All Questions

17
votes
0answers
920 views

Emacs and EasyPG not performing public key encryption

I have a file which I edit and encrypt following this guide. I'm a noob as far as security goes and thought that the point of including the line which specifies the cryptographic key to use -*- mode:...
9
votes
0answers
455 views

OpenSSL EVP aes_256_cbc Initialization Vector Size

I'm looking at the crypto library examples (programmed in c) provided for OpenSSL EVP on OpenSSL Wiki. Their example for a 128 bit Initialization Vector is as follows: /* A 128 bit IV */ ...
9
votes
0answers
634 views

How to properly secure an ActiveMQ instance, and what are all of the different files for?

I'm trying to configure user based authentication for ActiveMQ, and I'm pretty confused about the many different files involved in this process. I've read ActiveMQ's security page, but I still have ...
7
votes
0answers
1k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
7
votes
0answers
235 views

Can SRP be implemented using libsodium

I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls. ...
7
votes
0answers
292 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
6
votes
0answers
815 views

How was Google recaptcha v2 bypassed several times?

There are multiple reports of a reᴄᴀᴘᴛᴄʜᴀ v2 bypass. Most of the time, the explanation is neural networks services provided by Google or ɪʙᴍ. But there is something I am failing to understand: for ...
6
votes
0answers
310 views

Fully transparent proxy

By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections. The following ...
6
votes
0answers
456 views

FB Oauth CSRF security, PHP website

I am experimenting with third party login, using Twitter and Facebook. After getting access token from these parties, and confirming its validity, I then issue my own JWT token thats used within my ...
6
votes
0answers
626 views

Limited Buffer Size for shellcode on 64 bits machine

I have a code snippet which has the classic strcpy vulnerability int main(int argc, char argv[][]){ char buffer[8]; strcpy(buffer, argv[1]); } By disassembling the binary file, we can see ...
5
votes
0answers
59 views

Difference between Secure Boot and Attestation

What's the exact difference between secure boot and device attestation. Nowadays with secure devices both are used, even at the same time, when in the core they do similar things, which is ...
5
votes
0answers
110 views

Do long lived TLS connections pose a security risk?

I would like to better understand the implications of maintaining a long lived (hours, days) TLS connection with respect to certificate revocation. As I understand TLS, the client verifies the server'...
5
votes
0answers
154 views

Looking for resources for interpreting my security logs

I am currently setting up an Apache web server on a Linux machine at my house. I am working on a website project which will allow users to log in to complete certain work. There is no open ...
5
votes
0answers
223 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
5
votes
0answers
436 views

How does Chrome distrust Symantec Certificates?

Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC. When I visit chase.com on Google Chrome, I get the following ...
5
votes
0answers
317 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
5
votes
0answers
28 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
5
votes
0answers
130 views

Monero miner in ~/.info directory - a worm signature?

On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab. ...
5
votes
0answers
316 views

Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?

Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
5
votes
0answers
102 views

How to encrypt cookies in Xamarin

I have a Xamarin application which creates a few files in /data/data/my.app.com/app_webview after using it. The problem is that the cookies file is a file which contains session cookies. According ...
5
votes
0answers
74 views

Update intervals of VPN client code

I recently had to find a VPN client to connect to a preconfigured Cisco IPSec VPN. Of course there's Cisco's own client implementation AnyConnect, but I wanted to stick with a free alternative if ...
5
votes
0answers
699 views

Generating RSA keys per the FIPS 186-4 standard

my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
5
votes
0answers
133 views

Does a “Barge-in Attack” exist for unencrypted Bluetooth Low Energy connections?

Does what I'm calling a "barge-in attack" exist for Bluetooth Low Energy? This is a type of Man-in-the-Middle attack, I guess, but unlike in most discourse on BLE security, the attacker does not ...
5
votes
0answers
712 views

Metasploit DCERPC BindError

I'm trying to gain shell access to my home router/gateway, so I decided to use metasploit and nmap to find if there were any vulnerabilities that I could use: [marcel@GLaDOS ~]$ sudo nmap -sS -Pn -A ...
5
votes
0answers
270 views

Android verified boot within the boot sequence

I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process. From what I gathered so far I get that in Android devices ...
5
votes
0answers
139 views

Using instruction set architecture (ISA) to stop stack overflows

I have been learning about using stack overflows to get arbitrary code execution, one of the tricks used is overwriting the return address to make control flow go the way you want it. Assuming our ...
5
votes
0answers
57 views

DSquery leaking personal infomation

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
5
votes
0answers
103 views

.net website using certificate with .com

I found a website where all browsers navigate to just fine and do not complain about the certificates. When i inspect the certificate i noticed something i hadn't thought i would see. the website foo....
5
votes
0answers
2k views

Meterpreter (Metasploit) anonymous reverse connection over Tor2web

The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box. I've ...
5
votes
0answers
886 views

How to interpret the scrypt vs bcrypt vs pbkdf2 comparison table?

You are probably familiar with this table: The source of the table is this here This table is 10+ years old. Is this still valid with actual technology? Wikipedia says that since 2014 there is ...
5
votes
0answers
183 views

What is the meaning if all IoT hacked by Mirai all over the world identify themselves on my server since 15 days in the rhythm of 180 unique IoT/h?

In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, ...
5
votes
0answers
603 views

Hyper-V Sockets in 2016 version and host/guest communication

In new version of Hyper-V released recently with MS Windows Server 2016 contains a new functionality Hyper-V Sockets which allows for host/guest communication. It uses WinSock API with new address ...
5
votes
0answers
155 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
5
votes
0answers
712 views

How to differentiate between encrypted and unencrypted Bluetooth traffic while using Wireshark?

I captured Bluetooth traffic between a master vault Bluetooth smart padlock and an iPhone 6s. This was done using a Bluetooth sniffer and the captured traffic was stored to a pcap file. Analysing it ...
5
votes
0answers
4k views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
5
votes
0answers
116 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
5
votes
0answers
266 views

Enterprise message bus encryption

I'm contemplating using Amazon's Simple Queue System as the basis of an enterprise message bus. According to Amazon, the contents are not encrypted, which means the application(s) will have to handle ...
5
votes
0answers
749 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup, where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, ...
5
votes
0answers
5k views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
5
votes
0answers
2k views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
4
votes
0answers
84 views

XSS with escaped equal sign inside jQuery selector

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206). It passes filtered and urldecoded document.location.hash (val2 below) value ...
4
votes
0answers
61 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
4
votes
0answers
145 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
4
votes
0answers
125 views

How to send Wi-Fi management frames from macOS?

I realise that this question has been touched on before as linked here. However, none of the solutions suggested solved my question and it fails to answer the overarching question of how to send all ...
4
votes
0answers
545 views

What type of data can be recovered from the swap file / page file and thumbs file

This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
4
votes
0answers
383 views

How secure are IMEI numbers?

I recently had my phone stolen (Galaxy S8) and have done the following: Wiped it remotely Reported the theft to network operator, who have allegedly blocked the EMEI I have tried searching for ...
4
votes
0answers
713 views

How to encrypt, sign and decrypt a file with gpg?

I am using gpg to encrypt and decrypt a file. Here are the steps I am doing taking reference from this question: # Sender gpg --encrypt --recipient recipient@gmail.com --output confidential.pgp ...
4
votes
0answers
79 views

What is the purpose of a requesting a non existent resource

nwolb.com the site for Natwest Online Banking (a UK based bank) makes two requests to non existent resources. For example: https://82.13.77.77:4531/NonExistentImage20297.gif https://127.0.0.1:4817/...
4
votes
0answers
810 views

What unique device fingerprinting information can an iOS 11 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
4
votes
0answers
3k views

Configure Access-Control-Allow-Origin for clients with origin: null

I develop a web app. When I run the app on Android, origin in the header of a network request is null. Access-Control-Allow-Origin in the response header is null too, because the origin of the ...

15 30 50 per page