How and where can I best announce an XSS vulnerability in a relatively well-known website? I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in pressuring the organization to fix the vulnerability. After that, the vulnerability would just linger around, increasing chances a "black-hat" hacker would exploit it. That's the opposite of what I'm trying to accomplish.

I'm pretty far in the "responsible disclosure" process. I'm trying to behave very ethically here.

If it were a vulnerability in something as big as Facebook or Google or so, than this would be picked up quiete easily by security blogs I think, possibly even general tech press. This site is definitely more "second tier", which makes for less juicy news. Also, I don't feel like taking time to write an exploit (say: a worm, perhaps capturing user cookies along the way), which I assume would enhance the news-value. I'm actually surprised how much time I put into this already, somewhat "proving" that I care to myself. (never been in a like situation before)

I'm fully aware that this question is "subjective" (it's even be automatically detected as so), but I'm still gonna try my luck, 'cause I really could use some help here.

Note, I tagged this with "vulnerability-markets" because I think that this is somewhat related. I'm not looking to sell it though. I just want to see it fixed.

Thanks in advance. :)

Perhaps I should have made it more clear that as it stands now, I don't have much faith in the organization's desire to fix this vulnerability, without external pressure. That's why I'm exploring my options.

You can Make a Responsible Disclosure with ZDI (Zero day Initiative), They are well known for their work and you have a good opportunity to earn some money depending on how strong exploits can be plotted upon the vulnerability you have found.

Many security experts submit CVE's to ZDI, Its legal and secured in case you are afraid of company to sue you.

They actually act as a mediator between you and the company and let company know about the vulnerability on your behalf.

  Link to ZDI


Can a VM be used as a home computer? Our old computer is getting replaced, and I want to secure the new computer right from the get go.  So I figured if I install something like VirtualBox first thing, I could then create one very powerful VM for my family to use.

My old computer was plagued with viruses and trojans and rootkits that i couldn't pull out of the hardware, and I didn't want it to happen again to the fresh PC hardware.  My thinking was, that if something went horribly wrong with the VM, I could just restore a backup of the VM.  In that way, the PC's hardware is spared.

Is this a viable security measure?

---Addition

So, I know that the resulting VM will be weaker than the actual computer.  I am betting on the fact that the host will be healthy/not crippled by malware to make up for the loss.  I'm not the only one who will be using the computer, and the rest that would use it are casual users/unsafe on the internet.  So, the computer will almost certainly be compromised.

By having all the users use the VM, I am hoping to preserve the strength of host; as in, keep the malware on the guest.  If I restore the VM to its clean form, I can wipe out the malware no?  I am meaning to keep the host clean.

It sounds like you are wanting to run a bare metal hypervisor as a desktop. This is only recently been supported on platforms like vSphere and Xen due to PCI/VGA Passthrough. If you are looking for any real performance, you are going to be slightly disappointed with this setup.

What I generally suggest is to install the operating system, install the applications you know are safe and stable, configure the machine to your liking, and then take an image. Windows 7+ makes this process almost stupid easy, to the point where you can restore a system to its previous state in less than an hour. This is exactly what you would be doing with a VM, except it would not be virtualized.

To answer your question, it is a viable security measure. I don't know how practical it is though. I've done this exact thing before, and usability as a desktop was not optimal.


What is the difference between "local" and "Adjacent" threat agents? I am using CVSS to do the vulnerability assessment for my project.
As per documentation here is the definition of local and adjacent

Adjacent (A)  The vulnerable component is bound to the network stack, but the attack is limited at the  protocol level to a logically adjacent topology. This can mean an attack must be launched from the  same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE‑2013‑6014).

Local (L) The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either:
the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or
the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).

I want to list the assets which will be exploited by local and adjacent threat agents for below components.

Client EXE - Which will be installed on devices
Cloud system  - EXE communicates with a cloud system

Questions:

Does EXE fall under both local and adjacent?
The VM deployed in cloud system can be accessed by SSH. does it also belongs to local?
accessing resource remotely by SSH is local or network threat agent?

Architecture

You cannot assign an Attack Vector (AV) to a component, only to a specific vulnerability to that component.
If the vulnerability can be exploited by using an SSH connection from a local network, set the AV to adjacent
Depends on where the connection of the attacker is coming from. If it' coming from the internet, use Network. If you need to be already in some LAN, use adjacent.

The CVSS user guide gives you some nice flowchart telling you how to decide which values to use in your CVSS vector


Possible arbitrary file download vulnerability I am auditing a possible vulnerable piece of ASP code on a Windows environment. The code is as follows:

If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then

Basicly it is supposed to only let the download script fetch files from that location. Webserver has directory traversal turned off. This means that the following submit will not work and will in fact return a 403 forbidden:

\Only\Download\From\Here\..\..\..\..\..\c:\windows\system32\eula.txt

Because the function sais "InStr" instead of "BeginsWith" (psuedo code) it only checks if the String contains the path, but not in fact begins with the path.

The following submit will pass the If clause, but will return in a file not found:

c:\windows\system32\eula.txt%00\Only\Download\From\Here\

The nullbyte injected here does not do anything and it tries to find the file matching the entire string. I've also tried injecting CRLF, #, ; and more.

My question is then if there is any way I can submit a query string that would successfully download arbitrary files? Is there any way to submit a file URI that will fetch me a file and in a way commenting out the /Only/Download/From/Here.

Edit: To summarize I am looking for some kind of way to "comment" out the last part of the filename, either through a bug/feature/vulnerability in ASP, Webserver or windows's handling of files.

Whilst you probably can't get access to files on the system, it's still a potential vulnerability if you can get it to access UNC paths. You could get the server to download arbitrary files like so:

\\evil-server-example.com\Only\Download\From\Here\malware.exe

Just set up a server with Windows file sharing open to the internet, with an openly accessible share. This will cause the file to be downloaded, thought it may not be stored depending on the configuration of the OS and the code you're dealing with. If it is stored, it's likely to be in a temporary directory. You may be able to leverage this later on.


End-to-end "group chat" encryption I have a case here, where I need to encrypt messages to a team/group. Everyone in the group can create a new message, and everyone else in the group can read/edit/delete that message. I want the following things:

Encrypted messages
Decryptable by everyone in a group (no one else can unlock it)
Group members can read/edit each message
No re-use of messages (like storing all the team members' public keys and then encrypt all messages with their public key), as that wouldn't work in this case
Possible to add a new member to the group and give that member access to all previous messages

The main property of this is security. I do not want anyone to be able to access the messages.

Here's a possible problem: If the whole database gets dropped and someone already has an account on that site, that said user should NOT be able to just add himself to that group, to display all the passwords stored in that group (like if the person recreates the application using the database). The messages would need to be encrypted somehow, that no one (not even with the database in hand) can access the encrypted messages.

What am I looking at doing here? It's a pretty unique case I think.

Let's start with your last constraint: if the database is compromised, then attacker must not be able to extract a key from the database and decrypt messages.  A simple way to ensure this is make sure the key is not in the database.  That is, whatever keys/etc. are required to decrypt the messages are stored by each client, not centrally.

You said you don't want to encrypt each message for each person using their public key.  Is a per-person symmetric key also out?  The disadvantage there is that in an N-person group each message would have N signatures, and there would need to be N2 keys - so this is not ideal for large groups.

Instead, what if there was a single "group key", which everybody uses to encrypt their messages?  Everybody in this group would have this key.  Part of "joining" a group is where an existing member shares their copy of the key with you.  To prove authorship (if that's desired) you could sign each message with the public key of the author - edited messages would be signed with the public key of the editor.

If there's a single group key, you would need to rotate this key whenever someone got booted out from the group.  This would require a user commonly-accepted as a "group administrator" sending a message to each individual member telling them the new key.  In order for new members to be able to read the entire history, it could make sense for the old key to be encrypted with the new key and posted to the group (possibly as part of the "X has left the group" notification), so that new members can follow the message history back across this boundary.

So: a single group key stored in the clients not the servers, keys replaced whenever a member leaves the group and sent to each member (public-key encryted) by an admin, and each message/edit optionally signed by public key (different from the previous one, because you never sign and encrypt with the same key).  This seems to me like it would fit your requirements,  but it falls short on some other requirements - the gold standard is Whisper Systems, so you could read about how they do things.


REST API: does securing the first call with a CAPTCHA make sense? Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data).

There is no good way to guarantee my API is only called from my mobile application. Oauth2 and the like with 'secret' in the client code can be easily reverse-engineered.

Let's say I have an API call like this:
https://myapi.example.com/register_user?username=UUU&password=PPP&email=EEE

This creates a new user and from then on all API calls will either include a session-token or something that ties the API call to a specific app user with an account.

This first registration call is the only one that is not protected by anything and what I'm worried about is that a malicious person calls it 1,000,000 times from a PC script to create lots of fake users, especially with real email addresses. Then people with these addresses won't be able to use the app.

How can I protect that very first API call to prevent mass misuse? I'm thinking of including a server-validated mobile-friendly CAPTCHA in the user registration form.

Again, all subsequent API calls are protected with session-token and API-call-count monitored per user (suspicious ones are blocked).

It's about designing the API in such a way that even if used from an inherently unsafe client like a mobile phone, it is still fine. Basically even if the API were to be made completely public, nobody could do much wrong with it. So here the question focuses on protecting that first API call but it's also about solving a more general problem.

It seems other interesting alternatives include using email-validation or a solid third-party identity provider like Google and the like. None of these 3 options is perfect. Anyway, interested in the discussion around this issue.

Does that make sense? Am I over-complicating things?

The standard approach to this would be to e-mail the user to confirm the account and if this doesn't occur in a pre-defined period of time, to delete the registration.

You could combine this with some Anomaly detection so for example if you got large numbers of registrations from a single IP address you could assume that this is hostile and block that IP address. Not perfect against a determined attacker but could deter less determined ones.

You could also add something like a CAPTCHA to the registration process, again this could deter less determined attackers but there are a number of ways round these, such as CAPTCHA completion services which are relatively inexpensive, so a determined attacker could bypass them.

Which of these are reasonable largely depends on the risk/threat profile of your application.


Why are randomly generated passwords often hexadecimal? Most of the time, when I see a randomly generated password, it's hexadecimal, i.e. only uses the character set [0-9a-f]. Wouldn't it be much more secure if the character set were [0-9a-z], let alone [0-9a-zA-Z]?

(Do you have evidence that random passwords are usually hex?)

Here are some possible reasons why you frequently find hexadecimal passwords:

The passwords you see might be already hashed. Since hash functions return binary strings, you will often see them stored in a hexadecimal form.
Hashing a random binary sequence (e.g. from /dev/urandom) is a cheap but reasonably safe way to create a random password. You'll occasionally see something like this in the wild:

$ head -c 100 /dev/urandom | sha256sum | head -c 25
c9ea6b67af36753a68ef42429

All characters are easy to distinguish. That is, you won't run into problems with confusing 1 and I, O and 0, etc. if you only permit hexadecimals in the first place.
Randomly generated sequences are usually binary, so displaying them in a hexadecimal form seems logical and efficient.

That said, choosing a random password from a larger range than [0-9a-f] is obviously safer if you don't adjust the length. I usually go with your suggestion of [0-9a-zA-Z] which gives me a broad range and avoids special characters that might cause issues with storing and transmitting.

Also, here is what I put in my shell config to quickly generate passwords on Linux:

function spw() {
    cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c ${1:-20}
}

E.g., spw 25 will give me a 25-character passwords of [0-9a-zA-Z].


Storing Passwords On Server Config I have a web-application. My web-app needs access to certain other applications such as MySQL.

In order for my web-app to access MySQL, I need to provide it a username / password. What are best practices to store this username / password on the server in a secure way (not in plain-text that anyone could stumble upon)?

For clarification, I do NOT need to store my web-app's users information. I need to store a user/pass for my web-app to use MySQL.

This seems like a basic question that would have been answered already, however after searching around, the only related answers I can find are as follows:

Is it okay for API secret to be stored in plain text or decrypt-able?
How is storing an API secret key in plaintext (in a database) secure?

Turtles All the Way Down is a good talk that covers this subject.

In short, there aren't any great solutions, because if you store the password to the database somewhere, you have to authenticate to that somehow, which leaves you back where you started.  However, there are some options that reduce your risk.

The most common solutions are to store the password in an untracked file or environment variables on the server.  This prevents a leak of your source code from exposing the password, but someone who gains access to your server will still be able to see it.  You can also use systems that encrypt passwords into a file that is then stored in version control, which gives you all the benefits of a VCS, but this falls to similar issues.

Personally, I'm fond of secrets management systems like Hashicorp's Vault or Square's Keywhiz.  These are systems that (usually) live external to your server and provide an API for getting and setting secret values.  While they require authentication, this authentication can be temporary session values, similar to session cookies for websites, which will prevent an undetected attacker from gaining long-term access to your secrets, as the session they've stolen will expire (at some configurable time).  These systems generally include audit logs as well, so once you detect a breach, you can track down where it came from.

The solution that makes the most sense for your particular situation depends a lot on your needs.  Vault and friends are excellent, but introduce a lot of additional operational complexity, possibly more than the entire rest of your application.  You will need to evaluate the tradeoffs for yourself to see what would be a good fit.


how can I stop someone from watching my internet history? I use someone's wifi network. Is there anyway to stop him by getting my browsing information or can I somehow hide my browsing history from him?

Use a VPN to a trusted endpoint, or at least visit only sites over HTTPS.  (There he'll still be able to know which servers you connect to, but not which pages you request.)  You could also consider using something TOR to tunnel all your traffic (as it also encrypts all traffic).


I'm Trying to Find how to Exploit my SQL Code I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think that's necessarily because the code is immune to SQL injection, but maybe because my test cases were not thorough, so is this code exploitable? Example?

USE [MyDB]
GO
SET ANSI_NULLS ON

GO
SET QUOTED_IDENTIFIER ON
GO
CREATE PROCEDURE [dbo].[sp_mySP]
    @Myfirst nvarchar(10),
      @Mysecond nvarchar(400)

AS
BEGIN
DECLARE @SQLString nvarchar(MAX);
DECLARE @ParmDefinition nvarchar(MAX);
      SET NOCOUNT ON;
      SET @SQLString =  N'insert into MyTable (Myfirst, Mysecond) values (@first,@second)';
      SET @ParmDefinition = N'@first nvarchar(10),@second nvarchar(400)';

      exec sp_executesql
            @SQLString,@ParmDefinition,
            @first = @Myfirst,
            @second = @Mysecond;
END

For the record, here is the .NET code that accesses the database, however I want the stored procedure to be secure by itself with no assumptions about the calling function.

           cmd = new SqlCommand("sp_mySP", Con); //The SQL Command

        cmd.CommandType = CommandType.StoredProcedure;

        //Parameters
        SqlParameter first = new SqlParameter("@Myfirst", SqlDbType.NVarChar, 10);
        SqlParameter second= new SqlParameter("@Mysecond", SqlDbType.NVarChar, 400);
        first.Value = "value-here";// <-- Definitely not the test cases I used
        second.Value = "value-here";

        cmd.Parameters.Add(first);
        cmd.Parameters.Add(second);

        Con.Open();
        cmd.ExecuteScalar();

Doesn't the truncation SQL injection attack only apply to dynamic/concatenated query constructs?


How can SSH server know private key is incorrect if passphrase havent been provided yet? I have server which I am accessing via SSH. I only allow the authentication to be made with private key. Normally when I login via PuTTY, I am first asked for username and then asked for passphrase for the key. Out of curiosity I have created new private key, which should be invalid for my user and I also have put passphrase on it. To my surprise once I provided the user name the key attempted to login with to my server was refused before I have been asked for the passphrase.

I am wondering how can SSH server know that the private key is incorrect if the passphrase for it haven't been provided yet?

While you've encrypted the private key, the public key is still readable. SSH authentication with the "publickey" method works by having the client send each potential public key to the server, then the server responds telling the client which key is allowed. If one of the keys is allowed, then the client must decrypt the private key to sign a message, proving ownership of the private key.

In your experiment, the server responded saying that none of the provided keys was allowed for your username, so there was no need to decrypt a private key, authentication had already failed.


nmap: why is it "silly" to combine OS finding option (-O) with bounce scan (-b) If you run an Nmap FTP bounce scan with nmap -O -b, nmap will do the scan, but it says that the scan "seems silly" before it starts. Why would the scan be silly?

It actually appears to report a ton of results for what ports are open, although the OS it reports is different from the OS that is reported if I run the nmap -sT -O -P0 option.

Why would the OS it reports be different for the bounce scan than for the TCP Connect scan? Is there some reason the bounce scan is unreliable?

FTP has a "feature" in it that allows one party to request that the FTP server send a file to another party, in effect acting as a proxy. This is really a vulnerability: if that feature is enabled on an internet-facing FTP server then that server could be used as a jumping off point for attacks on whatever the FTP server can connect to. This "feature" has long been deprecated and you're unlikely to find any FTP servers using it, although you never know.

When you use -b you are supposed to put the IP address of a vulnerable FTP server after the -b to act as a proxy. If you haven't put an IP address after it nmap won't have an FTP server to bounce through, so the option isn't used, so it would be silly to put -b without an IP address after.

If you have put an IP address after the -b, and the IP really is an FTP with bounce enabled, then the effect of the proxy would be to skew any OS fingerprinting so the results wouldn't be valid. Any OS fingerprinting done through any sort of proxy cannot be trusted, so using -O while using FTP bounce would also be silly.


Why does Google consider Thunderbird not secure enough? There is a special setting in Google accounts to allow "less secure applications" access to your account. If you turn this off, Mozilla Thunderbird won't work to check your e-mail. This is confirmed on this page, where Google says:

  Some examples of apps that do not support the latest security
  standards include:

  The Mail app on your iPhone or iPad with iOS 6 or below
  The Mail app on your Windows phone preceding the 8.1 release
  Some Desktop mail clients like Microsoft Outlook and Mozilla Thunderbird

My question is specially about Thunderbird... what are those security standards that it does not support?

Thunderbird doesn't support two factor authentication, so Google has a means of generating a special credential set that can be used with Thunderbird. When configured in this way it works fine with Gmail, but I guess it is less secure than proper TFA.


Professional certifications for IT Security Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist?

CEH  Certified Ethical Hacker
CIPP Certified Information Privacy Professional
CISM Certified Information Security Manager
CISSP Certified Information Systems Security Professional
GIAC Global Information Assurance Certification
LPT  Licensed Penetration Tester
AHC  Anti-Hacking Certification
AISC Advanced Information Security Certification
CHFI Computer Hacking Forensic Investigator
CPP  Certified Protection Professional
SSEC Software Security Engineering Certification

None.
Generally speaking, certifications in the security field, much like most other tech areas, are required only for entry-level positions (when you have no experience to speak of), senior positions (when you need the long signature), and government jobs (when you need to answer an RFP to work there).
By themselves, none of these are a replacement for good ol' experience and knowledge.

That said, these are the ones that get more "respect" (that I am familiar with):

CISSP
CISM
GIAC
CEH for a juniorish pentester

Also OWASP is supposedly coming out with their own cert soon, that would probably be respectable enough....


Slow client key exchange in TLS? I've been benchmarking my TLS performance, and I noticed that during the "write client key exchange" phase, there's significant overhead compared to all other actions. I'm wondering if there's anything I can do to speed this up?

40348.989720O ssl_info_callback SSL_connect SSLv3 read server certificate A
140348.989934O ssl_info_callback SSL_connect SSLv3 read server key exchange A
140348.989954O ssl_info_callback SSL_connect SSLv3 read server certificate request A
140348.989968O ssl_info_callback SSL_connect SSLv3 read server done A
140348.990606O ssl_info_callback SSL_connect SSLv3 write client certificate A
140349.29131O ssl_info_callback SSL_connect SSLv3 write client key exchange A
140349.35914O ssl_info_callback SSL_connect SSLv3 write certificate verify A
140349.36013O ssl_info_callback SSL_connect SSLv3 write change cipher spec A
140349.36062O ssl_info_callback SSL_connect SSLv3 write finished A
140349.36077O ssl_info_callback SSL_connect SSLv3 flush data
140349.36094O ssl_info_callback SSL_connect error in SSLv3 read server session ticket A

Based on this, it looks like the client key exchange takes ~300ms

After your client receives the server's certificate, It could be that the client tries to check certificate revocation.

Save the server's CA certificates to a file and use the -CACert argument (or -CAPath).


Does TLS provide server authentication by default? In the scenario where "Application A" wants to communicate with "Application B" over an API (HTTPS), I want to ensure mutual authentication is implemented. Meaning that "A" should authenticate "B" before it authenticates itself. A CA signed certificate will be held on "B" to enable HTTPS.

When "A" initiates the TLS(1.2) connection with "B", does "A" authenticate "B" by default using TLS? Meaning does "A" verify that the endpoint certificate (CN) on "B" matches the domain name? If the domain name checking is not done I would assume this would not be sufficient for server authentication as the application will initiate the connection regardless of what certificate is presented on "B"?

I understand web browsers implement domain name checking, but was not sure if this was built into the TLS protocol and will therefore be implemented by default in application to application connections.

Update/Answer: This URL provides specific answers to my question: https://stackoverflow.com/questions/17279683/how-can-you-test-that-an-ssl-client-library-is-properly-verifying-the-certificat

RFC 8446 (TLS 1.3) says:

  Implementations are responsible for verifying the integrity of
  certificates ... Absent a specific indication from an application profile,
  certificates should always be verified to ensure proper signing by a
  trusted certificate authority (CA)

The spec seems to say that verification needs to be supported, but doesn't exactly require it (SHOULD vs MUST), and leaves it up to the implementation and application.

There isn't a single "TLS" either. There are many different implementations, although OpenSSL is probably most common. Reading their wiki, it seems that the defaults are fairly sane and should handle verification.

However, the application gets to decide if verification is actually used. So it's possible that a poorly developed application may have verification turned off.


How does server use session key after tls handshake? After TLS handshake both server and client agreed about session key to use as symmetric key. So server must store several session keys which each one belongs to a specific client.

How server determines for a received request which session key must be used(i.e session key of which client)? (Is this true: Client appends its session id in each request(somewhere like header?) and server has a map between session id and session key.)

How long a server uses a session key? Is it bad practice to use a session key for long time? Why they change session key while it transferred in a secure(i.e encrypted with public key) manner?

Normally, once the TLS handshake is complete, the client and server can exchange encrypted traffic on the same connection without having to communicate the session id.  This is because the server associates the SSL context information (including the session key) with the TCP socket on its end.  You can see this in this simplified example of a TCP server: https://wiki.openssl.org/index.php/Simple_TLS_Server

However, there are two scenarios where the session id is communicated after the initial handshake - session resumption and session renegotiation.

Session resumption allows the same TLS session (containing all the parameters agreed in the handshake) on a new TCP connection after closing the original one.  This means the connection could time out, and your browser would detect this case and resume the TLS session on a new connection by sending the session id in a new Client Hello.  More details on session resumption here: http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html

Session renegotiation is used to change the parameters to be different from the initial handshake, but on the same TCP connection.

As you mention, the storage of a session cache on the server compromises security.  An attacker could gain access to the session cache and then decrypt traffic.  More details on this here - https://blog.compass-security.com/2017/06/about-tls-perfect-forward-secrecy-and-session-resumption/


Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones? Take a random PHP site. It is essentially guaranteed that its web server is configured as follows: serve any file from the document root, except for certain files or paths that are blacklisted. Scripts are also made executable using a similar model: all .php files are executable by the web server except the blacklisted ones.

ASP.NET is configured the same in IIS: *.aspx files are, by default, executable from any directory, and one is supposed to blacklist directories like a public "uploads" location to prevent vulnerabilities.

I don't know about other web servers, but in IIS it is entirely possible to flip this around, by removing all handler mappings and then whitelisting very specific files / paths. Given a well-structured codebase, one can have just two such mappings: a single mapping for a "/public/" to be served by the StaticFileHandler, and another mapping that maps "/index.php" - and nothing else - to the FastCgiModule. For ASP.NET, it's a bit more work, but if this were a goal, tools could be written to whitelist .aspx files during deployment, so that no other .aspx files could be executed, no matter where they are located.

Allowing everything and then trying to plug the holes is surely one of the "security 101" no-no's. Why is it so ubiquitous in web server set-ups then?

Because web-server content changes frequently and it would be annoying to have to constantly add new files to a whitelist.

  For ASP.NET, it's a bit more work, but if this were a goal, tools could be written to whitelist .aspx files during deployment, so that no other .aspx files could be executed, no matter where they are located.

But you don't typically deploy .aspx, .php files through a tool.  You just drop them in the directory.  It would require a huge change in how scripting languages work.  They would cease to be scripting languages and become more like compiled languages.

  Allowing everything and then trying to plug the holes is surely one of the "security 101" no-no's. Why is it so ubiquitous in web server set-ups then?

Going the other way around would be based on the assumption that allowing user uploads is a normal use-case for everyone installing the webserver. Its not very likely that the majority of webserver instances allow user uploads, as most are undoubtedly corporate intranets or non-interactive sites that simply publish material to the user.


Injection of code into executable - Size question Code injection is the process of injecting some malicious code into a legitimate binary.

A lot of code injection projects that I have seen involve finding a large area of null bytes (\x00) in the .text section of the binary in order to inject shellcode. Then the address of the entry point is changed in order to point to the injected shellcode. The injected shell code will then point to the beginning of the original code after finishing.

Sometimes there are not enough contiguous \x00 bytes available in the .text section in order to perform this action. As a result, the project will not be able to perform code injection.

Why don't they just increase the size of the ".text" section segment? Is it because of security reasons?

Binary modification is a complex subject and requires some understanding of the system's application binary interface (ABI), process layout in virtual memory, the runtime environment, and the compilation process. Background information will be discussed here in order to provide context for the answer to the question.

1. Code Injection vs. Static Binary Modification (Patching)

From the question:

  Code injection into binary is the process of injecting some malicious code into a legitimate binary.

  A lot of code injection projects that I have seen will find a large \x00 into .text section in order to inject their shellcode. They then change the address of the entry point in order to point to the injected shellcode. The injected shell code will then point to the beginning of the original code after finishing.

Code injection usually refers to code included in input entered at program runtime, which differs from the process described above, in which a binary is statically modified prior to program execution in order to alter its runtime behavior.

From MITRE's Common Weakness Enumeration (CWE) entry regarding code injection (emphasis mine):

  Description Summary

  The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  Extended Description

  When software allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the software. Such an alteration could lead to arbitrary code execution.

  Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.

One implication here is that code injection is a technique employed at program runtime in order to alter program behavior. A second implication is that code injection includes executable code in input whose origin is external to the binary itself, and code injection does not alter the structure of the binary.

Altering the structure of an executable binary prior to execution can be referred to as static binary instrumentation, but is more commonly referred to as patching.

From PEBIL: Efficient Static Binary Instrumentation for Linux (emphasis mine):

  There are two main approaches to binary instrumentation: static and dynamic. Static binary instrumentation inserts additional code and data into an executable and generates a persistent modified executable whereas the dynamic instrumentation inserts additional code and data during execution without making any permanent modifications to the executable.

The distinction between runtime process modification and static modification is important, because their technical implications are quite different.

2. Sections, Segments, Linking and Relocation

From the question:

  Sometimes, there is not enough available \x00 bytes into the .text section in order to perform this action. So, the project will not be able to perform that injection.

  Why don't they just increase the size of the ".text" section segment?

There is an important distinction between sections and segments in ELF binaries:

  Sections hold the bulk of object file information for the linking
  view: instructions, data, symbol table, relocation information, and so on1

Sections and their associated information are used by ld to perform relocation and symbol resolution.

segments and their associated information are used by the program loader in the kernel to map portions of the binary file on disk into virtual memory at the correct offsets

Here is a diagram from the System V ABI contrasting sections with segments:

  Object files participate in program linking (building a program) and program execution (running a program). For convenience and efficiency, the object file format provides parallel views of a file’s contents, reflecting the differing needs of these activities.1

Why does this matter? The address ranges of the a program's sections, including the .text section, as well as the address range of the .text segment, are both determined by the linker which is invoked on the object file at after preprocessing, compilation and assembly. From Advanced C and C++ Compiling page 26:

  •  The ultimate intention behind the idea of building the program is that the sections obtained by compiling individual source files be combined (tiled) together into the single binary executable file. Such binary file would contain the sections of the same type (.text, .data, .bss, . . . ) obtained
  by tiling together the sections from the individual files. Figuratively speaking, an object file can be viewed as a simple tile waiting to find its place in the giant mosaic of the process
  memory map.

  •  The inner structure of the object file does not, however, suggest where the individual sections will ultimately reside in the program memory map. For that reason, the address ranges of each section in each of the object files is tentatively set to start from a zero value.

  The actual address range at which a section from an object file will ultimately reside in the program map will be determined in the subsequent stages (linking) of program building process.

  •   In the process of tiling object files’ sections into the resultant program memory map, the only truly important parameter is the length of its sections, or to say it more precisely, its address range.

Page 27:

It should also be noted that an executable ELF binary's text segment consists of multiple sections in addition to linked .text sections:

sections:

$ readelf -SW /bin/ls
There are 29 section headers, starting at offset 0x1e738:

Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            0000000000000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        0000000000400238 000238 00001c 00   A  0   0  1
  [ 2] .note.ABI-tag     NOTE            0000000000400254 000254 000020 00   A  0   0  4
  [ 3] .note.gnu.build-id NOTE            0000000000400274 000274 000024 00   A  0   0  4
  [ 4] .gnu.hash         GNU_HASH        0000000000400298 000298 0000c0 00   A  5   0  8
  [ 5] .dynsym           DYNSYM          0000000000400358 000358 000cd8 18   A  6   1  8
  [ 6] .dynstr           STRTAB          0000000000401030 001030 0005dc 00   A  0   0  1
  [ 7] .gnu.version      VERSYM          000000000040160c 00160c 000112 02   A  5   0  2
  [ 8] .gnu.version_r    VERNEED         0000000000401720 001720 000070 00   A  6   1  8
  [ 9] .rela.dyn         RELA            0000000000401790 001790 0000a8 18   A  5   0  8
  [10] .rela.plt         RELA            0000000000401838 001838 000a80 18  AI  5  24  8
  [11] .init             PROGBITS        00000000004022b8 0022b8 00001a 00  AX  0   0  4
  [12] .plt              PROGBITS        00000000004022e0 0022e0 000710 10  AX  0   0 16
  [13] .plt.got          PROGBITS        00000000004029f0 0029f0 000008 00  AX  0   0  8
  [14] .text             PROGBITS        0000000000402a00 002a00 011289 00  AX  0   0 16
  [15] .fini             PROGBITS        0000000000413c8c 013c8c 000009 00  AX  0   0  4
  [16] .rodata           PROGBITS        0000000000413ca0 013ca0 0069b4 00   A  0   0 32
  [17] .eh_frame_hdr     PROGBITS        000000000041a654 01a654 00080c 00   A  0   0  4
  [18] .eh_frame         PROGBITS        000000000041ae60 01ae60 002c84 00   A  0   0  8
  [19] .init_array       INIT_ARRAY      000000000061de00 01de00 000008 00  WA  0   0  8
  [20] .fini_array       FINI_ARRAY      000000000061de08 01de08 000008 00  WA  0   0  8
  [21] .jcr              PROGBITS        000000000061de10 01de10 000008 00  WA  0   0  8
  [22] .dynamic          DYNAMIC         000000000061de18 01de18 0001e0 10  WA  6   0  8
  [23] .got              PROGBITS        000000000061dff8 01dff8 000008 08  WA  0   0  8
  [24] .got.plt          PROGBITS        000000000061e000 01e000 000398 08  WA  0   0  8
  [25] .data             PROGBITS        000000000061e3a0 01e3a0 000260 00  WA  0   0 32
  [26] .bss              NOBITS          000000000061e600 01e600 000d68 00  WA  0   0 32
  [27] .gnu_debuglink    PROGBITS        0000000000000000 01e600 000034 00      0   0  1
  [28] .shstrtab         STRTAB          0000000000000000 01e634 000102 00      0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), l (large)
  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

segments and section-to-segment mappings:

$ readelf -l /bin/ls

Elf file type is EXEC (Executable file)
Entry point 0x4049a0
There are 9 program headers, starting at offset 64

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  PHDR           0x0000000000000040 0x0000000000400040 0x0000000000400040
                 0x00000000000001f8 0x00000000000001f8  R E    8
  INTERP         0x0000000000000238 0x0000000000400238 0x0000000000400238
                 0x000000000000001c 0x000000000000001c  R      1
      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
  LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000
                 0x000000000001dae4 0x000000000001dae4  R E    200000
  LOAD           0x000000000001de00 0x000000000061de00 0x000000000061de00
                 0x0000000000000800 0x0000000000001568  RW     200000
  DYNAMIC        0x000000000001de18 0x000000000061de18 0x000000000061de18
                 0x00000000000001e0 0x00000000000001e0  RW     8
  NOTE           0x0000000000000254 0x0000000000400254 0x0000000000400254
                 0x0000000000000044 0x0000000000000044  R      4
  GNU_EH_FRAME   0x000000000001a654 0x000000000041a654 0x000000000041a654
                 0x000000000000080c 0x000000000000080c  R      4
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     10
  GNU_RELRO      0x000000000001de00 0x000000000061de00 0x000000000061de00
                 0x0000000000000200 0x0000000000000200  R      1

 Section to Segment mapping:
  Segment Sections...
   00
   01     .interp
   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame
   03     .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss
   04     .dynamic
   05     .note.ABI-tag .note.gnu.build-id
   06     .eh_frame_hdr
   07
   08     .init_array .fini_array .jcr .dynamic .got

The third segment (segment 02) is of type LOAD, has execute permissions, and corresponds to the process text segment in virtual memory. Here, this segment consists not only of the .text section but also several others, some of which consist of data rather than instructions, such as the .rodata section.

In light of the information of sections and segments shown above, it is important to note the at linker controls the following:

section definitions

  The most frequently used statement in the SECTIONS command is the section definition, which specifies the properties of an output section: its location, alignment, contents, fill pattern, and target memory region. Most of these specifications are optional

section attributes
section placement

  In a section definition, you can specify the contents of an output section by listing particular input files, by listing particular input-file sections, or by a combination of the two. You can also place arbitrary data in the section, and define symbols relative to the beginning of the section.

memory layout

  The linker's default configuration permits allocation of all available memory. You can override this configuration by using the MEMORY command. The MEMORY command describes the location and size of blocks of memory in the target. By using it carefully, you can describe which memory regions may be used by the linker, and which memory regions it must avoid. The linker does not shuffle sections to fit into the available regions, but does move the requested sections into the correct regions and issue errors when the regions become too full. A command file may contain at most one use of the MEMORY command; however, you can define as many blocks of memory within it as you wish.

Looking at a sample output from a link map shows in a concrete manner that it is the linker that controls program memory layout through the assignment of memory addresses to sections and symbols:

.plt.got
 *(.plt.got)

.text           0x0000000008048074        0xa
 *(.text.unlikely .text.*_unlikely .text.unlikely.*)
 *(.text.exit .text.exit.*)
 *(.text.startup .text.startup.*)
 *(.text.hot .text.hot.*)
 *(.text .stub .text.* .gnu.linkonce.t.*)
 .text          0x0000000008048074        0xa test.o
                0x0000000008048074                main
 *(.gnu.warning)

.fini
 *(SORT(.fini))
                [!provide]                        PROVIDE (__etext, .)
                [!provide]                        PROVIDE (_etext, .)
                [!provide]                        PROVIDE (etext, .)
.rodata
 *(.rodata .rodata.* .gnu.linkonce.r.*)

.rodata1
 *(.rodata1)

.eh_frame_hdr
 *(.eh_frame_hdr)
 *(.eh_frame_entry .eh_frame_entry.*)

.eh_frame       0x0000000008048080       0x38
 *(.eh_frame)
 .eh_frame      0x0000000008048080       0x38 test.o
 *(.eh_frame.*)

3. Direct Answer to Question

  Why don't they just increase the size of the ".text" section segment? Is it because of security reasons?

The address range of the .text section and the layout of the text segment in memory are determined by the linker at binary build time. In order for any changes to these to be made, access to the source code of the binary is required, since the binary would have to be rebuilt (compiled -> assembled -> linked) with a new memory layout, which is controlled by the linker.

Patching is performed if rebuilding the binary (which implies access to the source code) cannot be done.

1. SYSTEM V APPLICATION BINARY INTERFACE Edition 4.1


Why doesn't my LoadLibraryA (LLA) hook prevent a dll injection that uses CreateRemoteThread + LLA? According to this answer, DLL injection through CreateRemoteThread in conjunction with LoadLibraryA can be prevented by hooking LoadLibraryA. I went through the effort of doing an actual implementation of both the attacking side and defending side. I used this article as a baseline for creating both applications.

The defending side succesfully hooks LoadLibraryA and replaces it with a dummy function. The dummy function gets called whenever the defending process calls LoadLibraryA.

But why is it that the attacking process is still able to call the original LoadLibraryA after creating a remote thread in the defending process?

It's almost as if it does not access it through the IAT. Wouldn't it otherwise get forwarded to the dummy function?

It sounds like you might have already figured out what's going on (I'd have to look at the code in question, ideally running in a debugger, to say for sure though). However, I want to point out that this just doesn't actually work at all. At best, it's a speedbump that will break fragile payloads, but a knowledgeable attacker can bypass it easily. Here's a few ways, in roughly increasing complexity:

Use a different function, like LoadLibraryW or LoadLibraryExA (unless that internally calls LLA at some point, but I doubt it).
Use WriteProcessMemory (WPM) and VirtualProtectEx (VPX) to un-hook LLA, using the attacker's version of the function as the template.
Use WPM VirtualAllocEx to write the binary code of LLA into the target process, and inject your thread at that entry point.
Just dump the payload of whatever DLL you wanted to inject into the target's address space and enter that.
Do everything that LLA does (including stuff like ensuring new threads call the library's DllMain), but remotely to the target process, before even spawning a thread in it.

In other words, even if your hook prevent calling CreateRemoteThread to the address of LLA, it doesn't actually do anything significant against DLL injection in general.


Parse logs from router to database I would like to parse log files from Cisco WRVS4400N router to a specific database for detecting a DoS Attack. Any idea please?

So first it would be good to consider what kind of database you'd like to use, and then secondly what kind of adapter you can use with it.

Regarding databases and log storage, the main factor is about storage - the storage model defines what it will be like, and these models you can categorize like this:

Unstructured text files (smallest size, fastest ingest)
Structured data (medium size, medium fast ingest)
Structured data with indexes (big size, slow ingest)
Structured data with indexes and full text search (very big size, slowest ingest)

So, based on that you can do the following:

Use BigData storage with Hadoop like processing. This is over-kill for the task.
SQL tables without indexes, MongoDB without indexes
SQL tables with indexes, MongoDB with indexes
SQL tables with index and with full text search, MongoDB with indexes and full text search, Elastic Search

SQL and MongoDB are both most user friendly due to availability of various GUIs and SDKs which are easy to use (as of 2016). There are also other engines like Cassandra, Splunk.

So now, from my experience, the best usability / scalability / easy to use is to use MongoDB table with primary index and eventually some optional when it's needed. This is because MongoDB with it's newest WiredTiger engine it compressed data so typical log entry from Apache takes approx 90 bytes of space on disk (with indexes). Compared to uncompressed SQL it is very good result, and secondly it allows you to define called collections (tables), which can be limited to e.g. 4GB which gives you 50M log entries. So then, after hitting 50M entries, it will be overwriting old ones.
Another advantage of MongoDB is that you can ingest JSON Document without need to define table structure, it just takes any JSON document.

Comparing e.g. other SQL engines, there's problem with removing old entries and sometimes the indexes has to be rebuilt (there's no way without at least primary index). This makes it lot more complex in a way that this data needs to be inserted into new table every day, so implementation of it is a lot harder.

Regarding Search Engines, the search functionality is really not needed. This is very good marketing but very little benefit for a lot of hassle when it comes to log parsing. In fact, searching is for manual operation and once you perform search of two it happens to be not needed any more, yet all data storage and ingest is designed for searching.

What is the best usage of such data is to e.g. run Nagios check (as good example), and storage the values in RRD table and generate graph with pnp4nagios. So each check run every 5 minutes checks last 5 minutes worth of logs and based on that take data point and ingest into Nagios.

For Elastic Search for example, there's front-end for viewing data but it's not reporting tool, for reporting on e.g. httpd logs you can use Sawmill instead.

Finally, you need adapter which can do one of the following:
   - Accept SNMP traps
   - Accept Syslog messages
   - Accept JSON formatted documents over HTTP/HTTPS (usually it is using keep alives)

There are few options to do it like using Syslog with Database plugin, so basically logs are passed to Syslog and Syslog is loading it to database. But then, you need to also construct SNMP trap or any kind of sink separately. There are few other commercial sinks for these tasks optimized for Splunk, there's something with Greylog2 as well.

However what seems to be easy to implement is Spring XD, so basically you can establish Syslog source and JDBC (SQL) / JSON/ MongoDB output. It is very easy to do and once running it should be OK. You do not need any extra code to have it up and running.
You can then use Syslog as source from servers and from router as well. You need to find out which Syslog format is good, and you can start many Syslog listeners with many Syslog formats. So this should work fine for router.

Now, as SQL for example would seem to be easy option, when there's more entries like HTTP etc, MongoDB performs better, and also if Syslog seems easy as well, it may not be good for large number of requests. Therefore for medium-size installations (like if you are not Facebook or any big website), MongoDB is good because it's easy with GUI, API, capped collections and small storage / RAM requirements.

Then it comes how do you ingest  HTTPD logfiles into MongoDB. For the integration sake it's good to use Adapter as well and some kind of universal one, for example HTTPS JSON -> MongoDB or SQL, and then make server on which HTTPD is running to tail the logs and ingest send it to the Adaptor as JSON documents so there's field name and field value. So when you change log format then it's no pain to change the database schema or even queries.

So this can be achieved with daemon which tails the httpd log and sends HTTPS / JSON documents to Adaptor. For example many people are comfortable with Perl but most recently with Python. This is not really difficult think to do. The Apache log format is stored in it's config, so from this you can work-out the log format and it's columns. Sometimes there's log field description in the header. The daemon is good option because it doesn;'t interfere with anything else, but making Apache writing to Syslog also works, however you need structured documents or SQL table data and not single line.

The above methods are highly reliable and scalable and you are not in any vendor lock-in. For example, Nagios is good monitoring tool and since it doesn't realy on any database itself it's very hard to break it while it's very easy to install / revert any changes as you can have them in Git. And it can do both rendering and alerting like email notifications. Plus, you have various Front-ends like Thruk which is nicely packaged for many distributions.

In overall, the above gives you the lowest cost, smallest infrastructure requirements and good flexibility. Going with any search engine is huge over-kill and it will not make it any easier even if the start looks easy. Being familiar with database APIs other than SQL is apparently needed, some bit of scripting and the Nagios. These are standards and this can scale to a lot of more devices. It's easy to make Nagios monitoring bandwidth and so on. It's not by default, Nagios plugins do miss big time plenty of things but it's easy to make it happen with a bit of SNMP experience.

Search engines are not good for being used by Nagios. They are useful for used by people. So if you want alerting it's better to use something else than Search Engines. It is just huge over-kill for the task and you might find yourself working on something which in the end has little benefit even if you have believed in it.

What you really need is:

Proper reporting like Sawmill, and Search Engines with their front-ends are nowhere close to it today
Proper alerting with Nagios (it's not as good or not at all with other alternatives)
Stable, mature database with scale-out options which works
RRD based drawings, the round-robin in MongoDB and RRD in Nagios is what it is all about
Proper front-end to Nagios like Thruk
Good database client like Mongo3T, SQLYog for MySQL etc
Good scripting language with good environment (definitely not tons of Regex).


Does using ASP.NET prevent XSS I was reading about XSS, and I know that ASP.NET doesn't allow saving HTML to database.

So my question is Does using ASP.NET make my web application secure regarding XSS completely, without additional work from me, since attacker can't submit any malicious code?

I know there are other ways malicious attackers can try, but I'm just asking about XSS right now.

SQL Server does not prevent XSS. XSS would still be possible via issues in the web application code. Proper use of prepared statements with SQL Server can prevent SQLi, but to prevent XSS, you must validate data received from untrusted sources and encode data before returning it in an HTTP response.


Protecting email addresses if their hashes are publicly avaliable I am working on a project, where user email address hashes will be available publicly, and I need to prevent them from being quickly discovered by spammers.

The main idea of the undertaking is to give anyone who already knows the email addresses an easy way to find users by them, but make it difficult to discover emails by simple enumeration of possible alternatives.

What I thought about is using BCrypt or PBKDF2 to create the hashes, and use salt to create hashes where the sum of the bytes in the first half equals the sum of the bytes in the second half.

Here's what the algorithm could look like:

    static byte[] GenerateMagicSignature(string text)
    {
        long id = 0;
        const int nParts = 2;
        while (true)
        {
            var key = BitConverter.GetBytes(id);

            for (long i = 0; i < id+1; i++)
            {
                var dd = new HMACSHA256(key);//replaced new encoding....
                key = dd.ComputeHash(key);
            }

            var b=new Rfc2898DeriveBytes(text,key,10000);

            var sig=b.GetBytes(32);
            id++;
            var pts = SplitIntoPartsAndSum(sig, nParts);

            int val = pts[0];

            bool wrong = false;
            for (int i = 1; i < pts.Length; i++)
            {
                if (val!=pts[i])
                {
                    wrong = true;
                    break;
                }
            }

            if (wrong)
            {
                continue;
            }

            return sig;
        }
    }

    static int[] SplitIntoPartsAndSum(byte[] data, int parts)
    {
        var sums=new List<int>();

        for (int i = 0; i < parts; i++)
        {
            int sum = 0;
            var start = i*data.Length/parts;
            var end = (i + 1)*data.Length/parts;
            if (i==parts-1)
            {
                end = data.Length;
            }
            for (int j = start; j < end; j++)
            {
                sum += data[j];
            }

            sums.Add(sum);
        }

        return sums.ToArray();
    }

The average hashing time for a known email address with these settings is around 1 minute on a single CPU. Which right now can be divided by 5000 cuda cores, if I understand this stuff correctly (or is the use of PBKDF2 going to significantly reduce that number?).

My question is: is doing this a good idea, or do I have to re-think the whole thing? My goal is not to make the email addresses fully protected, but make it more difficult for the attacker to get them than, say, by sending queries to facebook and checking if it knows those emails or not.

Email addresses are very often built off of easy to construct, common patterns with public data - first initial plus last name @ company, first name dot last name @ company, etc. etc. etc.

Further, many actual email addresses have been leaked, and several sets of attackers are going to have stolen or purchased large lists of email addresses to try as well.

Therefore, attackers have a much, much smaller keyspace than when attacking passwords.

I'll address PBKDF2 in specific; assuming your clients have powerful, modern 64-bit machines, they can still only use one core to hash one email address (their own); Hashcat probably has one of the most optimized sets of code available for CPU, and oclHashcat likewise for GPU.

Assuming a PBKDF2-HMAC-SHA-1 style setup (i.e. SHA-1 is the base hash), then you can expect a single serious modern 8-GPU box to crunch passwords 1500 to 2500 times faster than x64 code running on a fairly serious modern CPU; the advantage only grows if your users have out of date hardware, inexpensive hardware, low power hardware, or mobile devices.

Even at, say, 2000 times faster, the attacker averages 0.03 seconds to run a test on an email it took a client one minute to generate.

PBKDF2-HMAC-SHA-512 would reduce the attacker's advantage, but you're still in a losing game, since an attacker can spin up their GPU's and leave the machine to try email patterns for two and a half million seconds (30 days) easily, paying only an electric bill and the loss of that machine for other actions.

Alternately, spammers may simply dedicate spare CPU time, which they probably have plenty of, to validating their email lists against your email list.  It's even free if they're using other people's computers (i.e. a botnet)!


How does the Perspective addon work? I've just installed the Perspetive addon in firefox.

When I'm vistit, for example google, Perspective says the following message:

  Warning: Perspectives has NOT seen this certificate consistently.

What does that mean? Is my connection secure or what?

How can I make sure of that my SSL-encryption is secured and not faked?

I have compared the fingerprints from different sites, like google and facebook, and there are not the same. Is that Ok?

The Perspective addon does distributed certificate pinning. Certificate pinning means to associate a particular certificate to a particular host, so that any changes can be noted. This is mainly to help prevent man-in-the-middle (MITM) attacks.

For example, say that when you visit https://www.eff.org/ on Monday, the security certificate for that site was issued by Comodo, with an expiry date of 2017. Certificate pinning software would alert you if you visit the same site on Tuesday, but this time the certificate is from TeliaSonera.

Distributed certificate pinning means that various different devices around the world collaborate to compare the certificates that they have each seen, thus making it extremely difficult for a MITM attack to go undetected.

Perspectives is configured to have a threshold of "disagreement", and will show a warning if a certain number of notary servers disagree, are unresponsive, or can't be contacted.

From their Firefox Extension page:

  If your local network uses a proxy or firewall to access the Internet,
  it may prevent Perspectives from reaching notaries. As a result, all
  sites will fail verification

In this case, I've done a quick test. The default threshold is 75%, and there are 10 notaries in the default list. At the moment, 3 of those notaries don't seem to be responding. Therefore even if all 7 working notaries agree, you only have 7/10 = 70% agreement, which is below the threshold.

This means that by default, every HTTPS site will cause a "Perspectives has NOT seen this certificate consistently" warning. I tested with 7 HTTPS sites and got the warning for every single page.

So my take on this is:

Your connection is probably secure and not faked.
The error is probably transient caused by a combination of default
settings that err on the side of caution, and what may be temporary
issues with the default notaries.
The fingerprints from different sites should be different, as each
certificate has a different fingerprint.

I would suggest reducing the "Percentage of notaries that must agree" setting to 60%, which still gives good protection and does not cause this false alarm.


Is it safe to not update Windows if you dont accept any incoming connections? I see this guy shared his thought:
How to be safe even without most updated Windows updates

So he claims that as long as you do not accept any incoming connections and just use sandbox of Chrome, then it is safe to not update Windows. What do you think?

No, that's simply wrong.

Just like with a jail. They're not only built in a manner to keep anyone from escaping, but as well to prevent anyone from breaking in. You always have to think through both ways.

Just an example: windows had a vulnerability that allowed arbitrary code-execution injected in JPGs (I think the format was JPG, but I'm not sure. Doesn't matter here anyways). Now I've got a nice little drive-by download that directly infects your PC. Since you didn't apply any Windows-Updates you're still vulnerable and the PC is infected. Now you've blocked inbound connections. Luckily, I'm already inside your PC, so all I need to do is create a outbound connection. No need to break in to get stuff from your PC, if I can get myself inside in a normal way and then break out. I know this example includes quite a lot of uncertainties, but it should do to demonstrate the principle. Real-life attacks will quite likely be more complex, but should function the same way. In general home-PCs are usually bound to a dynamic IP. Most likely noone will attack this kind of PC from "the outside", but rather via malware, so just disallowing inbound connections might make your server more secure (and unuseable); for your home PC this doesn't apply.

The main-mistake already lies within this line:

  Don't worry, i know what i am doing. To be infected, you need to allow code to execute locally. If this code isn't allowed to execute, you can't be infected.

It's pretty much correct, that you have to allow execution of code locally to be infected. So far so well, but local code-execution happens every day. Just consider this site. It runs quite a bit of javascript code - inside your browser. This should - in theory - be safe; practically there are plenty of vulnerabilities that can be executed to produce rather ugly behavior. "I know what I'm doing" is already a misconception, since that's far beyond anyone's possibilities. And in general: updating windows is free, doesn't take that much time if scheduled properly. So why would you decline free security-improvement?

Last but not least:

  stuff everything into a sandbox and you're fine

In theory that's right. But I wouldn't say in theory, if there wasn't a twist. Sandboxes, just like any other piece of software, have bugs, weaknesses, etc.. For example JavaScript runs in a sandbox, just like the rest of the browser. Still one can do massive damage using JavaScript as a starting-point for malicious code execution. Why? Because the sandbox isn't perfect and has holes in it, that allow execution of arbitrary code, if used in the right way. Next point: going back to the JPG-example from above: there are ways to get out of the sandbox without even embedding any code to do so.

TL;DR

This ignores several factors:
The weakest link is always the human factor. "I know what I'm doing" is just wrong. That'll never happend to the point where you know enough make sure your PC is absolutely secure. Home-PCs usually aren't attacked from the outside, but rather by distributing malware that infects the PC, so blocking inbound connections is just a waste of time. Sandboxes, just like other security software, have weaknesses and bugs. They are a security-improvement, but nothing to solely rely on. In addition: why would you decline any free security? Windows updates are usually there for a reason.


Preventing users abusing emailing feature of web application Our web application offers users with the option to bulk email a bunch of interesting information to multiple email addresses at once. It's fairly easy to register an account with the service and thus it's pretty easy to start spamming people with email they never wanted to receive. You can't actually change the content of the email, but you can send it to any set of addresses.

My understanding is that if someone decides to troll the service and start spamming random people on the Internet from it, the company's domain might get banned from the major email providers out there and we're pretty much never getting ahold of legitimate users again through email.

Couple of questions:

Is the above the worst case scenario or are there are aspects I'm not taking in consideration?
What are some common and affordable (engineering-wise) prevention and mitigation practices that services use to deal with the above? I imagine that limiting the # of email that an account can send per day is one option. Also requiring that the account show some legitimate activity before it can send email is another valid approach. Anything else major I'm missing?

All other tips are greatly appreciated.

There are a few things you can try to help prevent malicious actors from abusing your service:

Require a CAPTCHA: This should help cut down on bots abusing your services.
Limit usage of this feature by IP address & time: Don't let a single IP send large amount of mail within a short period of time (keep in mind that you may have multiple users behind NAT though).
Consider limiting the "from" address to verified email adresses: You can have each user register and verify each email address he wants to appear in the from "field." Limit the number of email adresses a user can register for this purpose.

These steps are not foolproof though. An attacker with multiple IPs (a botnet for example), very good OCR software (or a human CAPTCHA breaking service), and disposable email addresses can still get around this.

It is also possible that even without a botnet, a single attacker with a list of honeypot email addresses may still be able to get you on some blacklists (I don't know the thresholds for the various blacklist services).

You should also be sure to have an optout (unsubscribe) link on all emails sent by this service, so people who don't want to get emails from your service can stop them from coming.


How does Google save authentication information in the browser? When I open Gmail in the browser, I automatically log in. I believe this is because of the previously saved cookies. If I remove cookies I need to sign in again. It means Google saves some auth keys in cookies which are never expired or in 2-3 years from now.

I heard that cookies can be copy-pasted. In this way, if someone has access to the cookies, they can access your account. So the server should keep the expiry time shorter (probably a day max).

Is my understanding about saving authentication info in cookies correct?
If no, then what approach do they use to save authentication info in the browser?
If yes, then how do they stop someone from copying the cookies or rather using the copied cookies?

Yes, you are correct that authentication tokens like session identifiers are often stored in cookies. Sometimes local storage is used instead of cookies, but that has basically the same security implications.

There are a few things that makes it more secure than it may sound at first:

At least some browsers on some systems encrypt the cookies. (This will not protect against an attacker that has access to your system in a logged in state, but it's something.)
Google probably implement  some kind of sanity check every time an authentication token is used, like checking some kind of browser fingerprint or the geolocation of the IP.
Finally, an attacker that has access to your computer so that she can read your cookies has pretty much won anyway. In such a situation, cookie theft is only one of many many problems you have.

In the end, picking an expiration time is a security versus usability trade off. It's a matter of opinion, but I don't find Googles choice unreasonable.


Where to store private and public keys? I'm new to backend and currently don't know best practices of storing sensitive data in safe.

I configured node.js server with JWT. I signed JWT with RSA key. Each time server receive request it verifies integrity of JWT.

For now I have 2 files private.key and public.key. The first file is used for signing JWT and the second one is used for verifing JWT.

So the question is.

Where should I store these keys (files)? Currently, I store them beside the project source files but do not push them to the remote source control system. Whenever I need content of the keys I just use readFileSync so it requires files to be present in the project.

Do I need to encrypt these files too? or...
Do I need to push these files to the remove service and use them via HTTP? or..
Is there any service where I can put my files and use some URL to get access to the files?

Public key: that's the easy part, it can be almost anywhere (known URL, some type of file store like S3/GCS/..., even source control). The only concern is to make sure it is not modified, but it can be read by anyone.

Private key: this is where it gets tricky.
The private key should be as safe as possible with access as limited as possible.
If someone reads your private key, they can pretend to be your service. You are correct that it must not be in source control.

You'll want to make sure the private key is always encrypted. The issue now becomes how to give your service the passphrase to decode the key. The encrypted file itself can be in a cloud storage system (S3, GCS, etc..). Some access controls on the encrypted file is still a good idea.

Some ways to access the passphrase (definitely not exhaustive). Each has pros and cons. Which to use depends a lot on your environment and balancing automation vs security.

environment variable: many deployment systems allow you to specify environment variables in a way that is not easily read by anyone but administrators of the system. This might not be safe depending on the production environment and who has access to the VM/orchestration system.
manage your own: use your own infrastructure to distribute secrets. Things like keywhiz and Vault can be very powerful, but these are not simple systems to deploy and manage.
cloud KMS: make use of the cloud-specific Key Management System (eg: Google/AWS KMS, Azure Vault, etc...). They usually cannot store a file, but they can store a key with which to encrypt a file. The permissions on key usage should be very restricted, this can usually be done per role account and assigned only to your service.
human interaction required: require that someone manually login to the system and decrypt the private key for use by the backend. The obvious downside is that there is no automation there, if your VM goes down it cannot be automatically restarted.


SSL/TLS and PKCS#1-1.5 Encoding - Why? I read about SSL (version 3.0) and that the PreMasterSecret (pms) is encoded with PKCS#1-1.5 before the client encrypts it with the given public RSA key and sends the encryption to the server.

So the pms looks like this:

[2 byte SSL version number || 46 random bytes]

Therefore the PKCS encoded pms looks like this:

0x00 0x02 [random bytes, not containing 0x00] 0x00 [pms]

The length of the encoded pms must equal the RSA modulus in bytes.

Questions

So why is the PKCS encoding needed? Just to bring in more randomness before encrypting the pms?
Why must the length of the encoded pms equal the length of the RSA modulus in bytes?
Also, the PKCS encoding seems to be the reason why the Bleichenbacher attack was possible. So what advantage can be found in using PKCS?

I also found this question but it's just about the PKCS encoding without the RSA encryption.

I think I found the reasons why PKCS is used with RSA in SSL!

First of all, it's important to know that (Textbook-)RSA encryption is deterministic, that means a message m encrypts under the usage of the same public key e every time to the same cipher text c because c = m^e mod N.

Especially short messages can easily be calculated by an attacker because if m^e is smaller than modulus N, one just needs to calculate the eth root of c (because the modulus operation was never applied to m^e). m itself must be smaller than N, so: m < N and m^e > N

  So why is the PKCS encoding needed? Just to bring in more randomness before encrypting the pms?

As stated above: (Textbook-)RSA is a deterministic encryption without randomization, so the attacker could just try a lot of different pms values until one of them results in the same cipher text as send by the victim.

So even if the pms is already a random value, the PKCS encoding adds more randomness which makes it harder for attackers to guess the pms by testing multiple different values.

  Why must the length of the encoded pms equal the length of the RSA modulus in bytes?

The longer the plain text the more values one must test for a successful brute force attack. But as stated above the length of a message m must be smaller than the modulus N but m^e must be bigger than N.

So the PKCS encoding increases the length of the pms to its maximum (same byte length as the modulus N) but it's still smaller than N because the PKCS encoding starts with 0x00. But because of its maximum length it is made sure that m^e is bigger than N.

  Also, the PKCS encoding seems to be the reason why the Bleichenbacher attack was possible. So what advantage can be found in using PKCS?

The Bleichenbacher attack was possible because the server's error messages helped the attackers to narrow down the possible values for the pms until only one value was left.

Deactivating those error messages solved the problem.

In PKCS#1-2.0 the Bleichenbacher attack was fixed.


Understand aes cbc IV When I use AES CBC, the encrypt function needs to get an input-buffer to encrypt + key + IV?

Is IV like one more key, or IV is generated by the key (so the encrypt function only needs to get the input-buffer to encrypt and the key)?

An IV is used to make sure that the same input (plain text) results in a different output (cipher text) even if the same encryption key is used - which can be guaranteed if a different IV is used all the time. The IV does not really be kept secret and insofar it is not comparable with the encryption key. But it should be as unpredictable as possible which means it should have uniform randomness (no IV is more probable than any other).


Perform CSRF attack when CSRF token is sent in custom request header? I have found that the web application uses a weak algorithm to generate CSRF token. The CSRF token is sent in a request header:

X-CSRF-TOKEN: "token-string"

Since the request header is being used, how to do a CSRF attack to perform a sensitive action in real time?

Custom headers can be sent using JS but it's blocked due to CORS. I have seen a few threads which mention ActionScript in Flash which can be used to send custom headers. Does that still work, considering Chrome has stopped using Flash? Is there anyway I can perform the attack?

The custom HTTP header works as a defense in and of itself. Actually, one rudimentary form of CSRF protection is to simply set a custom header to a constant non secret value and then check for it server side. This protection is sometimes applied unknowingly by simply requireing certain content-type headers.
OWASP describes this technique:

Adding CSRF tokens, a double submit cookie and value, encrypted token, or other defense that involves changing the UI can frequently be complex or otherwise problematic. An alternate defense that is particularly well suited for AJAX/XHR endpoints is the use of a custom request header. This defense relies on the same-origin policy (SOP) restriction that only JavaScript can be used to add a custom header, and only within its origin. By default, browsers do not allow JavaScript to make cross origin requests.
A particularly attractive custom header and value to use is "X-Requested-With: XMLHttpRequest" because most JavaScript libraries already add this header to requests they generate by default.

The limitation to this is, as you say yourself, Flash vulnerabilities:

[B]ypasses of this defense using Flash were documented as early as 2008 and again as recently as 2015 by Mathias Karlsson to exploit a CSRF flaw in Vimeo. Riyaz Walikar from Appsecco Labs was able to exploit this even in early 2019 using older versions of Firefox and also in some recent versions of Chrome (with a bit of user involvement). Since we cannot the control the versions of browser end user uses nor depend on it for their security, this technique is not recommended as a primary defense in measure.

The last sentence is key here. If the victim uses a vulnerable combination of browser and Flash plugin, you can exploit this. If not, you are probably out of luck (unless a permissive CORS policy lets you set the header).


Check reputation of specific email address I know that it's possible to check the reputation of email address domains, but what does the security community use to find information on the reputation of specific email addresseses?

List of ways to verify domain or IP reputation:

mailfloss https://mailfloss.com
Xverify https://www.xverify.com/
zero bounce https://www.zerobounce.net/
Hubuco https://www.hubuco.com/email-ver...
email list validation https://www.emaillistvalidation....
QuickEmailVerification https://quickemailverification.com/
email list verify https://www.emaillistverify.com/
mxtoolbox https://mxtoolbox.com/blacklists...
MailTester http://mailtester.com/
Pepipost https://pepipost.com/?utm_campai...
MailboxValidator https://www.mailboxvalidator.com/
CaptainVerify https://captainverify.com/

Is there a site similar to www.abuseipdb.com for email addresses? I want to be able to check what other folks around the globe have noted about activity from specific email addresses, not their domains.

But what if I want to find the reputation of a specific gmail.com email address?

What does the security community use to find information on the reputation of specific email addresseses?

Nothing. This isn't a subject of interest.

Email addresses generally fall into two categories:

Major webmail providers. Abusive activity from these addresses is best handled by forwarding the emails to the provider's abuse address, not by adding the address to a blacklist. They tend to respond quickly.
Private mail providers. If the provider does not follow up on an abuse report, or refuses to take action, the most appropriate response is typically to blacklist the domain, not the address. If the provider is malicious in their own right, they can create a practically infinite number of addresses under a domain they control; there's no point in trying to block individual addresses.


Encrypted view state vulnerable? While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states:

  An attacker who successfully exploited this vulnerability could read
  data, such as the view state, which was encrypted by the server.

I had always heard that encrypted view state was secure.  Does anyone have any details on how this exploit works?  I did some googling but didn't find any details.

This is the infamous Padding Oracle vulnerability, this is the original paper describing the vulnerability in detail.

View State related exploitation would strongly depend on the actual application logic. If the state information is properly encrypted and integrity checked the application (developer) can safely presume that the included data is trustworthy (e.g. input validation was already performed or the data originates from the server not the client). Without proper defense-in-depth measures in place this can cause a situation similar to a TOC-TOU conflict resulting in a security vulnerability.

Example: PadBuster exploits the fact that the WebResource/ScriptResource handlers presume that their parameter could only properly be set by the server and didn't check for path traversal.


CSRF Token in GET request According to the OWASP testing guide a CSRF token should not be contained within a GET request as the token itself might be logged in various places such as logs or because of the risk of shoulder surfing.

I was wondering if you only allow the CSRF token to be used once, (so after one request it's invalidated) would this still be insecure? Considering that by the time someone logs the token, it will already be invalidated and unusable should the attacker want to perform CSRF.

If you're generating the tokens in a secure random fashion, then an attacker cannot infer the next token from the previous ones. So there shouldn't be any realistic risk.

Another important point here is to use SSL. Any proxies/reverse proxies between the user and the server cannot even see the GET parameters to log them. The only places where the token is logged is on the two ends of the SSL connection.

Logging on the user's end (History, for example) happens after the link is clicked. Logging on the server's end carries no risk (if you don't trust the place where the SSL traffic is decrypted, then there are bigger problems).


Virus detection with Process Explorer Can Process Explorer ( Windows apparently) detect a virus? Is it even possible?

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for Windows!"

That being said, it is not a virus detection tool. It does, however, give a knowledgeable admin or analyst the information they need to understand what is running on a system. Using this information one can start looking into specific processes to determine whether or not they should be running, and if an application is doing something it is not supposed to be doing. In this manner it is possible to find viruses and other malware running but it is not a virus detection in and of itself.

One should always keep in mind, however, that a good rootkit can still fool these types of detections. If the virus has access to the Windows kernel, then it can forge all of the information that is presented to Process Explorer. In doing so you will only see what the virus wants you to see.


Performance issues while applying encryption at host or guest level? One of the security expert here suggested me to apply encryption at guest(virtual machine) level rather than applying at host level with good reason. Before applying that I want to know what can be the possible performance issues in both cases. Will performance be worst in guest level encryption or vice versa? I want to have some theoretical knowledge before implementing it.
Many thanks in advance.

While I haven't got any data to support, a big problem with Virtualization is that the I/O performance tends to drop dramatically. Now encryption can have a small impact on cpu usage, but definitely the I/O might get hit. So make sure you have fast enough storage to cope with this overhead (you don't want to be using 7.2k rpm sata drives but 10-15k SAS drives or even SSDs).


Is there a "generally accepted" balance between privacy and convenience when protecting user data? I am building a system that's going to host medical records for the users.

The system needs to be secure, so that only the users with correct auth can access their data (data will be encrypted, so not even the devs can access user data).

But at the same time, it needs to be convenient, so that a user can "Forget his password", and certified doctors can access the user's data in emergency cases, without the user's consent.

I know that it's not logically possible to achieve 100% convenience and privacy at the same time, but is there an acceptable balance that i can consider "OK" that will satisfy the user ?

Yes, there are usually laws/regulations about storing medical record data. In the US it is the Health Insurance Portability and Accountability Act (HIPAA), you should definitely know about your obligations under whatever regulations apply before offering such a product.
In other medical record systems it is common to allow doctors in emergency medicine to access any record at any time, but with an audit trail specifically for emergency access. They basically have to provide justification afterward. Sort of a "break glass in case of emergency" thing. These record systems have verified the identity of the doctors previously though, so this might not work for your app if the doctors are unknown.
Trying to say that the data is encrypted with a user password, so users don't need to really trust you, is not valid. It would always be possible for your app to skim someone's password or data in an update. Ultimately they need to trust your company completely to handle this data, end of story. Being trustworthy means having an entire security infrastructure in place, including but not limited to, encryption at rest. It means physical security, good IT practices, auditing of code, background checks... probably a lot more.


Antivirus for Thesis I just want to ask if you know any book or technical papers and theses regarding computer viruses and anti-viruses. 'cause we're having a hard time looking for updated books regarding anti-viruses/viruses. Right now, we're just basing our documentation on the book of Mark Ludwig, The Giant Black Book of Computer Viruses and other books that are pretty out-of-date already.

First hand advices from your experiences in the industry are also welcome.

It will be very helpful for our thesis which is an anti-virus as well. Thanks! :)

"The Art of Computer Virus Research and Defense" by Peter Szor is interesting, and also references a lot of other materials.


Secure sync of TrueCrypt containers Need to sync arbitrary files within two TrueCrypt containers; one container is a backup, the other the one actively used by me, both are local during the transaction.

Current concern security wise is that there would be "data leaks" that would result from the sync tool being used; for example, the sync tool producing indexes that when be stored unencrypted on disk.

Any suggestions, or insights into the possible attack vectors that might result from using a sync tool as described?

UPDATE: I've removed the reference to "on Windows", since while the answers, and question they addressed deal with Windows, these answers (putting aside the sync tools used) apply to Windows, Linux, OSX, etc -- and I would not want the person reading the title of the question to believe the question only applies to Windows, since it does not, and given the importance of securely executing backups of encrypted data, I thought it best to make the question as accessible as possible.

Current concern security wise is that there would be "data leaks" that would result from the sync tool being used; for example, the sync tool producing indexes that when be stored unencrypted on disk.

You are correct to believe there is a risk of data leaking as a result of indexes. How much of a risk that is depends on what exactly is indexed.

A while ago, I lead a project to build something a little like dropbox. To compare directories across runs, we used the path name, a sha256 hash of the contents if not already computed, various timestamp information etc.

Clearly, if a sync tool were to store this information about files stored in an encrypted container, the attacker would also have access to them. The exact risk of that really depends on your given scenario.

I suspect, however, there are bigger risks in play than you think. Let's assume, for example, that on opening a file, your innocent piece of software creates a copy so as to not corrupt the individual - however, you've mounted the file system read-only, so it handily creates a copy of the file in your temp folder. Great, except - it just copied your data from an encrypted partition to an unencrypted one, thereby leaking it.

The same could be true of sync tools. This would be a fairly bad way to build one - but it is conceivable the tool could copy files to a temporary location in progress. Again, you have a leak problem.

To be a bit more realistic - let's assume the sync tool copies the files in memory by mmaping them and copying between them. What if you experience a system crash during this update and your app happens to be core dumped? Heck, what happens if the truecrypt drivers' memory is core dumped too? It might well contain unencrypted file data.

The fact of the matter is you're unlikely to be able to deduce the contents of entire files from any of these scenarios - but like getting damp in your house, something will leak, somewhere. The only way to be totally sure you have everything wrapped up is to do the obvious: encrypt the whole lot. Swap, disk, everything.

So to answer the question you asked: an attacker can clean whatever the sync tool stores. Have a look. Grab Process Monitor, see where it is storing data and then look at what's in it. That'll tell you exactly what data is being leaked.

To answer the question you didn't ask: there's no way to be absolutely certain you are not going to leak something using a truecrypt container on an unencrypted system.


Spoofing domain registration date info Is it possible to spoof or change backwards Domain Registration Date that can be looked up in online whois tools and databases?

Your question lacks a lot of details, but in short if you read it correctly the domain expiration date is managed by a registry, for the given TLD, and to make it deliver a spoof element of data means someone found a way to crack it and alter some data in store or in transit, in some way.

While nothing is 100% impossible nowadays, the above seems not the most probable cause as there is many others ones. For example, many people are not aware where to go to retrieve authoritative data, and will use any thirs party website to do a whois query, which could return any kind of garbage as it would not be authoritative in any way.

There is only one authoritative and relevant database for this data, it is the registry one. It is certainly online in some way but can not be queried directly by the public (registrars do have a more close access to it through registration protocol such as EPP). It can be queried using the whois protocol, with a whois client, when you query directly the registry whois server. There is quite always a web version of it, but, again, you need to visit the registry whois website, not any third party.


Protecting the root ca bundle Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates.

How can I protect those files from malicious agents trying to modify them? I think signing is not an option because they could also replace the public key used for verification.

Is access control the only protection against fraudulent certificate injection in Firefox and similar applications, or is there some other mechanism in place?

root or Administrator access is usually required to modify the CA bundles. If an attacker has gained that level of access, it's game over. Defending against such a scenario is almost impossible as there are many other things the attacker can do.

Now, for the very specific case of SuperFish, browsers (and other applications) can push updates to reject that particular certificate, but that's only because SuperFish incompetently reuses the same certificate across all devices. A more sophisticated attack is much harder to defend against.