All Questions

6,891 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
12 votes
0 answers
540 views

PGP security with Thunderbird 78 email client

I have a query regarding best practice of using PGP to sign emails with Thunderbird 78. Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
Martin's user avatar
  • 1,097
11 votes
1 answer
591 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
O. Jones's user avatar
  • 379
11 votes
0 answers
416 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
runeks's user avatar
  • 423
11 votes
1 answer
4k views

Do fTPM implementations protect against physical attacks?

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC. As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
KovBal's user avatar
  • 333
9 votes
0 answers
1k views

How could I block or at least detect the use of ultrasonic side channels or Google Nearby Messages API on my smartphone?

My question is about the use of ultrasonic messages that are part of the modern advertising ecosystem and are also used by the Google Nearby Messages API. When it comes to advertising, the type of ...
user100487's user avatar
9 votes
1 answer
2k views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
SAR's user avatar
  • 199
9 votes
0 answers
939 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now use ...
Flimm's user avatar
  • 1,280
9 votes
0 answers
415 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
forest's user avatar
  • 67k
9 votes
1 answer
4k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
Shurmajee's user avatar
  • 7,487
8 votes
0 answers
5k views

Are there any security benefits to enabling the PIN on an eSIM?

For physical SIMs, I'm aware of a number of security benefits to enabling the SIM PIN, because for an attacker with access to a lost or stolen SIM, a PIN prevents transferring the SIM to a different ...
Lachlan Hunt's user avatar
8 votes
0 answers
284 views

Why is iOS sending HTTPS requests even with background refresh disabled?

I've installed NextDNS on my iPhone and started noticing random connection requests to *.aliexpress.com, live.musical.ly, amazon.sa, and others. What made me wonder is that I don't have "...
Joseph jun. Melettukunnel's user avatar
7 votes
1 answer
2k views

Powershell Empire - Token Impersonation

I have been struggling trying to get token impersonation to work in Empire 2.0. I use the credentials/mimitokens module to list and elevate to use a specific users token - I see mimikatz' output ...
user3046771's user avatar
7 votes
0 answers
563 views

Can SRP be implemented using libsodium

I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls. ...
Nathan's user avatar
  • 361
7 votes
0 answers
6k views

Running openssl s_client with an aes encrypted key fails

I'm trying to verify a 2-way SSL connection using the openssl s_client command openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key The openssl s_client fails ...
ddewaele's user avatar
  • 221
7 votes
1 answer
596 views

TLS connection to untrusted server - client reaction for dropping connection standardized?

I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
Robert's user avatar
  • 1,461
6 votes
1 answer
3k views

Is HTTP header Permissions-Policy worth using if no features are used?

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
captainmish's user avatar
6 votes
0 answers
3k views

How to bypass certificate pinning in Android phone?

I am working on analyzing Android applications from my phone using MITM Proxy. My Android phone version is 4.4.2, SDK is 19 and its rooted. I have performed all WiFi configurations required for MITM. ...
user399's user avatar
  • 61
6 votes
0 answers
355 views

Whats the meaning of ] symbol in a SQL query?

I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works. The query in the PHP application would ...
Rumesh Madhusanka's user avatar
6 votes
0 answers
185 views

How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?

I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
Roy's user avatar
  • 61
6 votes
0 answers
3k views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
Jyosk Natalm's user avatar
6 votes
1 answer
3k views

Payment Handlers In Google Chrome

Are there any privacy/security risks associated with using payment handlers in Google Chrome? Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
John Anderson's user avatar
6 votes
0 answers
230 views

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
Filipon's user avatar
  • 1,294
6 votes
1 answer
1k views

Are there any observed Rowhammer attacks in the wild

Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a ...
user1192748's user avatar
6 votes
0 answers
461 views

Recent Pwn2Own baseband exploit

I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
Damon's user avatar
  • 5,221
6 votes
1 answer
650 views

GSM - Implementing Cipher Mode Command on YateBTS

I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!? I use the combination of BladeRF x40 FPGA and ...
Brian Salehi's user avatar
6 votes
1 answer
348 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
flane's user avatar
  • 69
6 votes
0 answers
613 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
prhymethyme's user avatar
6 votes
2 answers
3k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
Salvatore's user avatar
6 votes
0 answers
645 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
rustgamer3434's user avatar
6 votes
0 answers
1k views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
darkhorizon's user avatar
6 votes
0 answers
2k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
Shurmajee's user avatar
  • 7,487
6 votes
0 answers
6k views

How does TLS 1.3 break inspection?

The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools. I don't fully understand how it does that and if there are ways around this. ...
RussM's user avatar
  • 61
6 votes
0 answers
594 views

How does Chrome distrust Symantec Certificates?

Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC. When I visit chase.com on Google Chrome, I get the following ...
Krishnaraj's user avatar
6 votes
0 answers
154 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
Mogarrr's user avatar
  • 161
6 votes
0 answers
448 views

Security of TPM 1.2 for providing tamper-evidence against firmware modification

I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
guest's user avatar
  • 229
6 votes
1 answer
2k views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
B-MO's user avatar
  • 313
6 votes
2 answers
4k views

Is it ok to write OidC Bearer token to log?

During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
Michael Freidgeim's user avatar
6 votes
0 answers
3k views

Metasploit DCERPC BindError

I'm trying to gain shell access to my home router/gateway, so I decided to use metasploit and nmap to find if there were any vulnerabilities that I could use: [marcel@GLaDOS ~]$ sudo nmap -sS -Pn -A ...
marceloneil's user avatar
6 votes
0 answers
3k views

Authenticate JWT over websocket

I post here to know if my authentication mechanism over websocket is sound. My app API works over websocket instead of the standard HTTP rest. Each time a path that is secured is accessed over ...
Ced's user avatar
  • 189
6 votes
1 answer
741 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
Synthetic Ascension's user avatar
6 votes
0 answers
310 views

What is the meaning if all IoT hacked by Mirai all over the world identify themselves on my server since 15 days in the rhythm of 180 unique IoT/h?

In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, ...
T. Grandier's user avatar
6 votes
1 answer
12k views

Is it possible to clone an NFC/RFID chip that uses IsoDep, NfcA and NdefFormatable

I have an NFC/RFID keychain that looks pretty much like this one: When I read it with an Android app called "Nfc Reader", it shows me a specific ID (always the same) and it says that these ...
Forivin's user avatar
  • 1,019
6 votes
0 answers
579 views

Is there are way to do Per-User Encrypted Samba Storage?

I'd like to address following scenario: Company keeps documents in-house and not in Cloud Documents are stored on Samba Share Sysadmins have access to the storage so they can dump it The point is to ...
Aria's user avatar
  • 2,701
6 votes
1 answer
376 views

Does the ability to delete data impact availability in CVSS v2?

NIST SP 800-33 2.0.1 says that "availability" part of the CIA triad protects against intentional or accidental attempts to either: perform unauthorized deletion of data or otherwise cause a denial ...
Wrycu's user avatar
  • 440
6 votes
0 answers
161 views

How do (broadcast-only/passive) RFID licence plates assert their identity?

I would have guessed by some kind of challenge-response, but there seem to be many claims of 'passive' or 'broadcast-only' tags in the plates. For example from http://www.e-plate.com/security.html: ...
R. Davids's user avatar
6 votes
0 answers
3k views

What Key Usage values are required to support Code Signing?

I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
user104013's user avatar
6 votes
2 answers
10k views

Clarification of PCI DSS 3.1 requirement 6+8

I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions. The login is the end user/customer login to the public facing control panel in which they can ...
Jeffery's user avatar
  • 61
6 votes
0 answers
2k views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

I saw a few threads about NFC NTAG against cloning and NTAG Desfire, I just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
clark's user avatar
  • 109
5 votes
0 answers
142 views

Android Find My Device Network Privacy

My Android device today popped up a screen indicating that it had joined the new Find My Device Network that allows two-way scanning of device locations over Bluetooth. Despite Google's claims of ...
Robert Chapin's user avatar
5 votes
1 answer
432 views

Does HTTP/3 necessitate additional - beyond HTTP/2 via TLS1.3 - restrictions on client authentication (mTLS)?

A recent Nginx release allows me to set listen 443 quic; to enable HTTP/3. Neat. I had been using HTTP/2 with TLS1.3 before, so I did not expect that change much, just optimize round trips with ...
anx's user avatar
  • 370

15 30 50 per page
1
2 3 4 5
138