25
votes
0answers
611 views

WPA2 ephemeral key derivation

I'm trying to learn how ephemeral keys in WPA2 4-way handshake are derived. Starting from 4 EAPOL packets sniffing, I successfully derived PMK and PTK reading ANonce, SNonce, and knowing ASCII-PSK ...
18
votes
0answers
775 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
15
votes
0answers
214 views

Bypassing HTTP to HTTPS cached 301 redirect to use SSLstrip

I'm doing some pen. tests on a HTTPS (443) server that does not have HSTS implemented (no HSTS headers on response and the address is not on Chrome HSTS preload list). The problem is that in my ...
10
votes
0answers
235 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
9
votes
0answers
365 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
9
votes
0answers
374 views

CERT FOE Fuzzing Framework documentation

So I read another post here about fuzzing local standalone applications. I have understood how to exploit basic buffer overflow vulnerabilities in standalone applications and am now looking on how to ...
8
votes
0answers
388 views

Naive implementation of Rainbow Table and/or Hellman's trade-off

This question is the same one I asked here. Since I haven't got any response or even a comment I will post it here as well. Is there any naive implementation of Hellman's cryptanalytic time memory ...
7
votes
0answers
71 views

Using certificates to secure

I'm working on an application that comprises of a C# WebAPI (on Azure Websites) and a native mobile app. Essentially, a client creates a series of messages using a Web interface and these can be ...
7
votes
0answers
219 views

iPhone 5/6 RAM security

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+. I've previously discussed general iPhone encryption and from the response it reads: There are many exploits over the years ...
7
votes
0answers
66 views

Computer Virus Phylogenies algorithms - pseudocode?

I've collected a large number of "Web Shell by oRb" (a.k.a. "FilesMan" backdoor, a.k.a. antichat backdoor) files by running a WordPress honeypot, and searching pastebin. The code in the variants is ...
7
votes
0answers
317 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
6
votes
0answers
43 views

What LDAP schema is recommended for PKI?

In my research, I found some RFCs that have not been updated in over a decade, e.g draft-ietf-pkix-ldap-crl-schema-01. I also explored several public directories used in PKI (e.g. x500.bund.de) and ...
6
votes
0answers
67 views

Third-Party-Cookies Tracking - Google Chrome

I've read an article about third-party-cookies which explained that in Google Chrome disabling third-party-cookies will not stop the browser from sending third-party-cookies. So when I visit Facebook ...
6
votes
0answers
63 views

Can a faked iPhone SMS log be detected

SMS messages received by an iPhone is stored unencrypted in an SQLite database, which may be extracted by backing up the phone. You can manipulate (tamper with, e.g: replace the text of a message ...
6
votes
0answers
133 views

How do Lync and SSL inspection play together?

Whitelisting all Lync hostnames is cumbersome. Globally deactivating SSL inspection is undesirable. At a place I work for, they have SSL-inspection enabled on their proxy. All traffic to the Internet ...
6
votes
0answers
189 views

Do I need to use the cipher command with a newer SSD to erase files?

I've used Eraser in the past, and recently became aware of the cipher command in Windows 8. Specifically, with the /w flag: /w removes data from portions of the volume it can access and have not ...
5
votes
0answers
53 views

Is Google identity sign in product HIPAA compliant?

I want to use this product to save me a month of coding. Looking for a product that Password expiration forgot password system lock after x times of wrong password Valid passwords rules (min 8 ...
5
votes
0answers
64 views

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password ...
5
votes
0answers
46 views

How to understand QEBEK (Honeypot Monitoring Tool)?

I am working from a while to find something meaningful or updated about QEBEK, but what i got is here in two links Intro and KYT Paper for Installation 2010 . These links are nothing more that a ...
5
votes
0answers
320 views

How to protect from ROM-0 via port triggering?

I'm using an anti-virus that told me that my router can be compromised with the ROM-0 vulnerability. It told me to use "port forwarding" to fix it. But, my router have a "port triggering", which they ...
5
votes
0answers
50 views

How the AWS signature works in depth

I'm trying to understand how the AWS signature 4 works. I read the docs and I found the Python example where a signature is computed ...
5
votes
0answers
93 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
4
votes
0answers
20 views

SSL 3.0 for clients without room for chosen plaintext attacks

I've collected the issues that affect SSL 3.0 and found that they are either configuration issues (disabling RC4, RC2, DES, anon, export, null suites, compression, proper key lengths, etc.) or ...
4
votes
0answers
32 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a ...
4
votes
0answers
48 views

Motion sensor door locks

I have seen several offices with electric locks for entry that have a sensor for exit. I assume it's some kind of motion or object detection sensor. This is odd because in many cases, there's a ...
4
votes
0answers
50 views

Can I use a satellite phone for 2 factor auth sms and such?

Would 2 factor authentication SMS messages or other kinds of internet security notifications work with satellite phones? E.g. companies like Google, Paypal, Facebook, banking institutions and others ...
4
votes
0answers
41 views

Wordpress.org pages refresh when logging out of Gmail

I've noticed that when I change my Gmail account by logging out of one account and then logging into another, all open Wordpress.org pages refresh. Additionally, when I recently changed a password on ...
4
votes
0answers
55 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
4
votes
0answers
61 views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
4
votes
0answers
49 views

Bidirectional encrypted server to server communication using TLS

I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would ...
4
votes
0answers
68 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
4
votes
0answers
41 views

How to encrypt data using the iOS secure element?

I would like to know if there's a way to encrypt/decrypt data using the iOS secure element chip (Java card). Or does the keychain already use it?
4
votes
0answers
36 views

Privilege escalation fails outside gdb

I have an application with the following source code: #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { char buffer[12]; strcpy(buffer, str); ...
4
votes
0answers
84 views

ARP spoofing kills victims connection and other issues

Recently i got interested in sniffing/spoofing. I'm running Kali with MITMf(9.8) and SSLstrip. To start attack i use: python mitmf.py -i wlan0 --target X.X.X.2 --gateway X.X.X.1 --arp --spoof --hsts ...
4
votes
0answers
243 views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
4
votes
0answers
78 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
4
votes
0answers
79 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
4
votes
0answers
211 views

OpenSSL 0.9.6a PRNG algorithm weakness: How to exploit?

I saw an OpenSSL security advisory for Openssl 0.9.6a Recently a cryptographic flaw in OpenSSL's built-in pseudo-random number generator (PRNG) was pointed out to us by Markku-Juhani O. Saarinen ...
4
votes
0answers
120 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
4
votes
0answers
132 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
4
votes
0answers
119 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
4
votes
0answers
711 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
4
votes
0answers
73 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
4
votes
0answers
202 views

CRL check for TLS client certificate on Linux?

I run a HTTPS web service. Clients authenticate using a TLS Client Certificate. How do I configure a standard Linux web server (preferably Apache) to validate client certificates against their CRLs? ...
4
votes
0answers
575 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
4
votes
0answers
171 views

Enabling virutalization, addressing the bluepill risk?

Background to this question is the ambivalence I assume with virtualization. Also to start directly with clarity: the term bluepill should here be a placeholder to denote "malware that uses ...
4
votes
0answers
168 views

Is the GTK or MIC in the unencrypted portion of a WPA protected frame?

In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to ...
3
votes
0answers
44 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
3
votes
0answers
42 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
3
votes
0answers
47 views

ADFS 3.0 OAuth2.0 against client applications

ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets. Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...

15 30 50 per page