All Questions
6,522
questions with no upvoted or accepted answers
16
votes
2
answers
2k
views
What unique fingerprinting information can an iOS 10 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
- 1,430
14
votes
0
answers
3k
views
TPM PCR value unchanged with BIOS configuration changes
I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
- 141
12
votes
1
answer
818
views
Random seed not propagating to the entropy pools in a timely manner
The Linux kernel's randomness driver collects entropy from the environment. Because there will be little entropy during boot, a random seed is often kept at /var/lib/misc/random-seed or a similar ...
- 64k
10
votes
1
answer
4k
views
Meterpreter (Metasploit) anonymous reverse connection over Tor2web
The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box.
I've ...
- 111
9
votes
0
answers
402
views
SolarWinds Orion SAML compromise mass cert update
SolarWinds Orion customers have suffered some network compromises according to news reports.
One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
- 369
9
votes
0
answers
332
views
PGP security with Thunderbird 78 email client
I have a query regarding best practice of using PGP to sign emails with Thunderbird 78.
Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
- 1,057
9
votes
1
answer
2k
views
Using the authorization code grant without using cookies?
I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal:
OAuth2
OpenID Connect
SPA / Mobile ...
- 529
9
votes
0
answers
324
views
Penetration-resistance of a HaLVM unikernel
A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
- 383
9
votes
2
answers
332
views
SAML 2.0 Multiple AuthnStatements
If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
- 223
9
votes
1
answer
4k
views
Do fTPM implementations protect against physical attacks?
I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC.
As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
- 313
8
votes
1
answer
1k
views
TCP Sack panic proof of concept?
For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies?
[1] ...
- 189
8
votes
0
answers
961
views
What is the difference between TEE and HSM in Android Pie?
Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox).
What is the actual difference between TEE and HSM?
Does ...
- 181
8
votes
0
answers
297
views
Authentication using SysRq
The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
- 64k
8
votes
0
answers
378
views
How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?
The DISA Application Developer STIG specifies:
Group ID (Vulid): V-69565
Rule ID: SV-84187r1_rule
Rule Version (STIG-ID): APSC-DV-001730
Rule Title: The application must require the change of at ...
- 81
7
votes
3
answers
316
views
Is it possible for a website to detect the presence of a proxy?
I am attempting to scrape a site which is notoriously difficult to scrape. Access from datacentres is generally blocked. In the past I've used various proxies, but recently these have stopped ...
- 291
7
votes
1
answer
2k
views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
- 2,809
7
votes
0
answers
431
views
Can SRP be implemented using libsodium
I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls.
...
- 359
7
votes
2
answers
2k
views
Can TPM "Storage Keys" be created outside the TPM?
I am interested in 'adding' preexisting keys to a TPM's storage hierarchy.
An example of a desired key hierarchy can be shown as:
(SRK)----->(User Storage Key)-------> User Working Key 1
...
- 81
7
votes
0
answers
6k
views
Running openssl s_client with an aes encrypted key fails
I'm trying to verify a 2-way SSL connection using the openssl s_client command
openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key
The openssl s_client fails ...
- 221
7
votes
1
answer
516
views
TLS connection to untrusted server - client reaction for dropping connection standardized?
I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
- 1,326
7
votes
1
answer
4k
views
Session fixation in Java
In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability.
Referring to the documentation I came up with the following ...
- 7,275
6
votes
0
answers
155
views
Why is iOS sending HTTPS requests even with background refresh disabled?
I've installed NextDNS on my iPhone and started noticing random connection requests to *.aliexpress.com, live.musical.ly, amazon.sa, and others.
What made me wonder is that
I don't have "...
6
votes
1
answer
434
views
XXE OOB Large File Extraction
Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
- 61
6
votes
1
answer
753
views
Are there any observed Rowhammer attacks in the wild
Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a ...
- 263
6
votes
0
answers
368
views
Recent Pwn2Own baseband exploit
I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
- 4,961
6
votes
0
answers
147
views
How to find malware added in supply chain to Android phone?
As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
- 69
6
votes
0
answers
613
views
How does Facebook Pixel's new first-party cookie work?
Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation:
You can now use ...
- 1,230
6
votes
0
answers
3k
views
Are JWT refresh tokens in browser really that bad?
Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
- 61
6
votes
0
answers
356
views
Security of TPM 1.2 for providing tamper-evidence against firmware modification
I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
- 209
6
votes
1
answer
1k
views
Pivoting with Metasploit
I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
- 313
6
votes
2
answers
2k
views
Is it ok to write OidC Bearer token to log?
During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
6
votes
0
answers
2k
views
What Key Usage values are required to support Code Signing?
I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
- 61
5
votes
0
answers
59
views
Is chrome not blocking all third party cookies?
I opened a website 99acres.com in incognito windows on two browsers on a Macbook. Following are the settings:
Chrome
Version: 100.0.4896.75 (latest)
Third Party cookies: Disabled
Firefox
Version: ...
- 151
5
votes
0
answers
353
views
Windows Defender catches Trojan right after clean install
I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
- 51
5
votes
0
answers
456
views
How did ntpd get patched to prevent NTP time synchronization attacks?
I recently tested the NTP Time Synchronization Attack as described and demonstrated by Jose Selvi in 2015.
Basically, the attack was mostly used to send the victim's clock in the future, so the ...
- 751
5
votes
0
answers
163
views
What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?
I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general.
So, PAdES has the concept of Long Term Validation, which ...
5
votes
0
answers
434
views
How is my ISP circumventing SSL on thepiratebay even though the certificate is valid?
When I visit https://thepiratebay.org it is displaying a message from my ISP saying it is blocked under government rules. BUT the https icon is green and the certificate is a SNI certificate from ...
- 51
5
votes
0
answers
2k
views
How to bypass certificate pinning in Android phone?
I am working on analyzing Android applications from my phone using MITM Proxy. My Android phone version is 4.4.2, SDK is 19 and its rooted. I have performed all WiFi configurations required for MITM. ...
- 51
5
votes
1
answer
1k
views
Is `gpg --refresh-keys` secure and where is this documented?
From the gpg manual:
--refresh-keys
Request updates from a keyserver for keys that already exist on the local keyring.
This is useful for updating a key with the latest signatures, user IDs, etc.
...
- 191
5
votes
0
answers
138
views
Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?
There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes.
Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
- 208
5
votes
0
answers
193
views
Why am I getting seemingly random fingerprints back when connecting via SSH/SCP?
I manage an application that connects to various servers using a client-specific keypair. We have around 70 customers; all but one can connect to our FTP server (for SCP) after first accepting the RSA ...
- 51
5
votes
3
answers
317
views
Fix vulnerabilities in ALL applications, or only client-facing ones?
Given a setup where we have nginx sat in a DMZ serving static content, forwarding (REST/WS) requests through a firewall to tomcat running on a server where other applications are also running:
YOU &...
- 151
5
votes
0
answers
135
views
How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?
I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
- 51
5
votes
0
answers
452
views
Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?
Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to?
Such targeted or ...
- 199
5
votes
0
answers
333
views
Is there any privacy- or security-relevant difference between FIDO2 and SQRL
I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme.
Both seem to use the same key elements:
a private, user-resident "master key" ...
- 3,512
5
votes
3
answers
233
views
How can one centrally manage / audit AWS resource-based policies
An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said ...
- 151
5
votes
0
answers
356
views
How to securely delete a file after it was insecurely deleted (in linux)
How can I securely delete/shred a file after I accidentally deleted the file insecurely?
Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
- 806
5
votes
0
answers
999
views
Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?
I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
- 61
5
votes
0
answers
269
views
How accurate are people at determining the validity of a signature?
Is there any scientific survey about this?
I could imagine an experiment like this:
100 people provide at least 3 times their signature (e.g. with different pens)
Each of them gets all 3 example ...
- 3,892
5
votes
0
answers
126
views
Poor Man's OAuth Grant - Review
A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me.
The user has ...
- 151