Reputation
738
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
5 17
Newest
 Critic
Impact
~19k people reached

  • 0 posts edited
  • 0 helpful flags
  • 148 votes cast
Mar
15
comment Does Java/Dalvik's Java Native Interface JNI make Android prone to better attacks?
sure there can be coding mistakes in the JNI/exec-native code, being unintented security risks. My question anyway rather wanted to look at the case: someone wants to use a apk package as trojan horse actually trying to break out of the uid-based sandbox. For the latter scenario I was thinking that coding natively, accessing the systemcalls might offer better ways for priveledge escalation, than the managed Java. I do of course not want to write such software, I simply figured it was possible, and also I prefere not coding in Java whenever possible
Mar
10
asked Does Java/Dalvik's Java Native Interface JNI make Android prone to better attacks?
Feb
23
answered Security implications of rooting Android
Feb
23
comment Security implications of rooting Android
How did you option this revolutionary root/jailbreak and in what form (an apk file? It was surely '11 when this question, yet it would be nice if there was a chance to add how you tried to decompile/disassemble the revolutionary.
Feb
9
awarded  Critic
Feb
4
comment How trustworthy is Firefox?
that study with 30% malware seems to not consider certain problems with proprietary operation systems, since at a closer look the to say that Microsoft Windows itself does not have malware aspects is blurry. Looking at Intel ME/AMT one might even say that those computers are build as malware.
Jan
24
comment Firefox pre-downloading
True and to the same extend simply adding the URL of the download item (e.g. a .gz file) is also a user interaction and also triggers the creation of the file in the filesystem. The misleading thing is the offered "cancel". It is rather a "discard what has already been created as temp file". A security related issue anyway arises only in connection with further troubles (i.e. a data file put into the os' filesystem is provoking a further threat/exploit). If on the other hand firefox would only load the header to memory and pause download, the file wouldn't even exist as risky in the fs.
Jan
24
comment Firefox pre-downloading
@Ramhound problems are (1) resource wasting (the download completely to a temp file, while the user may yet gain info about the file and decide to abort and discard the download; (2) that the temporary file is like the Browsercache content potentially accessible to processes that can be triggered to fail upon that data, something that would not happen if this downloading would simply not be done by firefox before the user confirms it with the dialog. The cancel of the dialog is a fake, the download already took place long before.
Jan
24
comment Firefox pre-downloading
Via this pre-downloading the data is put into the filesystem without need, and that adds to the risk (other processes might read the tempfile). Firefox could avoid this by downloading the necessary initial data and store it in memory. Only upon user interaction should any content be placed in the filesystem. Yet one might of course argue that the Browsercache also puts stuff into the filesystem.
Jan
22
answered What does “revoking” a key actually do?
Nov
20
comment Is this an evidence of a Skype communication being spied on?
I find it already unacceptable that a skype communication could very easily be spyed upon, i.e. by Skype/MS. Given that I think that this should be impossible to start with, technically, hence if privacy is key then it'd never even come to the question if it is done, the spying, as it's sufficiently bad it could.
Nov
9
awarded  Popular Question
Oct
28
comment How do organizations check *what* has been hacked?
Besides all the great answers, and only as a side-point comment: The public most often gets a result maybe resulting from forensics, in which case the answers apply. Consider also, that any result like "oh, it was really not thaaat bad", can only be a bloody lie of the companies. So with respect to determine "what has been hacked", a substantial part of what the public sees can also be have traces or PR and marketing and not only forensics. Even though maybe you choose to disregard this when posing the question, the picture would be incomplete without this mentioned
Oct
27
awarded  Nice Question
Oct
27
awarded  Nice Question
Oct
1
awarded  Yearling
Jul
21
awarded  Caucus
Mar
29
comment Software can be audited, is there an equivalent for hardware?
@cybermike then this is bad luck for me, I have no trust in the manufactorers, and no money either. It anyway suprises me to hear you mention "reverse engineering of hardware" as I thought that is techologically unfeasible for those nice <50nm IC. I will read into what you say, maybe it will eventually allow to provide a definitive answer to this question or at least a good approximation.
Mar
29
asked Software can be audited, is there an equivalent for hardware?
Feb
17
revised What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
added 202 characters in body