Using SUID program to avoid having entries in sudoers Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for my problem.

We're currently developping a Qt-based tool on Ubuntu for upgrade/rollback management of our main application.
So as you might have guessed, the said tool is making extensive use of apt install/purge and dpkg commands, that happen to be executable only with root privileges, which the tool does not have, as it is meant to be executed only within the limited-privileges user's context.

To circumvent this limitation, the team has chosen the most straightforward solution : adding appropriate entries in the user's sudoers file for the aforementioned commands.
BUT, as far as I know, this opens up a dangerous vulnerability in the system, as an attacker who would gain only limited access to the machine might then remove important components of the underlying linux system (systemd for instance), thus making the system crash.

As I'm the only cybersecurity engineer in the team, I'm trying to find the safest and most recommended way to mitigate this flaw, but so far could think of only one alternative : turning the upgrade tool into a SUID program.
The thing is : SUID programs have a nefarious reputation when it comes to privilege escalation vulnerabilities they might expose on the target system (see here for a checklist of all the considerations to implement in order not to mess up everything when writing a SUID program).

The question is : is going through this painful process really worth it ?
Is there any other way we could safely use apt/dpkg commands without all the hassle of SUID implementation, and without making the upgrade tool run with superuser mode ?

Note: a lot of questions on stackexchange cover SUID related concerns, but none actually discusses the specific usecase we're dealing with.

In summary, you mention two possibilities:

adding sudoers entries for apt-get, dpkg, etc. – yes, this sounds dangerous
making your application setuid root – yes, this is a problem; even more so if there's a code path where it doesn't drop privileges very early during execution

There are at least two other options that I can think of:

Write a small setuid root wrapper around the dangerous commands

You can have a small wrapper application which validates how it is being called, only allows operating on a small number of predefined packages, etc. This doesn't remove the liability of having a setuid root application in the first place, but it does greatly limit the attack surface.

It doesn't even really have to be setuid root; it could also be allowed to be executed via sudo. (Though sudo or setuid root doesn't significantly change the attack surface.)

Use a custom dpkg root

This might be the easiest approach. dpkg accepts --root=<somepath>, which is an alias for specifying --instdir  and --admindir. If those two directories are writable by the user, then they shouldn't need root access to work with packages within those hierarchies.

Since by default the tools will only look in the standard locations, your packages won't show up in a standard package listing, system upgrade, etc.; but your management application could presumably take care of that.

The only real downside of this is that it allows the user to mess with their own installation of the software. However, you could in principle use user account separation to reduce that attack surface.

Of these options, unless there's a good reason not to, myself, I would probably go with the custom dpkg root, especially since you already have an application that's going to handle most of the gory details.


Is password generation adherent to a primitive pattern insecure? A certain website I use has a section the password to which is e-mailed to you. I'm not involved with administrating it, but I've been able to discern the algorithm used for password creation. It uses fixed-length passwords coming from a fixed charset which is then shuffled (and no character appears to appear more than once).

Here are some passwords generated using this method (some which I received):
74YRAkghvq, 499Jyvnpjz, 344WXptyit, 4AVEMzdrtp, 379Ecwuyxt.

From where I'm standing, these things just scream insecurity harder than a Hummer SUV in an urban setting. There's not much on the lockout process side either.

Am I correct in my assumption?

Edit: people are asking for a threat model - those passwords aren't one-use, they're mostly allowing repeated usage and login attempts, though, yes, it is advised on the website to change them (but can you really be sure...)
So, the threat model is as follows - the attacker requests a password change and utilises bruteforce capabilities (there isn't even a captcha!) to gain access to the user's account.

This looks like a programmer doesn't understand what makes a password strong. Perhaps thinking: Everyone else requires lowercase, uppercase, at least 2 numbers, and at least 10 characters total.
Website admins have trained users to think about password security the wrong way. Between the way websites deny registration based on password rules and the way other websites tell users how secure ("billions of years") their password is based on a naive formula, it appears to typical users that appending a 1 in a password that doesn't otherwise contain numbers automagically makes it much more secure.
These samples look like they were generated using a similar mindset. However, it may be the case that the programmer didn't have the option to change company password policies and decided to use the easiest password for users to enter.
Especially for mobile users. Switching keyboard layouts between letters and numbers adds an extra input that can make entering passwords tedious and error prone. You could go further and generate passwords with only lowercase letters (except for the first letter being case insensitive). Reducing the character set would require making the password longer, but the longer password would still be easier to type.)
Assume that individual characters are uniformly distributed (with different character sets) and independent. You can get a conservative estimate of the password's strength by simplifying the pattern to the following rule.

Three digits (Excluding 0 and 1)
One uppercase letter (Excluding O, L, and I)
One uppercase or lowercase (Excluding O, L, and I)
Five lowercase letters (Excluding O, L, and I)

The number of possible passwords generated is then 83 * 231 * 461 * 235. About 241.6 or three trillion passwords. That's not a strong password for cryptographic key derivation and won't stand up to offline password cracking, but it's okay for rate-limited online attacks on a website that doesn't require much security.
I assume that some letters and numbers are excluded because they're easily confused. I didn't see them in the sample passwords, so I will assume they are excluded just to be on the safe side. I could have gone further and assumed other vowels weren't use (to prevent passwords contain coincidentally offensive words) but saw that vowels are used.
I noticed samples contain 1, 2, or 3 numbers, but the total length is always 10 characters. Our set of digits is smaller than the set of plausible digits and uppercase letters. I made this simplification either because I'm too lazy to compute all the different pattern variations or because I was fine underestimating numbers.
Likewise I saw a variable number of capital letters. I assumed the first was always capitalized and that the second could be lower or uppercase. I know some samples had three uppercase letters but just treated each third letter as if it were lowercase like the final 5 are.
Because of the way we simplified this pattern, we know that the actual number of possibilities is larger. The unaccounted for variations could add a few bits to the password strength. If another user wants to calculate a less conservative estimate or exact answer, then they can submit it as extra credit homework.


Why should I use jwt in Refresh Token? I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me".

So why should I use jwt in Refresh Token? Can it be just a random hash string? And should it have expiration time?

Can it be just a random hash string?

Yes, it can be any random string. You just have to ensure that it cannot be randomly generated or guessed.

  So why should I use jwt in Refresh Token?

jwt has it's own pros and cons.
The main advantage being it's stateless; And you don't need any storage.
However, the downside is the security depends on just one key. If it's compromised, the whole system is compromised.

It depends on your architecture and use-case. Both jwt and random hash string are already used successfully in many production application. Choose as per your need and resources.

  And should it have expiration time?

Seems you're considering to use it. :)
Since, it's used to get a new access token in case it is expired, refresh_token must have long expiry time.
With above, there is concern for abuse of the refresh_token.
To mitigate it, we can take some measures. Let's take a look at the OAuth 2.0 specification. OAuth RFC-6749

  the authorization server could employ refresh token
     rotation in which a new refresh token is issued with every access
     token refresh response.  The previous refresh token is invalidated
     but retained by the authorization server.  If a refresh token is
     compromised and subsequently used by both the attacker and the
     legitimate client, one of them will present an invalidated refresh
     token, which will inform the authorization server of the breach.

Would love to know whether you used jwt for your purpose.
(Do write an answer/comment here in future)


Could other people steal my Internet connection if they had my PPPoE data? Would it be possible for other people to use my PPPoE data to get Internet access or is it somehow restricted to my house? Then what about my neighbors downstairs, could they do it?
And what about intercepting a PPPoE login? Are PPPoE logins secured by encryption? If so, what encryption is used?

I actually tried this with my neighbor who is connected to same ISP.
PPPoE required 3 things:

Username
Password
MAC if Binding is enabled by your ISP

I was able to get these things from my neighbor.
I spoofed the MAC address, started PPPoE connection with his credentials.
And BOOM I was able to use his IP.
But before that the PPPoE session of my neighbor has to be shut down.
There could be only one PPPoE session at a particular time.


PHP malware/shell keeps resurrecting So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros.

I have a VPS (with root access) which hosts several different PHP websites, some of which are WordPress-based. Some of the sites got infected with the a malware as a result of the MailPoet vulnerability. I cleaned the infected sites, completely removed MailPoet, backdoor accounts, and related stuff, but the malware keeps resurrecting once in a while. Below is what I can describe about it:

There are two malware signatures (sorry if I'm using the wrong term), both are injected at the very top of PHP pages. Once looks like this <?php $ozufdqjmhx = '7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x782vg}... with the variable $ozufdqjmhx changes from time to time, the other begins with <?php if(!isset($GLOBALS[\'\a\e\0... etc etc
The malware comes back at random intervals. Sometimes it comes back a day after cleaning, sometimes a week, or several weeks.
Only previously infected files/directories/websites get infected again. New directories, or old unaffected ones, are always clean. New files in old infected directories though, get infected.
maldet (using ClamAV I believe) can't detect any malware. PHP Shell Detector can, but it cannot fix due to being a detector only.

Can you guys help, or give a direction I should be heading to? A million thanks in advance!

(Also I'm sorry if this question doesn't fit the site's regulations. When I'm a daily user of StackOverflow, this is my first time on this Security subsite).

EDIT: I really appreciate any recommendation from you guys, but wiping the sever and start from scratch is not an option. If it was, why would I ask this question to begin with, right? :)

EDIT 2: Following @Mints97's answer, I've checked all the open ports -- looks normal:

21/tcp    open  ftp
22/tcp    open  ssh
25/tcp    open  smtp
53/tcp    open  domain
80/tcp    open  http
110/tcp   open  pop3
143/tcp   open  imap
443/tcp   open  https
465/tcp   open  smtps
587/tcp   open  submission
993/tcp   open  imaps
995/tcp   open  pop3s
3000/tcp  open  ppp
3306/tcp  open  mysql
5432/tcp  open  postgresql
8000/tcp  open  http-alt
8080/tcp  open  http-proxy
8082/tcp  open  blackice-alerts
10000/tcp open  snet-sensor-mgmt
20000/tcp open  dnp

EDIT 3: This is for @QuestionOverflow: When searching for the 4 domains you mentioned in your other answer, I came across a script to eliminate the malware here. In the code we can see if (preg_match('/^<\?php \$[a-z]{10} = \'/', $fh_str)) {, which targets EXACTLY the first signature. I would say now it's the same malware, or at least from the same guy via the same vulnerability. Pretty interesting.

EDIT 4: The second malware has already been discussed here if it may help, and yes, apparently both fetch some payload randomly from 4 domains: "33db9538.com", "9507c4e8.com", "e5b57288.com", "54dfa1cb.com". I've added all 4 into my hosts files, pointing to 127.0.0.1. Let's see what's next.

EDIT 5: Several suggest that this question has already been answered here at How do you explain the necessity of “nuke it from orbit” to management and users?. Honestly I fail to see how the other question answers mine. I'm asking how to eliminate a malware, not to explain to my boss why I should reinstall a server.

I would enable auditd to monitor changes to the files you expect to be backdoored. You will be able to determine which account and process that is responsible for doing these changes.

After installing auditd (not installed pr default on all systems), you can start monitoring changes in files. To do this, simply run the command:

auditctl -w /var/www -p wa

This command will log all file changes to the auditd log file. Usually you will find it in /var/log/audit/, but it is system dependent.

If you are concerned that the attacker might notice this (and maybe remove the rule), you can lock it by running the command:

auditctl -e 2

No further changes can be made to the audit rules until the system is rebooted. Before doing this, be sure that the audit rule above do not generate an insane amount of logs.

Lastly, the audit logs are a bit cryptic. Once you have found that the system is backdoored again, you can search for the audit trail, using the command:

ausearch -f /var/www/backdoored_file.php

I hope this will provide you with the clues on what is going on.
Good luck!

Additional:

To make the audit rules survive reboot, you have to define them in /etc/audit/audit.rules


Can the ransomware encryption key be derived from comparing encrypted and unencrypted files? A firm has 10 million files, all ransomware encrypted, but the firm has all of those 10 million files backed up, and almost all of them have not changed.  Would comparing all of those files against their unencrypted backups in addition to the other cracking algorithms help discover the key?

What you are suggesting is a Known Plaintext Attack, and yes if the encryption algorithm is bad enough, it could be used to discover the key or keys used to encrypt the data, depending on the cipher used. I say keys because some ransomware uses individual keys per file, so cracking one key would only give you the key to that file.

Practically this is unlikely to be useful as unless the ransomware encryption scheme has some sort of flaw (weak cipher, poor pseudo-random data source, small key, etc) or you have access to massive decryption computing resources then your great-grandchildren might just live to see one of the files cracked.


Mobile phone is picking up 13 bluetooth devices and not sure what they are? I have a particular problem with a potential security breach. I bought a new device today that connects to my phone via Bluetooth. Nothing strange about that.

Surprisingly when I turned Bluetooth on with my phone and set it to search for discoverable devices, it came up with 12 Bluetooth devices that I have no idea what they are.

I entered one of the MAC addresses into a MAC address database, and none of the addresses was recognised. Wondering if I had made a mistake, I put the MAC address of the mobile phone, and it correctly showed that it was made by OnePlus.

I'm somewhat concerned about why there are so many Bluetooth devices around my computer working area and would love to hear some advice on what I can do to try and discover what they are and what they are doing? I wouldn't be so concerned if their MAC addresses resolved to a legitimate manufactorer but showing not found concerns me.

It doesn't take much to get up to 13 MAC addresses. For example, a family of four nearby with 4 cellphones, 3 laptops, a printer, a console game system, a internet router/gateway, an Alexa, a Kindle and a iPad would do it.

How many MAC addresses can you account for in your house? Laptops, desktops, cable internet modem or gateway, printers, tablets, game systems, Roku, Kindle, etc?


How can I best protect myself on an encrypted network with untrustworthy users? I will be starting university in September. As part of my accommodation I will be provided with fast WiFi which requires a password to connect to (WPA2 Enterprise).

However, I don't trust the other users on the network. How can I protect myself on my phone and laptop from any potential security risks this situation arises? And how can I protect my printer from being publicly accessible?

Buy your own hotspot from a provider for your laptop.

Using university wifi gives them the right to monitor what you do and say on the web. As you pointed out, it also exposes you to potential bad actors.


What are the pros and cons of disclosing a vulnerability before it is patched? I had heard a lot about Google's project zero and it's 90 day deadline for vulnerability disclosure. It has taken some flak from Microsoft for disclosing the bugs before they were patched.

I understand the argument that users should be aware of the risk that is present in using a flawed software and that definitely is a pro towards responsible disclosure.
At the same time I believe that if you disclose a vulnerability especially in a closed source software before a fix is released, the users become sitting ducks. High value targets using these systems can come under serious trouble because of this.

Responsible disclosure with a fixed deadline seems to be a popular concept in the industry. I wanted to know what are the pros and cons of this approach.

The main argument for a fixed deadline is probably that history shows that many vendors will take ages to fix software if no hard deadline is set for disclosure. Since it is likely that others will find the same bug too (or have already found and use it) this means that users are at increased risk without being aware of it. This also means that they will not add additional defenses to deter the risk, like  increased monitoring, replace affected software with a more secure one, or reduce the risk by temporarily taking affected systems or services offline.

The main argument against a fixed deadline is that some bugs are more hard to fix than others and thus fixes take more time and that maybe there are no effective workarounds for the customers. Thus customers have an increased risk while the vulnerability is known to the world and thus potential attackers but no fixes or workarounds exist. But at least they can be aware of this additional risk. Past has shown that if this is the case it is often sufficient if the vendor works closely with the security researchers to get the problem fixed as fast as possible. And if past experiences with the vendor where positive the researchers often extend the deadline a bit this one time.

Regarding the Google Zero Project: one might complain about their hard deadlines but if you look at the work they do and how fast most vendors react to the bugs found the strategy of a hard deadline seems to be successful: many bugs are fixed within  a few days, i.e. much shorter than the deadline. And I very much doubt that this would be the case if the pressure of the deadline was not there.


Can ClamAV detect CSV Injection? I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector.

Would a ClamAV (or other AV) scan offer protection against such a file?

Any scan would happen only after validating the MIME type.

ClamAV has, as far as I know, no specific detection features for CSV files. CSV injection is not a vulnerability that an AV would resolve directly. Instead, an AV may detect known malicious macro payloads that were injected into a file, regardless of the file type.

If you want to know about specific detection features, I suggest talking to the ClamAV maintainers. For now, I recommend following OWASP's advice on filtering: do not allow any cell to start with -, +, =, or @.


How to find what files in a zip are malware using Virustotal I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and xbin into one file for testing using Virustotal, after scanning, some anti-virus engines indeed detect the zip to have malware but I can't view the specific files that caused that detection. Is there a way to do this in virustotal? or any other way to achieve this?

An easy way would be for you to unzip the files in a VM, create md5 hashes and submit the hashes to virus total. You'd know which files are malicious then.


Retreiving Google Chrome passwords While retrieving Google Chrome passwords on macOS, I've noticed that the passwords all come up as the same thing (something along the lines of): Vi??M!4NNn. How I retreived them was with the following (as a non-admin):

cd "users/user/library/application support/google/chrome/default"
sqlite3 "Login Data"
sqlite3> .output chrome-passwords.txt
sqlite3> select origin_url, username_values, password_value from logins;

Even if I run as root and pull the passwords I get the same thing, what is causing this and how can I retrieve them correctly?

Alright I figured it out and said I would post an answer.

The reason that the passwords showed up like they did is because they are encrypted with a pbkdf2 key that is stored in a specific keychain location (usually having the name 'Chrome' in it). To find this key you can execute the command security find-generic-password -wa 'Chrome' as an administrator and it should pull the key for you.

Once you have the key, in order to decrypt the you would need to;

Generate the IV (python -c 'import sys;sys.stdout.write("20" * 16)'
Get the salt (110% chance it's saltysalt)
Encrypt the found key using pbkdf2_hmac grabbing the first 16 characters and hexlify the encrypted key (python -c 'import binascii;import hashlib;key=hashlib.pbkdf2_hmac("sha1","<KEY>",b"saltysalt",1003)[:16];print binascii.hexlify(key))
Base64 encode the encrypted password and remove the first three characters (python -c 'import base64;print base64.b64encode("ENCRYPTED_PASSWORD")[3:]')
Decrypt the encryption with the following command: openssl enc -base64 -d -aes-128-cbc -v <IV> '<HEX KEY>' -K '<BASE64 ENCODED PASSWORD>'.

Luckily for you, I created a simple python function to return the same thing:

import base64
import binascii
import subprocess
from hashlib import pbkdf2_hmac

def decrypt(encrypted, key):
    iv = ''.join(('20', ) * 16)
    key = pbkdf2_hmac('sha1', key, b'saltysalt', 1003)[:16]

    hex_key = binascii.hexlify(key)
    hex_enc_password = base64.b64encode(encrypted[3:])
    try:
        decrypted = subprocess.check_output(
            "openssl enc -base64 -d "
            "-aes-128-cbc -iv '{}' -K {} <<< "
            "{} 2>/dev/null".format(iv, hex_key, hex_enc_password),
            shell=True)
    except subprocess.CalledProcessError:
        decrypted = "n/a"

    return decrypted

Please note, in order for the to work successfully, you have to have the administrative credentials for the computer you're running this on.


Is a concatenation of random numbers better than a single random number? We are generating random numbers 16 digits in length. One option that was put forward was to generate four random numbers of 4 digits each and concatenate them instead of just generating a single 16 digit random number. The reason accompanying the suggestion was that it would be harder to predict the next number in case there was an issue with the random number generator.

So is the concatenated random number better than a single random number?

So is the concatenated random number better than a single random number?

If the random generator really produces random data then it will not matter.

  ... it would be harder to predict the next number in case there was an issue with the random number generator.

If the issue is that the random generator is not that random at all then it might even be better for an attacker to get as much last outputs as possible because then the behavior could be better to predict. Of course this assumption depends highly on the internals of the random generator, so no general answer is possible.

But in general: if you need really good random data you should use a proper random generator. Your method will not improve the quality of the output if the random generator is bad, i.e it stays predictable. If you actually don't need true random data but only want to make sure that you get somewhat random data without a bias you should be careful because depending on how exactly you do it your method might add a bias to the output.


What are the consequences of turning on Apache AllowEncodedSlashes? What are the consequences of turning on Apache AllowEncodedSlashes? I want to turn it on and I want to know if this any worse than any of the other kinds of injection attacks that may occur in web apps?

Your web server should not be responsible for correct encoding of user supplied input. If this would cause you to be vulnerable to injection, it means that your application does not sanitize user input correctly.

It has always been considered a security issue because the application running on the web server weren't always escaping the input correctly, resulting in path traversals. But the responsibility for the issue ultimately lies with the web application, not the web server. So if your application correctly escapes these values, you should be alright.


What is the default cipher algorithm for GnuPG? I know, that one can force GnuPG to use AES256 for encryption with

gpg --cipher-algo AES256

or with a special setting in ~/.gnu/gpg.conf.

But, what is the default cypher algorithm for GnuPG, if I would miss this switch?

TL;DR: For GnuPG 1.0 and 2.0, default is Cast5, for GnuPG 2.1 it is AES-128.

Recipient's Preferences

Per default, GnuPG will read the recipient's algorithm preferences and take the first algorithm in that list it supports (in other words, it takes the most-preferred supported algorithm the recipient asks for).

Safe Algorithms

If no preferences are given (or --symmetric is used for symmetric encryption using a passphrase), it chooses a "safe" one. Safe means, one that must be or should be implemented. Which one this is depends on the version of GnuPG and compatibility level chosen. You can easily verify this by starting a symmetric encryption, passing one of the compatibility levels (or none, which implies --gnupg):

gpg --verbose --symmetric
gpg: using cipher CAST5

Strict RFC Compliance

On the other hand, if enforcing strict OpenPGP compliance following RFC 4880, it drops to triple DES:

gpg --rfc4880 --verbose --symmetric
gpg: using cipher 3DES

The same applies if enforcing RFC 2440 using --rfc2440.

GnuPG 2.1 Defaults to AES-128

GnuPG 2.0 also uses CAST5 with the default --gnupg, while this default was changed to AES-128 in GnuPG 2.1:

LANG=C gpg2 --verbose --symmetric
gpg: using cipher AES

(AES without further specification means AES-128 in GnuPG)

GnuPG 2.1 uses the same algorithms for the RFC-compliant settings.

Digest Algorithms

For digest algorithms, similar algorithm preference inference is performed. If --verbose is set as an option, the used algorithm is printed.

An exception is the Modification Detection Code Packet, which only allows SHA-1 with no algorithm choice as defined by the standard.


Server to server authentication I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls.
The current architecture + what I need to add in orange:

*All servers are exposed to the internet.
What I thought to do is:

Limit sensitive API calls by IP
All sensitive API calls will need a secret key (do I need to use HMAC here?) that will be validated on the API server

What do you think? Is there a better way to do this?

The simplest solution is to use mutually authenticated TLS. This will only authenticate the communicating parties.


Why doesn't my leaf certificate validate against the root CA only I created a root CA and intermediate CA, then used the intermediate to sign a leaf cert, for the purpose of enabling SSL on various web servers in an internal network.

I'm trying to figure out if I need to distribute both the root and intermediate CA certs in my client truststores, or if I can get by with only distributing the root, as explained in: Do I put my subordinate (intermediate) or root CA certificate in my truststore?

Doing a quick test with curl against an https endpoint with a leaf cert, signed by the intermediate, it appears I need the full chain, e.g.:

curl --cacert chain.crt https://my-endpoint:8080/

When I tried with only the root CA, I got an error:

curl --cacert root.crt https://my-endpoint:8080/
curl: (60) SSL certificate problem: unable to get issuer certificate

Why do I need to provide curl the full chain instead of only the root CA? Do I need to create leaf certs with a special option to embed the full chain?

Edit: another answer that indicates I should only need the root: https://security.stackexchange.com/a/83875/117515

Edit 2: the webserver I'm testing against happens to be Vault – not sure if that's relevant but perhaps there's something wrong with the way that server is presenting its certificate; it needs to serve the full chain, right? How do I verify that it is or isn't serving the full chain?

Why do I need to provide curl the full chain instead of only the root CA?

In order to build the trust chain the client has to know the intermediate certificate somehow. Usually this is done by sending both the leaf certificate and the intermediate certificate in the TLS handshake but it is a common error in server configuration to send only the leaf certificate. This is probably the problem in your case too.


SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions? I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed cert.

I have three questions.

The document shows two ways: (1A) Generating your own self-signed cert. and (1B) Generating your own cert/CA and then using the CA to sign your cert.

I don't understand what the difference between the two is. What is the point of generating your own CA if none of the browsers trusts it (unlike certs signed by Verisign)? Is (1B) used to prevent MITM attacks? If so, should I use (1B) over (1A)?

Other than managing/revoking multiple certificates (if I use them), a self-signed CA seems pointless?
I noticed that the doc uses des3 cipher. Would it be possible to use aes-256 cipher instead unless there is a good reason to use des3? (Also how do I do this?)
This thread made a distinction between using 2048 bit keys and 256 bit keys. I understand what the answer is saying to some degree (that the public (2048 bit) keys are used to encrypt the symmetric (256 bit) keys in order to exchange keys between server and client). But I do not understand how this is applied in the context of the doc. In the doc, I see this line:

  openssl genrsa -des3 -out server.key 4096

Does this line mean that it's generating a symmetric key (des3), and then generating a public key (RSA 4096 bit)?

A CA certificate is a certificate which is owned by a CA and marked as being suitable for usage as a CA; namely, that it contains a Basic Constraints extension with the "cA" flag set to TRUE.

A self-signed certificate is a certificate which is signed with the private key corresponding to the public key which is in the certificate itself. This means that the certificate was issued by the certificate owner itself, not by somebody else.

A CA certificate can be self-issued; this is the normal case for a root CA. A root CA is a CA which exists by itself and is meant to be trusted a priori (manually included in a Web browser or an OS certificate store) and not by virtue of being issued by another, trusted CA.

Creating a self-signed CA and using it to sign the actual server certificate (option 1B) is useful if you envision to issue several certificates (possibly many) for many servers. With your own root CA (that's what option 1B means), you would just have to insert one certificate manually in all the clients (your self-signed root CA). If you only have a single server certificate to produce, and predict that things will stay that way, then option 1A is as good as 1B, arguably better since it is simpler.

The -des3 option is for symmetric encryption of the CA key. That's not bad. There is not enough computing power (or, for that matter, raw power) on Earth to break properly done 3DES encryption. Going to AES-256 would be useless, and it might prove difficult because the OpenSSL command-line tool do not support it out-of-the-box (OpenSSL, the library, includes an AES-256 implementation, but the command-line tools do not given an easy access to it when it comes to symmetric encryption of private key).

Digital signatures (that which are applied on certificates) use, by definition, asymmetric keys. Asymmetric keys require a lot of internal mathematical structure, and that structure can be used to weaken them, so they have to be much bigger than symmetric keys in order to achieve a decent level of security. Which is why a good RSA key will have to go to 2048 bits or so, while a 128-bit symmetric key is already rock solid. The line:

openssl genrsa -des3 -out server.key 4096

generates a new asymmetric RSA key pair of size 4096 bits, and stores that in the file server.key. That storage is furthermore protected (encrypted) with 3DES, using a symmetric key derived from the password you type at that point.

The private key includes a copy of the public key. The public key (but, of course, not the private key) will also be part of the certificate: it is first copied into a certificate request (the ".csr" file) and then into the certificate itself.


What problem does ECC seek to fix compared to RSA? Elliptical Curve Cryptography (ECC) is one of the newest encryption schemes to challenge RSA cryptography. What problem does ECC seek to fix compared to RSA? Would you have any qualms with using ECC to encrypt sensitive material?

The main "problem" that ECC tries to fix is that RSA is RSA. Namely, people want to have a backup kind of algorithms, in case RSA gets brutally broken through a stupendous (and unpredictable) advance in integer factorization techniques. Integer factorization has been heavily studied for more than 2500 years (it was already all the rage in the Neo-Babylonian empire), and we can therefore say that ground-breaking advances in that field are not obvious, and don't happen often. However, this is mathematics: progress comes from ideas, which may occur without warning in the brain of people living in remote places that you have never heard of. Though such a break is improbable, there will be no prior warning. Hence ECC.

For the "backup algorithm" strategy to work, the ECC-based algorithm must be deployed wherever RSA is used. It takes a lot of time from the scientific article to code which runs and interoperates; if ECC is supposed to be able to replace RSA at a moment's notice, then it must be already there.

Apart from that point (often described as "a need for algorithm biodiversity"), ECC offers interesting performance-related advantages: smaller messages (an RSA-based key exchange with a 2048-bit RSA key requires 256 bytes, while the ECDH key exchange of similar strength may fit in 28 bytes), faster private key operations (by a factor of 10 or more)... Smart card vendors are much interested.

Furthermore, some very specific types of elliptic curves allow for efficient pairing computations, which open up the practical possibility of three-actor protocols. This is used, for instance, to implement identity-based encryption: you cannot do that with RSA.


Blacklisting accepted file extensions: how careful do I need to be Currently working on a web application which allows users to upload files onto one of our Windows servers. The application is built in ASP.NET MVC with a MySQL backend. The uploaded files are not stored on the web server, and so are inaccessible through the application.

Good practice for file uploads is to limit the extensions to relevant file types, but that's not going to wash here. If I'm to restrict uploads by extension, it has to be via a blacklist.

Searching suggests there are something like 50-odd file extensions I ought to be suspicious of, and block. On top of that, there's the potential for dangerous code to be hidden in other files like pdf.

However, the purpose of the application is to parse uploaded text files. Once files are up on the server, they're fed into a file stream and the contents combed through for data standardization. That's all it does.

Given that what we do with the files seems safe enough - we're not executing them or anything - do I really need to maintain an ever-expanding 50-string block list? Or are there some file types (i.e. .exe) that I can pick out as particularly dangerous without compromising security.

A file extension is just part of the name and by itself says nothing about the content of the file. It is only used by the OS and applications to decide what to do with the file. Thus if you have no component in your system which uses the extension for deciding what to do with the file than the extension does not matter at all and you will neither need a white list nor a black list.

But since you will process the files no matter which extension they have what really matters is the content of the file. Thus make sure that your text processing itself can deal with unexpected content in a secure way. That means it should not make any kind of assumptions about the adherence of the input data to some standard but should always assume that someone is feeding you slightly corrupted input data to exploit bugs in your application, like currently done with images.


Storing passwords of third party services (web app) I have a web app that includes third party websites in iframes. The 3rd party websites require user to be logged in them. Option A is to require the user to login to each website individually via iframes and rely on cookies to remember the user. That however is quite inconvenient and some users would definitely prefer a one login for all websites so that's my option B:

It relies almost entirely on frontend security and encryption.

First, storing the password. Every user has a password (main password) to my web app. The password, besides being used for logging in to my website, would also be used to encrypt user credentials from user's websites. So credentials are encrypted using the main password on my server and only the user could decrypt them. This is where I have a question, would I just need to encrypt it using the password alone, or some magic secret keys or some stuff could be used to strengthen encryption?

Overall process:

User logs in to my web app.
Main password is stored in browser memory for further use
Pulling encrypted credentials from server and decrypting it on the
frontend, using the main password
decrypted credentials are stored in browser memory
open login iframe and send credentials using postMessage to the login
iframe (origin validation included)
log in automatically (I have integration plugin for the sites, that's
why I would be able to do it).

Note that logging in to web app and decrypting credentials are 2 different processes. If the user refreshes website, is still logged in, he cannot access the credentials. He will be asked for the password again. That's not a problem, since the session from third party websites will be remembered by the browser anyway.

So the frontend data would be protected from iframes by web security and as long as I make sure there are no XSS sinks on the web app, there's no way these passwords are leaking, am I right? Even if the server was compromised.

The only way I see it, if the server was compromised and someone edited the frontend code to be malicious and grab the passwords. But that is something that would always be dangerous, even if I didn't implement autologin at all.

I just want your opinion if that's a secure way to store and use passwords and what could potentially go wrong. Especially, is it safe to store passwords in javascript memory and how to encrypt credentials - use just the user password or maybe add some secret token to that password (don't know if that makes sense). Anything that would make it more secure. Any help appreciated.

The best way to do this would be through oAuth.  Check to the documentation on the websites to see if that is a viable option.  If it is not, it is definitely not recommended to store user credentials in any form on a webserver, a browser, or anything else.  Normally when you validate a login you are validating that the hash (plus a salt) of the password matches what is in the database.  The password is never actually stored in the database not even in a encrypted form.  In this scenario there is no way for an attacker to know what the password for the user is even if they are able to compromise the database (short of a brute force attack).


How secure is connecting to a machine behind a router with SSH tunnels using a 3rd machine that has static IP address? I found the article that describes how to access a Linux machine behind a home router with SSH tunnels.
https://juliansimioni.com/blog/howto-access-a-linux-machine-behind-a-home-router-with-ssh-tunnels/

How safe is such setup? I'm not an expert, so not sure if there are any pitfalls.

My use case is almost the same as the authors:

Ubuntu Desktop that I need to connect to. The desktop is behind a WiFi router. External IP is dynamic.
My Linux laptop from which I need to connect.
I need to set everything up once due to dynamic IP address.
I can get a Linux VM in a cloud with a static IP address.

If I go with that solution, is it possible to use public keys instead of password authentication in such setup?

That proposal opens a reverse-tunneled port from the NAT'd system (the final destination SSH server on your LAN) to the world. It's clunky; if you want that sort of thing, just set up port forwarding from your router.

The "proper" SSH solution would be to accept SSH connections on your public-facing system (router) and use it as a jump host into your network. Then you're as secure as your router's SSH plus your NAT'd system's SSH (the port-forward and reverse-tunnel solutions have zero security for the router and rely solely on the security of your NAT'd system).

After you've set up ssh open to the world on your router (which, by the way, should not allow root to log into, or at least not without a key), you can connect like this:

ssh -J username@my-router me@lan-system

This will connect as username to the router, then immediately forward a connection to the lan system as user me. (Specifying a user is optional, it'll default to your local user name.) This is all performed from your local client's perspective, so if you're using SSH keys (which you requested—and you should), the private keys all live on your local system, not the jump box (the router).

This SSH jump host guide has some good examples, including how to use your ~/.ssh/config to make it automatic (so you'd type ssh lan-system instead).

To set up key-based authentication

On your local client my-laptop, create a key (make an RSA key if ed25519 is unsupported, see that link):

me@my-laptop:/home/me$ ssh-keygen -t ed25519 -a 100

Make sure it has a password on it. We'll get to saving the password with ssh-agent later. This will create ~/.ssh/id_ed25519 (your private key) and ~/.ssh/id_ed25519.pub  (your public key) by default, which is fine. You can also use -C "comment about your key" if you want something other than the default username@host.

Now you can copy the public key to the jump box (my-router):

me@my-laptop:/home/me$ ssh username@my-router "mkdir -p .ssh; chmod 700 .ssh; cat >>.ssh/authorized_keys" <~/.ssh/id_ed25519.pub

This should be the last time you'll be prompted for your router user's password.

This runs three commands on the router. First, it ensures you have a ~/.ssh directory. Then, it ensures its permissions are correct (700 is drwx------). Finally, it appends the input to your list of authorized keys. After that, we're piping the public key via standard input (think of this like passing a ball; you hand the ball to ssh and it instructs the remote system to hold onto it in that prescribed location).

You should now be able to log in with the key, but let's set up your SSH agent first.

There's a good chance you're already running an SSH agent, so let's just try it:

me@my-laptop:/home/me$ ssh-add ~/.ssh/id_ed25519
Enter passphrase for /home/me/.ssh/id_ed25519: [your typing will be invisible]
Identity added: /home/me/.ssh/id_ed25519
me@my-laptop:/home/me$

If that worked, you're good to go. If not, you'll need to launch an agent:

me@my-laptop:/home/me$ ssh-add ~/.ssh/id_ed25519
Could not open a connection to your authentication agent.
me@my-laptop:/home/me$ eval `ssh-agent -s`
Agent pid 1234567
me@my-laptop:/home/me$ ssh-add ~/.ssh/id_ed25519
Enter passphrase for /home/me/.ssh/id_ed25519: [your typing will be invisible]
Identity added: /home/me/.ssh/id_ed25519
me@my-laptop:/home/me$

You should look into how to do this for your whole desktop environment rather than per-shell, but you could just add eval `ssh-agent -s` to your ~/.bashrc if you're willing to deal with having to run ssh-add in each terminal you open rather than having it managed centrally.

You should now be able to run ssh username@my-router and log in automatically with your agent's unlocked key.

Let's connect to the NAT'd system lan-system now. This should look familiar:

me@my-laptop:/home/me$ ssh -J username@my-router me@lan-system "mkdir -p .ssh; chmod 700 .ssh; cat >>.ssh/authorized_keys" <~/.ssh/id_ed25519.pub

This will automatically jump through my-router and request your me password for lan-system, then it will install your key. After that, you can run ssh -J username@my-router me@lan-system and log in seamlessly with your agent.

Finally, you can shorten this command line by putting this stanza into your ~/.ssh/config file:

Host lan-system
  ProxyJump username@my-router
  UserName me

This will let you run ssh lan-system on its own. The UserName line is unnecessary if you have the same username. The same goes for the username@ part of the ProxyJump line.


Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc? This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter.  I copied it here because I'm curious too.

Rich posted these follow-up tweets:

  And by APT I mean real APT.... China specific stuff.
  Netwitness/Mandiant/HBGary type stuff.
  Really specialize in this. Most of what I've seen is very custom.

Due to the sensitive nature of APT and that it is closely aligned to espionage, the only real way to get a suitable feed will be through Government or National Law Enforcement agencies.

The difficulty will be in establishing a level of trust to enable the sharing of information.

For organisations within the USA, the advice is to contact your local FBI field office and arrange for a threat briefing on the subject.

For organisations within the UK, then making contact with CPNI (Centre for the Protection of National Infrastructure) would be the best option. CPNI hold a number of industry specific 'Information Exchange' forums that may be of help. However it is worth noting that CPNI has a focus on the critical national infrastructure for the UK and if your organisation falls outside of this may impact on access to that.


How should passwords be stored if they must be recoverable? By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants.  They want to be able to obtain the passwords of any user.  By all accounts this is bad thing, and Bruce Schneier agrees.

So how can you satisfy this French mandate as well as maintaining a high level of security?

Don't force yet-another-password on your users.  Use PKI, hardware tokens, or some other method like OAuth or OpenID that leverages some Identity Provider site which sits outside of whatever jurisdictions you're worried about.

Note that the actual requirements of the 2004 French law in question Loi pour la confiance dans l'économie numérique aka Act on Confidence in the Digital Economy are not clear and it seems that some reporting has misinterpreted or exaggerated the effects.  For example it sounds like it may be sufficient to simply provide law enforcement with some other access to the user's account, e.g. for a child pornography investigation, in a way that doesn't tip the user off that their account is being accessed (as a typical password reset would).


UK or EU regulations that require Security Awareness Training I was completing a survey of the various regulations and standards that require Privacy or Security Awareness training, and have compiled the following list from various sources:

FEDERAL LAWS AND REGULATIONS

HIPAA
GLBA
FISMA
FTC Red Flags Rule

INDUSTRY CODES

PCI DSS

STANDARDS

NIST 800-53
ISO/IEC 27002

REGIONAL LAWS

US-EU Safe Harbor Arrangement
Canada’s PIPEDA
Texas Health Privacy Law
Massachusetts Data Security Law

But I am not seeing anything specific for the UK or EU. Are there regulations that apply?

I knew it had to be in DPA somewhere...while not an explicit reference to training/awareness, Data Protection Act 1998, Schedule 1, Part II, paragraph 10 states:

  The data controller must take reasonable steps to ensure the reliability of any employees of his who have access to the personal data.

By implication, for staff to perform their data protection obligations reliably they will need to be aware of what those obligations are and trained in how to meet them.


Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe? If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website.

You trick the victim into visiting your URL;
Through the client_id and the matching OAuth 2.0 secret you log them in silently in the background;
The OAuth 2.0 system redirects to the OAuth 2.0 provider from the first web page, then the OAuth 2.0 provider redirects to the redirect_uri parameter's value (which usually redirects back to the website which initiated the log in).
The process sets a session cookie that is used both for authenticating on the website and interacting with the OAuth 2.0 provider's API.
Depending on the situation, if the user is already logged in on both the real web site and the OAuth 2.0 provider, he/she can be connected to the attacker's website without having to enter any credentials or click on anything. So this works silently like an XSS attack from the user's perspective.
Because the user trusts the real website with stolen OAuth 2.0 credentials, he/she gave the website authorization to access OAuth 2.0 provider data. But since the attacker can technically impersonate the target website through a session cookie, the attacker can reuse the authorization trusted on the scope parameter.

But in my case, the OAuth 2.0 provider requires to set up a whitelist for the redirect_uri parameter, so it's impossible to redirect back directly.

While leveraging a full open redirect on the real website might lead to an actual threat, I'm wondering if things remain secure as long as such second vulnerability isn't leveraged according to the rfc6749 specification.

Assuming there are no further logic flaws in the OAuth 2.0 implementation (the implementation is compliant with the specification), without chaining your finding with another issue such as cross-site scripting on the white-listed host that allows you to steal the OAuth token, you are right to assume this scenario is not exploitable.

Section 10.6. of the RFC covers this attack scenario in great detail.

  In order to prevent such an attack [authorization code redirection URI manipulation attack], the authorization server MUST
  ensure that the redirection URI used to obtain the authorization code
  is identical to the redirection URI provided when exchanging the
  authorization code for an access token.  The authorization server
  MUST require public clients and SHOULD require confidential clients
  to register their redirection URIs.  If a redirection URI is provided
  in the request, the authorization server MUST validate it against the
  registered value.


Am I safe to see a thumbnail of a downloaded images on Ubuntu 14.04? I have downloaded an image that someone has uploaded to my website with a public upload form.

My intention was to copy the file in a virtual machine and see the image from there; unfortunately, on ubuntu there is something called "thumbnail"...

So, thumbnail was created and I can see the image in the file explorer, but I've never clicked on the file.

I run on standard Ubuntu 14.04 (previously lubuntu-desk was installed in this way sudo apt-get install lubuntu-desktop).

It depends on what you mean by safe.  Ubuntu has to parse and decode the image file to display it in a thumbnail.  So any potential exploit in the decoding code is exploitable when you preview the file.

So from a strict perspective, no you're not safe.  In practice, I don't believe there's any known exploits on ubuntu for image files.  Historically images tend to be low risk.

If you have reason to be suspicious of a file, turn off the preview feature as described:

https://askubuntu.com/questions/136024/how-to-stop-nautilus-from-creating-thumbnails-of-specific-file-types


Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability? I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser.
A last line of defense for XSS vulnerabilities is a good content security policy header set. It won't get rid of the underlying vulnerability but prevents an attacker from effectively exploiting it. For example, the following policy only loads scripts from the same origin as the webpage:
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'none'; base-uri 'none';
As this is browser-based protection for a web application, I would think it would not mitigate any risk from a universal XSS as it affects the browser and so could bypass the protections. This leaves the only real mitigation for universal XSS as ensuring your browser and plugins are up to date.
Am I correct in my thinking? Appreciate any input.

Yes, this is correct.
UXSS does not need a vulnerable web page in order to trigger, and can penetrate web sessions belonging to secure, well written web pages, thus creating a vulnerability where there isn’t one.
If an UXSS defect in the browser allows for injection of Javascript into arbitrary webpages (like this UXSS for Chrome Android) then the the XSS execution would still be respecting the CSP: script-src 'self'.


SElinux security context public_content_t for vsftpd My understanding of SElinux context public_content_t is as

public_content_t is required for files shared via a FTP server unless associated with a user home directory

Here is my question

Does user include FTP anonymous user ftp? If I have created a file owned by ftp:ftp and save it to /var/ftp/pub does it mean it is associated with a user account ?

Thanks

SELinux labels don't care about the username or userid. There is a helpful mapping of default labels to paths, which you can look at by running:

semanage fcontext -l

In your case, we are interested in the /var/ftp directory:

# semanage fcontext -l | grep '/var/ftp'
/var/ftp(/.*)?                                     all files          system_u:object_r:public_content_t:s0
/var/ftp/bin(/.*)?                                 all files          system_u:object_r:bin_t:s0
/var/ftp/etc(/.*)?                                 all files          system_u:object_r:etc_t:s0
/var/ftp/lib(64)?(/.*)?                            all files          system_u:object_r:lib_t:s0
/var/ftp/lib(64)?/ld[^/]*\.so(\.[^/]*)*            regular file       system_u:object_r:ld_so_t:s0

From this output, you'll see that excepting /var/ftp/bin, /var/ftp/etc, and /var/ftp/lib(64)?, all files placed in /var/ftp will be assigned public_content_t label. So, if you create a new file in /var/ftp/pub, it will be labelled public_content_t regardless of whether you did this as user root, ftp, bob, etc.


Why would an encrypted file be ~35% larger than an unencrypted one? According to the ownCloud documentation, if you enable encryption, file sizes can be ~35% larger than their unencrypted forms.

From my understanding of encryption, the file sizes should be more-or-less identical (perhaps some padded 0 bits at the end to make it a multiple of the key size).

Is that incorrect? If not, why?

Most likely, the encrypted file is base64 encoded which would account for 33.3% file increase (you encode three bytes of data in four bytes of base64 data).  Inserting a new line every 64 characters to make it easier to read (as is done by ASCII armor in openssl, GPG, PGP) will increase the size by 65/64.

Combining these two effects results in the new file being (4/3)*(65/64) = 135.4% of the size of the original or an increase in file size of 35.4%.

I've gone through the calculation in this answer here.

You are correct though that encryption should not need to significantly change the file size.  It possibly adds a couple blocks of data if there is a header, an initialization vector/nonce, some padding to make it a full block and/or MAC to check integrity, though these changes will be insignificant for large files (e.g., adding four blocks to an AES encoded file that is 1 MB would make the file 0.006% larger).

However, to not increase the files size, you need to be fine with storing and passing around the encrypted data as an arbitrary binary.  Arbitrary binaries are often blocked over email to prevent spreading computer viruses, and are often difficult to open outside of hexeditors.  Base64 encoded files are easier to pass around and is a more portable format than binary files of an unknown file type.


Emerging Standards for file transfer and integrity check? What are the emerging standards for file transfers (including online transactions)?  How about for file integrity checks?

There's not much more to it than "use SSL for file transfers, use digital signatures (e.g. PGP) for file authenticity".

The recommended ciphers are AES for a symmetric cipher and RSA for an asymmetric cipher. Any SHA2 family hash should be safe as a hash function.


I want a full time career in the field of security. The following is my plan. Any suggestions or modifications? Currently, I have two years of experience in the field of IT and IT security. The type of work isn't what I expected when I was a student. Since then, I've asked people who work in this field, who suggested me to get certified.

So, I started preparing for the CompTIA Security+ certification (I need to refresh my basic knowledge), which I'd like to finish by the end of August 2014. I also want to finish the CEH V8 exam by the end of this year.

Holding these certifications, I'd have a good understanding of theory and the required tools. By mid 2015, I want to obtain the much acclaimed Offensive Security Certified Professional (OSCP) certification.

Am I overdoing things here? Any other suggestions by the mates of this Information Security site?

Certifications will only carry weight in certain industries and on certain teams. In my experience, they're great for doing security consulting, but not so much for impressing a company's InfoSec team.

Of the certs you mentioned, the only one that carries weight is the OSCP, and unmentioned CISSP is kind of a standard cert.

What type of security do you want to do? digital forensics? Incident response? In-house security team (defense/blue team)?

The security field has a bunch of cool areas you could get into, it'd be helpful to know where you want to go so we can rescope the question (What is a good career path for X infosec job?)


How do I gain root access to a system using a setuid root binary? Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a buggy program written in C that has root permissions. Specifically, the execlp() function is what is being exploited as I have already found a way to specify the file parameter. The user variable is received by a call to the getenv() function.
execlp("chown", user, file, (char *)0);

How would I exploit this ability to gain ownership of any file in the system to ultimately gain sudo access over the system? What files would I modify?
I've tried modifying the etc/sudoers file itself but it would give the following errors
sudo: no valid sudoers sources found, quitting
sudo: /etc/sudoers is owned by uid 1000, should be 0

Note that I can't change the file's owner back to root as the current user does not have permission to chown the file to root.
I am operating on a dummy VM right now and this is just a security exercise.
Side note: perhaps that last character array parameter in the code could be exploited somehow too?

execlp does not have an absolute path for chown here, so you should be able to manipulate the linux PATH variable and get arbitrary code execution. In order to do this, write a simple C program which calls system shell like :
#include ...

void main(){
    system("/bin/bash");
}

Save this file and compile this program using cc program.c -o chown and set execution privilege on it using chmod +x chown
Once this is done, run the vulnerable binary from the path of the evil chown binary like: PATH=. /path/to/vulnerable/c/program.
Your C program will now call our custom chown binary as root and drop you into a root bash shell.


Is exploit different from the kernel level or root? i'm searching privilage escalation. there is some way if you looking at. i trying exploit in my lab machine like vulnhub.
there is a diagram for understanding differents.

anyway I told you a little. my opinion is this. for example I successfully run exploit linux/local/udev/net_link vulnerability. Yes good. Now I can read etc/shadow and etc/passwd documents. But I already have root rights. because I can read everything with meterpreter.

my question is: what right can kernel based exploit give me. What are these rights? I'm obviously a little confused.

I'm sorry if I made a mistake because it was my first post. Thank you.

I think you're confused about privilege escalation. First of all privilege escalation is meant to bypass restrictions for a low privileged user in order to execute tasks as a  high (root) privileged user.

Executing a privilege escalation exploit as root is kind of useless (just to state the obvious)

  What right can kernel based exploit give me

root privileges


Random pop ups caused by add on in Firefox I'm a bit conflicted. Firefox was open to it's default home page and after a few minutes of inactivity a new tab opens by itself to this (seemingly harmless) webpage: http://barisderin.com/?p=2264

The title on this page is "Facebook Message Seen Disabled" which I thought was a legitimate add on that I have installed: https://addons.mozilla.org/en-US/firefox/addon/facebook-message-seen-disable/

I'm not sure how to proceed. I do use the add on but I don't want to have random pop ups and now I don't think I can trust them. I also have adblock plus installed, and I ran adaware and the only thing found were the registry keys HKCU\Software\Conduit

EDIT: how on Earth do we not have a adware tag?

You can fix this. You can stop the popups, if you don't like them. Its Open Source!

As you can see the source of the addon here . There are couple of lines on the top in bootstrap.js file.

    firstRunURL:'http://barisderin.com/?p=2262',
    updateURL:'http://barisderin.com/?p=2264',

Simply change them to ,

    firstRunURL:'',
    updateURL:'',

Additionally, the popup is caused by line-276

FacebookMessageSeenDisable.openURLInTab(window,facebookmessageseendisableUrl);

Just comment out this line using //.

Above changes can be implemented in practice as follows.

Download the xpi file from here using chrome/ie/Download manager.
Open the xpi file with a Archiver like winzip/winrar/7zip.
Edit the bootstrap.js from the archiver with above changes  and save it.
Once you save the bootstrap.js file, archiver will ask whether to update the archive with changes. Choose Yes. Now the .xpi archive is updated and saved.
Go to Firefox, Choose File->Open File from menu. Select the updated xpi file and install it.

Note: Also I did these changes and you can download from here . Replace already existing one with this. And those popups should be gone now!


How encryption/decryption of RSA private key by passphrase works? I would like to know how exactly the encryption of private key by passphrase works. I am a software developer with no background in cryptography and I know only some basics. When I open the private key file I see:

    -----BEGIN RSA PRIVATE KEY-----
    Proc-Type: 4,ENCRYPTED
    DEK-Info: AES-128-CBC,225AAFE1E579A5E38EC1C7F479C5F877
......
    IBUX1w9RYjMsgRE6de79iT80A+Er3RYH7tKKcFrjMoIv4z3YxeIgvPtXjmkoXLmv
    -----END RSA PRIVATE KEY-----

As I understand this is private key encrypted using symmetric encryption where passphrase is the key.

The algorithm used is in this case is AES-128-CBCbut I also have seen DES-EDE3-CBC in a different key. What I don't understand is that number/string behind the algorithm type info- 225AAFE1E579A5E38EC1C7F479C5F877. The similar one but shorter was present also in DEK-Info header of the key which had DES.

What are these numbers?

Is the passphrase digested to the key in some standard way? Is it different for every algorithm used?

According to this: https://stackoverflow.com/questions/1774469/how-does-the-rsa-private-key-passphrase-work-under-the-hood the hex string is the initialization vector used by the encryption algorithm.


Is securing Apache with SSL certificates enough to protect all of the underlying applications? I have a few applications that serve HTTP content on localhost.
I have installed apache and configured reverse proxy so that apache routes all the traffic to the underlying applications based on URL patterns.

Then I ran cert-bot and installed an SSL certificate from Let's Encrypt.

Only apache knows about SSL and HTTPS.

Is this secure? Am I doing anything wrong?

Is it more secure if my applications handle SSL or can I let apache take care of it?

I know that anyone inside my server can bypass SSL of course. I dont consider that a problem.

SSL/TLS is only used to protect the transport of the data between client and server. It solely protects against sniffing or modifying these data during transport. It does not protect against any attacks which do not require sniffing or manipulation of the transport, i.e. attacks like CSRF, SQL injection, password guessing and many more.


Objectively, how effective are malware removal tools at detecting infections? I'm fully aware that concrete scientific data may not exist on this topic but I feel that the question at hand won't all boil down to opinion. Either way, with the rampant increase in sophistication of malicious software, how effective have anti-malware and antivirus vendors been at combating these threats?

To further explain, if I run a full scan with the top software currently in the industry, such as Kaspersky, Malwarebytes Anti-Malware (with the anti-rookit functionality), BitDefender, ESET NOD32, and Avira to name a few, and they all come up as clean, can I truly feel safe? Is 'undetectable' (as in through traditional mediums) malware possible?

A lot of the things I do as a hobby involve viruses, worms, trojans, and the like. There's been times where I've been worried that my main machine is compromised but all major vendors report no threats so I've trusted that blindly. I think that this may be a mistake.

Keep in mind that the question has nothing to do with the actual ability to removal said infection, just with the ability to detect it. This also isn't a self-help post but logical, non-subjective suggestions are more or less welcome.

The best numbers I've found so far are in the Microsoft Security Essential Report 19 where they show at page 89 that with full real-time protection the infection rate is still at about 2..5%.

Then there are numbers from the Cicso Annual Security Report 2016 where they claim a time to detection at about 20 hours, but adware and browser injections are at about 200 hours.

  Is 'undetectable' (as in through traditional mediums) malware possible?

With APT (advanced persistent threats) the time to detection is weeks..years. Last average I've heard was about 200 days. So I would consider this as 'undetectable' at least for a long time. But even non-APT malware is designed to be as stealth as possible with a large amount of infections because the more persistent the infection is the better is the return of investment for the attack.

The big question is always what is really malicious. For example you could not simply declare software as malicious which reads data from the local disc and talks to the internet because this would not only include information stealing malware but also mail programs and browsers. And the less obvious the malignance is the harder it will be to detect the malware.


Connecting to public proxy servers I use public proxies a lot. I was wondering, is it possible that they can modify the html and send back malicious javascript, etc?

Yes, absolutely.  This is a classic man-in-the-middle attack.  All traffic (encrypted or not) runs through the server before being passed to you.  It would be trivial to read (and modify) unencrypted traffic (so anything over HTTP).

HTTPS is different.  As long as it's not a web based proxy, I think you'll be fine as long as you check the certificate is correct and valid for the site you're visiting. This is because to view your traffic, they would have to be able to unencrypt the traffic and then reencrypt it to you.  This means they would have to present you with a certificate signed for a domain they own and not signed for say, https://Google.com.


Security Risk of outbound web calls What possible risks/attack vectors could be introduced be allowing my server application to make outbound calls to a 3rd party REST API?  The 3rd party REST API is off premises and owned and operated by the 3rd party.

In order to clarify and limit scope let's just focus on attacks that result in impact on our business (so DoS and things like that would count). Let's also assume that it's properly protected via HTTPS. The users will be other businesses and the on-boarding would be controlled, so there's very little room for bad actors to inject themselves as legitimate system users.

The data from the 3rd party is not essential/used/trusted in our system. In fact our calling out is purely a notification of an event being sent in a fire-and-forget scenario.

... our calling out is purely a notification of an event being sent in a fire and forget scenario

In this case there is not much risk if properly implemented. Proper implementation means that any possible problems are known and addressed or that your API access is mostly independent from the rest of the application so that even unforeseen problems will not affect your main application.

Such problems might be that the third party does not respond in time or that it sends an unexpected reply - for example a really large reply which eats lots of memory or an unexpected or deliberately malformed reply which might result in buffer overflows or similar bugs on your site. If there is too much dependency or interaction between your main code and the 3rd party API access this might negatively affect the main application (slow down, denial of service) and might even make it possible to take over the application by a malicious third party.

A robust protection against such problems could for example be implemented with privilege separation where the API access runs as a separate process with different privileges (different user with own resource limits, container, sandbox, VM ...) and there is only a small and well defined communication between your main application and this separated API access.


Hack profile identification What does it suggest about a "hack" when people I know get emails from me, but my email password hasn't been changed to lock me out?  (Not a spoofed sender - I see some in my sent folder).  If my password is known to the attacker, why would they make themselves known (by sending emails like that) and NOT take over my whole account?

I've changed my passwords, verified my secondary email address (for forgotten password recovery) and reviewed my two-factor-auth-app-passwords.  Nothing seemed amiss.  What should I look out for?  I feel like since they didn't lock me out they have some other trick.  This is gmail, so I have a higher confidence in their application and password database security.

Thanks!

If you have confidence in the security of Gmail's servers, and since the communication between your machine and Gmail uses SSL, this leads to an unescapable conclusion: the vulnerability is on your side. Ill-intentioned people could took some control of your machine, or learned your password, or both. If they could run their nefarious code on your computer, then that computer must be considered as infected and corrupt, and MUST be cleansed. There is no amount of password changing which can heal a computer which has has tasted the foul taint of malware; only a reformat will purge it.

It is possible that the attacker learned your password and just used it from another machine, in which case changing your password would be sufficient to lock them out. However, this does not explain how the attacker learned the password in the first place, and the most plausible explanation again involves malware on your computer (a keylogger). Burn it !


mail.google.com identity doesn't match I got

  This website doesn't supply identity information

in firefox while browsing gmail.com, I understand that would be because I understand it is required when it needs to load content using HTTP and HTTPS as explained in this post

however when I check most possible scenario to make gmail load contents (from attachment, from profile pictures, loading mails, loading ads, gtalk embedded voice call, hangout), everything is transferred over HTTPS, no HTTP is used

now if I check the fingerprint supplied via the site consumed by Firefox it is

and when I check the identity by using https://www.grc.com/fingerprints.htm, I get different fingerprint

is my understanding correct ? if so why do I see different finger print ?

The page on GRC actually explains why this occurs.   Google has a massive infrastructure, and uses many certificates to protect HTTPS traffic, not just one.  Each of these certificate has a different fingerprint, of course.  So, even though you see two fingerprints above (because there are two different certificates here, one was used when you access the site, and a different one when GRC accessed it) both are valid Google certificates.  This behavior is as expected.


Custom extensions to commonly used ciphers? I wonder if there would be any value in creating a custom cipher for added security.

So, I guess, for example, you have passwords stored as SHA256 hashes, if access is gained to the hashes it is possible to execute a brute force attack easily since the SHA algorithms are a standard.  But, if you have your own custom cipher, this cannot be done so easily.  Since I have next to zero knowledge of how to create my own cipher and in order to have some assurance of collision resistance, I thought I could just take the output of a standard cryptographic hash function and run it through a few more steps in order to make the result less likely to be brute forced, as essentially no one would know what the extra few steps are.

An extra simple example which I wouldn't use but for the sake of having an example would be to reverse the order of the hash I started with.

Thoughts?

You are right in that SHA-256 only is a bad choice for password security. But, adding "secret steps" is not a good idea in cryptography, because there will be a time these secret steps will be public. Instead one uses random salts or much better uses algorithms specifically designed for this class of problems.

In the case of passwords I recommend to read the Password Storage Cheat Sheet at OWASP to find out how to do it properly. See also Is my developer's home-brew password security right or wrong, and why?.


Why code memory pages should be readable? I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x".

But my observation is that the behavior of reading code into CPU for execution is normal, while reading code into another memory space (e.g., copying the code into a generic-purpose register) is quite suspicious. One example is it benefits "Just-in-time code reuse for bypassing ASLR" (http://www.ieee-security.org/TC/SP2013/papers/4977a574.pdf), and I believe it can be used by attackers in many other ways.

So my question is that why do not remove the "r" permission from the code pages, that is, why not design the CPU in a way that the code can only be read into the CPU for execution?

We're dealing with the consequences of Von Neumann architecture - the shared memory space for data and code.  It has advantages, but as you point out, it has security problems as well, including that attack methodology.

If we were starting from scratch, I think there's no reason such a CPU couldn't be built - but many programs, from anti-virus to DRM to video games doing weird optimizations to debuggers to who-knows-what-else would not work with such restrictions.  It would be hard to bring that CPU into today's market which expects backwards compatibility - some people still want DOS programs to run on today's computers.  These sort of things make major architectural changes difficult.


Someone is making random calls spoofing my phone number. What to do? For the past six months, I've experienced call-backs from foreign numbers (all within the EU) telling me that I had called them earlier. At first, I thought the calls are malicious. However, due to the frequency and other details (searching the numbers, etc.), I concluded that these people are actually receiving calls from my number.

My Details

Austrian mobile phone with "Drei" (Hutchinson)
There is no log of outgoing calls on my provider's backend

Conclusion

Someone must be spoofing my number and dialling EU phone numbers at random.

Questions

What threat models could the spoofer be exploiting?
What can I do (beyond changing my number)?
How easy is it to spoof a number in this
context?

Not sure about Austria, but in the US it's quite easy to find software that masks the outgoing call's origination and replaces it with something else.  (I receive several calls per week from different numbers, all across the US, offering me a reduced rate on my credit card.  The recording is the same, so I know it's the same scammer calling.)

Based on that, I don't think that they're exploiting a threat - they could just be using this to spoof your number as the outgoing call.  Changing your number will help, but if this person or party decides to use your new number as the originating number, that will only give you relief for a short while.

I don't think that there's much you can do to stop it.  Finding who's spoofing your number is pretty hard - @Schroeder has a good suggestion.

More than anything else, the effect on you is the annoyance factor.  ,,Sie haben mich angerufen...'' ,,Leider nicht, jemand verfalscht sein Telefonnummer.  Tut mir Leid'' is about all you can do.


How much identifying information is in a photograph? If I take a photograph with a smartphone camera, how much information is there that could be used to identify the owner? I know of Exif tags and that all cameras have slight manufacturing variations that are (citation needed) able to be disambiguated in a lab setting. Other than those, what other information/metadata may be present?

Typically only EXIF data will be present in a smartphone or indeed any digital camera.

Of course, from EXIF data, you can identify the camera make and model and possibly the location of the image capture.

You are right in that in theory the differences in digitisers and post processing would enable at least the camera or lens to be identified by specialist processing even without the metadata.

If a specialist got hold of a smartphone/camera and some images, it is also likely that they would be able to match one to the other as well due to differences in the manufacturing though I don't know how reliable that would be.


Can canvas fingerprinting be prevented? How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it went up to 15 bits.

Are there any other ways to increase browser privacy by blocking canvas fingerprinting? Also how is WebGL hash different than hash of canvas fingerprint?

Panopticlick is looking for things that make you different to other visitors. In this case, fewer people use canvas blockers than don't, so you become more unique if you use one. However, this only means that it is easier to tell you apart from another user - not that they can tell who you are.

Think of it being like a security camera which can only see heights of people passing by (maybe shadows). Can say "tall person went past", but not "Celeritas, who is tall, went past". The Panopticlick increase means that they can suggest with greater confidence that this specific person visited - you've put a box on your head, so now the security camera can see a square shadow. You're the only square shadow, so someone looking at it can say "aha, the tall person with the square head went past" - they are a lot less common than just tall people!

As a result, in order to minimise this kind of tracking, you should try to blend in - no canvas blocking, default settings on your browser, no unusual fonts installed on your computer, always running in a common resolution.

This isn't the same as preventing specific tracking - it only works if no-one is specifically looking for your traces. If you're the only person in a region who visits a specific site, they can fingerprint you easily, even if you blend in perfectly with other visitors by more easily controllable factors. Essentially, it comes down to what you want privacy from:

Ad networks: block their cookies and adverts, never click on any unblocked adverts, avoid Google
People you share an office or computer with: incognito mode. It makes you more unique, but protects against local investigation to some extent
Law enforcement: anonymous VPNs, TOR. Both increase your uniqueness, but reduce the ease of tracking a specific request


The best way to prevent ransomware and virus? I am using
Avast free antivirus real time protection and weekly scan
Malwarebytes free anti malware weekly scan
Malwarebytes Anti-ransomware
EMET
good enough? Anything else I should do or choose another software?

Malware is a fast evolving beast and their is no single solution which will protect you. But you can reduce the risk in various ways. First you need to know how the malware gets delivered:

A major delivery vector for malware is mail, i.e. either as an attachment in the mail or mail which includes a link to some site you should visit. While many of the mails look suspicious others are get really hard to detect because they seem to provide expected or unexpected invoices or delivery notices from Amazon, Ebay, Paypal, DHL etc or even have the the of a friend as alleged sender. Typical attachments are various kinds of office documents, PDF or ZIP files containing JavaScript or Windows binaries. Sometimes the real type of the file is hidden, i.e. document.pdf.exe might look like a PDF from name and symbol but is actually a program.
The other major delivery vector is the web. This will be illegal sites where you can watch movies, but more and more malware gets delivered through ads and through formerly trusted but now hacked sites.

Once the malware is on your system it needs to be run to start malicious part. This can be done with exploits or with social tricks:

The major attack targets are Flash-, Silverlight and Java-Plugin, Acrobat Reader, Office and also the Windows system including Internet Explorer. Thus remove anything of these which you don't need (Java, Silverlight, Flash) and keep everything else always updated. There are lots of exploits out there which use problems in unpatched versions of Office, thus if you have some out-of-date Office software which is no longer supported you better remove it.
Other attacks need your help, i.e. they lure you to enable macros in office, to update your Flash plugin with the alleged newest version which the attacker helpfully provides for you, to install some plugin or download program you need to access specific content etc. Or it tries to scare you with some dialog which claims to have found malware on your system and offers you a software to remove this malware. Don't fall on these tricks.

Thus how you can protect against these threats?

Educate yourself and know what can go wrong. Then don't do anything which might be dangerous. Don't open unexpected attachments or links, don't install some software from the internet unless you are completely sure that it is definitely the one you need.
Keep the system clean: Remove any software you don't need or which does not have any more updates. Always get the latest updates for the other software.
Protect yourself with technologies like Adblocking and Antivirus. Use a browser which includes good protection technologies by itself - Chrome/Chromium is probably currently the best here. While none of these  provide fulls coverage they reduce the attack surface (even if some claim that Antivirus is dead).
Always have current backups in case anything goes wrong. These backups should be offline so that they don't get affected. And you should have backups from multiple days in case you realize an infection too late and the backup itself is infected.

There can be much more hardening done, like only run whitelisted applications, disable Javascript in browsers, use virtual machines, using a more secure operating system ... . But after a while these protections get too much in the way of the normal work. Thus you have to find some balance between security and comfort and the risk you are willing to take.


PDF UrlMal-inf[Trj] Virus When I create PDF file from my particular DOCX file, it gets infected with the virus. But if I create a new DOCX file and create PDF from that, it doesn't get infected with the virus.

I have tried to solve the issue with Malwarebytes but it didn't work. Only AVG and AVIRA antivirus detect this malware but rather than neutralizing it, it is removing the file.

Is there any way to remove this malware manually?

The detection of PDF.UrlMal-inf [Trj] is related to the PDF contents: the file itself isn't harmful, but contains URLs (links) to sites that have been found malicious. That's why an empty file can never be infected with a PDF.UrlMal-inf.

Search your .docx file for hyperlinks.
Test these URLs with e.g. VirusTotal.
Manually remove the links that have been found malicious.
Convert the PDF again.

In order to neutralize the file, an AV would need to be able to create working PDF files.


Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS? Question

Are there any functional (or detectable) differences between the various implementations of SSL/TLS?  What are the differences between them?  (e.g. which ones implement "False Start")
Would it be a concern that someone could detect the underlying SSL code used based on the TLS response?

Background

I'm asking because it's possible for any of the following SSL stacks to incorporate questionable features (such as false start), or may have implementation-specific bugs,

OpenSSL is written in C, used in Apache
GnuTLS are written in C
Sun's SSL implementation (mostly written in Java)
I'm not sure if the Microsoft TLS uses Win32's under the hood, or if it uses managed code.

There is a lot of variability in SSL/TLS; for instance, when data must be sent, it is split over one or several records, and the implementation is free to choose the size of each record as it sees fit (within the standard size constraints). Modern implementations, in particular, tend to make a few very short records (with 0 or 1 byte of application data) as a protection against the BEAST attack. Also, every implementation supports only a subset of the hundreds of possible cipher suites. The bottom-line is that it is possible to distinguish implementations from each other (I do not know of a readily available tool which does that, but it does not look very hard to do).

Leaking which implementation is used is not a big issue by itself (although it tends to make people nervous). Anyway, if the SSL server is used within a Web server, identifying the Web server already yields definite clues about the SSL implementation (if the server is IIS, the SSL code will be the one from Microsoft...). Also, there are not so many SSL/TLS implementations out there; the attacker needs not guess which is used, he just has to try out all the exploits he knows until one works.

If you use an implementation which has "questionable features", then the issue is not that the attacker may know or guess that you use this implementation -- the issue is that you use an implementation with questionable features.


Browsers tripping on timezones and renewal of Security Certificates On Friday evening (JST) I was reviewing the website of a company dealing with currency trading. No problems. On Saturday morning try I go back to the site, but both Chrome and Safari say they don't trust the security certificate. I checked it and the validation had expired. Odd that.

Then this morning, I visited the site again and the certificate is valid and I can get in (on both Chrome and Safari)

Then I noticed a quirk.

With the failed certificate, the notice said the certificate expired Saturday Aug 13, 2016 at 8:59:59 JST.

But with today's valid certificate the notice says the the certificate is valid from Aug 13 2016 00:00:00 GMT.

I did a check of the time difference and 8:59:59 JST is 23:59:59 GMT (note: the UK is on summer time)

Is this a problem with how browsers check certificate validity? Do they always assume the expiry time is 23:59:59 and the validity time is 00:00:00, but never check if there is a time zone difference or a summertime difference?

My guess is that the website's certificate actually expired, and then they bought a new one and replaced it before you checked again.

When Comodo issues a certificate, the "valid from" time is backdated to 00:00:00 UTC the day it was issued, and the "valid until" time is 23:59:59 the day it expires. So the new certificate could have been issued any time of the day on August 13.

(That's just Comodo's particular policy. Other CAs handle it differently.)

It's a bit late to try to prove this now, but you could search for the domain on a tool like Censys and see if they have a copy of yesterday's certificate.

Hypothetical timeline:

2016-08-12 21:00:00 JST (2016-08-12 12:00:00 UTC): You visit the website successfully. The old certificate will expire at 2016-08-13 08:59:59 JST (2016-08-12 23:59:59 UTC), 11:59:59 from now. The sysadmins have no idea.
2016-08-13 08:59:59 JST (2016-08-12 23:59:59 UTC): The old certificate expires. All of the sysadmins are asleep.
2016-08-13 10:00:00 JST (2016-08-13 01:00:00 UTC): You visit the website and get an error. The old certificate expired 01:00:01 ago. The sysadmins are still asleep.
2016-08-13 15:00:00 JST (2016-08-13 06:00:00 UTC): The sysadmins wake up, notice that they blew it, and scramble to replace the certificate. The new one is valid starting 2016-08-13 09:00:00 JST (00:00:00 UTC).
2016-08-14 07:00:00 JST (2016-08-13 22:00:00 UTC): You visit the website again. The new certificate is, of course, valid.


Browser page "Not resolved" page hijacked by yandex Any domain that cannot be resolved defaults to yandex right now, on any browser on my system.

Helper objects or extensions are not installed.

It turns out that the ISP (Turk Telekom) is employing DNS Poisening to achive this result. All pages that cannot be resolved now resolve to the yandex landing page.

It turns out that the DNS system has been hijacked by yandex in cooperation with turk telekom (TTNET) which in turn results in non resolving pages end up on the yandex landing page.


Source for up-to-date GPU/ASIC hash performance? I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this fast-changing field is so important for security managers, I would expect there to be a resource that provides the latest benchmarks in this area. Does such a thing exist?

In June 2016, Jeremi M. Gosney (the guy behind sagitta HPC) published the results obtained with their top-end password cracker, running Hashcat v3.00-beta: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40

This list contains all hashing functions implemented by Hashcat which, unfortunately, doesn't support Argon2i yet.

Regarding SHA256, the results are:

Speed.Dev.#1.:  2865.2 MH/s (96.18ms)
Speed.Dev.#2.:  2839.8 MH/s (96.65ms)
Speed.Dev.#3.:  2879.5 MH/s (97.14ms)
Speed.Dev.#4.:  2870.6 MH/s (96.32ms)
Speed.Dev.#5.:  2894.2 MH/s (96.64ms)
Speed.Dev.#6.:  2857.7 MH/s (96.78ms)
Speed.Dev.#7.:  2899.3 MH/s (96.46ms)
Speed.Dev.#8.:  2905.7 MH/s (96.26ms)
Speed.Dev.#*.: 23012.1 MH/s


When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality? I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from Server-View, could help the Pentesters?

The objective is NOT to keep the testers out, but to find any possible way to bypass the WAF and internal protections.

EDIT:
it's merely a WAF-testbed. The Vulns within the Apps are known and mostly marked as WONTFIX [!sic!]. You know, it's one of that "natural grown" - java-app from once upon a time ...

Your approach should be two-fold:

Technical:
Check for:

Various escape sequences (e.g. \x00, %s, \\, etc.)
Unicode tricks (e.g. multi-byte characters that end in 0x22 to produce a ")
Alternative XSS methods (e.g. <img src=0 onerror=alert(1) /> instead of <script>alert(1)</script>)
Various nasties (e.g. XSS, SQL injection) inside of cookies and HTTP headers - often WAFs miss these!

Advisory:
Ensure that the client understands that a WAF is just a sticking plaster, and cannot fix a broken limb. If the application is broken in an exploitable way, a WAF may prevent the attack or mitigate some of the impact, but there is no way to be sure if it will be effective.

It is also a double-edged sword, in that people often assume that a bug that a WAF makes unexploitable will always be unexploitable, and therefore doesn't need to be fixed (at least with any haste). Browsers and HTML / CSS / JavaScript / SQL / XML / server-side languages, etc. evolve constantly, so new exploit techniques may come along that make old bugs exploitable.

One additional point I'd like to make: if the test is aimed at the web-app, and not specifically aimed at the WAF solution they have deployed, then I would highly recommend asking the client to disable the WAF on their staging site for the duration of the test. Leaving it on makes it much harder for you to give them a reasonable estimate of the security posture of the application, and that means they get less value from the test. If they're really interested in testing the WAF, they could do an additional test day afterwards that compares the exploitability of the found issues with and without the WAF being enabled.