Run this Free Scan on your Website

Mozilla came out with a great free online tool called the Mozilla Observatory which gives you another great way to get a gauge as to how secure your developers and sysadmin are setting up your website. It's a simple A to F grade scale again, and of course like every other tool it's not perfect, but if you have a dynamically generated site that pulls records from a database for example, you really want to consider having your team modify your website code to get the score of an A.



It tells you about many great features, mostly HTTP Header related, that you should be doing on your site but may not be. It has the little informational icon which will give you details about how to resolve your issues also.



It also tells you about your SSL configuration (Qualys SSL LAbs is also a good tool for this)

Overall it's good to get 3rd party perspectives on the security of your site.

More about neonprimetime

• neonprimetime pastebin
• neonprimetime virustotal
• @neonprimetime twitter
• neonprimetime reddit

Top Blogs of all-time

1. pagerank botnet sql injection walk-thru
2. DOM XSS 101 Walk-Through
3. An Invoice email and a Hot mess of Java

Top Github Contributions

1. Qualys Scantronitor 2.0

Copyright © 2016, this post cannot be reproduced or retransmitted in any form without reference to the original post.

SSL in the News

Just a couple positive movements around SSL / HTTPS in the news over the past few months.

8/1/2016 - Google enables HSTS
By using HSTS, visitors following HTTP links to Google.com will be automatically redirected to the more secure HTTPS version of the Google domain. The effort, announced Friday, is meant to protect against protocol downgrade attacks, session hijacking and man-in-the-middle attacks that exploit insecure web connections.

6/8/2016 - Google Gmail deprecating SSLv3 and RC4
Google said that it will initiate on June 16 a gradual deprecation of SSLv3 and RC4 for Gmail IMAP/POP mail clients. Both the crypto protocols cipher are notoriously unsafe and are being phased out in big chunks of the Internet. Google, for its part, had already announced in May that it would no longer support SSLv3 and RC4 connections for Gmail SMTP.



More about neonprimetime

• neonprimetime pastebin
• neonprimetime virustotal
• @neonprimetime twitter
• neonprimetime reddit

Top Blogs of all-time

1. pagerank botnet sql injection walk-thru
2. DOM XSS 101 Walk-Through
3. An Invoice email and a Hot mess of Java

Top Github Contributions

1. Qualys Scantronitor 2.0

Copyright © 2016, this post cannot be reproduced or retransmitted in any form without reference to the original post.

How To Enable HTTPS on your blogger/blogspot Blog

It was exciting to see the recent announcement that Google would be expanding Free HTTPS to all blogger/blogspot blogs. The only catch is, YOU HAVE TO ENABLE IT!. Here's the steps I took to enable a redirect from HTTP to HTTPS on this blog.

Go under settings -> basic

Under the HTTPS header there is an HTTPS redirect drop down list that you can change from No to Yes.

Now when you navigate to your blog you will see it auto-redirect to the HTTPS version

More about neonprimetime

• neonprimetime pastebin
• neonprimetime virustotal
• @neonprimetime twitter
• neonprimetime reddit

Top Blogs of all-time

1. pagerank botnet sql injection walk-thru
2. DOM XSS 101 Walk-Through
3. php injection ali.txt walk-thru

Top Github Contributions

1. Qualys Scantronitor 2.0

Copyright © 2016, this post cannot be reproduced or retransmitted in any form without reference to the original post.

WordPress.com Free SSL for Everybody!

I've blogged several times about the benefits and eventual widespread adoption of of HTTPS on the Internet 1 2 3 4 5

I found this article about Wordpress.com SSL more proof that it's happening. The article says "All custom domains hosted on WordPress.com will soon have their sites automatically encrypted for free. WordPress said late Friday afternoon that more than one million sites will have encryption automatically deployed .... WordPress’ SSL cert rollout is coming courtesy of the Let’s Encrypt project, a coalition of tech providers, and privacy and legal minds, who developed a mechanism to issue free SSL certificates to any sites that wants one."

More about neonprimetime

• neonprimetime pastebin
• neonprimetime virustotal
• @neonprimetime twitter
• neonprimetime reddit

Top Blogs of all-time

1. pagerank botnet sql injection walk-thru
2. DOM XSS 101 Walk-Through
3. php injection ali.txt walk-thru

Top Github Contributions

1. Qualys Scantronitor 2.0

Copyright © 2016, this post cannot be reproduced or retransmitted in any form without reference to the original post.

HTTP Login Pages with HTTPS Posts

A while back Troy Hunt talked about HTTP Login forms that post to HTTPS. The long story short is these are still unsecure. As a web developer, don't be fooled into thinking that just because you're POSTing to HTTPS that your customers are safe. No, you need to have an HTTPS login form/page or you're at risk. The HTTPS POST may prevent sniffing because the traffic is encrypted, but with an unsecure HTTP form posting to HTTPS you are still at risk for man-in-the-middle. With a man-in-the-middle the form action url could tampered with and changed so your credentials get posted to some attacker website instead of the real one.

Now finally FireFox will make this even clearer by warning users if they're logging in with on a website with this insecure configuration.



More about neonprimetime

• neonprimetime pastebin
• neonprimetime virustotal
• @neonprimetime twitter
• neonprimetime reddit

Top Blogs of all-time

1. pagerank botnet sql injection walk-thru
2. DOM XSS 101 Walk-Through
3. php injection ali.txt walk-thru

Top Github Contributions

1. Qualys Scantronitor 2.0

Copyright © 2016, this post cannot be reproduced or retransmitted in any form without reference to the original post.

TLS Best Practices Guide Summary

The TLS Deployment Best Practices from SSL Labs is a good read. Thought it might be good to summarize some of it.

Private Key Strength - In order of strength it's 1024bit RSA (low, should be replaced) , then 2048bit RSA ( should be safe for a while ) , and then 256bit ECDSA (best right now if you have support).

Private Key Protection - Guard it with your life, password protect, minimal access, and revoke if compromised.

Private Key Source - Get your keys from a reputable large CA that has strong security posture and services available like simple revocation.

Hash Function - SHA1 is week and should be replaced immediately, SHA2 is the current standard as long as your users can support it.

Protocols - SSL (v2 and v3) are considered broken and should not be used. TLS v1.0 is considered but v1.1 and v1.2 have their advantages that will soon lead to the decom of v1.0

Cipher Suites - You should only be using suites with 128bit encryption or stronger. Also not Anon key exchange suites provide no authentication, NULL suites provide no encryption, Export key exchanges are broken and should not be used, and RC4 is broken and should not be used.

Cipher Suite Selection - Clients submit a list of supported suites and the server chooses one. Having the suites ordered by strength on the server is important so the highest security available is utilized.

Forward Secrecy - This is a feature that makes TLS not use the server's private key but instead a different key each time. The benefit is that if the server's key is compromised, historical traffic cannot be decrypted because the key was not the same.

Renegotiation - It's ok for a Server to initiate a re-negotiation of TLS settings, but there is no reason a Client should. Thus configure the server to ignore Client re-negotiation requests.

TLS & HTTP Compression - They're insecure and most clients don't support TLS Compression, so disable it.

Mixed Content and HSTS - Avoid mixed content of HTTP and HTTPS. Go all or nothing to HTTPS. Otherwise it leads to user confusion, mis-trust, and also some known vulnerabilities related to mixes. Use HSTS (Strict Transport) which tells the browser your site is only ever HTTPS.

Cookies - Cookies must be secured properly by the developer or else it can render your HTTPS ineffective in protecting session and other sensitive information.

EV Certs - You can go one step beyond and get an Extended Verification certificate which goes through extra tests and is harder to forge.

Public Key Pinning - Another above and beyond step that specifies which CAs can issue certificates for your websites.

ECDSA Certs - Elliptical curve certificates provider more strength from smaller key sets which increases performance.

Validate your settings - Run re-occuring tests like ssl labs to ensure your settings are secure.

Keep in mind this information is accurate as of the Dec 2014 publishing of the best practice guide and new information may have surfaced since then that changes some of these stances.

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

Securing SSL with testssl.sh

I thought this tool seemed pretty simple and handy testssl.sh.

The usage is simple for a linux shell prompt...
   #./testssl.sh google.com

And the output is easy to read.

I could see this tool being used by developers as a scorecard to show how well your website HTTPS is configured. Green results being good, red being bad.

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

More Evidence HTTPS will soon rule the World

I've blogged a few times ( [1] , [2]) now on how HTTP is going away and will soon be replaced by HTTPS.

I thought it was worthy to mention a few other big names making the same push.

REDDIT: Recently announced they'll move all site and services to HTTPS-only by the end of 2016.
BING: Recently announced that this summer they'll start making HTTPS their standard.
WHITE HOUSE: Recently announced that all federal agencies and departments are instructed move publicly accessible Web sites and services to HTTPS-only by the end of 2016.
APPLE: Recently published guidance for developers explaining the inclusion of Application Transport Security, a protocol that allows developers to force secure connections to specific domains from their apps.


This is all very exciting news and pushes home the idea that the migration to HTTPS is real and coming to your neck of the woods soon. You should start planning out your migration if you haven't already.

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

Remove SSL3, TLS 1/1.1 by June 2016 for PCI

SecurityWeek.com described how the PCI council appears to be telling companies that SSL v3.0, TLS 1.0, and in some cases even TLS 1.1 may have to be disabled/removed by June 30, 2016 to pass your PCI audit.

Pretty interesting , likely caused by the stores about POODLE and FREAK basically busting apart the security of these older protocols.

Apparently PCI doesn't release these out-of-band updates very often either, so they must've thought this was important, and I tend to agree with them.

Let's push forward and not live in the past.

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

HTTPS gives you more than just Encryption!

You probably know the main benefit of HTTPS. ENCRYPTION.

If you're navigating to a website, it ensures that your passwords, banking numbers, credit card numbers, etc. are encrypted from your laptop all the way across the internet to whatever data center the website's web servers are located in. It prevents somebody from sitting anywhere in between and sniffing out your data in plain text (something that has been almost trivial nowadays with the free tools available). It also prevents malicious attackers from easily grabbing your session cookie in plain text, hijacking your session, and logging in as you. That would suck.

BUT WAIT, THERE's MORE!

1.) Authenticity - If you are navigating a website, how do you know that page you're receiving is even from the website you initially navigated to? What if there is a man-in-the-middle who's intercepting all your web requests and serving back his malicious pages instead of the real ones? HTTPS gives you strong confidence in that aspect.

2.) Integrity - How do you know that the content you're downloading is original or if additional malicious content has been injected in by some malicious attacker? HTTPS also gives you confidence that the data hasn't been tampered with.

3.) 3rd Party Vetting - HTTPS certificates aren't just handed out, there is a little bit of vetting that goes on especially by the big trusted Certificate Authorities. Thus if you're on site and the certificate is from a trusted authority, you gain a bit of confidence in knowing that a 3rd party is marking this site as trusted.

4.) Revocation - Benefit #3 above about 3rd Party Vetting isn't always bullet-proof. The nice thing about HTTPS though is that if a Certificate does get compromised or is marked as malicious, it can be revoked, and then suddenly all browsers will warn a user if they're going to a site that is no longer trusted.

5.) User Trust - If you're running a website, you can potentially gain trust and increase sales by having the EV certificate that shows the Green lock/bar across the top of a browser.

6.) SEO - If you take the time and do it right, based on Google's current algorithm, HTTPS will give you a boost in your search ranking.



It's time get it done and migrate the entire Internet over.

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

SSL/TLS Best Practices from the OpenSSL Cookbook

Ivan Ristić wrote a great free online book about SSL/TLS security called OpenSSL Cookbook.

Appendix A makes for great bullet points "SSL/TLS Deployment Best Practices"

• Use 2048 bit private keys
• Restrict Access to the private keys
• Obtain Cert from a reliable CA
• Use Strong Cert algorithms (Ex: don't use SHA1)
• Use Secure Protocols (Ex: don't use SSL v2 or v3)
• Use Secure Cipher Suites (Ex: don't use RC4)
• Support Forward Secrecy
• Disable Client-Initiated Renegotiation
• Disable TLS compression
• Pay attention to performance
• Encrypt 100% of your website (don't mix content)
• Secure your cookies
• Validate everything works

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

It's STILL Time to Kill HTTP

As I mentioned back in December, It's time to Kill HTTP

Here's some quotes related to the topic ...

• “I feel HTTPS will soon be seen as a requirement for anyone doing business online,” said Paul Moreno, security engineering lead on Pinterest’s cloud team. . See more here from March 2015
• "We, the Chrome Security Team, propose that user agents (UAs) gradually change their UX to display non-secure origins as affirmatively non-secure." See more here from December 2014
• Why HTTPS? It’s simple. There is simply no reason not to anymore", Chris Wiegman web engineer for 10up.See more from December 2014
• "Our goal is to remove the barriers to deploying HTTPS and see an encrypted web completely replace unencrypted HTTP.", J. ALEX HALDERMAN of letsencrypt.com. See more from November 2014
• "We’d like to encourage all website owners to switch from HTTP to HTTPS to keep everyone safe on the web," said WebMaster Trend analytics at Google, Zineb Ait Bahajji . See more here from August 2014.
• "If you have a website, it’s a great time to convert it to all HTTPS – and now for multiple reasons," Gleb Budman CEO of BackBlaze.com. See more here from August 2014
• "HTTPS Everywhere," said web performance engineer at Google, Ilya Grigorik. See more here from June 2014.
• "We’ll be changing, moving everything to HTTPS somewhere in the coming weeks. My suggestion is you do that too", Joost de Valk from yoast.com. See more here from January 2014

Time to switch to HTTPS and Kill HTTP

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

HTTP Login Pages are a Big No-No

You should NEVER enter your username and password into a website that runs under HTTP. Contact the owner of that website and request they add a simple SSL Certificate so that the website runs under HTTPS. Why? Because otherwise your password will be sent in plain-text across the internet from your computer, one router at a time, until it reaches that company's web server. Anywhere in between, your password could've been captured. Whomever captured your password can then turn around and login to that website, or even worse than that, try to use the same password to login to your email, your bank, or any other website of their choice.

Most common places of compromise would be if you're logging into a website at a wireless hotspot like a Coffee Shop, Hotel, or Airport. Why? Cause it's so simple and trivial to sniff shared unprotected wireless for plain text passwords. But it doesn't stop there, I would not trust entering in my password on HTTP even if it's from my home, hard-wired in, or from my work on our Intranet. It takes one malicious insider at your ISP or at your work or in your house, or wherever to sniff those packets and steal your information.

It's sad, but I did a simple search for "Support Login" on google, and found numerous websites that are still running HTTP logins. I was able to proof-of-concept that fact that on all those websites your password is transmitted plain text. Use this pastebin as an example of how HTTP login pages just don't cut it ...

http://pastebin.com/vKtNx2DN

Note: I did send an email to each one of these company's support emails on their website as a friendly reminder to upgrade to HTTPS.

Copyright © 2014, this post cannot be reproduced or retransmitted in any form without reference to the original post.

It's Time to Kill HTTP

You've seen the green lock next to a URL before indicating you're on a secure website. If you're savvy enough you probably even confirm it's there before you do sensitive things like pay with a credit card or do your online banking. I contend that's not enough. It's time to kill HTTP and move all websites over to HTTPS.

Why? Security. Privacy. Awareness. Google says so. It's time.

Security - For example if you're logging into any website and you'd don't see the lock you might as well just post your password on the front page of Facebook. Believe me when I say it's become trivial to do things like sniff Hotel and Coffee Shop wireless for pain text passwords over HTTP. And at work all it takes is somebody on your wireless or a Joe Blow with access to a network jack to see your credentials or critical internal data floating across the wire.

Privacy - There are levels of snooping that go beyond trying to grab your password. Imagine HTTP traffic as the news ticker scrolling across try bottom of CNN. Any data that you submit over HTTP is plain as day out in the open and trivial to collect and aggregate. Imagine all the data you plug in such as email addresses , street address, zip code , phone , etc. being collected and saved into a database. But above and beyond that ... What are you typing into your search engine? Perhaps your current health conditions? Your political affiliations? And more ... What if you're typing nothing ... You're just surfing the internet ? All the urls and pages you go to can tell a lot about a person like where they live, what they do on the weekend , what age kids they have , etc. Why would you ever want that in plain text for the world to see?

Awareness - Hey, if I haven't scared you yet, let me put it bluntly ... The Internet is dangerous. Don't trust it. There are lots of disturbed people and companies out there. People need to be told the truth and made aware that the only true way to stay safe is encrypt everything. Everything. Emails , web traffic, public websites, internal work websites, everything.

Google says so - Most recently they wrote a blog ( Chromium Blog - Making HTTP non-secure ) saying they're considering marking HTTP urls as "insecure" ... Letting the browser finally tell the truth ... If you're not on HTTPS you are not safe! Google also announced this year that they will start giving SEO search ranking bonus points to websites running all HTTPS ( Google Webmaster - HTTPS as a Ranking ).

It's Time - It's time for HTTP to die. Performance is no longer an issue. Today's modern hardware and virtual environments can handle HTTPS even on peak days like Cyber Monday. Cost is no longer an excuse, as SSL Certificates are almost as cheap as candy nowadays. SEO is no longer an issue. Google has decided to reward you for it. There's no more excuses, it's time.

Snowden showed us that everybody is watching you and the X-Files had it right when they said "Trust No One". The next time you build a website or web service whether it's out on the Internet or local to your company's Intranet, do the smart thing and HTTPS-it-up! The next time you're on an HTTP website, second guess everything you're doing. If you love that site, reach out to the owner and tell them to convert over to HTTPS. It's time for everybody to jump aboard and do what's right .... Kill HTTP.

Copyright © 2014, this post cannot be reproduced or retransmitted in any form without reference to the original post.