All Questions

6,944 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
17 votes
1 answer
3k views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
MattyG's user avatar
  • 171
11 votes
1 answer
507 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
O. Jones's user avatar
  • 379
11 votes
0 answers
469 views

PGP security with Thunderbird 78 email client

I have a query regarding best practice of using PGP to sign emails with Thunderbird 78. Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
Martin's user avatar
  • 1,077
11 votes
1 answer
976 views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
forest's user avatar
  • 66.5k
11 votes
0 answers
372 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
runeks's user avatar
  • 413
11 votes
0 answers
31k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
inferno's user avatar
  • 111
10 votes
1 answer
4k views

Do fTPM implementations protect against physical attacks?

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC. As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
KovBal's user avatar
  • 323
9 votes
0 answers
1k views

How could I block or at least detect the use of ultrasonic side channels or Google Nearby Messages API on my smartphone?

My question is about the use of ultrasonic messages that are part of the modern advertising ecosystem and are also used by the Google Nearby Messages API. When it comes to advertising, the type of ...
user100487's user avatar
9 votes
1 answer
1k views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
SAR's user avatar
  • 199
9 votes
0 answers
363 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
forest's user avatar
  • 66.5k
9 votes
1 answer
4k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
Shurmajee's user avatar
  • 7,417
8 votes
0 answers
237 views

Why is iOS sending HTTPS requests even with background refresh disabled?

I've installed NextDNS on my iPhone and started noticing random connection requests to *.aliexpress.com, live.musical.ly, amazon.sa, and others. What made me wonder is that I don't have "...
Joseph jun. Melettukunnel's user avatar
8 votes
0 answers
828 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now use ...
Flimm's user avatar
  • 1,260
7 votes
1 answer
1k views

How does TLS 1.3 do Stateless "Hello Retry Request" if the HRR is also included in the Transcript Hash?

My question has to do with "stateless" Hello Retry Requests between a Client and Server doing a TLS 1.3 Handshake. First, some context: Relevent portion of the TLS 1.3 RFC: https://www.rfc-...
jester's user avatar
  • 132
7 votes
1 answer
5k views

Nmap scan of iPhone public IP address shows port 21 open

I'm using my iPhone personal hotspot to connect to the internet on my computer via usb connection. I don't go through any other router or connection. The phone is my only means of connecting my ...
I0_ol's user avatar
  • 311
7 votes
2 answers
4k views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
Stefan's user avatar
  • 171
7 votes
0 answers
506 views

Can SRP be implemented using libsodium

I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls. ...
Nathan's user avatar
  • 361
7 votes
0 answers
6k views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
ddewaele's user avatar
  • 221
7 votes
1 answer
565 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
Robert's user avatar
  • 1,423
6 votes
0 answers
2k views

How to bypass certificate pinning in Android phone?

I am working on analyzing Android applications from my phone using MITM Proxy. My Android phone version is 4.4.2, SDK is 19 and its rooted. I have performed all WiFi configurations required for MITM. ...
user399's user avatar
  • 61
6 votes
0 answers
156 views

How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?

I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
Roy's user avatar
  • 61
6 votes
0 answers
2k views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
Jyosk Natalm's user avatar
6 votes
0 answers
2k views

Payment Handlers In Google Chrome

Are there any privacy/security risks associated with using payment handlers in Google Chrome? Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
John Anderson's user avatar
6 votes
0 answers
192 views

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
Filipon's user avatar
  • 1,264
6 votes
1 answer
961 views

Are there any observed Rowhammer attacks in the wild

Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a ...
user1192748's user avatar
6 votes
0 answers
424 views

Recent Pwn2Own baseband exploit

I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
Damon's user avatar
  • 5,201
6 votes
1 answer
585 views

GSM - Implementing Cipher Mode Command on YateBTS

I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!? I use the combination of BladeRF x40 FPGA and ...
Brian Salehi's user avatar
6 votes
1 answer
236 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
flane's user avatar
  • 69
6 votes
0 answers
558 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
prhymethyme's user avatar
6 votes
2 answers
3k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
Salvatore's user avatar
6 votes
0 answers
585 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
rustgamer3434's user avatar
6 votes
0 answers
1k views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
darkhorizon's user avatar
6 votes
0 answers
6k views

How does TLS 1.3 break inspection?

The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools. I don't fully understand how it does that and if there are ways around this. ...
RussM's user avatar
  • 61
6 votes
0 answers
569 views

How does Chrome distrust Symantec Certificates?

Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC. When I visit chase.com on Google Chrome, I get the following ...
Krishnaraj's user avatar
6 votes
0 answers
128 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
Mogarrr's user avatar
  • 161
6 votes
0 answers
417 views

Security of TPM 1.2 for providing tamper-evidence against firmware modification

I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
guest's user avatar
  • 219
6 votes
1 answer
1k views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
B-MO's user avatar
  • 313
6 votes
2 answers
3k views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
Michael Freidgeim's user avatar
6 votes
0 answers
3k views

Metasploit DCERPC BindError

I'm trying to gain shell access to my home router/gateway, so I decided to use metasploit and nmap to find if there were any vulnerabilities that I could use: [marcel@GLaDOS ~]$ sudo nmap -sS -Pn -A ...
marceloneil's user avatar
6 votes
0 answers
3k views

Authenticate JWT over websocket

I post here to know if my authentication mechanism over websocket is sound. My app API works over websocket instead of the standard HTTP rest. Each time a path that is secured is accessed over ...
Ced's user avatar
  • 189
6 votes
1 answer
2k views

How to reset the TPM PCRs?

I am working on the ATMEL TPM device on an embedded platform. While experimenting with the extend operation of the PCR, I extended the PCR 0 with a string of 20 bytes. As mentioned in the TPM ...
Pritha Ganguly's user avatar
6 votes
1 answer
683 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
Synthetic Ascension's user avatar
6 votes
0 answers
287 views

What is the meaning if all IoT hacked by Mirai all over the world identify themselves on my server since 15 days in the rhythm of 180 unique IoT/h?

In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, ...
T. Grandier's user avatar
6 votes
1 answer
11k views

Is it possible to clone an NFC/RFID chip that uses IsoDep, NfcA and NdefFormatable

I have an NFC/RFID keychain that looks pretty much like this one: When I read it with an Android app called "Nfc Reader", it shows me a specific ID (always the same) and it says that these ...
Forivin's user avatar
  • 1,019
6 votes
0 answers
512 views

Is there are way to do Per-User Encrypted Samba Storage?

I'd like to address following scenario: Company keeps documents in-house and not in Cloud Documents are stored on Samba Share Sysadmins have access to the storage so they can dump it The point is to ...
Aria's user avatar
  • 2,731
6 votes
1 answer
314 views

Does the ability to delete data impact availability in CVSS v2?

NIST SP 800-33 2.0.1 says that "availability" part of the CIA triad protects against intentional or accidental attempts to either: perform unauthorized deletion of data or otherwise cause a denial ...
Wrycu's user avatar
  • 440
6 votes
0 answers
141 views

How do (broadcast-only/passive) RFID licence plates assert their identity?

I would have guessed by some kind of challenge-response, but there seem to be many claims of 'passive' or 'broadcast-only' tags in the plates. For example from http://www.e-plate.com/security.html: ...
R. Davids's user avatar
6 votes
0 answers
3k views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
user104013's user avatar
6 votes
2 answers
10k views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
Jeffery's user avatar
  • 61
6 votes
0 answers
2k views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

I saw a few threads about NFC NTAG against cloning and NTAG Desfire, I just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
clark's user avatar
  • 109

15 30 50 per page
1
2 3 4 5
139