200,000 passwords exposed in Sweden

Thursday, October 27th, 2011 | Gene Teo | Comments Off on 200,000 passwords exposed in Sweden

The Sophos blog always has interesting articles on the latest developments in IT security. It’s easy to read and targeted at non-experts. Today there is a post about how several websites in Sweden were compromised, and an estimated 200,000 usernames and passwords were made public.

The lesson: Don’t use the same password on multiple websites. To help with this, use a password manager like KeePass, LastPass, or even your web browsers’ built in password manager.

More privacy and security issues with iOS applications

Thursday, October 20th, 2011 | Gene Teo | Comments Off on More privacy and security issues with iOS applications

Troy Hunt takes a look some iOS apps with regards to security and privacy. Here’s a hint: In the apps analyzed there isn’t much of either.

The information is collected by creating a proxy server to act as a middleman between the app and the server. This way the proxy server can see everything that passes back and forth, and save that data for analysis.

http://www.troyhunt.com/2011/10/secret-ios-business-what-you-dont-know.html

NoScript available for Android Firefox

Wednesday, October 19th, 2011 | Jim Cheetham | Comments Off on NoScript available for Android Firefox

The excellent & highly recommended NoScript addon for Firefox has been released on the Android platform (and Maemo, but I’m probably the only person here who has one of those). This addon blocks JavaScript, Java and Flash activity on webpages, giving you a simple way to selectively re-enable trusted providers and restore the full page functionality temporarily if you need it.

https://www.infoworld.com/d/mobile-technology/noscript-security-tool-released-android-maemo-176280 provides a nice writeup; NSA is the distribution point for the add-on itself.

Survey results: Social Networking Security & Privacy

Wednesday, October 19th, 2011 | Jim Cheetham | Comments Off on Survey results: Social Networking Security & Privacy

Barracuda Labs have released their 2011 survey on the Security & Privacy issues in Social Networking.

You can view the infographic version of the report, which presents findings like

  • One in five people has been negatively affected by information that was exposed on a social network.
  • Nine out of 10 people have received spam, and one in four have received a virus or malware, on a social network.

Let’s be careful out there!

Understanding Facebook Privacy settings

Tuesday, October 11th, 2011 | Gene Teo | Comments Off on Understanding Facebook Privacy settings

It’s not exactly well-publicized, but Facebook have lots of information about the privacy settings and features that you can apply to your Facebook account.

A quote from one of the documents:

Facebook is designed to make it easy for you to find and connect with others. For this reason, your name and profile picture do not have privacy settings. If you are uncomfortable with sharing your profile picture, you should delete it (or not add one).

 

Verifying an IIS7 SSL renewal request using OpenSSL

Monday, October 3rd, 2011 | Jim Cheetham | Comments Off on Verifying an IIS7 SSL renewal request using OpenSSL

Recently I received an SSL “renewal request” generated by an IIS7 server. These SSL certificate requests are interesting because they are very different from the usual CSRs generated.

The structure of this IIS7 renewal request is actually quite elegant. It seems to start from the premise that because this is a request to renew a *current* certificate, it needs to prove that the request is coming from the correct host — i.e. the host that is actually using the current certificate & ∴ owns the associated private key. In the Internet world, you prove that you are allowed to request renewals for a certificate by authenticating to your CA as the original user, rather than creating a signed CSR.

To prove the right to issue a renewal request, IIS7 creates a normal CSR (PKCS#10 object), and then signs it, and provides the cert of the key that signed it.

  • IIS7 renewal CSR
    • PKCS#7 Data
      • PKCS#10 Data (the ordinary CSR)
    • Normal server certificate
    • Issuing CA data
    • RSA signature (I assume)

Use openssl asn1parse -in iis7rcsr -i to see the structure of the file, and compare this to normal CSRs. You should see an OCTET STRING near the beginning, in an object labelled “:pkcs7-data”, which is what you need to extract to get the CSR.

$ openssl asn1parse -in iis7rcsr -i
0:d=0  hl=4 l=4273 cons: SEQUENCE
4:d=1  hl=2 l=   9 prim:  OBJECT            :pkcs7-signedData
15:d=1  hl=4 l=4258 cons:  cont [ 0 ]
19:d=2  hl=4 l=4254 cons:   SEQUENCE
23:d=3  hl=2 l=   1 prim:    INTEGER           :01
26:d=3  hl=2 l=  11 cons:    SET
28:d=4  hl=2 l=   9 cons:     SEQUENCE
30:d=5  hl=2 l=   5 prim:      OBJECT            :sha1
37:d=5  hl=2 l=   0 prim:      NULL
39:d=3  hl=4 l=2426 cons:    SEQUENCE
43:d=4  hl=2 l=   9 prim:     OBJECT            :pkcs7-data
54:d=4  hl=4 l=2411 cons:     cont [ 0 ]
58:d=5  hl=4 l=2407 prim:      OCTET STRING      [HEX DUMP]:3082096330820...

In order to get the actual PKCS#10 CSR out of here, we need that offset number, “58” in this example. Then we can use that offset to extract the binary version of that object :-

$ openssl asn1parse -in iis7rcsr -strparse 58 -out thecsr -noout

Next we can read that output file ‘thecsr’ with openssl req, remembering to specify the input format DER.

$ openssl req -in thecsr -inform DER -text -noout
Certificate Request:
Data:
Version: 0 (0x0)
Subject: (normal CSR Subject: line, censored)
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
...

I can wrap all this up into one command-line with no temporary files (but sadly 2 reads of the original cert), as long as I can use Linux’s /proc/self/fd/ to fool openssl (it will do native tricks with file descriptors for password handling, but not normal output).

$ openssl asn1parse -in iis7rcsr -strparse $(openssl asn1parse -in iis7rcsr | grep -A2 ':pkcs7-data'|tail -1|cut -d: -f1) -out /dev/stdout -noout | openssl req -inform DER -noout -text

Certificate Request:
Data:
Version: 0 (0x0)
Subject: (Subject: line censored again)
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
...

This long command line is directly equivalent to the simple openssl req -in non-iis7rcsr -noout -text that I normally use 🙂