Is HelloSign actually compliant with EU Regulation 910/2014 (eIDAS)? EDIT

I added the full replies I got from HelloSign. These may perhaps help someone more expert than I am to determine if they actually provide an AdES signature. Please note that I also asked questions regarding private certificates that as far as I understand now are not required by an AdES signature.

Q: How can I identify the signatory from the document he/she signed?

A: This is outlined in the portion of our Terms of Service > Audit Trail. In summary HelloSign creates a transaction log between signing parties that help to identify signers.

Q: How sole control of the private key by the signatory is assured?

A: HelloSign Offers an Advanced Electronic Signature (AES) In order to be considered an AES the following requirements must be met:
- uniquely linked to signatory
- capable of identifying the signatory
- created using electronic signature-creation data that the signatory can, with   a high level of confidence, use under his/her sole control

HelloSign meets all requirements to be considered an Advanced Electronic Signature.

Q: How accompanying data may be checked against modification after the document is signed?

A: A document once signed can not be reopened and modified. In addition to ensure any tampering of your transaction log is detectable, we process the transactions log with hashing technology.

Q: How the signature is invalided in case the document is modified after it i signed?

A: In the event a document is contested, HelloSign will provide the transaction log which will show if any changes were made to the document after signing.

NB: This question is about a specific issue of compliance of HelloSign services with the eIDAS Regulation. It has nothing to do with other questions about DocuSign or HelloSign I have read about on this forum.

I happen to use electronic signatures now and then. In my country, Italy, as well as in most European countries, electronic signatures are in use rather widely and successfully. The most recent legislative framework that makes this possibile is called the eIDAS regulation, a Europe-wide law about electronic identification, signature and other trust services.

Several kinds of signature are allowed by eIDAS, from least secure ("electronic signature") to most secure ("advanced electronic signature" and "qualified electronic signature").

When I discovered that HelloSign was offering an "eIDAS compliant" advanced signature service I rushed to register. After a plain email verification, during which my identity was not validated, I created a PDF file and signed it. Apparently, no digital certificate had been generated. In fact, when I checked the signed document against a common eIDAS-compliant verification tool provided by the European Union and hosted by an Italian Government agency (http://dss.agid.gov.it) the document appeared to be void of any certificate.

This is quite strange, as HelloSign states in its scanty legal documentation that they provide an advanced eIDAS-compliant signature, which contradicts the fact that my identity was not verified and no digital certificates were used.

I tried to have more info about HelloSign compliance from their customer service but after a lenghty and inconclusive mail exchange all I got was several versions of "our signature is eIDAS-compliant because it is compliant with eIDAS". The final reply was something like: "if you have further doubts concering our product we suggest you consult with a local lawyer". I repeatedly asked for a technical reference but I got none.

Does anybody familiar with eIDAS more than I am (I repeat, this is a very specific issue of compliance with that regulation) share my view?

I researched exactly this question some time ago, and here is my conclusion. I am not a lawyer so take anything I say with a grain of salt.

What I found out is that it seems like HelloSign takes great care to never actually state that they support advanced electronic signatures according to eIDAS.

eIDAS also states (quote from wikipedia) "no electronic signature should be denied legal effect or admissibility in court solely because it is not an advanced or qualified electronic signature".

What that means is, if you scribble your name in paint in a PDF, the court can't deny the legal effect of that signature because of that. They have to check if it is plausible/likely that you signed that. The same for HelloSign signatures. You can argue in court that the signature is valid and hand in the documentation that HelloSign provides. The court will then decide if the signature is valid.

What hello sign doesn't provide is a advanced or even qualified electronic signature.
This might be a problem in court.

From my layman understanding, with such a signature the court would likely believe the signature is valid, and one would have to prove that it isn't. With a HelloSign signature you would have to prove that the signature is valid.

eIDAS also states that qualified electronic signatures have the same legal effect as handwritten signatures. Thats also obviously not valid for HelloSign signatures.


How to handle session absolute lifetime during user activity? I'm implementing a web login system and am confused about how to think about when authenticated sessions (not just browser sessions) should be expired.
There seem to be 2 factors:

absolute lifetime of a session;
idle time.

Idle time makes sense to me.
Having an absolute lifetime implies a session should be expired even if the user is actively using the site at the time.  That would be a poor user experience; and also doesn't seem to be what happens in practice.
So how is absolute lifetime generally handled?
It seems to me one option could be to discard the current session and start a new session each time an authenticated user makes a request.  Then the session lifetime and the idle time are effectively one and the same thing, and an active user won't be logged out while clicking around the site.  But as far as I can tell the OWASP guides don't talk about this.  Is it a sensible approach?
There also seems to be something called session "renewal" but I don't understand it – is it simply changing a session's identifier without affecting its expiration?

as far as I can tell the OWASP guides don't talk about this

OWASP addresses session timeout and explains the risk:

The Session timeout defines an action window time for a user, this window represents the time in which an attacker can try to steal and
use a existing user session…

If timeout depends on idle duration only, and such token is stolen, then the attacker can first establish refresh process by sending requests regularly to have a valid token at any time. In the meanwhile the attacker can analyze the API better, construct a desired bad request, then executed it. The attacker will have unlimited time for such work.
OWASP suggests following:

Set session timeout to the minimal value possible depending on the    context of the application.
Avoid “infinite” session timeout.

Then, if the token is stolen, the attacker will have limited time to use it.
Too long validity increases the risk of successful attacks. Too short validity makes user experience worse. Only you can decide what risk is acceptable and thus what timeout is acceptable.
Some other thoughts about timeout you can find also here.
How can you implement it? Before you implement your own solution from scratch, consider using some existing solutions. For instance, there are many implementations of Open ID Connect. Implementing your own solution should address many questions. For instance, do you want your application to handle both access to resources and authentication or do you want it to be two separate applications? If you have such kind of questions, ask them as separate posts, because a single post should address a single question.


What browser plugins (ActiveX, or those for Chrome/Firefox/Safari etc) pose the most risk for your company? I'm looking for a list of risky browser plugins that we should prevent their use on the desktop.

It's probably safe to assume that old versions of Flash are on the list, but what versions?  What other objects should we check for?

All plugins. :/

With that being said, I don't think you can practically blacklist plugins.  You should really do it on a case by case basis and whitelist them.  That way whenever someone askes for one to be installed, you have a record, and can keep track of them to keep them up to date with the latest patches.


Kaminsky Bug DNS Cache Poisoning I'm trying to use Kaminsky DNS cache poisoning method. I'm using bind9 server on ubuntu and static port. So far I achieved to insert a line into DNS cache which is

;additional
www.blalba.com 80000 A 1.2.3.5

I thought that was enough to redirect users to 1.2.3.5 but when I try to get IP address of www.blalba.com with nslookup command DNS server still gives me the correct answer.

What I'm sending to DNS server is like this;

;; ANSWER SECTION:
    aaaa.blabla.com.    120    IN    A    1.2.3.4
    ;; AUTHORITY SECTION:
    aaaa.blabla.com.        86400   IN    NS   www.blabla.com.
    ;; ADDITIONAL SECTION:
    www.blabla.com.    604800  IN    A    1.2.3.5

When I look DNS cache I could find aaaa.blabla.com 1.2.3.4 record also the additional record.
Is there anything wrong with my method or my DNS server?
Thanks.

Since you can see the DNS cache has the poison in it, it sounds like you're doing the poisoning successfully.  My best guess:

The DNS server the machine running nslookup is configured to use isn't the one that's being poisoned.  (In other words, you're poisoning the bind server you set up, but nslookup is causing lookups to, say, your ISP's DNS servers, or Google's or OpenDNS'.)


Can ransomware hide in cloud storage/backup environments? I currently use Dropbox as an online backup to protect my important files (work related, save files, some hobby projects) against data loss, including ransomware, hardware loss, theft,...

However, I'm wondering whether this might actually cause more issues in some situations. Suppose I get infected by ransomware. Not much lost, I just reinstall Windows and rollback my Dropbox to before I got infected (maybe through an account rollback ticket). However, could the ransomware somehow manage to hide itself in my Dropbox folder and reinfect my machine after the rollback, or worse, other machines that sync using Dropbox?

Example: I got my resumé in my dropbox. Can ransomware alter this word file so it can reinfect me? And would this alteration survive a Dropbox rollback to a point before I got infected?

Probably not... but yes it can.

There are many places: Exe files, MSI, PDF, Word files (Macros)
I would recommend you to inspect all files with a Virus Scanner and/or a tool that detects the exact Ransomware you have just removed...

In general you should avoid storing some files in your backups (like .EXE or .MSI)

For example:

Ransomware owns your system
Ransomware detects dropbox and infects your cv or .exe with trojan or another version of himself
Ransomware encrypt your files and delete originals from your harddrive and dropbox
You get rid of ransomware and restore previous version of dropbox files
Previous version was infected in step 2 (smart ransomware developer)
Back to square 1


What infection vectors is Trojan.Linux.BillGates usually delivered with? I just discovered that my server is infected with Trojan.Linux.BillGates.G and is being used to launch DOS attacks.

It surprises me as the server is kept up-to-date (CentOS/Tomcat/CouchDB) as much as possible. My SSH server is only accessible via the public key/private key mechanism, no direct login is permitted.

It appears that this particular trojan is getting widespread recently. I have found several articles about it but none managed to clearly explain via what vulnerabilities the trojan is usually delivered. For instance, another trojan seems to always to laced in malicious packages.

QUESTION: What infection vectors is Trojan.Linux.BillGates known to often be used with?

So I have found a few resources which seem to indicate that the main infection method is done by gaining access to the system using SSH bruteforce:

A Avast antivirus research:

  The infection starts by an attempt to brute force SSH login credentials of the root user. If successful, attackers gain access to the compromised machine, then install the Trojan usually via a shell script.

A Akamai reasearch:

  Like the XOR botnet, this malware is believed to be of Asian origin. The attackers are using
  the same methods for infection, which are primarily SSH brute force attempts for root login
  credentials (previously it was reported that infection methods include a vulnerability in
  ElasticSearch Java VM).


double-new attack? replace contact method twice so that the "new" and "old" one are both attacker-controlled With some services, if an attacker changes the value of a user's contact information (email address, for example), when the user tries to recover their account, they can use either the new or the old value for contact information to do the account recovery, precisely to guard against the attack where the attacker tries to block account recovery by changing the contact information.

The problem is that some services implement this incorrectly, so that if you just change the contact information twice, these values become the values for the "new" and "old" contact information, which means the attacker just has to change the email address twice and now they control both addresses.

It seems the correct implementation would be that when an "old" value has to have a minimum time being the "old" value before it can be "aged out".  So if you change your email address from A to B, then the stored values would be:
current_value: B
old_value: A
But then if you immediately change your email address to C, then the values should be:
current_value: C
old_value: A
rather than updating old_value to B.  And then if you wait some time period (say, two weeks) so that A can now actually be aged out, then if you change your email address from C to D, then the stored values become:
current_value: D
old_value: C

Is this a documented attack that has a name?  ("double-new" seems inelegant.)  Does this seem like the correct mitigation?

I haven't heard of a name for this, but...

A better way to mitigate this is to have a transaction log, rather than just a pair of slots for old and new values.  The company's customer service will be able to see rapid changes to the contact information, and can rollback changes no matter how long the attacker has had control of your account before you found out.


How well is the SSL/TLS handshake protected against modifications? The SSL/TLS handshake is protected against downgrade attempts by the Finished message, a signed and authenticated hash of the master secret and all previous handshake messages.

Consider a client that uses a mix of strong and weak cipher suites that connects to a server that supports the same set of ciphers. Usually, one or both parties will prefer a strong cipher, and the connection will be securely established.

What capabilities would an attacker need to have in order to actively downgrade the handshake to one of the weak cipher suites? I'm assuming that the master key establishment via RSA or (EC)DH can't be broken by the attacker.

I think they have to be able to do at least the following:

Compute a valid hash value for the modified handshake (e.g. with some cipher suites removed or changed to invalid values), without knowing the master secret, and possibly also without knowing the original hash value (depending on the encryption scheme used)
Perform those hash modifications to ciphertexts (with unknown plaintexts), since the Finished message is encrypted
Modify the encrypted authentication tag for the Finished message (since SSL/TLS use authenticate-then-encrypt) so that it is valid for the modified handshake hash, again without knowing the original value.

"How broken" does a hash function, "how malleable" does a cipher have to be to enable such an attack? Is there any chance today or in the forseeable future (considering the existing attacks on MD5, SHA1, RC4 etc.) of an attack becoming possible for one of the existing legacy cipher suites, except for maybe the export versions where the master key might be brute-forced by the attacker?

Or is it safe to leave those "moderately secure" cipher suites enabled in client and rely on the handshake protection?

In "hash" of the handshake messages, as used in the Finished messages, is computed with the PRF, which uses the master secret as additional parameter (in SSL 3.0 the computation is different but the master secret is still used; the 36-byte values are sort-of-HMAC with both MD5 and SHA-1). If the attacker alters one of the previous handshake messages, then he must be able to fix the first Finished message accordingly. That message is the first one that gets encrypted.

The consequence is that even if the encryption system is awfully weak, the attacker must be able to break it with no known plaintext whatsoever if he wants to simply learn the Finished message contents. This must be an online break, meaning that any failure on his part implies impossibility to complete the handshake. As such, even 40-bit encryption would be highly effective at thwarting such attacks.

Let's suppose nonetheless that for some reason, the encryption layer is completely transparent to the attacker (e.g. the cipher suite is TLS_RSA_WITH_NULL_SHA, with no encryption at all). Our attacker still faces two formidable challenges:

The MAC is HMAC (or sort-of-HMAC in the case of SSL 3.0), for which there is no known attack, even when using MD5 as base function (see this, and then that). To make a baseline, there is a known forgery attack on HMAC with MD4, but even that one is still very expensive and thus theoretical only.
The PRF itself is based on a lot of HMAC, so the attacker will have a hard time computing his modified Finished. Mere forgery attacks on HMAC would not be enough; he would have to be able to recover the key (the master secret).

Notably, in TLS, the Finished messages have length 12 bytes (36 bytes for SSL 3.0), while the master secret has length 48 bytes. This means that it is mathematically impossible to recover the complete master secret from the first Finished message, however weak the PRF may be.

To be able to break the handshake integrity, we have to assume a very weird interaction of the PRF with itself, since the PRF is used to compute both the encryption and MAC keys that are applied to the PRF-generated Finished contents. This looks implausible. Alternatively, break through the key exchange mechanism itself. The key exchange (RSA, DH...) looks like the only non-ridiculous attack path (as far as we know).


How can I execute shell in this CTF exercise? I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough.

How can I:

Make strcmp to be 0 (evaluate if to false)
Somehow surpress singals?

I want shell to be executed:

execl("/bin/sh", "sh", NULL);

Any ideas?

Binary is setuid and /levels/level08.pass is readable only on higher level.

-r-sr-x---  1 level9  level8   7696 Apr 25  2015 level08
-r--------  1 level8  level8    412 Apr 25  2015 level08.c
-r--------  1 level9  level9     13 Apr 25  2015 level08.pass

Program code for level08.c is below.

#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
        char buf[64];
        FILE *fp;
    signal(SIGABRT, SIG_DFL);
    fp = fopen("/levels/level08.pass", "r");
        fgets(buf, 64, fp);
        buf[strcspn(buf, "\n")] = '\0';
        if(strcmp(buf, argv[1]))
                raise(SIGABRT);
        execl("/bin/sh", "sh", NULL);
}

Make strcmp to be 0

Assuming a correct implementation of strcmp, this means argv[1] must match the contents of level08.pass exactly for 63 bytes or until the first newline/null byte.

Since we don't know the contents of the file, our only option would be to manipulate argv[1] to point to an address in memory containing the correct string (e.g. buf). The absence of any argc checks made me wonder about this, but it isn't possible the way argv is handled.

  Somehow suppress signals

Have a look at the process signal mask.

There are a couple of key points in this paragraph from the docs:

  The collection of signals that are currently blocked is called the
  signal mask. Each process has its own signal mask. When you create a
  new process (see Creating a Process), it inherits its parent’s mask.
  You can block or unblock signals with total flexibility by modifying
  the signal mask.


What are possible consequences for applications that depends on Safe Mode for security? PHP finally removed safe_mode feature:
Safe Mode

Warning
This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP
5.4.0.
The PHP safe mode is an attempt to solve the shared-server security
problem. It is architecturally incorrect to try to solve this problem
at the PHP level, but since the alternatives at the web server and OS
levels aren't very realistic, many people, especially ISP's, use safe
mode for now.

My question is:
What are possible consequences for applications that depends on Safe Mode for security?

The main reason why safe mode should be removed is because its doesn't work.  Over the years people have found many ways of bypassing PHP's safe mode.

But the lack of enforceability is only one reason reason why Zend chose to remove "safe mode".  This is a quote taken from the PHP 6 minutes discussion:

  As safe_mode is a name that gives the wrong signals as making PHP
  safe, we all agreed that we should remove this function. It can never
  be made totally safe as there will always be ways to circumvent
  safe_mode through libraries. This kind of functionality also better
  belongs in the web server or other security scheme. open_basedir is a
  feature that we will keep, and we will point users to this
  functionality in the error message that is thrown when we detect this
  setting on start-up.


Kubernetes show secrets for namespace I stumbled upon this command:
kubectl get secrets -n namespace-name

(Jay Beale, Attacking and Hardening Kubernetes | KringleCon 2020)
It seems to list the secrets for a specific namespace (here namespace-name). But I couldn't find any documentation about that (e.g. https://kubernetes.io/docs/concepts/configuration/secret/, https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#get and googling it). Does anybody has some deeper insights about this?

Found the solution. Searched at the wrong place:
-n is part of the core kubectl command:
https://kubernetes.io/docs/reference/kubectl/kubectl/

-n, --namespace string
If present, the namespace scope for this CLI request

So it shows the results for a given namespace if applied.


Is a Diffie Hellman Ephemeral key good material for being used as a symmetric cipher algorithm key? I am designing a secure protocol (for academic/learning purposes) and I am at the point where I need to (re)design the key exchange step.

In my previous implementation, I used to rely on RSA to encrypt then sign a couple of randomly generated AES keys that I would then use for traffic encryption.

It has been brought to my attention that using Diffie Hellman for the key exchange could suit my needs better but I'm not too comfortable using an algorithm I don't understand well enough, hence the questions:

I'd like to use EC-DHE and I read that the generated key was not random (read: it has some structure, that I suppose comes from the underlying mathematical concepts). I always heard that using randomly generated keys was highly recommended for symmetric cipher algorithms. Even if I hash the resulting DHE key, it still won't be "random". Is it still okay to use it for that purpose?

I understood (please correct me if I'm wrong), that in EC-DHE, the choice of the elliptic curve is basically an easy way of choosing DH parameters. Is there anything I should be aware of when picking the elliptic curve? Should I let the users decide what EC they can use?

DH (be it with elliptic curves or not) results in a shared secret. That secret is a numerical value with some algebraic properties; however, all the secrecy is contained in it. You just need to distill it, the same way you turn potatoes into vodka.

Suppose that you are using a 256-bit elliptic curve, e.g. NIST's standard P-256 curve. The elements sent over the wire are curve points, each being, formally, a pair of coordinates (X,Y) in a 256-bit field. The DH result is another curve point, and, per the standard, the X coordinate of that final point is the shared secret. It is a 256-bit value. With such a curve, ECDH is supposed to offer "128-bit security" (which is good), so the shared secret somehow contains 128 bits worth of secrecy. That secrecy is "spread" over the actual 256 bits. So there is room for structure as well in that 256-bit value.

Using the resulting 256 bits "as is" is usually considered unwise because it is not easy to determine the extent of that extra structure, and how it could be exploited externally. To turn these 256 bits into a sequence of bits that you may truncated and split into keys for AES/HMAC/whatever, the simplest method is to hash them with some hash function. E.g., apply SHA-256, and you get again 256 bits, which can then be safely split and used as you wish. For a more generic case, use a key derivation function.

As for the curve choice: since there are performance benefits to hardcode the exact curve in the implementations, most existing libraries will support only a handful of specific curves. In SSL/TLS, when using elliptic curves, the client sends a list of symbolic designations for the curves it supports, and then the server chooses one of these curves. In practice, everybody uses P-256. Of course, in a custom protocol, you can choose some other curve; you could even mandate that arbitrary curves may be used, dynamically, but then you would have to make provisions for sending the curve parameters, and this will be burdensome for implementations since most EC libraries don't offer support for arbitrary curves.


Why use XOR or OR operator for "bypass" a conditional jump I'm currently working on a challenge on root me but had to read the solution on internet because I couldn't progress anymore. I read this article which talk about the challenge I'm currently working on.

He's "bypassing" (don't know if that is the right term) the JNS instruction using:

(gdb) set $eflags = $eflags ^ 128

And also the JNE using:

(gdb) set $eflags = $eflags | 64

Can anyone explain why he is using the XOR or the OR operator?
And why with the 128 value and the 64 value?

EDIT: This is a question I already asked on StackOverflow but nobody answered.

We are now at the JNS instruction. This means Jump Short if Not zero
  ...
  So lets go back to where the JNS instruction was and unset the SF flag
  so the jump gets executed. SF is the 7th bit in the register so in
  order to cancel it we need to xor with 2^7 = 128

There's actually an error in the first sentence here, JNS means "Jump if Not Sign", i.e. jump is taken if sign flag is not set. The following logic is valid: he decides that he wants the jump to be taken since otherwise the program will exit. So the sign bit should be cleared.

As he says, the sign flag is bit 7, a xor with 128 (= 2^7, or 0b10000000 in binary) will flip it. (the result of a xor is 1 if exactly one of the input bits is 1.) Since he checked just before that the bit was set, there's no risk of accidentally setting the bit. Generally one would and with the inverse (i.e. 127, or 0b01111111) to clear the bit. (result of and is 1 if exactly both inputs are 1.)
Wikipedia among others has truth tables for the logic functions.

In the second case, the bit at position 6 needs to be set, and or with 64 (= 2^6, or 01000000) does it. (result of or is 1 if at least one input bit is a 1.) He could have used xor to toggle it too, but that would again require checking if the bit is set first.


Is running a DNSSEC enabled DNS service as hard as running a CA? I think we all know that running a CA is really hard to get right.

Now there's a "new" system that uses digital signatures to associate data with names: DNSSEC. DNSSEC signs the DNS records and therefore binds their values (f.ex. TLSA / A records) to the specific domain name.

For the question let's consider two scenarios:

Some user sets their own BIND server up and uses DNSSEC only for his zone, of course he publishes the DS record in the appropriate zone.
Some company offers a DNSSEC DNS service and takes care of all the configuration.

Now my question(s):

Is the task to run a DNSSEC server (in either of the above scenarios) as complex as running your own CA and requires the same amount of care?

As we are running to 2 solution in for our company, here is a rather fair point of view.

When you are outsourcing the CA or DNSSEC service, all that's matter is how much trust do you have in the 3rd party company providing your the outsourced service. In order the outsource the complexity you'll have to rely on on the secure practices of the CA/DNSSEC provider.

For the 2 services, the main point you'll have to take about is the key management. You'll have to protect your private keys in order to prevent being compromised. As Kurt mentionned, it's perfectly fine to handle the KSK and the ZSK as stated.

But the experienced operational complexity for the 2 services is the following:

CA: The main tasks you'll have to achieve is the (re)issue and revoke certificate. These processes are rather simple because if you issue a wrong certificate just revoke it and issue a new one using your issuing certificate. If a service is disturbed, i.e. wrongly signed or invalid certificate, your service will be disturbed till the moment you'll put in place the new certificate.
DNSSEC: The main task to resign the zone (on time basis according to the validity lift time of the signed zone) and also re-sign when adding modification to your DNS zone. But if something goes wrong then your invalid DNSSEC zone will be cached in other DNS (i.e. clients, other companies) usually for 48 hours. As a example if your client are using google's DNS (8.8.8.8 & 8.8.4.4) your wrongly signed DNS zone won't be resolved trough google DNSs causing a huge service disruption. Your only chance will be to wait until your signed zone expires are other DNS will renew it.


user account management: is it acceptable to keep an account locked after the password is already reset Is it alright to keep an account locked after the password reset? Say, for example, I have an account locking mechanism that will lock the account for 5 minutes after 3 tries.

Now the user performs a password reset and is successful. Should I keep the account locked and wait for the 5 minutes to complete or should I already unlock the account?

This depends on why the account was locked in the first place.

If the account was locked due to too many failed login attempts and the password reset procedure is also used to "recover" forgotten passwords (as in, the 'forgot password' link on the login screen sends the user into the password reset procedure), then it serves no purpose at all to keep the account locked after the password was reset successfully.

On the other hand, if the account was locked for administrative reasons (for example, the user got a temporary ban due to misconduct), then a password reset should definitely not unlock the account.

And there are many other situations somewhere in-between.


How to secure SFTP against symlink attack? I've configured SFTP on my virtual machine, because I wanted to test how can I use symlink in order to access files outside from user home directory.

I've created user:

test:x:1003:1001::/var/www/test/public:/bin/false

Ownership and premissions:

drwxr-xr-x  root root test

drwxr-xr-x test sftpusers public

Here is my sshd_config:

Subsystem sftp internal-sftp

#UsePAM no

Match group sftpusers
ChrootDirectory /var/www/%u
AuthorizedKeysFile /var/www/%u/.ssh/authorized_keys
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

After that I had to login into my SFTP account and from there I did:

sftp> symlink / /public/root

I think most of the servers which use SFTP are configured in a similar way.

So, what can be done in order to prevent symlink attack?

The problem is that the symlink looks different in the chrooted environment and from the point of Apache/webserver view.

Unless the symlinks are necessary for the users, the obvious option is to forbid users connecting over sftp to create symlinks. You can do that using a parameter to sftp-server:

internal-sftp -P symlink


If I migrate from dovecot/imaps to exchange will I be less secure? I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - particularly because the client is a charity and gets Microsoft software almost for free.

There are a few things I'm worried about however because I have limited experience with Exchange:

They have a lot of remote users including BlackBerry/iPhone connections
The imaps password is currently different to their windows login - and I'd like it to stay that way if possible
I've heard scare stories (a few years back) that Exchange is less secure

In principle is Exchange with imaps enabled any less secure than using dovecot? How about MAPI access with remote Outlook clients assuming that is possible)?

Of course, you'd have to do a detailed risk assessment to answer this question, but some points that may reassure you:

Exchange always encrypts all RPC traffic, client-server and server-server. It relies on the OS for this, so the algorithm varies: I think it's typically RSA or CAST?
And it always encrypts all internal HTTP traffic with TLS.
By default, it always attempts to use TLS when talking to external mail hosts (and you can prevent it falling back to plain SMTP on a per-host basis)
All remote clients connect over HTTPS.
Exchange has hooks for tight integration to anti-malware, anti-spam, and backup systems, either from MS or other vendors.
Exchange has tight BES integration for Blackberry; and iPhones use Microsoft ActiveSync for their push email - which was designed for Exchange.
Exchange has topology options allowing you to put a limited functionality edge server in the DMZ.
Exchange supports IRM and S/MIME for encrypting/signing individual messages.
Exchange has pretty comprehensive resiliency/recoverability features
Exchange has built-in compliance options (e.g. email retention and discovery)

For your specific Outlook question, Outlook has a feature called Outlook Anywhere which wraps it's RPC traffic in HTTPS. It's used automatically when the client detects it is not inside the network.

Exchange doesn't do any authentication itself though - it entirely depends on Active Directory, in fact there isn't really such as thing as an "Exchange account" - so having separate login and email passwords is not trivial. Some people do manage it, I believe, by having a separate AD domain for Exchange, but this means a lot of extra work.


Forefront Identity Management Server Hardening Is there a good document for hardening FIM? I've tried CIS and NIST, but I couldn't find anything. If there is no such document, what would I have to look out for in the configuration?

I haven't seen such a document before.
FIM uses security groups for controlling access to the synchronisation engine and sets for the FIM service.
My suggestion is to use AD security groups for the synchronisation engine that way you can utilize AD auditing to monitor the security groups.

By default the FIM service uses a least privilege approach and you can monitor request history which will highlight set membership changes and successful / rejected requests.

Apart from this FIM is deployed on Windows server, Sharepoint (wss / foundation ) and SQL server, so be sure to harden these components as well.


Why does PGP use symmetric encryption and RSA? Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see how this is any safer than straightforwardly RSA-encrypting the actual message.

It may very likely be that I am simply too naive in terms of security and encryption, but if I can obtain your RSA private key, why does it matter whether that gives me access to the message body or the other key that will unlock the message body?

RSA isn't really built to encrypt large pieces of plaintext. Each RSA "round" can encrypt 117 bytes of data, and to encrypt more, you'd have to use some chaining mode. Currently, this means extra overhead, slowness (remember, RSA is pretty slow), and security uncertainty (RSA-chaningMode hasn't been scrutinized as other types of encryption schemes). <- BAD

By using hybrid encryption (symmetric + asymmetric for the symmetric key) you get the benefit of asymmetric, namely, not having to worry about exchanging keys; and symmetric, very fast and has been well-vetted. <- GOOD

For more information please check: How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?


Use of Teleport instead of SSH From a security standpoint is it safe to run Teleport instead of an SSH daemon?

For anything really sensitive, it's hard to justify using Teleport given how young it is.

OpenSSH is battle-tested and has had 10000's of developer hours spent on it, as well as countless audits.

OpenSSH is also guaranteed to be around for a long time to come.


How does one go about network forensics investigation with no prior knowledge? I am being asked to perform a forensics investigation on a network.
The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration changes are being made, and all sorts of modifications are occurring on the network devices. IT ranges from the Firewalls, through the SSL VPN device and all up to the switches. The system administrators are feeling like they are being toyed with, and I was asked to see if I can find anything (this hasn't been labeled a real "forensics investigation" since I am no forensics investigator, but was simply asked to give me best effort on this).

The question is, how do I go about it?
Does it all just come up to collecting the logs and looking for events around the time that the company felt the changes?
Is there any basic methodology "for-dummies"?
Is this sort of investigation an easy task or is it tedious and boring, time-consuming effort?

OK. I promise I'm not trying to be mean about this.

To paraphrase the question: how do I go about performing forensics with no prior experience?

You don't. Seriously. There are dummies books available that will touch on the basics and there are a number of websites that will walk you through common situations but to perform any defensible forensic analysis you will need the proper training and documentation.

To the point of 'this hasn't been labeled a real "forensics investigation"'; maybe it hasn't, but it could and there is a very real possibility that you could alter evidential data in your analysis. Should this become a 'real' investigation you might find yourself in a bad situation.

-IF- you get it in writing that this is not ever ever ever going to move toward a legal issue, with complete indemnity for you, then grab a copy of Computer Forensics for Dummies and have a ball.


What is the difference between SSL\TLS vs certificates? Are digital certificates part of TLS protocol implementation?
Is the
padlock green icon on my browser has to do with TLS use or digital
certificates?
If I use a service like Let's Encrypt to issue a certificate for my web server, how can I determine the TLS version used?

Thank you

Are digital certificates part of TLS protocol implementation?

Certificates are used for authentication inside TLS but they are by themselves not part of the protocol specification. Certificates are a concept not an implementation so they are not part of the protocol implementation either, although using certificates for authentication is part of the protocol implementation.

  Is the padlock green icon on my browser has to do with TLS use or digital certificates?

Both. It signals a successful TLS connection against a trusted site where the trust comes from the certificate. Note that this trust does not mean that the site is secure by itself or that it will not harm you, it only says that the browser connected to a site which provides a certificate matching the URL, i.e. the expected site and not some man in the middle.

  If I use a service like Let's Encrypt to issue a certificate for my web server, how can I determine the TLS version used?

The used TLS protocol version is independent of the certificate.


Is there such a thing as an Authenticated Protocol? I need two devices to communicate in plain sight and I want to know what to ask for. Nothing is secret so no need to encrypt. However, I need the source to be authenticated to prevent bad actors from sending false communications. Is there a term for protocols that carry some authentication in each message which is validated on receipt and which only the sender can generate correctly?

Yes, this would be a message authentication code or MAC. It is a cryptographic hash that only the parties that have the secret key can compute.

Party A computes the MAC over the message.
Party A sends the MAC and the message to party B.
Party B computes the MAC over the message.
Party B now compares the computed MAC to the actual MAC, and knows whether the message has been tampered with, and wheter it came from someone who had the key.

There are also asymmetric solutions to this, where party A has the private key and party B has the public key. This means party B kan only verify messages, not create them. In this case it is called a digital signature, and the message is called a signed message.


What is a good symmetric encryption algorithm for many small texts? I'd like to encrypt some sensitive data, which will be stored in an event storage. A few of the event types will require encryption and the data is in the 10 byte - 100 kbyte range. I think the main danger here that the database can be stolen and not that somebody falsifies the data, so symmetric encryption is fine, we won't need different keys for read and write. What I am worried about that the too many small, possibly repeating texts might make it easier to do known plaintext attack. Is that a real danger by nowadays algorithms? Which algorithm to choose to avoid that? Should I change the keys frequently? Are there other dangers by encrypting these events I did not think of?

It’s not the algorithm you should be concerned about as much as the encryption mode. Sure, you need to use a strong algorithm such as AES, but there are several you could choose from.

What you really need is to use it in a secure mode (not ECB!) with a unique IV. As long as each message has its own IV, it won’t encrypt to the same ciphertext. That way an attacker can’t correlate different encrypted messages to see if they’re the same.

There are no known attacks against related plaintexts in any strong, fully implemented block cipher. (There are some reduced-round attacks against some ciphers, but that’s one reason the algorithms specify more than enough rounds to defend against them.)

EDIT: Lie Ryan raises a good point. Make sure that message length doesn’t betray any secrets. For example, if you have a field such as “VIOLATIONS”, I might infer that a a 16 byte cipher text means “N/A” or “no data”, while a 19K ciphertext might mean the client often violates rules.


What happens if a secure token is provided to a trusted party that gets compromised Take for example - AWS STS token or JWT tokens.
Let’s say node A got a token for accessing a resource of account X on behalf of account X. Access includes read/write privileges.
Let’s say few minutes later the node A got compromised.
Nothing else knows that A got compromised.
Question Account X is also compromised now. Correct?
Question We will continue to provide renewed tokens to access account X to node A because we have not detected that node A is compromised yet. Correct?
Question What should we do to detect that node A is compromised?

There's not really enough information to determine the specifics here, but there are some general answers that can be provided.
In your scenario, the assumption by default should be that node A has had the ability to access and modify account X within the scope of the permission of its token.  This is, generally, why tokens are usually limited to certain scopes, so that, for example, if node A needs to access directory information about account X, it cannot abuse that to also modify other information on the account.
This is also why automated tokens tend to be time limited—so that the abuse of account X by node A is limited to the life of its tokens—and why credential issuance is usually logged—so that any misuse can be easily determined and the extent of access can be readily discovered.  If tokens are issued using sufficient entropy, it is also common to log their access using a hashed version of the token so that actions taken by a bad actor can be determined.
Whether, in this situation, it means that account X is compromised (that is, under the control of the attacker) depends on what data the attacker had the ability to access or modify, both due to the scopes and duration of the token and the design of the system.  If, for example, the token grants the attacker the ability to do only cosmetic changes, like change personal names or avatars, then the account is, while potentially defaced, probably not compromised.
If your system permits the issuance of additional tokens to node A, then you may well provide it additional tokens.  That, of course, depends on the design of the system.
To detect compromises, you will generally want to have some sort of automated measurements or metrics that detect indicators of compromise.  What those are depend on the system.  For example, if you know that nodes are generally only supposed to handle about 20,000 accounts per day, you may set up a dashboard or an alert to detect large numbers of issued tokens or tokens issued for many accounts, so you notice it's acting strangely.  You may also monitor other indications of compromise, such as loading of additional kernel modules, unusual usage of sudo, or access from or connections to unexpected systems.  All of this depends on what you know about your instances and systems and requires that you build in suitable metrics and monitoring that are appropriate for your scenario based on suitable threat modeling.  You will need to balance good detection and prevention of threats with gracefully handling the occasional anomalous but harmless traffic pattern and avoiding major inconvenience for staff.


What exactly does L2TP (over IPsec) mean? I understand that one of the ways in which a VPN can be implemented is via L2TP over IPSEC. What does this mean exactly? I know that IPSEC is a network layer protocol. On the other hand L2TP is a data link layer protocol.

Does L2TP over IPSEC then encrypt the data twice (at the network layer and the data link layer?)

No, L2TP over IPSEC only encrypts once, the encryption is done by IPSEC. It is used when you wish to encrypt your data link layer. IPSEC will handle IP packets. Your data link layer is converted into L2TP IP packets, with no encryption. Then you encapsulate the L2TP in the IPSEC protocol.

If you don't need to transport your data link layer over IPSEC but only your IP layer, then you don't need L2TP since IPSEC can handle the IP packets.


Does random online keyboard increase security? This bank's website* has a login form for their internet banking section. They disable the password field, and display a randomised virtual keyboard under the login form where users must click on the buttons to add characters to the password field.

* I don't know whether I'm allowed to actually link to the bank's website for demonstration purposes, so I'm not doing that. I can add it if it helps.

I think this is terrible because:

It makes it a lot harder for users to type in their password.
People looking over their shoulder can easily see what key the cursor is on, and thus undermine the whole point of password obfuscation.
The restrictions on the password field are client-side and easily to disable.

Is there any good reason to use this kind of technique that perhaps I am missing?

The use of an onscreen keyboard (especially randomized) is a big inconvenience to users - and that, in general, is bad for security.

Technically, any onscreen keyboard is deployed to fight keyboard loggers (a real problem since most banking trojans use this). Randomizing the keyboard helps against mouse action recorders.

However, in this case, by disabling the password field (especially since it prevents password managers from working), the bank is doing more harm to their users than good. IMHO, the net impact on security is negative.


What is considered a reasonably high iteration count? I copy-pasted a function that implements the PBKDF2 hashing algorithm in PHP. The function asks for the amount of time that I would want it to loop in order to produce a hash.

Now, I'm wondering, what would be a reasonably high iteration count that ensures a very secure hash, while at the same time does not cause the server to slow down to a crawl.

Well, you said it. The right count is exactly the count which "does not cause the server to slow down to a crawl". You want it to be as high as can be tolerated, given the hardware you use yourself and the expected average load. As @Jeff said, this is a matter of a benchmark.

The whole concept is about making the password hashing process slow for the attacker. This makes it slow for _everybody, including you, so you cannot make it as you would wish. The principle at work here is that your notion of cost, and that of the attacker, are not exactly proportional: a 1000x cost increase is "free" for you if it means that you will spend 1ms instead of 1µs to authenticate a user, whereas turning a 1-hour attack into a 6-week attack is certainly not free for the attacker.


Hacked bluetooth speaker I recently purchased a new OontZ Angle Plus bluetooth speaker and I believe that it has been hacked.

I can't connect any of my devices to it, the bluetooth light indicates that it has been paired with a device, and if I turn my bluetooth on with my computer I will receive never ending messages to connect to an apple mouse (which I don't have, and this will only happen when the speaker is on).

This will happen no matter how often I turn the speaker on and off. It worked for about a week when I first purchased it but no longer.

Is it possible to hack this speaker? I'm fairly sure it is.
Can I fix it?
Can I figure out who is doing it?

The speaker is at my house and to the best of my knowledge my neighbors would not be capable of doing anything like this.

I doubt the speaker was "hacked" :) It could either be a defect or broken speaker, or if you ordered it used from Ebay, it could already be paired. I don't think that your neighbors even know you bought a speaker, and looking online aren't any security problems with that specific speaker.


How fill up a gig interface bandwidth with hping3? I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, unfortunately nothing changed in my interface's bandwidth!

Well, my question is: How should I fill up my interfaces bandwidth for DOS attacks simulation?

@camp0 here is the result of ethtool:

# ethtool enp3s0
Settings for enp3s0:
    Supported ports: [ TP MII ]
    Supported link modes:   10baseT/Half 10baseT/Full
                            100baseT/Half 100baseT/Full
                            1000baseT/Half 1000baseT/Full
    Supported pause frame use: No
    Supports auto-negotiation: Yes
    Advertised link modes:  10baseT/Half 10baseT/Full
                            100baseT/Half 100baseT/Full
                            1000baseT/Full
    Advertised pause frame use: Symmetric Receive-only
    Advertised auto-negotiation: Yes
    Link partner advertised link modes:  10baseT/Half 10baseT/Full
                                         100baseT/Half 100baseT/Full
                                         1000baseT/Half 1000baseT/Full
    Link partner advertised pause frame use: Symmetric Receive-only
    Link partner advertised auto-negotiation: Yes
    Speed: 1000Mb/s
    Duplex: Full
    Port: MII
    PHYAD: 0
    Transceiver: internal
    Auto-negotiation: on
    Supports Wake-on: pumbg
    Wake-on: g
    Current message level: 0x00000033 (51)
                   drv probe ifdown ifup
    Link detected: yes

You don't need hping3 to fill your gigabit pipe: the standard ping utility in my Debian creates about 1.3GiB/s when using the flood and data size options. CPU seems to be spent on creating the packets and so at 100% CPU, the only thing you can do is create larger packets rather than more packets.

hping3 with the exact same arguments (flood and largest possible packet size) gets me 2.1GiB/s. The default protocol there is TCP; in ICMP mode, it goes even further at 3.3GiB/s. When not pinging localhost, the MTU will be an issue, but with the largest possible packets and fastest possible setting, that's all you're going to get out of hping3 (well, that and running it in parallel like you already do).

Note that the easiest way to bring a website down is almost never to fill up the pipe with raw data. Find an HTTP request that takes a few hundred milliseconds (search queries, login requests sometimes, that sort of thing) and flood that. Since you can re-use TCP/TLS connections, you only have to worry about the actual request, so let's say 250 bytes. On a slow home internet connection of, let's say, 10mbps upload, you can do that request 40 thousand times per second (10e6/250=40k). Given that each request takes a few hundred milliseconds, let's say 250 (¼s) to make things easy, the site would need ten thousand CPU cores to keep up with that (40k*¼=10k), assuming that CPU is the internal bottleneck. Or even more efficient: send 1000 requests in parallel (making sure that the thousandth request is sent before the first one is done processing), once, and at least for smaller sites odds are that the site does not recover on its own.

This is a bit outside the scope of this question's title, but in the body you mentioned that denial of service attack simulation is your real goal, so this is how I would go about that (it works for a significant portion of our clients: DDoS is out of scope but a search query that takes 2 seconds makes this child-play and so we mention it as a risk).


Given a vulnerable JavaScript snippet from a Stack Overflow answer, how can I cheaply find websites whose authors have copied and pasted it? Frequently, Stack Overflow answers to JavaScript questions contain XSS vulnerabilities (or vulnerabilities of other kinds). For instance, this answer with 420 upvotes and a quarter of a million views to a question about decoding HTML entities is likely to cause an XSS vulnerability if used on untrusted input.

Given the popularity of the answer, we can safely assume that there are dozens - maybe hundreds or thousands - of websites using this vulnerable code snippet. Finding these is of interest to both blackhats (one of those sites might happen to be something worth hacking) and whitehats who would like to inform the owners of those applications about the vulnerability.

However, locating such websites is not a trivial problem. Google doesn't index JavaScript, so we can't simply Google for the snippet and find vulnerable sites. Searching GitHub finds some instances of the snippet being copied and pasted, but the source of most websites is not publicly hosted on GitHub. Spidering the entire internet myself and searching all the JavaScript on the web is, of course, a theoretical possibility - but not one that I (or most people) have the resources to do.

So what practical mechanism does a normal person have to search for places where a code snippet has been copied and pasted?

There is no easy and powerfull way to mass scan for a given code.

Most of the possibilities I can think of have been written, but I will try to resume them into a complete answer. Also, my answer will applies for all snippets and not only for those from Stack Overflow.

Search for context : This is probably the most efficient way to search for source code. Are you searching for a vulnerabilities on a CMS (Wordpress, Joomla, e107) ? Most of them have specific context, such as Proudly powered by ... that you can Google. This does not seem apply to the questions you linked us, but sometimes, you can also guess a context where the code would be executed, which can help you to find them on traditionnal search engines.
Use source code search engines : Despite the fact that they are not as good as traditionnal search engines, you can still get some results for most popular website. There are plenty of them : nerdydata, globalogiq, publicwww, searchcode ...
Use code sharing platforms : As aborded in your question, you can use source code sharing platforms to find vulnerable code and trace back to the websites. Github has a effectively, but you might also try pastebin.
Crawl websites : This is probably the worst and slowly options, but it sure works.

If you are more interested about your own security, you can also :

Use a plugin : The plugin would look at the source code of the pages you visit and check if it can find a match with one of the code your searching for.

Of course, there are others powerfull way, such as using botnets, softwares you distribute ... but they require either time or illegal issues so they are not in the scope of the questions.


How important is it to use a large encryption key for SSL certificate? I'm trying to figure out which size of encryption key should I use for my SSL certificates (2k, 4k?)

Is a 2k key "sufficient"? is it crackable...? and if so, is a 4k key not crackable?

Also, how does a large (such as a 4k key) affect the speed of the connection? is it just the first hand shake that is slower or does it also slow down all traffic as well?

Thanks in advance.

"Anything may be crackable given enough time and resources."

Here is a good article that explains the differences of key size. Now imagine you exaggerate and create a 8192 key can it be cracked? Likely not. Are you safe? This all depends on the security of the system. If someone can compromise your machine and steal the key you made, the encryption strength is a moot point.

Considerations to take when asking a question like this would be to think as an attacker would.

Can I crack this (likely not)
How long would it take?
How much would it cost me (wasted time+resources)?
What would I gain putting in all this time, effort, and resources?

It is far cheaper to try and compromise the key, system, and or organization to get the key (install a keystroke logger, etc) than it is to try and brute force it.

When it comes to encryption, a lot of focus is spent on "can it be cracked" which is often a moot point when you think about the other factors. "Can this 16384 bit key be cracked on this insecure system." While it may not be cracked, it does not take away from the fact that other often overlooked factors may yield the key without the need to crack it. When someone performs penetration testing, if they can, they always copy SSL keys, screenshot them, then explain the dangers of not securing the key.
Analogy:

  You are a billion dollar bank. You buy the biggest baddest safe on the planet... and You leave the key right next to the vault.


What multiplier to use when calculating the average time to crack passwords with a given entropy? Suppose that we have a process that generates passwords with entropy E.

I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password.

From the entropy E (in bits), I can compute the total number N = 2E of candidate passwords in the universe from which a given password was chosen.  On average, a brute-force attack would have to MD5-hash N/2 candidate passwords in order to crack a specific instance.

But this calculation does not give me the amount of time that this would take.  For this I need some multiplier for computational performance, something of the form "x candidate passwords/second".

I imagine that computer security experts have some rule-of-thumb number to plug in for such multiplier x.  If so, what is it?

(Of course, if the multiplier x does not take into account the possibility of multiple processors working in parallel, then whatever time one computes using such a multiplier would have to be divided by the number P of processors that the attacker can have running in parallel.  If there's a standard rule-of-thumb-like value for P, I'd be interested in that too.)

The term you're looking for is "hash rate", and a quick Google search indicates that a GPU-based password cracker can try on the order of 10^10 passwords per second when cracking MD5 hashes.

Generating hashes is an example of an "embarrassingly parallel" process, so doubling the available computing resources will double your hash rate.


Can I tell that both VPNs are used by using those traceroute info ?

Just based on the traceroute this is not possible. You need at least to know what the endpoints of your VPN connections should be and check if these are shown in the traceroute.

If the router VPN is used these endpoint IP are the VPN entry (router) and exit (somewhere on the internet). If the laptop VPN is used the VPN entry is the local computer and the VPN exit is somewhere on the internet. If both VPN are used together it will exactly look like if laptop VPN is used only since the underlying carrier for the laptop VPN (i.e. the router VPN) is not visible from within the laptop VPN but only from outside.

  If both VPNs are used, shouldn't I get more hops used in the 2nd traceroute ?

No, you should get the hops until the VPN entry (i.e. local laptop or router) and from the VPN exit (somewhere on the internet). Thus it depends on where exactly entry and exit are.

  Is there a more reliable way to test if both VPN are used ?

You cannot see this way if the VPN are stacked. A packet capture on all the entry or exit points of the VPN would be more reliable.

  Are the "VPN passthrough" settings in my DD-WRT router involved in my questions ?

Probably not. This should not be relevant for OpenVPN connections.


Does a Windows 10 endpoint check software installations for malware if they are installed through GPO / SCCM / Software Center? I'm trying to get a view on what extra security checks our packaging team could do when they download a potentially infected installer from the web before they package an MSI or EXE (assuming that the software vendor didn't provide a checksum or the staff member from the packaging team omitted to check it). By nature, these installers are run with administrative privileges, increasing the chances of exploitation.

I was wondering to what extent an infected installer would fly under the radar if it is downloaded to a SCCM server and packaged there for distribution to clients. If the installer is never run on any system before being deployed, will malware detection on the endpoint be triggered upon installation?

As Windows Defender Smartscreen only kicks in when you actually run the installer (verified by downloading https://demo.smartscreen.msft.net/known/knownmalicious.exe), how is that handled when a software installation is done silently through a GPO / Software Center? Does the packaging process do some sort of a "dry-run" of the executable before packaging it? (checking publisher certificates, perform a virusscan, try to run it and see if SmartScreen goes off, ...) or is it assumed that the person performing the packaging does this manually?

Any and all input and/or links to resources are highly appreciated.

Instead of waiting for the application getting deployed by SCCM or GPO you should at least apply the below Security measures:

1) Monitor any new application get deployed
2) Monitor accounts that have privileged permission which is used by SCCM
3) Monitor SCCM or AD login attempts
4) Not allow any application to be deployed unless it get approved by Security team
4) For RDP apply MFA

There is also many more, and regarding AV's it will check the signatures once the file land on the hard disk for signatures.
but bear in mind that there is alot of application that can harm your environment that are not detectable by old AV's since they write on Memory sections like fileless malwares and many more so take proactive measures before anything get deployed in your environment.


Spoofing TCP/IP stack OS Fingerprinting attacks in OSX We need to change our OSX fingerprint in order to impersonate the Android OS against "passive OS fingerprinting" attacks.

For Windows machines there are tools/guides for doing that, but can't find any for Mac OSX machines :(

This attack works even if I browse a website using Tor browser!

This attack works even if I browse a website using Tor browser!

I think you are wrong here.

You are talking about fingerprinting the TCP/IP stack and you claim that the original OS can be even detected this way if you use Tor. But Tor nodes do not simply forward packets like a router does but instead the data are re-packaged in user space and you have each time a new TCP/IP connection. Thus what you should see with fingerprinting at the TCP/IP level is at most the OS of the exit node. This also means that any changes on the TCP settings of your OS should have no effect regarding fingerprinting when you are using Tor.

Since you have probably checked against some site which claimed to detected your OS even through Tor I recommend that you share a link to this site so one can find out how the detection is really done there.


Best way to store/retrieve sensitive key files? We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server instance, pull down our repo and build our application. I need a way to get the keys down to the server to put into the environment for the application. Since we are deploying multiple times a week, this can't be a manual process. I also don't want to put the keys in our repository. Even if we encrypted a file with all our keys, we will still need a key to decrypt it on the other side. I have a solution in place, but whenever we need to add/change keys it's not very straight forward.

Can anyone think of a good way for me to get these keys into the environment?
Thanks!

I know I'm late on this one, but might benefit someone else facing this problem now.

You could do the following:
- Put a master key in the database
- Checkin the actual key in code repo, but encrypted by the master key.  This checked in key could be in a password protected file.

A few months ago AWS has come up with a new service called KMS (key management service).  They take care of managing the actual key and its master key in a secure and compliant manner.


Is Data Remanence a Myth? Possible Duplicate:
  Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Multiple overwrites have often been discussed as a secure way of erasing data. Some people say that the only way to securely erase a magnetic HDD is to physically destroy the device, grinding each platter to powder, incineration etc.

If I ask the question whether a single overwrite makes data permanently irretrievable, I get different answers. Some people say that it was an issue on older hardware, others that it still is. I have not come across a case where a single overwrite of zeros has been recovered, despite many people theorising that this could be done using techniques such as magnetic force microscopy.

It seems that in general people err on the side of caution under the assumption that one of the mysterious government entities has some crazy eletron-microscope equipment capable of recovering data after single, or even multiple overwrites.

While this is clearly the sensible option as it doesn't take a great deal of time to shred a disk this way, the question remains; is it necessary?

The best citation I can give is from Overwriting Hard Drive Data: The Great Wiping Controversy, which was published as part of the 4th International Conference on Information Systems Security, ICISS 2008. You can view the full text of the paper by viewing the book on Google Books, and jumping to page 243.
The following excerpt is from their conclusion:

The purpose of this paper was a categorical settlement to the controversy surrounding the misconceptions involving the belief that data can be recovered following a wipe procedure. This study has demonstrated that correctly wiped data cannot reasonably retrieved even if it of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of data of information from a wiped drive is in error.
Although there is a good chance of recovery for any individual bit from a drive, the chance of recovery of any amount of data from a drive using an electron microscope are negligible. Even speculating on the possible recovery of an old drive, there is no likelihood that any data would be recoverable from the drive. The forensic recovery of data using electron microscopy is infeasible. This was true both on old drives and has become more difficult over tine. Further, there is a need for the data to have been written and then wiped on a raw unused drive for there to be any hopy of any level of recovery even at the bit level, which does not reflect real situations. It is unlikely that a recovered drive will have not been used for a period of time and the interaction of defragmentation, file copies and general use that overwrites data areas negates any chance of data recovery. The fallacy that data can be forensically recovered using an electron microscope or related means needs to be put to rest.

NIST also seem to agree. In NIST SP 800-88, they state the following:

Studies have shown that most of today’s media can be effectively cleared by one overwrite.
Purging information is a media sanitization process that protects the confidentiality of information against a laboratory attack. For some media, clearing media would not suffice for purging. However, for ATA disk drives manufactured after 2001 (over 15 GB) the terms clearing and purging have converged.

As such, I'd say that data remanence on modern hard drives is a complete myth, and it's likely to be infeasible for old drives too.
So, as a quick set of bullet points:

You might be able to extract individual bits after a single overwrite, but not any useful amount of data.
It is entirely infeasible to recover any data, even at the bit level, from a wiped disk area outside lab conditions, due to the effects of day-to-day use (file copies, etc).
A single overwrite, for all intents and purposes, provides complete protection against useful data recovery.


MD5 collision attacks: are they relevant in password hashing? DISCLAIMER: This is not an endorsement of MD5 as a password hashing function. I know about parallelization, GPUs, and dedicated password hashing functions like bcrypt and scrypt.

With that out of the way, I'm getting at least a little irked when every time someone mentions "MD5" and "password hashing" in the same sentence, the hivemind jumps in and screams "MD5 is broken!" (usually followed by a misinformed suggestion to use another general purpose hashing function like SHA-*).

But is it really? As far as I know, all feasible attacks on MD5 are chosen-prefix attacks. Are any of these in any way applicable to hashed passwords?

And in a related question: while hash collisions are 2n/2, does that really mean anything when used against passwords, especially over the web? Just because you've found a collision doesn't mean you'll be able to send them in password field, which is usually limited in length and probably not binary safe.

Doesn't that mean that for the purpose of hashing passwords, a function is only truly broken if there is a preimage attack on it? And as far as I know, MD5's preimage attack is still 2123.4, which is nowhere near feasible.

Note: Bruteforcing a weak password will take much less than 2123.4, and yes MD5 is fast (by design). I'm not concerned with either of these problems, which aren't really MD5's fault.

Collision attacks have no impact on password hashing, although there can be some details depending on what you hash for. Roughly speaking, when we hash passwords, we may want to do two things:

Check that the password hashes to a given stored value: this is password verification (e.g. to know whether to grant login access to a server).
Compute a big symmetric key deterministically from the password: this is key derivation (e.g. to encrypt a file).

Password verification works only on resistance to preimages (hardness of finding a value m such that h(m) matches a given output). However, key derivation needs a bit more than that. Ideally, for key derivation, the hash function should behave as closely as possible to the mythical random oracle. We already know that hash functions based on the Merkle-Damgård construction, such as MD5 or SHA-256, are not random oracles (because of the "length extension attack"); however, we can use such functions in HMAC, which uses two nested hash function invocations precisely to avoid issues with the MD construction. But HMAC is "proven" secure only relatively to an internal property of the hash function (namely, the internal "compression function" should be indistinguishable from a PRF) and we know that this property is not fulfilled in the case of MD5, because otherwise collision attacks would not be feasible...

To sum up, when using MD5 for key derivation, we need to apply schemes such as HMAC-DRBG (a PRNG based on repeated HMAC invocations), which use MD5 internally. Such schemes are known to be strong as long as the hash function is strong, and while collision attacks do not directly apply, they show that this "strength" is not achieved. Thus, the guarantee is void. Nobody knows, right now, how to weaken HMAC/MD5, but we have the example of MD4: MD4 is thoroughly broken for collisions (collisions can be produced "instantly"), and there is a known attack on HMAC/MD4 which is quite expensive but nonetheless much faster than the theoretical 2128. The attacks on HMAC/MD4 do not exploit collisions, but build on differential paths which are the same source from which collision attacks have been designed. Therefore, it is highly suspected that HMAC/MD5 is not as strong as, say, HMAC/SHA-256 (even when truncated to 128 bits).

Correspondingly, for key derivation, do not use MD5. It would not be broken right away, but it is still looking for trouble. There is no need to immediately migrate existing systems which use MD5 for password hashing, but for new designs, you should avoid it.

Mandatory reminder:
Of course, when hashing passwords, regardless of the intended usage (password verification or key derivation), you shall apply salts and configurable slowness. A password is by itself a weakness because of biological limitations of the human brain which manages it. Salts and configurable slowness are ways to cope with it: salts thwart parallelism (the attacker cannot share attack costs between several password instance -- e.g. through precomputed tables such as rainbow tables) and slowness defeats Moore's law (computers get faster over time, but human brains do not). So you would not want to hash a password with "just MD5", but rather use a dedicated password hashing function such as PBKDF2 or bcrypt. PBKDF2 internally uses a hash function, e.g. MD5. It so happens that MD5 (like SHA-256) maps very well on the computing abilities of GPU, which makes it a questionable choice for this job, and bcrypt is arguably better (see this answer for details).


How does Near Field Communication (NFC) compare to RFID technologies? Looking for a functional primer I'm starting my independent studies in RFID and NFC and am trying to understand how they relate to each other, and what security issues are common/unique to each.

Is RFID a superset of NFC? (or vice versa?)
Is all RFID / NFC hardware the same? (my Galaxy II has NFC, but Google payments isn't available)
Can a mobile phone with NFC / RFID "read" an ID badge, Easy Pass (for highway/bridge tolls), US Passport, credit card, or other object?
Does the ability to "read" an NFC object imply the ability to "copy" and emulate it?  (Can I clone a credit card?)

Is RFID a superset of NFC? (or vice versa?)

To quote from the the Wikipedia article "NFC standards cover communications protocols and data exchange formats, and are based on existing radio-frequency identification (RFID) standards..." So RFID is just a name for devices that use radio frequencies to communicate and NFC is one of these.

  Is all RFID / NFC hardware the same? (my Galaxy II has NFC, but Google
  payments isn't available)

All NFC hardware is the same, it works at 13.56MHz and has a data transfer rate of 106 kbit/s to 424 kbit/s, as described above NFC is a subset of RFID so whilst all NFC hardware belongs to the RFID category the reverse isn't necessarily true. The reason that Google Wallet doesn't work is that it requires in addition to NFC hardware that a secure element (SE) is in the device. A secure element is needed in order to store the card details etc. According to this and this the Galaxy S2 has no SE so can't use Google Wallet.

Edit: With the addition of Host Card Emulation in Android KitKat 4.4 it looks like Google is moving away from needing a Secure Element so there's a possibilty for Google Wallet working on all NFC enabled phones at some point in the future

  Can a mobile phone with NFC / RFID "read" an ID badge, Easy Pass (for
  highway/bridge tolls), US Passport, credit card, or other object?

I'm from the UK so I'm not aware about the Easy Pass reading but if you own one you could try reading it using an app such as NFC TagInfo. However in general your NFC enabled phone should be able to read these cards, for example I can read my student card, passport, train pass and credit card all via the NFC in my phone. The credit card requires a more specialised application than other cards to be read but it can be done easily.

  Does the ability to "read" an NFC object imply the ability to "copy"
  and emulate it? (Can I clone a credit card?)

NFC is just the standard for communication, it doesn't necessary imply anything about the object. For example a very popular form of access card for buildings is the MiFare Classic (my student card uses this). The chip in most (Android) phones allows emulation of this card, although the actual Android APIs don't currently allow for this easily. So you could emulate the data on the card however generally door access systems work with something called the Unique ID (UID) of each card to identify it and your phone doesn't allow for the setting of the UID so you can't use it as a door access.

Modern credit cards generally can't be copied, however this can depend on the country. In the USA I believe it's easier to clone cards as the banks there haven't all implemented what the UK calls Chip & PIN but is more generally known as EMV. EMV helps protects against cloning as each card has a cryptographic key that it uses to sign and then return some data that the ATM sends it. This key can't be (easily) extracted from the card meaning that you can't set up a fake card with the key. However it is possible to skim some data from a credit card using NFC and I've written my own app to do this. I was just looking for similar ones on the PlayStore to link to however it looks like Google is removing them and there used to be a lot more. It's possible to get information like card holder name, date of expiry and the card number.

N.B. I'm not sure why the site I linked to suggests skimming details from an NFC credit card in 2012 is new as it has been a known weakness for years. Part of my recent dissertation was on attacks on credit cards and I'll post a Q/A on here and link to that for more details as to why (modern) credit cards generally can't be skimmed and copied.


Backtrack 5 R2 & Metasploitable I have configured the OpenVAS server as per wiki instructions:

http://www.backtrack-linux.org/wiki/index.php/OpenVas

And i ran the following commands:

msfconsole
load openvas
openvas_connect admin toor 127.0.0.1 9390
openvas_target_create Metasploitable 192.168.56.101 "Target Machine"
openvas_task_create Scan1 Scan1 3 1
openvas_task_start

When i download the report, it doens't show any vulns. Can someone tell me what i did wrong?

Both BT5 and Metasploitable are run in VirtualBox with host only adapters, and BT5 can ping the ip address of the metasploitable target machine.

Its difficult to tell what limiting network factors might be involved without a full network map, but if you have both operating systems running within Virtualbox on the same host, I would guess that its a virtualbox issue. You've got one os trying to scan the other os's network stack, while both networks are using the same network card. Switching to bridged and using a different connector for each would likely return more accurate results.

To test if the backtrack vm can even communicate with the metasploitable one, I would suggest trying to set up a telnet or ssh connection between the two, or to open up a netcat listener on the metasploitable box and scan it with nmap. Usually a vulnerability scanner reporting nothing at all is indicative of networking issues.


limit malicious log in attempts on wordpress site Following my previous question, I have installed an "activity log" plugin on my site, from this I can see several malicious log in attempts.

In above image we can see a new attempt each second, these come in bursts, so it can be quiet for 12 hours, then suddenly this happens, and then it calms down again.

Under the "Description" column, we can see what username this bot tried to log in as, this is often "admin" and that's not a problem since I have changed the default admin username, but sometimes it tries the real one too, as well as other users.

Following this realization I installed another plugin that adds a reCAPTCHA button to the login page, but the attempts didn't decrease at all.

I understand that the chances of this bot guessing the password is small, really small even, but it just might do it, and this makes me nervous.

What can I do to limit the malicious log in attempts on my wordpress site, or atleast limit its chances of success?

To limit its chances of success, make sure your users' passwords are strong and all security patches are applied on time.

From your description it looks like a simple automated brute force activity trying to break into your system in some simplest scripted ways. This on the Internet is roughly equivalent to white noise in radio transmission. It's always there in the air, always present, but as long as it doesn't prevent you from listening to the music, this is fine, more or less. You wouldn't even have noticed this if not for a recent unfortunate event not connected with this particular activity at all though.

On a /19 IPv4 network, I can see hundreds of similar attempts coming towards different IP addresses every minute. Those attempts are mostly automated, bots are trying a few simple passhrases and also a few popular exploits (hence patch management on your side) across the whole IPv4 address space. If the rest of your security policies are fine, you won't see problems with this alone. If you do have problems with security, rate limiting won't help you for long.

If it's not an automated activity, then a motivated attacker is able to use much more than a single IP address at a time and won't get fooled by any sane rate limiting. Some brute force bots are already issuing their requests once in 10 minutes or even less frequently. You can't allow just one authentication attempt in 10 minutes, an ordinary user will be upset with that.

Having said that, popular HTTP servers allow you to set up rate limiting in the configuration file:

Apache/mod_security: a sample, manual
Nginx: documentation, examples

Limiting authentication attempts to a rate close to 15r/m with some reasonable allowed burst may be a good idea.

There's also probably something wrong with either the activity log plug-in, or the reCAPTCHA plug-in, or the way all your plug-ins communicate with each other. Make sure the reCAPTCHA plug-in checks the CAPTCHA response before allowing to process the rest of authentication.

It might be also a good idea to do CAPTCHA checking only at account registration and to use MFA for authentication, it's more reliable in your case and would probably have helped you with the previous incident.


Security issues with an append-only log in UNIX I'm going over past exam papers for a security module I'm taking at university and there is a question which I can't give a great answer for.

  As a security manager in a bank you are asked to implemented an
  "append-only" log system in Unix for all transactions in your bank.
  Give five security issues you are going to address and discuss a
  proper countermeasure for each.

To make it more in the spirit of this site... What security issues are there when it comes to implementing append-only log files in Unix and what would countermeasures to those issues be?

For an authoritative answer, see your instructor.

Here are some possible security issues:

How will we enforce/ensure that the log can only be appended to, and no prior entries can be deleted/removed/modified?
Who/what will have authority to append items to the log?
Who/what will have authority to read the log?
What do we need to do to ensure that confidential information is not stored in the log, or else is adequately protected?
How will this stand up in court, if the logs ever need to be used as evidence in a legal dispute?
What information/events should I log?
How will we secure the information to be logged while it is in transit from the system generating the log to the system storing the log records?
How will we secure the log information on storage?
How will the log records be used?  How can they be used to detect attacks/fraud/anomalies?  What tools/techniques will be used to analyze the logs?

For techniques you can use to address these security issues, you might start by reading the following questions on this site (they should cover a good part of the space, and if there is anything specific missing, you can ask another more specific question separately):

Techniques for ensuring verifiability of event log files
WORM media types
What data should be logged?
Do any cloud storage system offer an append-only mode for buckets, directories, etc.?
How can I secure my log files?
How do I log everything a certain program is doing?
Is it legal to log passwords from failed logins
What's the risk if I accidently type my password into a username field (Windows logon)?
logging requirements for PCI for web applications


How does buffer overread cause arbitrary code execution? Referenced in the recent VLC vulnerability and other places, apparently buffer overreads can cause arbitrary code execution. How does it do that? Suppose in the following toy example

void badcpy(const char* src, char* dst, int n) {
    for(int i = 0; i < n; i++)
        dst[i] = src[i];
    dst[n] = '\0';
}

int main(int argc, char** argv) {
    const char* str = "I'm being overread!";

    int n = argc > 1 ? atoi(argv[1]) : strlen(str);

    char* buf = (char*)malloc(n + 1);
    badcpy(str, buf, n);

    for(int i = 0; i < n; i++)
        buf[i] += 42;
    printf("%s", buf);
    free(buf);

    return 0;
}

The worst that could happen is either the application crashing or leaking some value in memory that shouldn't be, no arbitrary execution ever takes place.

Here's a simple example:

struct {
    char userControlledIndex[2]; // single-character string
    char whocares[6]; // some more data of arbitrary purpose
} blob;

Our user is malicious:

blob.userControlledIndex = '62'; // Look ma, no null terminator!
blob.whocares = "177"; // or {'1','7','7',0,0,0}, maybe not attacker controlled?

Here's where the input is consumed:

typedef void (*func)(); // func is a pointer to a parameterless function
func func_table[10] = { f0, f1, ... , f9 }; // an array of 10 nice safe functions
int index = atoi(blob.userControlledIndex); // totally safe, will be one of 0-9
#if DEBUG
printf("index is %d\n", index); // no possible way this prints "62177", right?
#endif
func_table[index](); // invokes one of ten safe functions

Overreading the string (char buffer) resulted in control over the program flow. If the attacker knows where the func_table variable will be relative to executable program code, and can find a suitable target within the range of "indices" they can select, then they can use this as the entry point for a ROP or return-to-libc attack.

Of course, such attacks are complicated by the presence of ASLR... but buffer overreads can also give you the information necessary to defeat ASLR, by exposing a masked pointer's value inadvertently.


SSL handshake not visible in Wireshark In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address.

I have captured the apps traffic with Wireshark. You can see it below:

Also, I have captured traffic on the wifi interface or adapter as well, which is the actual interface of my laptop. You can see the capture below:

On the wifi interface, I can see that there is an "HTTP connect" packet which is being sent which is totally fine as its proxy devices and I expect that but the problem is that I am not able to see the client hello and server hello or any other SSL handshake packet. So I want to know where these packets are gone, although it is an encrypted traffic.

Also, just additional information: This app create an unencrypted HTTP micro tunnel to their server or cloud(proxy) and in these micro tunnels the traffic is being sent but how my Facebook (which is an encrypted traffic being sent without SSL packets although my application is creating an SSL handshake packets and these micro tunnels are being created for every session)

The "misbehaving" pcap has a capture for HTTP proxy traffic on port 443, i.e. a HTTPS traffic prefixed by a HTTP CONNECT request and response. Port 443 is reserved for direct HTTPS though and not for proxied HTTPS.

It looks like Wireshark somehow insists that it should be either direct HTTPS on this port (which is how the port is commonly used) or that it should have nothing to do with SSL at all. Thus it will detect the HTTP proxy request and response but will then refuse to decode the rest as SSL even if explicitly specified in the settings. I did not find a way to change this behavior.

If one rewrites port 443 in the pcap to something else (like 4433) using tcprewrite the problem magically vanishes and it will happily show the SSL protocol details. Thus, it is all because of some strange behavior of Wireshark and is not a problem of the data itself.


Two questions regarding Mixor worm According to Symantec's write up "it also infects .exe and .scr files in folders containing [RANDOM CHARACTERS].t".

What if one of the .exe/.src files is run on the same computer - then all the same files would be infected again and eventually would all be corrupted, or is there a check against this?
If one of those infected files were manually transferred to a new computer and run, that computer will now be compromised?
Regarding the fact "the worm ends security-related processes, if one of the following words is included in the window title: [lengthy list follows]" how does an AV defend against this? (3a) How is removal possible if each time a program starts it's knocked out?

Depends on how well written the virus is. (Most of them are pretty badly written!) However, I doubt the writer cares much about the long term survival of the worm once it's grabbed all your email addresses and then mailed itself to them.
It's not the intended vector for infecting other machines, but yes, that would work.
AV tries to intercept the worm before it gets resident in memory (by checking files when written to the disk, scanning attachments in mail, etc.) but once the worm is running the AV is indeed vulnerable to having it's processes attacked, which is why booting from a clean disk (such as a LiveCD) is such a vital part of malware cleanup.


Google Chrome - How to save usernames only I don't want Google Chrome saving my passwords, I only want it to save my username.

Any suggestions?

An option is a custom GreaseMonkey script.

The majority of password fields are typically of input type password. GreaseMonkey could look for any such fields and when they are updated by Chrome instead of the user, XOR in a Base64 symmetric key before Chrome dispatches the form.

This way the GreaseMonkey script could ask for the symmetric key when you start Chrome and it is stored in memory until Chrome closes; Chrome has no persistent copy of the real passwords; and yet you only need to remember one password. The symmetric key can be stored in any truly secure password store the rest of the time.

Although all this does assume that Chrome's built-in password store is actually weak. I don't recall any article saying it is.


Ideas for subdomains isolation Consider a blogging platform - example.com and we want to host untrusted content in subdomain1.example.com and subdomain2.example.com.

By default, same origin policy doesn't allow communication between these two subdomains. Beyond SOP, what are some of the security considerations we need to have in place to make sure subdomain1.example.com can't read or interact with the properties of subdomain2.example.com?

An example could be scoping the session cookie for each subdomain to that particular subdomain.

Even though modern Web technologies use the complete domain name as a the one security boundaries, HTTP cookies is an old technology that isn't rooting in RFC but in history and evolved from a world with poor isolation.

Cookies can be segregated by exact domain name match, or by super-domain: on that very Web page, my browser informs me that it has a bunch of cookies for the  domain stackexchange.com which is a super domain of that of the page (https://security.stackexchange.com/questions/227598/ideas-for-subdomains-isolation).

The sharing of these cookies is the problematic issue with hosting user provided, arbitrary and totally non-secure HTTP content

content provided with an HTTP content-type header that either means HTML content (or generic XML/SGML that is seen as HTML),
or content with a content-type that is plain text but which may be "sniffed" as HTML by the browser (as historically HTML HTTP browsers are known to have such "quirks")

in your super-domain.

It isn't the only issue: not only existing cookies could be read (which could be prevented by the HttpOnly flag), but even if you have none of these cookies, the active HTML content could set new cookies that are shared on the super-domain. These cookies will be associated with the super-domain.

The extreme weakness of the HTTP protocol means that only the HTTP server tells a browser the scope of the cookie when it is set, the browser never repeats back that information. It means that the HTTP server has no way to determine the origin of a cookie: which complete domain name set a cookie, and what is its scope. The browser has that information, the end user can access it (f.ex. with the page inspector, you can see a list of all cookies set or sent during that page load), but the server won't have it.

[Note:

Google set up the googleusercontent.com for a reason: any complete (whole Web pages, not HTML fragments) user content is provided from a completely different domain (webcache.googleusercontent.com) from the one domain trusted by the browser (google.com): there is zero chance the Web client can confuse these domains. Only the end user can navigate to (non existing) https://webcache.googleusercontent.com/zfzefzef

and see that the domain certificate is attributed to

CN = *.googleusercontent.com
O = Google LLC
L = Mountain View
S = California
C = US

(Another hint is the list of altNames in the certificate, many of which are very recognizable as Google's.)

That's the kind of effort it takes for an end user to identify that a domain is owned by the same entity as another.

end note]

Because the client doesn't inform the browser which entity was the source of any particular cookie, the server can be confused by a cookie with the same name set by a subdomain; if more than one domain has a cookie with the same name, the behavior of browsers is unpredictable, with either multiple Cookie header, in some browser dependent order, or the concatenation of all cookies in one header. Making some part of cookie names unpredictable by any adversary (like cookie_name_RANDOM_SEQUENCE) at least avoids the concatenation of multiple cookies issue, but it doesn't authentify the origin of a cookie.

Conclusion: to be safe, do not allow any potentially active HTML content (one with working Javascript) anywhere inside (in a subdomain of) your trusted domain.