Botnet tracing: Is SvcHost RemoteIP reliable or can it be spoofed? On an RDP server, the "Resource Monitor" system app shows network connectivity by process in the "Overview" tab under "Network" section.
In this section, I see an SvcHost process on TCP port 3389 for each active and authenticating RDP connection, including connections that fail authentication.

When I test a dictionary attack or DDoS on port 3389 to my test server, I see all of my connections popping in and out of Resource Monitor, so it looks like this would be a good way to log incoming RDP requests, and start collecting data on botnet sources. (I also collect Audit Event Logs from TerminalServer and Security Event Logs -  see my other post here - Digging into DDos Attacks...)

I'm curious if and how the RemoteIP associated with the SvcHost process can be spoofed. Is there a way to detect if these IPs are spoofed? Can an RDP connection be established via a spoofed IP?

How reliable is the remote IP in Resource Monitor?

how the RemoteIP associated with the SvcHost process can be spoofed

In TCP, you can't really spoof an IP address and use the connection. The TCP handshake requires a three way handshake where packets are exchanged between the two endpoints. If you have spoofed the remote IP address (i.e., written a fake or incorrect IP into the IP header) the handshake will fail. So, the bad actor client sends your servers spoofed packets (inbound SYN) your server replies with a SYN_ACK, but sends the SYN_ACK to some random place. If it arrives, the machine that receives it will wonder WTF this is doing randomly showing up there, and just discard it.

Spoofed IPs are useful for DDoS attacks (to hide the source), amplification (to bombard a target), etc...

But they are not useful if you're trying to get a connection and hide where you are.

  Is there a way to detect if these IPs are spoofed?

Not really. The only time I have seen that it was easy to detect spoofed IP requests (or what I surmise are spoofed IP requests) are looking at a firewall where there is a burst of inbound SYN packets, which get a SYN_ACK sent out, but an ACK is never recieved).

  Can an RDP connection be established via a spoofed IP?

Depends on your definition of spoofed IP. If you mean an IP address that is not associated with the attacker, then no.

If you mean an IP address that conceals an attacker, then yes. They can MiTM themselves, use VPNs, proxies, and a number of other technologies to obfuscate their actual IP addresses.

P.S. - One other thing that you need to be aware of in terms of "can a spoofed IP establish a connection" ... RDP uses crypto to secure the connection. This involves the exchange of keys in order to encrypt the data, which is another handshake that has to work. So, our TCP /IP setup requires a handshake. Key exchange for the crypto requires a handshake. You can't do all that with fake IPs. It has to be an actual machine that is ready, willing, and waiting to fulfill it's half of all the requests.

  How reliable is the remote IP in Resource Monitor?

It's reading the IP address from the IP header of the traffic. So, it's as reliable as that header is.


GPG encryption date or GPG version recoverable? Is there a way to determine the date of encryption or the GPG version of a GPG-encrypted file (with symmetric encryption)?

I lost the password but some rough information about when the file was encrypted would help me. (The oldest could be 5-7 years ago, newest a few months. The file modification time is also lost.)

For example, if I remember right, it could be that old versions of GPG did not have integrity checking. Can I figure this out?

If the file is ASCII armored, you may find the header at the top.

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.11 (GNU/Linux)

jA0EAwMCSPY2a+zUrBBgySD3+GWiPhdcQbtKogerjG/50O9Q6f3FY78qqyxLBw00
RA==
=DBXE
-----END PGP MESSAGE-----

If it isn't then you can try to review the specification, but it's complicated and after several minutes of reading I don't have a clear answer either. See  http://www.ietf.org/rfc/rfc4880.txt.


Security and conventions. DB or File? Let me start off by stating I know the benefits of a database but that is not the question. I want to know if the security makes sense with an added benefit of speed.

By using PHP 7.0,

Test 1: I have a database setup with a table called user, with an id field and password for an example. I use the PDO extension to query the database by id.
The request took o
0.0005719 microseconds to complete.

Test 2: I read a local file that all it contains is a password hashed.

The request takes 0.00005912 microseconds to complete.

Please note: in both cases the passwords are hashed using php's password hash function. As this is a security fourm I want to state that as well. Also for concurrency the file is assumed safe to be read only by one person at one time at login only.

Either way, as it would be used to login only, not get details, would it be secure? (The files are NOT stored in web root). So somebody would need a server login, or the php acting as a middleman to read the file. The database is mysql and  requires a server login plus mysql login.

Question: are the speed benefits for using a file instead of a database warrant good grounds for using a file or keep it in the database? Does this pose any security risk on a production environment?

Update - 23-02-2017
Let me state a few things. 1, A "full" user is not stored in the file, only a password already hashed. No need for indexers because when a user logs in a md5 hash of the Username would be directed straight to a file on the local system. (Username cannot be changed). This would allow for quick logging in, without a database query. 2, The test was conducted with the data already store just the time getting the data was tested. 3, It is microseconds, as per php microtime. The operation was iterated 100 times, then a difference was taken and averaged. 4, this is strictly hypothetical.

If the passwords are salted and hashed then there is no real value in them to an attacker. Go with whatever is simplest to manage from a development and maintenance point of view.


How to crack `salt + SHA256(salt + password)` hashes with JTR? I have a set of password hashes. Sample:

9e74437e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806

From the source code of the application generating this hash I learned that the salt is prepended as the first 6 characters and the overall algo producing the hash is:

salt + SHA256(salt + password)

Knowing the cleartext password for the above hash (helloworld) I was able to confirm my assumption gleaned from the source code on Linux command line (command + result):

printf 9e7443helloworld | sha256sum
7e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806  -

Now as I said I have a set of those hashes and I'd like to set John The Ripper against them and use dictionary attack. I guess it can be done using --rules flag and supplying custom configuration file with custom rules. But I'm not sure this is the right way and not familiar with JTR's mangling rules.

Can you please show me the way of achieving my goal with JTR?

as far as I know the --rules option only allows you to define rules for the password the user may be using (foobar, foobar123, f00bar…).

--format corresponds to the format of the hash: there are many predefined rules (http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats), so you can modify your file to the format salt:md5(salt+password), eg : 9e7443:7e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806, and find a format which processes username:md5(username+password) for example.

Another option would be to use dynamic scripts (https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/DYNAMIC_SCRIPTING). This method will be trickier but also more flexible.


What wrong with this system to proactively check if customers' passwords have been found in a breach? Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so what if my customers' passwords show up in the list later, after they've already created their account?

I'm of course storing the passwords hashed, salted, and peppered, the whole point of which is to make it intractably expensive to try lots of guesses, such as every newly leaked password. Any information I can think of to store alongside the salted hash to enable checking the newly leaked passwords would also weaken the salted hash. I could wait til they next sign-in and check against the leaked passwords list then, but how can I notify them proactively? I could force re-sign-in by expiring all current sessions, but how can I avoid inconveniencing unaffected customers (especially if that's usually 100% of them)?

What if:

during the sign-in process, the server generates a 160-bit cryptographically random nonce, sends it to the client, and also associates it with the session in ephemeral storage like Memcached
when sending the sign-in request to the server, the client hashes the password with SHA1, XORs it with the nonce, and stores the result locally while forgetting the nonce
when the server learns about a new breach, it pushes the nonce to the client
the client can then XOR the nonce with the encrypted SHA1 and check the SHA1 hash with Have I Been Pwned or whatever

Notes:

the nonce never touches disk/durable storage, anywhere
the customer's password never touches disk/durable storage, anywhere (nor any value from which the password can be easily extracted, e.g. unsalted SHA1)
without the nonce, the encrypted SHA1 is useless because the XOR pad/one-time pad encryption is cryptographically perfect, so no vulnerability to XSS or compromise of the client's computer
the server can expire the nonce after a while, and/or limit how many such nonces it keeps around per customer account, either of which render the encrypted SHA1 irreversibly useless

If my systems were completely pwned, of course, then next time the client updates it could include malicious code to combine the nonce with encrypted SHA1 and exfiltrate the cleartext SHA1 the attacker's server, but that seems like a much higher barrier than my database dumps being compromised.

One tiny way to potentially strengthen this that I can think of is that it might be possible, instead of storing the full SHA1 hash, to just store a prefix of enough bits such that the relatively small number of newly leaked passwords would collide with only very few of my customer's SHA1 prefixes, but few enough bits that it would only filter a dictionary attack down to dozens or hundreds of guesses, which is sufficiently many to not be usable on a properly ratelimited online service. I don't think this mitigation is very useful, though, even if such a number of bits existed, because it's difficult to imagine the attacker not having the Argon2-hashed password and salt, which would be very easy to crack if guesses have been narrowed to hundreds or even thousands.

I think what you are pursuing is quite ambitious but it is overkill.
In my opinion you should simply:

enforce a minimum level of password complexity
add two-factor authentication (2FA) - this will make up for weak or compromised passwords
if possible make 2FA mandatory or try to enroll as many users as possible
devote your free time toward tightening and auditing your systems - you may have some vulnerabilities present, that could nullify all your security efforts

So the answer is not to rely on the password alone for authentication purposes.

Checking the password supplied at signup against pwnlists is a good idea. Do it offline, that is against password lists that are  stored on a local drive. Do not submit the password to an online service for verification.
You can repeat this check whenever the user changes their password.

Regarding implementation of 2FA you have a number of options. It would be good to offer some choice, for example many users could be satisfied with a Google authenticator but others may more comfortable with an alternative solution.

SMS is not considered safe these days but it depends on the value of the assets you are trying to protect.


If am using Stripe am I SAQ A-EP in PCI V3 We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to them, does that mean I need to go down PCI SAQ A-EP ?

I am a little confused and the only way to be PCI SAQ A is to use an iframe or have my application hosted on a PCI-compliant payment processor.

That is correct. if you are using the Stripe or similar processors that utilize a redirect method to post payment data to the processor you will use the SAQ A-EP. if you use an iframe or payment is 100% hosted by a compliant service provider then you can fill out SAQ A. Here is a FAQ from the PCI council that explains things in a little more detail:

PCI SSC FAQ - iframes and redirects


Triggering a XSS when the payload appears twice? I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*, appears two times. The idea was to close the function foo1() and trigger confirm(1). But foo2 is the problem. It is not possible to initialize foo_var with the same payload. The character ) is the problem. Any ideas?

function foo1(){

    if('EUR66038');}confirm(1);/* != 'blabla'

 /*
    Some comments
   */

function foo2()
{
    var foo_var= 'EUR66038');}confirm(1);/* //Comment
...

The following payload will work:

EUR66038'+confirm(1)+'820

Encoded version:

EUR66038%27%2Bconfirm(1)%2B%27820


Methods to work with offline primary keys I created a number of profiles with separate subkeys for authentication, signature, and encryption while primary keys are saved on USB Stick. It's working alright but I was wondering if there are some good methods to link to a primary key when it is needed to certify certain operations, such as signing another key, adding identities etc.

I followed this blog, which I thought would be a solution. I imported private keys into a temp gpg directory ~/ram/gpgtmp/ and tried to sign ID2 with ID1 both in a default folder ~/.gnupg/puring.kbx.

gpg --homdir ~/ram/gpgtmp --keyring ~/.gnupg/pubring.kbx -u ID1 --edit-key ID2

The ID2 is not signed in a default gnupg folder but in ~/ram/gpgtmp. I tested it when invoking command gpg --homedir ~/ram/gpgtmp -k. Therefore it is not necessarily working.

Do you know how to bring an offline primary key?

I have found a way to link an offline primary key. Still, inspired by a blog Using an offline GnuPG master key, I realised that --keyring adds a file to a list of keyrings, whereas I needed to specify exactly one file. Therefore, the missing option was --no-default-keyring. I am not an expert but this is what worked for me:

1) Mount USB stick. The folder will something like /run/media/username/CORSAIR in Linux.

2) Create directory for a ram disk

mkdir ~/ram

3) Mount the ram disk:

sudo mount -t tmpfs -o size=64M tmpfs ~/ram

4) Create a temporary directory for gpg: mkdir ~/ram/gpgtmp.

5) Import private keys from a USB to a temp gpg , e.g.

gpg --homedir ~/ram/gpgtmp --import /run/media/username/CORSAIR/gpg-archive/primary-keys.asc

After importing private keys to ram disk, USB stick is no longer needed.

6) Run GPG editor:

gpg --homedir ~/ram/gpgtmp/ --keyring ~/.gnupg/pubring.kbx --no-default-keyring -u <ID1> --edit-key <ID2>

7) In the editor, use uid n to choose an identity of interest, followed by sign to sign selected identity with a local key .

With a primary key linked to a temp gpg folder, the command should be completed with success. As a side note, after step 5 a USB stick is no longer reuqired and can be dismounted.

EDIT.

In case of error:

gpg: key AAAAAAAAAAAAA: error sending to agent: No such file or directory

try to restart gpg-agent

gpgconf --kill gpg-agent
gpgconf --launch gpg-agent

I also deleted everything in gpgtmp. Even better would be to re-create the folder. After re-launching the gpg-agent, the import was working again. I guess a simple restart system would also work.


Is there use for Windows built-in file/folder encryption if the PC has only one user? From what I gathered, Windows 10 built-in encryption decrypts file/folder when a specific user logs into Windows. In a PC that only has one user, I want to keep the files encrypted until the user is prompted with a password and only then the files are decrypted. If I understood correctly file encryption does not do this.
I want to know if Windows 10 built-in file encryption is useful to me in any way if my PC only has one user account?

The whole point of EFS is that the unlock key is protected by your logon password. If you only have one user, then they can access the data. Additionally, if there's only one user account then you have no separation of privileges between you and someone else logged into your account.
If you want to have an encrypted drive that you need a password to open, consider something like VeraCrypt.


Comparing Site to Site VPN with DMZ Consider that the two cities A and B have offices of a company and both these offices have their own isolated networks. People at site B used to communicate using an application which has its server located inside the same network. Considering that the server has been moved to site A for some reason and the employees at site B still want access to that server as if it were a part of their own network, what would be the best possible was to achieve this?

So far I have studied about putting the server in DMZ so that it could be accessed over internet and the rest of site A still remains isolated. The other was that I studied is to create a site to site VPN. This would ensure the safety of server from internet.

I want to know if there's any other way to do it? If not, which among the two would be better?

In practical senses, I rarely see this being handled by the company infrastructure and instead what happens is the company signs up for WAN to a provider which will make access between sites transparent and absolutely guarantee that the companies traffic is not co-mingled in any way that other customers of that provider can hack into the traffic.

If you don't have that service and need to roll your own, or perhaps you don't fully trust the service, a site-to-site VPN encrypted with AES256 would be generally considered a good practice. The network router might have the ability to do this, and would be considered a good practice -- especially if those features are built into the network gear of a good name brand.

Another option would be firewalls on each site which establish the site-to-site vpn. Whether that is "better" than using IPSec features in the routers is a big "it depends".

From a cost perspective, less boxes costs less, sucks less power, throws off less heat, and takes up less rack space. From a security operations perspective more boxes means more things to worry about being mis-configured and introducing security holes, or less boxes to make sure are patched regularly, less boxes means smaller attack surface.

Not sure why you would opt to put the server on the public Internet in a DMZ if the only access comes from within the company from site A or B. Putting it in a DMZ on the public Internet would make it susceptible to security bugs in your DMZ firewall, configuration errors (which either are there from day one or get introduced through changes), etc.

DMZ's are meant to be places where you put servers that absolutely have to be exposed to the public Internet and there is no alternative. If there is an alternative, the alternative is always going to be the better route.  There is nothing in the question that justifies taking this risk.


How to securely access web api from Html5 Website So the thing is I have created a Asp.Net web api and am using oauth to secure the access.
The problem is that the clients want to make a pure html(angular) website from which they will access the api. So basically they will call my webservice oauth endpoint using their credentials to get the token and refresh token and they will store that somewhere in the localstorage to make subsequent request. My problem is that if they will use pure html and angular, their call to the api and point and request data will be visible to a malicious user and he can use that client id and password to generate tokens and can use that for his use.
 I searched a lot and didn't find any help . Since it is my first web api project, I don't lot about these. Can any one help me regarding this
?

Your use-case is the public client as described in RFC 6749 Section 2.1. In this case you have the option to implement the implicit grant. This implies that the user interacts with your site to grant access to the data.

However if your use-case forbids the redirection of the user the OAuth framework can't solve your problem.


Detect and remove USB malware I bought a USB thumb drive on ebay. It seems like much too good of a deal ($20 for a 512GB drive, as of 2015-08-10) which makes me suspicious about malware on the drive. How can I test it to see if it has malware, whilst also not infecting any of my PCs with malware?

I was thinking I could unplug all hard drives, boot with a Linux live CD, then format the drive. Would that be considered a secure process, or, for example, could my BIOS get infected if I were to do this? And is it possible for the drive to contain malware even after I format it? If so then how could I detect this?

Yes, you could plug the USB drive into a Linux Live CD and format the disk.  Once it's formatted, it's safe to use.

Note that this would not thwart any infection if the malware is in the USB firmware, but that's a remote possibility and I wouldn't be too much paranoid about it.

There is a better reason to be suspicious about good deals on USB thumb drives bought from unreliable sources: they might have a tampered firmware that let them sport a fake capacity, so your 512-Gb drive can in fact hold only 4 Gb only.


What techniques do advertisement companies use to get my browsing information, and how can I stop them? In the past year, I've noticed a strangely increasing incidence of advertisements on various web sites being for products that I was browsing for elsewhere.

This makes me extremely uncomfortable. It doesn't seem to be cookie-driven, nor does it seem to be Google.

I took a look at one of the ads and traced it back to some marketing company, whose name I will not mention as I don't want to give them the satisfaction of a link, but I will say that their front page slogan is the rather eerie "Discovery: Information Finding People", and their about page is equally creepy. They also describe themselves as "the world's leading content discovery platform, serving 300B recommendations to over 750M unique visitors each month on the web's most innovative publisher sites, including NBC, USA Today, The Weather Channel, The Atlantic and Fox Sports." No doubt there are other companies providing this service as well; I only looked at one ad.

Also, Adblock does not seem to block these ads by default. I've added a pattern but I'm not confident that it's doing anything more than simply preventing me from seeing the ads.

I realize I probably can't stop this in general (e.g. I suspect they don't care about "do not track"), but maybe I can somehow stop it one content-provider at a time.

I am certain that this is not merely paranoia. In fact, I am fairly loose in my views on personal privacy. But there is something disconcerting and uncomfortable about looking around for a product, or for, say, books on a subject, then seeing advertisements for precisely what I was looking for on unrelated web sites the following day.

Even more troubling is sometimes the ads I see are for products that I was browsing on unpopular, low quality web sites that surely weren't employing these marketing companies for tracking in the first place, so I'm not even sure how this information was tracked. It would be one thing if I was looking on Amazon, but having targeted ads show up for things I was looking for on, say, independent local business web sites, is another thing entirely.

What can I do? How can I find out how these people are tracking my browsing history and stop it? What techniques are usually used by these companies when gathering information and what can be done to counter it?

There are several ways I can think of:

Browser-fingerprinting. To stop browser-fingerprinting, use Random Agent Spoofer correctly.
Your IP address. To stop this, use a VPN such as Private Internet Access, and connect to a random IP every time.
Your free accounts. When you connect to free accounts such as Gmail, YouTube, etc., they sell your information to third parties. Associating your fingerprint and known IP addresses helps people track you down. To stop this, quit logging into your free services on your current IP, including VPNs.
Third-party Cookies. Don't allow third-party cookies, like ever. And on some sites, simply don't allow them to use cookies at all.
Canvas-fingerprinting.
Javascript that tracks you. You can disable Javascript, or find an add-on that prevents tracking scripts from loading. Usually, uBlock will do this.
Flash LSO objects. Use an addon such as Better Privacy.

There's a lot of different ways to track you...

Apparently, there are a lot of things I haven't considered. Check Steffen Ullrich's suggested reading.

Also, you should be using uBlock origin.

uBlock for Chrome
uBlock for Firefox

Wear an advertisement-based Tinfoil Hat

I would suggest a mix of the above, but probably take it a step further: set up a virtual machine (such as VirtualBox) that connects to a different host, and use your "free" services on the virtual machine's web browser.

If it's online, and it's free, then the majority of the time, you're the product. How do you think these companies survive by providing free products while having a LOT of staff members? It isn't because of their good nature.

Don't forget to clear all of your cookies.


How does collecting sensitive data using iframes increase security? So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations.
The added layer of security that "fields in iframe" brings also supposedly reduces the level of PCI compliance required.
Verygoodsecurity, a tokenization service that also offers forms for sensitive data collection has a rather unusual approach of using a separate iframe for each field of the form, allowing the developer more control of the integration.
What I was wondering was, what added security does this approach offer and what kind of threats does it mitigate compared with just sending the data to the trusted 3rd party via a web request?
Am I wrong in thinking that if a bad actor is able to run javascript on your page, then they would be able to intercept the users actions, regardless of iframes, or is that not the case? Can keypresses be intercepted? And if not, they could just strip out the iframes..
Is it possibly just to make it a little less easy to get at the sensitive data? Maybe it would prevent a non targeted attack, like just listening for anything that looked like credit card details..
Quotes from PCI standards:

iFrame
provides “sandboxing” to isolate content of the embedded frame from the parent web page, thus ensuring
that information is not accessible or cannot be manipulated through various exploits by malicious
individuals.

but then..

If an attacker has compromised the merchant’s website, however, they can create alternative content for
the frame, which then allows completion of the payment process as well as creation of a copy of the
cardholder data for the attacker.

...  if a bad actor is able to run javascript on your page

That's exactly the point one want to avoid. Iframes allow third-party sides including script to be part of the visible page without having access to the parts of the page outside the iframes served by this specific third party. This is much more safe than embedding a third party HTML (for the form) and script (for form control, like input checks) directly into the main page.
If the iframe and main page come from a different origin, then the Same-Origin Policy will severely limit how they can interact with each other. Contrary to that a third-party script included with the script tag has full access to the DOM and could do everything a same-origin script tag could do.


Incident isolation and containment approach In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported.

Compromised systems are disabled or disconnected but operations carries on by reverting to a redundant system until the incident is solved, or disconnected/disabled temporarily until the incident is resolved
Compromised systems are not disabled or disconnected and normal operation carries on? But spend time to trace hackers and collect evidence??

In both approach, there are suggestions by experts that disconnection is not advisable because of forensics reasons. If so, then what is the best way to isolate/contain and incident so that it won't spread further and at the same time I don't let the hacker know we have already detected his existence? IMO i would think it's a question of time and resources ? Would you rather spend time tracing who, how they got in? Or would you rather patch and bring up your systems quickly ?

I asked this, as we don't really have a very good incident response plan and is trying to find out the best way to handle incidents.

In my opinion the response should be aligned with your business. It depends on what you value more if confidentiality, integrity, availability or traceability.

If availability or traceability are the most important: do not shutdown the systems. Design a procedure to gather forensic evidences as soon as possible and execute it when needed.

If confidentiality or integrity are the most important: shutdown the systems, extract forensic images from the disks and perform forensic analysis with what you have there.


Upload data from Internet to DMZ to an intranet I've got the following situation: A web server located in a DMZ receives file uploads from web browsers. The uploaded files are stored on the web server's file system. In the next step, these files must be forwarded to another server (let's call this the internal server) in the internal network. For the last step, the internal server needs a traditional file access. I would like to discuss some solutions:

Web Server accesses a shared file system on the internal network
Pros: Simple, files are stored and accessed from both machines with SMB/CIFS
Cons: Pretty dangerous to allow a SMB/CIFS access (I remember all the bad Windows bugs in the past) in the internal network.
Install some kind of a custom service on the internal server, web server get's a client to send the data. Could be FTP or some custom implementation.
Cons: The installed service may not be safer than the shared folder.
Shared folder in the DMZ, only accessible from the internal server.
Pros: from 1.
Cons: ?

Do you see points I forgot or another completely different solution?

Note: A "control channel" from the web server to the internal server exists, thus, the web server can send a "load new data from this directory" command to the internal server.

Thanks.

You should give consideration to converting the document from its native format.  Convert JPG to PNG, say, and Word to PDF.  It's a catch-all attempt to try and remove any document-specific malware.  The advantage is that it might protect against unknown and future threats.  The disadvantage is that it might mess with formatting or lose content.  The level of effort you go to here is determined by the risks.

Advancing the idea, you could keep a native copy around so that in the case of it being damaged in the conversion process, you can recover the original, and make the risk-based decision to use that.  For the truly paranoid, encrypt the native file with the public key of a key pair, where the private key is only available on a specific hardened standalone non-persistent machine.  Use that machine alone for viewing the native documents.

Still more: the document conversion process needs to be on a "trusted" machine.  Ideally don't do it on the Internet-facing web server, nor on the internal server; so it should be done in the DMZ.

Your data should be pulled from the Internet into the DMZ by the DMZ, and then pulled from the DMZ into the internal network, by the internal network.  It's just a good principle, and otherwise might require more firewall rules than you otherwise need.

I'd look at rsync-over-ssh as a battle-tested one-way sync method with mutual authentication.  Run it regularly, and you don't have to worry about signalling the DMZ to come and collect files (might not be enough if you must process these files quickly, though)

Of course, this may well be too much effort to manage your risk.


Does Skype technology tap a user's machine to route other calls? I was surfing a random blog today (Enterprise video conferencing solutions vs Skype), and I came across a claim. I do know that the Skype protocol is a proprietary one, but the author of this blog claims that:

  Skype makes use of peer to peer technology in which Skype users become supernodes. This allows Skype to tap on your bandwidth to route other calls, often slowing down your computer.

What I would like to know, from a networking standpoint, is how is this implemented or even possible? First of all, why is there a need to route calls between user nodes? If person X is calling Y, then isn't it a straightforward TCP connection from X to Y nodes? Why does a Z node have to come in between?

Moreover, if this is true, why do most users stick with Skype? Aren't there better opensource technologies available in this arena?

Today, Skype do not route communication through other users machines. This is done by Microsoft servers in datacenters.

But back in the days, in the early versions of the Skype protocol, every user with strong-enough bandwidth and not behind a NAT (with routable IP address), can become a supernode and route the traffic of other users that are behind NAT.

That's the reason why this is necessary. If your ISP is doing NAT on the gateway level for example, you can open TCP connection to any host you want, but some other unknown host can't reach you, because the incoming connection is not requested by you. That's how the NAT works, and direct TCP/UDP connection can't be established.

If two Skype users that are behind a NAT wants to talk each other, in normal conditions, they can't, because they only can request-and-receive packets, but can't receive something that is not requested early.

Example:
Host A wants to talk through Skype with Host B.
Host A tries to open TCP/UDP connection to Host B, but the Host B didn't request anything from Host A early, and the NAT of the Host B's gateway just drop the connection. In the reverse direction is the same.

So, in order to communicate, they both connect to some supernode that becomes a bridge between them. This works because each client transmit the data to the supernode, and the supernode route them to the other side (which is also connected to the supernode, as i mentioned before).

Becoming a supernode can be disabled in early Skype versions with change in the Windows Registry.


How can you fake geolocation in Firefox? Google and many other sites know my correct location. How can I fake my location without using a VPN, proxy, Tor or similar?

I went to about:config and looked for geo. What I think I have to modify is geo.wifi.uri? Maybe we can put in false lattitude and longitude values directly? If so, how would it look then? I really have no idea about the format.

Or is there another way using JavaScript in Greasemonkey?

If you want to spoof your location for the HTML5 Geolocation API you can follow these steps:

Go to about:config.
Type in geo.provider.network.url [it was geo.wifi.uri in previous versions]
Change the value to something like this:
data:application/json,{"location": {"lat": 40.7590, "lng": -73.9845}, "accuracy": 27000.0}

(The lat and lng values determine the latitude and longitude of your location.)

Congratulations, you're now on Times Square! (You can test the result here.)

Note that if you want to prevent websites from deriving the location from your IP address you can't do that on the application layer - the only way will be a proxy.


How to introduce delay in scanning tools that do not implement delay without touching source code? Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.

Is there a way to delay packets from tools that do not implement this option without touching the source code? I know that touching the source code is an option...the option I follow frequently. But I would like to know if there is any tool that exists to do that. Probably this tools, if exists, should be a kind of proxy that would store, in a buffer of some kind, all the packets the tool send and resend them introducing the configured delay.

Any ideas?

You can suspend the process and resume it after a while. The OS buffers data that is being sent to a suspended server and the server will receive it after it is resumed.

For Linux:

pkill -stop <process-name>
sleep <seconds>
pkill -cont <process-name>

For Windows there is PsSuspend:

pssuspend <process name>
ping -w 500 -n <seconds> 1.1.1.1 #windows sleep hack
pssuspend -r <process name>


Isolate a Virtualbox VM from local network I have the need to isolate a virtual machine created with Virtualbox from the local network but I need to provide internet access to that machine.
It is the first time that I face this kind of problem, different solutions came up in my mind:

create a VLAN
use a DMZ
use a firewall in the host machine filtering communication in the virtual NIC

I would like to know what do you think about these solutions, which in your opinion is the best and why.

VLANing it is the best bet as it keeps it protected behind your firewall, but isolates it from the network.

The DMZ is next since it puts it in the open, but completely separate from your network (note that this isn't the same as simply using a DMZ ip address on a consumer router that simply allows a particular IP to be connected to, but doesn't isolate it from the internal network.

The third option strikes me as particularly difficult to implement and risky as a missed rule would allow access and the information is still traveling across the internal network.


Could someone steal all stored cookies with an XSS attack? I mean, with "document.cookies" the browser shows cookie(s) that belong(s) to only for that website. (Or doesn't it?)
So, could an XSS attack steal all stored cookies in device/browser?
Thanks.

The document.cookie object retrieves the cookies from the current document. The document refers to the webpage from where the javascript invoking the document object is running. So javascript won't be able to access cookies from other websites, that includes obviously a XSS attack.

  with "document.cookies" the browser shows cookie(s) that belong(s) to only for that website.

This statement is not entirely true. The document.cookie object allows javascript to access cookies from the current document, but only those that doesn't have the HTTPOnly flag. This flag is used to prevent javascript from accessing those cookies and is a policy enforced by the browser. It's recommended to turn on that flag on session cookies to protect them from being stolen through XSS


Trying to do an SQL injection into a login field I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is the correct syntax to execute queries and grab the admin login or login without the password?
In the first picture I tried to just add a quotation

Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'version()-- -'' at line 1

Since this is an assignment, you need to learn more of the underlying function. You have a big helper in that the server is returning detailed error information, in the security world this is a big no-no.
There are numerous SQL sub dialects, but in general what you need to do is:

Break the standard processing

You've already done this with the insert of the ' (quote) which the server is failing to sanitize.

Insert you own SQL command

It looks like you already did this as well.

Close your SQL command out

Often with a ; (semicolon). You may have missed this part, I can't tell.

Terminate any remaining portion of the server command

Often with a --' (double dash quote). It looks like you already have this as well.
The exact syntax may vary. Watch the error message!
A classic PHP based example is:

Normal: SELECT * FROM customers WHERE username = 'timmy'
Injection: SELECT * FROM customers WHERE username = '' OR 1''

In this extremely simple case, you don't need any additional breakouts.
Whether you need the semicolon and/or double dashes will vary with the implementation. Watch the error message!


Most secure data storage? What is most secure data storage currently available and suggested by specialists, to store digital data in digital medium (without making hard copy of data onto paper or other type of medium, than digital).

I mean, secure from EMP bombs, magnets, and other digital world threats, like hackers or physical property thiefs. Some sort of safe, that is immune to EMP or other external fields(?).

For example, to store my documents, photo archive and other private data. I mean, I don't trust cloud computing, and don't trust my data to big organizations, that can easely access data, stored at their servers.

Your question is subject to some subtleties. Fasten your seat belt, I am going to be verbose.

Digital Medium

You want a "digital" medium. What is that exactly ? In a hard disk, a bit is written by changing the orientation of some magnetic dipoles, created by the "movement" (inasmuch as it can be defined as per quantum mechanics) of electrons in some of the atoms of the disk platter. Roughly speaking, each atom has a natural orientation, and the bit is stored by changing this orientation, i.e. "rotating" the atom. So there is some amount of "physical movement" in it. That's also true with flash memory: data is stored by accumulating "charges" in a semiconductor substrate; the charge corresponds to the "physical" movement of electrons (they hop between "bands" -- the kind-of orbital trajectories of electrons around atom kernels).

Now consider a sheet of some material in which you engrave some data; there again, that's just "moving around" some of the atoms of the material, so it is not qualitatively distinct from magnetic storage. You can make a distinction based on the amount of matter which is moved for a single bit, but this involves an arbitrary threshold.

Engraving has a remarkable record of long-term reliability for information storage. Consider this marvelous extract from the Schøyen collection:

This specific data file has been stored for more than 4500 years, in an area which has been scourged by countless wars in between. Empires have waxed and waned, and the soil soaked by the blood of warriors. Yet the information remained and was not lost; and, even better, it was stored at no marginal cost at all. As can be seen on the picture above, the medium would be good for a few more millenia at least. Data integrity is more threatened by, let's say, "encoding problems" (although that specific example could be translated nonetheless).

From the wording of your question, I assume that you would declare such engraving as "not digital" and reject it. Now, have a look at this:

This is a close-up view of the surface of a Compact Disc, of the "pressed" variety (i.e. not a CD-R). The bits are encoding by embossing, the dual operation of engraving; a big press is involved in the process. A CD-R does not use embossing; rather, the optical properties of a dye layer are modified with a laser, so a CD-R is more similar to printing on paper (in particular thermal printers as are common in payment terminals).

A CD is definitely "digital". However, it is not qualitatively distinct from the work of a Sumerian scribe on a stone slab. To declare the latter "not digital", you have to enforce a totally arbitrary threshold, which, as such, can be challenged.

You might want to make a distinction based on how the data can be read back into a computer, on the basis that a CD goes into a reader which outputs zeroes and ones on a wire. However, the slab picture above which you saw went to your computer over wires as zeroes and ones, so, there again, the distinction is subject to an arbitrary threshold. As a more striking example, consider QR codes like this one:

Now, a QR code printed on a sheet of paper, or engraved on a marble slab (to be read with tangential lighting, so as to shadow the pits), is that digital or not ?

Magnetism and EMP

Magnetism is a property of some materials. Magnetism is convenient for computerized data storage, because of the achievable high density, low latency, and possibility of multiple rewrites. However, this last property is also the bane of long-term storage: stored data can be affected by external magnetic sources, and is subject to gradual leakage. Even reading implies "grabbing" a bit of energy from the medium, thus weakening the data storage. Magneto-optical drives fare a bit better:

The medium magnetism can be altered only at high temperatures; at room temperature, it is "fixed".
Reading can be done optically (because the medium optical qualities are modified by the magnetic orientation which was forced upon it when it was last heated), thus leaving the magnetic field "alone".

Although manufacturers of magneto-optical drives claim reliable storage for long durations (decades, up to a century or two), this heavily depends on environmental conditions, and has never been tested "in full size" since the technology itself is not that old.

In particular, magnetic storage, whether magneto-optical or not, can be disrupted by applying a huge amount of magnetism in one go, something known as an Electromagnetic Pulse. This is the electromagnetic equivalent of a full stadium of beer-powered sport fans bellowing simultaneously (this has been used by some movie directors to obtain sound effects which are hard to simulate in a lab, resulting for instance in this scene -- a cricket stadium was involved). The method of choice for generating big EMP is through nuclear weapons: nuclear fission and fusion emit huge amounts of high energy gamma rays, which, by colliding with electrons, create the EMP. EMP can also be generated with non-nuclear devices, albeit with a much lower energy.

Hollywood, in its everlasting educational mission, has depicted a non-nuclear EMP in which the generating device looks like a jukebox. There has been some allowance for artistic license, though: a non-nuclear EMP works by rapid compression of a conductor in a magnetic field, where "rapid" means "high explosives". While the EMP effect has some military applications in specific situations (especially disabling onboard electronics in missiles, without needing to actually hit the missile with another missile), the common wisdom is that the explosives are more a general threat than the EMP itself. Would-be terrorists would not care about electromagnetism; they would just blow up things with the explosives alone.

A Faraday cage is effective against EMP proper; however, it does not block gamma rays and neutrons from a nuclear explosion, so gamma rays may enter the cage and generate a local pulse by interacting with the magnetic storage medium itself. The best protection for magnetic storage devices against a nuclear event is a deep underground bunker (it is also efficient for protecting human operators). That's what they do for NORAD: the headquarters are buried under a mountain.

Security: Threats and Goals

There are two sides to data security:

Protection against destruction: we want to be able to read the data back later on, possibly after many decades. An attacker may want to prevent us from doing that.
Protection against data theft: we do not want an attacker to be able to access the data.

These two goals are partially opposite to each other. The best protection against destruction is duplication; if you have a dozen copies of the data scattered over five continents, then the attacker will have a hard time obliterating them all (even Harry Potter could not do it in less than seven books). However, the more physical copies there are, the harder it is to protect them all against illicit copying. To some extent, theft is just another copy, so theft protects against destruction...

The situation is substantially different, depending on when and how you want to be able to access the stored data (data storage makes sense only if you plan to access the data at some point, even conditionally). If you just want long-term storage as a backup in case of a large-scale disaster, then you can use a non-networked storage facility, thereby removing all threats related to "hacking". Thus, protection against theft becomes a matter of physical security: store the data in a bunker, enlist guardians with (as @Lucas suggests) fierce dogs.

Guardians and dogs are a worry, though, because:

There are costs: you must feed them, entertain them, see to their general well-being and health, but in the same time subject them to enough stress and well-dosed misery so that they remain sharp and mean killing machines. And you must do that for the dogs, too.
Bribery is a problem. Each biological entity you allow around the premises is yet another target for subversion. Elaborate cross-spying schemes, with rewards on ratting out, can mitigate the issue, but involve even higher costs, and are considered to be "toxic to the workplace".

The storage medium can trigger the same kind of issue. If you use magnetic storage such as hard disks, then you must regularly (say, on a yearly basis) power the drives, and replace the units which fail to go live (invariably, some will fail to power up). This entails some redundancy (error correcting codes and variants, such as what is used in some RAID arrays) and, you get it, operators. Those pesky humans tend to have external lives, through which they can be controlled by adverse parties (give a man one million dollar, or kidnap his mother, and see if he keeps on refusing something as simple as pinching a hard disk).

If the facility does not need regular intervention, then you can, to some extent, use discretion as a substitute. For instance, consider the external lookout of the tomb of Tutankhamun (actually, a view from the Valley of the Kings, in Egypt, at a place where archeologists of the last two centuries have not yet defaced the landscape with their excavations):

and compare that to the tomb of Khufu, of, let's say, questionable inconspicuousness:

Now guess which one was not robbed in more than three thousand years ?

That's "Security through Obscurity" and it is known to be unreliable (e.g. see the plot of For a Few Dollars More), but "unreliable" does not mean that it never works...

Encryption

It is time to flourish our secret weapon: encryption. Encryption does not create secrecy; however, it concentrates secrecy. You have a key; it is a sequence of bits which have been generated with as much randomness as is practical (e.g. with coin flips, or sufficiently unbiased dice). Using the key, you can transform the data, even huge amounts of data, into a big heap of meaningless junk of roughly the same size of the original data; but, knowing the key, you can reverse the operation and recover your precious data.

A cryptographic key for symmetric encryption ("symmetric" means that the same key is used for encrypting and for decrypting) needs not be long; it just has to be long enough to thwart exhaustive search (i.e. it would be way too expensive, or even downright impossible with energetic resources available on Earth, to try out any substantial part of the set of possible key values). 128 bits are enough, but, in order to accommodate inflexible administrative regulations and quiet the qualms of managers who read too many science-fiction books, you might want to pump the key size up to 256 bits
(don't believe Dan Brown: exhaustive search is not a ultimately workable attack strategy, even if the attack machine is expensive; the scientific basis for this novel is no better than the quality of writing or the plausibility of the characters). As for the encryption algorithm, there is no guarantee that any specific algorithm will keep up its security promises for the next century, but there are good looking candidates which have sustained cryptanalytic advances for more than a decade, and that's not for lack of trying. I am of course speaking about the AES, which seems to be quite secure, and, furthermore, is Approved by governmental bodies throughout the World. AES might not ultimately protect your data, but it is the best that can be offered right now, and its security is plausible enough that you can get insurance against possible attacks at reasonable costs.

The secrecy concentration works like this: if the data you store is encrypted, then you no longer have to worry about theft of the data itself. You can store your gigabytes on any number of hard disks, copied and stored over dozens of remote places so that local disasters and "Acts of God" do not destroy it. Hundreds of underpaid henchmen may oversee the regular maintenance operations, with no bribery issue. You still need to take steps to guarantee the secrecy of the key, but the key is very small, so that's much easier.

The Solution

For long-term storage, I thus recommend the following scheme:

Encrypt the data, with AES and a 128-bit key (or 256-bit key if you need to woo investors).
Store the encrypted data on hard disks or pressed CD (the former have more capacity, the latter require much less maintenance), and put these in guarded bunkers in geographical locations which are far away from each other (preferably, in distinct countries over several continents).
Make a few copies of the key by engraving it on stone slabs (marble is classical; avoid limestone, which might lack durability in humid conditions; the Distinguished Customer will want to engrave on diamonds). Put the slabs in the safes of a few banks (do not conceal them in jewelry worn by your mistress -- that's the way of James Bond villains and it does not work well, for long-term secrecy).

For extra security, split the key into parts with Shamir's Secret Sharing, so that plundering one bank does not endanger the secrecy of the key.

The trick, of course, is to make attacks more expensive than what the data is worth. If destroying or stealing your data involves a wide-scale nuclear war or a worldwide meteorite strike, then chances are that your data will be quite irrelevant in such conditions, and nobody will bother resorting to such drastic measures just to get at it.


How to inspect TCP Header -> Optional Data with Snort? I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header)
TCP Header
Any clues?
Is Snort even able to do that?

Snort don't support to check tcp header length.

But if snort connecting to database, it can store optional data of ip and tcp.


Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party? I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.

What headers should I set/ignore, and what is the correct value to use in the following scenarios:

SignIn
General usage (HTTPS only site, or regular HTTP)
SignOut

Here are a list of headers that I've noticed and the differences among them.  I'm sure that each company had smart people implement or omit certain headers for a reason; I just can't tell which provider has the best implementation.
My bet is that each provider has something the others can learn from.
Expires:

LiveID sets the Expires header to exactly one minute prior to the current time
Google and MyOpenID has the Expires header equal to the current time
Yahoo Expires at Thu, 05 Jan 1995 22:00:00 GMT
Verisign PIP Expires at Thu, 01 Jan 1970 00:00:00 GMT
Facebook Expires Sat, 01 Jan 2000 00:00:00 GMT
ADFSv2 -1
Not present in Azure ACS

Cache Control:

Yahoo & Azure ACS: private
Facebook: private, no-cache, no-store, must-revalidate
MyOpenID: max-age=86400
PIP: no-cache,no-store,max-age=0
ADFSv2: no-cache

Pragma

Yahoo, LiveID, Facebook: no-cache
Google, MyOpenID, Azure ACS value does not exist.

X-Content-Type-Options:  IE8 Details, IE9 Details

Azure ACS, Google,  : nosniff

X-XSS-Protection  Details More details

Facebook, LiveID, ADFSv2 : 0
Google: 1; mode=block
Not present in Azure ACS and other providers

X-Frame-Options  More Details

Yahoo: X-Frame-Options: DENY
Google: SAMEORIGIN

Access-Control-Allow-Origin  (How to use with multiple domains)

Google (conditions apply)

Strict-Transport-Security  See also how to disable for debugging

Google (conditions apply)
PayPal / Lastpass (500 seconds = bit over 8 minutes)
market.android.com (2592000 seconds = 30 days)

X-Pad  // A fix for very very old versions of Netscape

Verisign PIP

Lastly it's interesting that Facebook has two headers regarding the HTTP Connection
X-Cnection: close  and  Connection: Keep-Alive.  I'm not sure if they are relevant but I'm including them here for completeness.

Use HTTPS, cachin/expires won't matter.
X-XSS-Protection as Google does.
Strict-Transport-Security (and the subdomain directive)
nosniff, blame IE.
X-Pad... if someone using using Netscape... there are bigger problems.


What is an OpenPGP Key ID collision? Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/).

What does the term collision refer to?

They're referring to short key IDs, which are considered vulnerable to collision attacks for quite some time now. The problem is already referenced in RFC 4880, OpenPGP,
3.3. Key IDs:

  A Key ID is an eight-octet scalar that identifies a key. Implementations SHOULD NOT assume that Key IDs are unique.

OpenPGP Fingerprints and Key IDs

Each OpenPGP key has a fingerprint attached, calculated mainly from its public key packet which also contains the creation time. The calculation is defined in RFC 4880, OpenPGP, 12.2. Key IDs and Fingerprints.

There are short and long key IDs, which resemble the lower 32 respective 64 bits of the fingerprint. For example, looking at the IDs of my OpenPGP key:

fingerprint: 0D69 E11F 12BD BA07 7B37  26AB 4E1F 799A A4FF 2279
long id:                                    4E1F 799A A4FF 2279
short id:                                             A4FF 2279

Fingerprints and key IDs are used, as sharing and comparing a whole key with usually 1024 to 8096 bits (adding some more for headers like the creation date) is very impractical.

Collision Probability

While shorter IDs are easier to share and compare, they also increase the chance of collisions. This is growing exponentially with the lenght, in numbers. This is the number of possible key IDs for each length:

2^32  =                                        4294967296
2^64  =                              18446744073709551616
2^160 = 1461501637330902918203684832716283019655932542976

The collision probability is the inverse of the numbers, being the chance of generating two different keys having the same ID.

Finding collisions for all publicly available OpenPGP key data requires finding collisions for barely 4 million keys. The project actually limited itself to the strong set (which contains the largest set of keys, that are all linked together, possibly with transient edges), and this currently contains about 55.000 keys.

Key collisions are still possible for long key IDs and fingerprints, but unlikely to very unlikely. The number of possible fingerprints is even larger than the number of possible UUIDs and these are usually expected to be unique. The same number of IPv6-adresses is available, techtarget.com has some examples to get an impression of numbers that large.

Enumerating Keys

Generating keys with reasonable security takes some time, making it impractical to enumerate enough keys to find those four million collisions. But that's why I already mentioned the key generation time above: with a single key, you can create lots of different OpenPGP keys from a single (lets say, RSA) key without the expensive key generation, you simply iterate over the time. This was already proposed by Micah Lee in his Talk on "Trolling the Web of Trust".

Regarding the UNIX timestamp to be stored as a 32 bit number, and assuming SHA-1 as a good hash function has nearly equal distribution of result values, iterating of a single RSA key with different timestamps should suffice to generate all possible short key IDs (in reality, you will have to repeat this for a number of keys). If you want to only generate reasonable keys created within some reasonable time span (say, the last few years, definitely not before PGP was released and not in the future) you will have to use some more keys, but generating some more keys is still doable in a rather short time.

What to do now?

Don't trust short key IDs, never use them for verification. You never should've done.
Use long key IDs instead (or even better, the whole fingerprint), if you want to share your key. To be very sure at verifying a key, better even compare the full fingerprint.
If you're developing software that deals with OpenPGP keys, even refer to the whole fingerprint (a computer doesn't really care about whether to compare 32, 64 or 160 bits, but remember the collision probabilities!).
Check your own software on whether it follows these recommendations.


How to secure a web service that allows custom user defined paths? I'm working on a website that will rebuild data as an RSS feed based on a custom path.

For example: You have a video on youtube that you want an rss feed of comments, you can add -rss to the url (making it youtube-rss.com/asdasdasd) and the web app will parse the path and kick out the RSS feed.

How do you lock the path handler down and avoid malicious input? String sanitation? Validation? Anything else?

There are certain URLs that are given special meaning to certain web services and client software that you need to make sure can't be used to lead to arbitrary content. (Flash's "/crossdomain.xml", LetsEncrypt's "/.well-known/<...>", Google domain verification's "google<...>.html", etc.) Imagine if someone makes a YouTube video named "crossdomain.xml" with valid xml content within the video's description set up to trick the Flash plugin of visitors into thinking the attacker's site can freely make ajax connections to your domain, and then accessing "youtube-rss.com/crossdomain.xml" triggered a YouTube search for "crossdomain.xml" and displayed the first result's description. That exact attack may not work out depending on details about Flash and your website, but there are tons of possibilities like this that may work if you allow any URL to include user-controlled content.

An easy and effective way to defend against this without needing to enumerate all the possible special URLs would be to have a strict whitelist of patterns you support in the URL. If the YouTube URLs you are interested in mimicking always follow a format like "/video?id=[a-z0-9_]+" and "/[a-z0-9_]+", then only process those kinds of URLs, and make sure you correctly limit the allowed symbols in the identifiers. Do not specifically blacklist these URLs (because there are surely many other similar ones too), but double check that these do not pass your whitelist: "youtube-rss.com/crossdomain.xml", "youtube-rss.com/.well-known/abc", and "youtube-rss.com/google123.html".


Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware? Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, fileless malware and other related hacks?

This will add another line of defense which will provide a better (but not perfect) protection against some attacks but not against others. It will probably be mostly effective against an attacker trying to break out of the browser into the system, although sandbox techniques used in modern browsers like Chrome already provide a good (but not perfect) protection in these cases.

But it will not help against Javascript-based or Flash-based attacks in general, i.e. it will not help against Cross-Site-Scripting or CSRF or cross-site flash attacks. These are not attacks which try to break out of the browser but instead work inside the browser and thus also inside the isolated browser.  A properly isolated browser might though prevent these attacks to affect your internal network. Browser isolation will also not help against social attacks like phishing for credentials.


Is it impossible to have a PDF file execute a command without abusing any exploits? We are running a purple team which includes attempting to run a malicious PDF on the target system. The targeted user is well aware of the exercise so there is no concerns about an AV picking the payload up, or about prompts (the user can simply agree to them).
However, they have the latest version of Adobe Reader installed. It was my impression that there were ways to execute commands or files using PDF files, similar to how a macro can execute commands within Word or Excel.
However all of the information I have found online targets specific vulnerabilities within readers, rather than abusing legitimate built in functionality. Is it impossible to run arbitrary code using a PDF file without abusing any specific vulnerability?

Adobe Reader allows javascript in PDF to be interpreted (initially to allow features like form validation).
You can manually edit your PDF in notepad++ to add scripts in javascript.
One time I made a phishing campaign exercise based on this usecase. The script asked for a login password in a form to "open the protected document" and then they are sent over internet to my C&C (the action to send data to internet raise a warning to the user).
This resource should help you : https://www.decalage.info/file_formats_security/pdf


OneDrive marked unsafe by Google Chrome due to unsafe scripts The OneDrive user's drive page asks to load the following script (which is typically blocked by Chrome to be unsafe)

<html>

<head>
    <title>Bing</title>
</head>

<body>Loading...
    <script type="text/javascript">
        //<![CDATA[
        var _w = window;
        var o = _w.opener;
        var mainWindow;
        (mainWindow = o) || (mainWindow = _w.parent);
        if (mainWindow) {
            mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:auth");
        };
        if (o) _w.close();;
        //]]>
    </script>
</body>

</html>

And the following was logged in the Developer Console

AI session renewal date is 0, session will be reset.
Mixed Content: The page at 'https://onedrive.live.com/?cid=<REDACTED>' was loaded over HTTPS, but requested an insecure form action 'http://www.bing.com/Passport.aspx?popup=1'. This request has been blocked; the content must be served over HTTPS.
Mixed Content: The page at 'https://onedrive.live.com/?id=root&cid=<REDACTED>' was loaded over HTTPS, but requested an insecure form action 'http://www.bing.com/Passport.aspx?popup=1'. This content should also be served over HTTPS.
Uncaught SecurityError: Blocked a frame with origin "http://www.bing.com" from accessing a frame with origin "https://onedrive.live.com".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "https". Protocols must match.

Can anyone shed some light on what it's exactly doing? Is OneDrive not secure anymore, or is this a false positive by Chrome?

I'm not a big-time expert on this. But I can give you a small explanation with my 3year as a server admin and technologist to a web development company.

The script may be a unified login check like Google does for all of its products.

The reasons for chrome to report it as unsafe are
 - It is being loaded over HTTP not HTTPS.
 - The requested script or page is from another domain (Bing.com) not the same or subdomain of the domain live.com.

So don't worry thinking that Google Chrome has detected one drive as harmful. It is just about the content being loaded from a different site and a non HTTPS URL.


Are my emails being hacked? I receive a lot of emails from the Mailer Deamon. It says that it could not deliver a message I tried to send. But I did not try to send anything.

I have an email address that is forwarded to another email of mine.

my_gmx_address_that_gets_forwarded@gmx.de => my@email_adress.com

The message I get is:

  This message was created automatically by mail delivery software.

  A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es)
  failed:

  my@email_adress.com

  Reason:
  multiple delivery attempts failed

  --- The header of the original message is following. ---

  Received: from avahost.ru ([212.146.244.254]) by mx-ha.gmx.net (mxgmx010
   [212.227.15.9]) with ESMTP (Nemesis) id 0MUkzE-1hagMe3Fgi-00YDne for  my_gmx_address_that gets forwarded@gmx.de;
  Sat, 09 Mar 2019 16:21:12 +0100
  Received: by avahost.ru id hgfcvm16lt04 for my_gmx_address_that_gets_forwarded@gmx.de;
  Sat, 9 Mar 2019 10:21:31 -0500 (envelope-from Kundenservice@avahost.ru)
  X-Gm-Message-State: APjAAAUkA/Z1I9rvxQjR2IwB+xhH+t4WVmeDzO3RXwx8CJmixgVAbYkF KqnpLS/6uWAQZ4mLCg+EMNfXFVda
  X-Google-Smtp-Source: APXvYqxVUsl5ekebDKnZxNP6iX4SYD9/aUscnS4oYGSYIlnDjaOC6TMp4Z/yfsA6MXFYNUNK6VRtYcMDtLpXtkBHDolo
  MIME-Version: 1.0
  X-Received: by 2002:a0c:945c:: with SMTP id i28mr613047qvi.57.1551766778742; Mon, 04 Mar 2019 22:19:38 -0800 (PST)
  X-Notifications: jk8qs8bxywg3fwhrxpb
  Message-ID: X5thOme9BF4B-rcjxkajxvld.0@notifications.google.com
  Subject: Gewichtsverlust von 10-12 Kg binnen eines Monats
  From: Kundenservice noreply-maps-timeline@google.com.replayingdom.com
  To: chaouisalman@gmail.com
  Content-type:multipart/mixed; boundary="----
   =_Part_121592_659013478.1551797199159"
  Envelope-To: my_gmx_address_that_gets_forwarded@gmx.de
  X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3; X-UI-Loop:V01:6afBCUOQJQ0=:u9DWyWBBaWAqM42eHRSUdgN4rZA148QSv0SckM/3wjM=

The message content is always different but one thing is always the same:

  To: chaouisalman@gmail.com

What is going on here?

Probably one of your clients got its password stolen and tried to spam or send info toward that address. Password reset for that client usually solves this.

Technically, there are scripts that can interact with weak e-mail clients (like outlook) credential storage. They get the password and then can send a lot of messages to whoever they want (usually predefined lists) until external filters trigger and your whole server starts getting rejected e-mails due to low reputation or blacklisting. If the user clicked a one-time script, resetting the password of the account prevents further spam, but if the infiltration was more elaborate you will also have to do serious anti-virus and anti-malware checks on the affected system.


Unfamiliar user agents 'CON 1.0 urlexists' and 'VANILLA 1.0 vanillastub' - are they malicious? I'm analyzing a pcap via Wireshark, and there are multiple get requests to the IP. These requests use different user agents, which I can't find anything about when I search. The user agents:

CON 1.0 urlexists
VANILLA 1.0 vanillastub

Each get request they use a different range of bytes. Does it mean they are malicious?

In many browsers using add-ons users can set agent to any value they want. Also applications can set this header to any value they want. That's why based on agent header it is impossible to say if this is a malicious request or not.


How do the root servers get updated with my name server? Is WhoIS information always in sync with the root? I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information.

Can someone elaborate on what happens when an update is made, and how it is consistently applied to the Whois result?

How secure is this process?
Can any registrar update my name server's root?
What security provisions are in place?

Your registrar has the right to manage a subzone of the DNS namespace. For ccTLDs (country-code top level domain, for example .us) this is mostly one, for gTLDS (global TLDs like .com) there are multiple.

If you tell your registrar your own DNS, the registrar will define a new subzone for the domain, and delegate the DNS resolution. Everytime the information in the DNS is updated, it polls the DNS above it that the information has changed. This will mostly be the registrars DNS. The registrar in turn will forward this information to the different root DNSs.

Now to your questions:

How secure is this process?

This process isn't very secure, since the system wasn't designed with security in mind. It basically trusts that whatever information it is given is correct. So if a rogue registrar wants to take over a domain, it just has to make sure the root servers have the bogus information and not the correct one. This information can easily be spoofed. Normally a registrar should check for this, and only update records for their own subzone.

Even worse are the responses, since, when the root server receives information, every DNS accepts every answer they get. Which means it isn't that hard to redirect, for example, Google to a bogus IP. This is why DNSSEC was invented, so responses can be cryptographically signed.

Can any registrar update my name server's root?

Do you mean that any registrar can pretend to be your DNSs master server? Every DNS should be able to poll data from your DNS, but that shouldn't be a problem (minus the spoofing mentioned above).

What security provisions are in place?

Trust, if you can call that a security provision. :) If you don't believe in trust, the rollout of DNSSEC is currently underway. It doesn't solve all problems DNS has, but at least a few. It mainly allows DNS responses to be signed, so it isn't that easy anymore to spoof the corresponding IP. It is, as far as I'm aware, still possible to poison the cache of the individual DNSs.


Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack? I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by setting up a rule that will automatically block their IP by adding it to IPTables after a configured number of attempts in a configured amount of time. My question is, if all you are doing is rejecting their requests, then they still have access to try to send information on that port. Can they not still overload your server with requests?

I've done some research on this, and the only potential reason I could find is that with a DOS attack, they are restricted by their upload bandwidth which is almost guaranteed to be smaller than your download bandwidth, so even if they are trying to hit you as hard as they can with requests, if you block their IP and aren't doing any processing on the information then they are really throwing pebbles at a brick wall there. Is this correct? What other reasons would this you be protected from DOS with this method?

My question is, if all you are doing is rejecting their requests,
  then they still have access to try to send information on that port.
  Can they not still overload your server with requests?

Yes, a subset of attackers can.  If their bandwidth is greater than yours, or if they find a way to use your bandwidth faster than theirs to offset the difference, you are starved of bandwidth and legitimate traffic cannot get through.

This is actually true at any time attacker_effective_bandwidth + legitimate_bandwidth > server_bandwidth, so it isn't solely dependent on the attacker's resources, but also on the degree to which you over-provision.

Note also that fail2ban is focused on access attempts and exploits that you log or monitor.  Some denial of service attacks rely on communications that may not be logged (ICMP echo requests, for example), and might not trigger fail2ban.

  if you block their IP and aren't doing any processing on the
  information then they are really throwing pebbles at a brick wall
  there. Is this correct?

It is only correct if the resource you are preserving is CPU, and if fail2ban will observe /trigger based on all traffic that causes CPU usage.  Dropping packets does take a measurable amount of CPU, but it is much smaller than trying to do anything else with them.

  What other reasons would this you be protected from DOS with this
  method?

I don't understand this question, but I think that fail2ban is one tool you might use, and a reasonable one.  However, you should consider adding other tools if the cost of your site going down is greater than the cost of acquiring and maintaining the tools required to prevent it.


International bank transfer, what is safe to share? Okay, so I am selling a smartphone, to the guy who lives in UK, or that is what he says. So for the money transfer he asks me these things.

Name

Bank Name

Account Number

Iban

Swift Code.

Is it okay to give them to him, BTW I live in the Latvia, and he already knows my email, whats connected to my bank account and he may know my mobile phone number, whats also connected.

All these fields are needed to transfer Euros internationally.

Both the UK and Latvia are part of SEPA; WP says:

  SEPA clearance is based on the IBAN bank-account identification and the SWIFT-BIC bank identifier.

The bank name and account number can be derived from the IBAN; they are not strictly needed, but it does not hurt to give them.


Leaking `.gnupg` directory when private keys are stored on a smart card What security risks can be caused by leaking .gnupg directory (for example, accidentally committing it to GitHub) when private keys are stored on a smart card?

There's a good reason this folder normally has permissions set to 700 and it certainly should not be published.

gpg.conf contains your GnuPG configuration. If there's some weak settings, it might be usable information for targeted attacks. Most has some default configuration from the distribution, which makes this the least interesting file.
pubring.gpg contains all your contacts (and your own public keys). It's like leaking your address book, but worse: it possibly has information specifically on all the contacts you would rather communicate in private with.
trustdb.gpg contains your entire trust database. That may reveal weak points if you trust some keys too much, and helps further in mapping your (most private) social network.


AD-DS: Why Hide the last logged on user? During a test for my certificate of apprenticeship, I got a demand to make my domain controller hide the users who where previously logged on to the Windows clients.

Exactly what are the purpose of this? Does it offer any advantages over security, or is it just completely pointless?

It's not hard to find out who was on the client by simply looking in the C:\Users folder. And if you don't have access to the client at all: You could just rip the hard-drive out and load it up on a different machine and still see the folders.

If you have no credentials or physical access, getting valid user IDs (for example at the logon screen through an RDP session) is a step forward in gaining access to the machine. Some of the users might have weak passwords which are easy to guess or brute-force. Missing the info about which users are valid makes these attempts much harder. You could also gather valuable insights about which individuals work at certain computers, and thereby determine which people might be interesting targets for social hacking attempts.

As you said, if you already have access to the box through proper credentials or physically, it doesn't help at all. But in a scenario where you don't, it certainly makes sense.


How to manage all the unlock codes for thousands of mobile devices (iPads)? I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code?

Maintenance users should be able to access the unlock code specific for a device whenever they need and all the codes should be managed in a centralized application.

I would like also to be able to send easily the unlock code to a user, for example, by SMS.

The alternative is to have for all the devices the same unlock code...

EDIT: Please, have in mind that my main problem is not to know the passcode. In my case is acceptable to reset it when needed but I have a problem setting different passcodes for thousands of devices the first time.

You are looking for a MDM (Mobile Device Management) solution:

  Mobile device management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablet computers, laptops and desktop computers. MDM is usually implemented with the use of a third party product that has management features for particular vendors of mobile devices. (Wikipedia)

Examples of such third-party tools can be found here.

These tools typically allow you to change/reset a user's passcode from the management console (example). However, most of these tools do not store the passcode in a central location. As administrator, you are able to change the passcode or to unlock the device, not to view the actual passcode.

In reply to the edit

These MDM policies will typically also allow to enforce passcode policies (see for example the answer here).


Windows 7 and missing patches and how to handle With the ransomware scare, someone asked me to look at their computer to make sure they have the required patch.  They had no patches after June 2016, with only the recent May 2017 patches installed.  I installed the security only for March, but wondering the best way to proceed to have their Windows 7 Home Premium fully patched.  Since they have May 2017, if I manually install patches missing from June 2016, will it overwrite possible patches installed with the May 2017?

I am not sure why Windows is not recognizing that they are missing the patches.  I could just install the security only from October 2016 to April 2017, and see what critical patches were released from July to September, but my concern is how will this effect May 2017 patches.

Also, just an fyi.  Windows is working in that it checks for updates and had the May 2017 to install and updated successfully with the May 2017.

Windows security patches are now cumulative which means that each new patch should contain the previous month's security fixes.

If you have any of the following patches installed you should be safe.

May, 2017 Security Monthly Quality Rollup for Windows 7 (KB4019264)
April, 2017 Preview of Monthly Quality Rollup for Windows 7 (KB4015552)
April, 2017 Security Monthly Quality Rollup for Windows 7 (KB4015549)
March, 2017 Security Monthly Quality Rollup for Windows 7 (KB4012215)
March, 2017 Security Only Quality Update for Windows 7 (KB4012212)


Nginx - SSL Website shows up on desktop but not mobile So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server.

My default virtual host file on /etc/nginx/sites-available/:

server {
       listen         80;
       server_name    www.navarra-rpg.com;
       return         301 https://www.----------.com$request_uri;
}

server {

    listen 443 ssl;

    root /var/www/--------.com/html;
    index index.html index.htm;

    ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
    ssl_certificate_key /etc/nginx/ssl/---------.key;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_prefer_server_ciphers on;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

    server_name www.navarra-rpg.com;

    location / {
        try_files $uri $uri/ =404;
    }
}

Here are the four files I recieved:

AddTrustExternalCARoot.crt
COMODORSAAddTrustCA.crt
COMODORSADomainValidationSecureServerCA.crt
navarra-rpg_com.crt

Of course, I then used the command to bundle them all up nicely to get the bundled certificate plus the key when I used the openssl req command.

Now, when I go to DigiCert's site to test and I type in my address... it says that I installed it correctly.

I checked out my cert installation to make sure I got the chain right:

Comodo RSA Certification Authority

Comodo RSA Domain Validation Secure Server CA

----------.com

I used the following command from this guide to get the ssl bundle cert.:

cat ---------_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > ssl-bundle.crt

Why isn't my website showing up securely on my Android mobile but is on my desktop?

I get NET::ERR_CERT_AUTHORITY_INVALID error on my phone along with upon pressing the NET:ERR_CERT_AUTHORITY_INVALID error

You can find some more information by "tapping" NET::ERR_CERT_AUTHORITY_INVALID on the first page see this example here: https://www.youtube.com/watch?v=o8iJE7p-W4M

In short NET::ERR_CERT_AUTHORITY_INVALID indicates the certificate authority is not trusted by your Android device.

Try opening a support case with the CA (Comodo), a quick google seems this is not an uncommon issue for comodo certs.

Check https://stackoverflow.com/questions/11340298/certificate-trusted-on-pc-but-not-in-android

Also for secure SSL nginx configuration refer to: https://wiki.mozilla.org/Security/Server_Side_TLS


Is it possible to use ECC private key for encryption? I want to use an ECC private key for encryption because of mutual authentication.
But I cannot find a method (or function) in wolfcrypt (wolfSSL) or the micro-ecc library.

Is is okay to use an (ECC) private key for encryption?
And if so, how can I do this?

No. In Public key Infrastructure(RSA, ECC) the private key is used to decrypt and the public to encrypt.

Furthermore, you can use private key to sign  with digital signature. And the Public key to verify the integrity of the signature.


table elements are not encrypted I read a security book a while ago that said HTML table elements are sent plain text, even if the server connection is https. Is this accurate?

I'm thinking about making an on-line purchase from a site where the order form is in a table.

The book I think was called Hack-IT.

HTML table elements are sent plain text, even if the server connection
  is https.

Completely wrong. Please throw this book away.

For the HTTP server, the whole HTML file is just a file, nothing less or more. The content is irrelevant. Either the whole file is sent encrypted, or the whole file is sent as plaintext.


Whistleblowing, business ethics and credit card data I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view.

I work for a small-business.  I'm part-time, doing "grunt" work type stuff while I pay for college.  I worked in this particular field before on a much larger scale so this is pretty easy stuff for me.  While I'm certainly not lazy, and I do my job, I'm also not "super loyal company man" that I have been for other full-time jobs.  I guess I feel more detached from this job then I have other jobs in the past.

Anyway, we have employees who must take orders from customers and we use a paper-based system.  We also happen to take these orders over the phone and occasionally the customer pays with a credit card.  The credit card number and expiration date are written on the back of the paper "ticket".

I also know for a fact that these tickets are passed between 3-6 people, leave the premises and, at least on one occasion, get thrown in the garbage.  Not shredded and thrown in the garbage, just thrown in the garbage.

Knowing the very rudimentary basics of PCI compliance I see this as a huge legal and financial bomb waiting to explode.

Not only this but personally I just don't feel this is right.  Customer's are entrusting us with this information and anybody willing to go take a dumpster diving trip at the local dump can potentially find a thief's treasure trove of credit card data.  This is highly unsettling.

Obviously, I'm going to be talking to my employer about this.  But, this is where the ethical problems come into play.

I don't feel that I'll be able to persuade the owner why they should change this practice or that the cost is worth it.  The owner is rather lackadaisical when it comes to things, in my opinion, and would simply brush off the possibility of something happening with this information as highly unlikely.

How far should I take this without being unreasonable while still being ethical?

Is simply informing the owner of the complete and utter lack of regard for customer data safety enough?  Even though deep down in my gut I don't think it is?  Even though deep down I want to scream at some compliance regulatory body to come fix this debacle?

I'm torn between not wanting to harm the owner's business while at the same time ensuring that the current policy towards credit card data is discontinued.

In short:

Is it more unethical to be the whistleblower, possibly doing great harm to this business, or stand-by and do nothing?

If your compliance or regulatory body is perceived as PCI, you are incorrect. They make the rules and guidelines, but in this situation it is your companies' acquiring bank (the bank that issued your merchant number and processes your payments).

What is the volume of cardholder data that is being taken off premises or thrown away without shredding? From your description it seems rather low. What level (how many transactions per year) is your company? They will be subject to at least an SAQ (self assessment questionnaire) where the owner is signing his name to abide by the rules of PCI (this is of course if your acquring bank is actually doing anything about PCI and requiring this of your company).

The best thing in my opinion is to make the problem easy to fix. After all, it sounds like purely a procedural / operational problem. If you offer a solution instead of a problem, my guess is that you could get a lot further not only in solving the problem (assuming you are looking to solve it) and perhaps some kudos from your boss (if you care about that).

A cross-cut shredder is about $50. I'm sure you could find a locking cabinet to store cardholder data on hardcopy until it is shredded on craigslist or second-hand for $10-20. It would take about 20 minutes to draft policy for employees not to take cardholder data off premises and to only discard cardholder data in said locking cabinet. The 6+ people seeing the data is not in violation of PCI if they have a need / are authorized to see it.

If you really want to solve the problem, provide a cost-effective solution to your boss along with your concerns.


PKCS12 - private key protection I know that PKCS12 private key is protected by a password, but what is actually done with the password ? Does it use PBKDF to derive the key from password ? That would be a problem as if you change the password, the private key would no longer be the same.

Is it like truecrypt volume, the password derives a key which is itself used to decrypt the private key ?

The answers to your questions are all in the PKCS #12 specification. I am going to take as reference the recent RFC 7292, which corresponds to "PKCS #12: Personal Information Exchange Syntax v1.1".

It is important to note that the private key is not derived from the password. What is derived from the password is the symmetric key that protects the PKCS12 object, which is completely unrelated to the private key. In fact, the PKCS #12 standard can also be used for protecting certificates, CRLs, or other miscellaneous information. Moreover, password-based protection is not the only method. It can use public-key encryption or even no encryption at all, so information remains unprotected.

In the password-based protection mode, the symmetric key used is derived using PBKDF2. In particular:

  [...] Specifically, PBES2 should be used as encryption scheme, with PBKDF2
  as the key derivation function.


Why not RSA-encrypt the entire document? I have recently learned of a way for person B to verify that a document sent from person A is indeed from person A.

Person A gives Person B his public RSA key. This must be done reliably.
Person A uses SHA1 to hash the document in a 160-bit hash.
Person A uses his private RSA key to sign the 160-bit SHA1 hash of the document.
Person A sends both the RSA-signed SHA1 hash and the document to person B.
Person B verifies the hash with Person A's public RSA key.
Person B generates a SHA1 to compare the document Person A sent him.
If the two SHA1 hashes match, then the document is indeed from Person A.

This process seems reliable, but also cumbersome to me. Why can't Person A just encrypt the document directly with his RSA private key and send that to Person B. Why encrypt a hash of the document instead and send it alongside with the document?

There is more than one reason:

1) Actually the RSA algorithm is slower.  For instance:

  By comparison, DES (see Section 3.2) and other block ciphers are much faster than the RSA algorithm. DES is generally at least 100 times as fast in software and between 1,000 and 10,000 times as fast in hardware, depending on the implementation. Implementations of the RSA algorithm will probably narrow the gap a bit in coming years, due to high demand, but block ciphers will get faster as well.

Then if you look here you can see that they list DES as taking 54.7 cycles per byte and SHA-1 taking 11.4 cycles per byte.

Therefore computing the SHA-1 hash of the document and signing that is a performance optimization vs. encrypting the entire document with your private key.

2) By splitting the document from the signature you have a more flexible system.  You can transmit them separately or store them in different places.  It might be a case where everyone already has a copy of the document, and you just want person A to verify to person B that they have the same document (or a hash of it).

3) Thinking about it, if someone encrypts the document with a fake private key, and you decrypt it with the real public key, your algorithm can't actually tell you the result (signed or not).  Unless your program can interpret the meaning of the resulting document (perhaps you know it's supposed to be XML, etc.) then you can't reliably say it was 'signed'.  You either got the right message, or the wrong message.  Presumably a human could tell, but not a machine. Using the hash method it assumes I already have the plain text and I just want to verify that person A signed it.

Say I have a program that launches nuclear weapons.  It gets a command file that's encrypted using your method, so I decrypt with the public key and send the result to my command processor.  You're then relying on the command processor to know if it's a valid command.  That's scary.  What if the protocol of the command is just the latitude and longitude of where to target the missile, encoded into binary?  You could easily just launch at the wrong target.

Using a hash, you get a command and a signed hash over a plain text channel.  You hash the command, check the signature, and if they don't match then you don't bother sending anything to the command processor.  If they match, you send the commands on.

If you want to hide the contents of the command, then you take the commands and the signature, zip them together and encrypt the whole thing with the public key of the receiving station before you send them.