End-to-end WhatsApp vs Telegram What do you think about the latest WhatsApp update?
Is now WhatsApp as secure as Telegram?
Which one should be trusted?
Which one has the strongest and most secure encryption?

This sounds like a job for your eyes! Read the terms and conditions and see if they mention anything about your data in there. Remember YOU are using THEIR service, which means YOU have NO CONTROL over what you put on their service.

Realistically though it sounds like it's in their best interest to keep your private stuff private since it's easier on them, easier on you, and safer for both parties.

However without checking the ToS of both apps in depth you can't really know for sure. This at best is no more secure than encrypted email services, and at worse is not secure but that is the nature of using someone else's encryption service and not your own.


How to create a bot-engine I      requested a feature and the voting is currently in progress, which I believe has been hacked, and heavily down-voted. I believe the hacker might have taken the following steps to achieve this:

Create a bot program to automatically create new email-id's. This would also include passing the OCR test by the bot program.
The bot program then creates a fake account on SE with fake profile information from a names-database after linking the email-id by auto-verifying the email verification link.
The bot then executes activities tailor-made to suit SE site emulating a human user, like up-voting, down-voting questions sorted by Activity, posting differently worded naive questions (mostly probably duplicates), answering a closed off-topic post with a paragraph answer obtained by first result of Google search using the question's keywords, and keep gaining reps with these activities.
Once the bots have reached a reasonable threshold reps that provide them vote-casting security-rights, the hacker then issues a RPC to all the bots to down-vote the selected voting process.

Is programming such a bot possible? I think the above bot program would be an easy script for the hacker, and he might be executing all the the above steps as a pseudo-human bot because Optical Character Recognition (OCR) software is already there, along with web-simulation tools. It's just like arranging the pieces together in the script to achieve the bot-engine functionality.

What are the security checks and firewalls on SE which prevent such bots? How would you identity whether such bots are running in the system, if any? If you are assigned to specifically check for a dormant bot, which is currently in deep hyper-sleep, but which can become active later at any unpredicted time, how do you proceed?

If you believe such bot programs don't exist, what makes you think programming them is so hard? What are the programming challenges involved in designing and implementation of such bot-engine?

Theoretically it is possible, but it takes a lot of skill and effort - much more than it is worth.

The captchas are created to be hard for machines, and easy for humans. This is the perpetual arms race between spammers and webmasters. It's easier to have a human verify the captcha's for this hypothetical bot network.

Gaining rep by fake posts is difficult, but not impossible. Once a few users start noticing that your bots are creating fake posts, or once SE notices copied content, the accounts doing this will get flagged and find themselves banned. And if a pattern is noticed, SE will look deeper and find out what's going on - and take drastic measures.

It's probably easier to gain rep by suggesting edits. There is, in fact, a bot that helps editors to create better edit suggestions. Copying this bot to generate automated edits could work - mostly due to the large amount of sloppy edit reviewers.

Assuming these bots do gain enough rep to vote, they can vote for each other's content, but Stack Exchange has a lot of experience in catching voting rings.

Regarding your edit: dormant bots don't need to be discovered, they only become a problem once they become active. However, SE does automatically delete unused accounts, if certain criteria are fulfilled.

So, it's not impossible, but it's very hard to pull off. The bot maker is very likely to get caught, and get banned from SE.
Over the years, SE has also become very good at catching users who, after being banned, try to create new accounts.


Why is "\000" added to the end of passwords prior to hashing with bcrypt? I am implementing bcrypt for java as found here. Before the actual hash takes place, line 455 of this implementation takes the raw String password, and transforms it into a byte array like so:

passwordb = (password + (minor >= 'a' ? "\000" : "")).getBytes("UTF-8");

So when minor >= 'a', as is always true for this implementation (I assume this is a version identifier?), then \000 is concatenated onto the end of the password before its transformation into bytes.

What purpose does adding \000 to the password provide?

I continued my own investigation...

\ is an escape character in java, but one thing I didn't realise is that it can escape more than one character. In this case, it escapes all three zeroes, thus adding a NUL character onto the string.

This turns into an extra byte on the end of the UTF8 array, with value 0. This is presumably used by the algorithm to identify the end of the password as it gets chopped into pieces and re-organized.

(This is enough to make me satisfied, but I won't accept my own answer for a while in case anyone can provide any more/better information than this in their own answer)


How to perform a port scan against a target with a software-based firewall? I use NMAP to perform port scanning, e.g., TCP SYN scan: nmap -sS 192.168.0.12.

I've two virtual machines running Windows XP and Windows 7, respetively. These have several services running, e.g., port 445.

However, if the Windows software-based firewall is enabled, then NMAP reports filtered for all well-known ports, even thus they are in fact open. If I disable the firewall, then NMAP reports all ports correctly.

Have I done anything wrong? What is the purpose of port scanning, if a simple software-based firewall makes it useless? Should a network administrator modify firewall rules to reflect real-world scenario, i.e., web server, before I would see the open ports in the result set?

In this case the firewall isn't blocking the port scan (although some firewall products do attempt to detect and block scans). It is actually blocking the service from being available externally. The port scan can't see it because to the external world it is not there.

The port reports filtered because the firewall drops the incoming SYN rather than reply to it.

Port 445 is used for Microsoft Directory Services - which is part of the underlying mechanism for File and Printer Sharing. Were you to enable the "File and Printer Sharing (SMB-In)" Allow rule you would likely find the port started to show up.


How are PGP messages constructed? I have recently found that openPGP, the protocol that GnuPG uses, uses a hybrid-cryptosystem by generating a random session key, encrypting the message using that key with a strong, symmetric cipher, before encrypting the session key with the recipients public key.

When you view an actual PGP message, you see what appears to one big block of base64 characters between a clear header and footer. However, if the ciphertext for the message and the ciphertext for the session key are sent alongside each other, why does a PGP message appear as one big block of text?

PGP messages come in a raw binary format that comprises multiple packets as specified in RFC 4880. There is nothing exciting about the syntax. For instance, every packet in a message consists of a header and a body with the first byte of the header being the header tag, etc. You can dissect a PGP message just like you would with a TCP packet.

What you identified as "one big block of base64" is called an ASCII armor. As the name suggests and @SteffenUllrich pointed out, it protects the message from getting corrupted during transfer by representing it with printable ASCII characters. All it does is base64-wrapping the OpenPGP format.

If you wanted to parse an ASCII armored message you would first base64-decode it and then parse the contained binary stream according to the syntax specification.

From section 2.4 of the RFC:

2.4.  Conversion to Radix-64

   OpenPGP's underlying native representation for encrypted messages,
   signature certificates, and keys is a stream of arbitrary octets.
   Some systems only permit the use of blocks consisting of seven-bit,
   printable text.  For transporting OpenPGP's native raw binary octets
   through channels that are not safe to raw binary data, a printable
   encoding of these binary octets is needed.  OpenPGP provides the
   service of converting the raw 8-bit binary octet stream to a stream
   of printable ASCII characters, called Radix-64 encoding or ASCII
   Armor.


Unencrypted passwords in a system considered a vulnerability? Few considerations regarding what to call a vulnerability:

An unencrypted password database (think yes)
An unsalted hashed password database (unsure)
A salted and hashed password database (tend to think no)
An encrypted password database but with a same "secret" key

Which of the above scenarios would a security researcher be able to report as a vulnerability?

First of all, you should not encrypt passwords. Encryption is reversible.
Instead, you should hash the passwords. A hash is kinda like one-way encryption.

When the user signs in, instead of decrypting, you encrypt hash the password they provided, and see if it matches the hash that is already stored in the database. If it's the same password (and salt), then the resulting hash will be consistent and you can let them in.

When hashing passwords you have to consider a few things:

It's important to use salt to prevent side-channel attacks in relation to duplicate detection.
You should use a well-vetted routine.
You should use a high enough Work factor so it is expensive to brute force.

I've explained all the considerations here: Why is MD5 considered a vulnerable algorithm?.

In summary, you should use BCrypt. (which has had more time to be vetted than Argon2)
Run a quick SHA-256 on the password before feeding it to BCrypt. (to prevent truncation)
The BCrypt Work Factor should take 50-500ms on your target machine.
Limit login attempts to prevent Online Brute Force as well as DoS via hash computations.
BCrypt already has Salt, but it's best to also include some Pepper (~72 bits of entropy) which is a quick sort of extra password added to the user's password. The Pepper is the same for all users, but is unique to your application. It is stored either in your source code, or better yet, in a separate text file, but never stored in an SQL database.
Include reasonable Password Strength Requirements in your application, because no amount of hashing will protect a weak password.

  Would an unencrypted password database in a system be considered a vulnerability? (think yes)

If you don't hash or encrypt, it's a vulnerability for sure.

  Would an unsalted hashed password database in a system be considered a vulnerability? (unsure)

Yes, primarily because of rainbow tables. However the bigger concern would be how strong of a hash function you are using. Most of the good algorithms already have salt, so if you don't have salt, there's a good chance you're using a weak algorithm.

  Would a salted and hashed password database be considered a vulnerability? (tend to think no)

You're right, this is OK. It's common to store both Salt and Hash in an SQL Database, but it's best to also include Pepper which is kept outside of the SQL database.

  And would an encrypted password database but with a same "secret" key be considered a vulnerability?

Yes. Reversibly encrypting passwords is bad. If the key is stolen, the passwords are easily retrieved without brute force. Hashing solves this problem.


Configuring socat to pentest an IPv6-only remote web server from an IPv4 host I need to pentest an IPv6-only web server situated in a remote network from my IPv4 host (Kali Linux VM). I have a 6-to-4 tunnel up between the two hosts (configured using Hurricane Electric). I'm trying to do a vulnerability scan using Nikto, but as far as I know, it's not compatible with IPv6 and I'd need to use socat to bind the local IPv4 port to the remote IPv6 service:

$ socat TCP-LISTEN:8080,reuseaddr,fork TCP6:[IPv6-remote-address]:80

After running the command above, I launched Nikto and tried to scan the IPv6 host again:

$ nikto -h web-server.com

and also

$ nikto -h IPv6-remote-address

but I got the ERROR: Website not found and ERROR: Invalid IP address '2001' (The IPv6 remote host address starts with 2001).

Any suggestions on how to fix this? And does Nikto use TCP port 8080 by default?

Thank you.

You literally have to put the brackets in there, i.e.,

socat TCP-LISTEN:8080,reuseaddr,fork TCP6:[fdf3:f0c0:2567:7fe4:a00:27ff:fe74:ddaa]:80

As seen in the excellent work by ERNW in this PDF here --https://www.ernw.de/download/newsletter/ERNW_Newsletter_45_PenTesting_Tools_that_Support_IPv6_v.1.1_en.pdf

They also make mention to the Chiron tool, which allows further proxying. A few books make mention to Relay6, 6tunnel, nt6tunnel, and asybo as other tools that allow for IPv4-to-IPv6 proxying.


Is AWS subnets enough for segregation of networks? or do we need VPC? Is AWS subnets enough for segregation of networks with the all security groups? or do we need VPC to really issolate two application from each other?

By default subnets inside the same VPC have no segregation. As Joe M's answer says you can use ACLs (subnet level firewalls) to enforce separation and security groups for a more fine grained instance level control.

Using multiple VPCs adds quite a bit of overhead but is a good option if you're looking for an extra layer of "accident-proof" separation e.g. if you want to be certain a misconfigured ACL cant cause damage.

The strategy you take probably depends on how much segregation you need:

Different VPCs (or even different Accounts):

Different customers (assuming you have a low number of high value customers e.g. not for users of an app) especially if you are peering/VPN to your customers,
Different environments e.g. Development or Prod,
Different applications with very different audiences e.g. CompanyWebsite and Company Payroll Processor.

Different Subnets:

Different services inside the same environment, e.g. webserver, appserver, database,
Linked applications in the same environment, e.g. public webserver and internal-webserver that both use the same database.

Possible worth noting you can link VPCs together however this is a relatively advanced feature and should only be used for larger, complex networks.


How do open (no password) wireless networks deal with abuse? Many places today such as restaurants, malls, and other public places have free and open WiFi that does not need a password or login information to access. That means that anyone, even people outside the building that contains the router, can easily access the network. Since there are no accounts or similar, even with logs it is almost impossible to identify a specific user (especially if they spoof their MAC address).

So, how do those places deal with abuse or illegal activity? That includes uploading/downloading illegal files, criminal activity (threatening emails, leaking information, etc.), or hacking (denial of service, capturing network data from other users).

Basically, is it even possible to deal with abuse and identify a user who has committed a crime or similar on a public network when thousands of people use it every day?

Most sites with open wireless systems deal with abuse by not caring. And that's it.

When police forces need to identify some villain and know that he connected to some wireless hotspot, e.g. in a bar, they resort to what police forces have always done since police exists: witnesses. Just ask everybody if they saw someone shifty or hacker-looking. In recent times, this includes surveillance video cameras. The fundamental property at work, here, is that perpetrators of computer crimes are also human beings, with corporeal bodies, biological needs, and leaving traces everywhere.

While some attackers feel that "the game" is to be played in the computer world only, law enforcement agencies do not consider themselves to be constrained that way. If I remember correctly, Kevin Mitnick first reaction, upon being arrested, was to say that Tsutomu Shimomura had "cheated" by calling the cops instead of defeating him with "computer skills" only. (This anecdote is likely to be apocryphal, but I find it representative of the mindset of many wannabe hackers.)


Authenticating AD user over TCP socket I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group.

The naive way is to send System.Environment.UserName to the server and let it determine the user permissions in this way.

However, it seems to be against best practices since any client can spoof the user name.

Is there an API I can use to send the credentials in a trusted manner to my server application, over a TCP socket?

SSL is not enough, since anyone can establish a secure connection, yet still spoof the username.

I'm assuming you are using a fat WPF or Forms client, and not a webpage, because the easy answer is ADFS v2 in passive mode.

If you're using TCP, you’ll need the authenticated stream class

https://docs.microsoft.com/en-us/dotnet/api/system.net.security.negotiatestream?view=netframework-4.8


IPTable Security between two servers Is using IPTables to only allow traffic between two servers considered an acceptable practice?  For example TCP traffic on a defined port.  I realize this is referred to as an ACL but how secure is this when an encrypted transport is not available? If it is not recommended, why?

It depends what you are trying to protect against, if this traffic goes over the internet, technically people would still be able to sniff or modify your traffic if they were able to put themselves between your two machines. IPTables is a firewall but it does not offer means of encrypting the traffic. Therefore you need to depend on other protocols like encrypted VPNs or IPsec.

Practically, it's relatively, commonly deployed on Linux machines unless you have dedicated firewalls. For instance I have implemented it to only allow SSH to be accessible from a certain amount of public and local IPs.


Is there Windows 2FA machine login for SMB/SOHO? Two step verification or authentication (2FA) for online services is fairly common. How about 2FA for Windows machine logins? Windows machines like desktops, laptops, servers, POS etc. could be compromised via a password hack or breach.

I have seen only a very few solution in the market, mostly aimed at enterprises. Is there a 2FA solution for security and privacy conscious consumers as well as small to medium sized businesses that operate Windows machines (on-premises or cloud based)? The solution should work for both physical as well as remote login.

If there is no viable solution, i am willing to put some time to start a side/open-source project for this. I envision a plugin or middleware that
once installed will trigger 2FA during the Windows login.

Do you think this is something you or people you know will use? Is there even a need for this thing in the first place? Your answers are most welcome.

I've spent some time thinking about this and wanting a good solution. At the moment, Windows 10 can join Azure AD, and the device itself become a form of authentication, where you can use your Azure AD PW, or set up a PIN. You can also set up a Yubikey with Azure and Windows Hello these days. But this won't help you with on-prem AD or Windows 7 and prior installs.

For Non-Azure AD or non-Win10 installs, take a look at AuthLite (http://www.authlite.com/). It is the solution that kept cropping up in my research. I really wanted to deploy Yubikeys and AuthLite a few years ago, but the project was cancelled, so I don't have any personal experience deploying this setup.


On the fly encryption for unencrypted cloud services? Today Amazon announced their Cloud Drive with unlimited storage for only 60$/yr. Microsoft did the same with Office 365 a while ago. I don't really want to entrust either service with my dearest documents in an unencrypted way.

So now I'd like to use one of these services with some workaround that...

allows me to use these services to store my documents encrypted on their servers (
is convenient, i.e. fast enough and without jumping through too many hoops
works from shells on Linux and OSX and ideally also from the OSX GUI (at least for R/W access)

My first thought is something like a fuse system that mounts the cloud service as a local drive and that encrypts all files with my gpg key (e.g. a bit like this combine with onedrive-fuse-fs).

http://lmgtfy.com/?q=+On+the+fly+encryption+for+unencrypted+cloud+services%3F ;-)

If you use such a service, you lose all of their web based services. So they effectively become purely a storage layer. Not a terrible idea, but removes much of the value from platforms like Dropbox with their countless integrations and so on.

There are many such services, with varying featuresets. Mobile supports tends to be patchy, but look at BoxCryptor, SafeMonk and my friends from Plug n Play, CrossCloud.

No need to use something like Fuse, you can use something like encfs if you really want to, but it'll be a pain to decrypt on mobile. There are also some tools that copy one directory to another, and sync the changes, encrypting from one to the other. So you have the encrypted directory in your cloud storage provider, and the unecrypted one on disk.

Personally, I'm using mega.co.nz because they handle encryption client side, have mobile apps, and include 50GB for free.


Task Manager and Keyloggers I know that some of the best keyloggers can't be viewed from the Task Manager.

Where can one see if such keyloggers are running on the system?  Will they be in the Windows Services or are they hidden from there as well?

The class of malware which prevents itself or other programs from being seen is called rootkits.  They work by replacing key system calls that are used to detect what is going on in the system.  For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to replace that request with one that said "what programs are running other than "my bad program".  That's basically what a root kit does.

Done properly, it makes it so that no matter how you try to ask for the information that would tell you what is going on, it gets intercepted by the bad code that says nothing is wrong.  There isn't any way to tell for sure if you have one and there isn't any way to tell for sure you've cleaned them all if you've been infected by one.  This is part of the reason for the "nuke it from orbit" philosophy that you may have heard around here saying that you should completely reinstall a system if it is compromised by anything more than the most simplistic malware.

The easiest and most effective way to detect a root kit is to boot from something known as a LiveCD.  It's an operating system on a CD or DVD that can boot up and scan your hard drive from a known good configuration.  There are a few things out there that can get around even this by infecting the actual hardware components themselves, but those are still (thankfully) exceedingly rare and fairly device specific.

As another aside, there are also key loggers that are actual pieces of hardware that sit on the line for the keyboard and can detect (or even alter) all keystrokes without having any software running on the system.  These are also exceptionally rare.


NIST test vectors for HMAC-SHA-256 I'm working on an implementation of HMAC-SHA-256 in classic ASP (legacy code). I currently have it working, and the resulting values are correct compared to some test cases I came up with along with test cases found in RFC4231. Does NIST have published test vectors for HMAC-SHA-256? And where would I be able to find them if they do?

NIST publishes a lot of test vectors. Including for HMAC (near the end of that page). In the file contained in the Zip archive, the vectors for HMAC/SHA-256 ought to be the ones with the parameter "L=32".


Security of mapping Local Resources over RDP I work with a group of developers that do network level program.  To prevent these developers from accidentally causing problems on the corporate network they have been given there own isolated network (different ip range with a shared DMZ).

In the past these developers have maintained 2x computers (one for each network) and when they needed to move files from one network to the other they would use a thumb-drive.  However, we recently moved offices and each of the developers was provided with an upgraded computer and told that for access to the corporate network they could remote into an RDP server setup in the DMZ.  The problem being that we can no longer use thumb-drives.  One of the solutions we came up with was to use the "Local devices and resources" tab under "Show Options" to map local drives to the RDP session, however, IS called foul play.

How is mapping "Local devices and resources" via RDP any more or less secure than our old system of moving files via a thumb-drive?

I believe that issue is due to auditing. An RDP session is not the same as a local logon session. Since thumb-drive auditing is very specific, I'd wager that it doesn't kickoff an event due to the nature of RDP.

An example of RDP woes (doesn't trigger account attempt lockout):
https://community.spiceworks.com/topic/354021-how-to-limit-rdp-attempts-from-hostiles

If I get more time, I'll try to update with actual facts vs conjecture.


Brute-force heuristics used in password cracking Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number substitutions plus two characters" instead of "8 random characters").

Obviously any newly-developed tool could incorporate any heuristic the author could think of. But I'm curious... what strategies are used by common password crackers out there today?

As has been already mentioned there's really only two main ways of approaching the problem (brute-force and dictionary based) (assuming that the password are not protected by a flawed algorithm or implementation).  From what I've seen the main add-on to those strategies is to try and add a probability element to the cracking, so if we know that the password '123456' is a very common one for similar password lists to the one we're looking at we start with that.

There was an interesting presentation at Defcon a couple of years back on this (link here) which covered some of this around probabalistic cracking and word mangling strategies for dictionary attacks.  There's also some good onward links in the presentation.

There's also a good collection of wordlists from cracked password database on the skull security site here some of which are already listed by probability.


Is it possible to verify a socket connection is coming from a particular web page? Suppose you implement a streaming api based on websockets at stream.myapp.com. One of the consumers of this api is your website myapp.com. My question is whether stream.myapp.com can verify connections are coming from myapp.com webpages loading in the browser. Basically I want to have an authentication layer for non-myapp.com connections. Is that possible to do securely? Or will I have to implement something like generating tokens for each page loaded for myapp.com?

WebSockets are not constrained by the same-origin policy, but the protocol defines an Origin header. That's set by the page or server that creates the connection.

This is pretty much how an application that I work on handles this; there's a filter in front of the WebSocket endpoint, which checks the Origin against a list of approved origins (a specific domain, using either HTTP or HTTPS). If this matches, we allow it through; otherwise, it is rejected.

There's a bit more information about using the Origin header in this answer.


How do XMPP servers process messages? I'm trying to understand how XMPP works and I'm much concerned about how do both the protocol and existing implementations ensure privacy.

More specifically, I want to understand how do XMPP servers process the messages sent out by their clients.

While reading the chapter 4 of the book "XMPP: The Definitive Guide by Remko Tronçon, Kevin Smith, Peter Saint-Andre", I got the following note:

  Upon receiving the message stanza, the realworld.lit server checks to
  see whether Alice’s sister is online; if so, the server immediately
  delivers the message to one or more of her online devices over a
  server-to-client XML stream (without storing it or otherwise
  performing much processing on it)

However it doesn't explain the way how the message is temporarily stored, and what it is meant by "performing much processing on it" (sounds vague).

I made a research and I read the XMPP Core RFC, but didn't find enough information.

What I'm wondering:

Are the messages directly stored within the source server (mapped to the sending client), before forwarding them to destination server?
Are the messages directly stored within the destination server (mapped to the target client) before forwarding them to the target client, after he becomes online?
How longer are they stored: are they stored temporarily (and how longer do they remain on server)?
How are they stored physically: are they in-memory or persisted to disk?
Are the messages directly flushed (deleted) from both source and destination servers after forwarding them?

While it's possible for a particular implementation to do something different, in every XMPP server I've looked at:

Messages are NOT end-to-end encrypted.

Messages are stored on the server in clear text.

Messages are mapped to both sender and recipient.

Messages are generally stored permanently on disk, subject to only local house keeping cleanup.

XMPP is essentially e-mail with realtime presence indicators.


is iptable whitelisting secure enough in AWS Suppose my app is hosted on multiple servers, within the same data center (say in AWS or DigitalOcean). To secure communication between these servers, I use iptable to whitelist each other's IP.

Question: is whitelisting IP secure enough to ensure the identity of the request? Or is it actually possible for a hacker server within the same data center to spoof IP, thus fooling me thinking it's one of my own servers.

Most of the providers are actually pretty good in securing their networks, but IP whitelists are still not a way to "secure communication". Though they can be an additional security measure, you'll still have to roll encryption and authentication to secure the connection.

However, most of the cloud providers allow you to set up private networks. This will give you an IP space that is guaranteed to be "yours" and is not routed to the public internet. If you want "internal" communication between servers you should very much use that, instead of messing around with iptables and public IP addresses.


Firefox:Secure connection failed(Error code:ssl_error_weak_server_ephemeral_dh_key) A screenshot of the problem:

Browser: Firefox 39.0

Is this a problem with my browser?
How can I solve this?

Is this a problem with my browser?

Firefox 39 and the Firefox 31 and 38 ESR releases upgrade the TLS implementation NSS to version 3.19.1. To harden the browser against Logjam attack the minimum key length for DH parameter within the TLS handshake is now 1023 bits. But the server at acs.onlinesbi.com only uses a DH key of 768 bits. This key length is considered insecure because it might already be broken by academic research and more so by a state sponsored attacker with more computing power.

  How can I solve this?

The site needs to upgrade their security. It is expected that other browsers increase the minimal required DH key length in the near future too so that the site will not be reachable by lots of users unless they improve their security.

To use the site with the current Firefox version follow the instructions below (from this MozillaZine.org forum post) to disable use of DH ciphers in Firefox:

In a new tab, type or paste about:config in the address bar and press Enter. Click the button promising to be careful.
In the search box above the list, type or paste ssl3 and pause while the list is filtered
Double-click the security.ssl3.dhe_rsa_aes_128_sha preference to switch it from true to false (this usually would be the first item on the list)
Double-click the security.ssl3.dhe_rsa_aes_256_sha preference to switch it from true to false (this usually would be the second item on the list)

Note: A browser restart is not required. The change takes effect immediately.

This will cause FireFox to fall back to non-DH ciphers so that the weak DH key is not in use. Note that this effectively disables Forward Secrecy with sites which don't support ECDH but only DH.


Server Encryption - Best practice Q: For servers running Windows 2008 and up, what would be the most reliable whole disk encryption? We want to protect our data from unauthorized access.

Right now, we used BitLocker. However, the key is still resident in the system and/or MS can decrypt it because they have what it's called: Key Escrow. I've used TruCrypt, but the likelihood of it getting cracked is getting relatively easy. Containers get resided in RAM and can be pulled off. I'm not trying to sound paranoid or worrying about extortion or any other crimes. The key point here is, "protecting data" using Best Practice guidelines.

Thanks

In terms of "best practices", Full Disk Encryption is designed to mitigate threats to data at rest. For example, FDE can mitigate the risk of a disk being removed from a server and then an attacker attempting to read data from it.

Against an attacker who has access to a powered on server (from which they can extract the key in RAM) most FDE systems are not an effective control (nor are they intended to be).

If you're looking to mitigate the threat of attackers getting access to your running servers then there are other controls you should be looking at.

For the threat of physical access then you need to look at the physical security of the server (e.g. locks on cabinets, access control to server rooms)

For the threat of logical access to the running server, then things like logical access control, patching, firewalls etc are the appropriate mitigations.


Drawbacks of ML in cyber security? I did some research on the topic (as I'm new to it) and it frankly seems too good to be true. A company called Darktrace for instance, makes use of AI algorithms and ML to autonomously detect threats within the environment.

Say I have an infected network. It's been infected for as long as I can tell. I then run Darktrace on this infected environment. Would it take the infected network as the "normal" network? I can see how it would work if it was just an isolated desktop, it would just compare the activity to other desktops in the network. But how would it be able to tell the whole network is infected ?

You are asking a couple different questions at once: how is ML implemented by a certain vendor, and how could it be implemented to be effective. Let's focus on the later.

I have designed such algorithms for a major global financial institution, and I can give you the broad strokes.

It's not too good to be true. Any security analyst will look at the logs, get to know how people operate in the company, and "get a sense" for what "normal" looks like. It's called 'baselining'. After some time, you "just know" when something looks fishy and you need to investigate because:

The network goes quiet every Friday afternoon (for reasons that are obvious to any human in the office at the time)
Network bandwidth gets maxed when the World Cup is on (streaming, not DDoS)
That server always throws that error (a bad config no one knows how to fix)
The user can never remember their passwords and always gets locked out
We just turn a blind eye to that exec because everyone is afraid to tell them to behave more securely
etc.

Every other oddity, whether excessive errors or abnormally low errors (hey, why didn't that server throw that error?) deserves investigation. This used to be infosec bread and butter, but now goes under the fancy term of "threat hunting".

But this baselining is easy to teach a computer. And you are correct, it all depends on the ability for the computer to understand what is 'normal'.

It would be a crude approach to take the current state of the network and determine that that is 'normal'. You would train your algorithm to accept bad behaviour. You still do this as a factor, but you cannot depend on it entirely. You need another way of looking at the data. There are a couple ways to add another perspective.

There are lots of fancy terms, but when I talk to non-algorithm people, I use the terms: 'weirdness' and 'badness'. Baselining the current state helps to determine 'weirdness'. If the network is already hacked, and the hacker is freely floating around the network, then that is not 'weird' for this network. It's 'bad', but not 'weird'. If we are good at determining 'weirdness', then we can see if a new hacker comes in, or if the current hacker changes tactics.

We can augment the network baseline by determining what is 'weird' for user types by baselining subsets of the network. Devs act a certain way, execs act a certain way, cleaning staff act a certain way. If a cleaning staff account normally acts like an executive account in our current state, then we have something to investigate, even though it is 'normal' in the current state. So, this recursive baselining is one way to augment the ML perspective.

Another way to add to the perspective is to define 'badness'. Things might be normal, but we can define that activity as categorically 'bad'. It might be 'normal' for this printer to be trying to log into every server in the DC, but we know that this is categorically 'bad'. So, if we can input these parameters into the algorithm (a lookup into a signatures table), we can expose the badness in our otherwise normal network activity.

I first got into UBA after I ran a demo of a new UBA product about 3 years ago. I knew my network backwards and forwards, and instinctively knew what was normal and what wasn't. I looked into the UBA product as a backup for me and my small team to cover that skillset for when people were on holidays or if people left the team. I wasn't expecting much. But the product included this 'badness' perspective that instantly (within 2 hours) exposed badness in my network that I never knew was there even though I had baselined and was performing threat hunting daily.

ML is not too good to be true. It's not perfect, but it is better than humans at breadth, speed, and consistency.


When implementing an OAuth provider, what is the right granularity for a "scope"? If I'm an OAuth provider and I want to empower the user to restrict apps to only a subset of resources (for example, only resources in folder X), what is the right mechanism to do this? Scopes would seem to be it, but I find little to no precedent for this.

I often see scopes implemented as different permissions, e.g. "read-only", or "read-write". These are often very coarse categorizations, and require that if deep access is needed to any particular set of resources, it must be granted broadly as well so you end up getting read-write access to everything even if you only need to modify one thing.

Sometimes I see scopes implemented as categories of resource to access, e.g. "photos" or "email address". This only makes sense if you have a meaningful, predefined, finite set of categories of resource.

When I look at the Google Drive scopes for example, there appears to be no way to restrict an app's access to a collection of files. I apologize if I'm not looking hard enough, but this would seem to be very useful and it just doesn't exist. Drive has a "per-file" scope but that has very specific behavior that I am not interested in.

As an OAuth provider, what are the arguments for/against creating scopes for user-created resources? That is, why couldn't Google allow a scope for each of the user's folders? Presumably the app would need permission to first list the folders so that the user could select them, then the app could seek additional permissions to the folders. This would mean multiple OAuth dialogs, so I can imagine the answer is it's just hard to make a good experience. I've had a hard time finding discussion of these tradeoffs elsewhere.

You may want to alternatively consider something like a Web Powerbox instead, possibly combined with a Rumpelstiltskin tree-graph setup. OAuth basicaly has the wrong authority asking/granting paradigm to do useful multi-granular work with. With a powerbox solution, the app asks the powerbox to ask the user to select an entity that the powerbox than grants to the user. All the app thus needs is a scope for the powerbox, for example allowing the app to only ask the powerbox to ask the user to select a read-only facet of file of a specific type from the directory tree. With a Rumpelstiltskin treegraph, you can construct a directory tree with an authenticating name (password-capability) for each node without the need for relational data management (sql and stuff). Combining the two, one user of an app could delegate access to other users of the same or a related app.


Why do browsers or operating systems not have default DNSSEC validation? Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it.

Yet it isn't checked on the client side by default. Why is this?

The Chromium security team say:

  DNSSEC and DANE (types 2/3) do not measurably raise the bar for security compared to alternatives, and can be negative for security.
  DNSSEC+DANE (types 0/1) can be accomplished via HTTP Public Key Pinning to the same effect, and with a much more reliable and consistent delivery mechanism.

(see https://bugs.chromium.org/p/chromium/issues/detail?id=50874#c22)

They've spent quite a lot of time and effort working on HPKP support, and Firefox have been making use of a lot of the tools they produced (e.g. the built in pinning lists). Therefore, they probably don't see much point in supporting a different method, when they have one which they consider better. Microsoft have also been investigating it, but haven't made any particular stand (although they don't appear to have been investigating DNSSEC). That's the main players in the current browser market leaning towards an alternative.

However, HPKP is built on HTTP - it's designed purely for the web. DNSSEC doesn't have that restriction, so can be used for other applications. It can verify that DNS records actually come from the domain owner, which can be useful for mail servers, or for small scale DNS resolvers, ensuring that a malicious actor able to modify traffic can't tamper with the records in an undetectable fashion. Because of this, it's still considered important to deploy - DNS is used for a lot more that just web pages!


Can a CA be defeated by MitM in order to deliver a signed certificate to the attacker instead of the legitimate owner? Some Certificate Authorities (such as Let's Encrypt) authenticate that the client controls the server by telling you to put up a secret string in a well known file on your server.

So it goes

CA -> You (qwerty...)
You -> Server (qwerty...)
CA --Verifies-> Server

But what happens if someone MITM the CA?

For example what if Chuck managed to take control of the wire between the CA to Server. He requests a certificate for veryimportantwebsite.com (which he doesn't control). The CA says "Ok. Put "qwerty" in $WELLKNOWNFILE". He can't do that (as he doesn't control the server), but what he can do that when the CA connects to http ://veryimportantwebsite.com/$WELLKNOWNFILE , he responds with "qwerty".

The CA says "Ok. I'll sign your public key".

Now, you'll say, why can't the CA connect with HTTPS? Because you're putting the cart before the horse. The CA doesn't know (and can't know) that veryimportantwebsite.com already has an HTTPS certificate (as the MITM can block port 443).

CAs use various techniques to protect against this, but at the end of the day, an adversary with the capability to do this is likely to succeed.  For example, Let's Encrypt requests the well-known file from multiple networks, so a MITM is more likely at your end than at the CA.

Almost all Domain Validation schemes fall prey to attacks like this:

Email validation based on WHOIS data?  Hijack the WHOIS server, or intercept the email since almost no mail servers use SMTP over TLS with certificate validation.  (They usually ignore certificate errors.)
DNS record validation?  Hijack DNS.  (That happens a lot already.)
SNI validation?  MITM the server (same as HTTP)

As a site owner, monitoring Certificate Transparency logs can help, as can implementing DNSSEC (especially with CAA).


Why are websites obviously run for nefarious reasons not taken offline asap? Although the question has a much broader scope an example case is my
posted question: Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys)

In summary the previous question is related to people running sites with the (supposed) aim of collecting ssh logins to poorly secured servers using dynamically allocated ips through dyndns.org. By running a server on for instance dyndn.com tyou could collect passwords where people accidently miss the s when ssh'ing in and if the sites using password authentication only theyve you have all you need.

Its got me thinking as to why these sites are still up considering theres reasonable supsicion (on my part thats all it is) that theyre being run for nefarious purposes.

Arent theyre agencys to tackle this behaviour? Is it that people dont report it (I havent, who to?), wouldnt dyndns be looking out for it and sort it (ill try to email them tomorrow)? Is it that theres no proof?

There are several reasons for this.

1.) It may be very hard to track down the owner of the server.

2.) The server may be hosted at an ISP in a country that speaks a very different language than the language of the people being targeted. Think about hosting a fake website for a very small mid-West US Bank at a Japanese or Korean ISP. Figuring out who to even contact may be a bit of a challenge then you have the language barrier (BTW: Google translate is great for this situation and most ISP's want to help you).

3.) Some countries don't care about this (The Russian Business Network has a lot of well known IP addresses hosting a world of bad stuff but no one can get the Russian government to do anything about this).

4.) Some governments either don't have the resources to do anything about this and don't want to get involved (possibly too busy with a war or other critical issues) and do the ISP's don't even bother.

5.) Some ISP's are very small and understaffed and possibly have a big list of other to-do items like taking care of paying customers so this just takes a while.

6.) ISP's that are on the edge of going out of business will take any money they can get. The bad guys are paying customers in many cases.

7.) Some organizations have bad security and when they get hacked they don't notice for months. This allows an attacker to setup a website, especially a virtual webserver, on an insecure webserver and run it for a long time.

etc...

In the long run it's not that some people don't spend effort to get these taken down generally people do but the sites pop up again very quickly and for some attacks a site being up for 24-hours is very effective and can potentially infect millions of computers.

Ultimately there are a lot of other reasons but these are the most common.

Hopefully this info helps.


What OS should I use for sandboxing/running viruses designed for IoT devices? I have a telnet and ssh honeypot (more specifically, cowrie). Most viruses I get there are designed for routers, cameras, etc...

The virtualization software I am using is VirtualBox, and I am using it with cuckoo sandbox, which also supports the android emulator.

Here is the output of the file command on these viruses:

My questions:

To run these viruses what OS should I use? Should I use the android emulator?
Is there any way to emulate router/IoT device firmware in VirtualBox (or any other software)?

The only thing I would be aware of is CSR 1000v which can be run in VMWare.  Try following these instructions.

https://techandtrains.com/2014/01/09/installing-cisco-csr-1000v-in-virtualbox/


Should VPN passwords be stored in plaintext? I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext.

Last week I installed a VPN add-on for Firefox then created an account and changed the default password before using it. It is good and also fast, but a few days later, when I checked my spam, I saw that the VPN provider sent me an email dated on the day I changed the password, with my password in plaintext. I thought it could be just a bug on their side.

So what I did next was to try to forgot my password, to see if they would send me my actual password or a reset link. But unfortunately they sent my password back in plaintext.

I sent them an email to their support but I didn't get a reply. After a few days of silence, I wrote a review on their Firefox page and sent a report abuse. After an hour they emailed me saying that:

  they need to be stored plain because of vpn authentication. you send
  them there plain. Otherwise they cannot work

My question is, is it true that they need to store the password in plaintext to make the VPN works? Or it is just beyond there capabilities to safely store user credentials?

Just think about the users that use the same password on their other accounts. That could be the case for most of us.

Thank you.

Yes, they need your plaintext password to make the VPN work, simply because their service is badly configured. They shouldn't need your password in plaintext.

The problem is that they use your plaintext password in their authentication procedure. When a new user creates an account, the VPN provider should properly hash their password and use that hash to authenticate them. From what I see, their service is badly configured.

Note that, when you changed the password the first time and they sent you your new password in plaintext, it doesn't mean that they stored your password in that format. They could have sent you that email before hashing it and storing it in their database. (Although sending any credential by email is a bad idea.) However, getting your password in plaintext when using the lost password feature proves it.


Using Diffie-Hellman exchange on low power IoT devices I have almost 0 knowledge of IoT, their protocols and usual device constraints. I had a discussion today with someone that has a fair amount of IoT experience and we were discussing some security related issues and the establishment of a shared key came up. I assumed that Diffie-Hellman would be used but this person seemed to not be familiar with the method and based on their knowledge for low power devices, the keys are actually preloaded inside.

Is this a real scenario?
Is it possible for DH exchange to be too intensive for a low powered device?
What role does Ephemeral Diffie–Hellman Over COSE (EDHOC) play in this case? Is it a good alternative or still problematic?

It depends on 2 factors: what resources are available on the IoT device (processor speed, memory, power), and how long you can wait for the data to arrive. If one of those factors are not an issue (say, you can wait 1h to receive 1024 bytes), it can be done on any device.

Generally, current technology is more than enough to run basic cryptography, the bandwidth and latency being the main issues. The low-power microcontroller Maxim MAX32621 (12mW on active mode, 2.6 µW on standby) can do AES-128, AES-192, AES-256, DSA/RSA to 2048 and TRNG native. Someone even implemented AES-CMAC on an Attiny85 (8k flash, 512B RAM, 8/16MHz, up to 20MHz).  EDHOC intends to solve the latency by, among other things, reducing the amount of round-trips needed to establish the connection.

If you don't care about implementing the full TLS stack, but only on encrypting data, you can implement your own protocol. Save the server public key on the device, generate a symmetric key, encrypt it with the server public key, encrypt the data with the secret key, concatenate both the encrypted data and encrypted secret key, and send to the server all at once. No round-trip, no TLS session establishing. If you use UDP, you can send all the data in one single packet, without even needing to establish a connection.


Strange RSA usage - how secure is it? Is following communication scheme secure?

To my mind, it uses RSA modulus and public key exponent as a cryptographic secret, which is strange usage of RSA, but can it be easily broken because of that?

Description of communication provided by the vendor:

Client generates a new pair of 1024-bit RSA keys on his machine every 10 hours and uploads public key to the Server. Client is authenticated using password and Server authenticates itself with SSL/TLS certificate.
If the Server wants the Client to provide the data, the Server generates AES key and sends it to the Client encrypting the message with Client's public key using OpenSSL library.
Client sends the data encrypted with AES to the Server.

Potential problem: is the Server authenticated against the Client in the 2nd part of communication?

As far as I can see, they should have just used TLS to get better encryption with less work.

Using RSA to exchange ephemeral AES session key is one of the most common way TLS are configured.

Several issues with this custom scheme:

2048-bit RSA is considered the minimum standard for RSA nowadays. The 1024-bit RSA is nowadays considered to be brute forceable by highly advanced attacker in the foreseeable future.
AES encryption does not authenticate the sender, and adding authentication to an encryption is quite fiddly to do correctly. I suggest changing step #3 to use Authenticated Encryption, recent TLS libraries supports AEAD, for example, with GCM
In step #2, the session key is sent over the network. TLS would use Diffie-Hellman to have the client and server derive a symmetric session key over untrusted communication channel.


How does SELinux affect the Linux Kernel networking stack? I'm interested in how SELinux effects the processing of packets through the networking stack.  I've found the following questions and answers:

Network policies under AppArmor/SELinux
Filtering network access on a user/group/process basis

The first seems to imply that SELinux can tag packets (kind of like tagging VLANs), and processing can differ depending on the tags associated with the packets.  This makes sense to me.  However, the second question is asking about network access via user groups and access controls.  It's unclear based on the answer and comments if this is true, or how it's possible.

When reading through the Linux Kernel source code (2.6.16, I know its old but a lot of embedded devices still use 2.6), you come across the file /security/selinux/hooks.c.  This has functions like selinux_parse_skb_ipv4, selinux_socket_create, selinux_socket_bind, etc.

My questions are:

Can someone clear up the second question for me?  Either by actually answering that question, or answering it here.
Does SELinux affect the network stack in any other ways?
With functions like the ones listed above, is SELinux used to create the abstract concept of a "secure socket"?  Much like the Windows API provides function calls to create "secure sockets".

Access can be controlled for local processes accessing local network assets like for example network ports. By associating labels with port objects and userids, groupids associated with processes (even individual processes, allowing you to specify whether and how an entities associated with particular labels can operate on or interact with entities associated with particular labels. This is generally pretty solid. With the exception that no access control is enforced for binding sockets to ephemeral ports.

Alternately secmark allows one to associate labels with "non" local assets as they come in or go out using the netfilter security table. So the labels only apply inside the system. (for example. a packet comes in unlabeled, gets associated with a label using netfilter and then you can specify rules how other local entities associated with particular labels can operate on the labeled packets). This is a local solution using netfilter.

Really associating labels with packets as they traverse the network can be done with netlabel or ipsec. This is used to enforce confidentiality on "trusted" networks. Ipsec is preferred for this i believe rather than netlabel (Multi level security).

SELinux is generally not the optimal tool to enforce controls on the network. Other technologies are generally a better solution. Except if you want to enforce confidentiality on trusted networks.

Generally the idea is that SELinux allows you to associate security labels with many entities, ranging from individual users groups of users, or even individual processes to local and non-local assets such as for example files and network nodes.

I am aware that this does not answer the question and that my information is not fully accurate, and is certainly not comprehensive, but it is something.


Can I use a virtual machine to connect to a public WIFI to use Internet by totally isolating the host from it? I want to use my laptop to connect to a public WiFi in a library but...

I have strong security in my Windows host machine (comodo firewall using a public network settings and rules, protocols disabled, limited privileges account, GPO rules, services disabledm, browser hardened with settings and extensions...) and use dnscrypt to help protecting my DNS but i think this wound't be enough to be totally safe if I connect my host to the wifi.

I have no VPN right now. Can I use virtual machine to connect an use only Internet through it and totally isolating the host system from the network?.

I have a Wifi usb dongle too. So i was thinking in disabling all the network interfaces in the host (including the VM one) and connect the VM (guest) only to that dongle.

What do you recommend, there is any guide out there to do this with Virtual Box?

This is only to browse the internet and maybe download some documents & programs, not to use my user credentials by loging in some web but I want to access my projects and documents in my host HDDs securely by isolanting it from the internet.

If I wanted only internet no HDD access I would use Tails u other Live OS and run, but... (I don't want to mount my HDD and browse the files in it while I'm connected to a not trustworthy network)

If I wanted only internet no HDD access.. I would use Tails and run, but...

You can use Tails on your computer and have a full access to your files and documents. Linux have evolved ;)
But honestly, I do not think you need this much of protection for browsing the Internet on a public WiFi :
Use HTTPS everywhere, have a well configured firewall and you should be alright, unless you're carrying with you strictly confidential documents, which I seriously doubt.

Also, a VM is not in anyway a mean to protect your host. There is many ways to escape VMs, and the only purpose of such machines is to create an environment which is controlled, thus useful for security research, better separation of data, or retrocompatibility e.g.

To sum up, the only way for being secure on the Internet is to be careful : I frequently use McDonald's or Starbucks' WiFi and I do not have any Antivirus or Firewall on my Windows 10 laptop. What I have though is experience and most importantly the ability to not click anywhere.

Always update your system, check that you're using HTTPS and be careful with your DNS.


Hashing two passwords can produce the same hash. How to prevent this? When hashing passwords, two passwords can produce the same hash, so if a user inputs someone else's username but his own password, there is a possibility that he will be able to login to that other account. How to prevent this?

It is a mathematical certainty that any hash function with a fixed output size will have collisions. However, the chance of a collision can be reduced by using a hash function with a large output size. Using SHA-2 with the default output size of 256 bits, for example, means that you will need 2^128 users before there is a 50% chance that some pair of them will have the same password hash[*].

Ideally, you should apply a hash function to SALT+PASSWORD, where SALT is a unique value specific to the user account. If the salt values are chosen uniquely over accounts, this virtually ensures that both username and password must match with a specific account to allow logging in.

Please note that the above is only intended to explain the concept. In practice, you should almost always delegate this task to a quality implementation of a standard password hashing function, such as PBKDF2 or bcrypt, rather than rolling your own.

[*] - assuming no pair of them actually have the same password, which can happen with surprisingly few different users.

In the case of Alice and Bob having the exact same password and Alice logging in as Bob accidentally, there is nothing you can reasonably be expected to do about this.

In terms of unreasonable efforts, you could store the hash of PEPPER+PASSWORD for each user (where PEPPER is a site-wide constant), run a script to detect same-password cases, put the hash on a "bad list", and automatically send e-mail asking users to change their password if their password hash is in the "bad list". Note however that this opens your site up to a new kind of attack whereby an attacker repeatedly changes their password to a common password and waits to see if an e-mail is generated. If it is, they know another user has that password and they can try common usernames with it (or, the result of scraping any available public data for usernames, such a site forum). So you should rate-limit the script that sends e-mails (for example, to once per day) to reduce the efficacy of such an attack.


How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form? What is CSRF?

I need a basic definition that is not just lifted from Wikipedia.

I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this.

I am using a framework, CakePHP, that has a component that automatically prevent this CSRF. However, whenever I do something to the form like using jQuery to alter the values of the field. Or when I include some Ajax that works with Flash plugins like Uploadify, I need to disable CSRF.

SO how do I, in principle get to prevent CSRF when such elements are involved in the form?

CSRF or Cross-Site Request Forgery is basically a bad person tricking a good person's browser into performing functions on your website on the bad persons behalf.

Here is an example:

  Good user logs into your website and
  obtains a valid session
  Bad user tricks good user into
  following a link to a malicious site
  Malicious
      site contains a form with falsified data which posts to your
  website
      (however since it's sent from client
      side, your site thinks it originated
      from the good user)
  Your site then
      see's the good user submitted a form
      and processes the action.

Let's put it into context:

  Good user is an administrator on
  your website.
  From the admin panel, good user can
  add a user by filling out a form
  that looks like this:

<form action="/new_user.php" name="myform" method="POST">
    <input type="text" name="new_username">
    <input type="password" name="new_password">
    <input type="Submit">
</form>

  Good user follows a link to a
  malicious site, which contains the
  following javascript:

<form action="http://www.yoursite.com/new_user.php" name="myform" method="POST">
    <input type="hidden" name="new_username" value="MaliciousHax0r">
    <input type="hidden" name="new_password" value="MaliciousPass">
</form>
<script type="text/javascript">
    document.myform.submit();
</script>

  Your application now receives the
  request which was submitted by Good
  user, on Bad user's behalf. Since it
  originated from Good user, who
  happens to be logged into your
  website, all is well and your
  website processes the request.

  Now keep in mind this is a simple
      example, and the Good user would see
      the submit happen which SHOULD raise
      a red flag, however using slightly
      more complex methods, such as
      XMLHttpRequest() in javascript would
      be silent/unknown to the Good user.

  Bad user has now obtained an account
  on your system.

How to eliminate CSRF:

  The trick is to add a token to each
  form that has a random value which
  is generated for each request.
  When the form is submitted, your
  application checks to make sure the
  token is passed, and matches the
  random one which was generated when
  the form was loaded.

  The malicious site wouldn't have
  access to this token, therefore it
  wouldn't be able to provide that
  required peice, and a form submission
  would not be processed.

How to make other tools work without disabling CSRF protection in CakePHP:

I don't know. Check documentation for the CSRF protection, for CakePHP, and for the other addons.

Question whether or not using those addons is worth the loss in CSRF protection, and consider alternate solutions.

CSRF Resource:

https://www.fortify.com/vulncat/en/vulncat/javascript/csrf.html


Spectre and Meltdown being used in large scale attack on unpatched systems Do we have to be worried about Spectre and Meltdown being used for a large scale attack like Wannacry? Even though the patches coming out are being deployed to a most recent systems, there will inevitably be A LOT of systems that won't be patched.

The affected systems range from routers to smartphones to data center servers, not all of them will be updated. If there is a way for meltdown to be abused and chained into anything else that could escalate privileges or other any other attack types, it could be used to hit entire networks if you have even a few unpatched devices.

Being able to snoop kernel memory seems like a huge problem and even if most things get patched, it seems like even a few unpatched systems could compromise everything else on your network. Sounds like this problem is only going to get worse and the performance degrading patches won't be the worst of it.

Wannacry was a remote attack: an attacker could point their exploitation program at another computer over the network and infect it, and could have that infected computer attack others in turn.

Meltdown and Spectre are both local attacks: an attacker needs permission to run code on the target computer in order to perform the attack.  Additionally, both are "read-only" attacks: they permit an attacker to read otherwise-protected data, but they don't permit an attacker to modify that data.

Spectre has the additional problem that it requires precise tuning to the CPU, OS, and program being attacked: for example, a Spectre-style attack to retrieve SSL certificates from Apache 2.4.10-10+deb8u11 on Debian Wheezy on a Core i5-8600K might be unable to mis-train the branch predictor on a Ryzen 5-1600, will be looking in the wrong place for Apache 2.4.28 on Gentoo on a Core i5-8600K, and will be completely lost when trying to attack Nginx on Fedora 26 on a Via C7.

The only real threat for large-scale attacks is Spectre-style attacks on web browsers.  For example, all copies of Firefox 57 on Windows are identical, so an attacker who puts malicious Javascript on an ad server could reach out of the Javascript sandbox and collect browser passwords with reasonable success.

(Incidentally, routers and most smartphones aren't vulnerable.  They tend to use cheap, low-end ARM CPUs, which are too primitive to be affected by either Spectre or Meltdown.)


Why would my firewall be blocking external source and external destination IP's that I dont own? In my Cisco ASA firewall logs I'm seeing events being blocked with an external source IP and a external destination IP. This is happening in the same event log.  An example would be:

TCP access denied by ACL from 235.97.144.162/6855 to outside:66.37.68.42/24

I'm curious as to why these events are happening.

The source address that you're seeing, 235.97.144.162, is not a normal IP address, it's an IPv4 Multicast Address.  Any one of your internal systems can legitimately try to use it.  It's used for trying to join into a stream of traffic that's being sent to multiple recipients - like a television signal that all TVs can tune in to.  Your firewall isn't allowing it: that's fine; although you may be breaking some application, multicast isn't heavily used or reliably relied upon :).


Nmap to discover live hosts with hostname I'm using Nmap version 7.12 to discover the live hosts in my subnet. When I type the following command:

nmap -sn xxx.xxx.x.*

It lists the live hosts alright, but the report only shows the IP address of the hosts. I'd like to see the hostname and the ip address of the live hosts in the subnet. How can I achieve this? Thanks.

You are using -sn which means No-port scan and it doesn't have any direct relation with hostname part of output. Nmap's both DNS resolver and reverse resolver will work in such cases but sometimes DNS server don't simply show up to the reverse DNS request and in those cases only IP address is shown.

If you are using a different DNS server(which can reply for reverse DNS request) in your subnet then consider using nmap --dns-servers <IP of your DNS server1>,[IP of your DNS server2] -sn xxx.xxx.x.*


Which public-domain encryption framework to use with .NET Which public-domain encryption libraries would you prefer to use with .NET?
I found http://www.bouncycastle.org/csharp/, but I don't how trustworthily The Legion of the Bouncy Castle is. Its seems not to be maintained frequently.

Which cryptographic primitives do I want to use?

Symmetric key cryptography
Public key cryptography with EC and RSA
Authentication
One-way hash function
secure number generator

Bouncy Castle is pretty well known and used in a fair number of production apps. I came across it myself a few times when I worked as a C# developer. However, most of the implementations in there simply piggyback off the .NET framework implementations anyway. The added value that they're selling is additional cryptographic primitives that .NET doesn't provide, and more convenient / simplified interfaces for people who don't understand how to use cryptography. However, it does have flaws and shouldn't be relied on for anything critical. It's also, to my knowledge, ever been formally reviewed by cryptographers.

That said, you should definitely use the .NET framework stuff, rather than rolling your own implementations. For a large part, it's just a managed wrapper around the underlying CAPI or CNG implementations in the operating system, so it's as trustworthy as the OS.  The bits that aren't wrappers are explicitly named Managed, e.g. SHA1Managed. If you don't trust the CAPI or CNG implementations, then you shouldn't trust the rest of the OS, and your problem becomes moot anyway.

Even better, the .NET framework is shared-source. You can go review the reference source at at any time. There are plugins for Visual Studio (e.g. ReSharper) that let you right click any .NET type and jump to the source, and it'll automatically download the appropriate reference source files for your viewing. It's pretty awesome, and has helped me solve loads of bugs over the years.

So yeah, tl;dr is that the .NET framework implementations are solid, so use them. BC is also useful, but then you're adding bloat and potential licensing issues, so if you can get by without it then do so.


Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in memory to do subsequent operations using the symmetric key. How is the security of the symmetric key in memory obtained? On a standard linux (android) should I not be able to dump the contents of memory and hence obtain the symmetric key? So what is the Trust Zone and wrapping with the SRK giving me? Is there a way to protect this symmetric key and all subsequent operations using the symmetric key? I remember reading a while ago that in the Trust Zone we can run signed code only which is good but isn't encrypted memory required to be secure? Is there a trust zone mode where I get encrypted memory there by protecting the key in memory?

How does Android solve it? If there is an option to use encrypted memory in Android, how is the memory encrypted, with which key and how is the key provisioned/generated?

TrustZone and TPM (with its SRK) are two very different things. I'll try to deferenciate both of those before explaining how they can be used to achieve what you explained.

TrustZone is an ARM platform environment. It provides a second environment which is meant to be secure. By this I mean, many features are available to obtain security.

In your example, the normal environment (the rich world in TrustZone terms) would be running Android and a so-called trusted/secure kernel (the TEE) would be on TrustZone side (the secure world). Those protections are defined by the TEE itself and depends on its actual goals. What's running in the secure world use protected memory that cannot be write/read by the normal world (Android) and some device might be mediated or reserved exclusively by the TrustZone kernel too.

You are right when you say a symmetric key wrapped by the TPM's SRK would normally be exposed directly in memory once unwrapped. The TPM does not offer anything at that point. The assumption is that you are only doing this from a trusted environment. However, if we join both a TPM and TrustZone, we can encrypt/decrypt data with the SRK (e.g. a symmetric key) and only expose the plain text to the secure world hence protecting it from the normal word, Android.

This is basically how Apple protects sensible information/processes (obviously heavily simplified).


Is it safer to trust software/company that has been hacked in the past? Which is better, when you have choices between 2 competing products:

First one, which has never been publicly reported about being hacked or having security holes

or

Second one, which has had bad days in the past, and was hacked (critical leakage) 1-2 times in recent years (which has been then fixed).

The argument which comes to my mind is to lean toward the 2nd choice. The 1st product developers could become loyal, used to think that their product is not vulnerable and don't much care about that, while the 2nd product's developers & management should definitely be worrying & working hard (if they are competent) on security details and development, to raise their reputation.

What is the stronger argument toward any of them?

EDIT: (To say in details, both are top password managers - both are used by millions of people).

It is safer to trust the product that has been tested thoroughly and has had weaknesses fixed. Many times, a successful hack can act as a form of robust test.

But being hacked does not equate to being safer unless the underlying problem has been fixed.

A product that has not been tested, and hence, has not been fixed, provides a false sense of security in that the product has "never had a problem". That's why penetration tests, audits, bug bounties, and public disclosures are useful.

But being hacked, or tested, means nothing without proper fixes to the underlying weaknesses. Adobe Flash has been fixed countless times, but it never become more secure because the underlying problems were never properly addressed.

RSA encryption has never been hacked, but has been tested thoroughly. One should not trust the encryption algorithm that has been hacked in the past.

It's not about the hacks, but about how it was fixed.


CSRF with JSON POST when Content-Type must be application/json I am testing web application for which business actions are done by sending JSON requests like for example:

POST /dataRequest HTTP/1.1
Host: test.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101
Firefox/55.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Content-Type: application/json; charset=utf-8
Content-Length: 99
Cookie: SESSIONID=7jtyutuytu1a
Connection: close

{"F":"test.AppRequestFactory","I":[{"O":"5vhghgjhgjE0="}]}

I made the HTML auto-submit page like this

<html>
<head>
</head>
<body onload=document.getElementById('xsrf').submit()>
    <form id="xsrf" action="https://test.com/dataRequest" method=post enctype="text/plain">
    <input name='{"F":"test.AppRequestFactory","I":[{"O":""O":"5vhghgjhgjE0' value='"}]}' type='hidden'>
    </form>
</body>
</html>

The problem is that it will be send with header Content-Type: text/plain, but the server only accepts Content-Type: application/json; charset=utf-8.

I've read the discussion CSRF with JSON POST
where one of the comments states:

  Use something like this: var blob= new Blob([JSON.stringify(YOUR JSON)], {type : 'application/json; charset=UTF-8'}); to generate a JSON blob and it'll send perfectly. CSRF in seconds!

But I have no idea how to use this approach.

Is this application vulnerable to CSRF attack?

Is this application vulnerable to CSRF attack?

Yes, it's vulnerable. The prerequisite, however, here is Flash. With the help of Flash, it's possible to forge a Content-type header with any arbitrary value. What you need to do is POST a request to your own domain, and then issue a 307 redirect. Please refer to below screenshot:

For more information, please refer to this cm2.pw article.

  Use something like this: var blob= new Blob([JSON.stringify(YOUR JSON)], {type : 'application/json; charset=UTF-8'}); to generate a JSON blob and it'll send perfectly. CSRF in seconds!

This, afaik, is already fixed in modern browsers. However, it still works in IE with file URI.

Update:
Since it's still getting a lot of views lately, I'm adding links to fixes;
https://bugzilla.mozilla.org/show_bug.cgi?id=1436241
https://bugs.chromium.org/p/chromium/issues/detail?id=332023

For some reason, chromium fix does not work and still allow sending POST request with custom Content-type headers.


Java / Android Client-Server application. Digital certificates and CAs I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the features such as file transfer, registering and logging in and so on (MySQL database keeping records of users and passwords) and so on. I've come to a halt in my development when trying to implement security features. I want to use asymmetric cryptography for authentication and symmetric cryptography for encrypting communication between client and server. So here is the deal:

The communication between client and server will be doing using AES. This relies on a pre-shared key between both parties. This pre-shared key will be generated on the client side each time a session is initiated and will be sent to the server, encrypted using the servers public key. That way, only the server that posses the private key will be able to decrypt the pre-shared key and read the communication. Where I am a bit confused is the sharing of the servers public key. Now I know the best way to do this is to use a digital certificate containing the servers public key. I also know this certificate should come from a trusted CA.

My question is, how do I go about getting a digital certificate for my server? Will my android application request for this certificate from the server or the CA? My initial thought is that it has to receive this certificate from a CA, as if it receives it from the server, it may be fraudulent. What is the process and the correct way of going about this? Anywhere I read, it just talks about HTTPS connection from client to Web server. I am writing a server in java that will communicate over sockets with my android application. How do I go about creating, receiving and verifying certificates in relation to trusted CAs?

Thanks

You say:

  My initial thought is that it has to receive this certificate from a CA, as if it receives it from the server, it may be fraudulent.

Yet, here lies the problem with your thinking: X.509 certificates are crafted such that they are tamper resistant. If the server changes the certificate, it get's invalid (with acceptable probabitity).

You can do it the same way TLS does it and let the server present the client the certificate to validate. Because it's signed by a CA the client trusts, it can be accepted.

Also, the usual disclaimer:

Why do you not use TLS? That's what it is for.
Do now brew your own crypto.


How to raise a key to ultimate trust on another machine? I have created a master key with two subkeys: one for signing and the other for encryption. Finally, I have exported the two subkeys to a new machine.

How can I tell the new machine to consider the master as "ultimate", even if it is absent from the machine? Does it matter?

You can set every key to ultimate trust through opening the key edit command line

gpg --edit-key [key-id]

and running the trust command. You will now be prompted to select the trust level:

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision?

Obviously, 5 will be the proper decision to achieve ultimate trust. Finally, save to commit the changes and exit GnuPG. The same commands apply to both GnuPG 1.4 and GnuPG 2 (and newer).

Ultimate enables a key to introduce trust in the OpenPGP web of trust, with other words all ultimately trusted keys act as a starting point for trust paths. You should set your own keys to ultimate trust, but usually will not do so for other's.


What are some good website security scanning solutions? What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.

Generally, I'm looking for something we can run to provide to clients some sort of certification that their sites are secure. A plus of some of the web-based solutions would be that they can automate it and provide a 'seal' proving the security check is up to date. An example of one I have seen is the GoDaddy Website Protection Site Scanner

Unfortunately there are no automated scanners to detect all the types of vulnerabilities in modern web applications (I often hear less than 50%).

Relying only on automated solutions is fraught with shortcomings.  Automated scanners can expose the easy stuff, but you need human intelligence to explore and reveal additional vulnerabilities.

With that said, you can refer to this question (and answers) to view a list of popular automated web application vulnerability assessment tools.


Is it valid to authenticate a message by decrypting and validating the format of the plain text? I'm wanting to validate a message came from a trusted source, and I'm wanting the message encrypted. I can share keys securely beforehand. The catch is that I'm very limited in the number of characters in each message (maximum worst case encrypted & armored message length ~300 characters which is acceptable, but high).

It seems the "correct" way of doing this might with signing? I'm not really familiar with the workflow, and I'm concerned about the length that would add or other complications.

Given that I can format my encrypted message however I want, is it valid to simply decrypt and validate that the message has the right format (10 character identifier, followed by 5 numeric characters, etc.)?

As the comments already suggest, this is a good scenario to be using AES-GCM, the Gallois/Counter mode of operation.

From the linked source:

  The operation is an authenticated encryption algorithm designed to
  provide both data authenticity (integrity) and confidentiality. GCM is
  defined for block ciphers with a block size of 128 bits

Other modes that authenticate the message with an additional MAC might work as well but as GCM is available, this might very well be the best suited option.

As to answer your actual question of just going with anything that decrypts to intelligible text:

This is not a good idea. There is a - small - probability that an attacker might alter the cipher text and it decrypts to valid plain text that wasn’t the original plain text.

While there is no known attack on AES to gain any significant advantage over randomly flipping bits to accomplish that, using GCM provides way better authentication, removes the possibility of human failure and offer this for little overhead, so GCM should be the choice here.


Recommendations for hosting highly sensitive data I am doing some investigation on hosting sensitive data.  Mostly finance and fund data but at a personal level.  This will be a secure website where users will be able to login and view their fund data. Backups are needed but source data will reside in offline database and will be transfered to this site on a monthly/quarterly basis (not sure at the moment how). Credit card data storage is not required at this time.

I'm trying to figure out what I need to look for when selecting a host from physical security to data security. What are some considerations to take into account when looking for a host?  SAS 70?  Any others?

You will want to make sure that all associated vendors have either a SAS70 type 2 or SSAE16 that is up to date. This should provide you with a list of the physical and technical security controls in place, and their effectiveness.


Work WIFI connection and personal cell phone I have a Samsung S8+ and when I'm in the office, I often will log in to the internal WiFi to listen to the Pandora app or play the Netflix app in the background.  We actually have 2 Wi-Fi connections we can log in to - one is for guests and the other is for the employees, which takes our login and password to connect.  I use the internal access, as do many others, because the guest access doesn't allow streaming but the internal does.

Since I am logging into the network, is my employer able to see everything else going on in my phone?  I ask, only because I have a lot of apps on my phone that while I am not on them, they always seem to be "on" anyway, like Facebook, Chase mobile app, Yahoo mail app, the internet app, etc. I don't want my employer to think I'm on these apps all day, when all I truly have running is Pandora or Netflix.

Also, if those apps are running in the background, can my employer look into them? For example, can they get into my Yahoo mail and start reading emails, or see what I have posted on Facebook or any websites I visit?  If I post on a forum, like this one, that I hate peaches (just an example), can they see word for word what I wrote?  Also, if I do access these apps, its only during lunch.

Lastly, there is no software from my employer downloaded on my phone.  They wanted us all to do that in order to reimburse us for business calls we make in the field, but i said no way - a $20 stipend per month wasn't worth it to me.

Thank you for any help you can give me.

First, let's talk about HTTP vs HTTPS.

HTTP vs HTTPS

Say you visit cutefluffyanimals.com/hairless-mole-rats and post about your unholy fascination with the critters. This web request breaks into (simplified, please correct in comments if simplified too much or wrong):

host: cutefluffyanimals.com
resource: /hairless-mole-rats
POST content: "They're just so pretty..."

If you visit http://... then the above will pass over your employer's routers in plaintext and in theory they can see all of it in their logs. But if you visit https://... then the host: remains in plaintext (because routers across the internet need to know where to send it to, like the address on the outside of an envelope), but the rest is encrypted from your phone all the way to the cutefluffyanimals.com server.

So for stuff sent over HTTPS, they (could) see the sites you visit, but not which pages, or what you did on those pages.

What does this mean?

Let's deal with the easy one first:

  can [my employer] get into my Yahoo mail and start reading emails, or see what I have posted on Facebook or any websites I visit? If I post on a forum ... can they see word for word what I wrote?

No, no, maybe, and probably not.

If you are careful to always use https://... then you're generally safe. They will not be able to sniff your Yahoo password, or see what you did on facebook. But they will be able to see that you visited mail.yahoo.com, facebook.com, streaming,netflix.com and how often / how much traffic you had there.

Similarly, your background apps are probably chattering away (ie "phoning home"), so your device is probably opening connections to chase.com, etc. If they apps are programmed properly, then they will be phoning home over https, so in which case your employer probably does have enough information to profile which apps you have installed on your device, but can't see the content. If the app is badly written then they can see the content too. Sadly you really have no control over this.

  Lastly, there is no software from my employer downloaded on my phone. They wanted us all to do that in order to reimburse us for business calls we make in the field, but i said no way - a $20 stipend per month wasn't worth it to me.

Yup, good. I personally did the same. My company wanted me to install a webmail app as a Mobile Device Manager (MDM) - ie root access- in order to access corporate email on my BYOD device and I said "cool, looks like I'll only be answering emails during business hours then".

The dangerous thing is if they install a https certificate onto your device, then they have the ability to intercept and inspect https traffic and everything I said above is shot out the window.


Public Key Transfer between two Applications I have a Service written in c# which uses asymmetric Encryption to Encrypt Data, and a client application which Decrypts the Encrypted data received from the service.

How can I do the following things ?

I need to save the private key in a secure way that no one can read it (preferably in DB).
Transfer the public key securely to the client application.
How can I make sure the key can only be used by the Client Application not any other applications

For #1 the usual answer would be to the store the key in an HSM (hardware security module). This is the only truly secure way to store a private key, as any keys simply stored on the hard drive will be compromised if your machine is compromised.

Question #2 is what is usually solved by a PKI (public key infrastructure). Others have said that there is no need to securely transfer a public key, but this is not entirely true; if someone were to perform a man-in-the-middle attack and insert their public key instead, then they would be able to decrypt all future communication. The key itself is not sensitive, and doesn't need to be secured, but you do need some way of ensuring that it is authentic. Confidentiality is not required but authenticity is.

When you use a PKI, the public key is signed by another key higher up the hierarchy to produce a certificate, and this signature verifies that the key is authentic. Of course, then you have the issue of distributing the public key of the next key up the hierarchy and so on. Generally this is solved by distributing the root public key along with your application, as a trusted root CA (certificate authority), then this can be used to verify the authenticity of any certificate chains with this CA at their root.

Question #3 is again something that can be achieved if you are using an HSM to secure your keys.


What is a privacy policy? Im having trouble grasping the definition of a privacy policy. Is it the agreement of user and another party? or can it also be privacy settings a user specify in an application? or is it just the terms they agree on before using the application?

Could this be a privacy policy?: "[check-box]Hide your recent activity", in a given application or this a privacy setting?

(This is a really high-level answer. Happy to receive clarification if you require it to be more specific.)

A privacy policy is defined by 2 pieces of information:

What the author considers to be private. This could be defined by legal or regulatory guidance in your state/country.
How private information is to be managed. This may include mandatory or optional controls. The necessity of these controls is usually graded by words such as must, required, shall, should, may, and optional.

For example, this is a high-level policy statement:

Personally identifiable information (e.g., name, date of birth, address) must be kept secure.

Now, secure is a vague word, but remember that this is a high-level policy statement. One would generally delve into the policy description or set of standards that define what secure means based on whether the information is in digital storage or on a physical medium such as paper.

Even then, security control for data stored in digital storage would be different for, say, a hard within a system in a datacenter versus tape backup on an off-site location managed by a third party.

Security controls managed by your organisation would generally have technical controls, whereas enforcing security controls operated by a third party would generally be managed using contractual controls.


Is my WiFi and computer hacked? Yesterday, I woke my computer up from sleep mode (it had been on all day while I was at work). And my browser was open to an email account that was not mine.

Is it possible that someone hacked my WiFi and then used my computer to visit websites on my computer?

If it is, is there a way to detect when someone had access to my WiFi (were he didn't belong to be) and is there a way to detect if they had access to my computer?

Is this is something that would be relatively easy to do, or would only really experienced hackers be able to do so? Also, would they have to be physically near my house?

Is it possible to hack your WiFi and then use your computer?

Possible, yes. Likely, no. To be able to 'use' your computer remotely, they would need to have some kind of shell access, use that to open a browser and check their email. Not something you would expect a hacker to do.

  Is it possible to see if someone had access to your WiFi?

Yes, depending on your router, there should be some kind of log, showing which mac addresses have been connected. They would have to be in range of your WiFi to do this.

  Is this easy to do?

Hacking WiFi is pretty easy and straight forward, if you use a WEP password, it's very easy, using a WPA makes it a bit harder: It will take longer, but it's not impossible.

Gaining access to your computer is a bit harder; they would have to make you click a link to gain access, or use another method, requiring more knowledge.

I really don't think that this is the case here, though. Sounds like someone had physical access to your computer and forgot to log out.


Are there any vulnerabilities in TLS 1.0 that can NOT be avoided by proper implementation? Assuming one has complete control the implementation of TLS 1.0 on both the client and the server side, are there any known vulnerabilities that can not be prevented at all? From what I have researched, there doesn't seem to be anything, not that I am advocating use of 1.0 over 1.2, I'm just curious.

Thanks.

I think that if:

Both sides implement empty record protocol packets or the 1/n-1 split[1] to mitigate the BEAST attack
Both sides send bad_record_mac alert rather than the decryption_failed alert in case of CBC padding error

Then TLS 1.0 is as secure as TLS 1.1. Then, if you also add:

Both sides implement correct timing safe checking of MAC for MAC-then-encrypt, including lucky13, which is so difficult basically everyone [2][3] made a bad bug while trying to implement it and one of the best TLS implementers in the world punted on implementing it for the Golang TLS stack because it's too hard [4][5].

you have a system in which the TLS CBC ciphersuites are secure. Of course, the recommendation is to switch to AEAD.

1 - https://bugzilla.mozilla.org/show_bug.cgi?id=665814#c59

2 - https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/

3 - https://blogs.aws.amazon.com/security/post/TxLZP6HNAYWBQ6/s2n-and-Lucky-13

4 - https://github.com/golang/go/issues/7418#issuecomment-66091828

5 - https://www.imperialviolet.org/2013/02/04/luckythirteen.html