How to identify the right hash from a list of salts and pre-given password during authentication? I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online.

From what I've gathered, the safest-without-sacrificing-efficiency way to securely store a password is to add a pepper, generate a random salt, and then hash all three (password + pepper + salt).

When a user attempts to login, the program would then check to see if the hash matched the hash in the database associated with the username. Since you need a salt (and hard-coded pepper) to hash the password with any hope of success...

Do you need to try hashing every single salt in your database?
If you have a million salts, wouldn't that be very slow?
Is there a better way to do this?

Someone is trying to log in. That means they've provided two things:

Who they claim to be.
Something they claim proves they are that person.

The salt should be tied to #1, as it's unique per user (and globally, but especially unique within your own database). Then you can just look up the user's information in your database, and the salt will be part of the information you retrieve.

The pepper is a single value added to all of the passwords to be hashed, but IMO it should not be hardcoded. Constant, yes, but if you keep it as an environment variable in the server or loaded at runtime from a file, then an attacker has to compromise your production webserver, not just the source code.

However, in general, the fact that you're worrying about salts as part of your webapp implies you're doing something wrong. You seem to largely understand how salts work, but unless this is an exercise whose whole point is implementing your own password hashing, you should really just use a standard solution. bcrypt has been the standard for years, and Argon2 is increasingly popular as well.


Difference between linux capabities and seccomp I know seccomp (secure computing) is a way to restrict a process from making particular system calls.
While linux capabilities provides a way to give privileges to specific user or process.
So if I want to disable a process from making raw network connections. I can drop the NET_RAW linux capability of that process or either use seccomp to restrict that process from making system calls relevant to raw network.
I want to know exact difference between linux capabilities and seccomp.
Also is it that linux capabilities use seccomp internally or is it other way round or they both are completely different?

I want to know exact difference between linux capabilities and seccomp.

I'll explain the exact differences below, but here's the general explanation: Capabilities involve various checks in kernel functions reachable by syscalls. If the check fails (i.e. the process lacks the necessary capability), the syscall is typically made to return an error. The check can be done either right at the beginning of a specific syscall, or deeper in the kernel in areas that might be reachable through multiple different syscalls (such as writing to a specific privileged file).
Seccomp is a syscall filter which is applied to all syscalls before they are run. A process can set up a filter which allows them to revoke their right to run certain syscalls, or specific arguments for certain syscalls. The filter is usually in the form of eBPF bytecode, which the kernel uses to check whether or not a syscall is permitted for that process. Once a filter is applied, it cannot be loosened at all, only made more strict (assuming the syscalls responsible for loading a seccomp policy are still allowed).
Note that some syscalls cannot be restricted by either seccomp or capabilities because they are not real syscalls. This is the case with vDSO calls, which are userspace implementations of several syscalls that do not strictly need the kernel. Attempting to block getcpu() or gettimeofday() is futile for this reason, since a process will use the vDSO instead of the native syscall anyway. Thankfully, these syscalls (and their associated virtual implementations) are largely harmless.

Also is it that linux capabilities uses seccomp internally or is it other way round or they both are completely different.

They are implemented completely differently internally. I wrote another answer elsewhere on the current implementation of various sandboxing technologies explaining how they differ and what they're for.
Capabilities
Many syscalls which do privileged things may include an internal check to ensure that the calling process has sufficient capabilities. The kernel stores the list of capabilities that a process has, and once a process drops all of its capabilities, it cannot get them back. For example, trying to open /dev/cpu/*/msr for writing will fail unless the process calling the open() syscall has the capability CAP_SYS_RAWIO, even if the character device's permissions allow write access. This check is agnostic to the syscall used to open it (e.g. openat() cannot bypass this restriction). This can be seen in the kernel source code responsible for modifying MSRs (low-level CPU features):
static int msr_open(struct inode *inode, struct file *file)
{
    unsigned int cpu = iminor(file_inode(file));
    struct cpuinfo_x86 *c;

    if (!capable(CAP_SYS_RAWIO))
        return -EPERM;

    if (cpu >= nr_cpu_ids || !cpu_online(cpu))
        return -ENXIO;  /* No such CPU */

    c = &cpu_data(cpu);
    if (!cpu_has(c, X86_FEATURE_MSR))
        return -EIO;    /* MSR not supported */

    return 0;
}

Some syscalls won't run at all if the correct capability is not present, such as vhangup():
SYSCALL_DEFINE0(vhangup)
{
    if (capable(CAP_SYS_TTY_CONFIG)) {
        tty_vhangup_self();
        return 0;
    }
    return -EPERM;
}

Capabilities can be thought of as broad classes of privileged functionality that can be selectively removed from a process or user. The specific functions that have capability checks vary from kernel version to kernel version, and there is often bickering between kernel developers over whether or not a given function should require capabilities to run. Generally, reducing capabilities from a process improves security by reducing the number of privileged actions it can perform. Note that some capabilities are considered root-equivalent, meaning that, even if you disable all other capabilities, they can, in some conditions, be used to regain full permissions. Many examples are given by the creator of grsecurity, Brad Spengler. An obvious example would be CAP_SYS_MODULE which allows loading arbitrary kernel modules. Another would be CAP_SYS_ADMIN which is a catch-all capability nearly equivalent to root and allows many administrative actions to be taken.
Mode 1 seccomp
There are two types of seccomp: mode 1 (strict) and mode 2 (filter). Mode 1 is extremely restrictive and, once enabled, only allows four syscalls. These syscalls are read(), write(), exit(), and rt_sigreturn(). A process is immediately sent the fatal SIGKILL signal from the kernel if it ever attempts to use a syscall that is not on the whitelist. This mode is the original seccomp mode and does not require generating and sending eBPF bytecode to the kernel. A special syscall is made, after which mode 1 will be active for the lifetime of the process: seccomp(SECCOMP_SET_MODE_STRICT) or prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT). Once active, it cannot be turned off.
Following is an example program that securely executes bytecode which returns 42:
#include <unistd.h>
#include <stdint.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <linux/seccomp.h>

/* "mov al,42; ret" aka "return 42" */
static const unsigned char code[] = "\xb0\x2a\xc3";

void main(void)
{
    int fd[2], ret;

    /* spawn child process, connected by a pipe */
    pipe(fd);
    if (fork() == 0) {
        close(fd[0]);

        /* enter mode 1 seccomp and execute untrusted bytecode */
        prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);
        ret = (*(uint8_t(*)())code)();

        /* send result over pipe, and exit */
        write(fd[1], &ret, sizeof(ret));
        syscall(SYS_exit, 0);
    } else {
        close(fd[1]);

        /* read the result from the pipe, and print it */
        read(fd[0], &ret, sizeof(ret));
        printf("untrusted bytecode returned %d\n", ret);
    }
}

Mode 1 is the original mode, and was added for the purpose of making it possible to execute untrusted bytecode for raw computations. A broker process would fork a child (and possibly set up communication via pipes), and the child would enable seccomp, preventing it from doing anything but reading to and writing from file descriptors that are already open, and exiting. This child process could then execute untrusted bytecode safely. Not many people used this mode, but before Linus could complain loudly enough to kill it, the Google Chrome team expressed a desire to use it for their browser. This created renewed interest in seccomp and saved it from an untimely death.
Mode 2 seccomp
The second mode, filter, also called seccomp-bpf, allows the process to send a fine-grained filter policy to the kernel, allowing or denying entire syscalls, or specific syscall arguments or ranges of arguments. The policy also specifies what happens in the event of a violation (for example, should the process be killed, or should the syscall merely be denied?) and whether or not the violation should be logged. Because Linux syscalls are kept in registers and thus can only be integers, it's impossible to filter the memory contents that a syscall argument might point to. For example, although you can prevent open() from being called with the write-capable O_RDWR or O_WRONLY flags, you cannot whitelist the individual path that is opened. The reason for this is that, to seccomp, the path is nothing more than a pointer to memory containing the null-terminated filesystem path. There's no way to guarantee that the memory holding the path hasn't been changed by a sibling thread between the seccomp check passing and the pointer being dereferenced, short of putting it in read-only memory and denying memory-related syscalls access to it. It's often necessary to use LSMs like AppArmor.
This is an example program using mode 2 seccomp to ensure it can only print its current PID. This program uses the libseccomp library which makes creating seccomp eBPF filters easier, although it is also possible to do it the hard way without any abstracting library.
#include <seccomp.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>

void main(void)
{
    /* initialize the libseccomp context */
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);

    /* allow exiting */
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);

    /* allow getting the current pid */
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getpid), 0);

    /* allow changing data segment size, as required by glibc */
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0);

    /* allow writing up to 512 bytes to fd 1 */
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 2,
        SCMP_A0(SCMP_CMP_EQ, 1),
        SCMP_A2(SCMP_CMP_LE, 512));

    /* if writing to any other fd, return -EBADF */
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EBADF), SCMP_SYS(write), 1,
        SCMP_A0(SCMP_CMP_NE, 1));

    /* load and enforce the filters */
    seccomp_load(ctx);
    seccomp_release(ctx);

    printf("this process is %d\n", getpid());
}

Mode 2 seccomp was created because mode 1 obviously had its limitations. Not every task can be separated into a pure-bytecode process that could run in a child process and communicate via pipes or shared memory. This mode has far more features and its functionality continues to be slowly expanded. However, it still has its downsides. Safely using mode 2 seccomp requires a deep understanding of syscalls (want to block kill() from killing other processes? To bad, you can kill processes with fcntl() too!). It is also fragile, as changes to the underlying libc can cause breakage. The glibc open() function, for example, no longer always uses the syscall of that name and instead may use openat(), breaking policies which whitelisted only the former.


IFrame Vulnerability Classification I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to google analytics from a website we can call tracking.com. When visiting the example website there is an iframe to the tracking website. The source of the iframe can be seen below.

<body>
<script type="text/javascript">
     ((function (e, t)
     {

          var n = function () {
               var e = t.createElement("iframe");
               e.src = "https://tracking.com/container/?utm_source=[INJECT];
               e.style.cssText = "position: absolute";
               t.body.appendChild(e)
          }

          if (t.readyState === "complete")
          {
               n()
          }
          else
          {
               if (typeof e.addEventListener !== "undefined")
               {
                    t.addEventListener("DOMContentLoaded", n, false)
               }
               else
               {
                    e.attachEvent("onload", n, false)
               }
          }
     })(window, document));
</script>
</body>

The example website also has a parameter called utm_source, into which javascript can be injected into the iframe (where I placed [INJECT] in the code above). For example, visiting https://example.com/?utm_source=";</script><script>alert(document.domain)</script> yields the alert embedded page at tracking.com says tracking.com. The issue is that the tracking website is not in scope of the bug bounty and I am not even sure that the issue is caused by the tracking website. It seems like the example website allows the user to inject arbitrary JS into the iframe of the tracking website. Is this a bug worth reporting or am I missing some easy way of escaping the iframe?

So far I have tried injecting </iframe> and things like e.onload=alert(1)to escape the iframe but have not been successful. Since the example and tracking websites are on different domains I cannot access things in the parent website (example) from the tracking website due to the "X-Frame-Options" header set to "SAMEORIGIN".

As a beginner this bug has me very confused as to how it should be classified and if it is exploitable in any way. Any tips would be greatly appreciated!

From your description, it seems that example.com is properly handling the user-supplied value (ie you are not injecting into the given script / e.src, which is why what you tried didn't work). You can inspect the DOM of example.com to verify this.

Instead, example.com treats the value properly as string and passes it on to tracking.com which in turn handles it insecurely (you could verify this by directly visiting https://tracking.com/container/?utm_source=[INJECT], but given that it's out of scope, I'd try to avoid that; if you still have the HTTP logs from your accidental triggering on tracking.com, you can likely check those).

Given the above, and assuming that tracking.com isn't trusted by example.com in some other manner (eg accepting or sending interesting postmessages, CORS, etc), the SOP will prevent most malicious actions.

What you are left with is often called a frame injection. It might allow:

If example.com has sensitive GET parameters on a page where it frames tracking.com, and if it does not take measures to protect these, you may be able to log those.
You may be able to bypass some Clickjacking protections (see here).
You might be able to navigate away from example.com via top.location.href="http://www.evil.com"; (akin to tab nabbing)
You could inject your own content in place of the ads from tracking.com (defacement).
you may be able to steal focus from example.com via this.focus(); and log user keystrokes in the hope of intercepting sensitive information from inattentive users (if it works it will impact usability on example.com, so it's a very noisy attack, with a bit of application-level DOS thrown in).

If you want to test any of these, I'd probably redirect traffic to tracking.com to a host I control via /etc/hosts to avoid further hitting out of scope domains.

Whether you want to report this to example.com depends strongly on the program. Some would likely consider it out of scope (tracking.com is the vulnerable site after all) or informative (eg the tab nabbing impact example). But if you can show impact on example.com and especially if you can show how example.com may prevent it themselves (eg preventing referer leaks), it might be worth a try.


What are the risks of installing a CA on the same machine as OpenVPN server? Digital Ocean states in one of it's tutorial about OpenVPN server :

  While it’s technically possible to use your OpenVPN server or your
  local machine as your CA, this is not recommended as it opens up your
  VPN to some security vulnerabilities. Per the official OpenVPN
  documentation, you should place your CA on a standalone machine that’s
  dedicated to importing and signing certificate requests.

I couldn't find an explanation from OpenVPN documentation regarding this matter. What are those 'security vulnerabilities' Digital Ocean is talking about ?

The OpenVPN documentation being referred to is the Getting started How-To on the OpenVPN Wiki. Specifically, this paragraph:

  BEWARE: One common mistake when setting up a new CA is to place all the CA files on the OpenVPN server. DO NOT DO THAT! A CA requires a private key which is used for signing the certificates your clients and servers will use. If you loose control of your CA private key, you can no longer trust any certificates from this CA. Anyone with access to this CA private key can sign new certificates without your knowledge, which then can connect to your OpenVPN server without needing to modify anything on the VPN server. Place your CA files on a storage which can be offline as much as possible, only to be activated when you need to get a new certificate for a client or server.

The concern is that if the CA's private key is ever stolen, the attacker could issue themself valid certificates for your VPN. Those certificates could be used to either fool your client into connecting to a rogue VPN server (letting the attacker spy on or modify your traffic) or fool your server into accepting a connection from an unauthorized client (allowing the attacker to use your VPN).

Keep in mind that if you're only ever planning to run a single VPN server, any attacker who compromises your VPN server will gain the ability to control and monitor any traffic that flows through that server anyway, even if they can't steal your CA's private key. For that reason, you may find storing your CA key as a private root-owned file on your VPN server to be an acceptable risk.

On the other hand, even in that scenario there may be some minor benefits to keeping your CA key on a separate machine:

A compromised VPN server might be easier to detect than a stolen CA certificate
You would be partially protected from attacks that can steal information from your VPN server but not gain control of it
Recovering from a compromised server might be slightly easier, depending on whether or not you find it easier to deploy a CRL to all clients than to deploy a new CA certificate to all clients

It's up to you whether or not you consider those benefits to be worth the possible inconvenience of keeping your CA on a separate machine.

If you're planning to run multiple VPN servers, keeping your CA private key on a separate offline machine is more important, as doing so prevents the compromise of one VPN server from affecting the security of other servers.


What does this mismatching SSL certificate hint at? I'm currently visiting China, and I use a well known VPN service for both my laptop and my phone.

Every now and then, I get certificate errors when using my phone when I'm connected to a VPN, but this never happens on my laptop.

Currently I'm trying to access m.facebook.com and I get a warning that the certificate is mismatching. I have one here now that says that the certificate presented belongs to someone with a "common name" that is a ip address that goes to a hosting provider in Germany. I get this both while being connected to a Hong Kong and a Taiwan VPN server.

Is it reasonable to assume that this is an attack, or could this kind of issues have natural causes? If this is an attack, what kind of attack vectors could fit into this description?

Update

Well, when you speak of the devil... I just experienced this issue from my laptop as well. And the mismatching certificates seem vary in a arbitrary way, the latest are issued by 144.76.99.230, *.sslserve.jp, RapidSSL SHA256 CA - G3, webmail.elclubexpress.com. The local malware theory seems to weaken?

I have another VPN provider as well for backup (these things are unstable in China), and I have not experienced these issues on that provider.

Is it reasonable to assume that this is an attack, or could this kind
  of issues have natural causes?

It can be an attack or just really badly implemented login portal or something like that.

Does it happen only on facebook or on any site you try to access?

What it is saying is that the SSL certificate presented to you does not match the site you are trying to connect to.

If this happens only on some sites, yes, it looks like an attack.

  If this is an attack, what kind of attack vectors could fit into this
  description?

Probably someone is sniffing your connection. By accepting a fake certificate,you establish a SSL connection to the attacker, not to the facebook server. The attacker MAY redirect the data to and from the facebook and you. Therefore the attacker can intercept your data and communication on facebook.


How to check for null byte injection in Java webapp Looks like Null Byte Injection is possible in Java apps. see: Is null-byte injection possible in Java filenames?

So how does one protect against it? Inspect all the bytes of the filename for a 0 (zero) byte?

Correct.  If you allow untrusted input to affect any part of a filename, then you should apply proper input validation to protect yourself from attacks.  You will need to protect yourself against not only null byte injection, but also path traversal and other attacks.

My recommendation is to apply the following checks:

Ensure that the filename is not "" (the empty string), "." (the current directory), or ".." (the parent directory).
Ensure that the untrusted input does not contain any slashes, as they can be used to separate directories and thus might enable a path traversal attack.  To be portable and secure, I suggest you check that it does not contain any instance of File.separatorChar (the directory separator) nor of '/' (as '/' also works as a separator on Windows, even though it is not the value of File.separatorChar).
Ensure that the path does not contain any '\0' characters (NUL bytes), as they can be used to mount a nul byte injection attack.
Check that the filename corresponds to a normal file, using File.isFile().  The purpose here is to ensure that the file does not correspond to a platform-specific special file.

For instance, on Windows, the filename PRN is reserved and treated specially: it refers to the printer.  Moreover, PRN is interpreted globally: if you access the file \Foo\Bar\PRN, Windows interprets this as referring to the printer (and in general, PRN is special in every directory).  There are a range of Windows reserved files like this.  You want to make sure the attacker is not tricking you into opening one of these reserved files.

Note that checking with File.isFile() before opening the file is not atomic in the presence of concurrent updates.  Therefore, if there are other processes on the system that might concurrently modify the filesystem and might be influenced by untrusted inputs, this check might not be sufficient: you might want to explicitly check whether the last component of the path matches any of the Windows reserved filenames.  Here's the list of Windows reserved filenames I'm aware of: CON, AUX, COM1, COM2, COM3, COM4, LPT1, LPT2, LPT3, PRN, NULL.  (I suspect that this list is probably incomplete.)

If you want to see some code from a separate project that contains these sorts of checks, albeit for a slightly different purpose, here's an example.


Are Content-Security-Policy nonces designed for production use, or as a stop-gap when implementing a CSP? Some websites use Content-Security-Policy nonces in order to include inline styling and script in their webpages.

Is the CSP nonce feature designed to be used for production use, or is it simply there as a stop-gap solution in order to help facilitate the potentially long and complex transition to a fully locked down CSP?

In so far as major browser support and working as advertised, then yes CSP nonce is suitable for production use. For cases where business reasons prevent changes to the website then it is still superior to not having a CSP or one that allows all unsafe-inline sources.

However as you hint at, using inline sources should be avoided where possible and nonces are meant as one way to work around the problem. The CSP specification even goes to note:

  Using a nonce to whitelist inline script or style is less secure than not using a nonce, as nonces override the restrictions in the directive in which they are present. An attacker who can gain access to the nonce can execute whatever script they like, whenever they like. That said, nonces provide a substantial improvement over 'unsafe-inline' when layering a content security policy on top of old code. When considering 'unsafe-inline', authors are encouraged to consider nonces (or hashes) instead.

One of the biggest security benefits of CSP is exactly to prevent the running of inline scripts and inline styles. Hence the nonce and hash solutions should only be used if you really have no other choice.


How secure is connecting to the Internet via Windows XP (or even older) nowadays only for e-mail? While trying (and failing) to convice a certain older person who wanted me to "fix" their ~20 years old PC that they should not be connecting to the Internet with whatever version of Windows they have installed (they couldn't tell me) and they should rather buy a new PC I resorted to arguments of this sort:

  The development cycle of software goes more or less like that: (a) A company releases software; (b) Usually in a short time security holes are found, some of them are published; (c) Exploits ("lockpicks") may be made and released to the public that allow your middle-school kid next door to break into your computer with little effort; (d) Some people try to automate such attacks, trying to target many computers connected to the Interned in a bulk; (e) After some (hopefully) short time the company releases a security patch that closes this hole, but (f) before users apply this patch they are open to all sorts of attacks (g) which is why it is recommended to apply updates as soon as possible and to only connect to the internet with up-to-date software, but (h) Windows XP stopped receiving such fixes in 2014(!)

I was pretty much repeating what I had been told.

Still, the person in question is still running their grossly out-of-date Windows version to perform the tasks they need to perform, which mainly boils down to receiving and sending important e-mails and using office software to read/edit/create attachments. When told about security their response was "Am I working in a three-letter agency?" and also "Who am I, a millionaire? Why would I be of any interest to anyone?"

I am wondering... Maybe they're correct? Security is not a binary thing, after all. It can only be sufficient or insufficient for a given threat model for a given situation.

In this situation, despite that their PC is theoretically open to all sorts of exploits:

I suppose routers / modems nowadays employ NATs / firewalls which while not perfect are enough to stop most of the en-masse portscanning? So their security should rise by the fact that they, by necessity, use the hardware from their ISPs?
Also, the use of such old Windows systems is in such a decline nowadays do people even bother looking for vulnerabilities in those en masse? So are they going to get infected only by the fact that they connect to the internet?
Gmail website and expected e-mails from trusted people are not going to contain malware as well...
If they were targetted then of course the above considerations would not apply but as they say, are they going to be specifically targetted?

I am wondering if counterintuitively, their setup is not actually secure enough for their peculiar purposes?

The argument "I am not of interest to anybody. Why would anybody want to attack me?" assumes that an attacker would only take one specific angle - that of a targeted attack.

However, more often than not, criminals will just run automated scripts that check for vulnerable machines and try the attack that will most likely work for that machine. Depending on the exploit, they can then use that machine for a number of malicious purposes, such as:

Sending out spam
Using it as proxy for other attacks
Deploying ransomware
Conduct DDoS attacks
Distribute malware
Etc.

  But what about NAT and firewalls?

It depends on your setup and the kind of exploit. For example, Windows XP doesn't support modern browsers, so you are stuck with legacy versions of other browsers. Just to illustrate this, the last version of Chrome available for Windows XP was Chrome 49, which came out in February 2019. That means any bug fixed after that date will forever stay on Windows XP.

If you are stuck with an old browser, you open yourself up to all kinds of horrible browser-based exploits, which attackers can easily employ on the web. A firewall or a NAT will not help you at all there.

  Are people even bothering to look for vulnerabilities in such old software?

Surprizingly, yes. Usually not specifically to Windows XP, but if someone were to find an exploit in some software, the vendor will then attempt to find when the bug was introduced in order to see who is affected.

In many cases, the bug was introduced in a very old version of the software, and if that happens to be the one you are using, then you're out of luck.

Furthermore, new technology to increase security gets employed. HSTS or OCSP Stapling, just to name some. If you use a legacy OS with legacy software, you will not have access to any of those, which will mean you are worse off.

  But I only receive e-Mails from trusted parties. I'm not in danger!

Yes, until you don't. Forging an e-Mail to look somewhat passable is not as difficult as it may seem. Phishing is a difficult topic, because many people will think that they "are too smart to fall for this", until they're in a hurry once, just quickly want to check their mails and open an attachment. Sadly, their version of Office was too old to detect the macro in the document was issuing OS commands in the background.

  But is it not secure enough?

Let me ask you a different question: Why are you not just getting a modern OS?

If all you do is check your e-Mails once in a blue moon or play some Solitaire, then get yourself a modern Linux distribution. Lubuntu, for example, runs decently well, even on Windows XP-era hardware.

And if your hardware is up-to-date and you just miss the look-and-feel of Windows XP, then use Windows 10 and get yourself one of the billion tools that make it look like Windows XP.


Why was the BEAST attack previously considered implausible? Can someone explain why the BEAST attack wasn't considered plausible? I saw an article quoting the creator as saying 'It is worth noting that the vulnerability that BEAST exploits has been presented since the very first version of SSL. Most people in the crypto and security community have concluded that it is non-exploitable' (http://threatpost.com/en_us/blogs/new-attack-breaks-confidentiality-model-ssl-allows-theft-encrypted-cookies-091911) and several other articles mentioned that the attack was previously though implausible but I don't know why.

The attack requires cooperation between an outer component (which can intercept traffic) and an inner component which runs on the attacked machine and is able to inject arbitrary data (chosen by the attacker) within the SSL tunnel, along with the piece of data which is to be decrypted. The general view among most people in the crypto and security communities is that when the attacker can do that, he has enough control on the attacked machine that he can be considered to have already won. A fix was nonetheless published in TLS 1.1 (published in 2006) and ulterior versions.

It so happens that with 2011's Internet, there can be a considerable amount of hostile code running on the user's system, through Java and/or Javascript, and such code has considerable power over what happens on said system. This is the kind of über-attacker that was envisioned and declared as "not plausible in practice" back in 2006. Note that BEAST is as yet unpublished except through some slides, so while it has run successfully in lab conditions, it is unclear whether it would be worth the effort to build it in the wild. After all, it seems that nobody ever bothered decrypting 40-bit SSL connections on a regular, industrial basis, despite the computational ease of doing so (that "nobody" is about attackers who are after credit card numbers and banking access passwords, not governmental security agencies -- if your country's secret service does not routinely decrypt 40-bit SSL, then you are entitled to question what the heck they do with your tax money).

One way to see it is that crypto and security researchers, and/or Web browser vendors, failed to envision the evolution of the Web architecture. Another way to see it is that browser vendors are hard at work building a Web structure which is, security-wise, doomed from start.


How does someone check for malware in his machine's firmware? We've all probably heard of firmware rootkits and other malware by now.

But how do you check if your firmware is infected?

And if you have been infected, how do you get rid of it?

You either need to compare the binary stored in the device with a known safe copy (either by checking a signature or comparing for byte equality with a copy provided by the vendor) or look for symptoms. Both of these are easier said than done.

If comparing a binary how do you get a copy from the device? If by requesting it via some kind of API the firmware offers how do you know the firmware is actually returning itself? Some devices will offer hardware mechanisms to dump rom contents - although attaching a JTAG isn't exactly convenient / easy to perform on a regular basis.

Symptom detection is similar to normal software based malware. Unusual behavior, network traffic etc. The difficulty of this depends on the malware itself.

In theory something well written enough on devices where the firmware controls all IO mechanisms could be impossible to identify until it decides to be malicious - and for all you know this could be triggered remotely.


Set Cookie in XHR response : How different browsers handle this? If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy  in response.
How different browsers handle this?

Does any version of any browser set the cookie for example.com, so that it will travel in subsequent requests(requests in compliance to SOP) to example.com

I'm not sure if browsershots will handle this - since it seems to be mainly focused on looks, rather than behaviour.

An XHR response, if it issues a "Set-Cookie" header, it will be included in further requests.  From http://www.w3.org/TR/XMLHttpRequest:

 If the user agent supports HTTP State Management it should persist, discard
 and send cookies (as received in the Set-Cookie response header, and sent in
 the Cookie header) as applicable.

I just tested in FF13, and XHR requests set cookie values.


Determining source port Working on a project where I have to determine the source TCP port used for an executable program (Meaning, when the program is running, what TCP port would it use to connect to the remote location).

Now because it's only a project, it isn't a real program. When you run the program you just pops open a cmd prompt window and closes it, almost instantly. I've tried running the program and quickly running Nmap to see what I could see, but the program shuts down too quickly.

I'm only an amateur so I know I am missing something. Would the source code somehow list which TCP port it will use to make the connection? I already know it will connect to port 8080. Or is there a program that logs network/port activity?

I've tried to use PID with command prompt as well to help track the program, but each time it runs, it comes up as a new PID (obviously).

As the connection is transient, using netstat or similar wont be an option.

If you know at least the name of the executable and/or the destination IP address it connects to, you can run WireShark to capture the traffic.

Although WireShark is confusing to begin with, all you need is the port details which won't be too hard to get.

You need to install WireShark (it will likely want you to install another small app, pcap, that allows it to talk in a special way to the network card). Run it and configure it to only capture data for the single executable and the destination IP address if you know it. Otherwise you will get too much confusing detail to make anything out.

Job done.


Is strong cryptography legal across the internet? In many countries strong cryptography is outlawed. That means you must store the data of your users in such a way, that government of that country can always decrypt it. And if you don't, you are a criminal.

Suppose, someone is an author of some security software (instant messenger, disk encryption, whatever), that utilizes strong security without any loopholes for governments and where encryption keys really belong to client only so author can provide no way of decrypting anything without changing the whole system's architecture. This software is sold or otherwise distributed on the net and it's legal to do that in the country of author's residence. Suppose also, that this software became so popular, that even Ben Laden decided to use it.

As I understand, the author can be arrested as soon as he crosses the boundary of any country where strong cryptography is illegal, being accused in helping terrorists, if for example, a legal case against Ben Laden is in process there and your cryptographic product is protecting the terrorist's data. Is that correct?

So, technically, if you invent a knife and some knife is used both to cut bread and to kill people, you are ok. But if you invent cryptography, that can serve the privacy of both good and bad people, you are in trouble?

Realistically, although there are a couple of countries who may arrest you for authoring a product which is illegal in that jurisdiction, they do this in breach of international law. caveat: I am not a lawyer, but deal a lot with international regulations around security works, and the real situation is as follows:

I could happily write an encryption product (well, it may not be very good, as I'm not a cryptographer, but anyway) which I pop onto the Internet - perfectly legal in my country.

(This wasn't the case in the US not so long ago - it was the exporting that was the issue, as the US government thought they could control strong crypto. This was nonsense as others around the globe were developing strong crypto as well, and the eventual relaxing of the rules was forced by people like Zimmerman exporting books with the algorithms in - which were protected under 'free speech' in the US. Some strong crypto still counts as munitions there though...)

But in any case, unless your particular country has export restrictions, you can pop crypto code up on the web. (Some draconian countries, such as the US, can put pressure on their residents to enforce access controls on some types of data to try and prevent it being accessible from prohibited countries, but realistically, if something is on a bit of the Internet, it is on The Internet)

The countries which may arrest you for providing code onto the Internet which is legal in your own country could only do it if you were on their own soil, and against all international guidance. I'm thinking of the countries that can arrest you for saying the wrong thing about someone in power, for example - which goes against most human rights legislation anyway.


Can a 32-bit virus infect a 64-bit executable in Windows or Linux? I've wondered whether a virus, originally written for 32-bit executable, can infect 64-bit executable successfully?

All 32-bit instructions are valid 64-bit instructions, right? So, only the ABI may break things?

How should a 32-bit virus be adjusted (if neccessary) to target 64-bit executable?

I'm interested in answers for Windows or Linux family of operating systems, i.e., virusses written with the purpose of infecting PE or ELF binaries.

It depends on what vulnerability is exploited by the virus. Some vulnerabilities are highly specific and would only work on a specific version of the library, even within the same architecture. Others are more general and can only be used against a wide range of versions and can be easily portable between architectures and even operating systems. For example, browser exploits (JavaScript or browser plugins) often runs cross platform, so it's often used to then select and deliver a platform-specific exploit.


Need references about why public access to a password hash and salt is poor practice What are some published industry standards about why revealing the password hash and salt are poor or bad practices from a security perspective?

I am dealing with a vulnerability where anyone can anonymously obtain the password hash and salt remotely.  The fix is to use a secure and long password (12+ characters).  The hashing algorithm is HMAC-SHA1.

I need solid references for why disclosure of the password hash and salt is a poor practice even with a long password.

What is bad in revealing the password hash-and-salt is that it allows offline dictionary attacks: since the password hash and the salt are sufficient to verify a potential password, then, by definition, they allow an attacker to try passwords on his own machines, limited only by the number of PC (or other hardware) he can muster. This contrasts with online dictionary attacks, where each try must go through your server, and your server will not accept to try billions of passwords per second.

Password hashing is a second line of defence. You don't want attackers to obtain enough information to run offline dictionary attacks; but when they do, you at least prefer it if they have to pay the full price of the attack, i.e. you show them only password hashes, not the passwords themselves. Plus, you want a slow hash function (with millions of iterations), and the salt to prevent parallel attacks and other similar optimizations (like precomputed tables).

All of this is about protection of passwords, as in "secret data that human users remember". Human brains being what they are, passwords tend to be vulnerable to dictionary attacks. However, if you can convince your human users to remember sequences of 20 random letters (not sequences that they choose themselves, but randomly generated letters), then you can show the hash values, because sufficiently random passwords are out of reach of dictionary attacks anyway -- arguably, these are no longer passwords but keys. Note that this is not a matter of length but of randomness: a password is not strong because it is long, but because it was produced with enough randomness in it; you just need length to make room for randomness.

If you need a reference to smite unbelievers, then invoke NIST Special Publication SP 800-118 (still in draft form, but published nonetheless), which notably includes this quote (from the "executive summary"):

  Password
  cracking attacks can be mitigated by using strong
  passwords, choosing strong cryptographic algorithms
  and implementations for password hashing, and protecting the confidentiality of password hashes.

(Emphasis is mine.)

Password hashing is a difficult art. You say that you use "HMAC/SHA-1", but HMAC is not a hash function; it is a MAC algorithm. MAC algorithms use a key. What you probably mean is that you use a password hashing function which has been designed over one or several invocations of HMAC/SHA-1 as a building block. PBKDF2 is such a password hashing function. It includes an extra parameter which is the number of iterations and that's an important one.

See this answer for a detailed discussion on password hashing, its theory and its practice.


Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed? It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can happily turn it over while smugly informing the attacker that it will do them no good because the physical token is 'dead'?

Does anyone manufacture hardware tokens which do not require physical strength in order to quickly 'destroy' them (ie. zero out the private key) when the user is under duress?

Although its a cool idea, I think these would be practically impossible to use.  A better idea would be a tamper-pin.  If coerced, give the tamper pin which renders the smartcard/token/etc useless when entered into a system.

To (try to) answer your question, I haven't seen any commercial solutions, but I bet you can find custom hardware.

EDIT: There is the Verisign OTP card that PayPal uses which is pretty flimsy.  While it's not designed to be broken, I can easily crush/snap the thing in half.  You can check it here: http://www.verisign.com/authentication/two-factor-authentication/compare-two-factor-authentication/index.html


Is it possible to verify the requesting user for a REST transaction secured by JWT at a later date? I have a React (Javascript) single-page application that authenticates users via username/password/MFA to Keycloak, receives a signed JWT upon successful authentication, and then uses that JWT to call stateless/session-less REST services.

With this setup, or with additional "moving parts" to be added to the overall system, is there a way to at a later date to assert that a certain user identity was responsible for a transaction? Assume that we are able to store any/all data that is in-context (i.e., is part of the REST call for the transaction) at the time the transaction is requested.

Thanks to @alnbhclyn for their thoughts below. I think I need to clarify -- the key gap above seems to be the link between a JWT and the specific contents of a transaction. Is there a means of "signing" the transaction with the JWT or some part thereof such that a positive link between the two can be made at any point in the future?

You already have signed JWT token, if your HTTPd stores access log (and it have also cookies in that logs), yes you can find the identity later.

Be sure following items;

You will need the secret key of JWT (which that cookie have).
What is the algorithm of that signed JWT cookie
When you open that cookie, are you be able to identify the exact user or are you just able to see a GUID which will be stored at database and will be removed later ? For example some developers creates a session table and stores opened sessions on that table, jwt have that session identifier and as the last step with sign-out removes the row from table, if this is the condition JWT will not solve your problem. You need to be able to see a user identifier at your JWT data.

You can open JWT token and see what are you store on it, you can use this https://jwt.io/ website for it.

Notes of For access logging;

Access log only stores URL, HTTP Status Code, Method, Cookie, User-Agent and datas like that and does not store POST data this why if your endpoint understands the action over POST parameter. Access log will not identify action.
Nginx & Apache HTTP daemons have enabled access log configuration, IIS does not have enabled access log configuration at default, you need to configure it.
If you will use this data at SIEM, JWT token will be a problem, store your own log file for SIEM (if you are gonna use)


How to force browsers to accepte all further SSL certificates I am using the last versions of IE, Firefox and Google Chrome web browsers on Windows 8. How can force these browsers to accept automatically the SSL certificates of any website I will visit ?
I know this is not a good security practice, but I do it for a specific security reason, indeed (virtualization and some stuff).

They are designed specifically to not allow this. As you brought up yourself, that would be a massive security risk.

If you want to be able to browse your own systems without clicking "confirm security exception" a million times, add the certificates to your trust store on your computer, using the "Certificates" MMC snap-in.

This can be done even better if you create your own CA, generate the certificates for your systems from that CA, then install that CA's certificate as trusted.

If you're in a domain environment, you can even create group policies to deploy the trusted certificate settings to as many computers as you want, automatically.

This way you trust your own resources without buying certificates, and don't break your internet security.


Is it safe to store encrypted volumes on cloud syncing services? A recent discussion on another website prompted a proclamation that storing (TrueCrypt, LUKS, DMG, etc) on cloud sync services like Dropbox is unsafe, since a version history is kept of each file, and that the change in the encrypted volume as files are added/remove/changed can be used to leak private information.

Some cursory googling didn't turn anything up regarding this supposed threat.

My question is, does storing these files on versioning cloud services represent any kind of real security risk, and if so, are there any safer alternatives to pass encrypted files around?

Take a look at Ferguson's criticism and the official response at the bottom of page 2 and top of page 3 here:  http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/comments/XTS/follow-up_XTS_comments-Ball.pdf

XTS sector/block mode (used on Truecrypt, Drivecrypt, etc) has a temporal quality that can certainly leak information.  Ferguson says an adversary who observes 4000 writes to an encrypted 4K sector will have obtained access to well over a million (2^20) ciphertext blocks encrypted with the same tweak and key.

I'll add that since most crypto volumes of windows users these days will be formatted NTFS or FAT32, the attacker has a pretty good idea where to look for frequently changing file system structure data that (a) has a defined range of possible known plaintexts; and (b) a predictable location given the size of the volume file.

Putting encrypted volumes in the cloud does all the "work" that the IEEE response said would make the attack on a volume infeasible.  The security model was never meant to be solid when you make the entire internet into a potential evil maid who can monitor the changes on the encrypted volume.  Even less so if the cloud service is doing the versioning that does even one more step for the attacker (i.e., collect and aggregate just the changed sectors).


'Ghost' access to a php file on a web server I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them.

They can ping to the web page just making a GET request to:
mywebsite/ping.php?ip=XXX.XXX.XXX.XXX&description=USERNAME

where 'ip' is the NAT IP and 'description' is a parameter to store the name of the user.

// Snippet of ping.php
// obs.: didn't handled the inputs in a correct way because I'm just testing
$real_ip = $_SERVER ['REMOTE_ADDR'];
$ip = isset($_GET ['ip']) ? $_GET ['ip'] : '';
$description = isset($_GET ['description']) ? $_GET ['description'] : '';

if (!empty($ip)) {
            // If ip is not set or empty, do not save anything
        // saves the ip (nat), description and the real ip  into database
}
else
{
        // do nothing
}

My website is up and running. I tested it and it saves my real and local ip. I also created a php file to see a list of all clients that ping the server.

The mistery

I deployed the website online yesterday and made some tests pinging to it. It stored my IP ok. Today I stopped working on it a little bit and when I was back  I realized that 10 different IPs pinged my ping.php file with the 'ip' parameter set to their local NAT IP. See the IP's list here

During the time that I was off I'm sure that none of my client programs pinged to the file since my PC was shutdown. Also the IPs found (real IP, not NAT) were all different from mine (mine didn't change until the time I checked the ghost IPs).

Question:
How is that possible someone reach a php file on web and make a request using the righ parameters since just me and god knows about the existence of this php file on my web server?

Additional information

In my .htaccess located in htm_public, I disabled the indexing.
Nobody but me accessed my hostinger account
There is no index or default page on my web server, just the ping.php and show_all_ips.php
I tried some Google dorks to find my ping.php file but couldn't find anything

The IP addresses seem to belong to a plethora pf european ISPs/data centers:

inetnum:        83.31.0.0 - 83.31.255.255
netname:        NEOSTRADA-ADSL
descr:          Neostrada Plus
descr:          Warszawa
country:        PL

inetnum:        178.217.184.0 - 178.217.191.255
netname:        HOSTEAM-1
descr:          HOSTEAM S.C.
country:        PL

inetnum:        91.0.0.0 - 91.23.255.255
netname:        DTAG-DIAL22
descr:          Deutsche Telekom AG
org:            ORG-DTAG1-RIPE
country:        DE

inetnum:        91.78.0.0 - 91.79.255.255
netname:        MTU-PPPOE
descr:          Comstar-Direct CJSC
descr:          Mamonovskij pereulok d.5
descr:          P.O. BOX 38 123001
descr:          Moscow, Russia
country:        RU

This one should be google's

NetRange:       8.0.0.0 - 8.255.255.255
CIDR:           8.0.0.0/8
NetName:        LVLT-ORG-8-8
NetHandle:      NET-8-0-0-0-1
NetType:        Direct Allocation
OrgName:        Level 3 Communications, Inc.
OrgId:          LVLT
Address:        1025 Eldorado Blvd.
City:           Broomfield
StateProv:      CO
PostalCode:     80021
Country:        US

A couple of suggestions, you pasted the url  with the IP parameter set somewhere and it's ended up on a webpage and being crawled as previously suggested. Other examples is that you pasted it somewhere where non public robots are validating the page. Examples of this is antivirus scanners, so pasting it in skype/emails could account for the traffic. Lastly, it could be side effects of having malware on your computer, but judging by the source IPs that hit your page I think that is unlikely.


Creating a secure offsite backup at a friend's house A friend has kindly allowed me to store a hard drive at his house to use as an offsite backup.  I normally use rsync-backup to make backups of my home directory and have always done this (just being lucky!) to 2 separate USB drives.  This has been great but the chance of a house fire has always terrified me.  My previous job let me keep a drive in a desk drawer but wouldn't allow it to be connected to the network.  It was such a pain to bring it home every few weeks and rsync that laziness prevailed.  My friend's ONE request is that the drive be encrypted so there's no chance of privacy issues -- either him reading my files, or him being somehow liable for anything that might be on the drive.

I have googled a LOT about this topic but the problem is that most of the whole drive encryption walk throughs are for an OS.  Not a remote drive.  I am hoping that someone out there knows how to set this up so that (ideally) a cron job can run at a regular time nightly or maybe weekly, updating everything from the drive at my house onto the one at his place.  He has high speed cable, so it shouldn't be problematic to do this and I'm going to FIRST do the initial rsync at home...then give him the drive, he'll install it at his place and give me access via a unique server, and hopefully things will go from there.

Thank you for any and all help with this project.  If this is easily answered somewhere, please let me know where -- I've done tons of searches and just can't find the right keywords to get the info I want.  I end up just getting to pages for making LUKS volumes within an OS...and I either don't understand how that's the answer or else it's NOT the answer.

I should add that I'm avoiding Cloud-based options because of expense.  I have about 6TB of data (I'm a photographer/videographer working with very large files over decades...) and I just can't afford the fees involved with typical cloud storage.  Even if I could, I would want to know how to ensure the data's encrypted and how to do regular automated backups.  But this option to have my own hard drive at a friend's place seems awesome.

Again, thank you!  :-)

It sounds like you want a tool like duplicity, which uploads pre-encrypted deltas. It works with multiple backends (from ssh and sftp to AWS) so your friend doesn't need to be running Linux. By using an existing tool you won't need to reinvent anything (except for maybe setting up your own cron job which can access a gpg key for duplicity to use) and you can reuse this solution with cloud (untrusted) providers for smaller sets of data or when it becomes more feasible to upload 6TB of data.


Are there any security hazards to installing Ubutnu for Windows 10? I only want a bash shell in Windows 10 that runs faster and doesn't have any of the quirks of git bash / MINGW64, like for instance all of that CRLF garbage.

Is there any security harm in installing it?  I mean I'm sure depending on what you install with apt-get there could be issues, but what if you're just installing Ubuntu for Windows 10 and git?

I noticed that I could not run iptables -L I got some error:

iptables v1.6.1: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

Any new piece of software potentially increases attack surface. However I think that Ubuntu on WSL does not open any massive holes as-is. WSL works by mapping Linux syscalls onto Windows equivalencies. So it cannot do anything that any Windows program could not do. It does not listen on sockets and terminates when you close it - it cannot run daemons. The risk comes if you install or run untrusted code, or an upstream is compromised. Unless you do something egregious like configuring any downloaded .sh to run in WSL or something you are not exposed to any extra risk that would not be running Ubuntu natively.

So you do have more ways to shoot yourself in the foot, but that’s all. Exactly the same as if you ran WINE on Linux.


Are polyglot microservices (multiple technologies) more secure than using a single technology framework? As a full-stack cloud-native (AWS, Azure, and GCP) polyglot (Rust, Golang, Python, and Java) microservices developer, the nagging question that I have is if the use of multiple technology frameworks vs single language (e.g., Java) have increased and improved the overall security posture?
Overall, is it more secure to use a single language/technology/framework or to use multiple language/technology/framework?

Unless the language itself has its specific pitfalls regarding security it mainly matters how fluent the developers are with the respective language, how much they understand they concepts necessary for security and how good they are capable they are to apply this knowledge into a secure by design software.
If there are multiple experts in their respective languages and if the tasks can clearly be separated it might be more secure to use multiple languages since the relevant expertise is (unfortunately) spread over multiple developers and languages. But apart from that a multi-language approach likely causes increased complexity of the code, makes it harder to understand and harder to maintain and limits the reuse of components - which typically makes the software less secure. So it would be preferred to stay with a single language as long as there is sufficient expertise for this available.
That said, there are some problems which are easier to solve in one language than in another. Since this also impacts the complexity and maintainability of the software the focus should also be to use the language which best fits the problem.


IP leakage on Skype through VPN Does anyone know how the traffic behaves if you configure a VPN natively through SSTP (WIN or MAC)?

Because most applications use the TCP, but Skype uses UDP.

I try to formulate more specific questions:

Is it true that the VPN works over TCP or via UDP, but not both at the same time?
If I set up VPN over TCP, is not there some kind of IP leakage in the case of using Skype (UDP)?

VPN stands for Virtual Private Network. A real VPN works like a virtual network interface and transports any kind of traffic, i.e. TCP, UDP, ICMP.. . In this case it does not matter which protocol is used by the VPN itself.

But note that some products are called VPN even if they are not handling all network protocols but only deal with some protocols. For instance Opera VPN is just a proxy, which means that it only cares about traffic from the browser and not all the other traffic at the system (like traffic from Skype).


What's an SSL certificate that's not even DV I was looking at the SSL certificates offered on A2 Hosting and I see they have something called a "GlobalSign OneClick Alpha" certificate which is less than half the price of the "GlobalSign OneClick DV" certificate.  AFAIK all SSL certificates are at least domain verified - so I contacted the sales team at A2.  Here's their response.

  The AlphaSSL certificates are not verified on a domain, organization, or extended basis.

Is there such a kind of unverified SSL certificate?  How does it show up to an end user in the browser?  (Meaning - do I still get the lock icon if I use this "alpha" certificate)?  FWIW I also went on GlobalSign's website and they do not list any information about providing a "OneClick Alpha" certificate.

Seems like nonsense from the A2 support. A certificate that's not even domain validated only carries as much trust as a self signed certificate and self signed certificate is not worth anything to pay.

In this case, I believe Alpha certificate refers to certificates issued by AlphaSSL certificate authority which is a brand of cheaper certificates owned by GlobalSign. It's basically a certificate with alternative trust chain, as AlphaSSL certificates are ultimately rooted to GlobalSign Root certificate.


Is there a reason to use TrueCrypt over VeraCrypt? I am looking to encrypt a few drives of mine, and my ONLY interest is security.  It is OK if my VeraCrypt volumes are not compatible with TrueCrypt, and vice versa.

There is a lot of talk about "TrueCrypt is dead" and it seems there are two forks out there now gaining momentum.  The one more interesting to me is VeraCrypt, and from the research I have done, this looks like the "more secure" option.  But is that so?

That is why I am asking you all here.  I know what VeraCrypt claims, I know they say they do more hash iterations of the password to derive the encryption keys.  That sounds nice and all, but...

Does anyone have real world experience using Veracrypt and is it as good as advertised?  How does it compare to TrueCrypt?

Does anyone have a security reason why they would choose TrueCrypt over VeraCrypt?  Any reasons at all why TrueCrypt is preferable to you?

I'm not on the "TrueCrypt is dead" bandwagon, I am just in trying to be progressive, so I would choose a newer "better" option if it is available.  But with that being said, I would also choose to go with the older option if it is actually better than the newer options.  Your thoughts?

I would still choose TrueCrypt for a matter of trust and the "many eyes" theory:

After the "TrueCrypt scandal" everyone started looking at the source for backdoors.
The TrueCrypt audit finished on April 2, 2015. They found low-risk vulnerabilities, including some that affect the bootloader full-disk-encryption feature, though there is no evidence of backdoors.
If VeraCrypt start changing TrueCrypt fast, they may introduce a few vulnerabilities. Since VeraCrypt is currently less popular than TrueCrypt, there are 'less eyes' watching at the VeraCrypt source code changes.
I consider that TrueCrypt 7.1a have all the features I need. An audited TrueCrypt with the vulnerabilities fixed would be the perfect choice. Unless I personally watch VeraCrypt source code diffs, it would require an audit on the changes, or a high increase in popularity, or many years of maintenance and active community to make me trust them more than the good old TrueCrypt.
The increase in iterations to mitigate brute force attacks only affects performance. If you chose a 64-char random password, 1 million years of brute forcing or 10 million years is the same from a security stand point.

(I downloaded the public key of TrueCrypt admin years before the scandal. So I can download a copy of TrueCrypt 7.1a from any source and verify its authenticity)

This answer may change after they publish new results from the audit. Also, if you are the VeraCrypt dev, the trust argument doesn't apply (because you trust yourself).


How to verify a x509 certificate from Apple on a Ubuntu server? I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this.
Steps 3 and 4 of that API say:

Use the publicKeyURL on the third-party server to download the public key.
Verify with the appropriate signing authority that Apple signed the public key.

The public key URL I usually get is https://static.gc.apple.com/public-key/gc-prod-5.cer.
On my Mac, I simply download this cert and call X509Certificate2.Verify() in C#, and it returns true. However, calling this function on an Ubuntu server returns false. The error message I get on the server from X509Chain is:

Status information: unable to get local issuer certificate

The cert in question appears to be CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US.
How do I get this cert on my Ubuntu server, so that I can verify the public key from Apple? Is there a common registry of certs where I can download it?

You need to update your root certificate store as in this post:
https://askubuntu.com/questions/73287/how-do-i-install-a-root-certificate
If I read your question right...looks like you have a copy of the cert?


Is using PGP/MIME or PGP Inline more secure? Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML will not work with PGP Inline but will with PGP/MIME.

What is the most and least secure way of going about encrypting emails?

What is the most and least secure way of going about encrypting emails?

There is no difference in security: both use the same cryptographic principles, they just use another method of embedding OpenPGP into e-mails.

  I am looking for security and have no idea which to use, though I do know HTML will not work with PGP Inline but will with PGP/MIME.

PGP/MIME has the advantage of properly hiding signatures in metadata when the recipient does not have support for OpenPGP (they might see a "weird attachment", though). PGP/MIME is sometimes not properly handled by mailing lists. PGP/MIME lets you also encrypt and sign attachments.

Inline PGP on the other hand is more visible, and more robust in case of bad MIME implementations. Inline PGP cannot encrypt/sign attachments.

Both methods only support the content of the mail, and do not touch the mail headers (subject, sender, recipient, date, ...).


SQl Injection MariaDB Im found a sql query that is injectable below

"car_info = query("select models, color, running from cars where manual = 1 AND UID = '{}' LIMIT 1".format(uid))")

Where '{}' is the point of injection.

The payload I am trying to enter is:

' OR enabled = 1") #

I am being returned an error below:

(1064, u\"You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')#' LIMIT 1' at line 1\

How can i get this to properly execute? I feel like I am close.

If I am reading the syntax correctly, I believe you need to remove your quotations and left parenthesis as it's prematurely ending the query function:

car_info = query("select models, color, running from cars where manual = 1 AND UID = '' OR enabled = 1 # LIMIT 1".format(uid))")

You are posting:

car_info = query("select models, color, running from cars where manual = 1 AND UID = '' OR enabled = 1" )# LIMIT 1".format(uid))")

So try the payload:

' OR enabled = 1 #


How secure is a user in MySQL? Let's say I have two databases on the same server (e.g. AWS RDS), DB1 and DB2. There are two users with some restrictions, and each user is assigned to a different database. US1 have access to DB1, and US2 have access to DB2.

The users and their passwords are stored separately on different servers. DB1 is used to store ciphertext, and DB2 to store the encryption keys.

Can I be sure, in 100%, that without the passwords (ignoring bruteforcing and other attacks on the password itself), that while having access to only one of the users, an attacker won't be able to access the other database?

If you set the permissions correctly, yes, you can be sure.

To grant user US1 select, insert, delete permissions to database DB1 use this query:

GRANT SELECT, INSERT, DELETE ON DB1.* TO 'US1'@'host';

or for all privileges

GRANT ALL ON DB1.* TO 'US1'@'host';

This way US1 can see and interact with DB1, while unable to interact with DB2.

You can test this by authenticating as user US1 and using the query: show databases; via the command line or phpmyadmin. You will only see DB1 in the results.


How can you find out who hacked your accounts and sent out dirty messages on your email and snap chat My College email account was hacked and several dirty messages went out to my teachers and boss. My Snap Chat was also hacked and messages were sent out to my parents only. How can I find out who did this.

Firstly, for your college email account you can consult and report it to your school administration. They will investigate your login activity and they can check the email header to figure out the source of those malicious emails. So basically they will do a forensic scan of your account.

Secondly, for your Snapchat Account, you should enable security features of login activity and also the 2 factor authentication by adding your cellphone number or you can use Google authenticator https://support.google.com/accounts/answer/1066447?hl=en

To figure out who accessed your account, the Snapchat team should be more than happy to assist or if you want to go further with this, 3rd party services can do the investigation for you as they know the legal procedures need to be followed.

To stay alert, I would recommend signing up to services like https://haveibeenpwned.com may be your email was leaked on a certain site and they got access to your credentials.


How can you (anybody) find out the IP address of a single computer inside college How can you find out the IP address of a single computer inside a college network.

Every computer has the same public IP address on the network. How is it possible, after discovering that the IP is from that college, to find the computer from which the attack/request/etc originated?

I suppose that our situation is the following: you have detected some undesirable network traffic and you are looking for the perpetrator, so as to, more or less metaphorically, convey to him the inherent unwisdom of his villainous behaviour. The source address of the offending IP packets points to a college; the college uses Network Address Translation so that outgoing traffic from all their students is seen, from the outside, as coming from a single IP address.

(Or, possibly, you are the wannabe evildoer and you want to know what the Long Arm of the Law could do to trace you back. It does not change the technical situation.)

Strictly speaking, the college acts as a kind of anonymizer, since it blocks the actual (internal) IP information. So you should ask the college. They may have detailed logs on network activity, which may help pinpoint the uncivilized individual; for instance, the DHCP logs within the college network could give some information on who had their computer up and running at the time of the indelicacy. There are various sources of such information, which depend a lot on the structure of the internal college network.

Be sure to bring all the information you have on your side; network traces obtained with a network monitor application (like Wireshark or the aptly named Network Monitor) are a must. Also, bring all logs, especially Web server logs, because Web browsers tend to produce a lot of information which can be quite specific to the specific computer which sends the requests (see this page for details).


How to tell ordinary spam from some abusing my mail? From time to time I glance through my spam folder to gauge how the filters are working, and if they're catching any "ham." Most of the spam is really obvious, but I'm getting a few which made me wonder if somebody is using my email (presumably in systems which do not require double-opt-in).

Some of the mails simply make no sense as spam, but I guess they might be tests if my mailbox bounces the request or not.

Are there relatively pain-free ways to find out if that is the case? In a couple of weeks the new EU General Data Protection Regulation comes into force and I could just ask companies what they have on me, but that would be a lot of work for me and for them, and fruitless if the sender was forged.

Re the comment, I hestiated to do give examples because it might "smear" a perfectly legitimate service.

    Received: from r157.p23.neolane.net ([66.117.16.157]) by [...]
    From: "Heathrow Airport"
    Subject: Welcome to Heathrow Wi-Fi - let us help you explore
    To: [...]

If they are sites, where you are allowed to log in, you could try resetting your password. That being said, there is little reason to do that. It could provide the site with additional information about you and it could allow some amount of phishing, so you need to be careful with this.

One danger I can think of is the site forwarding you a link/code for a different site and then using this code to confirm them as the owner of the email.

If the site does not have such functionality, then I can't see any easy way to do this.


How to validate that a EU List of Trusted Lists is authentic? In order to validate if a trust service is qualified, one should search for the public key in a member state trusted list (TL).

In order to validate if a member state TL is authentic, one should search for the public key that signed the member state TL in the EU List of Trusted Lists.

What is the process to verify that the EU List of Trusted Lists is authentic?

In its current version (sequence number 208) it is signed by a public key issued to Maarten Joris Ottoy by Luxtrust. How should one verify that Mr Joris has the authorization to sign the List of Trusted Lists?

The authenticity and integrity of the machine processable version of
  the LOTL is ensured through a digital signature supported by a
  certificate which can be authenticated through a publication in the
  Official Journal of the European Union (OJEU). Since end June 2016,
  the LOTL signing certificates and the location of the LOTL XML file
  are contained in the LOTL itself, as detailed in the EU OJ publication
  OJ C 233 [i.]. This enables relying parties to detect in a machine
  processable way a change in the LOTL signing certificates and/or in
  its location. Any such future change will be reflected in the
  publication of a new instance of the LOTL which will include a new URL
  and/or a modified set of digital certificates for relying parties to
  use when authenticating the LOTL. Starting at the date of issuance of
  the LOTL in which this new information is first published, the new URL
  and/or a modified set of digital certificates can be used by relying
  parties to locate and authenticate the LOTL in replacement of the
  formerly issued information. It is however always possible to the
  European Commission to publish a new publication in the OJEU, for
  instance as a temporary response to an emergency situation requiring
  the immediate replacement of all the digital certificates of the LOTL.

The source is ETSI work document: "Electronic Signatures and Infrastructures (ESI); Signature policies; Part 4: Signature validation policy for European qualified electronic signatures/seals using trusted lists"


Content hashes to help protect resources being fetched from a CDN During a conversation in The DMZ, it was suggested that an SHA256 hash could be used to check that content being delivered from a CDN hasn't changed before being executed, similar to how Kim Dotcom's MEGA tried to do recently with CBC-MAC.

The mechanism would be implemented at the browser level, whereby a content hash would be embedded in the link to the content. For example:

<script src="http://example.cdn/jq/jquery-1.2.3.js" hash="sha256:kMufczNYKx9B2A7x7eICQVu18YDzEMqUe3G+h5QSifw=" />

The hash would be provided as part of the site code, so that only content that matches the hash would execute. This would protect the user against cases where the CDN was compromised. It would also offer a way to provide minimal security if operating in mixed-content mode where everything but the CDN operated on SSL.

Are there any flaws in this approach? Would there be any important cases to consider during implementation?

Update: There is more information on Subresource Integrity at  MDN, which (as of 12/12/16) shows support in Chrome 45+ and FireFox(Gecko) as of 43+

Update: There is a w3c draft called Subresource Integrity describing a feature like this.

It's already implemented in Chromium.

For example:

<script src="file.js" integrity="ni://sha256;BpfBw7ivV8q2jLiT13…"></script>

The basic approach is sound IMO, but there are a few details to take care of:

You should support several hashes on a single tag. The browser doesn't need to validate all of them, validating one collision resistant hash is enough.
Being able to specify the size seems useful to avoid some kind of DoS where your site is fed a huge resource
Unless you're using a tree-hash, you can't verify incomplete files. That's not an issue for 100kB javascript files, but it is for a 5 GB video. So support for tree hashes should be added later on.
I'd use algorithm identifiers matching NI - Naming Things with Hashes, and use urlsafe Base64 without padding
I'd specify SHA-256 as the standard algorithm every browser should support, but allow browsers to add other algorithms. SHA-256 is:

collision resistant at a 128 bit level
a NIST standard, implementations are widely available(unlike SHA-3)
performance isn't great, but still fast enough to keep up with typical network speeds on mobile devices.

IMO SHA-256 is the ideal choice for the default/mandatory algorithm.
You should support all embedded resources, CSS, images, videos etc. and not just scripts
One could consider using NI urls instead, but I prefer the attribute based approach here. An attribute is more flexible and doesn't require cooperation of the target host to implement. NI can only specify a single hash per url.
You could disable mixed content warnings for securely hashed content that was fetched via http
It's a great way to see if your cache is still valid. It's valid if and only if the hash matches. No need for rechecking, dates, etc. This also works if you downloaded the resource from a different url. For example if you already have jquery from google in your cache, you don't need to reload it from another url since the same hash guarantees[assuming collision resistance] that they'll be the same.
There are probably some issues related to authenticating http headers since those influence the interpretation of the resource. For example mime type and charset/encoding are such headers.

So an example might look like this:

<script src="http://example.cdn/jq/jquery-1.2.3.js"
     hash="sha-256:UyaQV-Ev4rdLoHyJJWCi11OHfrYv9E1aGQAlMO2X_-Q; size:103457;
           other-hash: abc..." />


Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account How do large companies implement their security requirements which are centralized and used to drive things people can do (allowed to call a certain web-service, submit an order, etc.) as well as to drive UI (disable buttons, menu options, individual form fields)?

I am considering RBAC architecture: Users -> Roles, Roles -> Privileges.

Complex applications with permissions based on many individual field-account-user-role-amountThreshhold would have many, many "Roles" and managing this gets complicated as number of roles grows.

Managing all these possible options seems daunting, and my prior experience is to hard-code such logic in the application.

Ex: If (User.Roles("IsAccounting"))
{
    btnEditOrder.enabled = false;
}

I am tasked with designing / implementing a security service/architecture which will be used as common authentication/authorization point for any/all applications (all .NET, but some GUI and some process-oriented).

This is not possible out of the box because of the business organization around client accounts and permission tiers based on financial amounts.

Ex: John is a User and he can View and Submit requests for account "Microsoft" and "Google".
Mike can View "Microsoft" and "Google" requests but can only Submit "Google" requests.

Number of accounts / users is large and variable.

If I follow RBAC, there will be hundreds of "Roles" to accommodate all required Rights (Privileges). This doesn't help because the end goal is to give easy to manage GUI tool so that managers can assign their direct reports to appropriate Roles.

I was thinking to implement this security piece with the following API (rough draft in pseudo-code):

UserContext securityContext = Security.GetContext(userID, userPwd);

And usage in application would be like this:
if (securityContext.RequestManager.CanSubmitRequest("Google")) {...}

This way there would be thousands of these 'Can(params)' methods to check permissions which doesn't make it easy to either manage or use this pattern.

Any links / ideas / pointers are appreciated.

It's a .NET shop, but nothing I've seen from .NET (Membership / AzMan) will give us the granularity and delegation requirements required. ActiveDirectory / Oracle LDAP integration would be nice, but not necessary.

Old (current) system uses LDAP to authenticate users, but all authorization is done in-house and stored in classic "Users, Roles, Rights" tables.

I think it highly depends on end use.  Just off the top of my head and without knowing a ton about your app end user, have you thought about session based authentication?  Basically do a check on their permissions and apply some type of identifier to their session.  That way you could grant requests allowable permissions, which should be faster than checking all user permissions on every request.  Just have a lookup table for an action and what sessions are allowed to use it, that way you could store everything centrally which is a lot easier to manage.  Just a side note, this is purely a response on ease of implementation/manageability/speed, the more secure you want your app to be obviously the more you are going to sacrifice speed.  What will really drive your implementation is figuring out the reasonable balance point between acceptable speed and security.

I'll post a more lengthy response when I have some more time later on today.


What's the purpose of a key hash when you have the fingerprint? Looking for "Barack Obama" in Ubuntu's keyserver return these results
For example, take the first search result:
pub rsa2048/86678817fca9987e2d9a3d3ea2437f33d4266cc0 2017-07-08T04:17:08Z
     Hash=40135e3a9da88180a317be949b301708

The first line is the key's fingerprint.
I can obtain the fingerprint of my keys using gpg --list-keys --fingerprint

What is the second line? Why we need a hash if we already have the fingerprint?

How can I retrieve the hash for my keys in gpg?

If my friend calls me to verify that the public key is mine, should I give him the fingerprint or the hash?

I think you're mistaken. The top hexidecimal value is the key ID. That's what they're explaining at the top of the search results page with: Type bits/keyID            cr. time   exp time   key expir.
The second line with "Hash=" is the fingerprint of the public key calculated with MD5.
Fingerprints and hashes are functionally similar in that they are both produced by one-way functions. They both take arbitrarily large inputs and produce a smaller output. The important distinction is that cryptographic hash functions require collision resistence while fingerprints do not. The trade-off is that hashes are slower than fingerprints to calculate. So for large amounts of data, use fingerprints. For security-critical applications, hashes. Or both, starting with the faster fingerprint and using it like a Bloom filter. This specific case is a little confusing because MD5 is a cryptographic hash function used for fingerprints. MD5 is no longer considered trustworthy for cryptographic applications but can still function for fingerprints.
If you want the SHA256 hash you can use ssh-keygen -i -e "SHA256" -f yourkeyfile.
If you and your friend are using out-of-band communications to verify your keys then good job. Just use the fingerprint provided by gpg --fingerprint.


What are the security measures taken on websites that allow online scripting such as jsfiddle and codepen? As asked in the title, I have been wondering this for a while. These sites allow the user to write scripts and store them too. Are they not vulnerable to attacks such as cross-site scripting or any other similar attack? If so how do they protect themselves and their clients.

For Example, somebody writes a malicious code and shares the code with others posing as someone who needs help. Now, Members of stack will of-course run the code to check what the problem is. Isn't that directly playing into the hands of the attacker?

What you need to worry about here is XSS. Scripting in general is not (supposed to be) dangerous, since the browser limits what an attacker can do anyway. At least you can not do anything on JSFiddle that you can't do on any other webpage.

But what about the XSS? If you look at the source of JSFiddle you will find this:

<iframe sandbox="allow-forms allow-scripts allow-same-origin allow-modals allow-popups" allowfullscreen="" name="result" frameborder="0">

So the area where the code is executed is contained in an iframe. The URL of that page is https://fiddle.jshell.net/_display/. Since it is in a different domain from JSFiddle itself, it can not access any of the JSFiddle cookies. So that domain is pointless to XSS, because it contains nothing of value. It is just a page that returns any scripts you POST to it.


Is it possible to have a key for encryption, that cannot be used for decryption? For example, a server might have some encrypted logs or storage or whatnot, that would only be used for reference later. This way even if the server is hacked, everything is still OK until the hacker comes up with a way to intercept the data before encryption.

Another example is the basic browser HTTPS/TLS model where it needs to securely talk to an unknown server and they have no prior key exchange,, without an eavesdropper getting the necessary keys. I almost had an answer in this question: How secure is SSL?, but I still have more reading to do before I understand, but what caught my attention the most was the last answer (no upvotes or comments, just a high rep user)

Whether it relates to SSL or not, and whether that last answer is correct or not, I also want to know if it is possible to create an encryption-only key that requires brute force to decrypt. I don't see how this is possible yet.

  This question was IT Security Question of the Week.
  Read the Sep 30, 2011 blog entry for more details or submit your own Question of the Week.

What you are referring to is asymmetric encryption. A key is used for encryption, and a seperate key is used for decryption.

You would use the encryption key, aka public key, to encrypt the incoming log files, while the decryption key, aka private key, is stored on a different server/system/etc so there is no way to decrypt the logs.

Some good primers:

Asymmetric vs Symmetric Encryption
What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?
What are private key cryptography and public key cryptography, and where are they useful?


Specific character based policy for passwords I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special character..."

Thus if we target a reasonable entropy level for humans to remember, say 60-bits, then calculate the entropy.

This can be calculated dynamically and locally and give user feedback as needed.

Is this not a better, language/region agnostic way to do a password policy?

The fundamental issue is that entropy can only be estimated from the password itself, and that estimate can be very very wrong.  The entropy is determined by the password generation method.  You can't measure the entropy of the method from a single password.

Let's look at a practical example.  I find it easiest to memorize very long passwords generated from a small password space, so I'm going to use numbers only and make it very long.  Your algorithm looks at my password, sees that it only contains numbers (aka character set size is 10) and that it is 20 characters long.  This gives it an entropy of:

log2(10^20) = 66.4

It passes your test!  However let's stop and look at the password:

01234567890123456789

Hmmm... turns out that the actual entropy is pretty much zero.

I could get a lot more technical but in this case I think it's better to keep the answer simple.  I believe this example should provide a sufficient answer to your question.


PCI DSS or PCI Standard - Standards | Requirement | Implementation I have done ISO 27001 implementation and auditin. I want to get a clear idea of PCIDSS standard.

What is PCI DSS (I know the abbreviation)
What are all the materials and sites to refer?
What are all the standard documents to refer?
What are the professional certifications that can be achieved through PCI DSS for an individual?

Kindly help me with those points.

You can download the PCI DSS Standard here. This is the official site and the only one you should be referring to.

https://www.pcisecuritystandards.org/

Their certification program for individuals can be found here


How link flooding DDoS attack remain undetected? I read some explains or paper about link flooding DDoS attack, which is new relatively.

For example

"employs legitimate, low-density flows to flood a group of selected links. Therefore, these malicious flows can hardly be distinguished by traditional schemes..." - Towards mitigating Link Flooding Attack via incremental SDN deployment
"target the core of
the Internet that can cause significant damage while remaining
undetected..." - SPIFFY: Inducing Cost-Detectability Tradeoffs for Persistent Link-Flooding Attacks

I want to know how link flooding DDoS attack works, for example,

how employs legitimate traffic? what means attack selected links? how to remain undetected? etc.

...I want to know how link flooding DDoS attack works...

The authors of the second paper  (SPIFFY) provide two references in the first sentence of the introduction: The Coremelt Attack and The Crossfire Attack. From reading the abstract and introduction of these papers it looks like the basic idea is that a selected network path is saturated with large amounts of normal traffic. The source of this traffic is an attacker controlled botnet and the many targets are either from a botnet too or just normal public servers. Due to saturation of this link any connectivity over this link is negatively affected, i.e. a denial of service.

  ... how to remain undetected?

Given that this is normal traffic (i.e. HTTP or similar) between many sources and many targets it does not look like the typical DDoS which is directed against one or a few systems. Instead it looks like normal traffic and thus existing DDoS detection heuristics don't get triggered.


How to obfuscate SSH tunnel Mac? I am looking to test a DPI (deep packet inspector). I currently have it set up to block SSH connections (which it does successfully).

I have learned that DPI can be bypassed by obfuscating/encrypting the initial handshake (I think, feel free to correct).  By doing this, the DPI is not able to tell that the traffic is SSH and does not block it. How can achieve this with macOS?

I have complete control over both the server and the client.

Your question seems to be answered on Apple Stack Exchange. Note that the patch mentioned there seems to be no longer maintained, so it may have security issues if you do not backport fixes. A more up-to-date patch (supporting OpenSSH 7.6 as of this answer) is available on GitHub.* This particular obfuscated protocol is explained in more detail on its site. Judging by a quick read of the patch, this particular obfuscation seems to add a random length of padding to packets and encrypt the handshake using a preshared key stored in the configuration file of both the client and server. It is not particularly advanced, but will likely hamper automated protocol detection.

There are other ways to obfuscate SSH traffic as well. You could create an obfuscated VPN tunnel between the client and server and connect with SSH through that. I explained in another answer how to prevent OpenVPN traffic from being detected as such. You could use the techniques outlined in it (static keys and obfsproxy) to create a tunnel through which SSH can run. You need only a basic understanding of networking to bring up a virtual interface for the tunnels and assign a local IP to it so you can connect using your SSH utility. You can also use obfsproxy directly on SSH.

It's important to remember that, while protocol obfuscation can make automated detection or censorship more difficult, it does little to prevent an intelligent analyst with access to traffic dumps from realizing that the traffic is OpenSSH traffic. There is not much you can do to protect against such a threat while maintaining usability. All obfuscation does is raise the bar for detection.

* Applying a patch requires you know how to compile software from source code. You download the source code for the exact version targeted by the patch, and use a command to apply the patch, such as the patch utility.


Can I use AES CTR mode to encrypt files with same key and nonce? I want to encrypt the files stored in SD card and I am using the CTR mode of AES to encrypt it. The key and IV are fixed. So each time I encrypt/decrypt I use the same key and nonce. Most of the people suggest not to use same nonce repeatedly. In my case since it is not the communication between two parties I think it is harmless. Is my assumption correct?

You must not do this.

AES in CTR mode turns it into a stream cipher, such that AES is turned into a cryptographic pseudorandom number generator (PRNG) which generates a sequence of pseudorandom bits to be used as a keystream. This output keystream is simply xor'ed with the plaintext stream to produce ciphertext. Using the same key and IV produces the same keystream each time, so by re-using the key and IV you're essentially using a many-time pad.

So, you get:

  C1 = M1 ⊕ K

  C2 = M2 ⊕ K

Where C is ciphertext, M is the plaintext message, K is the keystream produced by AES-CTR, and ⊕ denotes an exclusive-or (xor) operation.

By computing the xor of those two ciphertexts, you get:

  C1 ⊕ C2 = M1 ⊕ K ⊕ M2 ⊕ K

which, after cancelling out the two K values (since x ⊕ x ≡ 0) gives us:

  M1 ⊕ M2

This allows an attacker to know which bits of M1 are equal to M2. If you know any bits of one message (known plaintext), you can then recover the corresponding bits from the other message. You can also employ techniques such as crib-dragging to fully decrypt the entire message.

There's a great answer on Crypto SE about exactly how this attack works.

You should always use a unique IV per message to avoid this problem.


Restrict website access I want website (A) to only work if a visitor came by clicking a link from a specific other website (B).

Initially I thought of using the document.referrer from website A to check whether website B is the source, but apparently it can be faked easily.

How could I achieve this?

More info:

Assume that website B code is nearly untouchable, and if possible all changes have to be made in website A,
Website A runs on nodejs server.

If website A and B are linked internally, you could just transport the session information, so the session key can be used to automatically login to website B - doing this without website A and B communicating internally somehow would very very difficult to secure.

Basically you need a method of A telling B which client session codes are valid, without relying on the client transmitting this information.

Of course it is possible to do it this way using PKI, but I imagine that's a little overcomplicated for you situation. In any case, this solution would basically be implemented as follows:

Client connects an logs into website A
Website A creates session cookie and signs it with website B's public key
Website A redirects client to website B along with signed cookie
Client goes to website B, presents signed session cookie
Website B reads session cookie, verifies it with website B private key
Client is now logged into website B

Bear in mind this whole process could still suffer from a number of attacks if any of these connections are not secured via SSL/TLS.