MITM protection, key distribution I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I distribute the keys?

Afaik SSL/TLS only makes sure the client is talking to the correct server, not the other way around. I want to make sure the client is who it says to be.

I thought of using asymmetric encryption to solve this. The servers public key could be included in the app, and distributed through app store/google play. Then the user would be able to talk to the server securely from the start. The client can then send it's public key securely to the server, allowing two way encrypted communication, and making sure the server is sending the data to the correct client. All of this would then be sent over https.

Am I over-complicating this? What security holes am I missing? Is there something else I would need to make this secure? I don't want to reinvent the wheel, so an existing solution would be preferred.

You want mutual authentication between client and server.

As per the SSL/TLS protocol, this is supported with client certificates. Both the server and the client have a certificate; the server shows its certificate to the client, and then requests the client to show its own certificate and prove control of the corresponding private key. This works, this is standard, this is supported by usual libraries; but it requires, of course, the client to actually have an installed certificate.

The double-certificate model is fine in cases where the client does not actually trusts the server. In your case, you can do something simpler, because your app trusts your server (the app wants to be sure that it talks to the genuine server, but once it has such assurance, it talks freely with no restraint): you can use the show-the-password model that is really common throughout the Web. In full details:

When the application is first installed or started, it talks to your server, identifying it through its certificate. The SSL protocol makes sure that what the app will send really goes to your server only, and cannot be altered or spied upon while in transit.
During that first connection, the app generates a random value K and stores it locally; it also says to your server: "Hello, I am a new client and my key is K".
Your server stores in its database the information about the new client, including h(K) where h() is a cryptographic hash function (say, SHA-256).
Later on, when the app reconnects, it opens a new SSL connection, there again making sure that it talks to the right server (thanks to the server's certificate); and it then sends K to the server. The server computes h(K) (on the K value from the client) and compares it with the stored value; if there is a match, then the server knows that it is the same client as previously.

When K is something that the human user remembers and types (a "password"), a lot of extra care must be taken, especially with the hash function h() which should then be something quite more complex than SHA-256. But here, the K value is generated and stored by an application, who can use a cryptographically strong PRNG and handle a K of 128 bits or more, which will be immune to the kind of attacks that apply to passwords.

Of course, all of this is about protecting the client-server communication from outsiders. The client itself (i.e. the app user) can reverse-engineer the app at will; you cannot make sure that what is on the client side is "your app", unmodified. However, SSL and the show-the-password concept allow you to make sure that if the data goes into the wrong hands, then the client himself is dishonest (or his smartphone was stolen).


Old hardware for encryption and backdoor free I've read and seen articles on backdoors in the processors or at least the idea of that would render software based encryption worthless.

I do know that routers and lots of the newer devices all have backdoors in them which allowed china to crack several major businesses like google ect...

Would older hardware be more secure and offer better protection from decryption?

I thought the word had spread that the NSA is pretty good too. Yes, chinese network gear is often seen by some as compromised by design. Though recent news reports suggest that gear from US-companies might get manipulated after it leaves the factory (see here or here). Other manufactures are not above suspicion, too. Pick your poison!

Picking old hardware is not a solution to this problem:

Old stuff is more likely to break and gives your admin headache.
Often the support is discontinued. Therefore no security updates (or new backdoors as you like ;-) ) => There may be known remote exploits but no one feels responsible to fix it.
The security features are out-dated. For example: if you use an old access point and encrypt your wireless network using WEP any script kid breaks your encryption in 5 minutes or less.
Old network gear is slow. In particular if you use encryption that slows everything down.
It is unclear / unproven if or at which point some state may have started to plant backdoors. 3 years ago? 5, 7 or 10? (You seem to be especially afraid of chinese manufacturers: they deliver components and did so for years.)


What is the impetus for major sites being HTTPS-exclusive now? I've noticed that there are a good number of sites (Google, Twitter, Wikipedia) that are serving up every page over HTTPS.

I can understand given that everyone is concerned over privacy now, but has there been some sort of best practice/impetus for this change?

Perhaps it's one of those things that it's just easier to use, because you get certain guarantees out-of-the-box?

It's been explained to me that it could be because of privacy concerns that were emphasized when the Firesheep Firefox plugin was released at Toorcon 12, but that was two years ago, and I seem to recall major sites making the switch to HTTPS-exclusive more recently.

HTTPS is the easiest solution to a large number of security problems:

Every form of Man In The Middle attack is completely impractical over an HTTPS connection (you'd need to either break SSL or hack into a certificate authority). This includes protecting your users while they're on public wifi.
If any page isn't secure, and a user clicks a "login" link (which is presumably HTTPS), an attacker could replace it with a link to an insecure version that steals passwords. The only secure way to do this is either to serve the whole site over HTTPS or make sure users pay attention to the URL bar. Only one of those two options is possible.
Since all of your pages are secure, you don't need to think about which pages are secure and which ones aren't (user clicks login -> redirect to HTTPS version -> user logs in -> redirect back to HTTP -> user goes to their profile -> redirect to HTTPS...).
Modern browsers give mixed content warnings if an HTTPS page contains insecure content (styles, scripts, images, etc.). Most browsers treat this kind of page as if it's not secure at all (showing the scary red URL box). The easiest way to make sure you never run into this problem is to just serve all of your content over HTTPS.
If you're HTTPS-only, you can enable HTTP Strict Transport Security to further reduce vulnerability to MITM attacks (once a user has been to your site once, their browser will always choose the HTTPS version, even if directed to a http:// URL).

Honestly, I don't know why anyone doesn't enable HTTPS. It's completely trivial and it can be free.


Is Aria2 downloads detectable by web servers? A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from my home to work and back. Recently I've been downloading these videos and watching a lecture a day during commute.

I've been using FlashGot add-on in FireFox with aria2 downloader installed in Ubuntu to download the video lectures. I've set the max-connection-per-server=1 option in aria2. My question is:

Will the web servers be able to detect my downloads?

It is not much known about this specific site and how it works. But from your description I will assume that they are streaming the video to a flash based video player  while you watch.

In this case there will be a significantly different traffic pattern between online viewing a video and downloading a video: in the first case small segments of the video will be loaded (only what is watched within the next minute or so) and downloading all parts will take around as much time as the length of the video. In the second case instead the whole video will be downloaded at once within a time considerably shorter than the length of the video. Additionally the user agent of the downloading client might be different and it might also not send any cookies inside the HTTP request, probably contrary to the intended online viewing.

It is unclear if the providers of the online course will actually look at such details to find out downloads they consider illegal. But if they want to detect such downloads I'm pretty sure that they could achieve this.


What information to provide for an overseas bank transfer? Is it safe to provide someone with your bank account number, swift code and branch code for an overseas transaction who is not known to you personally.

Yes it is safe, although this information qualify as personal identifiable information (PII), yet they are needed for transaction, as long as the person doesn't ask for information that are needed for authorization such as PIN, Credit CARD CVV/CVC etc. you are fine.

As usual ensure due diligence when sharing your information


Where should I store OAuth2 access tokens? I am building a REST API back-end, for a mobile application.
In our design choice, we decided to let OAuth2 providers handle the login security.

However, I am not sure what the best practice is for the access token, which I acquire from the OAuth2 providers.

The situation is, I get an access token from the OAuth2 provider, when the user makes a login. I will need to use this token, every time the mobile application makes a request to my back-end. So I can validate up against the OAuth2 provider, to see if the token is still valid.

I know that I am going to create a JWT, and hand it to the mobile application, which it will use every time it makes a request.

Now my question is, should I store the access token which I got from the OAuth2 provider, inside the JWT as claims.
Or should I store it in a database, and connect it with the users ID, which I will store in the JWT claims?

Perhaps it is recommended that I encrypt the JWT, with JWE? If that is the case, will it decrease performance more if I decrypt for each request, rather than doing a database lookup (I will be using either MongoDB or Redis) or will performance impact be the same?

The connection to my REST API, will be through HTTPS.

If the request to the 3rd party API is through your server, then store the access token in the database tied to the user, encrypted with a key that is stored as an environment variable. If the database is compromised, the tokens are safe. (Bonus, encrypt the tokens with a key that is generated and stored on the mobile app.)

If the request to the 3rd party API is directly from the mobile app, store the access token on the phone, encrypted with a unique key for each user stored in your server's database. Decentralized storage of sensitive information is more secure than centralized storage (compartmentalization). If the phone is stolen, it requires authentication to your server before the decryption key can be obtained. If your server is compromised, the tokens are not there.

I've not used JWT.


What are the most challenging IT security certifications to obtain? Which IT security certifications are considered the most difficult to obtain?


Will converting a MBR disk to GPT, formatting and the converting back to MBR remove a infected boot record. Will converting a MBR disk to GPT, formatting and the converting back to MBR remove a infected boot record. I am looking into writing a little program that will take a connected USB with a MBR infection and convert it to GPT and then format it before converting it back to MBR. Would this be sufficient to remove the threat of a MBR infection?

No, not unless the infection exclusively resides on the MBR. It can easily exist on the bootloader or any other stage in the boot process. Also note that GPT has two backup MBRs on it, though they are not executed by default. If you believe you have an MBR infection (which is quite unlikely), you should reinstall your OS, as an infection of the MBR requires such high privileges that your entire installation could be compromised.


ltd.exe, "Vista Antivirus Security 2012", any info? I was taking a look at someone's computer who had a virus. It called itself "Visa Antivirus Security 2012". It turned out to be ltd.exe. It would seemingly randomly block programs, it turns out it had infected the "open with" option for exe files. Renaming the exe then restoring the open-with references that contained ltd.exe did fix the problem.

I checked the (Firefox) browser's download logs to see if there was an exe in there. But no exes in the log except the other antivirus (Avira) that he was intentionally installed a good while ago.

This ltd.exe modify date is the date of the first boot of this computer today, being the first day of the year. Is there information on other occurrences of this ltd.exe, what its official title is, how is it distributed?

Considering what the user has installed, and that this is a careful user, somewhat computer savvy, I think the most likely cause is a recent vulnerability in Java, bringing some virus scheduled for 2012. But I would like to know.

The user will wipe the hard drive clean.

It's impossible to say with certainty how this infection was distributed. The rogue-AV landscape is a complex marketplace of affiliate groups; the infection process is likely to have been undertaken by a different party to the team behind Vista Antrivirus Security itself. Each pay-per-install affiliate may use different tactics.

But yes, plugin exploits (against Java and Acrobat in particular) have been the most popular drive-by-download vector in the last few years, so Java is a good guess. The other common infection methods are the simple trojan play (“to view this page, install this codec...” et al) and P2P poisoning but if you have a cautious user that would be less likely.

Going through the about:cache logs might reveal something.


Key Management/storage system In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour.

Each of these hardware devices encrypt the data they send with an individual encryption key, typically an AES 128 bit encryption, but there are several other encryption methods as well, including asymmetric encryption methods.

What I need, is to do is to safely store all these keys and from the input server be able to decrypt data as it comes in, the input system is made in  C# .NET.
The encryption keys have to, for security reasons, be stored on a different server.
Do you know of any encryption key storage systems that support the above?

We may only have a couple of thousand hardware devices currently, but the system should be able to handle hardware devices in the 100s of thousands.

I have through test and research already found that systems such as Oracle Key Vault are not ideal for our purpose. I have yet to find a system that does not focus on Database security, credentials security

You should rework your entire system.  It is inherently far less secure than it should be.  There is no good reason that you should be storing encryption keys that could be used to impersonate your devices on your servers at all.  Rather, you should be providing each device with a signed certificate (from one private CA that you can operate securely using CA best practices).  This affirms to you that a) each device actually is using a public/private key pair authorized by you and b) allows you to verify each device from the public cert which you can store in the clear (or even be transmitted by the device at the start of each connection and not stored on your servers at all).

For talking to your servers, you only need to have one private key used for all communications and a public key used by the devices to verify your server.  AES can still be used for the individual sessions between the client and server, but the key can be generated on the fly, exchanged using the asymmetric system and then discarded at the end of the session.

Under this setup, you only need to store 2 to 4 keys securely instead of needing an entire infrastructure to manage keys whose only irreplaceable value is to attackers that are trying to compromise your system.

Update: If you really can't use a proper distributed key infrastructure, then you will need to use key chaining to minimize the sensitive data.  Encrypt each of the keys with a master key, thus enabling them to be stored safely anywhere.  Setup an extremely locked down server with the master key and have it provide encryption and decryption services for the system so that the keys are never decrypted outside that system.  That system would then basically be functioning as an HSM (if you can get an actual HSM, that would be preferable.)  Connections would be sent off to that system along with their encrypted encryption key.  The system would decrypt the traffic and provide it back to the requester.  You would additionally need some kind of security to authenticate the services making requests of the encryption/decryption server, though the specific needs there depend largely on what kind of security you need on the data at your site.


Nmap scan comparison show change in ports I am going to try explaining my question in the simplest way possible.
I have a script which uses nmap to scan for open ports and save the result in a file. The next time it scans a host it moves the old saved nmap report and creates a new one, lastly it compares these 2 reports to see what ports have been changed. That is, if a machine had a port say (80/tcp , 22tcp) open in previous scan result; and if the new scan result consists of only (80/tcp) then the script notifies a slack channel as :

CHANGE OCCURED FROM (80/tcp , 22tcp)   ===>   (80/tcp)

so lately I have been having too many notifications from some of the machines, it keeps on changing port i.e from OPEN to CLOSE and CLOSE to OPEN. Now this script runs every 15 mins and I am really not sure why for some of the machines this keeps happening since I have seen that the ports do not change by manually logging in the machines.

There are no IDS on the machines which show this behavior. Is it possible that the machines are dropping NMAP traffic?

1) Nmap Timeout

I do not know how Nmap determines that but I'm fairly sure that it takes respond time into account while deciding if the target port is open or not. Depending on various factors, a port may not be able to respond immediately so maybe Nmap decides that the port is closed. Lets say that the threshold is 100ms. At first Nmap gets a response in 89ms and at second try it gets a response in 105ms. In both situations the target port is actually open but fails to respond in time.

2) Firewall Rules

The target machine does not need to have a full blown IDS in front of it, port scan is a really simple threat to detect. Limiting packet number over time from a single IP can disable your scans for a while. The funny thing is, since Nmap governs asynchronous scans it may scramble the order. That means Nmap might exceed the threshold while scanning port 8080 on one thread, and it might not have been scanned the port 50 yet. It could give you weird results.

My Recommendations

Use the "-T" flag of the Nmap. For example, use -T3 instead of -T5 so the scan will be slower but more docile.
There are flags for timeouts such as "--max-rtt-timeout" and "--max-scan-delay", take advantage of them for slower hosts.
Implement a better change detection algorithm. Instead of just checking the current result with a previous one, compare how many "CLOSED" or "OPEN" results you've got in a certain time. There are many false positive and false negative detection algorithms you can find on the internet. (SANS explains False Negatives security wise, here)


Where can I find real life examples of software vulnerabilities in OSS? I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly where in the code the vulnerabilities have occurred in the past, and how it was patched (if it is patched).

Try this one (https://blogs.securiteam.com/index.php/archives/2543#more-2543), the advisory shows the vulnerable code and since it's an open source product the patch is available from the vendor source code (http://www.live555.com/liveMedia/public/).


Is Bcrypt a hashing algorithm or is my study material wrong? I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question:

Or, represented as text:

▶ Which of the following are hashing algorithms? (Select all that apply)
----------------------------------
 ✔ ☑  MD5 (☑ Your answer)
 ✔ ☑  RIPEMD (☑ Your answer)
 ☐ ➖  Bcrypt (❌ Your answer)
 ✔ ☑  HMAC (☑ Your answer)
 ✔ ☑  SHA (☑ Your answer)
----------------------------------
➖ Your answer to this question is incorrect or incomplete.

Was I wrong to include Bcrypt as a hashing algorithm?

It's not a good question. You're not wrong to call bcrypt a ‘hashing algorithm’, but they're not wrong that it is qualitatively different from the others—although it is curious that they single out bcrypt and not HMAC too.  We can group them into three categories:

bcrypt is meant to be a password hash, also known as a password-based key derivation function, whose purpose is to be expensive to compute so that even if it doesn't take many trials on average for an adversary to guess what the input was, there's a high cost to testing each guess.  Other examples include PBKDF2, scrypt, and Argon2, and Balloon hash.
MD5, RIPEMD, and SHA are meant to be collision-resistant hashes, whose purpose is to make it hard to find distinct messages that have the same hash.  As it happens, MD5, RIPEMD, SHA-0, and SHA-1 (though not SHA-2 or SHA-3) are all broken—collisions have been reported for all of them.  They're also designed to be preimage-resistant, so that it is hard to find a message having a prescribed hash, and second-preimage-resistant, so that it is hard to find a second message having the same hash as a prescribed message; none of them have had these properties broken.  Other examples—which, unlike MD5, RIPEMD, and SHA-0/SHA-1, are unbroken to this day—include BLAKE2b and SHAKE128.
HMAC is a technique for constructing pseudorandom function families (PRFs) or message authentication codes (MACs) out of certain hash functions like SHA-256; sometimes HMAC is loosely called a ‘keyed hash’, but that doesn't really make it clear what the security goal is, which is unforgeability as a MAC or pseudorandomness as a PRF: if the key is chosen uniformly at random, an adversary who doesn't know the key can't guess the MAC for any message, and can't distinguish the hash of any message from a uniform random bit string.

The word ‘hash’ alone in cryptography just means a function that scrambles its input, or the scrambled output.  There are other kinds of hash functions: the FNV-1 string hash function, sometimes used in hash tables; universal hash families like Poly1305, with guaranteed bounds on collision probabilities, sometimes used to make extremely cheap message authentication codes with high security; key derivation functions like HKDF, used to turn high-entropy but nonuniform bit strings like Diffie–Hellman shared secrets into uniform random bit strings; etc.  It's not wrong to call any of these ‘hashes’, but it may be helpful to use more specific terminology like collision-resistant hash or pseudorandom function family or universal hash family.


Cell number and IMEI details Is there a device I can install to collect cell number and IMEI numbers for people within a vicinity?

We want to install in an area for security reasons so that we are able to trace the people in the event of a break in. Currently we have cameras and movement sensors which is not very helpful as our reaction time is known hence thieves have gone in and out before we catch them in the act.

This will be used in a small private area about 1000 m2.

These devices are called IMSI Catchers, and are in use by state agencies and law enforcement entities. I doubt whether you can get such a device for private surveillance.

I also doubt whether you will succeed preventing theft with such a device. A sopisticated thief will not carry HIS mobile around.


Erase broken external Hard Drive before returning to store I've seen similar questions out there but not the same.

I have a broken Seagate hard drive that I want to return to the store. It has a lot of private data on it. I can't access it through the computer. I can only see it showing as a 'backup' but it is not listed under 'computer' as a drive. So, I don't think I can overwrite the data.

The question then is, how can I destroy the data without erasing through the computer (no access) or without physically destroying it (store wont accept the return)?

Thanks

I would suggest that you try a Live CD recovery disk. This might allow you to get access to your data and use a tool like Bleachbit to securely erase it. If you can't access the data this way, then it doesn't mean your data is secure. A disk engineer might have other ways of getting at the data, for example replacing broken circuitry (if that's the problem), or a specialised test/service rig.

Attempts to erase the disk with an external EM field are unreliable and you'd have no way of knowing whether they worked.

If you can't securely erase the disk, then I guess you have to weigh up the cost of the disk against the risk of someone else accessing your data. Or, as others have suggested, talk to the store and explain the situation.

(I know it's too late now, but this is a good argument in favour of encrypting your disk in the first place.)


why can't i overwrite stack frame I'm currently reading Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition and I have a question with an exercise in the book. The lab "Lab 10 - 1 Overflow of meet.c" is a lab in which we perform a buffer overflow in the program. The program is as follow:

//meet.c
#include <stdio.h>   // needed for screen printing
#include <string.h>

greeting(char *temp1,char *temp2){ // greeting function to say hello
   char name[400];    // string variable to hold the name
   strcpy(name, temp2);    // copy the function argument to name
   printf("Hello %s %s\n", temp1, name); // print out the greeting
}
main(int argc, char * argv[]){      // note the format for arguments
   greeting(argv[1], argv[2]);      // call function pass title & name
   printf("Bye %s %s\n", argv[1], argv[2]);   // say "bye"
} // exit program

The book informs you to compile the code with:

gcc -ggdb -mpreferred-stack-boundary=2 -fno-stack-protector -z execstack -o meet meet.c

I'm not too sure what each argument pass to the compiler mean I read from the man page that mpreferred-stack-boundary attempts to aligned the stack boundary in this case 2 ^ 2 = 4 bytes. I've seen the no stack protector flag used before so I know that it allows smashing of the stack and the -z execstack I want to believe is to make data executable form the stack (removing the NX bit).

And prior to all this we already disabled ASLR using the command:

echo "0" > /proc/sys/kernel/randomize_va_space

The book also mention to disable the following:

echo "0" > /proc/sys/kernel/exec-shield
echo "0" > /proc/sys/kernel/exec-shield-randomize

I didn't find these files in the specified directory so I didn't run the command I was curious if this was causing my issue so I googled it and found this forum post:

http://ubuntuforums.org/showthread.php?t=1945764

But the forum post stated that the arguments we past to the compiler already takes care of disabling the "exec-shield" feature and the "exec-shield-randomize" feature.

So the issue I am having is when I follow the book instructions I receive different results from the book.

The book said the stack frame would resemble this:

                         Function
                         Variable                            Parameters
______________________________________________________________________________
|           |    ESP   |    Name   |   EBP   |   EIP   |   Temp1   |   Temp2  |
-------------------------------------------------------------------------------
Low Mem:               <--------- Stack Grow                         High Mem:
0x11111111                                                        0xfffffff0

They then loaded the program in gnu debugger with the following command:

gdb -q meet

They then placed a breakpoint on line 7:

strcpy(name, temp2);

An passed the overflow argument value using perl:

(gdb) run Mr perl -e 'print "A" x 600'

For that the got the following output:

Breakpoint 1, greeting (temp1=0x41414141 <Address 0x41414141 out of bounds>,
    temp2=0x41414141 <Address 0x41414141 out of bounds>) at meet.c:7
          printf("Hello %s %s\n",temp1, name); //print out the greeting

So they successfully written over the EIP register, temp1 and temp2 pointers as the book said but when I tried it I got this:

I tried 600, 1,000, 10,000, and as you can see in the screenshot 100,000 A's. So can someone tell me if I am doing something wrong am I forgeting to disable a security feature or something like that?

OS info:

  Ubunut 14.04 Linux ubuntu 3.19.0-49-generic #55~14.04.1-Ubuntu SMP Fri
  Jan 22 11:23:34 UTC 2016 i686 i686 i686 GNU/Linux

UPDATE:

This is the book results:

The book state that now the pointers temp1 and temp2 are overwritten and now points to null for me this didn't happen. Why?

One side note not directly related to the problem :

I'm not sure if the book you're using is  the best to start your pentesting\exploit development with.
I would recommend OSCP's hands-on or Georgia weidman's book
"Penetration testing A Hands-On Introduction to Hacking"
Or you can try SEED project's labs.

Now i'm not sure i can tell what is going wrong without trying the lab (Which i'll try do and get back to you).
However, I can tell you that increasing the buffer's size is not always the answer.
In fact, it sometimes corrupts your exploit because your extra long buffer might overwrite the caller's function data causing the app to call the exception handler which -if happened -will move the address of the exception handler function  to the EIP, and will force you to do things in a different way to overwrite the EIP because now the address of the exception handler is in the EIP, not your buffer .


Get IP of web server located at sub directory level I usually use ping or tracert to get IP-addresses for domains or sub domains and it works really well. However I have stumbled upon a site that seems to use a reverse proxy or something similar because one request to a sub directory generates different server-header and a lot of security headers are not implemented there. See example requests below. I was hoping for X-Real-IP or X-Forwarded-For header for the sub site but no luck there.

My question is if it is possible to get the IP of that server?

Request:

GET / HTTP/1.1
Host: www.site1.com

Response:

HTTP/1.1 200 OK
Date: Tue, 07 Feb 2017 09:12:36 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: deny
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Connection: close

Request:

GET /site2/ HTTP/1.1
Host: www.site1.com

Response:

HTTP/1.1 200 OK
Date: Tue, 07 Feb 2017 10:20:10 GMT
Server: Apache-Coyote/1.1
Content-Type: text/javascript;charset=utf-8
Content-Length: 242
Connection: close

What I have tried, even though I knew it would not work.

ping www.site1.com/site2

  Ping request could not find host www.site1.com/site2. Please check the
  name and try again.

tracert www.site1.com/site2

  Unable to resolve target system name www.site1.com/site2.

This is not possible, unless the (or every) site behind the proxy leaks its IP address somehow, usually in headers when sent special requests (it is surprisingly common but far from ubiquitous) - exchange autodiscover springs to mind. The application running on the server would have to be vulnerable to this.

There are leaks of information for example how many sites are behind load balancers using IP ID information disclosures, but not the address

Or the load balancers/proxies can disclose this information in some cases due to the cookies they use for connection tracking.

I'm not aware of any built in tools or the like. And has been commented - the chances are these will be behind a DMZ on a LAN on private address ranges, though again, not necessarily.


Can an infected phone infect other computers in a network? Can an infected phone infect other computers in a network?

For example do you need to worry about private phones in a company enviroment?

Or is that already paranoid?

A modern smartphone is far more powerful and connected than, say, a 1990s office work-station. There's nothing about it being a "phone" that makes it not a network-connected general-purpose computer. This is also true of many Internet of Things devices. The fact that a WiFi light socket is a light socket doesn't make it any less network-enabled or computationally-capable.

Typically, a private phone won't be on a corporate network unless there is a separate "guest" network meant for that purpose, as Mike Scott describes. Still, a smartphone could attempt an attack from that "guest" network (and it's not like compromising that network wouldn't be a problem of its own), or it could directly attempt to attack WiFi access points used by the internal network. Further, if an employee plugs their phone into their work computer to charge it, this is another vector for the phone to attack the internal network.

Another concern for some organizations is the phone's ability to record audio and video. Here, whether the phone is "infected" or not is less of a concern. Even if you trust the owner of the phone, the recording features can be enabled without the owners knowledge or consent.

If you can imagine how an infected laptop or desktop could cause a problem in such an environment, a phone is only an even more network-connected and discreet platform. In other words, for many reasons a phone is an even better platform for attacks as compared to a laptop or desktop.


Securely store password for Java Keystore Background

I am implementing set of Micro services using Java spring MVC and hosted in Undertow containers using Gradle. I am using a Java keystore to secure my keys which are using by the service to perform encryption and signing.

When a user spawning a Micro service, user injects the password into Gradle as follows.

gradlew bootRun -Dpassword=thePassword

This is ok for a normal usage because user is the one who enters the password.

Problem

There is a requirement that we need to spin up Micro services based on the demand automatically (for peak hours) and shut down when the load decreases. I can automate this but I need to hard code my password(s) in to my shell script(s) which is/are responsible for spin up services automatically.

Question

How can I secure my password(s) and do this automation ?

This is a recurring problem in app security: even if you store your secrets in a protected datastore, you have to authenticate to that, which means you've got another secret to manage, which puts you back at the original problem. Unfortunately, there's no cut-and-dry canonical solution.

The best you can do is to try to minimize risk by introducing different types of systems that are a bit harder to falsify. Are you using physical servers (presumably with some sort of virtualization layer on top)? You might store the encryption key on a smartcard or similar physical device that's plugged in to the machines, and lock down the software access to it to only the user responsible for scaling the app. Are you using AWS? You can take advantage of Amazon's machine-based roles, and lock down which IAM users are allowed to launch machines with those roles. Maybe you have a manual step when deploying new code that adds a private key and then bakes a virtual machine image, and you heavily restrict which users can access those baked images. None of these solutions are perfect, but they help limit the entry points into the secure data.


Should I compile as root? When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account?

./configure
make
sudo make install

or

sudo su
./configure
make
make install

There are two different situations:

1. You are going to run the software as root

In this case you should really trust the source code before using it.  Either by auditing it, or by trusting the author and the delivery method.

If you are going to be recompiling the code, then I think the source files should be owned by root, so that an unprivileged user cannot modify them.  And if the source tree is owned by root, then you will have to compile as root.  If you trust the source code more than you trust your users, then that is the safer option.

2. You are going to run the software as a user

Ideally you should trust the source code before giving it to your users.  But let's say that criterion is relaxed, and you don't fully trust the code.

Then it's not a good idea to compile or run the software as root.

Traditional installation, only partially as root

You can compile the software as any user, e.g. by running ./configure && make

But you might still need to run sudo make install to make the compiled code visible to other users.  In this case, you only need to audit the Makefile before running it.

Build a package for root to install

Alternatively, on Debian and derivatives you can use something like equivs-build or fakeroot equivs-build which will create a dpkg which you can then install as root.

But be aware that packages may have post-install scripts which could do anything with root privileges.  So this may also need auditing.

Safest: Install the software to a non-system folder

With this approach, root's involvement is minimised:

# Create a folder as root, and give one of your users control over it
sudo mkdir /opt/package_name
sudo chown user1:user1 /opt/package_name

# Now do compilation and installation as user1
./configure --prefix=/opt/package_name
make
make install

# Finally, make the executable easily accessible to users
sudo ln -s /opt/package_name/executable /usr/local/bin/


Can a website infect a computer without the user's assistance? Possible Duplicate:
  Can you get virus just by visiting a website in chrome

I have a hard time believing that drive-by downloads can actually happen without a user's assistance (e.g. without the user clicking a popup and downloading a program).

To test this, I've set up a virtual machine with IE 6 on it (no updates!), but then I got stuck -- when I looked at Norton's Top 100 Dirtiest websites, all of them seemed clean (clicking on their report says they're not infected). Subsequently browsing a couple confirmed this point.

Is a drive-by download even possible? Any simple proof/examples of sites that do this?

Yes and no. The problem is that as soon as a known security breach exists, the company which wrote the browser books it to patch the hole, so it is hard to find a concrete example.

One classic example of "drive-by download" is being able to write to disk without the user's consent. One such exploit was shown in Safari last year. What's worse, is that that specific security breach also allowed malicious agents to activate an app on the Mac, kinda scary.


How is the DEK in a SED drive encrypted? I am using a Samsung Evo 960 NVME SSD. I have encrypted the SSD using its built in hardware encryption features, which follow the tcg opal standard. If I understood correctly, the disk encrypts all data using AES-256. The key for this encryption is called the DEK (disk-encryption-key). The DEK is then encrypted again, using a password provided by me.

An attacker with access to the disk could theoretically extract the (encrypted) DEK from the drive. I would like to estimate how long it would take to crack the encryption of the DEK (so basically to find out my password). Therefore, I would like to know how the DEK is encrypted using my password, so I can estimate how many passwords one could try per second on commodity hardware.

Edit from comment:
The question is: How is this key (the DEK) encrypted/generated? Is it a 256-bit hash of the password? If so, which hash method is used?

It seems like there is no publicly available information about this specific model of Samsung. However disk encryption of Samsung 840 EVO and Samsung 850 EVO have been studied (among other SSD drives) in this paper. Based on the research Key derivation scheme is built upon:

1 - Key Storage

This key storage is aimed to validate the password and to derive the key :

  A password candidate p' is validated by computing PBKDF2(HMAC_SHA256,
  p', Sverif). Then, the result is compared against the stored
  PBKDF2(HMAC_SHA256, p, Sverif). If they match, then p = p' is assumed.
  The derived encryption key is then obtained by computing
  PBKDF2(HMAC_SHA256, p', Sderiv).

2 - Crypto blob

This bloc is 64KB and it holds all information related to disk encryption including DEK:

  From password to DEK Samsung’s Opal implementation allows a total
  number of 9 ranges and 14 passwords to be specified. The password is
  fed to the validation/derivation function, using slot 478+u, where u
  is the user id associated with the password. Once the password has
  been validated, the derived key is then used to decrypt an entry in
  the password ↔ range mapping table. The entry is located at slot 0 +
  27u + 3r, where u is the user id and r is the range number. Finally,
  the decrypted result is used to decrypt slot 456+r, yielding the DEK
  for range r


Can (or should) a system admin test a login before sending login info to users? I am a low-level system administrator for a new college Learning Management System, or LMS.

(An LMS is the platform used by professors to post their syllabi, lecture notes, assignments, grades, announcements, etc.)

I do not have the authority to create new accounts, nor does anyone at our branch campus.

As new students are admitted into our school, we send account creation requests to the main campus.

The account creation process has a quirk. Let's say we send a request for ten new accounts, but two of these students have already taken courses at the main campus. We will get back a list of ten accounts that look like they have all been newly-created, each with an assigned password. The eight new accounts will perform as expected; however, the already-existing accounts will have a new password listed, but this password will not work (the system won't overwrite a password that has already been changed by the user).

Additionally, there is no way for us to check and see if the user already exists at the main campus, because we can see users only after they have been assigned to a course at our campus.

After new accounts are created, we send an email telling the user their login ID and password.  We got tired of sending out erroneous information to those who already had accounts, so we began doing a test log-in before sending the information out, partly to seen which passwords worked and which did not, and partly to gauge the percentage of records that had erroneous information (i.e., bad passwords). In other words, we were trying to figure out: Is this just happening every once in a while? Or a lot? (It turns out roughly 20% or 30% of the records we were getting back had incorrect passwords listed.)

I realize there are many potential problems with the current system, and most of those problems are being worked on as we continue to iron things out. I'm not asking for suggested ways to improve the process. (I can think of several, including automating the process such that we no longer manually send emails with login information.)

Instead, I'd like to leverage the expertise of this community to ask: Is doing a test log-in with a newly-created student account some kind of a security faux pas? Would this be a no-no that should never be breached for any reason whatsoever? Or is it okay for a system admin to test a login before sending the information on to the user, particularly when it is known that there is a good chance the information will not be correct?

My staff is a customer-service organization with little-to-no formal training in information security. Also, once logged in successfully, we would immediately log out.

A recent debate has started on campus about whether we have been inadvertently committing a flagrant violation of security policy, or performing a justifiable quality assurance step by a system administrator. For the purposes of this question, we can assume "security policy" refers to industry best practices (not local written policies, which are being consulted even as I formulate this question).

This is wrong. A sysadmin should never log in or even know the users password in the first place.

The issue is with the system, fix it. A good pitch to the management to get $$ for the fix is to say that this impacts your security very badly and give him a good example of what could happen if let's say a sysadmin goes rogue + how much it would cost them.


Wireless devices with default configurations I have the idea of deploying a product using a Raspberry Pi alike (CHIP) however I am concerned of the security issues getting a wireless device into people's homes

The device will be:

Using all the default passwords and settings (debian)
Most likely powered 24/7 or during long periods of times
A portion of the users will connect it to the internet (wireless network) to get updates, the rest won't, however the wireless interface will keep ON
The device won't do any critical task as opening your garage, it will be more like a game

So far I have came up with this security issues:

If the device is in the wireless network

Anyone already in the network will be able to install anything (sniffers, etc..) but they are already in your network, so you should trust them right?

If the device is not in the wireless network

None

How dangerous is to have an unattended wireless device like this connected to your network, or in your wireless range?

I believe that you should not trust other users in the network, I believe that you want to use it as a black-box that is serving for a specific purpose for your clients. So they are receiving some hardware that helps to achieve some goal but they have no reason to look inside how it works..even if it could be challenging to achieve.The way I see it is that you want to use the device similarly as the boxes we receive for our TV services that are connected to the Internet.

So you should work on it to secure it, similarly as the IP Cameras we have.

I know that Google's ChromeCast can be accessed as by anyone who has access to the network, and they have decided to go in favor of easiness of usability instead of security and now any kid can start to broadcast anything on TV. The risk is not high, but our this situation where this device serves for example to open the garage and if the attacker was able only to penetrate in the network of your client, we could authenticate to that box with the default password and send a the request to open the garage allowing them to access in da house.

It is similarly problematic when routers were having default passwords, allowing malicious users to login,change network configurations to read their network traffic.


How to find the real IP of website behind reverse proxy? I've builded nginx as reverse proxy server that points to apache server remotely. Of course IPs are different and suppose that I'm only running http service on that server.

How can an attacker find IP of the server who's serving content, in my case apache?

It depends. A reverse proxy, if set correctly, will not reveal information about the web server it points to.

However there are a lot of things a determined attacker can do to gain information about the origin server:

DNS tricks

Your A records sure points to the reverse proxy, but are there other records (typically MX or any other subdomain) that directly point to the original server.

In CDN setups, its not uncommon to have a 'origin' subdomain that points to the actual server. Sure your can obfuscate the origin by using a non-guessable name but then often DNS mis-configurations like AXFR vulnerabilities can reveal such domain names.

Configuration Errors

Various configuration errors or settings on the reverse proxy side as well as on the apache side can leak web server's IP address. Some web servers enable the mod-info module. which essentially exposes the Apache status page to the internet. A quick google query revels many servers with such instances. Its remarkable how many of these exhibit the exact same leakage you are worried about. For eg, check out this site in the google query results. The DNS points to the reverse proxy, but the page shows the internal web server IP.

Application Errors

Its not uncommon for the application itself to reveal the internal IP addresses. For eg. can one trigger a SQL error or a 'Internal Server Error' on the application and get the error message to reveal the IP address of the server?

Application Vulnerabilities

If the application has vulnerabilities like remote command execution or remote file inclusion then it is totally possible to know the IP address (and a lot more). For eg. for a vulnerable php application a simple <? phpinfo(); ?> command will spit out everything about the server, including its internal IP address. Similar tricks will work for other frameworks/languages.

Other tricks

There are various other tricks/leakages that might happen. The following article illustrates various ways it can leak:
http://zeroknock.blogspot.com/2013/07/internal-ip-address-disclosure-over.html

I've also in past been successful in getting the origin IP address via https://censys.io/


What kind of attacks are mitigated by 2FA/MFA in Industry sector? I would like to understand the real role of 2-Factor Authentication in Industry Control Systems like SCADA/SmartGrid with Windows AD infrastructure. In particular I am interested in an operational use cases: when operators/engineers accessing workstations/HMI consoles.

On which kind of 2FA means are smart-cards being replaced with?
What is the main purpose of implementing 2FA ? the regulations, human factor or real security control.
What kind of threats/attacks are mitigated by 2FA as security control?

Any feedback from a field practitioners would be appreciated.

In our case, it was the human factor. You're lucky if the post-it with the password doesn't go right on the console. If it doesn't, everyone has the same password that everyone knows.

Staff gets annoyed by the need for a token, but they can't easily replicate it, so they're too worried about explaining how they lost theirs to just leave it around. Add a password that has to be changed and soon enough they run out of combinations so obvious that they could be guessed in three tries, and syncing their passwords is more trouble than doing things right.

On tokens vs tokenless, I'm strongly for tokens. Tokens come dirt cheap in a box from China, they work in buildings with phone jammers, don't get left elsewhere out of fear of damage, there's no battery concerns, and they end up stored alongside physical keys, which people always recognize as items to be protected. And there's something to be said for the personal interaction in handing one.

I don't see how you can separate real security control from the human factor. Security is all about minimizing the vulnerabilities from the human factor. Make it easier to comply with the rules than to work around them and you can get enough security that the system isn't wide open.

Source: Did SCADA.


If we can no longer trust NIST, what are viable alternatives? Regarding the Guardian article about NSA control over encryption, there was this gem deep inside:

Independent security experts have long suspected that the NSA has been introducing weaknesses into security standards, a fact confirmed for the first time by another secret document. It shows the agency worked covertly to get its own version of a draft security standard issued by the US National Institute of Standards and Technology approved for worldwide use in 2006.
"Eventually, NSA became the sole editor," the document states.

Where else can we turn for encryption standards?

You could try trusting the past. When Feistel and Coppersmith created Lucifer at IBM back in 1973, the NSA helped them strengthen it by providing better values for the S-boxes and adding the staggered bit shifting between rounds. They did this before IBM released it and it became DES.  The NSA later acknowledged improving DES was a big mistake. (At the time, we thought the bigger mistake might have been the revelation that the NSA understood differential cryptanalysis 20 years before the civilian mathematicians figured it out.) While the key length of DES is still too short and attacks over the years have significantly weakened it, 3DES remains a sound implementation built on solid theory, even if it is a bit slow.

Keep in mind that most attacks described in the articles published so far appear to be on the end points, where security is weakest. Even the NSA must follow a budget, and wouldn't expend the resources to brute force every SSL session key ever used; at least not when hacking a target's PC is so much faster and easier.


Password stolen on public wifi even though https was used I saw this video where news reporter is in public place, and some security expert demonstrates to her that even though she logged in at page which was using https that guy got password in his computer.

How that might work, any ideas? I can't find video, but video didn't have any more details or words to go over beside that be careful using any other free wifis. It was published little bit before olympics in russia.

I thought https was secure, but he showed on screen the password she had written in login form.

Is this the video you're referring to?

If the site does not have HSTS (HTTP Strict Transport Security) enabled then I believe you can capture login information without generating a certificate warning using software like SSLstrip.

SSLstrip does not bother forging a certificate; instead, it removes SSL entirely.  Many webpages are accessible via both standard HTTP and secure HTTPS, but the standard HTTP page redirects to the HTTPS version.  SSLstrip works by watching for these redirects, and then blocks it to make sure the victim goes to an HTTP version of the login page.  If the attacker wants to keep the padlock symbol, he can redirect the victim to a fake login page on his own server that uses HTTPS.

To protect yourself you should always look at the address bar to make sure that HTTPS is actually in use when you expect it to be, and that the URL of the site matches what you were expecting.  Also take a look at HTTPS Everywhere.

See How to thwart sslstrip attack?


A "hardware" random number generator for mobile phone I have been trying to write a random number generator using the hardware of the phone. After reading other people's attempts and tried some. I came up with the following to generate the seed:

Play a short pre-recorded white-noise on the phone's speaker.
The mic gets the feedback, which then gets mixed in the playback audio.
This should create a continuous white-noise output.

This can be done at program start and feeds into a PNG. What do you think?

Without lots of research and public scrutiny, home crypto tends to be very vulnerable to many attacks. You will do better using your phone's secure PRNG.


Why does WPA2 need a 4 way handshake? If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?

The difference between the two keys is that the Master key (PMK) is supposed to be valid for at least as long as the client is connected. In the case of WPA-PSK, the PMK is the same from the moment the AP is configured until either the passphrase or the SSID changes. Therefore, if the PMK is compromised in any way, the attacker gains "permanent" access to the network.

To protect the PMK, the protocol derives a pair of Transient keys (PTK and GTK) that are used to directly encrypt communications. These may be expired and renegotiated several times in the course of the client's connection, and the compromise of either of them does not gain the attacker permanent access to the network. The next time the client connects, it will generate a new pair of Transient keys from random values generated on the AP and the client, combined with the PMK.


id-ce-cRLDistributionPoints ASN.1 / DER encoding question I have a file - test.pem - with the following contents:

-----BEGIN CERTIFICATE-----
MBIwEKAOoAwwCqMIMAZhBEFCQ0Q=
-----END CERTIFICATE-----

openssl asn1parse -inform PEM -in test.pem -i returns the following:

    0:d=0  hl=2 l=  18 cons: SEQUENCE
    2:d=1  hl=2 l=  16 cons:  SEQUENCE
    4:d=2  hl=2 l=  14 cons:   cont [ 0 ]
    6:d=3  hl=2 l=  12 cons:    cont [ 0 ]
    8:d=4  hl=2 l=  10 cons:     SEQUENCE
   10:d=5  hl=2 l=   8 cons:      cont [ 3 ]
   12:d=6  hl=2 l=   6 cons:       SEQUENCE
   14:d=7  hl=2 l=   4 cons:        appl [ 1 ]
Error in encoding
19480:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:asn1_lib.c:142:

Here's what it corresponds to in hex:

00000000  30:10:30:0e:a0:0c:a0:0a:30:08:a3:06:30:04:61:02  0.0.....0...0.a.
00000010  58:58                                            XX

Hand-decoding it I get this:

SEQUENCE {
  SEQUENCE {
    [0] {
      [0] {
        SEQUENCE {
          [3] {
            SEQUENCE {
              [APPLICATION 1] XX
            }
          }
        }
      }
    }
  }
}

So it seems to work to me.  Why doesn't asn1parse like it?  Here's the ASN.1 mapping it corresponds to:

http://pastebin.com/NyKDK0ph

The definitions posted here via the link are incomplete, but after supplying definitions for all of the undefined types, I get a similar error message from the OSS Nokalva ASN.1 Studio utility.  The last byte you display here is a length (58 hex 88 decimal), but based on the second byte (hex 10, dec 16) the total length of the encoding is 16, so 88 more bytes cannot be found in the buffer based on that outer length, thus the error message on encountering that length of 88.

Paul


GPU powered Password cracking machine - buy metal or cloud? As a IS consulting firm, we would like to have our very own password cracking machine.
Great.

Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU or rainbow tables).
And the questions that we found hard to tackle was what is the best choice - can we buy just enough power from on-demand cloud service (amazon's is an immediate selection but if you have any recommendations, go ahead) or to buy ourselves a machine and build it with the appropriate hardware.
btw, we are thinking on using oclHashcat-plus if it makes any difference.

Suggestions on how to settle the debate?
Maybe some completely different approach?

Thanks in advance,

This is a simple cost / benefit analysis, so it's a business question rather than a security one since you've already decided the merits of how to approach the security aspect. Write your code, benchmark it, and compare numbers in a spreadsheet.

For the metal

* Cost of metal
* Cost per hour in terms of electric bill (assume under full load)
* Budget for parts replacement
* Operations per second

For the EC2

* Amazon rate per hour
* Operations per second

Compare the numbers on a month by month or year by year basis. Pick the one that makes more sense based upon expected life. Front-loading cost, net present value, expected utilization, risk, etc are all accounting problems.


Under xmlrpc attack, what is the best approach? I'm running a php application on a VPS. Recently I started a blog for my app on the same server, using wordpress and nginx.

Everything was running fine, until today server was returning error 502 and extremely slow. After some research, I found out I was having a ton of requests to wordpress xmlrpc.php file, so, yeah, my server is under attack.

I have renamed the file to keep it from being accessed, and installed a security plugin on wordpress, it's ok now, but I'm still receiving a ton of post requests to the nonexistent xmlrpc.php file.

It's the first time I'm dealing with this, my questions are:

Would this repeated traffic to an inexistend file still hurt my server performance or memory?
Is there a way to block it (or setup something that would block it) before reaching nginx?

Any help or insight would be greatly appreciated.

That happens all the time, on the first moment, identify the ip addresses that are attacking your wordpress and just block it with iptables.

On a second moment, install Fail2Ban, configure it to watch wordpress/apache logs, ssh, and any other kind of log that you think that are useful. Apache have several modules, to make users respect your server and don't flood it with requests.

Also, analyse your wordpress install for vulnerabilities, weak passwords, and analyse the logs to detect any intrusion.


How can you change "system fonts" in Firefox (to increase own safety & privacy)? I know there were some previous (similar) questions to this, I have read them all and also tried but nothing has really helped (maybe because it was outdated information).

What I did was I went to: https://panopticlick.eff.org to see my digital fingerprint on the internet.
I have realized that the main reason I'm identified as "unique" is information that "System Fonts" provide. The site says that only 1 of 160000 browsers have the same fonts like me which is really bad.

My question, is there actually a way to reduce / delete / edit System Fonts in Firefox?

I went to that page using Tor Browser and realized it has way less System Fonts than me on Firefox which is why it's less unique.

What I have already tried and did not work (but might still be good to increase your safety and anonymity):

disable flash
go to about:config and set "plugins.enumerable_names" to empty string
on your computer, find your flash folder, edit mms.cfg and  add this: DisableDeviceFontEnumeration = 1

Any other ideas? This is really frustrating, I know we cannot fully protect our privacy but we can surely at least make it a bit harder for others.

Edit: Thanks to WhiteWinterWolf: On Firefox you can remove most system fonts (and thereby reduce fingerprint) by going to task bar, write: "about:config". Then there you type in search: "browser.display.use_document_fonts" and you modify this and set it either to 0 or just leave it blank. I still like to know another way where you can remove specific fonts by your own decision or even add some (without deleting them from your own computer).

Edit: Here is my evaluation (I didn't use Tor, I didn't use proxy!), tried the entire day using the provided answers here and that's the best result so far (I'm still not happy about the result but I thought I will just share it with you. Reduced from about 1:175000 to 1:21000 isn't bad actually!)

On Firefox, you may want to try the Random Agent Spoofer addon.

IMHO, this module is poorly named, probably for historical reasons, since the agent spoofing feature is completely optional and maybe not even the most interesting one.

This module should be merely seen as an anti-tracking module, gathering both specific features and Firefox tracking-related settings in a single place (including so-called "advanced" settings, like disabling WebRTC). Most Panopticlick tracking criteria can be found in its settings.

The list of available fonts can be restricted by setting Options > Standard options > Limit detectable fonts. Setting this option may however slightly alter website's look, but this should not have any major impact on usability.

While you are here, I also recommend to try disabling canvas support (Options > Script injection options > Disable canvas support) as this should tremendously improve your Panopticlick score. I'm using this since several months without noticing any impact of this setting, but YMMV.

Regarding the actual agent spoofing feature, I'm not very happy how this was implemented by this module. If you are on Windows, I would recommend letting this disabled. If you are on another OS, you may want to try to show yourself as the same Firefox version but on Windows (sadly you will have to manually select the version and manually change it after updates, that's precisely why I think this feature could be improved).

I do not recommend using randomly changing User-Agents (or even worse randomly changing screen sizes) or simulating a different browser than Firefox (as long as tracking is concerned, this may be useful for other purposes). This may be counter-productive: the goal of anti-tracking is not to make you randomly changing, as this will make you stand-out, the goal is on the contrary to blend in by looking similar to the crowd.

Do not hesitate to rely on Panopticlick's breakdown (the Show full results for fingerprinting link appearing at the end of the analysis) to determine which technique allows to most uniquely identify you. The most effective techniques will be the one you may want to address first, until you get to a reasonable privacy level.

While you play with this module, be aware that some settings may impair usability, or even break some websites. Nothing to be wary of, but just keep this in mind when you face some issues while browsing: check your own settings before blaming the website developer ;) !

Note:

Please note that I used the term reasonable privacy level, and nothing like "perfect" or "full" privacy: there is no way to be perfectly untrackable.

On a standard browser, you usually see in the "one in x browsers have this value" column from Panopticlick result details values reaching (tens of) thousands, which means that the corresponding technique alone statistically allows to uniquely identify your computer in large sets: these are the values you need to avoid since they are basically just candy for trackers.

Given the number of different hardware, operating systems, browsers, settings and versions out there, you cannot reasonably expect values below a few dozens.

If the reason behind this is not clear to you: imagine you are with two other users, a Mac user and a Windows user, which system should you impersonate so a tracking engine could mistake you for both?

This is just impossible: they are different, you cannot be equal to both. Say you are a Linux user, a third OS type, instead showing up as such show yourself as a Windows user: a tracker will still be able to distinguish you from the Mac user (hence the bits of identifying information will never be zero), but it will not be able to distinguish you (using this technique) from the Windows user (hence a lower value than if you showed up as the only Linux machine in this set of three).

The more diversity, the more identifiable become you browser without any chance to become "like everybody else". That's why on the Tor network it is recommended to not modify the Tor browser settings, in order to keep this diversity as low as possible and therefore making tracking as hard as possible.


Are there any obvious flaws in this anonymous-receiver communication method using Twitter? There might be flaws in the following method for anonymous signal reception that I'm not seeing:

Alice doesn't know who Bob is. Bob wants to Alice to notify Bob of a particular outcome without discovering who Bob is. Bob doesn't want to rely on a narrow broadcast window. Neither Alice nor Bob want any other party (Carol) to spot that Alice is notifying someone of something.

So Bob tells Alice to do the following:

The message is to be a short collection of random characters that makes prearranged sense to Alice and Bob. For example, 94e3d5b0f1 for "Yes / Proceed" and 32b6422292 for "No / Stop".
Alice responds to or uses a twitter account with lots of followers. For example, a popular celebrity or topic.
Alice creates a relevant tweet on any relevant topic which involves a URL link for more information.
The URL link is created using a custom URL shortener. The custom URL ends with the desired message. For example, http://url.short/94e3d5b0f1

Alice can not find out who Bob is amongst the thousands or millions of followers. Other followers, such as Carol, have no idea that a Boy Band tweet or someone replying to a Boy Band tweet actually acknowledged for example, a fugitive amnesty for Bugs Bunny.

Would this be a viable method for anonymous signal reception?

The protocol you describe does not fit your assumptions in the beginning.

At first, you assume Alice does not know who Bob is, but then you assume that Alice and Bob have a secret mapping of "random short messages" to some meaningful statements. This is not impossible, but then you need a way for Bob to send this mapping to Alice in the first place anonymously, and Alice to accept this... without being able to verify who Bob is.

And then, you say that you don't want Carol to know that any message has been sent at all. This isn't an anonymous receiver protocol, but a steganographic channel, where the message is entirely hidden. But for methods like these, its security depends mainly on the fact that the attacker does not know the method.

Additionally, this scheme does not scale at all for multiple receivers, because Alice would have to send a tweet for each receiver (she can't give Bob the random mapping, if she has no other way to send him messages;so each receiver had to choose his own). Now Eve can detect "secret communication messages" by simply evaluating the frequency of tweets. The only way to circumvent this is by sending more random tweets in general (and they all have to be of the "secret message possible" format)... which has to be checked by every receiver if this was a secret code for some message.

Moreover, what is keeping Eve from "subscribing" to the hidden channel herself?

Overall, using Twitter as public broadcast channel is possible. Steganography in url shorteners would also work, but steganography is always about "hiding in the crowd": If you only use this scheme for secret messages (and the attacker knows this), then your messages are no longer hidden at all. Additionally, you are limited to your previously shared secret with the receiver, which is the mapping from random urls to signals/messages. But the "anonymous receiver" part makes this really inefficient for all involved parties: Alice has to create a lot of spam-tweets, to hide sending of messages, possibly to multiple parties. And each receiver has to test every single tweet in his own "secret message mapping".


Password strength when used with 2FA We have two factor authentication, with passwords and one time code received on SMS.

Now normally I know you could restrict users to create passwords with min 8 character length, lower and caps letters, and one number.

But since we are using mobile codes together with passwords, how far can we relax requirements on password complexity? e.g. can we allow only 6 character length passwords?

Password complexity is not just for brute-force attempts on the account login, which 2FA would help mitigate. But password complexity also protects against the situation when the password hash database leaks.

2FA only helps if 2FA is turned on and enforced. If you have the option to "authorise" a device, then all the user has for protection is the shorter password.

Conceptually

But what about bruteforce detection measures? And what about resetting passwords when a breach occurs? And what about all the other layers of protection? Can't we reduce each layer if we use many layers of protection?

Technically, yes, but then you put all the effort into maintaining each layer of protection because now the failure of any one layer becomes more likely, which puts more importance on the other layers. In practice, reducing the strength of one layer artificially because you rely on other layers creates a "technical debt" that you have to address from then on.

Password length, specifically

But I have worked with accessibility experts who loved 2FA because it meant that people could have much simpler passwords. And that's not a factor to dismiss. With a password that was simple to type and a phone with a push authentication app (not SMS), people with challenges remembering or entering passwords could enjoy much greater security of their accounts and independence of maintaining their privacy (often, helpers need to log in for people).

So, as with all things about security, there is a trade-off of risks and costs. I would be happy to endorse a reduction in password complexity if it meant that users could better independently maintain their own accounts and there were mitigations in place.


How is a root certificate revoked? I know that CAs use intermediate certificates to mitigate the impact of potentially having to revoke a root CA (i.e., the need to update all browser clients on peoples computers allover the world).

But nevertheless, a root Certificate will sooner or later have to be revoked, after maybe 15  years or so. How is this done to minimise disruption to communications?

Root certificates don't need to be revoked unless they are compromised. In case they are compromised they can be revoked by placing them on a blacklist within e.g. a browser, or by removing them altogether. Obviously it's not possible to just create a CRL as there would not be a trusted private key; instead this is a out-of-order operation.

In general it's better to create a new root certificate and let the old one expire. Note that the underlying certificates should have an expiration date that is lower or equal to the expiration date of their parent. Of course the new root certificates need to be communicated securely to e.g. the browser manufacturers. How this can be done is generally communicated by the browser manufacturers, e.g. see the Mozilla policy here.


More information about CVE-2012-0883 vulnerability I need  to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883

Second, I need to know , what mean DSos mentioned on the Overview section.
 Is it necessary to have another vulnerability which allows an attacker to create an illicit dynamic library ?

And Finally, how can an attacker exploit this vulnerability ?

Access vector of this vulnerability is Local, that means this vulnerability itself can not be exploited remotely. In other words, to exploit this vulnerability a hacker has to gain access to the system by exploiting a different vulnerability.

Exploitation allows local users to gain privileges by injecting a BackDoor/Trojan horse as a DSO (Dynamic Shared Object) in the current working directory during execution of apachectl process.

Hope that helps.


Use the same IIS RSA key on all servers I am working on standardizing our server builds where we currently have three different functional pools.

For web pools I use the same IIS RSA key across all machines.  It keeps life easy and allows the application.config file to be copied between servers without issue.

My question is, is there any issue of have all servers us the same RSA key, so there is only one key pair to maintain and use when standing up new servers?

Are there security concerns with doing this were the keys should be different in different functional pools?

Main problem with sharing the same private key between several servers is that it implies that, at some point, necessarily, the private key travelled. The more a private key travels, the less private it becomes. But, of course, that's a general comment; actual context details matter.


pdfid analyzing / disarming documents causing infection? If you analyze or disarm a potential unsafe pdf file using pdfid , will it infect the machine while doing it? Is it the same with peepdf?

It generally depends on how it is unsafe. If it is unsafe because of a vulnerability in a pdf handling library used by pdfid then it may compromise that machine.

If it's unsafe because of a vulnerability in random reader, that does not affect pdfid or any of it's libraries, then no, it will not affect that machine.

As always the first step is to analyze the threat. What is the threat? What is the target of the threat? What mechanisms does the threat use to achieve this target?

If you identify that JavaScript embedded in the PDF is the mechanism, any tool that is able to strip the script, without executing it, will be perfectly safe. So will any viewer not executing it.

If the mechanism is a buffer overflow in Acrobat Reader, any reader and tool not based on Adobe code is likely to be unaffected.

Once you understand a threat, you can protect against it. This may be stripping JavaScript from PDFs, or blocking them outright if you find no effective way to protect, and the risk outweighs the benefits of allowing PDFs.


Is there any advantage to splitting a password? I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm.

The LM hash is computed as follows:

The user’s ASCII password is converted to uppercase.
This password is null-padded to 14 bytes.
The 14-byte password is split into two 7-byte halves.
These values are used to create two DES keys, one from each 7-byte half.
Each of the two keys is used to DES-encrypt the constant ASCII string "KGS!@#$%", resulting in two 8-byte cipher-text values.
These two cipher-text values are concatenated to form a 16-byte value, which is the LM hash.

There are a lot of security weaknesses outlined in the linked Wikipedia article and talked about elsewhere, but I'm particularly interested in steps 3 through 6.  I'm curious about what led to this design. Is there any real security advantage to splitting a password, encrypting the two halves separately, then combining the two halves to form one hash again?  Or is this just an example of "security through obscurity"?

Splitting the password is a weakness, not an advantage. It allows breaking each password half independently. Beginning with ASCII characters (codes from 32 to 126, inclusive), then removing the lowercase letters, you end up with 127-32-26 = 69 possible characters in the password alphabet. This leads to 697 possible halves, which is somewhat below 243. In other words, this is highly tractable through brute force. You do not even need a dictionary.

This is not security through obscurity. This is insecurity through incompetence.

Edit: "highly tractable with brute force" also opens the road for various optimizations. Note that LanMan is not salted, thus precomputed tables can be efficient (you pay the cost of table building once, then you attack several half-passwords -- it is actually worth it even for a single password, since one password is two half-passwords). In 2003, Philippe Oechslin published an improved time-memory trade-off (it is the article in which he coined the term "rainbow table") and computed tables for cracking LanMan passwords. He restricted himself to alphanumeric passwords (letters and digits, but no special signs), thus a space of 237. The cumulative size of the tables would then be 1.4 GB, with cracking efficiency of 99.9%, and attack time under one minute.

With a 243 space, i.e. 64 times larger, table size and attack time both rise by a factor 16 (that's 642/3), so we are talking about 23 GB or so (that's not much for today's disks) and a 15-minute attack. Actually, the attack would be faster than that, because the bottleneck is lookups on the hard-disk, and the smart attacker will use a SSD which can do lookups 50 times faster than a mechanical hard-disk (a 32 GB SSD costs less than 70$...). The table-building effort (a one-time expenditure) could take a few weeks on a single PC, or a few days on any decent cloud, so it is rather cheap.

Apparently, such tables already exist...


Sending access token through GET request According to Instagram's Documents, we send an access-token through a GET request over HTTPS. Isn't this considered insecure? Because I've read that you shouldn't even send passwords over a GET request.

For /media/media-id (the first example):

https://api.instagram.com/v1/media/{media-id}?access_token=ACCESS-TOKEN

As explained here, sensitive data in the URL query part (such as a secret API token) is primarily an issue if the URL is accessed directly in the browser and therefore visible in the URL bar as well as stored in the browser history.
But API requests are usually performed in the background of an app or via a background AJAX request and therefore you're much less likely to run into a situation where the plain API request URL is presented to a user. Therefore the dangers of sensitive data in the URL are negligible for an API.
Also note that over HTTPS the full HTTP request is encrypted, including the query part. Only the hostname (api.instagram.com) would be exposed to a MITM as a side effect of SNI.


What does it mean to have authentication without confidentiality or authentication without encryption? I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. What are good usage examples for these functions?

I'm taking an information security course and these functions along with others were in the slides and I looked them up and that's what I got. I still don't have a clear idea about their usage and how they are supposed to provide security for the user.

First I'll have to say that the slides you were getting this information from are not of particularly good quality - to formulate it nicely.

What is called m+H(m+k) in the presentation can actually parsed as a poor attempt at providing symmetric message authentication. If you're not sure how to parse this, the second part is: Basically what is described here on Crypto. While it will be reasonably secure if you use a good hash function as H, it's not a good example on how to really do message authentication, which would be to not bother authenticating alone (rather using GCM or something like that) or to use HMAC, which has much stronger security properties than this construction at minimal overhead.

As for the application, there are TLS ciphersuites doing basically this: Not encrypting the message, but symmetrically authenticating it. The potential use cases are so rare that I can't actually think of any (but apparently there are some or otherwise there wouldn't be any cipher suites). As an abstruse example I could imagine that if a government has banned encryption (i.e. banned all encryption algorithms), this could be the highest security level you can get, it won't hide the message, but it will ensure it hasn't been tampered in transit.

The other function m+E_{eA}(H(m)) exploits the common missconception, that encrypting with the private key is equivalent to signing a digital message. It proposes to "encrypt the hash of the message using the private key eA" to sign the message m.

This actually has many practical applications. The first one is signing contracts, i.e. you want your signature to be authentic but don't care to hide the contents of the message (as is sometimes the case with contracts). Another one would be to authorize bank transactions, i.e. authorize payments of a large amount of money. This is usually only encountered in enterprise level payment. The last really important use-case is certificates. If a trusted party signs m=your_name+your_public_key, it binds this key to you, allowing people to use this key to contact you or to verify your signatures.


are older wpa_supplicant versions vulnerable to KRACK? Are wpa_supplicant versions prior to 2.x (e.g. 0.2.x, 0.4.x, 0.6.x, 0.7.3, etc.) also vulnerable to any of the KRACK CVEs?  I've looked at the source code but it's different enough from the 2.x releases that I can't immediately tell if those old releases have the same vulnerabilities, nor what it would take to develop an effective patch.

From the published paper by Mathy Vanhoef (emphasis mine):

  Our key reinstallation attack against the 4-way handshake uncovered
  special behavior in wpa_supplicant. First, version 2.3 and
  lower are vulnerable to our attacks without unexpected side-effects.
  However, we found that version 2.4 and 2.5 install an all-zero encryption
  key (TK) when receiving a retransmitted message 3.

Based on this and the widespread nature of the flaw in 802.11i client implementation, I would tend to believe they are vulnerable. However I personally haven't seen any actual tests for those particular versions or reliable documentation other than that statement.


Is my VPN-configuration secure? Can someone tell me please if my VPN-configuration is secure enough for small business? (Point to site VPN)

IKEv1 Protocol  (aggressive mode)
PFS/IKE Group: 2 MODP-1024
individual PSK for every user

64 Characters (unique)

no xauth
IPSec over HTTPS disabled
IKE-Proposal

AES-CBC 256Bit
Hash: SHA 512Bit
Authentication:  Preshared key

IPSec Proposal

AES-CBC 256
Authentication: HMAC-SHA-512
AH-Proposal: None

Anything to worry about? How to improve the config? (The Client is Shrewsoft VPN)

I don't remember IKEv1 itself being insecure, but it has been superseded by redesigned IKEv2 since 2005, so if the software supports both, I can't think of any advantage to using IKEv1 at all.

Your chosen PFS group (DH 1024-bit) is now considered to be insecure due to its size. The Logjam website claims that currently it's only breakable by "nation states", but that's already not a good sign. These days the minimum bit size for traditional DH seems to be 2048, and recently I've seen recommendations to turn it up to at least 3072 bits. You might even want to use ECDH.

IKEv1 with aggressive mode and PSK authentication is known to be insecure, as it allows attackers to capture the PSK hash and bruteforce the PSK:

https://wiki.strongswan.org/projects/strongswan/wiki/FAQ#Aggressive-Mode
https://www.giac.org/paper/gcih/541/vpn-aggressive-mode-pre-shared-key-brute-force-attack/104625
https://security.stackexchange.com/questions/76444/what-are-the-practical-risks-of-using-ike-aggressive-mode-with-a-pre-shared-key

But if I recall correctly, IKEv1 main mode does not support using individual PSKs for "roaming" clients as it has no way to distinguish them (except by IP address). So you should use IKEv2 which does support this because each client can send a different initiator ID (rightid).


WAF Process Creation for Integration of IT and Business A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready for production. The company is fairly large and is expanding. Thus, I want to tackle the manageability of their web applications’ security by creating a process which will integrate the IT department of the company with the Business side. At the same time, I am wanting to put together what so far appears to be three different processes I am about to create into just one.

Process 1

Say an XSS attempt is detected and alerted by the WAF: I don’t want the Operational Security to simply go ahead and block the traffic coming from that IP; this decision should fall under the Business’ remit, not OpSec’s. As the WAFs have been implemented not too long ago, I am reluctant to make it block anything it does not like by default. At the moment, they do not have a dedicated database for this purpose, so a spreadsheet Tracker should be created.

A process defining how this is to be done could potentially be as simple as:

 1. Operational Security is notified of an alert against one of their
    assets.
 2. Operational Security immediately checks their Security Information
    Event Management for signs of compromise.
 3. If there is a sign of compromise, an high-priority Security Incident
    is raised and the IP is blocked.
 4. If there is no sign of compromise, the IP is not blocked, but a
    low-priority incident is raised and forwarded onto the service owner
    of the web application being attacked.
 5. Business makes a decision whether this should blocked or not based
    on certain information such as “has this IP been seen before?”
 6. Security Management logs all the activity on their Tracker.

Process 2

Another process needs to be in place for whenever an application is added to their WAFs for protection, or for when an application is removed from the WAF’s protection. This process alone is a straight forward one. Security Management logs all the activity on their Tracker.

Process 3

Finally, a perhaps little more complicated process involves tracking significant changes to an application (such as pages/parameters added/removed) that is already being protected by the WAF. This would impact the WAF’s handling of alerts. So far I thought of something like:

 1. If a project is to change any of the application’s contents, they
    should notify and liaise with Security Management
 2. Security Management sends a Questionnaire for the project to fill in.
 3. Project forwards the filled Questionnaire to Security Management.
 4. Security Management can then tune the WAFs to reflect these changes.
 5. Security Management continues to monitor the application for say,
    one week and if so, the changes are consolidated.
 6. Should any issues occur, Security Management is to liaise with the
    project to address the problem.
 7. Security Management logs all the activity on their Tracker.

Questions:

Are those three processes (in)appropriate or am I missing any
step/process of the whole thing?
Is it really better to have one process addressing all these issues,
or should they be kept as three (or more) separate processes?
Does anyone ever come across of a Tracker and/or Questionnaire template or have any
suggestions on how I should lay them out? So far I thought of having
one Tracker workbook plus one Questionnaire with three different tabs each, one for each sub-process.
Is there a better way of doing this?
Finally, how should be business' grounds for making a decision of
whether to block an IP or not?

1.Are those three processes (in)appropriate or am I missing any step/process of the whole thing?

Do you have a need to inspect SSL encrypted traffic?  Depending on where your WAF is positioned in your network, you may need a process to handle certificate provisioning and renewal with respect to how the WAFviews traffic.

I separate it into these areas:

Reacting to a potential incident

Research/forensics of detected event
Response to event

Determining correct approach to a true incident - your Process 1
Reducing the cases for false positives

Managing Change

new apps
big changes to old apps
small changes to old apps

Managing overall health

troubleshooting
upgrades
business continuity

2.Is it really better to have one process addressing all these issues, or should they be kept as three (or more) separate processes?

This has a lot to do with how you typically document processes.  As someone who works in simply ENORMOUS infrastructures and organizations, I'm always working within a hierarchy of paperwork, process and documentation - and anything you might provide in such a world, is better when it fits with the existing model.  Make it weird and people won't understand it or use it.

For a growing organization that is currently smallish, but hoping to be bigger - my big caveat is that the first breakout should be organization or discipline related, and each process is grouped by the trigger that causes it.  So, ideally, you end up with chunks that are isolated as clearly as the people are.

My experience is that operational folks and developers are such different gene pools that they almost count as different species.  They may use similar words, but how they approach a single tool, protocol or idea can be radically different.  For this reason, my first breakdown would be there:

1 - Ops Guide - available to the operations team, preferably folded into existing processes for things like firewalls.

what to do when an incident is detected by the WAF

known likely cases
unknown process (what to do when you don't know where to start)
includes handoffs to developers - where do you go to write a bug report for a false positive?  What do you do when you need a developer to help you research the issue? etc.

guidelines for scope of resonsibility
guidelines for managing risk and when/where to get approval on a risk

2 - WAF Maintenance guide - for which ever team is maintaining this component.  WAFs are funny - could be your boundary control guys (the firewall gang), could be web server support, could be something else.  Depends on the architecture and the organization

3 - Software Deployment & Maintenance - for any server protected by a WAF - how to deploy software to a WAF protected site, how to help debug a WAF incident.

Basically separate process to the extent where you can link them to the places where people working with WAFs or web servers will normally look.

3.Does anyone ever come across of a Tracker and/or Questionnaire template or have any suggestions on how I should lay them out? So far I thought of having one Tracker workbook plus one Questionnaire with three different tabs each, one for each sub-process.

Not that I can share.  I use corporate protected formats for most of this.

4.Is there a better way of doing this?

Realize, in addition, that what ever you create here is a living document.  It may be an XSS attack today, it may be something different tomorrow.  You want to create processes that build a knowledge store, automation where possible, and a way to clearly communicate (both in a crisis and to prevent a crisis).

5.Finally, how should be business' grounds for making a decision of whether to block an IP or not?

WAFs block a lot more than IPs - if you specifically look for IPs, I think you are trying to block individual trees in a forest.  For IP blocking, specifically, I'd think that any organization using a WAF is also using a firewall, and IP blocking would be managed in a way consistent with any firewall type process for the same thing.

Risk-wise, across the board - there should ideally be a consistent structure regardless of the nature of the risk - blocking the behavior of known bad attackers, blocking vulnerabilities of known attack profiles, etc. - there should be an entity at a fairly high level whose job is to weigh the risks.  The tradeoffs boil down to:

the risk to security of the overall system and business to leaving the weakness in place (allowing what you are currently allowing)
the risk to business operations in strengthing defenses - what can't you do when you block the threat?
the cost to doing it/not doing it

The person making the decision is usually a high level person who can take accountability within the organization.  Often it's the ISO - Information Security Officer.  But someone who is high up enough to see the business and not just the IT side if it.  Chances are that some stuff will boil up into general guidelines - so this person isn't going IP by IP - he's setting out some rules - if the IP attacks are bigger than some metric, definitely block... etc.


XAMPP/Chrome net::ERR_CERT_INVALID on VALID Certificate Chain I have set up my own Root CA and Intermediate CAs for my local sites (virtual sites). I also have installed them to trusted certificates in my computer and also the intermediate CAs on their own folder in the cert market of my computer.

However, when I open my website in a browser it finds my certificate invalid. What could be the fix to this? Please consider pictures below.

I use Yandex Browser (almost the same as Chrome Browser)

I ran into the same situation today: self-signed CA (registered as trustworthy CA) and server certificate signed by that CA.

Firefox and Edge accepted the certificate
Java accepted it as well (JAX-RS request with CA in truststore)
but Chrome rejected it with ERR_CERT_INVALID.

The CA and server certificate both used EC-256 key material.

When I recreated the CA and server certificate, using RSA-2048 keys instead of Elliptic Curves, the certificate chain was accepted by Chrome.

Seems to be an ECC issue with Chrome and other Chrome based user agents (such as Postman, which also wouldn't connect when using ECC keys).