All Questions

12
votes
0answers
2k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
10
votes
0answers
514 views

OpenSSL EVP aes_256_cbc Initialization Vector Size

I'm looking at the crypto library examples (programmed in c) provided for OpenSSL EVP on OpenSSL Wiki. Their example for a 128 bit Initialization Vector is as follows: /* A 128 bit IV */ ...
10
votes
0answers
693 views

How to properly secure an ActiveMQ instance, and what are all of the different files for?

I'm trying to configure user based authentication for ActiveMQ, and I'm pretty confused about the many different files involved in this process. I've read ActiveMQ's security page, but I still have ...
7
votes
0answers
86 views

risk from USB-C port on locked laptop

If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but ...
7
votes
0answers
129 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
7
votes
0answers
265 views

Can SRP be implemented using libsodium

I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls. ...
7
votes
0answers
337 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
6
votes
0answers
324 views

Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?

Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
6
votes
0answers
2k views

Meterpreter (Metasploit) anonymous reverse connection over Tor2web

The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box. I've ...
6
votes
0answers
475 views

FB Oauth CSRF security, PHP website

I am experimenting with third party login, using Twitter and Facebook. After getting access token from these parties, and confirming its validity, I then issue my own JWT token thats used within my ...
6
votes
0answers
656 views

Limited Buffer Size for shellcode on 64 bits machine

I have a code snippet which has the classic strcpy vulnerability int main(int argc, char argv[][]){ char buffer[8]; strcpy(buffer, argv[1]); } By disassembling the binary file, we can see ...
6
votes
0answers
1k views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
5
votes
0answers
114 views

Difference between Secure Boot and Attestation

What's the exact difference between secure boot and device attestation. Nowadays with secure devices both are used, even at the same time, when in the core they do similar things, which is ...
5
votes
0answers
145 views

How to send Wi-Fi management frames from macOS?

I realise that this question has been touched on before as linked here. However, none of the solutions suggested solved my question and it fails to answer the overarching question of how to send all ...
5
votes
0answers
943 views

How to encrypt, sign and decrypt a file with gpg?

I am using gpg to encrypt and decrypt a file. Here are the steps I am doing taking reference from this question: # Sender gpg --encrypt --recipient recipient@gmail.com --output confidential.pgp ...
5
votes
0answers
148 views

JWT in localStorage with encrypted sessionId

What I want: Store a JWT in localStorage. The JWT contains claims about authorization. Prevent the JWT from being stolen and used by an attacker (using XSS) Avoid CSRF Storing the JWT in ...
5
votes
0answers
255 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
5
votes
0answers
451 views

How does Chrome distrust Symantec Certificates?

Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC. When I visit chase.com on Google Chrome, I get the following ...
5
votes
0answers
363 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
5
votes
0answers
30 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
5
votes
0answers
137 views

Monero miner in ~/.info directory - a worm signature?

On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab. ...
5
votes
0answers
107 views

How to encrypt cookies in Xamarin

I have a Xamarin application which creates a few files in /data/data/my.app.com/app_webview after using it. The problem is that the cookies file is a file which contains session cookies. According ...
5
votes
0answers
76 views

Update intervals of VPN client code

I recently had to find a VPN client to connect to a preconfigured Cisco IPSec VPN. Of course there's Cisco's own client implementation AnyConnect, but I wanted to stick with a free alternative if ...
5
votes
0answers
743 views

Generating RSA keys per the FIPS 186-4 standard

my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
5
votes
0answers
137 views

Does a “Barge-in Attack” exist for unencrypted Bluetooth Low Energy connections?

Does what I'm calling a "barge-in attack" exist for Bluetooth Low Energy? This is a type of Man-in-the-Middle attack, I guess, but unlike in most discourse on BLE security, the attacker does not ...
5
votes
0answers
825 views

Metasploit DCERPC BindError

I'm trying to gain shell access to my home router/gateway, so I decided to use metasploit and nmap to find if there were any vulnerabilities that I could use: [marcel@GLaDOS ~]$ sudo nmap -sS -Pn -A ...
5
votes
0answers
286 views

Android verified boot within the boot sequence

I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process. From what I gathered so far I get that in Android devices ...
5
votes
0answers
149 views

Using instruction set architecture (ISA) to stop stack overflows

I have been learning about using stack overflows to get arbitrary code execution, one of the tricks used is overwriting the return address to make control flow go the way you want it. Assuming our ...
5
votes
0answers
57 views

DSquery leaking personal infomation

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
5
votes
0answers
111 views

.net website using certificate with .com

I found a website where all browsers navigate to just fine and do not complain about the certificates. When i inspect the certificate i noticed something i hadn't thought i would see. the website foo....
5
votes
0answers
939 views

How to interpret the scrypt vs bcrypt vs pbkdf2 comparison table?

You are probably familiar with this table: The source of the table is this here This table is 10+ years old. Is this still valid with actual technology? Wikipedia says that since 2014 there is ...
5
votes
0answers
191 views

What is the meaning if all IoT hacked by Mirai all over the world identify themselves on my server since 15 days in the rhythm of 180 unique IoT/h?

In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, ...
5
votes
0answers
637 views

Hyper-V Sockets in 2016 version and host/guest communication

In new version of Hyper-V released recently with MS Windows Server 2016 contains a new functionality Hyper-V Sockets which allows for host/guest communication. It uses WinSock API with new address ...
5
votes
0answers
169 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
5
votes
0answers
769 views

How to differentiate between encrypted and unencrypted Bluetooth traffic while using Wireshark?

I captured Bluetooth traffic between a master vault Bluetooth smart padlock and an iPhone 6s. This was done using a Bluetooth sniffer and the captured traffic was stored to a pcap file. Analysing it ...
5
votes
0answers
76 views

How do (broadcast-only/passive) RFID licence plates assert their identity?

I would have guessed by some kind of challenge-response, but there seem to be many claims of 'passive' or 'broadcast-only' tags in the plates. For example from http://www.e-plate.com/security.html: ...
5
votes
0answers
4k views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
5
votes
0answers
117 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
5
votes
0answers
267 views

Enterprise message bus encryption

I'm contemplating using Amazon's Simple Queue System as the basis of an enterprise message bus. According to Amazon, the contents are not encrypted, which means the application(s) will have to handle ...
5
votes
0answers
778 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup, where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, ...
5
votes
0answers
5k views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
5
votes
0answers
2k views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
4
votes
0answers
189 views

How accurate are people at determining the validity of a signature?

Is there any scientific survey about this? I could imagine an experiment like this: 100 people provide at least 3 times their signature (e.g. with different pens) Each of them gets all 3 example ...
4
votes
0answers
44 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
4
votes
0answers
107 views

XSS with escaped equal sign inside jQuery selector

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206). It passes filtered and urldecoded document.location.hash (val2 below) value ...
4
votes
0answers
79 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
4
votes
0answers
205 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
4
votes
0answers
971 views

What type of data can be recovered from the swap file / page file and thumbs file

This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
4
votes
0answers
461 views

How secure are IMEI numbers?

I recently had my phone stolen (Galaxy S8) and have done the following: Wiped it remotely Reported the theft to network operator, who have allegedly blocked the EMEI I have tried searching for ...
4
votes
0answers
82 views

What is the purpose of a requesting a non existent resource

nwolb.com the site for Natwest Online Banking (a UK based bank) makes two requests to non existent resources. For example: https://82.13.77.77:4531/NonExistentImage20297.gif https://127.0.0.1:4817/...

15 30 50 per page