Unanswered Questions
7
votes
0answers
144 views
Help in understanding an application's crash - exploitable?
Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
6
votes
0answers
135 views
Getting exploit reliability when using the off by one framepointer overwrite on linux
scenario:
we have a program that is vulnerable to a one byte framepointer overwrite (note: stack is marked executable, Linux machine with aslr disabled and stack cookies disabled also standard x86 so ...
4
votes
0answers
112 views
Webapp2 security
I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
4
votes
0answers
177 views
Migrating GPG master keys as subkeys to new master key
Currently I have 3 private GPG pairs which are all master keys.
I want to convert these keys into subkeys for a new key pair (and keep that in the vault).
I have read the following thread ...
3
votes
1answer
60 views
Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?
The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
3
votes
1answer
70 views
Session Cookie Stealing Protection
I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used:
HTTPS Everywhere
Only use a securely created random ...
3
votes
0answers
102 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
1answer
28 views
Can attacker break out of apparmor jail with the following profile?
Below is an example profile I've created for web apps, in which I've limited files / commands it can access. It includes profiles to nginx, php-fpm and mysql, no commands is allowed, only few ...
2
votes
0answers
26 views
Validate XML-DSig by DVCS
Is it possible to validate an XML message (with XML-DSig or XAdES signature) by a Data Validation and Certification Server (RFC 3029)? Should it understand XML signatures or not? Could it parse XML? ...
2
votes
1answer
56 views
What cellular network is used for automobile theft recovery? Can that be used for PCs and mobile devices?
I'm interested in sending a remote wipe command to stolen IT devices, such as a cell phone, or wifi connected device. However most remote wipe technologies require that the cellular service (or wifi) ...
2
votes
0answers
26 views
How to handle two sets of OpenID credentials providing the same information, on the same or different OpenID providers?
I recently encountered a situation where one site assumed that if two different people's credentials for the same OpenID network produce the same email address then they were they same person. Also, ...
2
votes
0answers
75 views
How do I make or get computer certificates to use with IPSEC user authentication?
I am having trouble and need some direction using computer certificates with windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
2
votes
0answers
100 views
IIS 7.5 impersonation threat?
I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the ...
2
votes
0answers
39 views
PIV or GIDS compatible token availability
I am researching smartcards for corporate implementation and have hit a small bump. We need to support Windows RT, and Windows RT does not support Windows minidrivers for smartcards. Instead, it only ...
2
votes
0answers
186 views
What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?
In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever.
As the ADFS server is ...
