" because for each password the attacker tries they have to run the hash function 1024 times (the equivalent of having more entropy in the password itself - it makes up for the extra keyspace a stronger password would have).

So with Ruby on Rails, this is protecting against the site owner choosing a weak key (< 128 bits). If you can control your key and you make it strong enough, there is no need for any key stretching.