Unanswered Questions

12
votes
2answers
505 views

Getting exploit reliability when using the off by one framepointer overwrite on linux

We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
11
votes
1answer
464 views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
11
votes
1answer
257 views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
10
votes
1answer
78 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
10
votes
1answer
748 views

TextSecure protocol

Is anyone aware of an analysis of the TextSecure protocol? https://whispersystems.org/blog/simplifying-otr-deniability/ https://github.com/WhisperSystems/TextSecure/wiki/Protocol It is a ...
7
votes
0answers
48 views

What are the implications of publicizing a consumer secret for sharing between developers doing local website development?

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
7
votes
1answer
348 views

Is there a list of phone numbers Facebook uses to send auth tokens?

Up to a few days ago, I always received Facebook auth tokens from numbers +181338477XX, except a few times from +85294985XXX. Problem is that lately I've been receiving codes directly from Italian ...
6
votes
1answer
161 views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
6
votes
1answer
188 views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
6
votes
1answer
1k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
6
votes
2answers
254 views

What are the security implications of linking a domain account with a personal Microsoft account in Windows 8?

Besides being able to mess up settings and having access to the personal SkyDrive account, what else might an attacker on the corporate network be able to do when the accounts are linked and settings ...
5
votes
1answer
71 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
5
votes
2answers
112 views

Detecting and removing Absolute persistance technology

Absolute persistance technology amounts to a persistent rootkit pre-installed by many device manufacturers (Acer, Asus, Dell, HP, Lenovo, Samsung, Toshiba, etc) to facilitate LoJack for laptops, and ...
5
votes
0answers
771 views

Designing single-sign-on with JSONP/CORS?

I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions). I would like to do something ...
5
votes
0answers
380 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...

15 30 50 per page