All Questions
6,944
questions with no upvoted or accepted answers
17
votes
1
answer
3k
views
TPM PCR value unchanged with BIOS configuration changes
I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
- 171
11
votes
1
answer
507
views
SolarWinds Orion SAML compromise mass cert update
SolarWinds Orion customers have suffered some network compromises according to news reports.
One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
- 379
11
votes
0
answers
469
views
PGP security with Thunderbird 78 email client
I have a query regarding best practice of using PGP to sign emails with Thunderbird 78.
Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
- 1,077
11
votes
1
answer
976
views
Entropy sources used by modern Windows
A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
- 66.5k
11
votes
0
answers
372
views
Penetration-resistance of a HaLVM unikernel
A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
- 413
11
votes
0
answers
31k
views
How to make Firefox ignore the X-XSS-Protection response header?
I have two questions:
How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
- 111
10
votes
1
answer
4k
views
Do fTPM implementations protect against physical attacks?
I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC.
As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
- 323
9
votes
0
answers
1k
views
How could I block or at least detect the use of ultrasonic side channels or Google Nearby Messages API on my smartphone?
My question is about the use of ultrasonic messages that are part of the modern advertising ecosystem and are also used by the Google Nearby Messages API.
When it comes to advertising, the type of ...
- 493
9
votes
1
answer
1k
views
What is the difference between TEE and HSM in Android Pie?
Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox).
What is the actual difference between TEE and HSM?
Does ...
- 199
9
votes
0
answers
363
views
Authentication using SysRq
The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
- 66.5k
9
votes
1
answer
4k
views
Session fixation in Java
In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability.
Referring to the documentation I came up with the following ...
- 7,417
8
votes
0
answers
237
views
Why is iOS sending HTTPS requests even with background refresh disabled?
I've installed NextDNS on my iPhone and started noticing random connection requests to *.aliexpress.com, live.musical.ly, amazon.sa, and others.
What made me wonder is that
I don't have "...
8
votes
0
answers
828
views
How does Facebook Pixel's new first-party cookie work?
Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation:
You can now use ...
- 1,260
7
votes
1
answer
1k
views
How does TLS 1.3 do Stateless "Hello Retry Request" if the HRR is also included in the Transcript Hash?
My question has to do with "stateless" Hello Retry Requests between a Client and Server doing a TLS 1.3 Handshake.
First, some context:
Relevent portion of the TLS 1.3 RFC: https://www.rfc-...
- 132
7
votes
1
answer
5k
views
Nmap scan of iPhone public IP address shows port 21 open
I'm using my iPhone personal hotspot to connect to the internet on my computer via usb connection. I don't go through any other router or connection. The phone is my only means of connecting my ...
- 311
7
votes
2
answers
4k
views
Unknown MAC in network
A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
- 171
7
votes
0
answers
506
views
Can SRP be implemented using libsodium
I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls.
...
- 361
7
votes
0
answers
6k
views
Running openssl s_client with an aes encrypted key fails
I'm trying to verify a 2-way SSL connection using the openssl s_client command
openssl s_client -connect localhost:8883 -CAfile ca.pem -cert client.crt -key client.key
The openssl s_client fails ...
- 221
7
votes
1
answer
565
views
TLS connection to untrusted server - client reaction for dropping connection standardized?
I played around with a man-in-the-middle proxy tool and connected different smart phones to it. As the proxy uses a self signed certificate the tested smartphone apps did not accept the presented ...
- 1,423
6
votes
0
answers
2k
views
How to bypass certificate pinning in Android phone?
I am working on analyzing Android applications from my phone using MITM Proxy. My Android phone version is 4.4.2, SDK is 19 and its rooted. I have performed all WiFi configurations required for MITM. ...
- 61
6
votes
0
answers
156
views
How do crypto coprocessors securely decrypt a disk without allowing bus sniffing?
I'm trying to understand how using a crypto co-processor chip can securely decrypt a disk without someone getting the decryption key by sniffing the bus it communicates on or loading the disk onto ...
- 61
6
votes
0
answers
2k
views
Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?
I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
- 71
6
votes
0
answers
2k
views
Payment Handlers In Google Chrome
Are there any privacy/security risks associated with using payment handlers in Google Chrome?
Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
6
votes
0
answers
192
views
What security isolation exists between VDI instance to VMware Horizon to ESX?
I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
- 1,264
6
votes
1
answer
961
views
Are there any observed Rowhammer attacks in the wild
Due to the latest news regarding Rowhammer and its applicability to ECC DRAM, I was wondering whether there are any Rowhammer attacks spotted in the wild. Given the various approaches to conduct a ...
- 283
6
votes
0
answers
424
views
Recent Pwn2Own baseband exploit
I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
- 5,201
6
votes
1
answer
585
views
GSM - Implementing Cipher Mode Command on YateBTS
I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!?
I use the combination of BladeRF x40 FPGA and ...
- 171
6
votes
1
answer
236
views
How to find malware added in supply chain to Android phone?
As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
- 69
6
votes
0
answers
558
views
Why are banks largely absent from the HSTS preload list?
There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
- 61
6
votes
2
answers
3k
views
Are JWT refresh tokens in browser really that bad?
Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
- 61
6
votes
0
answers
585
views
Do I need to use SAML and JWT for auth in SSO web app?
I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
6
votes
0
answers
1k
views
Prevent Firefox or Chrome from evaluating URLs before page request?
If you browse to this page:
http://192.168.10.8/../../../../../windows/win.ini
Firefox/Chrome will evaluate the URL first. The resulting page requested will be:
http://192.168.10.8/windows/win.ini
...
- 161
6
votes
0
answers
6k
views
How does TLS 1.3 break inspection?
The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools.
I don't fully understand how it does that and if there are ways around this. ...
- 61
6
votes
0
answers
569
views
How does Chrome distrust Symantec Certificates?
Sometime back Google Chrome had announced plans to distrust Symantec certificates. I am trying to figure out how this is done for a POC.
When I visit chase.com on Google Chrome, I get the following ...
- 173
6
votes
0
answers
128
views
Is there a good way to store OAuth2 tokens for a native application?
Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
- 161
6
votes
0
answers
417
views
Security of TPM 1.2 for providing tamper-evidence against firmware modification
I would like to use a TPM for providing tamper-evidence to my workstation, using SRTM (Static Root-of-Trust for Measurement). Currently, I plan to have the TPM seal a one-time value which only I know, ...
- 219
6
votes
1
answer
1k
views
Pivoting with Metasploit
I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
- 313
6
votes
2
answers
3k
views
Is it ok to write OidC Bearer token to log?
During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive ...
6
votes
0
answers
3k
views
Metasploit DCERPC BindError
I'm trying to gain shell access to my home router/gateway, so I decided to use metasploit and nmap to find if there were any vulnerabilities that I could use:
[marcel@GLaDOS ~]$ sudo nmap -sS -Pn -A ...
- 161
6
votes
0
answers
3k
views
Authenticate JWT over websocket
I post here to know if my authentication mechanism over websocket is sound.
My app API works over websocket instead of the standard HTTP rest. Each time a path that is secured is accessed over ...
- 189
6
votes
1
answer
2k
views
How to reset the TPM PCRs?
I am working on the ATMEL TPM device on an embedded platform. While experimenting with the extend operation of the PCR, I extended the PCR 0 with a string of 20 bytes. As mentioned in the TPM ...
6
votes
1
answer
683
views
MS08-067.c fails at WNetAddConnection2()
I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB.
The section:
WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
6
votes
0
answers
287
views
What is the meaning if all IoT hacked by Mirai all over the world identify themselves on my server since 15 days in the rhythm of 180 unique IoT/h?
In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, ...
- 61
6
votes
1
answer
11k
views
Is it possible to clone an NFC/RFID chip that uses IsoDep, NfcA and NdefFormatable
I have an NFC/RFID keychain that looks pretty much like this one:
When I read it with an Android app called "Nfc Reader", it shows me a specific ID (always the same) and it says that these ...
- 1,019
6
votes
0
answers
512
views
Is there are way to do Per-User Encrypted Samba Storage?
I'd like to address following scenario:
Company keeps documents in-house and not in Cloud
Documents are stored on Samba Share
Sysadmins have access to the storage so they can dump it
The point is to ...
- 2,731
6
votes
1
answer
314
views
Does the ability to delete data impact availability in CVSS v2?
NIST SP 800-33 2.0.1 says that "availability" part of the CIA triad protects against intentional or accidental attempts to either:
perform unauthorized deletion of data or
otherwise cause a denial ...
- 440
6
votes
0
answers
141
views
How do (broadcast-only/passive) RFID licence plates assert their identity?
I would have guessed by some kind of challenge-response, but there seem to be many claims of 'passive' or 'broadcast-only' tags in the plates.
For example from http://www.e-plate.com/security.html:
...
- 61
6
votes
0
answers
3k
views
What Key Usage values are required to support Code Signing?
I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
- 61
6
votes
2
answers
10k
views
Clarification of PCI DSS 3.1 requirement 6+8
I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions.
The login is the end user/customer login to the public facing control panel in which they can ...
- 61
6
votes
0
answers
2k
views
NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?
I saw a few threads about NFC NTAG against cloning and NTAG Desfire, I just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
- 109