All Questions

6,522 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
16 votes
2 answers
2k views

What unique fingerprinting information can an iOS 10 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
user avatar
  • 1,430
14 votes
0 answers
3k views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
user avatar
  • 141
12 votes
1 answer
818 views

Random seed not propagating to the entropy pools in a timely manner

The Linux kernel's randomness driver collects entropy from the environment. Because there will be little entropy during boot, a random seed is often kept at /var/lib/misc/random-seed or a similar ...
user avatar
  • 64k
10 votes
1 answer
4k views

Meterpreter (Metasploit) anonymous reverse connection over Tor2web

The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box. I've ...
user avatar
9 votes
0 answers
402 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
user avatar
  • 369
9 votes
0 answers
332 views

PGP security with Thunderbird 78 email client

I have a query regarding best practice of using PGP to sign emails with Thunderbird 78. Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
user avatar
  • 1,057
9 votes
1 answer
2k views

Using the authorization code grant without using cookies?

I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal: OAuth2 OpenID Connect SPA / Mobile ...
user avatar
  • 529
9 votes
0 answers
324 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
user avatar
  • 383
9 votes
2 answers
332 views

SAML 2.0 Multiple AuthnStatements

If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
user avatar
  • 223
9 votes
1 answer
4k views

Do fTPM implementations protect against physical attacks?

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC. As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
user avatar
  • 313
8 votes
1 answer
1k views

TCP Sack panic proof of concept?

For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies? [1] ...
user avatar
8 votes
0 answers
961 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
user avatar
  • 181
8 votes
0 answers
297 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
user avatar
  • 64k
8 votes
0 answers
378 views

How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?

The DISA Application Developer STIG specifies: Group ID (Vulid): V-69565 Rule ID: SV-84187r1_rule Rule Version (STIG-ID): APSC-DV-001730 Rule Title: The application must require the change of at ...
user avatar
7 votes
3 answers
316 views

Is it possible for a website to detect the presence of a proxy?

I am attempting to scrape a site which is notoriously difficult to scrape. Access from datacentres is generally blocked. In the past I've used various proxies, but recently these have stopped ...
user avatar
7 votes
1 answer
2k views

iOS & Android Certificate Pinning with Lets Encrypt

We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for. We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
user avatar
  • 2,809
7 votes
0 answers
431 views

Can SRP be implemented using libsodium

I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls. ...
user avatar
  • 359
7 votes
2 answers
2k views

Can TPM "Storage Keys" be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
user avatar
7 votes
0 answers
6k views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
user avatar
  • 221
7 votes
1 answer
516 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
user avatar
  • 1,326
7 votes
1 answer
4k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
user avatar
  • 7,275
6 votes
0 answers
155 views

Why is iOS sending HTTPS requests even with background refresh disabled?

I've installed NextDNS on my iPhone and started noticing random connection requests to *.aliexpress.com, live.musical.ly, amazon.sa, and others. What made me wonder is that I don't have "...
user avatar
6 votes
1 answer
434 views

XXE OOB Large File Extraction

Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
user avatar
  • 61
6 votes
1 answer
753 views

Are there any observed Rowhammer attacks in the wild

Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a ...
user avatar
6 votes
0 answers
368 views

Recent Pwn2Own baseband exploit

I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
user avatar
  • 4,961
6 votes
0 answers
147 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
user avatar
  • 69
6 votes
0 answers
613 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now use ...
user avatar
  • 1,230
6 votes
0 answers
3k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
user avatar
6 votes
0 answers
356 views

Security of TPM 1.2 for providing tamper-evidence against firmware modification

I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
user avatar
  • 209
6 votes
1 answer
1k views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
user avatar
  • 313
6 votes
2 answers
2k views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
user avatar
6 votes
0 answers
2k views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
user avatar
5 votes
0 answers
59 views

Is chrome not blocking all third party cookies?

I opened a website 99acres.com in incognito windows on two browsers on a Macbook. Following are the settings: Chrome Version: 100.0.4896.75 (latest) Third Party cookies: Disabled Firefox Version: ...
user avatar
  • 151
5 votes
0 answers
353 views

Windows Defender catches Trojan right after clean install

I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
user avatar
  • 51
5 votes
0 answers
456 views

How did ntpd get patched to prevent NTP time synchronization attacks?

I recently tested the NTP Time Synchronization Attack as described and demonstrated by Jose Selvi in 2015. Basically, the attack was mostly used to send the victim's clock in the future, so the ...
user avatar
5 votes
0 answers
163 views

What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?

I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general. So, PAdES has the concept of Long Term Validation, which ...
user avatar
5 votes
0 answers
434 views

How is my ISP circumventing SSL on thepiratebay even though the certificate is valid?

When I visit https://thepiratebay.org it is displaying a message from my ISP saying it is blocked under government rules. BUT the https icon is green and the certificate is a SNI certificate from ...
user avatar
  • 51
5 votes
0 answers
2k views

How to bypass certificate pinning in Android phone?

I am working on analyzing Android applications from my phone using MITM Proxy. My Android phone version is 4.4.2, SDK is 19 and its rooted. I have performed all WiFi configurations required for MITM. ...
user avatar
  • 51
5 votes
1 answer
1k views

Is `gpg --refresh-keys` secure and where is this documented?

From the gpg manual: --refresh-keys Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. ...
user avatar
  • 191
5 votes
0 answers
138 views

Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes. Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
user avatar
  • 208
5 votes
0 answers
193 views

Why am I getting seemingly random fingerprints back when connecting via SSH/SCP?

I manage an application that connects to various servers using a client-specific keypair. We have around 70 customers; all but one can connect to our FTP server (for SCP) after first accepting the RSA ...
user avatar
  • 51
5 votes
3 answers
317 views

Fix vulnerabilities in ALL applications, or only client-facing ones?

Given a setup where we have nginx sat in a DMZ serving static content, forwarding (REST/WS) requests through a firewall to tomcat running on a server where other applications are also running: YOU &...
user avatar
  • 151
5 votes
0 answers
135 views

How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?

I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
user avatar
  • 51
5 votes
0 answers
452 views

Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?

Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to? Such targeted or ...
user avatar
  • 199
5 votes
0 answers
333 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
user avatar
  • 3,512
5 votes
3 answers
233 views

How can one centrally manage / audit AWS resource-based policies

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
user avatar
5 votes
0 answers
356 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
user avatar
5 votes
0 answers
999 views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
user avatar
5 votes
0 answers
269 views

How accurate are people at determining the validity of a signature?

Is there any scientific survey about this? I could imagine an experiment like this: 100 people provide at least 3 times their signature (e.g. with different pens) Each of them gets all 3 example ...
user avatar
  • 3,892
5 votes
0 answers
126 views

Poor Man's OAuth Grant - Review

A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me. The user has ...
user avatar
  • 151

15 30 50 per page
1
2 3 4 5
131