The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

    Mastodon

  • Twitter Updates

  • My Flickr Stream

    20140508-Delphi-2007--Project-Options--Cannot-Edit-Application-Title-HelpFile-Icon-Theming20140430-Fiddler-Filter-Actions-Button-Run-Filterset-now20140424-VMware-Fusion-6.0.3.-no-reclaimable
    More Photos

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,854 other subscribers

Archive for the ‘Security’ Category

« Previous Entries
Next Entries »

5 days before the Let’s Encrypt’s Root Certificate is expiring!

Posted by jpluimers on 2021/09/24

Only 5 days left to take a close look at both your web-clients (including back-end clients!) and servers to prevent potential Let’s Encrypt mayhem.

Last week, [Wayback] Scott Helme published about [Wayback/Archive.is] Let’s Encrypt’s Root Certificate is expiring!

Let’s Encrypt has done loads of work over the past lustrum to prevent trouble like cross-signing, issuing the successor certificates, and more.

The problem is that people like you and me have refrained from keeping their clients and servers up-to-date, so some security issues will occur. Hopefully they are limited to non-functioning communication and not leaking of data.

It is about this DST Root CA X3 certificate, used by the vast majority of Let’s Encrypt certificates, [Wayback/Archive.is] Certificate Checker: CN=DST Root CA X3, O=Digital Signature Trust Co.:

DST Root CA X3
Certificate Trusted anchor certificate
Subject DN CN=DST Root CA X3, O=Digital Signature Trust Co.
Issuer DN CN=DST Root CA X3, O=Digital Signature Trust Co.
Serial Number 44AFB080D6A327BA893039862EF8406B
Valid  to  Key RSAPublicKey (2048 bit)
SHA1 Hash DAC9024F54D8F6DF94935FB1732638CA6AD77C13 MD5 Hash 410352DC0FF7501B16F0028EBA6F45C5
SKI C4A7B1A47B2C71FADBE14B9075FFC41560858910 AKI

Quoting Scott, these clients likely will fail, so need attention:

  • OpenSSL <= 1.0.2
  • Windows < XP SP3
  • macOS < 10.12.1
  • iOS < 10 (iPhone 5 is the lowest model that can get to iOS 10)
  • Android < 7.1.1 (but >= 2.3.6 will work if served ISRG Root X1 cross-sign)
  • Mozilla Firefox < 50
  • Ubuntu < 16.04
  • Debian < 8
  • Java 8 < 8u141
  • Java 7 < 7u151
  • NSS < 3.26
  • Amazon FireOS (Silk Browser)

On the server side, you can help Android devices by using a Let’s Encrypt certificate that is cross-signed with the ISRG Root X1 certificate [Wayback/Archive.is] Certificate Checker: CN=ISRG Root X1, O=Internet Security Research Group, C=US:

ISRG Root X1
Certificate
Subject DN CN=ISRG Root X1, O=Internet Security Research Group, C=US
Issuer DN CN=DST Root CA X3, O=Digital Signature Trust Co.
Serial Number 4001772137D4E942B8EE76AA3C640AB7
Valid  to  Key RSAPublicKey (4096 bit)
SHA1 Hash 933C6DDEE95C9C41A40F9F50493D82BE03AD87BF MD5 Hash C1E1FF07F9F688498274D1A18053EABF
SKI 79B459E67BB6E5E40173800888C81A58F6E99B6E AKI C4A7B1A47B2C71FADBE14B9075FFC41560858910

Via [Archive.is] Scott Helme on Twitter: “There are only 10 days left until the Let’s Encrypt root certificate expires and there are still questions over what the impact will be! Full details here: …” which links to the above article showing a nice graph of the current Let’s Encrtypt root certificate setup:

–jeroen

Posted in Communications Development, Development, Encryption, https, HTTPS/TLS security, Internet protocol suite, Let's Encrypt (letsencrypt/certbot), Power User, Security, Software Development, TCP, TLS, Web Development | Leave a Comment »

Laat Je Niet Hack Maken: een goed wachtwoord kiezen of maken

Posted by jpluimers on 2021/09/13

[WayBack] Laat Je Niet Hack Maken: een goed wachtwoord

Laat Je Niet Hack Maken legt op een begrijpelijke manier uit hoe je jezelf beschermt tegen hackers.

–jeroen

via:

https://twitter.com/danielverlaan/status/1174262886472048640

Posted in LifeHacker, Power User, Security | Leave a Comment »

Hardening your network from locally logged on users

Posted by jpluimers on 2021/09/10

SwiftOnSecurity is a great account to follow.

One tweet was the base of my post [WayBack] On Windows, having an empty password can improve security.

Another tweet the base of this one.

Doug is great!

Swift has some great github resources too:

–jeroen

Posted in Power User, Security, Windows | Leave a Comment »

For my link archive: DNS over https

Posted by jpluimers on 2021/09/02

DNS over HTTPS

For my link archive:

JSON DNS output

Some DNS over HTTSP providers support dns-json, which Cloudflare delivers non-pretty printed.

Read the rest of this entry »

Posted in Cloud, Cloudflare, Communications Development, Development, DNS, Encryption, HTTP, https, HTTPS/TLS security, Infrastructure, Internet, Internet protocol suite, Power User, Security, Software Development, TCP, TLS | Leave a Comment »

Ryan O’Horo on Twitter : “Computerphile with a clear and complete explanation of how the block cipher AES works and how it’s different from older ciphers. Background info… “

Posted by jpluimers on 2021/09/01

From a while back, but still relevant: [WayBack] Ryan O’Horo sur Twitter : “Computerphile with a clear and complete explanation of how the block cipher AES works and how it’s different from older ciphers. Background https://t.co/WyvYpM5JJN SP Networks https://t.co/MGILCxkqUR AES Cipher https://t.co/ReHpnCBTvI… https://t.co/VbZomPrOow”

Videos below the fold

–jeroen

Read the rest of this entry »

Posted in Development, Encryption, Hashing, Power User, Security, Software Development | Leave a Comment »

Some links related to Apple’s NeuralHash algorithm, as it was reverse engineered and collisions can be generated so abuse with pictures matching sensitive hashes can be performed

Posted by jpluimers on 2021/08/24

Last week, I wrote [Archive.is] Jeroen Wiert Pluimers on Twitter: “Apple’s NeuralHash algorithm for automagically reporting sensitive images from iOS devices has not only been reverse engineered, but also collisions can now be generated. Now just wait for abuse of innocent pictures matching sensitive hashes. … “

Below, for my link archive, some relevant links on this:

–jeroen

Posted in AI and ML; Artificial Intelligence & Machine Learning, Development, Hashing, Power User, Security, Software Development | Leave a Comment »

On Windows, having an empty password can improve security

Posted by jpluimers on 2021/08/11

From an interesting twitter thread started by SwitftOnSecurity:

Interesting thought that I need to let sink in for a while before trying it.

Great posts by Aaron

Finding out about and fixing Limited User Account bugs:

More to think about:

  • [WayBack] Table of Contents (Aaron Margosis’ Non-Admin WebLog) – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog
  • [WayBack] Not running as admin… – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    To be more secure, users should log on with a Limited (or “Least-privileged”) User account (LUA), and use elevated privileges only for specific tasks that require them.  Linux/Unix users have understood this for a long time

  • [WayBack] Why you shouldn’t run as admin… – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog
    • The #1 reason for running as non-admin is to limit your exposure.
    • My #2 reason for running as non-admin applies to developers.  Developing software as User instead of Admin helps ensure that your software will run correctly on end-users’ systems.
    • My #3 reason applies just to Microsoft personnel, particularly those of us in customer-facing roles.  Hey, y’all!  We need to lead by example.
  • [WayBack] The easiest way to run as non-admin – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    Here’s how I set up home computers for friends and relatives:

    • Create a Computer Administrator account called “Admin”.  No password.  (Read on before you flame.)
    • Create a Limited User account for each person who will be using the computer.  No passwords.
    • Enable the Guest account if it is anticipated that visitors may need to go online.

    I instruct all concerned that the Admin account is to be used only for installing software, and to use their individual accounts for all day-to-day use, including web, email, IM, etc.  This has worked quite well for everyone I’ve done this for, and don’t get calls anymore about home pages being hijacked, etc.  Users generally don’t even have to log out.  My 7-year old walks away, the screen saver kicks in, my 3-year old moves the mouse and clicks on his picture (or the frog or whatever it is now) and has his own settings.

    [added 2004.06.22]:  I also like to make the admin desktop noticeably different from normal user desktops, to help prevent accidental use.  For example, use the Windows Classic theme instead of the XP default, set a red background, or a wallpaper that says “For admin use only.  Are you sure you need to be here?”

    OK, I know you’re bursting already:  “No password?!?!  Are you insane?!?!”  Cool down, now.  Starting with Windows XP, a blank password is actually more secure for certain scenarios than a weak password.  By default, an account with a blank password can be used only for logging on at the console.  It cannot be used for network access, and it cannot be used with RunAs.  The user experience of just clicking on your name to log on can’t be beat for simplicity.  If you can trust everyone who has physical access to the computer not to log on as someone else or abuse the admin account, this is a great way to go.  If not, you can always enable passwords.

  • [WayBack] “RunAs” basic (and intermediate) topics – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    The Secondary Logon service was first introduced in Windows 2000, and is in Windows XP and Server 2003.  When you start a new process through RunAs, you provide credentials for the account you want the process to run under – for example, the local Administrator account.  Assuming the credentials are valid, the Secondary Logon service then causes several things to happen:

    • creates a new logon session for the specified account, with a new token;
    • ensures that the new process’ token is granted appropriate access to the current window station and desktop (the specifics change somewhat for XP SP2, but aren’t important here);
    • creates a new job in which the new process and any child processes it starts will run, to ensure that the processes are terminated when the shell’s logon session ends (correcting a problem with the NT4 Resource Kit’s SU utility).
  • [WayBack] RunAs with Explorer – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog
  • [WayBack] MakeMeAdmin — temporary admin for your Limited User account – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    MakeMeAdmin.cmd invokes RunAs twice, prompting you first for your local admin password, then for your current account password.  The bit that runs as local administrator does the following:

    1. Adds your current account to the local Administrators group (using NET LOCALGROUP, avoiding the problem of needing network credentials to resolve names);
    2. Invokes RunAs to start a new instance of cmd.exe using your current account, which is at this instant a member of Administrators;
    3. Removes your current account from the local Administrators group.

    The result of the second step is a Command Prompt running in a new logon session, with a brand new token representing your current account, but as a member of Administrators.  The third step has no effect on the new cmd.exe’s token, in the same way that adding your account to Administrators does not affect any previously running processes.

  • [WayBack] MakeMeAdmin follow-up – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    In my first MakeMeAdmin post, there’s a section called “Objects created while running with elevated privilege,” the main parts of which I’ll recap here:

    Normally, when a user creates a securable object, such as a file, folder, or registry key, that user becomes the “owner” of the object and by default is granted Full Control over it.  Prior to Windows XP, if the user was a member of the Administrators group, that group, rather than the user, would get ownership and full control….  Windows XP introduced a configurable option whether ownership and control of an object created by an administrator would be granted to the specific user or to the Administrators group.  The default on XP is to grant this to the object creator; the default on Windows Server 2003 is to grant it to the Administrators group….

    If I use MakeMeAdmin to install programs, my normal account will be granted ownership and full control over the installation folder, the program executable files, and any registry keys the installation program creates.  Those access rights will remain even when I am no longer running with administrator privileges.  That’s not what I want at all.  I want to be able to run the app, create and modify my own data files, but not to retain full control over the program files after I have installed it.

    I concluded by saying:

    For this reason, I changed the “default owner” setting on my computer to “Administrators group”.

    Today I would like to go further:  If you are going to use the same account for admin and non-admin activities (e.g., with MakeMeAdmin), I strongly recommend that you change the “Default owner” setting on your computer to “Administrators group”.

  • [WayBack] And so this is Vista… – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    What becomes of all my earlier non-admin tips, tricks and recommendations vis-à-vis RunAs, MakeMeAdmin, PrivBar and their interactions with IE and Explorer? The short answer is that Vista changes just about everything with respect to running with least privilege.

    Windows Vista makes running as a standard user (non-admin) much more pleasant, feasible and secure than it was on XP. I’m not going to drill into all those improvements here. Instead, the focus of this post is to update my earlier posts about running on XP as a standard user (the “Running as Admin Only When Required” posts in the Table of Contents) as they pertain to Windows Vista. To save some space, I’ll assume you’ve spent at least a little time running Vista.

    …

    rwx—rwx
    June 28, 2007 at 9:59 pm

    > On XP/2003, MakeMeAdmin lets you run as a

    > standard user, and temporarily elevate your

    > standard account to run a selected program

    > with administrative privileges.

    Right.  It doesn’t mean temporarily elevating your administrative account to run elevated, it means temporarily elevating your standard account to run a selected program with administrative privileges in the context of your account.

    > Vista gives you the same ability

    It does not.  Here’s what Vista gives:

    > If you are a member of the Administrators

    > group on Vista

    Exactly.  It means temporarily elevating your administrative account to run elevated.  It doesn’t help your standard account at all.

    > “Run as administrator” serves as a superior

    > substitute. With the default settings, a

    > member of Administrators can use it as a

    > MakeMeAdmin replacement

    No, it is not a substitute, it’s different.  A member of Administrators can use it to temporarily switch context to an administrative account and run elevated in the administrative account.  If the administrator does this to install an application for all users then there’s no real problem, the application gets installed for all users just as it did in XP.  But if the administrator wanted to do this to install an application for the standard user, they can’t do it.  The administrator gets to install the application for one user’s account, which is going to be the administrator’s account, it’s not going to be the standard user’s account.  The standard user doesn’t get the benefit that MakeMeAdmin provided.

    Standard users in Vista still need a MakeMeAdmin tool.

  • [WayBack] Ctrl-C doesn’t work in RUNAS or MakeMeAdmin command shells – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    Workaround: 

    Use Ctrl-Break instead.

    [Added, March 9, 2005: While this problem occurs on Windows XP, it does not occur on Server 2003 RTM! ]

  • [WayBack] Follow-up on “Setting color for *all* CMD shells based on admin/elevation status” – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog
  • [WayBack] Running restricted — What does the “protect my computer” option mean? – Aaron Margosis’ Non-Admin, App-Compat and Sysinternals WebLog

    The bottom line is that the app runs with a “restricted token” that basically has these net effects:

    • Group membership:  If you were logged in as a member of Administrators, Power Users, or certain powerful domain groups, the app runs without the benefit of those group memberships.
    • Registry:  The app has read-only access to the registry, including HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE.  The app has no access to HKCU\Software\Policies.
    • File system (assuming NTFS):  The app cannot access the user’s profile directory at all.  That includes “My Documents”, “Temporary Internet Files”, “Cookies”, etc.
    • Privileges:  The app has no system-wide privileges other than “Bypass traverse checking”.

    IE works fairly well this way, but with some odd and annoying problems:

    • You can’t use SSL (https) at all.
    • If you right-click on a hyperlink and choose “Open in New Window”, nothing happens.
    • If you enter a URL in the address bar without “http://” in front of it (e.g., “www.msn.com”), you get an error message like “C:\Documents and Settings\aaronmar\Desktop is not accessible.  Access is denied.”, before IE goes ahead and loads the site anyway.
    • On XP SP2 and on Server 2003, toolbars do not appear where you configured them, if they appear at all.  E.g., PrivBar always needs to be re-enabled; “Links” appears (on my machine) in the upper left, to the left of the menu bar.  (This wasn’t a problem with XP SP1.)

–jeroen

Posted in Development, Power User, Security, Software Development, Windows, Windows Development | Leave a Comment »

Is warshipping still a thing?

Posted by jpluimers on 2021/07/30

Reminder to self to see if warshipping is still a thing, and in which regions.

Related:

Via:

–jeroen

Read the rest of this entry »

Posted in Power User, Security | Leave a Comment »

Ken Thompson’s 1980 Unix password got cracked only a while ago: he used much entropy in his password

Posted by jpluimers on 2021/07/22

A few years back, Ken Thompson’s 1980 Unix password got cracked.

It took that long because his password p/q2-q4! had enough entropy by using uncommon characters so the crypt(3) based hash ZghOT0eRm4U9s was hard to crack.

The password was an opening chess move noted in the variety of the descriptive notation. A shorter notation would have been P-Q4, which would require months to crack in that era.

In modern chess notation, it would be 1. d4, moving the Queen’s Pawn from d2 to d4.

References (many interesting messages in the TUHS thread below):

Read the rest of this entry »

Posted in *nix, B, C, Development, Power User, Security, Software Development | Leave a Comment »

Many http headers via 🔎Julia Evans🔍 on Twitter: “some security headers… “

Posted by jpluimers on 2021/07/20

An image on CORS will follow; likely more on related topics too. [WayBack] 🔎Julia Evans🔍 on Twitter: “some security headers… “ about:

Interesting comments in the thread.

More to follow: [Archive.is] 🔎Julia Evans🔍 on Twitter: “going to talk about CORS headers on a different page because that’s a Whole Thing but i’d love to know what else I left out / got wrong here :)” including these:

Read the rest of this entry »

Posted in Communications Development, Development, Encryption, HTTP, https, HTTPS/TLS security, Internet protocol suite, Power User, Security, TCP | Leave a Comment »

« Previous Entries
Next Entries »