Recommend Keylogger for Ubuntu I purchased a new laptop recently, and I'm working on hardening it.  Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen.  The system runs Ubuntu 11.04 (Natty).

I've installed Prey on the machine, of course.  I've also created a guest account that requires no password to log in, to give a would-be thief an opportunity to log into the machine so I can track him with Prey.  (I've got some other pretty rad countermeasures on there too.)  The last thing I want to get on there is a solid keylogger.

Does anyone have any keylogger experience?  I've Googled around and know that there are options, but I was hoping to benefit from the community's expertise on the issue.  Some options seem to have disappeared from the Canonical repositories recently (I was looking at lkl in particular), and I'm not clear what the current leaders are.

Do you have any recommendations as to which is the current "premier" Ubuntu Keylogger?

For what it's worth, this whole venture was inspired by the fantastic "Pwned by the Owner" talk from Defcon 18.  It definitely warrants a watch if you've never seen it before.

I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen.

I like Rory's answer. However, I think there are three risks involved here: the risk of losing your hardware, and the risk of losing your data, and the risk of your private data being exposed. Solutions which attempt to recover the machine are only solving one risk.

The risk of data loss can be mitigated by a good data backup system.

The risk of data exposure may be mitigate by good data protection: proper access controls, solid encryption, and good keys or passwords. The risk of data exposure may also be mitigate by destruction: remote wiping, conditional wiping, timed expiration. The final risk is the loss of your hardware.

When you have risk there are three options: mitigate the risk, assume the risk, and transfer the risk. You have already thought of some way to mitigate the risk of theft. However, you haven't covered a few of the most effective, which tend to be operation rather than technical.

Never leave your laptop unattended. If a thief has no opportunity, they can not steal your laptop.

When you are not using your laptop store it securely. At least use a locking cable attached to something unmovable. Or keep it in a locked drawer or cabinet. If you are not in a familiar place you can lock it in the trunk of your car.

Mark your laptop with your name in a way that is difficult to remove. You can have it etched into the case, or failing that large letters in permanent marker. It makes it harder for a thief to sell Chris's laptop, and if you put contact information as well it will help get it returned if you lose it.

Another way to deal with risk is assuming the risk, but I don't recommend doing that.

The final way to deal with risk is to transfer it. This is usually done by buying insurance. You can buy laptop theft insurance to cover the value of your laptop. If this is a personal laptop and you have homeowners insurance you may already be covered under personal property, or you may be able to add coverage to an existing policy for a small fee. I don't know insurance very well but I think renters insurance may act similarly to homeowners insurance. In any case you can check with your insurance agent.


Server infected with some kind of miner - can I steal the results? A Windows server of ours got infected with some kind of mining tool.

As luck (?) would have it, the tool left plenty of logs. The logs suggest it's a Claymore CryptoNote CPU Miner  v3.5 Beta. Outside of the logs, there are also mysterious files called history.txt and id.txt - but both contain hexadecimal gibberish akin to IDs of some kind.

Outside of the obvious next step of nuking the server and setting it up anew, I was wondering if there's anything I can do to mess with whatever mechanisms attacked the server in the first place. Steal their work, or at least make it harder to continue?

Is there anything I can do? Or is this entire line of thought a lost cause and best to just focus on getting a new server set up?

A cryptocurrency miner will usually request bits of work from a server, work on them for a certain period of time (until the block is mined, either by it or by someone else), submit its result and start over with a new piece of work.

The miner itself doesn't hold much data, and that data is irrelevant as the recipient address for the profits of the mined block are encoded in it, so by the time a block is mined there's no way to "go back" and get the funds.

The only option is to see if you can crack whatever server the miner is connected to, and see if that holds a wallet which you can steal - in that case you'd be able to recover funds mined on your hardware and maybe the attacker's other victims, unless the attacker already spent this money or transferred it to another wallet out of your reach.

To be honest, on a CPU miner you probably didn't loose much money - in fact writing this answer cost me more than this miner could've made in a month, so I'd say let it go, nuke the server and move on.


How to test password strength My very first question and I am happy to see that the algorithm did not come close enough.

My question is about the strength of a particular string to be used as a password. Is the length and mix of characters (upper and lower case letters, numbers, and other special characters) the only measures of the strength of the password that we have to work with?

Is there anything else that we can add to the mix to make strong passwords? What I am thinking about is control characters like the when we used to send a form feed to a printer back in the days. Could we use these kind of key combinations to add to passwords?

Thanks for any help.

Waseem

Theoretically, the strength of a password is the number of tests it would take to guess it. In pure mathematical terms, it's the number of possible characters in the character set raised to the power of the length of the password.  But the real measure of strength of a password is "how long will it withstand an attacker?"

We all know that most user-selected passwords don't take advantage of the full character set, because complex passwords contain too much entropy for a human to easily remember. So, most passwords consist of natural language words with slight modifications; vastly reducing the number of passwords that an attacker has to test. In other words, adding the ability to hit the control key won't make any users actually hit it, meaning it won't add much to the effective strength.


How secure is virtualization against breaking out of the box How secure are all currently used virtualization technologies (containers - BSD Jail, OpenVZ, Hypervisors - Hyper-V, KVM etc)?

I heard about one vulnerability in VMware software, which lets you break out of the guest machine.

What's the most secure option? I need this for malware analysis.

First, this is a pretty broad question since there are many virtualization technologies. So please don't expect an in-depth comparison of each of these. There are actually several resources on the internet which provide more detailed information, like Security aspects of virtualization from enisa. A simple Google search will provide even more resources. Thus this is mainly a summary without too much details which also only covers the main technologies:

The main virtualization technologies are full virtualization like offered by KVM, VirtualBox, vmware ESXi, Hyper-V etc on the one side and container based virtualization like done in LXC, OpenVZ, BSD jail etc on the other.

Full Virtualization

In full virtualization the virtual machines share performance critical host hardware like CPU and RAM with some hardware-assisted separation but emulates other hardware like network cards or display (but there are technologies to share parts of such hardware too). Inside the guest VM there is a full OS like Windows or Linux which does not need  to have special drivers to deal with the virtualization. But there are usually special drivers anyway since these make it possible to have more performance (like using hardware-assisted sharing of host resources) and more flexibility (like changing the amount of RAM and CPU without rebooting the guest VM).

The main attack path in full virtualization is this hardware emulation, since it usually requires some kind of complex interaction between host and guest. Bugs in this separation allow the guest to break out the virtualization. But usually an attacker running inside the guest VM has to break several security layers to be successful: first he needs to find a problem in his execution environment, use this to elevate privileges inside the guest VM, use this to break out of the guest and then find and use an attack against the VM host.

Container Based Virtualization

Container based virtualization is weaker but also provides more performance since the virtualized processes are just normal processes running inside the host OS and using the host kernel. The separation is done with namespaces, i.e. namespace for network, for users, for process ids etc. This also means that you cannot run a completely different OS inside a container, i.e. you cannot run Windows inside a Linux container like LXC etc. You could though run for example RedHat inside an LXC running on Ubuntu since they both use the Linux kernel.

Compared to the small hypervisor in full virtualization the container based virtualization is way more complex and provides a larger attack surface. On the other hand there is no need for complex emulation of hardware either since guests use the same kernel as the host. But a security issue inside the kernel would allow an attacker inside the guest to take over the host, while with full virtualization it would only allow the attacker to take over the guest VM.

Summmary

Full virtualization provides more security than container based virtualization. Additionally container based virtualization is restricted it what you can do, specifically you are not able to run a different OS. Thus it might not be a usable platform for malware analysis in the first place.

But, if you could do your analysis either inside a container or inside a VM you could actually combine both to provide even more security: you could run a VM with a full OS inside and then use containers inside these virtualized OS to add an additional layer of separation for added security.


Is it feasible to create a new key for symmetric encryption for each message rather than negotiating a long lives session? The normal method of providing an encrypted channel appears to be negotiating a session key (using Diffie Hellman or similar), then using this key for a long lived session. Even IPSec that is message based negotiates a key first that is later used for many individual messages.

What are the reasons against instead having each individual message be encrypted using a symmetric cipher, with its one off encryption key being derived from the message, using Diffie Hellman, encrypted using RSA etc? Is it simply due to higher computational complexity in deriving this key vs decrypting the symmetric cipher using a known key, or are there other reasons for this?

The main reason is that it isn't necessary: there's no real reason why you would create a new key for each message, because using one key for all messages is perfectly secure with modern encryption algorithms. While you can't use one key for too much data, with AES "too much" is 256 exabytes (that's around 256 million terabytes), which is far more data than you actually end up using a session key for. Using one key for a whole session doesn't make it relevantly easier for an attacker to recover the key, for realistic sessions.

I'm not sure what you mean by "deriving a key using Diffie-Hellman" or "encrypted using RSA," but I assume you mean renegotiating the key every message (i.e. both parties communicate to negotiate a new key; "derive" is an odd word to use, because it generally refers to something computed on one end without having to talk to the other end). Renegotiating a key for every message isn't done because it's a waste of time. Key negotiation takes a few messages back and forth, and is somewhat slow (it involves at least one asymmetric algorithm, and a common trait of asymmetric algorithms is that they're slow).

For deriving keys, while it's possible, there isn't really a need for it, and it again adds complexity. You can't derive your key for a message from the plaintext of that message for obvious reasons (the other end doesn't know that plaintext until it decrypts it with the key). You can derive a unique key for every message from a master key (this is common in payment processing systems), but it's not needed in typical communications, and it isn't done to make it harder to recover a transaction key (it's done so that recovering a transaction key doesn't let you decrypt all transactions).


How to list all of the known root keys in docker (Docker Content Trust) How can I list all of the Docker Content Trust root keys on my system?
I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral cloud instances. I want to make sure that every time my fresh build system does a docker pull debian:stable-latest, it doesn't just blindly TOFU the root public key used to sign debian's docker images--thus defeating the entire security model of DCT.
Before downloading a given docker image, how can I check to see if the system already has the image's root public key or not?

To see what keys you already have on your system (happily/blindly/silently obtained with TOFU unless you put them there yourself), check $HOME/.docker/trust/tuf/docker.io/library
For example:
root@disp9131:~# export DOCKER_CONTENT_TRUST=1
root@disp9131:~#

root@disp9131:~# docker pull debian:stable-slim
Pull (1 of 1): debian:stable-slim@sha256:89ff9e144a438f6bdf89fba6a1fdcb614b6d03bc14433bbb937088ca7c7a7b6d
sha256:89ff9e144a438f6bdf89fba6a1fdcb614b6d03bc14433bbb937088ca7c7a7b6d: Pulling from library/debian
696098ac4087: Pull complete
Digest: sha256:89ff9e144a438f6bdf89fba6a1fdcb614b6d03bc14433bbb937088ca7c7a7b6d
Status: Downloaded newer image for debian@sha256:89ff9e144a438f6bdf89fba6a1fdcb614b6d03bc14433bbb937088ca7c7a7b6d
Tagging debian@sha256:89ff9e144a438f6bdf89fba6a1fdcb614b6d03bc14433bbb937088ca7c7a7b6d as debian:stable-slim
root@disp9131:~#

root@disp9131:~# ls $HOME/.docker/trust/tuf/docker.io/library
debian
root@disp9131:~#

root@disp9131:~# docker pull ubuntu:latest
Pull (1 of 1): ubuntu:latest@sha256:bc2f7250f69267c9c6b66d7b6a81a54d3878bb85f1ebb5f951c896d13e6ba537
sha256:bc2f7250f69267c9c6b66d7b6a81a54d3878bb85f1ebb5f951c896d13e6ba537: Pulling from library/ubuntu
d72e567cc804: Pull complete
0f3630e5ff08: Pull complete
b6a83d81d1f4: Pull complete
Digest: sha256:bc2f7250f69267c9c6b66d7b6a81a54d3878bb85f1ebb5f951c896d13e6ba537
Status: Downloaded newer image for ubuntu@sha256:bc2f7250f69267c9c6b66d7b6a81a54d3878bb85f1ebb5f951c896d13e6ba537
Tagging ubuntu@sha256:bc2f7250f69267c9c6b66d7b6a81a54d3878bb85f1ebb5f951c896d13e6ba537 as ubuntu:latest
root@disp9131:~#

root@disp9131:~# ls $HOME/.docker/trust/tuf/docker.io/library
debian  ubuntu
root@disp9131:~#

WARNING! Note that docker content trust is disabled by default. Even after it's enabled, it will silently download and dumbly trust any root keys it obtains. Therefore, if you're using Docker on an ephemeral build system that launches fresh on every execution, then DCT is entirely security theater and will be vulnerable to MITM attacks on every run.

See Also

https://docs-stage.docker.com/engine/security/trust/content_trust/
https://github.com/docker/cli/issues/2752
https://stackoverflow.com/questions/48277065/docker-trust-initialization
https://stackoverflow.com/questions/63960217/how-to-list-all-of-the-known-root-keys-in-docker-docker-content-trust/64103579#64103579


How to use a port scanner in a hostile manner Port scanners like nessus and openvas are basically used to identify the vulnerabilities of the network. My question is if someone with bad intentions is able to use these legal tools in a more hostile way? If this is possible which I think it is, what features of these kind of tools can someone exploit to attack someone else?

Those are vulnerability scanners, not just port scanners. People use them to find vulnerabilities in systems. It doesn't matter what their intentions are. If there are vulnerabilities, there's a fair chance the scanner will catch it. A hacker can chose to exploit any exploitable vulnerabilities. The scanners themselves don't exploit the systems; an attack would need another tool, such as Metasploit.


Check uploaded python script for security issues before running it I would be allowing a user to upload Python scripts and would execute them on my server. The base application is in Java and I am using ProcessBuilder to get Python to run from my Java application. How could I go about testing for security threats from the end user, when they upload their script to run on my server.

Sorry to say, but this seems like a really questionable thing to do. Period.

There's a famous blog from Microsoft called "Ten Immutable Laws Of Security". Law #1 is:

  Law #1: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore.

There's a reason it's number 1; creating a list of "bad things" to block is a losing game: for a full-featured and complex language like python, there will always be more creative ways to do bad things that aren't in your list.

I would encourage you to consider why you need to allow users to upload scripts, and whether you can accomplish the same functionality through a set of UIs, REST APIs, or some other standard method where the security is well understood.

If you absolutely need to allow scripts (python or any other language), then I would figure out the minimal amount of python syntax that users need to accomplish whatever it is your site does and reject any script that uses something not on that list. Do your research about every item on that list and whether it could be used to make a system call or otherwise change files on your filesystem. If that list includes import then you know you're sunk right off the bat because then you're faced with either trying to enumerate everything on your sys.path and block the "bad things", or trying to enumerate which modules users need, which methods within those modules they need, and manually verifying that nothing bad could possibly be done with them. Even assuming you have good well-researched lists, building the regular expressions to properly enforce the list is probably a difficult task in-and-of itself.

The other approach is to assume the server is totally compromised all the time, don't use it for anything else, keep it in its own isolation network far away from any other servers you care about, firewall off any outbound traffic, and tear it down and stand up a new one every now and then.

The idea of letting users upload and run scripts on your server seems a bit like letting random teenagers experiment with fireworks in your living room.


Is it true that AES-128 and AES-256 are Quantum resistant? Is it true that with the rise of quantum computers, which is pretty close these days, AES 128 and 256 are resistant? while PGP and RSA are not?

Not entirely.  Symmetric cryptosystems, including those using AES, are not completely broken by quantum computing, as far as we know.  However, Grover's algorithm does pose a significant threat:

  Grover's algorithm is a quantum algorithm that finds with high probability the unique input to a black box function that produces a particular output value, using just O(N^(1/2)) evaluations of the function, where N is the size of the function's domain.

This means that, given a known plaintext-ciphertext pair, we could determine an AES-128 key using about (2^128)^(1/2) = 2^64 steps.  In other words, AES-128 would be unusable.

There's a straightforward mitigation though: double the key size.  In a post-quantum world, AES-256 is still comfortably secure.

PGP and GPG are programs that use a variety of cryptographic algorithms.  All of their asymmetric operations use algorithms (such as RSA and ECDSA) that are vulnerable to quantum computing.  It's likely that they will be updated, at some point, to use quantum resistant asymmetric algorithms, but that has not yet occurred.


Getting into pentesting with no experience Wanted to ask a question that I've seen answered in many places, but I could find nothing related to a specific point I got.

Just a bit of background, I work in 3rd level software support for 5+ years and got to a point where my job does not require the skills I acquired over time(don't want to say the word "overqualified").

Over time I developed many "advanced" skills, at least for a support role and those include reverse engineering, programming, scripting, debugging etc which I can't really use with my current role.

Decided to get into security for realizing that there are more oportunities there. My interest is more in webapp pentesting and Im taking several courses(and VM labs for practice) but feel that may be challenging the fact that I don't have any formal experience as a pentester.

So I thought that maybe if I started to bug bounty hunt and use the vulnerabilities I find in my cv as experience, would help me getting closer to the door of the hiring manager but wanted to ask for opinion of people already in the industry... does this make any difference? Does it help? Is there anything else you would suggest?

Anything you do to build your skills will help at this stage.  You might want to address some of the basics before trying to collect on bounties, though, or you might get frustrated.  Remember, the easy bug bounties have most likely already been collected, meaning you will need very strong skills to find what's left over.

Seek out some of the on-line classes on a wider variety of various pen testing tools, not just Metasploit.  Keep practicing on the VMs.  Learn about other security measures that might need to be defeated, such as IDP/IDS systems.

Attend local or regional security conferences; they're a great source of information, contacts in the industry, and potential clients.

Honestly assess your communication skills.  A pen tester needs to produce a clearly written report describing the vulnerabilities in such a way that the clients can understand and address them.  Ask someone else to take a look to ensure you're as clear as you think you are.

A big part of the entry-level pen tester will be their reputation.  Hiring a pen tester is a matter of trust.  If you have a criminal record or otherwise sketchy background, you may never find customers who want to hire you.  Consider getting some certifications, like Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP).  While some people like to mock certifications, don't let that stop you.  They offer something tangible to potential clients that you are at least taking this seriously, and it's those clients that will pay your salary.

Check your local area to see if you need other credentials, such as a private investigator license.  A PI license might also be helpful in standing out in a crowd of job applicants.

Consider preparing yourself for other careers in the security field as a path into pen testing.  Forensic investigation, application development security, and security architecture are all hot topics these days.


Are Web Services vulnerable to CSRF? I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify the session, then how could I test a CSRF attack to an android application with web services?

CSRF is an acronym used for Cross Site Request Forgery. It is an attack where a malicious website can transmit specially-crafted data to the vulnerable application on behalf of the victim, causing the state change in victim's account.

For the better understanding of the question for Android applications we can call it as Cross Application Request Forgery and for existence of this issue in mobile applications one application has to induce the state change for the other application installed on the device. Android supports the beautiful concept of application sandbox such that in the normal scenario one application can not access the data of any other application.

For successful execution of CSRF the session identifier(session cookie/session token) must be sent as the part of HTTP request for performing the state changing actions(which is the default behaviour in web browsers), it is highly unlikely to perform this kind of attack in Android applications since the attacking application won't be able to access the session identifier stored in vulnerable application sandbox to complete the attack.


HTTP reverse shell through corporate proxy I'd like to test a scenario where the user receives a mallicious attachment in a phishing email. The attachment is intended to open an HTTP or HTTPS reverse shell to the attacker who sits outside of the corporate network.
The network topology looks like this:

Attacker --- Internet --- Firewall --- Proxy --- Victim

The firewall blocks every outbound traffic except web browsing through proxy and DNS requests.
The proxy uses authentication.

As I've red through numerous post in this topic, i've got the impression that a basic metasploit reverse http meterpreter shell would do the trick in this environment, but I'm curious how the reverse shell could go through the proxy? First of all how does it detect that there is a proxy and what is its address?

It's maybe kind of a noob question. My only idea is that if the proxy settings are set in the registry, Windows routs all the HTTP and HTTPS traffic toward the proxy transparently.

How does the shell detects what is the proxy and its address?

It does it the same way as any other applications on your OS. On Windows an application can check registry settings for IE proxy, and get relevant proxy settings from other browsers. Or it can use Wininet API, which would handle proxies automatically (including things like NTLM authentication).

On Linux it can check the env variables such as "http_proxy".

A less typical, but still possible ways would be to do port scan (proxy typically listens on 3128 or 8080), or watch the traffic for proxy connection requests.

How does the reverse shell executes the commands?

There are several ways. For example, a reverse shell script/binary can do HTTP GET example.org/cmd.html, pass everything to a shell/powershell/Python, save the output of the executed shell to file, and POST it to example.org/output - those requests are valid HTTP requests, and will go through HTTP proxy. This will not work for interactive shell (for example using vi), but it is not really needed for an attack.

To build on top of that, the commands and responses could be encrypted with a symmetric key (thus making signature-based detections impossible), or could be embedded into regular traffic (for example into EXIF tag of an image).

However if the proxy supports HTTPS proxying through CONNECT command, it is much simpler. A reverse shell then issues CONNECT example.org:443 and has a direct TCP connection through the proxy, which could be used for a direct shell access (including the interactive shell).


Why Cloudflare is a MITM attack? There are discussion about Cloudflare.

https://bugzilla.mozilla.org/show_bug.cgi?id=1426618
https://trac.torproject.org/projects/tor/ticket/24351

They keep repeating "Cloudflare is not a MITM attack".
How do you counter this argument in technical way?

Unfortunately, you cannot counter it without being technically incorrect.

Per Wikipedia, the definition of a Man in the Middle attack:

  "In cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other."

The website owners who configure their site to use Cloudflare do not believe they are communicating directly with the visitors, so under the technical definition it's not a MitM attack.


Never spell a word the same way twice? A long time ago I was reading about Renaissance-era ciphers and I remembered this quote:

David Kahn, author of The Codebreakers, quotes Giovanni Battista Porta who published, in 1563, a famous cryptographic book, De Furtivis Literarum Notis:
"He urged the use of synonyms in plaintexts, noting that 'It will also make for difficulty in the interpretation if we avoid the repetition of the same word.' Like the Argentis, he suggested deliberate misspellings of plaintext words: 'For it is better for a scribe to be thought ignorant than to pay the penalty for the detection of plans,' he wrote."

This idea of deliberately misspelling words is intriguing to me. I'm wondering, is this a technique that could potentially be effective against modern mass-surveillance systems?
For example, in an NSA-style mass-surveillance system that flags certain designated keywords, could deliberate misspelling of words (in an email or SMS, for example) potentially be used to avoid detection?
the bobm is hdiden isnide teh parlaimnet biuldnig

The idea is that it would work sort of like a CAPTCHA, making the message obfuscated for computers but still human readable. Is this realistic?

What is being described is a protection against some classes of known-plaintext attack.  Up until the 1960s or so, most ciphers were vulnerable to these (eg. many of the attacks on the Enigma cipher were based on knowing or guessing part of the plaintext).  Modern ciphers are effectively immune to this: knowing that the AES-encrypted message is "Attack at dawn" provides no help in figuring out what the key is.

Using synonyms, typos, and alternate spellings won't help defeat keyword surveillance.  The system is automated and adding keywords is cheap.


Is it safe to accept the security certificate from AOL chat? Is it safe to accept the security certificate from AOL chat? Did they recently change their  certificates? These images are from Pidgin.

This is a known issue for Pidgin, related to the root certificates that are trusted, although it looks like it has been resolved:

https://developer.pidgin.im/ticket/15850

I'm not certain whether updating Pidgin will therefore fix this, or you have to import a certificate yourself...

  People experiencing the AIM certificate problem can save this file to Pidgin's ca-certs directory: https://hg.pidgin.im/pidgin/main/raw-file/4e027bce3693/share/ca-certs/Entrust.net_2048.pem
  For me that's /usr/share/purple/ca-certs/

To confirm that the certificate is in fact valid, you can check it using a service like SSL Labs (or from your own box using something like SSLyze maybe). We know that Pidgin is trying to connect over 443 so this works.

https://www.ssllabs.com/ssltest/analyze.html?d=api.oscar.aol.com&s=64.12.235.15

This service reveals that the certificate presented by the server is valid, although you should make sure that you're receiving the same certificate that SSL Labs did. You can do this by comparing the fingerprint (3d9b06d38685972da2515ffb6a5629706d7ec698) from your screenshot to the first SHA1 value in the SSL Labs report. Since these are the same we can be pretty certain that you are talking to the correct server.


Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual answer...

Can my traffic be encrypted before it hits the router so that no one knows what URLs or IPs I visit??

Technically I don't visit anything bad but I am relatively security conscious and I don't like the idea of anyone viewing my traffic using ettercap, wire shark etc...

So how do I remain anonymous in this regard.. I know vpn will hide my IP but that's after my request flies out of the router, isn't it ?? and I know no-IP will mask my routers IP address coming back in but what can I do for the connection in the back of my PC to the Ethernet network to the router...

Surely it's encryptable somehow so that no one knows what's being surfed from my Ethernet port on the network

A VPN is a solution to this problem, as is Tor (assuming correct configuration). With both of these methods, it is obvious you are using them, however all of your traffic is encrypted between you and some remote endpoint (VPN server, Tor node, etc.) such that nobody on your local network can see your final destination or data.


Is it safe to generate JWTs using private key? Currently I'm building a Rails API using ruby-jwt as my access token generator. I choose RS256 (RSA + SHA256) as my algorithm.

ruby-jwt uses private key to encode payloads, and uses public key to decode tokens.

My question is, is this approach secure enough? Is there any chance that an attacker can exploit the private key from a large amount of tokens? Why doesn't it use public key to encode and private key to decode?

When you speak about making "claims", this is exactly how it's done. A private key is not meant to be distributed. The keeper of the key is the authentic user of the key. It allows them to issue authentic claims. If that key were ever compromised, then other claims could be made that would be accepted as authentic. In other words, whoever has the private key can impersonate an authorized oracle.

The public key, on the other hand, is meant to be distributed to all servers that should trust the owner of the private key. This key doesn't allow anyone to make claims, but it allows everyone to acknowledge that the claim is indeed true. Other technologies, such as SAML, use a similar technique: the issuing server holds a private certificate, and the relying parties use that server's public certificate to verify the assertion.

For what it's worth, there's nothing special about the public and private keys. You could swap them around after they're generated but before the public key were distributed, and it would work in the same way. And, technically, yes, since JWT has a documented format, you do know what the payload is supposed to look like, which would weaken the key security a bit, but it still doesn't really help you, since each bit in a key affects multiple bits. It would be very hard to use a chosen plain-text attack against even a large number of tokens, simply because of the large number of bits that are used. Remember, the goal of recovering the private key isn't to get at the decrypted data (because the public key is already available), it's how to impersonate a given server.


What are the key steps in threat modeling as a user willing to stay anonymous? I've been looking for standards or guides in threat modeling. I found lot of informations for developers threat modeling when building apps, networks etc.. but I could not find relevant information from the user point of view.

I am looking for guidelines that could help more than one user.

There are few points on which I was wondering :

Should time be included in the threat model ? Indeed one can know what he is going to do at time t but what about time t+x ? Does one have to consider starting the process again when his habits/actions change ?
Does overestimating threats is a good practice ? How to properly evaluate a threat ?
What would be the best approach ? Is this subjective ?

I specified 'willing to stay anonymous' so the question is not too broad and the goal clear.

The EFF's "Surveillance Self Defense" is a good place to start.  https://ssd.eff.org/en

Over time leaks and mistakes are likely; generating a new identity regularly may make sense if you think that you'll come under intense scrutiny.  You reduce linkability between the things you've said, and thus reduce tracability.

Overestimating threats is never a good practice. It leads you to over-invest in mitigations and defenses.  However, it may be better than under-estimation.

The best approach is the one that works for you.


Best way to secure Wi-Fi Direct connection I have setup WiFi Direct connection between two Android devices by using Wi-Fi Protected Setup (WPS) "push button" for authentication.I also want to secure the connection itself by securing the data transmission between any two peers.

Edit: The WiFi Direct standard says to support WPA2 ciphering, but I'm not sure how it works (there is no way to configure the passphrase of it), and if it works at all.

One way of doing this could be to make some cipher key that the two peers shares and encrypt all the traffic coming out of specific port that I'm using.

Can you suggest some other method to make the connection secure?

The simple answer is do not use WPS as it is vulnerable to the reaver attack.

This greatly reduces the amount of time needed to bruteforce your passpharse.


Homebrewing something like SSL So me and eight other friends have founded a "company" (not official, we just like calling ourselves that) named sDev and we are making a strategy game. We are aged 16-17 and have about 3-5 years of experience coding, mainly from school lessons. So much for the context of this question

As for network communication in our game we have made the (rather sensible) decision to use encrypred traffic; the group agrees on this. The way of doing this? Thats where our views differ. Most of us agree that it would be beneficial for us to use a prefabricated security library (the only one any of us knows is SSL) while our enthusiastic (in a good sense) colleague martin is in favor of an alternative.

Martin thinks it would be good for us to make our own SSL for a number of reasons:

compile time
repo size
we only code the stuff we need
experience
license stuff
it would be cool

Side note, at this point martins idea of making our own SSL has become a meme. While we can identify with his views there are a few issues I see in this, mainly the fact that I would not want to have the responsibility for our potential clients' security. A number of us would also be troubled with the task of finding the motivation to learn and implement RSA, AES and whatnot else you need. My greatest concern though is that missing a simple if check can ruin the whole thing (best example, heartbleed) and I don't trust myself or the team to code such a perfect piece of software that can match the performance and security of SSL (not that I have trust issues). If we already have this beautiful library with years of effort and a strong competent team behind it that is also open and has a very kind license for us to use, why risk making our own?

So here to my actual question to some people that are more into the field:

How beneficial would making our own SSL really be, how risky is it if we mess up and how valid are the arguments for either side?

By the way, Martin will be shown this question in the near future

TL;DR: I don't really find any points that are positive to enroll your own Security. You can try to implement the Basic concepts of SSL in some dummy application to learn how it works but beside that you shouldn't even consider that to use it in Productive. For your own sake and for that of every user that should use your application.

Beside the Point of "don't roll your own" (which is always an argument that kills the need of a own implementation because a "normal" developer can't develop it correctly) according to Martin's points:

compile time -> you won't compile the entire SSL Library, you will use it. So use an external one is faster than your own
repo size -> you use the Library, your own implementation would be much bigger
we only code the stuff we need -> you do exactly that ;)
experience -> ok, you will learn the basics of SSL. But if you then program something which is broken in the beginning and you think that this code is correct, you will learn something wrong and thinking it is correct. That is much worse then learn how to use a well known library
license stuff -> yes you maybe must put some text in your application that says you use that library. But then go to different big applications (example may be Android OS) and go to their License Part. You will (if it use SSL) always see the openSSL library license text there
it would be cool -> what is cool on build something that is not good ;)

Additional:
 Always try to use Libraries that are well know. You don't need to fix bugs inside of them, they are reviewed by more eyes you could afford and bugs are much faster found than in your code (your 10 000 user vs. their 1 million users as example). Further more are well know Security Libraries very often checked by Experts that know what they doing ;)

The best code is that one you don't write.


Should I add protections where I dont understand how hacker can break system? Lets say there is an AJAX application where the user can submit items - buy them.

And there was a code

IF ($_POST[items] > 20) {
   echo 'error';
}
else {
   do_buy($_POST[items]);
   echo 'success'
}

Here, there is a check if items is not more than 20. On client side, it should not be possible to choose more than 20 items.

The system would work without problems even if 21 (or more) items were submitted (the user would simply pay for each item). While I realize you must want to yell don't trust the client, is there any harm in doing so if there are no consequences, as is the case here?

One could make the argument that overloading the cart might cause instability in the system but it seems as though the worst case would be that some script times out. If errors are disable, the user will just not get back any response.

In general: Does it make sense to code protections for an attack which violates an invariant of your system?

Update:

$_POST['items'] I meant that is array, not an integer. And each item how own properties - id and quantity, which are checked later before completing the buy operation.

About sql injection - I usually use frameworks, and they take care of injection protection.

Update

One more reason why I ask this is I want as much clean code as possible and also when someone reads it - will think why the hell this is needed, this programmer does not know what he is programming and why. So for all code I want to have clear reason why that piece of code exists and so if not in comment, then at least myself that I would have clear understanding why I make this check so I could explain if another programmer asks.

Yes, you should add protections, but they need to be appropriate for the situation.

All user input must be validated.  The fundamental principle is that you do not define what "bad" input is, you define what "good" input is and reject everything else.  To take your example, you've defined "items > 20" as bad.  But what if "items" is -1?  What if it's the quantity );DROP TABLE Orders;--?

The basic technique is that you look at each user input field and define what a "good" value looks like, taking into account both your software's capabilities and your business rules.  For example, "items" might be "an integer, greater than 0, less than 20, and less than or equal to the amount in stock" -- this rejects too-large orders, too-small orders, and exotic inputs such as SQL injection, without needing to worry about what an attacker might be trying to do or how your software might react.

This must be done server-side.  Client-side validation is there to help the honest user; a dishonest user can only be stopped server-side, since they control the client.

To use your house analogy, all user input is part of the door.


Password protection for NetCat shell? As a pentester, I often use NetCat, and its encrypted counterpart CryptCat. However, even CryptCat only encrypts the traffic.

I'm looking for a way to keep unauthorized users from gaining access to the backdoors I have created. I guess I could whitelist the static IP of my computer, and block all other LAN connections to prevent others from connecting, but by no means is that an ideal solution. I feel like there should be some NetCat-like derivative that supports both encryption and password protection out of the box.

How can I prevent unauthorized access to a NetCat backdoor?

I am not aware of an existing solution. Assuming you are using something like nc -l -p 4444 -e /bin/sh, you could write a script that would be called instead of sh and acts as a password protecting wrapper for sh.


Is there something like a portable GnuPG keychain? When encrypting or decrypting documents on a computer that isn't my daily driver I need to import my key to the keychain, do the encrypt/decrypt then remove the keychain and from the computer. As a security considering person I know that still leaves the key on the computer whether indexed or not, so it can be recovered.

Is there any way to encapsulate all the functionally of a GnuPG keychain but on a portable USB stick.

This way when you are done with encrypting/decrypting you can just remove the USB.

Like a Yubico stick but with GnuPG private and public keys on.

OpenPGP smart cards do not store the public key. You can only use them together with a local copy of the key. As a consequence, you cannot use the various OpenPGP smart cards, including YubiKeys and Nitrokeys without leaving traces on the host machine.

You can use a GnuPG key ring on a thumb drive by moving the whole GnuPG home directory there, and either setting the --homedir option to gpg or the GNUPGHOME environment variable. From man gpg:

   --homedir dir
          Set  the  name  of the home directory to dir. If this option is not
          used, the home directory defaults to ‘~/.gnupg’.  It is only recognized
          when given on the command line.
          It also overrides any home directory  stated  through  the  environment
          variable  ‘GNUPGHOME’  or  (on  Windows  systems)  by  means  of  the
          Registry  entry  HKCU\Soft‐ware\GNU\GnuPG:HomeDir.

You could even use a USB thumb drive for your GnuPG home directory together  with a YubiKey to hold the private keys for use on (somewhat) untrusted machines.

Still pay attention to possible traces in the command line history, temp folder, system logs,  ... Using some operating system without leaving any traces is hardly possible.


Preventing user supplied javascript from posting to external server I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these widgets operate on may contain sensitive data. What I want to avoid is the developer writing a plugin that has javascript which posts this data to some external server. However, it is essential to the operation of these widgets that they can manipulate the data on the page. Basically these widgets should only be able to effect the presentation of the data, but they should not be able to steal it.

I have looked at adsafe, but this is too restrictive because these widgets can only manipulate the dom provided by the adsafe widget, and so could not access the data they need. I also looked at Google Caja, which might be an okay solution, though its cross compilation would make the code execute slower in a performance critical environment (I have also not played with it, so I don't know specifically if I can use it to avoid posting).

I think the "ideal" solution might be some kind of static analysis tool that can eliminate "just" programs that try to contact an external server, but I welcome any suggestions that could work.

Code is inherently dynamic and it is and will always be impossible to control the behavior of user-supplied code.  By allowing users to execute JavaScript you are implementing a Cross-Site Scripting (XSS) vulnerability.   XSS is also commonly used to expose users to Drive By Download attacks which is strangely missing from your threat model.

One way of mitigating the threat posed by XSS is to isolate user supplied scripts to a sub-domain such that they cannot access sensitive information due to the Same-Origin Policy.  This does nothing to stop an attacker from executing BeEF on users of your web application or perform another type of drive by download attack.


ADFS: Verify requests from relying party In ADFS, serveral certificates are used. This is explained (very clearly) on this page: http://blogs.technet.com/b/adfs/archive/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-certs.aspx

Now, I have configured the following:

ADFS Communications certificate
ADFS Token decrypting certificate (for tokens that are received from another FS)
ADFS Token signing certificate (to sign the tokens that are sent to the relying parties)

And on relying party level I have configured the following:

RP Token encryption certificate

Now, what I don't understand is how to configure the request verification certificate. In ADFS, you can find it in a tab next to 'Encryption', and the explanation is the following:
"Specify the signature verification certificates for requests from this relying party."

I assume I have to add a clientCertificate or something in the web config of my Relying Party, but I don't want ALL requests to be signed, only the requests that are travelling to ADFS should be signed. I want to do this because I do not want other, random apps to be able to contact my ADFS and consume resources.

Does anyone know how to set the request verification certificate?

Is this for WS-Fed or for SAML?

I've only ever used this for SAML.

In the SAML world, this is imported from the partner metadata and is the public key of the certificate the partner uses to sign assertions (In WS-Fed terms = claims).

The RP uses this to validate the assertions.


Two-party symmetric key establishment protocol Update: original problem description

I am developing a client-server system for configuration updates. The system handles update tasks. An update task is initiated on a server; multiple clients then need to connect to the server to negotiate their updates within this task. A task can be initiated either manually of programmatically, and can be done either via CLI or via REST interface.

The requirements:

It should be absolutely easy for the end user to do those tasks;
Connections between clients and server should be secure, in the sense of that the whole communication should be authenticated, encrypted, protected against violations of message integrity or any other attacks, such as replays.

I will appreciate any suggestions to solve this task simply and efficiently.

The solution I have in mind currently is to generate a PSK on a server, and use then this PSK on the clients for connections. For that I have developed a symmetric key protocol that will mutually authenticate and establish a new short-living session key between two parties that have a pre-shared key. Unfortunately, I have not found any existing protocol that would fit my purposes, so I quickly devised my own. Would greatly appreciate your feedback on the protocol, or otherwise any advice to find something that already exists.

Notation:

C         = Client
S         = Server
K         = pre-shared key between C and S
ENC(K, m) = message m encrypted with key K; encryption function is AES-256-CBC
MAC(K, m) = a message-authentication code of message m, computed using key K
rnd       = random value
c1        = client challenge (randomly generated by the client)
c2        = server challenge (randomly generated by the server)
K'        = short-living session key

The protocol:

C -> S : em = ENC(K, (rnd, c1)), MAC(K, em)
S -> C : em = ENC(K, (c2,  c1)), MAC(K, em)
C -> S : em = ENC(K, (c1,  c2)), MAC(K, em)

Further session messages are encrypted with session key K' = c1 + K + c2:

* -> * : em = ENC(K', m), MAC(K', em)

Thanks a lot for your help!

Update: Rationale for using PSK instead of private/public keys.
Simplicity of usage. A tool is run on a server, and generates a unique PSK automatically, which the user then needs to manually or programmatically transfer to the clients he wants to connect. For the user this is much easier than using public-key cryptography.

Update: Rationale for having session keys in addition to PSK.
In the system I am working on, A PSK establishes a limited-time trust between a server and multiple clients. The underlying protocol is for configuration management, and there should be a protection against replay attacks. IF I were just to use the same PSK to encrypt different sessions, THEN it could be possible, as far as I see, just to record and then replay a session to achieve another (unauthorized) configuration update, which would be bad. Usage of session keys precludes this scenario.

This might be better suited to Cryptography.stackexchange; you're violating a major rule of crypto here (don't roll your own! It applies to authentication and key exchange schemes just as much as to everything else) and that's where I'd go if I wanted amateur advice on cryptographic scheme design.

With that said, while I don't personally see any vulnerabilities in your scheme, I suspect you're reinventing the wheel a bit. I think you ought to do a lot more looking around for alternatives.

For example, Steffen Ullrich already mentioned TLS-PSK, which in addition to handling authentication and key exchange, also takes care of message integrity and authentication, session resumption, and all that good stuff. One of the dangers in designing your own cryptographic algorithm or protocol is that even if you get the "hard" part of it right, you end up needing to write other stuff (such as the actual message-handling) yourself as well, and that's a lot of opportunities to mess up the implementation or miss an important protection.

Another protocol that does what you want is SRP (Secure Remote Password), which is designed to prove to two endpoints (client and server, in your scenario) that both know the same password/key over an insecure network without ever exposing the key, and which produces a value usable as a temporary session key if the exchange succeeds. This protocol could be used by itself, but it would probably make more sense to use TLS-SRP, which uses SRP for mutual authentication and key exchange.


AWS - YubiKey lost... now what? I just received my YubiKey and was playing with it. It works brilliantly but I couldn't help thinking what would happen if I would lose the key. Well, for Google you can print out some backup codes, so that's covered. But then I wanted to simulate a lost key for Amazon AWS. Apparently there is a page that allows you to troubleshoot your MFA key, see screenshot:

However, in case of a lost YubiKey, I would now click cancel or press escape. Next, the screen quickly changes and the "Troubleshoot MFA" link is not present anymore! In addition, I can't click on it when the message pops up.
How am I supposed to recover my account if I can't click on the link? Anyone with some tips?

This is a general question from AWS. It’s something I covered during my security specialty exam, I will try to dig more info, but:

If you are an IAM user, you can contact the admin/root user, and they can disable MFA for you.
If you are the root user, you’ll have to contact AWS support.

It doesn’t help that AWS does not allow you to register more than 1 yubikey per user. You’re stuck with a maximum of 1!


Websites that interactively test browser security (XSS, CSRF, Javascript, etc) I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing.  My intent is to know what risks may exist prior to using the browser.  (as I may be using a Beta or a mobile version of a mainstream browser and want to verify)
The most recent sites (relating to security) I've come across include

X-Frame-Options  (info)
Mozilla's Content Security Policy (CSP) demo
P3P Test Page and Validator

What additional sites should I refer to?  Is there an all-in-one site that aggregates the suite of tests?

You can visit Qualys BrowserCheck to check whether your browser has any known security issues.  It supports IE, Firefox, Chrome, and Safari, though you may need to install their helper plugin.

If you use Firefox, visit the Firefox plugin check web page.  It can detect old plugins with known vulnerabilities and provide instructions on how to update them.

I recently ran across Is my browser up to date?, a very simple site that checks just the version number of your browser.  I cannot vouch for it, and I don't know how good it is, but it claims to support IE, Firefox, Chrome, Safari, and Opera.  It does not check for vulnerable plugins, extensions, etc.

If you want to check for old browsers with known vulnerabilities, you use Windows, and you are willing to install software on your machine, I can highly recommend Secunia PSI.  It has a large database of applications and information about their versions (what is the latest version, which versions are known to be vulnerable).  It will scan your hard drive and find vulnerable/outdated versions of software installed on your system.  It can detect browsers and browser plugins with known problems.  However, it is not limited to browsers: it also checks for insecure versions of other software.

This may or may not be what you are looking for, but it is worth knowing about.


Adding false network tools / signatures for malware defense I was looking into implementing a security measure by adding false analysis tools / signatures on client PC's.

The idea is that certain malware would scan the environment for analysis tools, and if the malware is hardened, it will terminate itself before it can be analysed.

If I implemented this, would it be considered a viable solution for certain types of malware, and also how practical would this be for an enterprise environment?

Note: this is a part of Minerva's Hostile Environment Simulation, but I only wish to use this piece and potentially just push out these false tools / signatures as updates to the client PC's.

This is done, in a way. The WannaCry malware for example checked whether or not the domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com was registered and could be resolved. If it was present, the malware shuts itself down. The domain was registered in order to slow the spread of the malware.

Other malware may check for the presence of a certain file on the computer. If the file is present, the malware will terminate itself. This is sometimes done to prevent multiple simultaneous infections, and is sometimes done as a lazy way for the malware author to neutralize it on their own systems.

So why do antimalware systems not populate your computer with these signatures? Simply because, if the malware is known in advance, it is far easier to simply block it directly with signature-based detection. As for opportunistically placing debugging tools on the system to fool the malware into thinking it is being analyzed, simply not enough malware attempts to detect that. It would not be a cost-effective approach compared to, say, hardening your system. Another reason is that some malware detects debugging by spawning a child and mutually debugging each other, as only one debugger can be attached to a process at any given time. Fooling this kind of anti-debugging behavior would require attaching a debugger to every program that executes, in hopes that one of them will be malicious and will summarily terminate itself.


Is XSS exploit always illegal? I recently got a great deal of $$ stolen by scammers.  I am trying to use XSS exploitation to find his real identity (IMSI, IMEI, External IP, Internal IP, any computer unique ID)  Is it legal?   I am not going to hack his computer / phone, and I am not going to steal any password.

When you're not sure if something is legal, it's best to not do it. We aren't lawyers, you shouldn't trust our analysis if what is and isn't legal.  Even if it was in a grey area there's a good chance it could be a pain while the legal system sorted it out.

The CFAA is likely the law you would run afowl of.

You can report fraud and crime to the FBI

Don't take the law into your own hands. There a chance you will do more harm than good.


List of sites that still dont support HSTS? I'm working on an article for work and seeking a list of the top ~500 websites (ranked by Alexa) that still don't have support for HSTS. Does such a list exist? I'm not getting any interesting hits from my Google queries.

Other than check all the websites one-by-one, would anyone be able to offer a method for accomplishing this?

Assuming you already have a newline-delimited list of domain names you wish to check, use a script such as this one which takes the list in a file specified by the first argument or stdin:

#!/bin/bash

while IFS= read -r s; do
    curl -sI "https://$s" | grep -qiE "^Strict-Transport-Security:" || echo "$s"
done < "${1:-/dev/stdin}"

exit 0

This will output a list of domains to stdout that are up, but which do not send the standard HSTS headers over HTTPS. This does not mean that certain subdomains do not use HSTS, and it does not mean that all the sites which do send HSTS headers are doing so correctly. Checking whether or not the HSTS is syntactically valid would require much more complex regex.


OSes that are mathematically proven to be 100% (or 99%) secure? Are there any? What are their names? Are they publicly available/downloadable/installable?

The OKL4 Verified microkernel has passed the most stringent of Common Criteria evaluation assurance levels (EAL 7). Even this doesn't mean that it's "secure", "100% secure" or "more secure", it just means that it has been formally proved that the microkernel's implementation is compatible with the security model defined by the vendor.

Such a security model will contain assumptions about the environment and mode of operation of the software that may not be consistent with your environment. Taking a different example, when the Target of Evaluation is a commercial operating system the model usually assumes that all of the operators are benign and that any remote system to which the evaluated device is connected will also be consistent with the security model of the ToE.


'=' and '(' are bypassed XSS How can I add = in my script when return input.replace (/ [= (] /g, ''); is replacing it? This is only for education purpose solving CTF. Used HTML codes but not working.

= =

For clarity, that is:

[space][space]=[space]=[space]

The reason this works is because there's only one replace pass running on the input string. In this original string, there's only one instance of "[space]=[space]". When it's removed, there's now a new instance of "[space]=[space]" left over, but replace only scans through the string left-to-right once.

This technique is general to cases where replace is used once to remove a string from another string. Consider the code input.replace(/blue/g, ''). If you gave the string "my favorite color is blblueue", the inner "blue" will be removed, leaving just "my favorite color is blue".


Which forward secrecy cipher suites are supported for TLS1.0 protocols? May I know which are all forward secrecy ciphers supported in TLSv1.0 protocols?

As listed in the OpenSSL docs, the following TLS 1.0 suites support PFS via Diffie-Hellman Ephemeral:

 TLS_DHE_DSS_WITH_DES_CBC_SHA            DHE-DSS-CBC-SHA
 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA       DHE-DSS-DES-CBC3-SHA
 TLS_DHE_RSA_WITH_DES_CBC_SHA            DHE-RSA-DES-CBC-SHA
 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA       DHE-RSA-DES-CBC3-SHA

 TLS_DHE_DSS_WITH_AES_128_CBC_SHA        DHE-DSS-AES128-SHA
 TLS_DHE_DSS_WITH_AES_256_CBC_SHA        DHE-DSS-AES256-SHA
 TLS_DHE_RSA_WITH_AES_128_CBC_SHA        DHE-RSA-AES128-SHA
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA        DHE-RSA-AES256-SHA

 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA  DHE-DSS-CAMELLIA128-SHA
 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA  DHE-DSS-CAMELLIA256-SHA
 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA  DHE-RSA-CAMELLIA128-SHA
 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA  DHE-RSA-CAMELLIA256-SHA

 TLS_DHE_DSS_WITH_SEED_CBC_SHA          DHE-DSS-SEED-SHA
 TLS_DHE_RSA_WITH_SEED_CBC_SHA          DHE-RSA-SEED-SHA

If we include the Elliptic Curve ciphers, the following also implement PFS:

 TLS_ECDHE_RSA_WITH_NULL_SHA             ECDHE-RSA-NULL-SHA
 TLS_ECDHE_RSA_WITH_RC4_128_SHA          ECDHE-RSA-RC4-SHA
 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA     ECDHE-RSA-DES-CBC3-SHA
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA      ECDHE-RSA-AES128-SHA
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA      ECDHE-RSA-AES256-SHA

 TLS_ECDHE_ECDSA_WITH_NULL_SHA           ECDHE-ECDSA-NULL-SHA
 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA        ECDHE-ECDSA-RC4-SHA
 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA   ECDHE-ECDSA-DES-CBC3-SHA
 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA    ECDHE-ECDSA-AES128-SHA
 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA    ECDHE-ECDSA-AES256-SHA

If you also want to include TLS 1.2 (note that there are no TLS 1.1 specific suites) then you can expand the list to include:

 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256       DHE-RSA-AES128-SHA256
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256       DHE-RSA-AES256-SHA256
 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256       DHE-RSA-AES128-GCM-SHA256
 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384       DHE-RSA-AES256-GCM-SHA384

 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       DHE-DSS-AES128-SHA256
 TLS_DHE_DSS_WITH_AES_256_CBC_SHA256       DHE-DSS-AES256-SHA256
 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256       DHE-DSS-AES128-GCM-SHA256
 TLS_DHE_DSS_WITH_AES_256_GCM_SHA384       DHE-DSS-AES256-GCM-SHA384

 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256     ECDHE-RSA-AES128-SHA256
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384     ECDHE-RSA-AES256-SHA384
 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256     ECDHE-RSA-AES128-GCM-SHA256
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384     ECDHE-RSA-AES256-GCM-SHA384

 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256   ECDHE-ECDSA-AES128-SHA256
 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384   ECDHE-ECDSA-AES256-SHA384
 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256   ECDHE-ECDSA-AES128-GCM-SHA256
 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384   ECDHE-ECDSA-AES256-GCM-SHA384

 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256
 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384

 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   ECDHE-RSA-CAMELLIA128-SHA256
 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   ECDHE-RSA-CAMELLIA256-SHA384


Meaningless http request We've been logging GET requests on our domain to the following:

XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG

This has no meaning on our site. A search on the web revealed no information, but a few other places which logged similar requests.

Is this a known kind of attack? What might it be targeting?

This is a malicious request, but it's not trying to exploit a vulnerability. It's trying to generate a 404 page, in order to determine what kind of web server or CMS you're running, by identifying tokens in the page source. Error pages often specify their CMS name and version, or the web server name and version, so it's an easy target for recon.

Best advice I can give you is to keep everything patched, and make sure your firewall rules are properly configured. Primary targets are likely to be your CMS and web server, but your OS is important to patch too.

If you've got a few IPs that constantly do it, and you're certain they're not valid customers, feel free to block them for a few weeks to see if they remain persistent.


Zero Day Policies implementation I'm new here, and sorry if my english is a little bit broken it's not my main language.

I'm trying to put together a document/ppt for my startup with a Zero Day policy structure.

But I'm not finding real implemented flows, information, or something I can base this from (anything is helpfull)

What I found on my research mainly focus on specific discussing how heartbleed or the cve work.

I want to put something very straightforward but would love different point of views or examples if there are like:

We will be suscribed to receive every update automatically from the different applications, OS that we own
Critical updates will be reviewed, researched and implemented at top on 48 hours on all the servers
Medium/Urgent updates will be reviewed, researched and implemented at top on 1 week on all servers
Low Updates will be reviewed and implemented at most on the same month
A Team will monitor the audits logs of ports that are reporting status that are receiving suspected activity once a week on a internal meeting and define if new meassures have to be implemented
ETC

The point of zero-day attacks is that they use vulnerabilities which are not known at the time they get exploited. You can thus not create a policy specifically for zero-days. But hardening the security in general also reduces the risk or at least the impact of a zero-day. Because the zero-day exploit is just the way the attacker enters the network or takes over a system or account. The actual harm against the network is not done by the exploit itself, but by the attacker using other tools and methods from its achieved privileges on the computer and in the network for espionage, sabotage, ransom etc.

Therefore the protection you add must be based on the assumption that the attacker has already successfully entered your network using the zero-day exploit, i.e. that he is actually inside your network and that you need to reduce the harm he can do there.

This means of course being up-to-date with patching since otherwise you likely have problems already with the way more common known attacks than just with the uncommon zero-day attacks. This means monitoring your infrastructure for suspicious activity, which of course means that you know what should be normal and what is suspicious in the first place. Strict and narrow separation and segmentation at network and application level and proper user permissions can help a lot to restrict the harm a successful attacker could do in your network - no matter if he came in by using a zero-day or not. And for the harm you could not prevent you need recovery strategies, like having a backup with a working restore.

In other words: know what should happen in your network and implement techniques (like microsegmentation, zero-trust, ...) to enforce and monitor the expected behavior. Expect some harm and be able to recover from it. The better you understand what should happen and the better you enforce it, the less harm an attacker can do in your network even if he has successfully infiltrated some computer/user in the network. It is not that firewalls, IDS, antivirus, SIEM etc don't help - but these are tools to enforce and monitor expected behavior and not magic wands you just need to wave. Don't expect to successfully fight zero-days by adding security on top of a chaotic network you don't understand or which behaves differently than you believe.


Is PIN-protected token with login certificate a two-factor authentication if the token is controlled solely by the user? I know it isn't since the service the user is authenticating to cannot check the PIN correctness or existence. I need, however, to explain this to people who are convinced this actually is a two-factor authentication, since the user is required to use PIN by Terms and Conditions. Is there preferably some kind of "authoritative" definition I could build my argumentation on? Found only NIST 800-63-2 but it's inconclusive in this case.

If they cannot understand that the scenario is faulty, it might be better to side-step the 2FA argument and simply stick with the much simpler argument that having any factor that is insecure makes it a null method.

In this case, unless you can enforce a strong PIN or passcode when creating the certificate, you can be certain that lazy people (most of us after all!) WILL not bother. Leaving the certificate wide open to copying & unwanted reuse.

UPDATE: From your comments.

The first thing to do is to make sure your own butt is covered by raising a formal risk if you have a suitable process available. Otherwise by at least ensuring you have written proof that you raised the issue.

The Next step might be to try and encourage the organisation to have an external security review. Internal Audit departments can be very helpful here! They generally are very grateful to anyone who will willingly speak to them and are often more than happy to take a steer from you regarding organisational risks.

Not every problem has a direct answer :/


Is using a local DNS cache server more secure than using a DNS server from a router? Is using a local DNS cache server imore secure than using a DNS server from a router?

Confidentiality standpoint: Not much really, it does combine your requests with others behind the device, and won't be making them as often as if you were doing it uncached.

Availability standpoint: if a site stops responding to DNS requests sometimes the DNS cache can maintain those requests for a long time (depending on the cache ttl.)  Conversely, if a site is using DNS to perform load balancing or failover, you might be impacted if the site goes down and they switch to another IP for the host behind the name.

Integrity standpoint: Cache poisoning is a risk, you might be succeptable to it currently (or in the future.)  It could also be used by an attacker, if the device was compromised, to redirect DNS requests to a hostile service.

None of these reasons are huge negatives, you can have all of these things applied at almost every layer of your network.  Even Firefox has a DNS cache believe it or not.  If you have the need, I'd use one.  Just follow good security discipline while managing it.


PCI requirements to handle physical credit cards in non-payment contexts? I can't be too specific unfortunately, but let's assume a company has to receive, do some physical operation on credit cards, and send them back.

No card data will ever touch a computer, and payments for the service are handled separately through a PCI-compliant provider.

Does the company need PCI-compliance?

Who requires you to be compliant?

PCI DSS is not a law, and nothing in the PCI DSS can require you to be compliant if you don't want to. The usual meaning when people say "X needs to be PCI DSS compliant" is that either X has signed a contract where they agree to comply with PCI DSS, or want to sign a contract of a type where every partner will require them to be compliant - e.g. taking credit card payments.

If you don't want to be compliant, and haven't agreed to be compliant, then you can blatantly violate all PCI DSS conditions with two major risks:

the payment card industry may not want to talk to you, possibly in other aspects as well - e.g. if one of your products obviously goes against PCI DSS, then you may find out that you're unable to receive credit card payments for any products and services. That third party PCI-compliant provider might easily consider it good practice to refuse service to you if they believe you're misusing credit card data. Also, issuing banks may take action against you to prevent their cards being used in such a way - for example, if I as an issuing institution noticed that "End-users (bank customers) are sending cards" to some third party in sufficient numbers to warrant their attention, then it would be a proper and reasonable reaction to contact all customers who had transactions with you, notify them that their cards were compromised by doing this and asking them not to do it ever again, blocking all involved cards, requiring them to be replaced, and blocking any future card payments to you as potentially fraudulent.
if your cardholder data are fraudulently used, you might be held liable, as knowingly violating "well known industry standards" can be considered negligence and put you at fault if some fraudster manages to obtain that CC data and harm your customers. Due to this, you might want to follow at least some of PCI DSS guidelines anyway, as they include a lot of best practices for secure handling of data.


How is the password prompt going to protect me from ruining my computer? On Unix based systems, I'm often prompted to enter my password before installing or running a program.

Why does this protect me?

If I'm running a kiosk, I understand that a password might prevent someone else from messing with my computer. However, on my own computer, if I want to install something, entering my password won't stop me from running a virus or malicious program.

Prompting you to enter password is necessary to login into root account, enable user with higher rights. This is done just to prevent user from accidental actions like invalid command "rm -rf /". Sitting all the time under the root is not good idea - you really does not need such rights all the time you work. Also, it stops, prevents and decreases malicious stuff impact.

It is a part of Unix security model's philosophy.


Secure login system - using sessions? I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this:

<?php
session_start();

if (validPass() || isset($_SESSION['userId'])) {
    if (isset($_GET['logout'])) {
        session_destroy();
    } else {
        if (!isset($_SESSION['userId'])) {
            $_SESSION['userId'] = $the_id;
        }
        // User is logged in
    }
} else {
    // Show a login form
}
?>

Is this the secure way, or are there better systems? What should I look out for?

A more secure way? Use https along with this. There are two vulnerabilities here:

When the user logs in, the password that is sent over can be easily read by anyone snooping on your connection. This can't happen on an https connection.
If a user is already logged in, someone snooping on your connection can just copy over the session cookies. In HTTPS, cookies are transmitted securely, so there isn't much of an issue.

You may also want to log the user IP address and not let them switch, though this may get annoying (for a user like me who is behind a university proxy with rotating external IPs, I'll never be able to log in).

A final observation: Don't use GET for the log out bit.. Try not to use GET for anything which triggers a change -- it's fine for navigation, but not for anything which will lead to something changing on the server (a logout, or anything that writes to a database). See the prescribed usage of GET and POST for more details.

If you implement the above, then also make sure that the referrer of a POST request is your site and not some other site. (This, along with the above, will help prevent CSRF attacks).

To prevent clickjacking, disable framing via javascript and the X-Frame-Options: deny header.


TLS/SSL cipher suites I'm confused about cipher suites with regards to TLS/SSL.

For example, I see names like RSA AES 256 CBC and RSA AES 256 GCM. I understand that RSA and AES are algorithms used for encoding and decoding information, involving some sort of secret value to do so.

My problem is that I see these algorithms referred to with regards to general OpenSSL settings, which makes me think, "Oh, the public and private keys are just a lot of bits that are two variables used in potentially many algorithms, and not specific to any one algorithm". But then I see them appear when generating public and private keys, which makes me think, "The algorithm to use is encoded in the keys, and depending on which you use when generating them, determines which algorithm you must use."

Could someone please give me a high-level explanation of where these technologies are used and what they mean in their different contexts within SSL?

It's complicated.  What I'll present below is a dramatically simplified version of the details.  (Because the real details are contained in hundreds of pages of RFCs.)  There are essentially 3 cryptographic steps to a TLS connection:

Authentication
Key Exchange
Encrypted Communications for the application

Authentication usually involves the server identifying itself to a client by presenting a certificate.  This certificate validates that you are talking to a legitimate server: it has the hostname of the server embedded in, the expiration date, and is signed by a legitimate certificate authority.  Additionally, it contains a public key -- possession of the matching private key is evidence that the certificate "belongs to you."  Most often, this is an RSA keypair, though it's also possible to use DSA or ECDSA, or even another Public Key system (but on the open Internet, it's almost always 2048 or 4096 bit RSA).  This is what gives clients certificate warnings (wrong hostname, bad CA, expired, etc.).  This is the part that you generate a key for, and it needs to match your cipher specification.

Secondly is key exchange.  If you're not looking for perfect forward secrecy, this can be as simple as the client encrypting a piece of data using the server's public key from its certificate.  The server then decrypts this, and both sides use it to generate the connection key.  On the other hand, if you want perfect forward secrecy (i.e., stealing the RSA key isn't enough to decrypt every previous connection) you use some variant of Diffie-Hellman key exchange: basically, a technique for arriving at a shared secret securely.  Without an active man in the middle, a 3rd party can't get the shared key, and the authentication step ensured you don't have an active man in the middle.  This DH step can be Diffie Hellman over an integer group (DHE) or over an elliptic curve (ECDHE).  Whether you use RSA, DHE, or ECDHE for the key exchange, you now have a secret key shared between the client and server that nobody else should have.

Finally, you get the actual encrypted communication.  Asymmetric crypo like RSA and DH are too slow for ongoing communications of large volumes, so we use symmetric crypto systems (like AES) for this.  This uses the shared key exchanged in the previous step to communicate.  Each packet is signed as well, either with an HMAC (so you might see SHA256 as part of your cipher specification) or a tag like GMAC from GCM (for AES-GCM).  Additionally, AES (and other ciphers) can be run in several modes: GCM, CTR, CBC, etc.

Some examples:

ECDHE-RSA-AES128-SHA256 means to use Elliptic Curve Diffie-Hellman for key exchange, RSA for authentication, and AES128 with SHA256 signing of messages.  (CBC mode is used, though not explicitly included.)

ECDHE-ECDSA-AES128-GCM-SHA256 is Elliptic Curve Diffie-Hellman for key exchange, Elliptic Curve DSA for authentication, AES 128 for crypto (GCM for signing packets, SHA256 for signing other data.)

AECDH-RC4-SHA is Anonymous Elliptic Curve Diffie Hellman for key exchange, no authentication (hence anonymous), RC4 for encryption, and SHA-1 for packet authentication.  (Please don't use this.  All of it is broken by modern standards.  It's an example.)


How hackers manage to run javascript code in webform How hackers manage to input malicious code into web applications and most websites? I'd like to say that it is rare of websites to have the JavaScript function eval() on their website's code.

As a quick search on GitHub can tell, using eval is not that rare, it's actually pretty common. But eval is not the only way to inject code.

XSS is a common vector. If you have a form asking for the user name, and you print the result later, unescaped, a user named <script src='doma.in/scr.js'></script> can inject code.

Using the development tools, you can inject whatever you want. You can pause execution, inspect variables, create and delete objects, all you want. If javascript can do it, you can do it. If CSS can do it, you can do it.

The main issue is that developers often forget that the browser is on the attacker's domain. Anything you put on Javascript can be subverted. You can heavily obfuscate the code, but this cannot defend against a dedicated attacker.

I have seen sites using Javascript on the client for authentication. You can tell how bad this is...

Javascript aside, server-side languages (PHP, Python, ASP, JSP and the like) suffer from this too. Just search for Command Injection (OWASP has a good page about it) and you will find a lot of ways.


Where do organizations store their sensitive documents? How do they protect them? Where do organizations store their sensitive documents?

How do they protect them?

What are the pros and cons for each method? (If there are multiple common ones)

EDIT: I am more referring to applications that organizations use to save their sensitive documents such as HR/Finance/IP... or some method in which they are protecting it.

You are talking about a Document Management System. Typically these systems allow users to save documents and delegate read/write access on a user or group level. They also allow for auditing of when users access documents. Some may also restrict editing and copying or even printing of a document (in addition to auditing all such actions).

There is simple to complicated. Some use a basic NAS with AD Group Policies. Others add a layer of encryption (Full Disk encryption, TrueCrypt, something else).

Finally you have the 'Enterprisey' systems. These have workflow and publishing management, complex ACLs and options on securing the documents and logging all activity.

Xeros sells a system called DocuShare (http://docushare.xerox.com/ though now marketed more as CMS) which I know several UN Organizations use. There is also KnowledgeTree (https://www.knowledgetree.com/)

These are just two of many. YMMV depending on actual business needs. Hope this helped.


if SSL v3 disabled on www.google.com, why does openssl output suggest SSL v3 is being used? Auditing tools like
https://sslanalyzer.comodoca.com/?url=www.google.com
report that SSL v3 is disabled on www.google.com (as you'd expect; with the security flaws that have been discovered in SSL v3, a company like Google isn't going to forget to turn it off).

But then, how come when I connect to it with openssl and grep the output for "ssl":

openssl s_client -state -connect www.google.com:443 | grep -i "ssl"

the output references SSLv3 multiple times?

SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=1 /C=US/O=Google Trust Services/CN=Google Internet Authority G3
verify error:num=20:unable to get local issuer certificate
verify return:0
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
SSL handshake has read 2450 bytes and written 447 bytes
New, TLSv1/SSLv3, Cipher is AES128-SHA
SSL-Session:

I do see the reference to "TLSv1/SSLv3".  I've heard that "TLS uses SSL certificates" although I don't understand the details, but does that mean that this connection is using the TLS protocol but using SSLv3 certificates, and that's why I see all the references to SSLv3 even though we're not using the SSLv3 protocol?

(I assume this is more of a conceptual question than a programming question which is why I'm posting it here instead of Stack Overflow.)

These messages are coming from SSL_state_string_long, and many of them were updated in version 1.1.0 from "SSLv3 [message]" to "SSLv3/TLS [message]", so my guess would be that OpenSSL uses the same code for SSL 3 and TLS handshakes, and you're just using a version before 1.1.0 where the messages weren't yet updated to account for that.

You can see here and here for 1.0.2 that TLS uses many ssl3 functions, only swapping out those that are incompatible. This has been moved in 1.1.0 so that all of the implementations are in methods.c.


Firebug reports SHA-1 certificate error For the script at the bottom of this post, Firebug reports the following error:

  This site makes use of a SHA-1 Certificate; it's recommended you use
  certificates with signature algorithms that use hash functions
  stronger than SHA-1

The error is duplicated for every call to googleapis, and does appear for links to resources on my server (i.e. clicks.js).

https://www.ssllabs.com indicates that I am using SHA256withRSA.

oppenssl also indicates that I am using sha256WithRSAEncryption.

[root@devserver ~]# openssl req -in /etc/pki/tls/private/mysite_csr.pem -noout -text
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=US, ST=Washington, L=Bothell, O=MySite, CN=mysite.com/emailAddress=xxx@comcastdotnet
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Modulus:
                    xxxx
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha256WithRSAEncryption
         xxxx
[root@devserver ~]#

It occurs both with self-signed certificates as well as those from a CA.

The script which causes the error is below along with the Firebug errors.

<!DOCTYPE html>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
        <title>Testing</title>
        <link href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/themes/ui-lightness/jquery-ui.css" type="text/css" rel="stylesheet" />
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.js" type="text/javascript"></script>
        <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.js" type="text/javascript"></script>
        <script src="clicks.js" type="text/javascript"></script>
    </head>

    <body>
    </body>
</html>

Left clicking to copy the errors provides the following:

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/themes/ui-lightness/jquery-ui.css
Line 0

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.js
Line 0

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.js
Line 0

What causes this error, and how is it eliminated?

The problem isn't your certificate, it's the certificate of googleapis.com, which you're accessing by way of loading their jQuery libraries.

If you go directly to one of the scripts, you can click on the padlock icon and see more information about the SSL certificate:

+- GeoTrust Global CA
+--- Google Internet Authority G2
+----- *.storage.googleapis.com
     +--- Certificate Signature Algorithm: PCKS #1 SHA-1 With RSA Encryption

I wouldn't worry too much about it - Google are hoping to move forward to SHA256 soon, and it's hardly likely to affect you.

If you're really worried about it, move the copies of jQuery over to your site locally, then include them from there. That way you're not fetching resources from 3rd party hosts.


How do I know if I have a keylogger from my Flash client on Windows 7? I'm at work and having some issues here, so I found a lot of suspicious files involving the Flash, so I though that could be a keylogger. How do I find out if it is, and if truly is, what do I do to remove it? I'm worried about my security, since I'm a public agent.

If you are worried about particular files, you can upload them to Virustotal so that they are checked by popular AV software. Keep in mind that sophisticated malware could detect that and remove itself from the file before it is uploaded, so that the AV scanner wouldn't find anything suspicious.

Apart from that you can download free (check the license if you can also use them for business use!) ISO images from different Anti Virus software vendors which you can boot from and check your system. The benefit of this approach is, that any malware which might have infected your Operating System will not be able to start (since you don't boot your Operating System) and can't hide itself therefore. You can put several scanner on one CD/DVD or USB stick with tools like XBoot, so you only need to create on CD/DVD than several ones. These tools will add a bootloader to your CD/DVD or USB stick which will let you choose between the different scanner on boot. Here are examples of  Anti Virus ISOs from Kaspersky and Avira:

http://www.avira.com/en/download/product/avira-rescue-system

http://support.kaspersky.com/viruses/rescuedisk

You will find a lot more from other companies like F-Secure, AVG and so on via your favorite search engine. I would recommend to download them on a system, which you don't suspect to be infected by malware and handle them.

If you find malware, I would recommend a fresh re-installation of the Operating System to make sure you removed the malware completly. Keep in mind that you also should check any USB mass storage devices, backup devices etc. for malware. Again use multiple scanner.

Be aware that these solutions might not find recent malware. It might be wise to contact a security expert who could do detailed analysis of your system. Analysis of unknown malware is not trivial.


What's the point of the second SA exchange in the Create_Child_SA exchange in IPsec I have problems understanding why you would negotiate crypto-algorithms in the Create_Child_SA request in a IKEv2.

During IKE_SA_INIT you negotiate cryptographic algorithms which I assume (correct me if I am wrong) are very similar to a TLS cipher suite (symmetric crypto algorithm and a hash function). You also do a Diffie-Hellman exchange which I assume is not specified in the SAi1/SAr1 because you always do DH in IKEv2.

Later during CREATE_CHILD_SA you have to do the same and I understand that it improves security to do a Diffie-Hellman exchange twice (it is also optional).

What I dont get why you would want to negotiate cipher suites again. RFC 7293 tells me that

  All messages following the initial exchange are cryptographically
     protected using the cryptographic algorithms and keys negotiated in
     the IKE_SA_INIT exchange.

so what's the point of the SA offers in the CREATE_CHILD_SA request?

During IKE_SA_INIT you negotiate cryptographic algorithms which I assume (correct me if I am wrong) are very similar to a TLS cipher suite (symmetric crypto algorithm and a hash function). You also do a Diffie-Hellman exchange which I assume is not specified in the SAi1/SAr1 because you always do DH in IKEv2.

Yes, they are similar. But there are no fixed cipher suites in IKE (i.e. algorithms of different transform types may freely be combined in a proposal - with some exceptions, like not negotiating integrity algorithms when AEAD mode ciphers are proposed).

The DH group is also negotiated with SA payloads (transform type 4), even though the initiator already sends a KE payload with its public DH value for a specific group. So if the initiator proposes more than one DH group it has to assume which group the responder might select (the responder could, of course, use the KE payload as strong suggestion towards the group that should be selected, but it might prefer it's own configuration or not even support the proposed group). If the initiator's guess was wrong and the responder selects a different DH group it will respond with an INVALID_KE_PAYLOAD notify containing the selected group. The initiator then has to send another IKE_SA_INIT request with an appropriately updated KE payload (and possibly an updated SA payload).

  What I dont get why you would want to negotiate cipher suites again. RFC 7293 tells me that

    All messages following the initial exchange are cryptographically protected using the cryptographic algorithms and keys negotiated in the IKE_SA_INIT exchange.

  so what's the point of the SA offers in the CREATE_CHILD_SA request?

That quote is referring to IKE traffic, which is encrypted after key material has been established with the DH exchange during IKE_SA_INIT. But to transport traffic via IPsec it's necessary to negotiate actual IPsec/Child SAs within the IKE SA. The algorithms used for IKE and Child SAs may be different, actually, every negotiated Child SA could theoretically use different algorithms (that may usually not be the case, but using different algorithms for IKE and Child SAs is definitely common, e.g. AES-GCM for IPsec and AES/SHA-2 for IKE). That's why algorithms are negotiated in CREATE_CHILD_SA exchanges.

The CREATE_CHILD_SA exchange is also used to rekey IKE and Child SAs, and while different algorithms could theoretically be negotiated then (basically a new SA is created to replace the existing one) RFC 7296, section 2.8 discourages this:

  Note that, when rekeying, the new
     Child SA SHOULD NOT have different Traffic Selectors and algorithms
     than the old one.

Please also note that, unless RFC 6023 is implemented, a first Child SA is already created with the IKE_AUTH exchange. The algorithms used for this SA are negotiated with SA payloads during IKE_AUTH (SAi2/SAr2 in RFC 7296). However, because there is no separate DH exchange for it (the keys for this SA are always derived from the IKE key material), no DH groups will be negotiated, RFC 7296, section 1.2:

  Note that IKE_AUTH messages do not contain KEi/KEr or Ni/Nr payloads.
     Thus, the SA payloads in the IKE_AUTH exchange cannot contain
     Transform Type 4 (Diffie-Hellman group) with any value other than
     NONE.  Implementations SHOULD omit the whole transform substructure
     instead of sending value NONE.

If that Child SA is later rekeyed, a DH group may optionally be negotiated to establish new key material that's independent of the IKE key material. Because no DH transforms were contained in the initial SA payloads used for this Child SA, configuration errors regarding DH groups for this Child SA may only be detected when it is first rekeyed and fails.