Where to store secrets in .NET applications? I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in this encrypted format) on my machine (from which I can collect them and send them to the other application when needed).

The options include:
1) An SQL database;
2) The Windows registry;
3) A file;
4) Some Windows-specific secret vault I haven't been able to Google as of yet...

I realize that options 1-3 have access control mechanisms, but I cannot really determine the pros and cons of one approach over the other. Considering these, what would be the best option?

The Windows-built-in secret store (analogous to Apple's Keyring) is called Credential Manager. See https://stackoverflow.com/questions/9221245/how-do-i-store-and-retrieve-credentials-from-the-windows-vault-credential-manage for (slightly dated but still usable) instructions on accessing it programmatically.

With that said, all that the Credential Manager does is encrypt your secrets with DPAPI and store them in a structured data store (I'm pretty sure it's in the registry). Since you're encrypting with DPAPI yourself, the Credential Manager buys you very little except possibly a bit of convenience (though DPAPI is very convenient, and so are most storage APIs).

Personally, I recommend encrypting with DPAPI and then storing the secrets in the user's Local AppData folder, in a subdirectory with your program's name (if the secret is machine-wide rather than per-user, you can use the ProgramData directory instead of AppData\Local, but of course this will make it world-readable). It's as secure as any other location reliably available in Windows, easy to delete when uninstalling the program, and easy to access. Using the current user's registry hive under Programs\ProgName is also an option, though. A database is pretty pointless unless your secrets are some kind of interrelated structured data, or you anticipate having a very large number of them. I wouldn't bother with Credential Manager unless the secrets you're storing are actually credentials and/or it's acceptable/important that your users be able to view them using the Credential Manager GUI.

With all that said, a few words of warning:

DPAPI uses a per-user encryption key that is different on every machine. If you copy DPAPI-encrypted data from one machine to another, you won't be able to decrypt it on the second machine.
DPAPI's encryption key is itself encrypted using a key derived from the user's password (among other things). If the user changes their password through the standard process (where the old password is provided), this is fine; the DPAPI key is decrypted and re-encrypted with the new password's derived key. If the password is reset (by an Administrator or via offline modification of the SAM data), the DPAPI key is lost forever. This is probably fine for your use case but is something you should know.
A lot of the stuff mentioned in this answer is Windows-specific, but .NET itself is cross-platform. If you want to be allow Mac, Linux, and other platforms to run your code too, take care to avoid Windows-specific features and functions.


Can I spoof my user agent so that the type of device I'm using doesn't show up? I was looking into spoofing a user agent, but all that has come up so far is spoofing the browser type. However, I can still see what kind of device I am using (tbh I'm not really even sure why someone would want to spoof the browser type).

I wanted to know if I can spoof my user agent so that it can become another device, or if there are any other methods so that when I use a browser, my device isn't shown. For example, if I own a Mac, does using Tor along with a proxy protect me from a website, like Gmail, finding the type of device I am using?

Your device type is explicitly encoded in the user-agent string. Compare these UAs:

Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E304 Safari/602.1
Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; SCH-I535 Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

In this example iPhone idicates, well, an iPhone, and SCH-I535 is the model number of a Galaxy S3. Consequently, if you change the UA to a custom string, most websites will identify you as a different device. However, there are also many advanced device fingerprinting techniques which are potentially less accurate but also harder to block.

  if I own a Mac, does using TOR along with a proxy protecting me from a website like Gmail finding the type of device I am using?

The Tor browser aims for a design that minimizes possibilites for device fingerprinting. However, it can't stop everything. For example, if you're running the browser in full-screen mode, you're giving away your device's screen resolution. You can read the Tor browser docs chapter on fingerprinting for an extensive list of what exact measures they take.


Plain text password emailed back during registration I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.

You don't know.

You technically don't even know whether the password is stored at all, let alone whether it's stored hashed. Them being able to email you the password immediately after you tell it to them says nothing of storage.


Can Mallory see my command line options on Windows? Can Mallory see my command line options on recent versions of Windows? (Google is not helping here)

Mallory is a non-administrator user on server X, as am I. I run foo.exe -x=s3cr3t

Can Mallory see -x=s3cr3t on say Windows 7, 8 or 10?

I ask because when using Process Explorer, as a non-admin user, I seem to be able to see command line options for System user processes. A SuperUser user claims the that they cannot see them, though they are Windows 10 and I am on Windows 7

I cannot confirm this ability in Windows 10, however it is possible in Win 7,8.
Not only is it possible with Process Explorer, but also in Task Manager, and via command prompt with WMIC.

From superuser.com:

  Open task manager (by CTRL-SHIFT-ESC, CTRL-ALT-DELETE or any other method).

  For Windows 7 (and probably Windows XP):

  Go to "Processes" tab. The on the "View" menu, select "Select Columns...".
  Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)
  For Windows 8:

  Go to "Details" tab. Right-click on any of the columns (eg. Names, PID etc.) and select "Select columns".
  Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)
  A column of Command lines of will be added to the currently displayed columns.

  [...cut...]

  You can do it without Process Explorer, too, using Windows' WMI service. Run the following from the command prompt:

  WMIC path win32_process get Caption,Processid,Commandline


Can an AES-128 key be reversed if the attacker can control plain text and capture cypher text and IV? We have a product under development that uses AES-128 with a Master Key XOR'd with the device's serial number and a single-use randomly generated IV to encrypt a password before transmission. Passwords are fixed length.

I have verified that an attacker can capture the serial number, IV, and cyphertext-password during a connection attempt. If the attacker buys our product they can also set the password. So they will then have the serial number, IVs, and as many plaintext/cyphertext-password pairs as they want.

Assuming they can put it all together, is this enough information to reverse the Master Key? It seems to be like it is, but I'm a little out of my element here.

I believe my question differs from the possible duplicate because in this case the attacker can generate unlimited amounts of fully-known plaintext/cyphertext. In particular, I believe that our device meets the requirements for vulnerability to power-analysis side-channel attacks.

Knowledge of the plain-text and it's direct encrypted cipher-text does not offer the attacker any method of reversing the master key other than brute force, which they will already have at their disposal by just knowing the cipher-text. Therefore, your system should still be secure.

To find a lot more detail and justification to this answer, I would recommend this post:
How less secure is an encryption if we know something about the original data?

Hope it helps!


Can you get virus just by visiting a website in Safari using cache? A few days ago I was searching for information to do an essay and I opened a page using the "in cache" option on Google. But then I realised that the page was not what I was expecting. My question is if I can get a virus from opening a page using that "in cache" option?

My browser is Safari.

Drive-by vulnerabilities in web browsers became a lot less in the past years. The browser vendors really upped their game in regards to security. Further, the Google cache should filter a lot of things out of a website which might be required by some attacks. So the risk is low.

But there is never zero risk. It is always possible that there is an unknown vulnerability in your version of Safari which can be exploited in a way which even works if the website is cached by Google. The risk is very low, but not zero. Still no reason to panic, in my opinion.


How to see absolute difference between DV and OV certificates? I know that browsers show no difference to the user between OV and DV certificates, but what is a sure way to find out if a certificate IS or ISNT an OV certificate?

Also, are there any technical differences in the cert?

I know that browsers show no difference to the user between OV and DV certificates, but what is a sure way to find out if a certificate IS or ISNT an OV certificate?
Also, are there any technical differences in the cert?

Another answer partly answers your question: How does an end user differentiate between OV and DV certificates?

DV certificate contains no identifying information in the organization name field. Typically, this value just re-states the domain name or simply says "Persona Not Validated".

The organization name field is not part of a domain validated certificate.
Additionally, the policy identifier is different for DV and OV:

Domain Validated: 2.23.140.1.2.1
Organization Validated: 2.23.140.1.2.2

You can find this field in Extensions > Certificate Policies.


Certicate verification with OpenSSL commandline I am trying to verify a random certificate with OpenSSL in Windows. I've installed Win32 OpenSSL, but how do I verify a random certificate with the OpenSSL commandline? I know there are other ways, but I want to use the OpenSSL commandline :)

Thanks for you help!

EDIT:
When I use openssl verify cacert.pem it gives me this error:

New error:

The first error was due to your trying to 'read' (and verify) a non-existent file.

The second would seem to not be an error, but a 'proper' failure to verify.

What the message actually says it that it cannot find the CA that issued the cert you are testing, and so cannot validate the chain (which would generally be, at minimum issuing CA > your cert).

The SSLeay demo server line in your second output would tend to indicate one reason for this is that indeed, you just generated a new CA.

It also looks like you are trying to validate your own CA cert, which is a little redundant - but if you really want to do that, you should run:

openssl verify -CAfile cacert.pem cacert.pem

A more useful/practical example would be validating a (hopefully) known-good cert. Not sure if you can pipe on Windows, but on Linux, you could do:

openssl s_client -connect google.com:443 </dev/null | openssl verify

If you want to see the cert, you can run:

openssl s_client -connect google.com:443 </dev/null | openssl x509 -text

I think you might want to spend a bit of time reading up on how PKI works: generally, a PKI is built when a 'trusted' entity (a Certificate Authority) issues a certificate for another entity - it basically vouches for that other entity (which can be an organisation, a server, a user, etc) being who it claims to be.

So validating/verifying a cert involves the following (grossly simplified explanation coming up):

from your end-user cert (i.e. the cert used on the domain you are checking - user here is whatever is making use of the cert, not necessarily a human), the Issuer is checked, and the Issuer's public key is also extract (for comparison against known keys for that issuer).
you could then check first that your end-user cert is properly signed (i.e. the signature contained in the cert is signed by the private key linked to the Issuer's public key, which is included in the cert)
you could then validate the Issuer's cert, either by checking a list of known-good certs (which is what the OS cert store does), or by repeating the previous two steps if the Issuer has been issued its cert by some other entity.

At some point, you end up at a self-signed cert belonging to an entity such as Verisign/LetsEncrypt/YourCAHere, which is the root of the chain of trust the PKI reflects.


malware classification based on action Where can I get info with a view to classify malware based on actions performed by the them. Eg. modifying registry files, copying themselves into other executable's etc.

If you mean how to automatically classify malware, this paper on Learning and Classification of Malware Behavior (Meta data) can be of help.


importing OpenVAS xml in metasploit I am practising in my lab with some metasploitable machines, and I just realised that the vulns declared by OpenVAS 6.01 in the scan report aren’t imported in Metasploit 4.11.5 by the db_import report-blah.xml.

When I read the report on the OpenVAS web interface, I see 72 vulns (with all kinds of vulnerabilities like ms15-043, a backdoor on port tcp 1524, etc.) but on the Metasploit db, I just have 51.

I also tried to import the report in nbe, but there is no difference.

Have you tried to load the openvas plugin in MSF, connect to your running openvas server, and import your report directly from openvas by issuing "openvas_report_import report_id nbe"?

I was having the same problem as you until I imported using the plugin.


How can user-less servers be authenticated without sharing secret data? Background:

This is the architecture of the platform I'm working on:

The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if they're valid the API returns a JSON Web Token (JWT). The JWT is generated using a secret symmetric key.

The API does not know the servers, but the servers know the API. Meaning, there could be one or many servers, but I would like to avoid updating the API with a list of all available servers.

The Problem:

There are several servers that run applications that need to make calls to the API. Currently, the way that this is being done is that each application on the server has the secret key, and creates its own JWT with it. Then that JWT is sent on the request to the API, granting access to proceed with the request.

This is obviously not ideal since the secret should exist only in one spot, and only be used by the API itself. Also, it significantly increases the risk of exposure, since the number of servers is going to grow.

Looking over this question, it seems like it may be the way to go (the server makes a request to the API, the API returns a JWT, the server then uses that JWT) - however, how do I know that the server is one of the ones I should allow access to?

The Question:

Is there a tried-and-true way to authenticate these servers without sharing the secret key? Could public/private keys be used for authentication?

Since the API does not keep track of the servers, could a server provide some data to the API which would identify them as a valid server to communicate with? Or is a white list unavoidable at this point?

The servers each need a own secret (shared secret or public/private keys where the public part is known to the API server or signed by it/a CA).

Each server then identifies itself and gets access to the data it is allowed!

If one server is compromised, you delete the shared secret/public key from the API server or revoke the certificate.

You can look at the OAuth 2.0 Client Credentials Grant for inspiration.


How secure is a land line phone call? What are the risks of communicating sensitive information using a land line? Once my voice gets digitized does the carrier use encryption during transport?

We have all heard about rogue cell towers (stingray boxes) which render all cell phone conversations easily intercepted, however this question only addresses traditional land lines.

POTS lines (Plain Old Telephone Service) are not encyrpted by the carrier.

While the signal can be intercepted by tapping into the physical line, as in some guy climbing up a telephone pole, the more modern method of intercepting land line conversations is by tapping into the line at the switch level, which requires access to the telephone carriers' facilities control systems.

https://en.m.wikipedia.org/wiki/Room_641A


Does fetch() of an https: resource verify certificate chain? The fetch() spec doesn't deal with SSL/TLS since these are socket-level protocols. So I assume that it implements it's calls to lower level connection services to ensure that certificates are verified and certificate revocations are checked.

But other than a wire trace, is there a way to be reasonably certain that fetch() is implemented that way on any given platform? Are there other specs that document that it will happen (beyond the TLS spec)?

There is some guidance:

https://fetch.spec.whatwg.org/#http-network-fetch

  The exact determination here is up to user agents for the time being.
  User agents are strongly encouraged to only succeed HTTPS connections with
  strong security properties and return network errors otherwise.
  Using the "deprecated" state value ought to be a temporary and last
  resort kind of option.


In the context of advanced electronic signatures, what does "sole control" mean? To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this means?

In our scenario, the signatory is a moral person (company), and the signature will be generated "automatically" during a functional sequence (the upload of documents to a repository). Can such a signature ever be "advanced" or "qualified" in the terms of the European law? If we create processes to ensure that only employees of the company can access the uploading functionality, does this satisfy the condition of "sole control"?

A signature with a pen generally makes implicit guarantees, eg. "read and approved", "ordered", "good for payment". In our case, the law wants the signature to warrant that the uploaded document is a true copy of a paper original, but ensuring this is outside the scope of uploading software. Why do digital signatures have no concept of a "mention", a short phrase making explicit the assurance that the signature represents?

I'm a Public-Key Infrastructure (PKI) developer, we definitely develop software for that use-case, so I can speak to the software side of your question. Complying with European law is more about how you write your corporate policies (and how you enforce them).

In a use-case like that, we would recommend that users have 3 keypairs (pairs of public / private keys):

An Encryption keypair for keeping documents confidential,
A Signing keypair, usually for user-login operations (called authentication) like signing emails, establishing SSL/TLS or VPN connection, etc,
A Nonrepudiation keypair for signing legally-binding documents.

While it's technically possible to have a single RSA keypair do all three jobs, we recommend three different keys because there are usually different policies around how each is handled. As mentioned in this answer, nonrepudiation keys usually have the strictest policies for what you are and are not allowed to do with them. These policies define what it means for a key to be "under the sole control of the signatory". For example:

Non-repudiation keys should never be backed up to a server.
Non-repudiation keys should only be used when the human to whom it belongs is sitting at the keyboard (ie no auto-logins like a VPN key would do)
Corporate policy should dictate that you should never share the password for your non-repudiation key with anyone else.
If two people do get access to the same nonrepudiation key, corporate policy should dictate that the key be destroyed and a new one issued to the rightful person.
etc...

As I understand it, each regional government has a list of key-management policies similar to the above that you have to follow in order for your digital signatures to be considered legally-binding. These policies are meant more for the administrators of your computer newtorks rather than for software vendors.

I'm no law expert, but my guess is that for your "document uploading" scenario, you'd need the uploads to be signed by individual humans rather than by a company-wide shared key. ie "This document was uploaded by John Smith, and in verifying his signing certificate, we can verify that he is an authorized document uploader for this company".


How to protect iKvM, IPMI, KvM Interfaces from 0day and other exploits In REF to http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack and the hacks of several companies and web hosts have been hit and had their servers wiped from remote management hacking.

What can one do to protect their web based remote management ports?

So far I've begun isolating them on VPN connections and limiting customers to their own private VPN and VLANS and keeping the remote interfaces on local IPs.

Is there anything else that can be done to improve their security?

The only solid way to protect a service against zero-day exploits is to keep that service from being accessible from the Internet.  That includes network-internal barriers to keep other compromised servers from being used as a starting point for an attack -- firewalling off IPMI from the Internet is pointless if someone can pass through the firewall to your web server and use it to perform the attack.


Which .CER file format is more secure for purposes of an AIA record? What file format is most appropriate or secure for the AIA record in a PKI certificate?

The options I'm aware of are:

DER encoded binary X.509 (.cer)
Base-64 encoded X.509 (.cer)

I also have the ability to save as .P7B but don't think that's a supported choice with AIA certs.

The Authority Information Access extension, which is added into certificates issued by a given CA, should contain a URL which points at a download location for the certificate of that said CA. This is described in section 4.2.2.1 of RFC 5280, in particular with this paragraph:

  Where the information is available via HTTP or FTP, accessLocation
     MUST be a uniformResourceIdentifier and the URI MUST point to either
     a single DER encoded certificate as specified in [RFC2585] or a
     collection of certificates in a BER or DER encoded "certs-only" CMS
     message as specified in [RFC2797].

So that's either binary DER (not Base64), or a .p7b (which means PKCS#7, which is the old name for CMS). The raw DER-encoded certificate is probably better supported than the CMS object, therefore I recommend using it.


Bypassing Access-Control-Allow-Headers header What i want to do is access the Content-type header which is placed under the Access-Control-Allow-Headers header as i want to attempt to change json to xml on a web application im working on to check if its vulnerable to XML or XXE injection.

XML entity attacks are attacks against the server, not the client. CORS headers like Access-Control-Allow-* are only relevant to the client. You completely ignore them when testing for purely-server-side vulnerabilities. Just use Burp Suite / ZAP / Fiddler (or curl, or your browser's dev tools, or nc) to change the content-type header and the payload.

With that said, the likelihood that a server which expects only JSON will see a request containing XML instead and decide "better load that into an XML-parsing library" rather than "WTF is this nonsense 400 BAD REQUEST" is... very low.


Why run ondemand scanners in failsafe mode when the virus could have encrypted itself? The internet is full of guides of how to remove malware on already infected computers. Normally, step 1 is to enter failsafe mode, so that the virus can't interfere with the anti-virus program that easy. But if you got infected, you shutdown your computer, then the virus could have time to encrypt itself. And when you later on scan your computer in failsafe mode, the antivirus program can't find the data that the virus encrypted.

My question is the following: If a virus did all the things above, would that make it undetectable, or would the AV find the decryption-module, and therefore detect the virus?

Thanks in advance!

This is a very broad question. As you have not really talked about the type of encryption whether it be file based or memory based and so on.

Short answer:
No, Just because it uses encryption doesn't mean it will be undetectable.

Long answer:
It will however be likely to be undetectable until the AV vendor manually reverse engineers and generate some form of signature to detect (Byte signatures, checksums and so on)

Let's talk about your self encryption. This can be done in many ways.
I am going to guess that you're talking about file encrypting.

So, Virus.exe encrypts itself which is highly complexed as you'll have to encrypt all sections (.text, .data and so on) and change OEP (Original Entry Point) to a self decrypt routine. The whole file has changed checksum but it won't change any more.

You could even go more advanced and encrypt itself each execute (Polymorphic code) which encrypt itself but self decrypt routine which will now be at the EP (Entry Point) can be used as byte signature to detect the malware as this has to be static regardless of the key you use to decrypt it. Otherwise, how would it know how to decrypt itself?

You could even go more in-depth into different forms of polymorphic code, metamorphic code, obfuscated code and so on but I don't know what exactly you're asking for. Either way regardless of what method you use to encrypt any form of itself will leave signatures for AVs vendors to manually reverse engineer and eventually to detect. The question is how long the wild malware will remain undetected for before it get send to a AV vendor to get reverse engineered and how long it will take the reverse engineer team to find static signatures they can use to identify the malware.

If this doesn't answer your question, leave a comment or update your question with the actual type of encryption you're talking about and I'll update my answer.


Disabling SSLv3 breaks TLS 1.1 connections Having a bit of an issue with a SPAM filter receiving incoming emails. I was recently notified by a client that emails had been bouncing back when trying to contact me following disabling RC4, SSLv2 & SSLv3.

The bounce back they've had is as follows.

  Message delivery to 'joeybob@somedomain.com' delayed SMTP
  module(domain somedomain.com) reports: connection with
  mail.somedomain.com is broken

In past communications I can see the following in the message header.

  version=TLS1_1 cipher=ECDHE-RSA-AES128-SHA bits=128/128

In speaking with our support network, I've been informed that by disabling SSLv3 it also disables TLS 1.0, and TLS 1.1 because they shared the same ciphers. Our client doesn't appear to be using TLS 1.2, and in prior communications I can see that they connect using TLS 1.1 which explains why their mail isn't getting through.

I can understand TLS 1.0 not being used, but I thought TLS 1.1 was still secure and wasn't aware that SSLv3 would have a direct impact on it?

Any help would be appreciated.

I've been informed that by disabling SSLv3 it also disables TLS 1.0, and TLS 1.1 because they shared the same ciphers.

This is wrong.
 There is a difference between disabling a TLS protocol version and disabling ciphers. But, a common error is actually that someone tries to disable the use of SSLv3 by disabling all ciphers which were defined for SSLv3 and up instead of just disabling the TLS protocol version. Also, there is actually software out there which does not allow to disable SSL protocol versions but only restrict ciphers.

For example with the mail server Postfix there are various options for allowing or restricting ciphers (smtpd_tls_mandatory_ciphers, smtpd_tls_mandatory_exclude_ciphers) but also options to allow or restrict TLS protocol versions (smtpd_tls_mandatory_protocols). Only the last should be used to restrict the protocol version.


Multi sub-domain login for content, spring security for main Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com
contentsite.com will have some content that is not available for users who have not non logged. But login will be via mainsite.com
What is the best way to implement this? Some users might be on http, we want them to be redirected back the http page they were on, if they click login. Besides that we need contentsite.com to know that a user had logged in and what ther id is.

There will be a seperate on register and on-profile change job that shares information from mainsite to contentsite.com

So the question is :  is encrypted user name enough (after login to tell content site that user has logged in? add random salt so it cant be spoofed?)
2. need webservice so contentsite can cross check login?

We are considering :

Redirection on login so we touch the 2nd site and allow it to place http and https cookies. Is this what google does (but only https) for youtube and other google sites? Or a combination of web services domain to domain calls in the background? Do we need API calls to stop man in the middle or is initial SSL enough? Finally we want to be able users to use most of the website in http or https besides the checkout, login and profile pages.
javascript add on for the content domain, with AES encrypted user name along with some hash. So no redirection but everytime we add content tag we pass encrypted authenticated user or anonymous of not yet logged in
oauth or auth0.com or other scheme, not sure if we need this as we are already using a world class spring security impl built by a big co and just want to share our login user id with other domain that is our own

Looked at a few question about the same thing like this node js question but they did not seem to fit exactly. Is there a standard we have missed?

We are using spring security for the main store. The content site will have no data base but we will share some profile information via separate non web channels (on sign up and profile change api calls).

For login the store website has SSL pages ready, that redirect you back to the original page (http or https).

I think OAuth is your best bet; specifically OAuth2.  It might be a little overkill, but it does what you want.

OAuth

  OAuth provides client applications a 'secure delegated access' to
  server resources on behalf of a resource owner.

What does this mean?  You have a client application, contentsite.com, that you would like to give secure access to through mainsite.com.  User registration should already be implemented.  The contentsite.com will redirect to mainsite.com for login, and provide a mainsite.com access token to contentsite.com.  If the user logs out the token becomes invalid, and if it's used it should redirect back to login.

contentsite.com would register with mainsite.com as an application and receive a secret value as well as a client ID.  The client ID is used when requesting a token.  Access tokens are used for any other resource access once granted.  High-level overview of OAuth2.

To accomplish all this you'd need to implement an OAuth provider on your main site.  Here's a step by step with some server code written in Python using Flask.  Client side implementation is pretty simple.  Given the client ID and secret you make a request to your OAuth provider for a token.  Here's a link to a nice little Python library, you can declare the redirects right there client side.  You would just replace the Google specific links with your site specific links.

Like I said it might be a bit overkill, but it does exactly what you want.  If you wanted users to be able to login with things like Facebook or Google+ or whatever then the functionality is there.  Also, OAuth2 standard requires SSL/TLS to be used for its requests.  Always a plus.

Spring Security

Spring Security OAuth - Main Page
Spring Security OAuth2 - Developer's Guide
Spring Security OAuth - Github

Conceptual Examples for OAuth (non Spring Security)

How to Implement Safe Sign-in via OAuth - This link focuses on using Facebook, Google+, etc as a basis for registration/login.  If you wanted to support that.

Some notes on implementing a Node OAuth2 Server, from Papers.

Here's a good resource for OAuth libraries for different languages, server and client side.

OAuth2 RFC - If you like reading RFCs


Microsoft Edge Cache Data On CCleaner in Windows 10, there are options for Microsoft Edge, which I do not use for browsing the web. Deselecting the option to clean for MS Edge significantly speeds up the process, but I am wondering if even though I am not using Edge, Windows is using it somehow to store data that I may want removed for privacy.

Should I leave it included in the cleaning, or leave it out?

I am not a security professional, neither am I smart in this area. However, Cherlynn Low wrote an article that may help. It is called "How to Disable or Enable Cookies on Edge Browser." Here is the link: http://www.laptopmag.com/articles/disable-enable-cookies-edge-browser

Now, my answer to your question. If you are running Windows, then you can can bet that Microsoft is collecting data whenever you are connected to the internet. It may not be personally identifying information, but it does pull from your computer to keep it updated. That said, Edge is related to Microsoft, so while it may not directly "store" other browser information, the parent company does.

Case in point: If you are not using Edge, then it is not directly collecting cookie data. However, it can, but only if you allow it.


Why is client-side hashing of a password so uncommon? There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms.

But I can think of quite a few advantages, like protection against cross-site leaks or malicious admins, which SSL does not provide.

So why is this practise so uncommon among websites?

Inventor of JavaScript password hashing here

Way back in 1998 I was building a Wiki, the first web site I'd built with a login system. There was no way I could afford hosting with SSL, but I was concerned about plaintext passwords going over the Internet. I'd read about CHAP (challenge hash authentication protocol) and realised I could implement it in JavaScript. I ended up publishing JavaScript MD5 as a standalone project and it has become the most popular open source I've developed. The wiki never got beyond alpha.

Compared to SSL it has a number of weaknesses:

Only protects against passive eavesdropping. An active MITM can tamper with the JavaScript and disable hashing.
Server-side hashes become password equivalents. At least in the common implementation; there are variations that avoid this.
Captured hashes can be brute forced. It is theoretically possible to avoid this using JavaScript RSA.

I've always stated these limitations up front. I used to periodically get flamed for them. But I maintain the original principle to this day: If you've not got SSL for whatever reason, this is better than plaintext passwords. In the early 2000s a number of large providers (most notably Yahoo!) used this for logins. They believed that SSL even just for logins would have too much overhead. I think they switched to SSL just for logins in 2006, and around 2011 when Firesheep was released, most providers switched to full SSL.

So the short answer is: Client-side hashing is rare because people use SSL instead.

There are still some potential benefits of client-side hashing:

Some software doesn't know if it will be deployed with SSL or not, so it makes some sense to include hashing. vBulletin was a common example of this.
Server relief - with computationally expensive hashes, it makes sense for the client to do some of the work. See this question.
Malicious admins or compromised server - client-side hashing can prevent them from seeing plaintext passwords. This is usually dismissed because they could modify the JavaScript and disable hashing. But in fairness, that action increases their chances of being detected, so there is some merit to this.

Ultimately though these benefits are minor, and add a lot of complexity - there's a real risk that you'll introduce a more serious vulnerability in your attempt to improve security. And for people who want more security than password, multi-factor authentication is a better solution.

So the second short answer is: because multi-factor authentication provides more security than client-side password hashing.


Why can't scanners usually detect stored XSS? Is there a way to automate the detection of stored (persistent) xss,? I'm desperately looking for tools, preferably with some guide, also preferably open-source, to detect stored xss vulnerabilities. It is observed that a handful of them doesn't give the expected results with stored XSS.

I have tried with ZAP Proxy and xsser, but only found documentation on reflected XSS for those tools.

For stored XSS the "injected" page may be different from the vulnerable page.

I'm benchmarking tools on a simple vulnerable app found here: https://hack.me/101061/persistent-xss.html

Manual exploitation took seconds, but so far I was not able to use automatic tools, even in a "guided" mode where I specify the URL of the form and let the tool find vulnerable pages.

I suspect that both cited tools are able to do that, but it's either too trivial or too complicated to be shown in examples/blog posts. I would be really grateful if someone could show such use case.

Here are a few problems with what you are looking for and why they are virtually non-existent.

Tools find reflected XSS by searching for the injected script snippet in the HTML source of the immediate response to request which injected the script.
The same tools will detect stored XSS as well if the script is reflected in the immediate response.
But sometimes the immediate response may not reflect the script even if it is vulnerable to XSS. For example a user submits an internal form to a high privileged user which won't be visible to him/her immediately. In this case if the form is vulnerable to persistent XSS it will execute at the browser of high privileged user.
Persistent XSS mostly happen on POST request. Scanning post request usually lead to database exhaustion.

What you can do to automate:

At this point I am unaware of any tool which can be used for the same. However I would like to suggest a work around.

Use Burp Professional trial version [It will take a day or two for them to send the trial license.]
In User Options > Misc in Logging Section click the checkbox to log all the responses.
Browse through the application, spider it, Select the requests you want to scan, send them to the scanner tab. It will identify the usual vulnerabilities, but it may miss some persistent XSS.
Browse and spider again through the entire application after the scan with all the user privilege levels.
Check in the log file for scripts. Burp injected scripts can be distinguished as they usually carry a signature of random characters with them. For example the script injected might look like

jklmn |injected script which stackexchange won't let me post| jklmn
So if you identify any injected scripts in the response log file, you can identify the page, parameter and the source of the reflection.


Is it dangerous to serve executable cgi files in public folder? In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable cgi file from everywhere.

What is the security risk for serving webpages directly from executable cgi files? For example, what is the risk for http://example.com/hello.cgi where executable file of hello.cgi is in the root (public) directory? (comparing with a non-executable PHP file of hello.php)?

Of course, cgi scripts are practically served via FastCGI to persist the connection, but does it have an better security too?

In short, separating CGI files, which are often scripts, makes it easier to ensure that the web server will never mistakenly return the text of the script to the client instead of executing the CGI and returning the results.  If the script "source code" is revealed to the client, it may expose sensitive information, such as embedded database connection passwords or just information about how the script executes that could be abused by an attacker.

For example, the entire /cgi-bin directory is usually configured to execute files and never to return content.  If you edit hello.cgi and leave an editor backup file hello.cgi~ behind, the server should never return that file as content if /cgi-bin is configured correctly.  On the other hand, if that backup file is sitting in a normal web root that serves files, then the magic mapping of ".cgi -> execute" won't take effect for the hello.cgi~ file, and the server may therefore return the content of hello.cgi~ instead of executing it.


List of Top security risk/attack scenarios for android application WHat are the possible security risk/attack scenarios for android application.
This is with regards to the OWASP top 10 Mobile Security threats discussed here:
https://www.owasp.org/index.php/OWASP_Mobile_Security_Project

I would like to know which of the ten and if applicable how the threat is generated and how it can be mitigated.

Your question is probably not answerable here in its current form. The entire point of the OWASP mobile security project is that there are a great many threats, of which the top ten are listed, and a large number of mitigating controls or activities.

Insecure Data Storage
Weak Server Side Controls
Insufficient Transport Layer Protection
Client Side Injection
Poor Authorization and Authentication
Improper Session Handling
Security Decisions Via Untrusted Inputs
Side Channel Data Leakage
Broken Cryptography
Sensitive Information Disclosure

If you read the page you linked to, you will see their summary of risk, and a current list of mitigating controls for each of the top ten, and this is still a work in progress so the expectation is that the community will help to build more detail in to the document.

All those ten are applicable to Android phones, so read the risk summary for each one and look at your application to see if you use any of the mitigation controls.


How dangerous is it to allow arbitrary webhook urls to post to? I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me thinking: I am validating that the webhook url is indeed a valid url, but that's it.

What if, for example, the API posts to a webhook that redirects forever? Or, maybe even worse, a webhook that in turn communicates with the API again, triggering more webhooks, so that eventually the API has to handle an infinite amount of webhooks?

These are just two examples, but I guess a lot more could happen.

The one thing I have come up with is to put all posts to webhooks in background tasks, so that at least the workload is distributed to workers, in case someone tries a DOS attack (but then again, I am not sure if that properly protects me from DOS attacks).

Are there any other common threats/pitfalls when using webhooks? What can I do to defend against harmful webhooks and how can I detect them?

In addition to "validating webhook URLs", implement rate limiting on your API endpoints and/or calling webhooks.

If you have a big/popular enough service you should have this even if you don't allow users to have custom callback URLs — eventually somebody will attempt to make a million requests against a resource-intensive (for you) API endpoint, and you really should have protection in place.

That is — you don't have to thoroughly try to detect "malicious" URLs — just have logic in place that would cut off access if a single account makes X requests within Y minutes (add more complex logic as needed).

——

Of course you should also:

run webhooks asynchronously (in the background) so your API speed does not depend on a 3rd party.
run basic checks that prevent infinite redirect loops, and (for example) blacklist your own domain (make sure to check the blacklist for each redirect target separetely).


Monitor incoming TCP/UDP flood attack and graph it I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results.

I have some VPSes that will perform a tcp or udp flood attack simiultanesly on another specific server (Debian/Ubuntu), all of them owned by me of course. Something like a tiny scale DDoS attack.

I want some suggestions for existing tools or new programs to be installed on the target server (Debian/Ubuntu server distro) that can monitor and produce traffic graphs and related charts so I can present the network state before and after the attack.

I don't want to mitigate or stop the attack, but to show the results of it and if possible in a fancy way.

I'd appreciate every idea and suggestion, thanks.

PhpChart(http://phpchart.net/) if you got Apache server.

pChart(http://pchart.sourceforge.net/) if you are willing to compile php to work with graphic lib

MRTG if you just want a png / jpg files to put in simple html web page.

Simple bash script to count specific trafic with tcpdump. Send output to the file and count lines to pass to the rendering engine.

I use something like this:

#!/bin/bash

/usr/local/sbin/tcpdump -l icmp >> icmp.log &

pid=$!

# will monitor the traffic for 60 seconds
sleep 60
kill -9 $pid &> /dev/null

packets=$( cat icmp.log | wc -l );
echo $packets
rm icmp.log

This will monitor the icmp traffic for 60 seconds then echo the number of packets. Pass the output to the file and make the chosen rendering engine generate the picture.

<?php
require_once("../phpChartX/conf.php");
?>
<!DOCTYPE HTML>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>tcpdump</title>

<?php

$max=0;
$file=file_get_contents("scripts/icmp.1h");

$file=explode( "\n" , $file );

$o1=explode(" ", $file[0]);
$o2=explode(" ", $file[1]);
$o3=explode(" ", $file[2]);
$o4=explode(" ", $file[3]);
$o5=explode(" ", $file[4]);
$o6=explode(" ", $file[5]);
$o7=explode(" ", $file[6]);
$o8=explode(" ", $file[7]);
$o9=explode(" ", $file[8]);
$o10=explode(" ", $file[9]);
$o11=explode(" ", $file[10]);
$o12=explode(" ", $file[11]);
$o13=explode(" ", $file[12]);
$o14=explode(" ", $file[13]);
$o15=explode(" ", $file[14]);
$o16=explode(" ", $file[15]);
$o17=explode(" ", $file[16]);
$o18=explode(" ", $file[17]);
$o19=explode(" ", $file[18]);
$o20=explode(" ", $file[19]);
$o21=explode(" ", $file[20]);
$o22=explode(" ", $file[21]);
$o23=explode(" ", $file[22]);
$o24=explode(" ", $file[23]);

//$all=array( $o1, $o2, $o3, $o4, $o5, $o6, $o7, $o8, $o9, $o10, $o11, $o12, $o13, $o14, $o15, $o16, $o17, $o18, $o19, $o20, $o21, $o22, $o23, $o24 );
$all=array( $o24, $o23, $o22, $o21, $o20, $o19, $o18, $o17, $o16, $o15, $o14, $o13, $o12, $o11, $o10, $o9, $o8, $o7, $o6, $o5, $o4, $o3, $o2, $o1 );

for ( $i = 0; $i < 23; $i++ )
{
        if ( $all[$i][1] > $max  )
        {
                $max=$all[$i][1];
        }
}
$max=$max+2;

    /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    //Line 1 Example
    /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

    $pc = new C_PhpChartX(array(
                                array(
                                        array(24-$o1[0], $o1[1]),
                                        array(24-$o2[0], $o2[1]),
                                        array(24-$o3[0], $o3[1]),
                                        array(24-$o4[0], $o4[1]),
                                        array(24-$o5[0], $o5[1]),
                                        array(24-$o6[0], $o6[1]),
                                        array(24-$o7[0], $o7[1]),
                                        array(24-$o8[0], $o8[1]),
                                        array(24-$o9[0], $o9[1]),
                                        array(24-$o10[0], $o10[1]),
                                        array(24-$o11[0], $o11[1]),
                                        array(24-$o12[0], $o12[1]),
                                        array(24-$o13[0], $o13[1]),
                                        array(24-$o14[0], $o14[1]),
                                        array(24-$o15[0], $o15[1]),
                                        array(24-$o16[0], $o16[1]),
                                        array(24-$o17[0], $o17[1]),
                                        array(24-$o18[0], $o18[1]),
                                        array(24-$o19[0], $o19[1]),
                                        array(24-$o20[0], $o20[1]),
                                        array(24-$o21[0], $o21[1]),
                                        array(24-$o22[0], $o22[1]),
                                        array(24-$o23[0], $o23[1]),

                                )),'chart1');

    $pc->set_title(array('text'=>'icmp'));
    $pc->set_axes(array('yaxis'=> array('numberTicks'=>round(($max+1)/2),'min'=>0,'max'=>$max,'show'=>'false'),'xaxis'=> array('min'=>1,'max'=>23,'numberTicks'$
$pc->set_grid(array('background'=>'#fefbf3','borderWidth'=>2.5));
$pc->add_series(array('color'=>'rgba(68, 124, 147, 0.7)'));
$pc->set_series_default(array('fill'=>true,'shadow'=>false,'showMarker'=>false));
    $pc->draw(600,200);

?>

This is what i use to render the data (phpChart). It has 60 markers - one for each minute.
Hope this will help.


How to hide a process in Windows? Is there a way to make a process hidden without using any Administrator-level priviledges? I am building an antivirus which I want to protect from malware's actions, such as ending the process, or even detecting it. BTW, the targeted operating systems are Windows.

Are there any C++ or C# libraries or examples for how to do this, and is it possible?

https://www.apriorit.com/dev-blog/160-apihooks
Here's a good tutorial and explination on this. Many antiviruses are taking the same step and using malware like functionality in order to combat malware. Pretty neat how everything is transforming.

  Mhook library
  Several API hooking libraries exist. Typically, they do the following:

  Replace the initial part of a defined function code with our own code (also known as trampoline). Upon execution, the function jumps to a hook handler.
      Store the original version of the replaced code of the defined function. This is required for the defined function to operate properly.
      Restore the replaced part of the defined function.

  About API hooking

  Windows API hooking is a process allowing to intercept API function calls. This gives you the control over the way operating system or a piece of software behaves. Some of the software solutions that utilize hooks include: antimalware software, application security solutions, security monitoring tools, system utilities, tools for programming, and many others.
  API hook types

  API hooks can be divided into the following types:

Local hooks: These influence only specific applications.
Global hooks: These affect all system processes.

  The type of hook technique for Windows that we cover here belongs to the global type. It affects all processes across all sessions (as opposed to the SetWindowsHooks method, which is limited only to a selected desktop).


What kind of math is possible in a SmartCard? I'm interested in programming Prime numbers in an element field on a SmartCard.

Where can I learn about a smart card's "inputs" and "outputs" so I can call it from a custom application?

The math I need to do is:

 ( (BigInteger * BigIntegerA)/BigInteger) + BigIntegerB

I need to keep BigInteger A and B secret, and resident on the device.

A smart card is a general computing device that is Turing complete; basically it is a system-on-a-chip (SoC) with a limited amount of inputs / output. So in principle you can calculate anything with a smart card.

BigInteger (bignum) arithmetic however is tricky on such small processors. Many smart cards are 16 or even 8 bit computing devices (although 32-bit ARM is making some inroads even there). This is problematic for large number calculations such as multiplication and division. Addition can be easily implemented on any CPU of course - it is very easy to extend 8 or 16 bit additions to an N bit addition for any large N.

For this reason, many smart cards contain a coprocessor that contains a Montgomery multiplier, which is mainly used to perform asymmetric cryptography such as RSA and ECC (Elliptic Curve) calculations. The availability of this coprocessor for general purpose calculations depends on the operating system. Java Card for instance contains an optional bignum interface, but this interface is not often implemented.

With these kind of calculations it is likely that you need low level access to the coprocessor. If you want to keep A and B secret then you also need to keep side channel analysis - DPA and sharks with lasers: LFI) in mind, so if you want to perform the calculations yourself you're in danger.

The inputs and outputs can be performed using the normal APDU interface, which is the default for almost any smart card. You may need extended length or chained APDU's though, if your input or output values are large enough (255 bytes is the default maximum input, 256 bytes the default maximum output).

How you program the smart card depends on the operating system on the smart card. Java Card + Global Platform is the default for most manufacturer independent applications, but it has a relatively high level API (often extended with proprietary API's).


EKS managed worker nodes security patching Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?

This is likely to depend on exactly how your worker nodes are provisioned in the cluster.

If you're using unmanaged node groups then the AWS documentation here recommends that the customer upgrade their nodes manually.

If you're using managed node groups , AWS manage the node lifecyle as detailed here which I would take to mean that they will be patched and upgraded by AWS.

Of course if you're using workloads in EKS based on Fargate, the underlying hosts are managed fully by AWS, meaning you don't have to worry about patching them.


Can there be a virus that uninstall itself? Is there possible situation where a file contains malicious codes and after the code is excuted, the virus attach itself to another file and delete the malicious code from the file where it comes from?

Is there possible situation where a file contains malicious codes and after the code is executed, the virus attach itself to another file and delete the malicious code from the file where it comes from?

Yes, once the virus program is a running process (program loaded in RAM), it can easily access its own program file and delete its executable file from persistent storage.
The C code to do this self deletion is very simple, since the program file name is the zeroth argument of the argv input array pointer to the C main function. And, for example, the remove function can be used from the stdio library to delete a file by name.
For example:
#include <stdio.h>
int main(int argc, char *argv[]) {
    remove(argv[0]);
    return 0;
}

If you compile and run the above source code it will delete its own executable.
Injection into another process is also fairly straightforward, but the exact form of the source code to perform such functionality is more operating-system dependent.


If a hacker gets into my PC can he get to my saved windows live mail passwords? If a hacker gets into my PC can he steal my emails passwords?  I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail accounts and don't want to enter the passwords each time I open my PC.

Yes, but if a hacker gets into your PC, he or she can also install a keylogger that records everything you enter, so even if you did enter your passwords every time rather than saving them, you still wouldn't be safe.

The best advice is to practice safe computing and don't allow yourself to be infiltrated in the first place.

The next best advice is that if you're already past this point, or at any point determine that your system has indeed been compromised, Nuke It From Orbit, re-install and rebuild your system from the ground up.  This is the only way you can reasonably guardsmen it will be clean again.


Where are the user credentials stored when remember password is selected? Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials are stored in cookies in the client side itself? That would make huge security issues right? Somebody please explain

Usaually the user's browser stores some cookies with a random string identifying the user on the server.
More secure variants of this additionally check other parameters as the browser version, OS of the user and approximate location.

Basically, if you visit a webpage like facebook with a cookie, you get authenticated only with the random string in the cookie.

How this works:
If you log in, the server generates this random string and stores it in it's database (togehter with other identification parameters). Additionally it sends this string as a cookie to the user's browser, where it is stored and delivered to the page with every request.
So if there is a request with a random value, the server checks if it matches with the other identification parameters and - if so - accepts you as a logged in user.


How can "unvalidated redirects and forwards" be exploited? The OWASP example for Unvalidated Redirects and Forwards says that:

  The application has a page called “redirect.jsp” which takes a single parameter named “url”. The attacker crafts a malicious URL that redirects users to a malicious site that performs phishing and installs malware.

How does an attacker crafts a malicious URL and forces it on the victim? If one goes to foo.bar, fills a form and submits it, how can one be redirected to amalicious site?

Lets say there is a url called www.example.com/redirect.jsp?url=www.example.com/login that is used to redirect to the login page. I craft a link to www.example.com/redirect.jsp?url=www.myphishingsite.com/login which redirects to my phishing site. People look at the domain name and think its legit. It can also be used to DOS something and conceal your identity from the target.
There is no form involved.


Battery Backed SRAM (and Digital Forensics) Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power.

Combining this with drive encryption. I see this as being a highly effective method of securely transporting data, that in the event of emergency could be fairly rapidly (Around five minutes according to research at Princeton University) erased by removing the charge from the volatile memory.

Do you know of any current volatile memory implementation that could achieve such a result?

This is perfectly feasible. Current RAM only holds its storage while power is applied to it, so doing that in a mobile device is no different to doing it in a computer.
And you are right - turning the power off will lose all data on the drive in a short time frame.
All common RAM implementations can do this. All you are wanting to do is scale down from something you could do right now with a laptop to just the RAM.


How to properly generate and use (m)TANs? If you have an application that uses transaction authentication numbers (TAN) or mobile TANs, how do you generate them correctly? What are the pitfalls?

And should you only allow the next number on the list, or what are the best practices of using TANs?

The most important thing you need is a (good) random number generator. I've seen some cases where TANs where not randomly distributed and so in some kind guessable.

You just generate a list of TANs. The user can select one TAN for each transaction. This is one of the most unsafe variants of using TAN lists. The user can be tricked into some phishing site, enters user name, password and TAN. The attacker take them and uses it.
A better version are indexed TANs (iTAN). Every TAN gets some index number. When the user wants to finish some transaction the site asks for a TAN with a specific index number. When the user visits a phishing site and enters also username, password and TAN it is less likely that he enters the TAN which is needed by the next transaction. So this gives more security.
Mobile TANs (mTAN) is in my opinion the best way for TAN management. If the user wants to finish a transaction, a short message (SMS) is sent by his counterpart. He has to enter exactly this TAN. So if the user visits phishing pages he simply has no valid TANs anymore.

You should decide what kind of TAN you really need according to the security requirements you have. Besides from creating TANs you should have an eye on the distribution channel (snail mail, e-mail, sms etc.) of your TAN lists. If you choose an unsafe way this can also put the user to risk.


Is IKE aggressive mode really less secure than main mode? This guy argues it is not: https://www.youtube.com/watch?v=DuowFgNKAIg

I really confused about this. According to him, the only purpose of main mode is to make the peers anonymous, but in order to use main mode you need to manually configure the receiver's IP to setup the connection and that IP  is view-able to attackers so you don't get any benefit from it.

Am I understanding this right? He seems to be saying the only reason people use main mode is because the RFC is telling them to.

Edit: OK so I'm still a little unclear on this but after reading this blog post it seems main mode does more then just protect the identities of the peers.

It also encrypts the hashed shared key right?

So with aggressive mode I can get the hashed key and ( depending on key length,my compute power, etc) potentially brute force the hash. But with main mode that hash is encrypted so I would have to crack the encryption (a far more challenging feat then brute forcing the hash of a weak password) and then also have to brute force the hash too? I guess if I have already cracked the encryption I know the shared key anyway so I don't even need the hash?

It also encrypts the hashed shared key right?

Correct. When using aggressive mode combined with pre-shared key (PSK) authentication the hashes in the second and third messages are sent in the clear. Which means a passive attacker can try to determine the PSK via brute force or dictionary attacks.

With the PSK an active attacker can impersonate the server and collect XAuth secrets (transmitted in the clear), which, unfortunately, was (or still is) often used in combination with aggressive mode and PSK authentication (even in large scale deployments where the PSK could be considered public).

  I guess if I have already cracked the encryption I know the shared key anyway so I don't even need the hash?

That's true for IKEv1, as the PSK is used to derive SKEYID (from which the remaining key material is derived). But not for IKEv2 where an active attacker can get the AUTH payload of the initiator and attack it. Afterwards it could again impersonate the server and collect e.g. EAP-MD5/MSCHAPv2 hashes to brute-force user credentials.


Trouble understanding how passwords are authenticated I need some help understanding how password are used to authenticate who you are and thereby allow you, the user, to have access to the appropriate data.

I have read these two articles over here:
https://stackoverflow.com/questions/549/the-definitive-guide-to-form-based-website-authentication

How to securely hash passwords?

and basically my questions sort of flow from these articles.  I am going to try and summarize what I think it is saying as part of my attempt to understand.

1.User creates a password (say "123456" is the password, I know that is a terrible password).
2. The server uses a key derivation function with a salt and iterations to create a key for that user to encrypt that user's data.  So say for example we use PBKDF2.

After the key derivation, I know we should not store the passwords themselves as plaintext.  But I am not sure what to do next.

Specifically in one of the articles I read, the author said this

  A cryptographic hash should not be used for password storage because user-selected passwords are not strong enough (i.e. do not usually contain enough entropy) and a password guessing attack could be completed in a relatively short time by an attacker with access to the hashes. This is why a KDF is used - these effectively "stretch the key" meaning that each password guesses an attacker makes involves iterating the hashing algorithm multiple times, for example, 10,000 times, making the attacker's password guessing 10,000 times slower.

Does this mean that instead of hashing the plaintext password (e.g. hashing 123456), the server instead hashes the key generated by running PBKDF2?  So is the third step then to hash the keys?

Because the other article says something a bit different.  The other article says

  We need to hash passwords as a second line of defence. A server which can authenticate users necessarily contains, somewhere in its entrails, some data which can be used to validate a password.

Once the password has been created, say the user wants to end the session for whatever application is on.  Say he wants to get on the application the next day.  He enters his username and password.  Are the following the correct steps taken when the user wants to authenticate who he is?

User enters password.
Server runs key-derivation on that password
Server hashes the key with the particular hashing algorithm
Server calls the hashed key for this particular username from the database.
The output of steps 3 and 4 are compared.  If they match, then the user is authenticated, otherwise denied.

I read through the material and reread the Wikipedia entry on PBKDF2. I think I understand your confusion. PBKDF2 is a standard developed for how to derive a password verifier - it is an algorithm, but it doesn’t specify the exact details as it leaves some particulars open for implementation. These include the particular hashing function or PRF, salt size, iteration count and length of the output (key length). I’ll get back to all of this below.

Next, the article mentions cryptographic hash. What they mean by this is SHA-1 or MD5 or one of their brethren. Think of a cryptographic hash as a raw building block developed by cryptographers and designed to meet a certain set of constraints, in particular robustness in the face of known or discovered attacks against prior hashes including improvements in computing power. Also, why is the cryptographic part important? Because simple hashing that you or I might invent would be easily broken, whereas the hash algorithms cryptographers invent are resistant to various known attacks. There was a time when passwords could be stored in plaintext. People didn’t know how to break into the system files and recover the passwords. However, admins could see the raw passwords and sometimes certain system operations could be tricked into revealing passwords. Subsequently, passwords were hashed with any old algorithm and then cryptographic hashes.

The problem with cryptographic hashes is that hackers could steal the password tables/files and use rainbow tables to match passwords. I may not know your password, but if I have its hash and I run a dictionary through the hash algorithm and a result matches the hash, bingo! Now, offline I can just build a large database of every word or sequence I choose at my leisure and anytime I get any password hashes, I match them against the prebuilt table.

In comes salt. The salt, which should be the same length as the cryptographic hash output length, kills being able to prebuild a rainbow table. Every password hashed with a unique salt means even if two people share the same password (unknowingly) then no one could compare their hashes and discover that fact. The salt may be kept in the clear. It is not a secret, so much as a rainbow table nullifier.

Once computers became really fast, it became important to further thwart hash breaking attacks on the chance someone steals your password hash table. To do that, security folks decided that just doing more rounds of hashing would address the problem. Think of a cryptographic hash as really a KDF with only one iteration. Instead, some folks recommend 10,000 iterations.

Finally, we get to the KDF (Key Derivation Function) part. In the KDF, we combine a password (plus perhaps a username) and a salt and run it through some particular cryptographic hash 10,000 times. There’s the added bit of the PBKDF2 standard which allows you to suggest the output length. You might want to use the PBKDF2 to generate a key for a encryption algorithm or to pass to some other cryptographic function. The standard suggests a secure way to smear entropy bits throughout the entire output without risking reversing the inputs; always a problem for security protocols.

With all of this in mind, to answer your questions: (a) store and use the results of the PBKDF2 directly, there’s no need to apply any other operations on the password verifier and (b) in your list of steps at the end step 3 isn’t really needed and step 2 does all of the work including running many iterations of a cryptographic hash to create the PBKDF2 output.


Directory traversal in a URL? Scenario:

I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/
However, I also have some secret pictures in /var/www/pictures/secretpics/ which I must keep hidden.

So I updated my nginx conf with:

location /pictures/secrectpics/ {
   deny all;
   return 404;
}

So I tested this in my browser. I typed in www.myexamplesite.com/pictures/secretpics/secret01.png and received 404. (assuming that secret01.png is a real picture.)

Questions:
1. Is there a way to circumvent this and actually get access to secret01.png?

For example, is something like the following possible?
www.myexamplesite.com/pictures/../pictures/secretpics/secret01.png

If the above is possible, how should I secure my secretpics?

According to RFC 3986 Section 5.4, this has been specified to be resolved as absolute according to the URL itself.

You can imagine the ramifications of allowing double dots go unchecked until they are used to reference a real server file.

I did a test using wget and the requested URL was converted to an absolute URL.

This obviously relies on the client code requesting the resource and server to resolve URLs before they are used within the server. The server software, which in the majority of cases would be Apache, NGINX, IIS or similar, should never trust anything coming from the client.

$ wget https://www.nytimes.com/section/world/../../section/politics
--2017-08-24 17:05:20--  https://www.nytimes.com/section/politics
Resolving www.nytimes.com... 151.101.29.164
Connecting to www.nytimes.com|151.101.29.164|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 127149 (124K) [text/html]
Saving to: ‘politics’


Can I use an encryption of a url as a password to use on that url? I was thinking of writing a little program to generate passwords for me. What I want to do is encrypt the url of the login page with my master password, and take the first ~20 characters as my password for that login page (or however many characters any password length restrictions allow).

What I want to know is, is this secure, even if someone were to find my code (or this question)? By secure, I mean, as secure as the master password itself.
For instance, if a site is compromised and an attacker gets one or more of my encryptions + url, can he extract my master password from that?
If it's not secure, can I make it secure by adding something?

PS. I realize that this will also screw me if the login page ever changes url, but I can just reset my password then.

Is this secure, even if someone were to find my code (or this question)? By secure, I mean, as secure as the master password itself.

Yes, this is as secure as your password if you choose your encryption method carefully. In fact, what you want isn't encryption; what you need is a hash function (such as sha256) which takes input and scrambles it to produce a fixed-length output:

hash = sha256(url)

Obviously that's not good enough because there's no master password involved, so you might try

website_password = sha256( password || url)

or

website_password = sha256( url ||  password)

However, even though that might look perfectly fine, don't do it like that!. It's not secure.

What you should do is use a pre-existing primitive, HMAC, which guards against some weaknesses of the above two examples:

website_password = hmac(password, url)

This should be secure (the security depending on the quality of your password and the strength of the hash function used in hmac (you have some room for decisions there - hmac defines a protocol, but gives you a choice in hash primitive).

Still, rockStars's question is valid: Why not just use a password manager and decouple your master password from the site passwords? Because if someone guesses your master password, all your site passwords are immediately known.


How to securely hash/tokenize a string A system I'm working on accepts as input a customer account number and needs to generate a token based on it. We're not allowed to store the plain text of the account number itself, so the goal of the token is as follows:

Can not be reversed into the account number.
Can be used to lookup and uniquely identify an account metadata record in our database.

Account numbers resemble credit card numbers. They're 16-digit long numeric strings; the first 4 characters are constant; the last character is a computable check digit. This means that the actual size of the input set is an 11 character numeric string: 99,999,999,999 possible permutations.

I've thought about the methods below. Assume hash means a sufficiently slow secure hash such as high iteration PBKDF2, bcrypt, or argon2 and encrypt means AES256.

1. Plain Hash

hash(account_num)

While being simple, this approach is easy to reverse via brute-force and is vulnerable to rainbow tables.

2. Per-Account Salted Hash

hash(salt + account_num)

This approach fixes vulnerability to rainbow tables, however, due to the limited size of input set is still easy to reverse via brute-force.

3. Per-user Salted Hash encrypted with Global Pepper

encrypt(hash( salt + account_num ), pepper)

This is based on Dropbox's password storage mechanism. Reversing via brute-force requires leaking both the encrypted blobs and the encryption key. However, since encrypting the same value twice with the same key results in different output blobs, this breaks the ability to select an account from the database by account number.

4. Hybrid Approach

Store the last 4 digits of the account number in plain text.
Stored the entire account number as a pepper-encrypted salted hash.

Use AWS KMS for hash encryption to reduce odds of leaking a key.

What this accomplishes:

We can lookup accounts using the last 4 digits of the account number. Based on checking a few thousand account numbers, this select will return between 1–3 possible accounts.
Iterate over each of the possible account matches…

Decrypt the account number hash for the account.
Compare the decrypted hash to the input-account number.
Stop iterating as soon as we find a matching hash (use this account row) or run out of accounts (create a new account row).

My question: Does approach 4 actually make sense? For the extra security it provides, is it overly complicated? Does it have flaws I haven't thought about? Most of all, is there a simpler way to solve this problem?

It sounds like your account number is a credit card number. Conveniently, I know from experience that a five year old graphics card can exhaust a salted 10 numeric digit key with salt in 3 days, meaning an average of 36 hours to reverse a PBKDF(4096) hash. It's not looking good for you already.

You're much better off generating a random nonce to pair with the transaction and associating that nonce with the card.


Covert Channels Exploit and the Bell-LaPadula MAC Model I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I have learned is regarding Database Object Size:

High clearance subject adds or removes data
Low clearance subject checks pattern of size changes.
Bandwidth of covert channel could be increased by using
multiple objects

However, I neither understand the benefit of this example to a malicious user, or just how it is carried out. I do understand how covert channels work in general though, but do not understand why it is particularly highlighted as a pitfall of this MAC method - perhaps, as opposed to the Biba model?

My question then, requires an explanation of how covert channels are exploited in a database using the Bell-LaPadula model - with perhaps an explanation of the related example or the explanation of a better example.

If I understand your question correctly, the point that is shown in your example is that even without direct read access to the data being written, you can create covert channels that could theoretically leak information.

Say I am a spy and managed to get a high security clearance with access to Top-Secret Data. I want to somehow copy this data and send it to my government. With a BLP security system I can only write data up, meaning I cannot try to write the data and lower its security level. Equally, my junior collaborator spy (with security clearance Secret) cannot read data that is written up (on Top-Secret).

The covert channel that can be established here according to your example, is in a form similar of a side channel attack. Lets say the collaborator in security clearance Secret cannot read the data, but can gain access to meta-data stored about the files or database tables where the top-secret information is stored. This data might be low-classified, since it doesn't contain any real confidential information. The spy on top-secret can construct a pattern of changes to data, which itself decodes to a covert message.

As a simple example, lets say they agreed on morse-code, and that changes to column A in the database table == dot ; changes to column B == dash; The spy can create a sequence of writes to the tables, that will be decoded by the collaborator on the lower level into a message. All the collaborator at the lower clearance level needs is access to the timestamps of changes to columns A and B in the table. This (timestamp data) in itself could usually be considered unclassified, or certainly discounted as having no real security value.


Is it nescecary to wipe and reset the MBR when laptop changes owners even if full disk encryption is used? Where I'm currently working we use full disk encryption and after a laptop transfer owners we use a secure erasure program. This is quite time consuming and I'm wondering is it necessary? For the disk encryption program we use what we refer to as PGP, but I think it's actually Symantec Drive Encryption (am I right, there's no product actually named PGP?). For wiping the hard drive we use a Linux Live CD with DBAN on it. Many of the laptops have a problem where DBAN hangs and adjustments need to be made to the BIOS, requiring another reboot. This process is quite time consuming. Is it necessary to wipe the data even though the hard drive is fully encrypted? If no, it would really help if authoritative sources would be provided as I would need to acquire my boss's approval. If yes, is there anything I could do to speed up the process; for example wiping a fleet of laptops at once?

Another person had established the policy that before a disk can be wiped it must be decrypted first to protect the MBR. This created a back log of disks needing to be wiped, however the policy got changed and now we simply enter a command to fix the MBR (something like MS-FIXMB). Can this process be optimized any further or can it be shown that this step isn't necessary?

The Center for Magnetic Recording Research at the University of California, San Diego has an interesting document on Data Sanitization in the form of a tutorial on secure wiping of storage media. They explain that securely destroying the decryption keys securely renders the data on the disk indecipherable and thus inaccessible (especially with strong encryption such as AES-128 or AES-256 which is used by Symantec's PGP WDE by default).

A research centre specialized in these mattesr and the company that made the product. It doesn't get more authoritative than that. Good luck with your boss.


Malware Author's Mindset I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life difficult for a human analyst to pick apart the malware, while potentially making the malware very easy for an automated system to flag as "probably malicious." I'm curious to see if anyone can tell me what the rationale is behind such design choices.

For example, some anti-reverse engineering tactics. Yes, they may make it more difficult for the analyst to reverse the malware, but tactics like TLS callbacks could easily be flagged as suspicious, especially since the malware is almost never signed, whereas most legitimate software that uses such techniques for anti-RE purposes is.

Another example would be anti-VM tactics. Most AV emulators time out after a short period. There's no need to detect the emulator. Just do something for a few seconds (other than something obviously delaying, such as calling sleep()), as opposed to doing extremely noisy checks like trying to open a bunch of VMWare and VirtualBox registry keys. The only case where you can't just outlast the VM is when there's a human analyzing the sample, and if a sufficiently motivated human is analyzing a program, they're going to be able to reverse it eventually, so why even bother?

Maybe I'm just not knowledgeable enough in the field of making malware to understand the purpose for all this, but it would seem to me that the kind of systems a malware author would be trying to bypass would mostly be automated systems. For example, antivirus engines or automated sandboxes that AV companies use to analyze new, potentially malicious samples that sort said samples into "definitely not malicious; discard" and "potentially malicious; send for human review" piles. The main goal of the malware author would seem to be keeping those automated systems from flagging the program as suspicious to reduce the chance of the malware ending up in front of a human analyst to begin with, not slightly frustrating the human analyst who will eventually be able to analyze the malware anyway.

I know that some malware authors are just script kiddies, but I'd assume at least some of them put effort into making software development choices. I'd assume they know more than I do about the subject, since they do malware development for a living. But I can't understand some of the design decisions they make. Can anyone explain to me the rationale behind these decisions?

I think you're maybe giving too much credit to malware authors in terms of understanding *anti-reverse-engineering(and maybe also too much credit to professional software devs;). In my experience most malware authors each use their own 'favorite' set of techniques with small variations(lots of times based on code from other authors or researchers), the same way a webdev might use mostly the same input sanitization code each time they write a password field, irregardless of the underlying application code.

Also, in regards to saying, "why doesn't it account for x tactic": malware is cat-and-mouse; even if you created the "best" anti-re code, if it's used enough it'll eventually become a detection signature.

Lastly, keep in mind that no malware is impervious to analysis, so it's more akin to DRM on games; try to get as many infections as possible before it's cracked. You could spend months crafting fancy anti-re schemes for a single piece of malware just to see it broken and turned into a signature in a couple days anyways, so it's probably better to go for quantity of malware over quality of anti-re defenses.


What is the background of the Reference Counter Overflow in Microsoft TCP/IP (MS11-083)? How unique is this bug?

Is there a more sophisticated and well-studied attempt behind? Is it accidence? The article below says "continouos stream to UDP". What stream? Just an hour stream of zeros? 1.000.000 PSs of 1601 bytes packets of zeros?

Of the information provided around this bug, it look "accidentally discovered". The issue are described as related to ports without services (could it really be a risk?). Also, the bug appears as a TCP/IP bug, but affects only Windows 8 / Server 2008 / Windows Vista FW.

Is it really a TCP/IP bug?

Or a FW bug that covers with the looks-more-complicated-approach "It's a TCP/IP bug"? To make technicians more satisfied because TCP/IP is less Microsoft-bundled?

An article about the bug fix (rather then MS own info).

The vulnerability could allow remote code execution if an attacker sends a continuous flow of specially crafted UDP packets to a closed port on a target system.
  https://technet.microsoft.com/en-us/security/bulletin/ms11-083

So while a huge amount of UDP packets with all bits set to zero may result in a crash, it is unlikely that it will result in code execution. They need to contain content specifically written to exploit the issue.

It is an reference counter overflow according to the same Microsoft source.

What is a reference counter?

When a program allocates a block of memory, a reference counter may be used to manage it. Whenever a part of the program code wants to access it, the counter is incremented. Whenever this part of code is done working with the memory block, the counter is decremented. When the counter reaches 0, nobody is interested in the memory block any more, and it is freed.

What is an integer overflow?

Integers are numbers used for counting. They have a fixed size in computer memory. For example 32 bit or 64 bit. So unlike integers, you know from mathematics, there is a largest possible number. Adding 1 to that number will either result in a very negative number or 0.

In other words, if you add 1 again and again, you will end up with 0.

What is a reference counter vulnerability?

A reference counter vulnerability is usually caused by a program path that fails to decrement the reference counter. The attacker is therefore able to increment the counter again and again.

As a result, he can get the counter to 0 and beyond (see previous section). After he got the counter to overflow and ended up at 1 again, he will trigger the normal program path that will decrement the counter.

Now the counter reached 0. 0 means, nobody is interested in the memory block anymore, so it will be freed.

What is the error path in this context?

The program path that fails to decrement the counter is used when there is no service listening on the UDP port.

It is easy to conclude that an open UDP port is required for the final decrement to exploit the issue. Microsoft, however, did not mention this. Furthermore they  stated that the Windows Firewall offers no protection against this bug. Therefore the conclusion is likely wrong.

Why is freeing used memory blocks a bad thing?

Freeing memory just means that it is marked as "available". Someone else, who requests a block of memory, may therefore get it. But the original program still thinks, it owns the block and can use it as it wants.

So we end up with two programs using the same memory block without being aware of each other. This obviously leads to data inconsistencies.

With a bit of bad luck and special crafting, one of this programs may do bad things to the other. Imagine that the other program is storing program code, pointers to program code, or trusted data that will result in pointers to program code in this memory block.

Is this a real risk?

Yes. It is not easy to exploit and sending a such a huge amount of UDP packets over a slow Internet connection will likely be noted. But it is real issue that needs to be patched.


Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses? I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I don't know is if they can do this to VLC on Linux (my guess is not).

When I opened the file, it did not play when I clicked the Play button and my system froze (I must reiterate I was an idiot). I did a hard restart.

I am now running a ClamAV scan (I am not confident at all in an antivirus' abilities). I ran find -cmin -20 in my home dir to look over the log of modified files (nothing suspicious found).

VLC did not have root so it could not have written to /.

Should I be worried, and why did my computer freeze?

Edit: It my have been this attack.
I removed padding then sent it to Cuckoo Sandbox.
VLC does not support .wmv DRM

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code.

Like most video players vlc also has/had lots of bugs which could be exploited, including in the handling of WMV files. But it is unlikely that antivirus will find such exploits because they usually don't know much about codecs and don't even scan video files. Since such exploits are usually OS specific and most care only about Windows because of the market share you are probably safe nevertheless with Linux unless you got specifically targeted.


What's the point of S/MIME? I received an email recently which displayed as an empty body with a smime.p7m attachment. After some Googling, I discovered it was an encrypted email -- neat! So I started looking for the key. But... I couldn't find it.

On a hunch, I tried downloading the email from my web client and opening it in Thunderbird, and it just worked. This is a fresh install of Thunderbird, with no connection to my email account. So it's encryption that requires no key to decrypt (or where the key is shipped in plaintext with the message) and, therefore, seems entirely pointless.

What's the point?

I can think of two things:

This isn't how SMIME is normally used, and it normally does have a key.
It's meant to discourage casual inspection, not actually secure communications.

If it opened without a key, it wasn't encrypted. It was probably signed by the sender, and if you have the sender's public key (out of band) then you can verify the signature.

The point of S/MIME is the same as PGP, but geared for corporate use. It's not good, and people should use Signal instead, but when used for encryption it does provide encryption.

The people who downvote this answer because they don't like me saying PGP and S/MIME are not good and should not be used, should read the "Johnny-You-Are-Fired" paper about PGP and S/MIME signatures.

My reply to a comment got too long so I post it here:

@martijnbrinkers in practice you are wrong.

A standard for doing something between you and another person is only good and useful if there is a high chance the other person will (1) have an implementation and (2) that the implementation they have is good.
If no one uses the standard (e.g. too hard to implement or expensive) then it's no good.
If the major implementations are not good then it's no good.

Take for example TLS. If only an implementation you never heard about had the bug we would agree the bug doesn't mean anything about TLS. But if every major implementation had the bug, like poodle and lucky13 variants, we say TLS was a bad standard (fixed in TLS 1.3).

Back to secure mail, Thunderbird, Outlook, Apple mail all fell? Interoperability with a random implementation used by other side is likely insecure? The standard is bad.

If it's only secure to use if you are sure the counterparty verifies signatures and decrypts using gpg command line outside their mail client, it's not good.

And even when all these bugs are fixed, it's not using authenticated encryption, there is no forward secrecy, the non repudiation is too strong, the metadata is problematic, etc. etc.


promiscuous vs monitor mode in 802.11 I've been reading up on promiscuous mode and monitor mode as they relate to 802.11 networks. I understand the difference, which is explained here:

What is the difference between Promiscuous and Monitor Mode in Wireless Networks?

The definition is pretty simple. One you are associated with an AP, the other you are not.

My question is, what is the benefit of using promiscuous mode over monitor mode? When would you use one instead of the other?

If I want to monitor traffic between an AP and a device, both modes give me the capability. I feel like I am missing something that promiscuous mode allows you to do that you can't with monitor. I know monitor mode does not allow you to check CRCs, but still don't see a real advantage to using promiscuous mode beyond that.

In "Promiscous mode", the driver still outputs standard ethernet frames belonging to the one wireless network you are currently associated to (identified by the BSSID). Possibly the device will only dump packets from the AP to wireless devices, but not packets from wireless clients to the AP, as receiving packets from non-AP devices is not used in AP client mode.

In "monitor mode", you capture packets from all the networks operating on a chosen channel (possibly even adjacent channels - there is a reason that 802.11 DSSS beacons contain the channel number in the payload), and the driver does not output plain ethernet, but needs to output more headers (there are 3 addresses in a 802.11 header, instead of just 2 addresses in the 802.3 ethernet headers). Only special wireless monitoring software is able to process packets in the format dumped by the driver in monitor mode.

So monitor mode is advantageous if you want to really see what's going on, while promiscous mode is there for compatibility with standard ethernet network sniffing tools that can't handle the extended 802.11 frame format. If the tool you want to use supports monitor mode, use it. Use promiscous mode only as backup.

Furthermore, some wirelesse driver/hardware allows your device to send completely arbitrary packets while in monitor mode - this is called packet injection.