How to react when under attack Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I never allowed password logins for root in the first place so that's not really a problem but they have been after our website too.

We use the Laravel PHP framework which has some pretty verbose errors. They must have at least found a full path disclosure hole by now. I have inspected the mod_security logs and it seems that they are just running a security scanner on us. They have been trying a bunch of exploits for software we don't actually have installed. Anyway, they have been at if for almost a week now and I'm beginning to become worried.

What is the best thing to do right now? The attacks are not that sophisticated but are attacks none the less. How do I convince my boss and coworkers that whatever actions we have to take are necessary?

Your best bet is to install a web application firewall like mod_security and apply rules to nip this in the butt. Apply Duo Security, to disallow unvalidated sudo commands from a compromised account.

  fr00yl00p says:

  Configure the system to alert you upon logins (e.g. per mail in sshrc    and bashrc)

This becomes too cumbersome and complex if you have systems that perform maintenance, e,g, SNMPv3, any kind of rsync accounts, etc. A better mechanism would be an alias of the last command written to terminal whenever you log in. Duo will stop a lot so check it out.

  fr00yl00p says:

  Let your firewall drop connections with obvious attack patterns. (e.g. http://spamcleaner.org/en/misc/w00tw00t.html)

This is not a feasible mechanism and you'd have to create a whitelist in parallel. Consider the fact that I can spoof connections pretending to be anyone. Imagine I generate enough spoofed messages to simulate say a CIDR /16, /8, or even /2.

  fr00yl00p says:

  Install PHPIDS (https://phpids.org/)

Unless you're willing to become an incident response analyst, you will be wasting so much time chasing false positives, you'll eventually ignore the alerts from IDS' and IPS' even well trained DFIR people spent hours at a time constantly modifying. Let alone someone who isn't accustomed to using an IDS, nor interpreting its output.

As for other recommendations, you need not block entire ranges for a webserver if you configure a WAF properly. On one of my sites, I PURPOSEFULLY keep Joomla 1.5 running and worry nothing about compromises since my WAF is written to only allow a POST from my static address. Its simplicity at its finest. My website is designed ONLY to allow GETs not POSTs so there is no need to go bezerk on rules.

You need to also be cognizant, that much traffic is generated by infected machines, so you're not stopping or blocking an attacker per-se, you're blocking one infected machine. So I wouldn't go as far as blocking entire IP blocks to a webpage. Mailserver, ssh server sure. In fact, you should have a default "BLOCK ALL" to your webserver, ONLY allowing your address to services such as SSH. However, everyone's designs/needs differ


How to configure WebScarab to intercept only POST requests? I'm trying to make WebScarab intercept only POST requests. On the Intercept tab below Methods I've selected only POST, but it still intercepts all GET and POST requests, so it's quite hard to tamper data, because of massive amount of traffic going on. How can I configure WebScarab so that it will intercept only POST requests?

The solution is to unckeck Intercept responses.


Locking down web-based admin areas with personal SSL certificates I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have these specific certificates.

We're running Windows Server 2008 R2 Web, with IIS 7.5. I know how to turn the SSL certificate requirement on and off for the administration areas; but I can't work out how to have X many certificates mapped to X many administrators being able to access the specific areas.

I'm not sure of the terminology to be able to google this stuff, which doesn't help my searching; I can only find outdated stuff.

(I've got another question on this on Server Fault, but they said to go here.)

Here's some high level design things to plow through first.  There's a couple of ways to skin the cat, and how you set it up will impact the long term sustainability of this system.

Issuing and Managing Certificates:

So, you'll definitely need to issue each administrator his certificate.  As per usual, Microsoft plays well with Microsoft, so if you have your own CA set up already for issuing server SSL certificates (or domain controller certificates), then leveraging it might be an easy way to do this.  You'll need to think through:

How you get the certificates to admins
How admins store their certificate - for example, software certs are easy to create - and the private key gets stored in a file, but if you switch from machine to machine doing your job, how do you keep that private key safe?  on a USB?  USBs are easy to loose!  Imported into each browser on each system?  That's putting the key pair a lot of places.  Putting the certificates on smart cards or other hardware tokens is more expensive, but more secure.  But then you have to be sure that the admins have a smart card reader on each machine!  This stuff can really impact your security policy and should get figured out before you spend the time setting up the system.
How are admin certificates terminated?  The typical PKI process is revocation by the CA, but that assumes that your servers have a way to check certificate status via either CRL or OCSP.  IIS servers can do that (google "certificate status check" or "certificate status validation") but it almost certainly takes some configuration at both your CA and the server.  You may also want to stand up an OCSP server, if you haven't already.
how are certificates authenticated - you'll want to set up your IIS trust store to include the CA that is issuing your admin certificates.  This is a big reason to have a CA sign your certificates... if you do not, you need to configure every trust store to trust the self-signed end entity certificate and that is a maintenance nightmare.

How is privilege assigned?

A CA is usually used to issue a variety of certificates, only some of them are admin certificates.  How you design privilege assignments has a big impact on how well all this stuff works.  Here's some options:

make it a special quality of the issued certificate - for example, include the word "Administrator" in the Distinguished Name when you create and sign the Administrator certificate.  Look for that field when the admin logs in.  That may involve some custom code at the server.  Advantage - no extra centralized checking, Disadvantage - must have a way to consistently issue certificates, must revoke certificates when an admin leaves his position, must check certificate status.
configure privileges in Active Directory - as @M'vy's links say - there's ways to configure AD (or any LDAP server) to affiliate users (authenticated by certificates) with privileges (ie, being an admin) - this makes the setup eaiser to change - the user can have 1 cert, which he uses for admin stuff.  This privilege can be disconnected when the user is not an admin, or other criteria can be added via AD.  Means configuring your AD and your IIS server to check it.  Adds some complexity to user setup, as now the admin needs a cert AND a setup in the Active Directory server.
Statically configure at the server- keep a list of trusted admin certificates at the server, and check this list - that's the AD-free way listed on the links form @M'vy - that works fine for a small operation with no AD server, but it gets troublesome if you have to manage lots of servers, as each server needs an update every time an admin joins or leaves.

Any or all of these options will work - it's just a question of how frequently you change admins, how many servers you have to manage, and what you want the process to be.  Thinking all that out will save you much pain in the long run.

Here's some hit words for researching this stuff:
- to force user SSL based login with a digital certificate - "SSL client authentication", "client auth", "TLS client authentication/auth",
- for more configuration help - "cert(ificate) store", "trusted certs",
- for certificate status checking - "CRL check", "OCSP check", "cert status check", "cert verification/validation"
- for configuring privileges "role based access control", "privilege management",

And couple those with the software you are trying to configure.


How to identify IP from a UDP-based DoS I'm running a Counterstrike server on UDP port 27015. I'm using Amazon AWS to host the game server. I have added only my friends' IPs (about 50 of them) into a security group so the rest of the traffic is always blocked.
My enemy is spoofing my players' IPs and sending UDP floods. He sends it from 3-4 IPs.
I'm currently capturing IPs in TCPdump and blocking manually.
For example:

I capture packets using tcpdump and then I save it in pcap file

I analyze that file and I check for length of the packet

If incoming packet length is more than 600 then I manually block IP
0.007450 192.168.168.2 â†’ 183.83.145.212 UDP 240 27015 â†’ 54491 Len=991

But it takes too long to do this manually.
Is it possible to get those IPs using a shell script or something so I can block that IP?

You should look at a solution such as OSSEC or Fail2ban. It will do exactly what you want to achieve. However UDP spoofing is difficult to block, because you can freely spoof the IP address.


Is a single page application naturally breaking the same-origin policy? Assume that you have a web application. The backend API is deployed at  api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to your browser. The origin is frontend.example.com, yet when you are sending requests to the backend they are actually sent to api.example.com which is not the same origin.

So an SPA naturally breaks the same-origin policy since in most cases the API it works against is not the origin it stands on. So my question is, is there a way to develop a SPA without breaking the same-origin policy, and without using some tricky tech like CORS or JSONP?

If you want to avoid making cross origin requests, host your frontend and your API on the same origin. If you host them on different origins, by definition you must make cross origin requests.

And if you do have to make cross origin requests, just use CORS. JSONP is an ugly hack that should be avoided. It was used back in the day in situations like this, because there was no CORS back then. Then CORS was developed to deal exactly with the kind of situation you describe.

So asking how to make cross origin requests without CORS is sort of like asking how to hit a nail without a hammer. Just use the hammer, that's what it's there for!


Credit Card information Security In providing first 4 and last 4 number of credit card to vendor safe, considering you dont provide the expiration date or CVV2 number?

Per PCI-DSS Req. 3.3 You are allowed to display at most the first 6 and last 4.

This is typically not needed (most software just use the last 4).

I've seen a lot of app companies take the stance that they need the PAN digits to find transactions, however, this is usually because the of the poor implementation of the software and most of the industry has moved on to providing tokens.

It's not really a security thing other than to check that the full PAN is not stored anywhere.

Note:

Some states/cities have recipient requirements requiring "4 and 4" or "6 and 4",  or only 4. E.G New York


What are other channels Botnets can use for command and control except IRC What command and control channels might a botnet use? Which would be most effective?

I found good info on IRC, what are other possibilities?

(Exam preparation - no harm intended :-) )

There are many alternatives being used by the malware creators. Some of them are:

Flashback Mac Malware used Twitter 1.
Google AppEngine 2.
Facebook 3.

For sure, there must be other channels as well, these are the one that I remember from recent news.

The botnet owners are diversifying from IRC as, Twitter, Facebook, Google AppEngine are services used a lot and the traffic is considered to be legitimate and less suspicious by the network administrators. Though I am not an expert, I hope this gives you some idea.

Edit:

I remember of another one, presented in DefCon 2010 by Dennis Brown. Using Tor network.  Using Tor2web botnet can access a .onion website and take commands from the server. Have a look at the presentation, it is informative. 4


DNS entry defined only in HOSTS file - will browsers mark the SSL cert as valid? I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server.

We have a few contractors accessing this site from outside the network and while they can do so just fine via IP address, their browser properly flags the SSL cert as being invalid and forces them to HTTP.

I want to ask them to edit their HOSTS file and add a record for this site. If they do that, will their browsers properly acknowledge the site's SSL cert? Note that the cert is issued by DigiCert so there won't be a chain of trust issue - the only weak link was the DNS registration.

(We're setting up VPN access for these users but it takes a few weeks to go through internal red tape so this is a short-term solution.)

Yes, it will work. SSL/TLS don't care about name resolution mechanisms and network routing details. The only requirements are:

TLS certificate itself is valid (i.e. time valid, trusted, not revoked, usages are correct, blah-blah-blah as per RFC 5280 §6).
TLS certificate's SAN extension contains an entry that matches the name entered in the web browser's address bar.


How can I mitigate against chosen plaintext attacks for AES ECB? I am developing on a platform where my only encryption option uses AES ECB.  The encryption is used to protect parameters that the user can set, and so it susceptible to a chosen plaintext attack.  It's not a cookie, but similar; the user enters credentials, which with other data is sent to the server for authentication and authorisation.

What steps can I take to make the chosen plaintext attack impractical?

Specifically, my current proposed mitigation is to add random "fill" before and after my meaningful content.  The encrypted blob will look roughly the same length, but the place where the ciphertext from the chosen plaintext appears will be different for each call.  At this point the communications are low volume, so I am less worried about the efficiency, size or processing time of the data.  Is this an effective mitigation?

Alternately I could consider randomising the order of the fields (the plaintext is JSON).  That's a bit harder to implement.  Would this make the attack impractical?

I have read and think I understand this great question and answer.

The simplest way of dealing with this I can think of is to more or less implement CBC mode yourself. All it requires is for you to be sure of the block size used:

Build a random (and unique) IV of the same size as the AES block size (128 bits).
Encrypt that block and store the result (let's call it A)
Build a chain of 128-bits blocks containing your actual message (add padding as needed).
For each block in that chain, XOR it with the content of the buffer A and encrypt it individually. Store the result in your output buffer and replace the content of the A buffer with it as well.

In order to decypher the data, you decrypt the first 128-bit block and store the result in a 128-bit buffer. You then take each 128-bit block thereafter, decrypt it, XOR the result with the content of buffer A, store the result both in your output buffer and in A and move to teh next block.

You then remove the pad and you're done.

Edit:
One word of warning:

The best way would be to use a standard library instead of toying with code like this.

By doing what I suggested, you're running a rather severe risk of adding some vulnerability to your implementation: although I fully understand your need to work with specific limitations, you need to be aware of the fact that you are quite likely to end up with code that is vulnerable to some kind of attack (although it might be more resilient than the initial implementation).

Furthermore, if you rely on code that use ECB mode, it means that the author of that code had no understanding of modern cryptography and therefore probably contains other basic errors.


Self signed SSL certificate in multiple devices - Is this secure enough? We are trying to design a solution where we have several Smart devices and we can control every smart device from multiple phones. We will generate a Self-signed SSL Server Certificate and embed that in all the smart devices. And we will include the SSL Client certificate in all the phones. Now in order to connect a phone to the smart device the phone needs to obtain an ID (which can be obtained by scanning a QR code on the Smart device - this is just to ensure that the phone is in the vicinity of the smart device).

Smart Device:

Embeds a Self signed Server certificate. Reason: No dependency on the
internet connectivity
Maintains a WiFi hotspot (Internet connectivity
is not guaranteed always)
Maintains a list of connected phones (each
phone identified by the unique QR Code ID that is scanned by the phone)

Phone App:

Implements Certificate pinning and hard codes the Client certificate
Connects to the Wifi hotspot
Establishes an SSL connection with the Smart device.
In order to register for the first time it scans a QR code and for subsequent connections it sends the QR Code ID to provide its identity.

Can you please review the above architecture and identify any flaws with this?
Because we are installing the same server certificate in all the smart devices and the same client certificate in all the phones is there a way to hack the Smart device in some way?
If there is an SSL connection established between a smart device and a phone, can another device (which is on the same network with the same certificate) be able to hijack the packets sent between the Smart device and the first phone?
Once a secure link is established we send the QR Code ID in plain text format through the SSL socket. Do we need to encrypt this again or is the SSL link secure enough?

If you have control over both the client and the server, you can use self-signed certificates securely. The best way to do this is to create a private self-signed root CA, and use that to sign the certificates of the various devices. In the client, verify that the server's certificate has been signed by the private root CA. Also, use a different certificate for each device. You wouldn't want to give someone access to all devices if he hacks one device.

This setup will provide transport level security, so you can safely send a QR code.


Multiple, different sites on same server. Individual SSL certificates for each or SAN certificate? On a server containing multiple unrelated sites what is the best solution, in general, for applying SSL security to each site? Individual certificates for each site or a SAN certificate?

If the sites are unrelated it would be best to have different certificates. And if the different domains have different owners more so.

But, multiple certificates on the same system can be a problem when you try to serve multiple domains from a single IP address. In this case the client needs to use the Server Name Indication (SNI) extension to signal the server which of the hosts it tries to access. While SNI is supported by all recent web browsers it is not supported by older browser (IE8 on XP) and several programming languages still have problems with it: support for SNI was added to python only with 2.7.9 a year ago so lots of systems don't support it. And while SNI is available for Java since version 7 it still makes problems with older libraries on Android. Also, some bots don't support SNI either, like the bot for the search engine bing.

Thus it might be in theory nicer to have multiple certificates but in practice this can cause problems.


Plausibly deniable SSH - does it make sense? My colleague just told me he can't make outbound SSH connections in his corporate networks, so I advised him to set up a server on 443 port and it worked. I then started thinking that the administrator could detect that it's actually an SSH connection using deep packet inspection and/or by connecting to the server, but I think I found a way to make it more difficult that does not involve protocol obfuscation (which I don't like, because it would break putty).

While it's obvious that if you don't change the protocol, your connection will stay in the logs, but I thought that the admin could feel confused if I could prove to him that there's actually a HTTPS website on the port and the server doesn't really speak SSH. In order to do the trick, I thought of a proxy that wraps the port and always lets in SSL requests, but lets in SSH only after a secure login attempt over HTTPS. Since I don't yet know the protocols of neither SSL nor SSH, can you think of a reason this couldn't work? If not, do you think it could actually be convincing/useful?

Technically, the first bytes of a SSL connection, and the first byte of a SSH connection, differ. Basically, with SSL, the client talks first, and the very first byte has value 22 (0x16) for the record containing its ClientHello (see the standard). With SSH, client and server talk simultaneously, but the server can wait for the client to talk first, and they send their "banners" which starts with "SSH" (see the standard), so the first byte from the client will be 83 (0x53, for an ASCII "S").

Thus, you could write some server software which listens on port 443, looks at the first byte, and, depending on that byte, redirects to a local SSH or SSL server. The two protocols can be multiplexed on the same port that way (I used to do that for SSL vs RDP). However, of course, there will still be SSH traffic on the socket when you do SSH, so packet inspection things will still see "SSH-like patterns".

The same applies to your idea. Even if you do a complete SSL-based dialog first, the moment you switch to SSH on the same socket, the packet inspectors may detect you. If you really want to evade them, you have to do the SSL thing completely: begin with SSL, then do the SSH inside the SSL tunnel. Basically, run a SSL-based VPN. From the outside, it will just be SSL all along; inside, arbitrary IP packets, which may convey some SSH or anything else, really.

(Note that SSL encryption does not hide packet size, and SSH traffic includes a lot of small packets which imply a traffic pattern distinct from "normal Web". A nosy sysadmin may still find out about your attempt at evading the local policies. Crime is not an easy craft !)


FarCry 1 Server Security Risks? Some friends and I want to play FarCry version 1.40 on PC over the internet on our own private server but we have some security concerns. Since the game was released 15 years ago and we'll be running it on Windows XP Pro Version 2002 Service Pack 3, we are likely to have our server and operating systems hacked, correct? What are some security measures we can take to prevent this?

The server will be behind a home router with port forwarding enabled.

If the only port forwarded to the server is the port used by the game, you are fine.

You can protect even Windows 95 with the correct measures. If you block everything but the game server, not use the computer for anything else but host the game (no browsing, no email, no running random programs), it will be reasonably safe.


Security of adding letter in front of passphrase I am wondering about the security of adding a letter in front of a long passphrase to help me have different passphrases for each site I use while not requiring me to remember several different N word sentences.

E.g., if my phrase is the classic "correcthorsebatterystaple", would it be ill-advised to add, say, "f" for facebook, "g" for gmail etc.? I could imagine it both adding one extra character of complexity to the phrase (good), but if inspected by a human, that pattern may be obvious (bad).

This is a bad idea.

You need your passwords to be unique. Re-using 95% of a previous password doesn't respect this rule, so you should really avoid it.

If an attacker manages to get access to one database with cleartext passwords, he will most likely understand how your password was generated, and will be able to guess all your other passwords.

You should use a password manager instead, they will generate random & unique passwords for you.


Password storage in 1password and other similar password storing applications My understanding of memory in a computer is that it is stored in blocks that are over written only when the computer finds it convenient. so if a program asks to write in a certain block rather than clearing that block, which takes time, the computer will just redefine where that block is so that it can use an empty block and worry about clearing other blocks latter. This is fine but with password storage that means (if I understand correctly) that even though a password may be stored in encrypted form, a non-encrypted form of the password is lying around somewhere in the "uncleared" part of my computers memory.

Please explain to me either why this is not the case or why this is not a security issue. Thanks for the help.

In this case, the program will only store the plain text password in RAM (Random Access Memory). From this, it will then encrypt it, usually with AES, and write it to the permanent storage.

RAM memory is not permanent, as soon as the power of the computer goes out, the entire RAM is cleared. Meaning that even if it was not written over as soon as the power is out, it is completely gone.

It can also be assumed that the program will take steps to write over the RAM address with null data. But this might not be the case.


Why is CVE-2017-5461 rated Critical with CVSS Score 9.8? A while ago I came across this CVE-2017-5461, which is rated 9.8 both on NVD and Redhat Portal, with a CVSS base string of

  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

for those who is not very familiar with CVSS scoring mechanism, let's break it apart, and I will elaborate my doubt following every element:

AV:N means Attack Vector is Network, this is clear;
AC:L means Attack Complexity is Low, Don't think so. as it require attacker to forge a special certificate.
PR:N means privilege is not required.
UI:N means user(victim) interaction is uneeded.
S:U means Scope is unchanged.
C:H means Confidentiality Impact is high. no doubtedly.
I:H means Integrity Impact is high. we can agree on that.
A:H means Availability Impact is high. how is this the case? why would a successful attempt break the availability of application?

Do you think this vulnerability qualify for a Critical vulnerability?

AC:L means Attack Complexity is Low,
  Don't think so. as it require attacker to forge a special certificate.

I don't see why this should not count as low complexity. The attack does not require that the certificate is signed by a trusted CA since the bug is in parsing the certificate which is done before the trust chain can be checked.

  A:H means Availability Impact is high.
  how is this the case? why would a successful attempt break the
  availability of application?

From the bug description of what the attacker could do: "could cause it [the application] to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library.". In other words: the attacker can make the application to crash which definitely impacts the availability. Even worse, the attacker might be able to execute code with the permissions of the application which might further impact the availability and might also be used as a starting point to get deeper access using a local privilege escalation attack.


How do CC servers communicate to botnet bots in a local network? A more general question How do bots communicate in  the Zeus botnet? doesn't really address my question.

I'm trying to understand how a bot can communicate with command and control (CC) machine. On a technical level, I know bots use sockets (for example), but I really have no idea how the CC can send commands to a bot/computer which is probably inside a LAN private network. Lots of computers are in a LAN behind a box, or a router. So for communication behind a port with a server you must to use NAT I think.

Can anyone explain how this works?

Usually it's not the command and control infrastructure which connects to the bots, because it can not magically know when a system gets infected. It's the botnet clients which contact the C&C infrastructure and ask for commands.

Most routers (at least in the consumer segment) are configured to blindly forward any connections from inside the network to systems outside the network. Port forwarding only needs to be configured when a service needs to be contacted from the outside.

How exactly the bots contact the C&C servers differs vastly between different botnets. They masquerade as other protocols (like HTTP), use anonymization networks like TOR and various other methods to avoid being detected easily.


Is sha1sum still secure for downloadable software packages signature? We use sha1sum to calculate SHA-1 hash value of our packages.

Clarification about the usage:
We distribute some software packages, and we want users to be able to check that what they downloaded is the correct package, down to the last bit.

The SHA-1 cryptographic hash algorithm has been replaced by SHA-2 since SHA-1 is known to be considerably weaker.

Can we still use sha1sum?

Or should we replace it with sha256sum, or sha512sum?

I suppose you "use sha1sum" in the following context: you distribute some software packages, and you want users to be able to check that what they downloaded is the correct package, down to the last bit. This assumes that you have a way to convey the hash value (computed with SHA-1) in an "unalterable" way (e.g. as part of a Web page which is served over HTTPS).

I also suppose that we are talking about attacks here, i.e. some malicious individual who can somehow alter the package as it is downloaded, and will want to inject some modification that will go undetected.

The security property that the used hash function should offer here is resistance to second-preimages. Most importantly, this is not the same as resistance to collisions. A collision is when the attacker can craft two distinct messages m and m' that hash to the same value; a second-preimage is when the attacker is given a fixed m and challenged with finding a distinct m' that hashes to the same value.

Second-preimages are a lot harder to obtain than collisions. For a "perfect" hash function with output size n bits, the computational effort for finding a collision is about 2n/2 invocations of the hash function; for a second-preimage, this is 2n. Moreover, structural weaknesses that allow for a faster collision attack do not necessarily apply to a second-preimage attack. This is true, in particular, for the known weaknesses of SHA-1: right now (September 2015), there are some known theoretical weaknesses of SHA-1 that should allow the computation of a collision in less than the ideal 280 effort (this is still a huge effort, about 261, so it has not been actually demonstrated yet); but these weaknesses are differential paths that intrinsically require the attacker to craft both m and m', therefore they do not carry over second-preimages.

For the time being, there is no known second-preimage attack on SHA-1 that would be even theoretically or academically faster than the generic attack, with a 2160 cost that is way beyond technological feasibility, by a long shot.

Bottom-line: within the context of what you are trying to do, SHA-1 is safe, and likely to remain safe for some time (even MD5 would still be appropriate).

Another reason for using sha1sum is the availability of client-side tools: in particular, the command-line hashing tool provided by Microsoft for Windows (called FCIV) knows MD5 and SHA-1, but not SHA-256 (at least so says the documentation)(*).

Windows 7 and later also contain a command-line tool called "certutil" that can compute SHA-256 hashes with the "-hashfile" sub-command. This is not widely known, but it can be convenient at times.

That being said, a powerful reason against using SHA-1 is that of image: it is currently highly trendy to boo and mock any use of SHA-1; the crowds clamour for its removal, anathema, arrest and public execution. By using SHA-1 you are telling the world that you are, definitely, not a hipster. From a business point of view, it rarely makes any good not to yield to the fashion du jour, so you should use one of the SHA-2 functions, e.g. SHA-256 or SHA-512.

There is no strong reason to prefer SHA-256 over SHA-512 or the other way round; some small, 32-bit only architectures are more comfortable with SHA-256, but this rarely matters in practice (even a 32-bit implementation of SHA-512 will still be able to hash several dozens of megabytes of data per second on an anemic laptop, and even in 32-bit mode, a not-too-old x86 CPU has some abilities at 64-bit computations with SSE2, which give a good boost for SHA-512). Any marketing expert would tell you to use SHA-512 on the sole basis that 512 is greater than 256, so "it must be better" in some (magical) way.


What precautions I can take to secure software against user? I want to build a client that connects to my server and uses server API. You can consider this as a banking application because data security is the most important thing. Since the users or hackers going to try breach software security to get into flow and see what is going on, we need to protect everything from user too. Simply, I want to take precautions against this (but not limited) situations:

Reverse engineering attacks: No one must see my source code. If someone see it they can understand the algorithm and learn how API is working. Since the API is not a public one, it must never happen. Is obfuscating an irreversible process and best way to hide real source code? Also how can I secure my variables that can be dumped from memory at the runtime? What is the best way to secure local configuration or created files under Windows?
Pirate clients: How can I prevent other softwares from using my API? If someone gets the source code, alter it anyway or create theirs this will be uncomfortable situation. Is there a way to limit access of service to my own original, not modified clients? (Hash control? Client certificates? Assembly signature maybe?)
Data channel & data security: Software should be able to run in every network that connects to Internet, so it seems I have to use web requests & responses to communicate clients with server. I think data channel can be secured with https easily. Should I prefer a paid certificate (like Verisign) or creating my own certificate (signed by me) is enough? I want to secure the data itself too, I think a public & private key pair for each client will be enough for both identify and communication. Is it a good approach? I'm also thinking connecting that clients with a HTTP Proxy, can it increase security?

I know my software is working on enemy soil that I mustn't trust and there is nothing an user can't do with it. But I want to secure this as much as I can. No one can make it fully secure but I want to do everything I can to increase it.

All your client side security efforts are doomed to failure.

Obfuscation and hiding your source just isn't going to work.  The more valuable the data you are working with the sooner your code is going to be reverse engineered.  The only logical approach to consider everything client side public.

Your approach should be to focus your security on server the server side, generate an authorization keypair for each client, and monitor for abuse and revoke keys in these cases.  Just like Amazon AWS.

HMAC for authorization and TLS for transport encryption.
It doesn't matter whether you generate your own cert (you may trust yourself more than verisign) as long as you tell each client to trust it.
Adding a proxy will not increase security, using TLS will.
If it makes sense for the application add a password to encrypt the HMAC
key and the client side data, to make it a bit more secure.
On the
detection side consider automated ways to detect abuse.  How many
queries is too much?  Maybe throw some juicy honeypot API endpoints in the client source code.  When an attacker connects to /payments/swissbank/million then you know the key has been compromised and should be revoked.  Whatever else is outside normal behavior, including validation fails.


Why is NIST removing & not updating TLS guidance? What is the replacement? The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document.

In addition there is a Network World article that mentions the requirement of Mutual Auth TLS on Government websites and the possible depreciation of TLS 1.0.

I don't have the original document to refer to, but what was so egregious in this document that required its demise? Is NIST getting ready to pull the rug from under certain configurations of TLS?
What are the implications for the federal user concerning TLS moving forward?

It took nearly a year, but NIST has released this bulletin explaining the update and also providing the updated document for SP 800-52 Revision 1.

The answer to your question is expressed in the bulletin:

  NIST published the original version of SP 800-52 in 2005, but withdrew
  it in March 2013 because the guideline had not yet been updated based
  on the new versions of TLS and known vulnerabilities. This new
  publication is the final version of SP 800-52 Rev. 1, which
  incorporates public comments to the draft version made in the fall of
  2013.

  Chief among the changes in SP 800-52 are the recommendations that
  government servers and clients move to TLS 1.1 and 1.2. It also
  recommends that they adopt cipher suites with NIST-approved algorithms
  to support 112-bit security strength and higher.


Are Meltdown and Spectre exploitable on 32-bit Linux platforms? All of the information I've seen thus far on Meltdown and Spectre explicitly reference 64-bit platforms.  What about 32-bit (specifically RHEL/CentOS)?  I would assume that's also vulnerable but can someone confirm if that's the case?

Any CPU that performs speculative execution is vulnerable to Spectre, so yes, 32-bit OSs are vulnerable.

Meltdown is an issue with how Intel CPUs enforce memory protection while performing speculative execution (in short, memory protection isn't enforced until the point at which speculative execution is turned into real execution).  32-bit OSs on Intel CPUs are vulnerable, but the heavier use of swap reduces the impact somewhat (Meltdown can only read physical memory; data that's been swapped out to disk is inaccessible).


remove untrustworthy CAs from firefox There are so many CAs in firefox, that are impossible to approve the reliability of all of them.

How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and DigiCert?

Maybe wqith an addon?

Go to about:preferences#privacy, scroll down to the bottom under "Certificates", click "View Certificates", then go to the "Authorities" tab.

Select each certificate authority you want to distrust, then click the "Delete or Distrust" button.

There doesn't appear to be a simple way to restore trust in a built-in CA, so you may want to be extra careful in distrusting built in CAs - in particular, not all well known CAs have well known issuer names: "Let's Encrypt", for example, is issued by "Internet Security Research Group", so distrusting the "ISRG Root X1" certificate would distrust "Let's Encrypt" (well, they're cross-signed, so would keep working unless you also distrusted IdenTrust, which also doesn't sound like it's related...).

You need to decide what counts as untrustworthy for your use case - if you need to deal with the Finnish government, say, you need TeliaSonera. If you don't, and you don't need any other sites using certs signed by it, you probably don't.

The options are basically:

decide which CAs you trust, and remove all others, living with breakage of sites signed by other CAs,
or work out what sites you use rely on, and perform more detailed checking of those CAs until you feel able to trust them, or can replace those sites which rely on them with others using CAs you do trust.


Looking for real penetration testing reports I'm wondering if there's any repository with leaked penetration testing reports?
I found some samples but I'm not confident they are taken from real life cases.
Does any one know where can I find some?

Thanks

Leaked? You mean, like, published?

https://github.com/juliocesarfort/public-pentesting-reports/ contains a "list of public penetration test reports released by several consulting firms and academic security groups".

I can confirm they are "real life cases" because it includes one of my employer.


Firewall demo - iptables I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out a good use case to present at class. I can show how to use add rules etc., but this isn't enough.

Could I have 2 pcs in a network to show what happens when connection is blocked for example?  Any other ideas?

You can use a network protocol analyzer like Wireshark to show exactly what is happening. Set up an experiment with and without a certain set of rules and compare the results from the Wireshark log files. That way you can show what happens on the network level.

If you don't want to bring more than one computer, you can use virtual machines to simulate the different hosts interacting with each other. It is a little less impressive than using real computers but works almost the same. That way you can demonstrate the use of iptables as a host based firewall (controlling the access to the machine iptables is running on with the host OS and a single virtual machine) and as a stand alone network firewall. In the second scenario you can use 3 virtual machines (or 2 VMs and the host OS), simulating a client, a server and the firewall in between. The more virtual machines, the more is possible. Add one more and create a DMZ for example. It depends on how much time you have and how deep you want to go.


Someone searching "0x6461726b33636f6465" - what kind of exploit is this? Recently spotted someone searching:

  1 and 1 2 union select 0x6461726b31636f6465--

And a bunch of variations.  What type of exploit is this and what does it attempt to do?  I don't believe I'm at any particular risk, but it would be helpful to understand what the goal of the attacker is here so I can be sure since I've never seen this before.

Also, it's worth noting that searching "0x6461726b31636f6465" on google yields a ton of results.  Why would google be crawling and indexing a search term that clearly appears to be a vulnerability exploit of some sort?

It's an SQL injection and the "dark1code" is just a column value that the attacker intends to include into the result set. if the result of the SQL query is reflected in the response html page somewhere then the attacker can see that his injection is being reflected.


How to fix AWS security hole ALAS-2018-1045? I am researching about the security hole CVE-2018-12020 and learned that you need to update to min version 2.2.8 to fix the issue.

I need to fix this for my EC2. I read information from this offical AWS report, and it says that the security hole will be fixed after I run yum update gnupg gnupg2.

In new packages session:

i686:
    gnupg-1.4.19-1.29.amzn1.i686
    gnupg-debuginfo-1.4.19-1.29.amzn1.i686
    gnupg2-smime-2.0.28-2.32.amzn1.i686
    gnupg2-debuginfo-2.0.28-2.32.amzn1.i686
    gnupg2-2.0.28-2.32.amzn1.i686

src:
    gnupg-1.4.19-1.29.amzn1.src
    gnupg2-2.0.28-2.32.amzn1.src

x86_64:
    gnupg-1.4.19-1.29.amzn1.x86_64
    gnupg-debuginfo-1.4.19-1.29.amzn1.x86_64
    gnupg2-smime-2.0.28-2.32.amzn1.x86_64
    gnupg2-debuginfo-2.0.28-2.32.amzn1.x86_64
    gnupg2-2.0.28-2.32.amzn1.x86_64

Why does AWS only show as version in 2.0.28, despite of the first claim that the security hole will only be fixed when you update to 2.2.8? This confuses me.

Is it a package before (was affected by this bug) or after you update (AWS fixed for this bug)?

The confusion you are facing is that Amazon & RedHat back port fixes into their known stable branch, this is to say that

gnupg2-2.0.28-2.32

Really indicates gnupg2 core version 2.0.28 with revisions 2.32;

If I am understanding your question correctly, you should run: rpm -q gnupg2-2.0.28-2.32 --changelog and inspect the changelog to ensure the installed version contains the backported fix for CVE-2018-12020


How to attack a specific computer on a remote network? In a situation where I know the victim's public ip of their router, how does an attacker attack a specific computer in that network using something like metasploit? Because when using metasploit in the target address you either put the local ip of the victim if your attacking over LAN, or the public ip, but if more than one computer is connected to that public ip how do I attack a specific one?

Unless there's a port forwarded to that specific computer that the attacker can use, such an attack wouldn't work. The attacker would have to do the reverse, making the victim computer connect to the attacker's computer.


Is RDP secure enough? China/HK Access I have offices in China and HK and for local internet all fine. International connectivity is very slow indeed - not usable. They need to access a terminal server in the UK and do this by using SSLVPN to the UK. From HK it is very slow and China not usable.

So one solution is to buy in some international bandwidth (not cheap) or use a hosted server at a datacentre. The idea would be that they RDP to the server in the datacentre and then off that server use SSLVPN to the UK to use the application on the terminal server. I have tried it and it works ok.

My concern is the connection from the machine to the datacentre server only using RDP. I am either restricted by the great firewall of China or the hosting company.

Any thoughts if this is secure enough? I have changed the RDP port and also secured it down to certain IP's.

By default, RDP connections are encrypted using the RC4 stream cipher, which is not considered secure anymore.

If possible you should tunnel your RDP session through TLS or set up an encrypted VPN between your RDP server and your workstation.


WebSecurity and StrictHttpFirewall in spring Could somebody please demonstrate a small code for spring security for StrictHttpFirewall and Websecurity classes?
I want to defend against XSS attacks, SQL injections, be it POST or GET, on all the URLs.
Where should we instantiate and inject these beans?

All of the attacks you referenced can all be mitigated with user input validation.

Don't want your site attacking another site?  Then don't allow certain command characters so they can't construct scripts do to do.  Do explicit checking to search for commong behaviors for XSS.  Search for the  tags and Javascript code.

SQL Injection can also be mitigated by user input validation.  Make sure that if you're looking for a persons name in a variable, you're only allowing characters appropriate for the names you want (no extraneous characters:  <, >, $, %, *, etc.).  You can also help mitigate this by using a database user who has catered access to the tables in question:  SELECT and INSERT but not DELETE, etc.


Are open wireless networks unencrypted? When you connect to an open wireless network (that is, a wireless network without any symmetric password set) is there any sort of secure key exchange going on, or is data sent back and forth unencrypted and able to be intercepted by anyone "listening"?

Yep. Open wireless networks are entirely unencrypted; anyone can see all the data you send (even if they aren't connected to the network).


Can a file upload function be vulnerable without it the file name getting passed? From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the picture's content (file-contents: ‰PNG...... via post request) then display it on the browser like, as <img src="data:image/png;base64,.....> ?

Most definitely!
File uploads can be very tricky and there is a lot that can go wrong.  There are (at least) two further steps you should take:
1. Verify that the file is actually a PNG
If you are expecting only PNGs, then you should verify that the file is actually a PNG.  To be clear, checking the extension is useless here - you want to check the actual file contents themselves.  If you don't do this you open yourself up to a few potential attacks of varying levels of severity:

An attacker can upload a JS file.  This can help as part of a multi-step attack by bypassing a CSP or other restrictions.
An attacker could host their own HTML files/images/an entire website on your website, potentially making phishing or other attacks much, much easier.
Depending on your server setup, an attacker may be able to upload scripts and have your server execute them, compromising your system.

2. Make sure the file cannot be executed by the server
Even if you check to verify that the file is a valid PNG, this may not be enough to stop an attacker from using your file upload to upload and execute scripts.  In particular, most image formats allow for comments and meta data in headers.  It is possible to put actual code in these comments, and in the event of permissively configured servers, the attacker may be able to trick the server into executing it.  Most modern servers with default configurations will be immune to such attacks, but attacks like this are possible and definitely have happened.
Bonus: Host somewhere else
The most straight-forward way of mitigating the above attacks is by hosting your uploaded files elsewhere.  Most modern cloud providers have buckets that are a perfect use case for this (AWS, GCP, Azure), but you can always manage it yourself with a separate server on a different domain that only serves static files.  By hosting the uploaded files on a different domain you skip the risk of CSP bypass, and by hosting it on a server that is incapable of treating files as code, you don't have to worry about missed vectors for RCE.  In essence, by immediately transferring uploaded files to a separate system, you're putting them in a sandbox for safety.


How to transfer a database of usernames and passwords to a friend Caveat: I basically know nothing about information security, so I apologize in advance. I'll try to keep the question as general as possible.

I have a website X over which I have administrator privileges (someone else helped set up the website for me, though). There are users A,B,C on my website, with usernames and passwords.

I assume that somewhere in the infrastructure of my website, there's a:

Table of registered usernames
Table of encrypted passwords using a hash algorithm
Some description of what this hash algorithm is

My trusted friend (important, because the security problem isn't that he might be shady) is making a different website Y. He wants A,B,C to be able to log into Y using the same credentials that they use for X. This is just a one-time thing; if D joins my website X tomorrow, my friend doesn't care about having D be able to use his login credentials on Y.

However, not all of my users necessarily want to join Y, and I don't know a priori which of them do.

What information can I give my friend such that, if A and C want to log into Y with their X credentials, they can, but also ensuring that the information of B is protected?

Note: I understand fully that A,B,C shouldn't be re-using their passwords on multiple websites, but X and Y are related in some way such that it would not only be convenient for the users, but it would also just make sense for them to have the same login credentials.

What you are asking to do violates some foundational concepts of security, so I am advising against a technical solution.

Credentials are meant to validate a user against that trusted asset. Passing those passwords to a 3rd party breaks that trust (even if you trust the 3rd party, your users do not have that chance). If I was one of your users, I would be very, very angry. What you propose is called a "breach". You are exposing a user's passwords to a 3rd party without their consent.

Even OAuth allows the user to specifically state what service they want to log in on, giving the power to the user.

The best solution is to simply invite the users to create a new account on the 3rd party service, and there are lots of ways to make that streamlined without disclosing your user's passwords. Like sending a pre-filled account creation link for the new site.


PFX file without import password? Is it possible to create a pfx file without import password? Or is it possible to remove the import password from pfx file that I've already created?

Is it possible to create a pfx file without import password?

Yes, it is possible:

openssl req -x509 -newkey rsa:4096 -keyout PrivateKey.pem -out Cert.pem -days 365 -nodes

openssl pkcs12 -export -out keyStore.p12 -inkey PrivateKey.pem -in Cert.pem

  Or is it possible to remove the import password from pfx file that
  I've already created?

Yes, it is possible:

openssl pkcs12 -in old.pfx -nodes | openssl pkcs12 -export -keypbe NONE -certpbe NONE -out new.p12

Conversion from .p12 format to .pfx format is possible by just renaming the file.

Hope that helps!


Password checking in the context of symmetric encryption It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that.

I played around with 7-zip, which uses AES-256/CBC. I encrypted a bunch of files and deliberately corrupted it zeroing a couple of bytes. I observed that, as expected, the earlier I zeroed the bytes, the more files would be corrupted.

I also noticed that supplying an incorrect password wouldn't stop decompression at all. Only after decompressing the entire archive, 7-zip would report the password might be wrong. Since it saves checksums of the files, it can tell if they're corrupted. This makes sense.

Now enter Adobe Acrobat X. I encrypted a PDF (AES-256 again). To my surprise, corrupting bytes in the encrypted file seemed to have no observable effect on the result. Note that Acrobat X encrypts metadata as well, and I edited something well beyond where I'd expect metadata to be anyways.

I was still able to see the read the whole file. I then removed the password from both the original and "corrupted" files and did byte by byte comparisons. I noticed that besides some address ranges where I presume metadata is stored (since they differ every time I decrypt the same file), there was only a single block where 16 bytes (coincidentally AES' block size) are different.

Acrobat also seems to be able to verify if a password is correct without attempting to decrypt anything, implying it has a hash of it (or something) stored somewhere.

Does it make sense to do that (verify a password or key is correct without attempting decryption)? Wouldn't that make it easier for an attacker to bruteforce the password?
Am I correct in guessing that Acrobat uses ECB? Is there an advantage to it?
How do AE modes behave when it comes to:

Verifying a key is correct before decryption is attempted
If a byte of ciphertext is corrupted accidentally, how does that affect what comes after it?

If the encryption scheme uses CBC and you alter one bit of the encrypted data, then, upon decryption, this will have two effects: it will garble the corresponding block, and it will flip the corresponding bit in the next block (16 bytes further, with AES). It will not alter the rest of the data. This is quite unlike to what happens if you flip one bit of the clear data, when encrypting: that one would alter all the subsequent blocks, till the file end.

For other modes, things vary. Flipping one bit of encrypted data just flips the same bit of the clear data with OFB and CTR modes. With ECB, it alters one block exactly. With CFB, it will modify all subsequent blocks.

For the authenticated modes, CTR is often used internally (e.g. with EAX) but the point is moot because the integrity check will detect the alteration and report it (it is still up to the application to get rid of whatever it decrypted in that case).

Including an explicit password check is customary (e.g. OpenPGP does it) and it does not weaken the encryption, if done properly. Basically, the password must first be slow-hashed (with a salt), and then a hash of the resulting key is used as checksum. In any case, no sane attacker will decrypt the whole file for each password that he tries: he just decrypts the first two or three blocks, to see if he finds a realistic-looking file header. We cannot rely on decryption speed as a substitute for the slow hashing.


Bus smart ticketing systems and EMV I have recently started to study the smart ticketing systems. Most of the modern systems support the use of EMVCo standards for buying tickets in the bus. Also, in each bus usually there are more than one devices from which a passenger can buy a ticket.
In my opinion these devices exchange data related to the bank cards, e.g. the validator must send some data to the main pc in the bus (on board unit, obu) when a passenger buys a ticket, and of course all the data are sent to the back office.
I think that these data must be encrypted to prevent eavesdropping.
Does anyone have any idea if there are any standards that specify the type of this encryption?
I ve read about PCI standards and point to point encryption  but I am not sure that these are applicable in smart ticketing systems.

As far as security goes, there's no specific standard that I'm aware of. Smart ticketing systems are a varied bunch, but they usually consist of:

Some sort of passenger identifier, e.g. an RFID / NFC card or device.
A point-of-sale (PoS) device, such as a scanner on a bus or in a station.
A communications link between the PoS and the back-office.
A back-office system which processes the transactions, maintains balance and customer information, and interfaces with the payment gateway.

Most importantly, card details are usually taken ahead of time, and are usually stored only in the back-end system.

The specific configuration is largely dependent upon the transport type. While a metropolitan bus service could operate a 3G cellular link back to the office, a cross-country train may have more difficulty in rural areas where cell towers are few and far between.

The normal mechanism that I've seen is that the list of valid card IDs is synced onto all PoS systems periodically (e.g. via WiFi at a station) so that individual cards can be identified as "valid" without having to call home every time someone swipes in. Each transaction is locally cached and then transmitted when a connection is available.

The security of the actual communications is entirely up to the implementation. It may rely entirely upon data-link layer encryption (e.g. WPA2), transport layer security (e.g. TLS), or may implement its own application layer security.

Of course, in the case of systems where contactless payments are performed at the PoS, the PAN may well be transmitted, and as such the communications (and PoS device) will become part of the PCI domain.


Identify a user using random characters of the password Assuming a password is not stored in plain-text, how is it possible that a support guy is able to identify during a phone call a customer by asking him random characters of his password?

For example, if the password is "password", the support guy asks for the first and fourth characters, the customer says 'p' and 's'. At this point, the support guy considers he's speaking with the legitimate customer.

The only solution that comes to my mind is that they are using plain-text passwords, but I hope that's no the case and that there is another solution, because it's a bank...

PS: It's a real scenario, no a phishing attempt.

EDIT: as Matthew said, without having access to their system is impossible to know what is going on. The goal of my question was to known if there are any known "public" methods to achieve this, not a custom made algorithm.

The point of a cryptographic hash is to not be reversible, so they can't be getting it from that.

It's possible they pick out and store a few characters from the password when it's set, so customer service knows what characters 1 and 4 are, but not 2 or 3. However, I'd strongly suspect they're storing the password in reversible encryption, because that's much simpler of an explanation, and banks aren't known for having great information security practices.


How to prevent reflected XSS with the Java Struts Framework? I have an application that executes under Jboss server.
I have an Apache server in front.
My application contains a security vulnerability (XSS Cross-site scripting).

I wanted to know that I had to make changes in the code (HTML, JavaScript, Java, ..) ..?

How can I secure my application? do I set up js frameworks to secure it?

What kind of XSS vulnerability is it ?

Reflected

How is it introduced and what is the context ?

Introduced by modify my url

What Java frameworks are you using ?

Struts 1

XSS is performed by the HTML code, which was introduced by a third party and is performed by the application. In the following example to call added a postscript   alert (1)  . It was made on the application side.

As far as I understand, you have a reflected XSS on a JSP page (the question does not fully specify which technology but JSP is a pretty good bet if you use Struts 1)

Your solution is therefore most probably to surround the potentially dangerous data with the standard

<c:out value="${dangerousData}" />

tag, which escapes XML content (and therefore eliminates your nasty XSS)

Also, the standard

${fn:escapeXml}

function provides equivalent security.

You have to use the right one depending on how you actually use the data. If you simply display the data, use c:out.

====== Update after OP's comment =====

This solution works. Let's take an example : you have a JSP with the following line, which is XSS-prone :

Hello, dear ${username}

the ${username} variable is replaced by the content of the username parameter in a request (typical reflected XSS).

So the request www.yoursite.com/somepage?username=

would indeed prove the effectiveness of the XSS, with an alert box popping as a proof of concept.

If you replace your code with the following (as described in the solution) :

Hello, dear <c:out value="${username}" />

, the  would be displayed on the page and would not be executed, therefore making your users safe.

This is the best-practice when dealing with XSS given your technology choices.


Why does a spam sms contain a link to an email address? A colleague of mine just received a (spam) sms with this message:

  Congratulations! Your mobile have won $1,000,000,00 Pounds with Draw#
  294 64/2013. For more info & claims, contact our office on:
  mobilelotterydept101@rogers.com@

The smartphone automatically makes a link of the email address ofcourse. (up to the last @ sign, which seems a typo or scripting error)

What is the point of this? What do the people sending this spam message hope to gain?

Once you reply to the email address they will most likely try to phish more information from you, such as bank account number to transfer the money, name, address, card expiracy date, codes and more. This could of course be automated with a script replying to anyone sending email to that address.


What kind of security is needed for simple REST API on Amazon's AWS I am envisioning a simple REST API for my app only that essentially functions as a proxy server for some organization's API. Thus, no sensitive information is stored or available through the my API.

Critically, the information must be constantly available and accurate. It does not need to be kept confidential, as it is public information.

Amazon AWS is comparatively cheap for private hosting, but I worry that I am not addressing security concerns because I do not know what such concerns would actually be.

By security, I mean anything that has to do with protecting my server: some sort of firewall, strong password (of course), 2-factor authentication... I do not know what else.

Are there any security issues I should address for this simple REST API without sensitive data on AWS?

As the most basic security principles, you need to consider the CIA triad: Confidentiality, Integrity, Availability.

Your say that the information hosted on the site is public information, so confidentiality to your company isn't priority. However, you need to consider also the user's perception of confidentiality might not necessarily be the same as your company's perception of confidentiality. Even though is public information, many people don't want their browsing habit to be tracked for various reasons, many people are searching publicly available information about medical issues they might consider embarrassing, maybe an LGBT still in the closet don't want anyone to know they're browsing certain sites that might tip other people off, maybe a husband want to hide his researching for a surprise vacation plan research from his wife. Modern best practice usually considers this to be too difficult to evaluate properly since you can't always guess the motives of your users, so end up just encrypting everything with HTTPS.

How about Integrity? How important is it that the public knows that this data is published by you, and not have been altered by any other entities? If integrity is somewhat important, then you should consider using HTTPS, and possibly also publish cryptographic signature of the data you published. How important is it that the user knows that the data is up to date? You might want to add signed timestamp of the data publication date, to ensure users can tell if they're setting outdated data (replay attack), in sine circumstances, you might even want to notarize the timestamp by publishing the hash of the data in, say, Bitcoin's blockchain.

You suggested Availability is important. Availability risks that you need to consider is attacker doing a DDOS attack to overwhelm your site, or for the attacker to trigger account lockouts by using incorrect passwords. For basic availability, you'd want to implement firewall and monitoring and alerting systems, you'd want to ensure legitimate users have a way to reset account lockout that the attacker won't be able to do. How important is it that the data is available in case of deliberate censorships like say Great Firewall of China? Depending on the level of availability that you are targeting, you may want to consider using a network of mirrors, CDN, Tor, or Freenet to distribute the data.


Why does my bank use this verification method? I hold my business account with Lloyds TSB [UK] and the process for logging in to their online banking service(s) is as follows:

Login page
Enter customer number
Enter password
Put debit card into their card reader
Put in PIN for the debit card and press 'identify'
Enter 8 digit code generated to complete the login

After three wrong attempts the account is locked until they send a letter out with unlock information.

I understand banks have to be very secure, but surely it would be more secure (and simpler and cost effective) to have two [long] passwords of which it asks for certain characters?

Edit: Furthermore. This card-reader device is only a cheap, light, calculator-style reader. I don't see how it could possibly connect to the internet for verification, which means it can determine whether or not the inserted cards PIN is correct. Surely the software on the reader could be exploited to obtain a card's PIN?

Login page
  Enter customer number
  Enter password

So far, this is what you're used to: username & password.

  Put debit card into their card reader
  Put in PIN for the debit card and press 'identify'
  Enter 8 digit code generated to complete the login

This is a second factor. The algorithm for generating this number is shared by the bank and your card. The secret is stored with the bank and also in your card. The computer uses the current time as a seed (I assume it is connected). From this, even if one does compromise your machine and sniff your password, they can't use it without the hardware card. The hardware device doesn't report the number back to the computer, so it can't be automatically called if you leave the card in the system.

It would be less secure to use two passwords and pick random characters. The bank I reference in talking about what constitutes two factor security used a method something like this -- multiple passwords that weren't all used at the same time. An attacker monitored the customer's computer over a period of time and walked with a lot of money.

From this, losing your card doesn't compromise your account. Somebody has to physically collect your card, so an attack can't be entirely remote. Somebody can't pick your card up off the street and access your account. They still need an account number and the password. Unless you lose your card with your account number and password written on it (to be straight-forward, we consider this the building a better idiot problem), your odds of compromise are much lower than with just a pair of passwords.


What are the best Nmap Scripting Engine (NSE) service discovery scripts? Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535.  To narrow your results and enumerate interesting services the wealth of NSE scripts can be very helpful.

So what are your favorite NSE scripts for service discovery?  What scripts do you use to boost your signal and reduce noise in your scan results?

A good example is smb-enum-users.  Having udp 137 open isn't always a problem,  but being able to identify information about this service is very valuable.

I think the whole NSE system serves to boost the signal-to-noise ratio of Nmap scans. Most scripts will avoid producing output if they have no useful information. If you're talking about vulnerability discovery, then any of the scripts in the "vuln" category will be useful. A couple points of clarification that may help you use Nmap and NSE more effectively:

Many scripts will not run properly if version detection (-sV) is not performed first. Version detection provides extra information that is used by NSE to determine whether to run a script on a particular host or port. -sV will run all the scripts in the "version" category. Scripts, even in other categories, can also update version information. The two systems are complementary.
If -sV is too verbose, consider saving your results in XML format (-oX or -oA) and using a results viewer like Zenmap, Martin Swende's onepage result viewer, or even your web browser (with XSL support) to drill down to the information you want.
Scanning all 65536 ports (yes, 0 is a valid port number!) is usually overkill, especially with version detection. If you are doing this for assurance of network state, consider setting up a periodic scan (just ports) and using Ndiff to see changes. You can choose to do a more thorough version detection scan of any new ports that show up. For general network discovery, the top 1000 ports (default) are usually plenty to check.

It's important to note that lots of scripts will not run by default, even when requesting a script scan (-sC). This can be because they require more input (via --script-args) to run (xmpp-info), or because they are not considered "safe" enough or they are too verbose or slow to run by default. An example would be ssl-enum-ciphers, which used to be very time-consuming to run. I spent some time increasing its efficiency, but it still is too "intrusive" to be in the "default" category. Reading through the NSE documentation portal (or at least searching for scripts that apply to a particular service) can yield some real gems.


Is using Transit Wireless unsafe? When connecting to the New York City Subway's new Transit Wireless service, my iPhone raised these warnings:

Is it dangerous to use this service? Is it really just a normal unsecured wireless network, or is there some security here that iOS is just unaware of?

When you connect to an open public wifi network without any security settings such as your local Starbucks, everything transferred over that network is sent in plaintext. Anyone sniffing the network could intercept the traffic, and potentially modify it. If you're connecting to one of these networks, it's best that you then connect to a VPN to encrypt your traffic so that it can't be captured or modified.


Is this considered DOM-XSS or self-XSS or both? SCENARIO:

A web page shows an error login page using these javascript lines

<script>
    let queryParams = new URLSearchParams(window.location.search);
    document.getElementById("message").innerText = queryParams.get("message");
    let link = document.getElementById("link");
    link.innerText = queryParams.get("linkText");
    link.href = queryParams.get("linkUrl");
</script>

The last javascript line allows me to hide javascript inside a link in the web page crafting an url like the following.

https://vulnerablewebsite.com/folder/custom.html?message=not+correct?&linkUrl=javascript:alert(1)&linkText=click+here+to+shine

1) the user click the shortened version of this link

2) the user click "click here to shine"

3) the alert opens

I was inspired by this article on portswigger
https://portswigger.net/web-security/cross-site-scripting/dom-based
in particular from this example

  If a JavaScript library such as jQuery is being used, look out for
  sinks that can alter DOM elements on the page. For instance, the
  attr() function in jQuery can change attributes on DOM elements. If
  data is read from a user-controlled source like the URL and then
  passed to the attr() function, then it may be possible to manipulate
  the value sent to cause XSS. For example, here we have some JavaScript
  that changes an anchor element's href attribute using data from the
  URL:

  $(function(){ $('#backLink').attr("href",(new
  URLSearchParams(window.location.search)).get('returnUrl')); });

  You can exploit this by modifying the URL so that the location.search
  source contains a malicious JavaScript URL. After the page's
  JavaScript applies this malicious URL to the back link's href,
  clicking on the back link will execute it:

  ?returnUrl=javascript:alert(document.domain)

QUESTION:
to me they look the same kind of attack but someone told me it is a self-XSS. Anyway I read that self-XSS expects the user to self-paste javascript code in his console. So I'm confused and I'd like to know which type it is. Also, can be considered a vulnerability of medium/high severity or not?

I would call it a DOM-based (reflected aka non-persistent) XSS requiring user interaction.

It's not self-XSS, because self-XSS is just a way to call a specific type of attack where the user actually injects the code themself, typically by copying and pasting the malicious code directly into their browser JS console. Self-XSS is actually a social engineering attack, rather than a real XSS vulnerability. Apparently in the past self-XSS could also be achieved by tricking a victim into running malicious code in the address bar, like javascript:somethingMalicious(); but that's not possible anymore in some browsers (I just tested it in Chrome, it doesn't work). However links like  still work when you click on them.

The severity of your vulnerability depends on several factors, and you might want to consider CVSS to try to estimate it, although I'm not really a fan of those scoring systems. With CVSS version 3.1 and these parameters ( AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N ) you would get a score of 4.3, for example. Note that I don't know anything about the details of your vulnerability, and that I just supposed the attack complexity was low, user interaction was of course required, confidentiality impact was low, and no impact on integrity or availability. If you set the confidentiality impact to high, and attack complexity to high, you will get a score of 5.3, for example. Only you can know if those numbers are meaningful or not. Sometimes it can be very difficult to estimate the attack complexity and the impact of user interaction.


web services: how prevent illegal accesses As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate).

I want to prevent unwanted accesses from others that know the urls of my web services.

I use a "secret key" that the app must provide to the web service method, but it's stored in a constant variable inside the code and I know this is not the best solution to ensure security.

What's the best way to achieve the definitive solution?

You need to define with high precision what it is that you exactly want.

Here, you want to allow accesses from you, personally. The business with the secret key means that access will be granted to whoever/whatever knows the secret key. Embedding the key in the application means that the application knows the key, not you; and, as you note, secrets embedded in a widely published application are not really secret.

So, you have to be clear with yourself. First of, define who should be granted access, and by "who" I mean "the humans". Every human in this set should "know" a secret value which is used by the server to authenticate the said human. If several humans use the same secret value, then the management of this secret becomes complex, because you cannot enforce forgetfulness: you cannot evict a user from the set of people who "know the secret" because he will remember it nonetheless.

Therefore, you should have user-specific secrets. Each human should have his own secret value, and send it to the server to be granted access (since we are talking about sending secrets over a network, I assume that all of this happens under the aegis of SSL). Then comes the question of how technically a user will store his secret value. If he stores it in his head, and make it available to the application he uses by typing it when required, then this secret is a password. But other models are possible, e.g. the secret could be a bunch of randomly generated bytes which the user stores in a file along his app.

You cannot prevent a user who has access to your server from "sharing" that access with anybody else; but with user-specific secrets you can at least:

know on the server who is (allegedly) connecting, and thus modulate the set of operations which the server will allow or disallow;
evict specific users, by removing the secret server-side, without impacting other users.

What you cannot do is to have an app that everybody in the world could download and install and use to access your server, while reliably preventing any access which did not use the exact app that you published. This would be the Holy Grail of piracy prevention, and it proves as elusive as its theological counterpart.


How can I secure a network share from the insider threat? We have a network share that contains thousands of files. I am concerned that anyone with access to the internet could copy that information to a CD.

In addition to disabling all removable media, what else could I do to prevent someone from stealing our data?

If you want to prevent an insider from stealing your data, I'd guess you have only one strong defense: don't give them access to the data.  In other words, use access control to limit their access to the data.  If the insider has access to all the data, prevention is really hard.

One alternative is to detect signs of such misuse: e.g., where someone has accessed far more data than you would expect they would legitimately need for the purposes of their job.  Detection is imperfect, and doesn't necessarily provide any great way to recover from such a leak, but it might provide some deterrence.


Determining if company is considered a business associate under HIPAA? I am trying to clearly understand the HIPAA regulations a court reporting company must adhere to.

Let's say the court reporting company does not directly contract with any covered entities but does contract with law firms who would be considered a business associate of the covered entity. Would the court reporting company also be considered a BA of the covered entity because they do work for the law firm? Or would they be considered a BA of the law firm itself? If that is would the HIPAA requirements of the court reporting company change at all?

Also, being that the court reporting company only works directly with the law firm which is a BA of the covered entity is the law firm required to have the court reporting company sign a business associate agreement?

I am just trying to understand this process better. Any help or feedback would be greatly appreciated.

Thanks in advance!

IANAL, however as far as I understand it, it would depend if the court reporting company received access to any HIPAA protected information or not.  You do not get a business association for HIPAA purposes unless you are exchanging HIPAA protected data.  If you are, then you need to follow the BA standards for protecting the data assuming you don't otherwise do anything with the data that requires further levels of protection.


Does CORS interact with WebAssembly the same way it does with Javascript? Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary web language standardized in 2019; webassembly.org, wikipedia/WebAssembly) gains popularity, I'm curious if my CORS:Javascript knowledge transfers over cleanly to CORS:Wasm, or if CORS has different behaviour and "gotchas" with Wasm?
For example, from the Mozilla docs:

Cross-Origin Resource Sharing (CORS) mentions javascript a bunch of times, but not Wasm.
From the docs, it seems like CORS applies to the browser APIs XMLHttpRequest and Fetch API, and I'm not expert enough to know if those are javascript APIs and I need to go looking in Wasm API docs for the Wasm equivalents, or if those APIs are low-level enough that they are common to JS and Wasm and therefore Wasm inherits exactly the CORS that I know and love.

It looks like Same-Origin Policy (SOP) applies to web assembly modules.  See https://webassembly.org/docs/security/, where it states:

Additionally, each module is subject to the security policies of its embedding. Within a web browser, this includes restrictions on information flow through same-origin policy.


What is the difference between "full" and "ultimate" trust? When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools):

  1 = I don't know or won't say (undefined)
   2 = I do NOT trust (never)
   3 = I trust marginally
   4 = I trust fully
   5 = I trust ultimately

If you look at the options as "variables" used for "calculating" validity, never, marginal, and full are all clear. However, if so, I'm not sure how ultimate fits into the picture during the calculations.

What is the difference between the last two in the list?

Ultimate trust means that the key is allowed as introducer in the web of trust. This means, if a key is ultimately trusted, all certified keys are considered valid, no matter if there is a trust path to the ultimately trusted key. This does not require you to posses the private keys, but you usually will do.

Full trust (by default, this can be adjusted) also makes keys certified by the fully trusted key considered trusted, if and only if the fully trusted key is valid itself (thus, there is a certification path from an ultimately trusted key).

Marginal trust works similar to full trust, but requires multiple incoming certifications from other marginally valid keys.


Why doesn't Google uninstall or report, installed pirated apps? Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users.

You could go to a website and download an apk for an app which you normally pay for in the play store. After installing the app, it appears as “installed” when you go to the Google Play app and browse to it’s page, so Google must know you have it installed and would also know you didn’t get it through them…so it seems like a simple conclusion you pirated it. Why doesn’t Google do anything about this? It even allows the pirated app to be updated, which I think happens with through the Google Play service.

I guess one could argue they make it this way so that app owners can sell their product not through the google store, but it still seems like it would be easy for Google to send a message to the owner being like “hey, this guy has your app and he didn’t download it through us” and the owner knows you didn’t download it through them, and then you’re caught.

TL;DR Google seems well aware of all apps installed on the phone, and since 99% of the time google is the only source it seems like an easy way to catch pirates. Why is it still so prominent? I’m assuming it has to do with laws.

Android is an open source system. Its the users choice what to do. If he wants to install pirated apps google will not stop him. If google would, the users would disable google play and youre still not blocking pirated apps.


Application of Bayesian network for Web Application Security How can a Bayesian network be used to perform attack analysis of web traffic?  I read an interesting article on its application. "Web Application Defense with Bayesian Attack Analysis" but I was not clear about its methodology.

Bayesian networks are a form of probabilistic model, whereby a set of conditions can be used to predict whether an assertion is true or false.

For example, let's suppose there are two conditions we are using to predict whether a disk is dying.

Disk writes are slow.
Traffic is abnormally high.

We might formulate the probabilities like this:

  Slow Writes | High Traffic | Disk failing?
--------------+--------------+-- T --|-- F ---
      F       |      F       | 0.05  | 0.95
      F       |      T       | 0.01  | 0.99
      T       |      F       | 0.90  | 0.10
      T       |      T       | 0.45  | 0.55

This can be interpreted as follows:

If writes are not slow, and traffic is not high, there is a 0.95 probability that the disk is not failing.
If writes are not slow, and traffic is not high, there is a 0.99 probability that the disk is not failing.
If writes are slow, and traffic is not high, there is a 0.90 probability that the disk is failing.
If writes are slow, and traffic is high, there is a 0.55 probability that the disk is not failing.

We can take this type of model and apply self-learning to it. We take a large set of data where the outcomes are known, and use this to build a probability model.

For example, in a network we might have tests such as:

>10Mbps TCP traffic coming from internet?
>10Mbps UDP traffic coming from internet?
>5 failed logins to RDP in last 10 minutes?
>5 failed logins to SSH in last 10 minutes?
Number of TCP connections to SQL server is >5?
Number of TCP connections to HTTP server is >500?
Firewall has logged >100 events in the last minute?
Time is currently within office (9-5) hours?
etc.

We run these tests over a set of known traffic on the network, and inform the model of times where a breach has or has not been attempted. It can then check which tests were most likely to correlate with a particular type of target event, and build a probability model like we did above.

When we detect further breaches, we tell the model "this was a breach", and it can attempt to improve its model. We can also tell it when it falsely alerted us to a breach.

These models can become extremely complex when dealing with large numbers of question and huge datasets, especially when the model contains test questions that are fed from sub-models, or other forms of analysis. As such, they can provide an excellent pattern-matching approach to intrusion detection.


How to detect & prevent fake emails? I hope this question not same as this one:
E-mail can be made to appear like it came from a big organization?

I'm not asking how to protect brands and large organizations (Google, Yahoo, etc.), but how can normal users protect themselves.

As far as I know there are worms that can get an email's address books, and there are programming libraries that enables users to craft packets .

By using both (stealing the address and crafting an email packet and send it to the right server), a malicious hacker should be able to send the victim an email that will look like it came from one of his friends (asking for money for example).

So beside the typical way, (calling the one that the hacker claimed to be), is there a technical way to detect such fake messages?

Your description is not quite accurate, but the outcome is the same: email messages that look authentic enough to fool recipients can be sent. Note that a common way for this to occur is for the attacker to actually gain access to the senders email service - so the fake email would be identical to a real email in every aspect, except for the person composing it.

I'm pretty confident there is no reliable way to detect such messages. You can certainly apply a battery of measurements to account for email frequency, use of language, and other variables, but I don't know of anything good enough to put into widespread use. Also, if anyone had created such a system, they would have released it already and enjoyed their hundreds of millions of dollars in earnings.

The most reliable option is for the recipient to question the sender via a different channel if a suspicious or unusual message is received.

Example 1: I get an email from my friend jane@email.com asking for money. Suspicious, I text her, and she replies that the email is authentic.

Example 2: I get an email from service@fedex.com requesting credit card details to deliver a package that incurred extra costs. I look up the phone number for my local FedEx office and ask them, and they reply that there are no packages for delivery to my address.


String sql injection vs sql injection What's the difference between normal sql injection and string based sql injection?
An example would be appreciated.

As far as I understand from the few readings around the net, string based sql injection is somewhat similar to blind sql injection in that, the sql injection occurs but a valid page is returned and we cannot see the result of the query. But, based on string sql injection we can force the webpage to return an error and the result of the query will be revealed with the error message! can anyone confirm this, and give and example.

EDIT: some of the websites out there are defining the terms as explained above,
check this http://zerofreak.blogspot.co.uk/2012/03/tutorial-by-zer0freak-difficulty-easy.html?m=1
but this doesn't seem to be valid!

Edit: in light of OP's reference to Blind SQL Injection

I can't see any way in which "string based SQL injection" could be interpreted specifically as a form of blind SQL injection. Blind SQL injection can occur on any data type, not just strings. Of course it can be string-based, but no more so that normal SQL injection can.

Admittedly, there are at least a couple of articles online but I believe these have confused the term. E.g.

http://zerofreak.blogspot.co.uk/2012/03/tutorial-by-zer0freak-difficulty-easy.html?m=1
http://youtu.be/JezijO2mPh8

Articles from more reliable source like OWASP don't seem to make any link between the terms "string based" and "blind", but please feel free to correct me. Furthermore, your question seems to describe what is known as Error-Based SQL Injection which isn't blind, nor is it specifically "string based".

Nevertheless, here is my original answer that covers SQL Injection of strings in comparison to other data types...

This comes down to where the vulnerable parameter is being injected; more specifically, whether it's being injected inside quotes (a string) or otherwise (e.g. integers, timestamps etc).

For example, consider the following URL:

http://www.example.com/search?id=23&txt=my+search+string

Now let's assume that these feed into a query dynamically via PHP as follows:

$id = $_GET('id');
$txt = $_GET('txt');
$querystring = "SELECT * FROM items WHERE id = $id OR txt = '$txt'"

If $querystring were then to be executed in SQL, in this case both parameters would be vulnerable (they have been concatenated without validation or sanitisation).

However, the txt parameter is contained within quotes ', meaning that in order to execute arbitrary SQL statements, you would first need to escape the string by including a ' character (i.e. we end the string ourselves so that our SQL is included afterwards). This is because anything inside the quotes is part of the search string, and therefore won't be executed.

For example:

http://www.example.com/search?id=23&txt='+OR+1=1--

This would result in a $querystring that looked like:

SELECT * FROM items WHERE id = 23 OR txt = '' OR 1=1--'

So we've 'escaped' the string by injecting our own '. Therefore, this case relies heavily on being able to include the ' character.

Whereas the id parameter just needs some whitespace:

http://www.example.com/search?id=23+OR+1=1--&txt=my+search+string

...

SELECT * FROM items WHERE id = 23 OR 1=1 OR txt = 'my search string'


Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows? EFS is not an option for me because I'm using Windows 7 Home Premium.

I am looking for folder encryption, not drive encryption.

I don't know if this is possible in your context, but I'd say that you want to use Container-based encryption.
That way you create a container file (using VeraCrypt/TrueCrypt/BestCrypt/...) which you mount as a new drive afterwards. The mounted drive can be used transparently for data accesses.
If you can't move the folder you want to encrypt, than you can still use container-based encryption, but add a junction point pointing to your encrypted (virtual) drive.


If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen? I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to factor the primes using 8 hours of cloud computing). But what if the server only has a single 2048-bit RSA Private key on the server? Wouldn't that make it protected from the attack?

The RSA "export" cipher suites can work a bit like ephemeral Diffie-Hellman: if the server's "permanent" key is longer than 512 bits, then the server is supposed to generate a new one (dynamically) of length 512 bits, and send it over the wire as a ServerKeyExchange message, signed with its permanent private key. See section 7.4.3 of RFC 2246. The private key you see (your 2048-bit key), the one that is stored in a file or some sort of certificate store on the server, is then used only for signatures; actual key exchange (encryption of the random pre-master secret with a RSA public key) happens with the temporary RSA key that the server generated.

Note that while the server may generate a new 512-bit RSA key pair for each connecting client, it will usually not do so because of the involved CPU cost (it is possible to generate RSA-512 key pairs quite quickly on modern hardware, but the support code for export cipher suites is more than 15 years old and is unlikely to have been optimized over the years). Therefore, many servers that still support RSA export cipher suites will generate a new RSA-512 key pair upon start, and then use it for all incoming clients that want to use such an export cipher suite. The so-called FREAK attack is made somehow practical because of that reuse: it allows the attacker to spend the 8-hour breaking effort before engaging in an actual Man-in-the-Middle (because the victim, a random Web user, is unlikely to wait for 8 hours that his SSL handshake completes).