Unanswered Questions
12
votes
2answers
495 views
Getting exploit reliability when using the off by one framepointer overwrite on linux
We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
11
votes
1answer
449 views
Return-oriented programming: how to find a stack pivot
I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
11
votes
1answer
256 views
What attacks, if any, are possible against Security Support Provider Interface (SSPI)?
I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
10
votes
1answer
75 views
Why does Android mix phone state with phone identity?
The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
10
votes
1answer
739 views
TextSecure protocol
Is anyone aware of an analysis of the TextSecure protocol?
https://whispersystems.org/blog/simplifying-otr-deniability/
https://github.com/WhisperSystems/TextSecure/wiki/Protocol
It is a ...
7
votes
1answer
345 views
Is there a list of phone numbers Facebook uses to send auth tokens?
Up to a few days ago, I always received Facebook auth tokens from numbers +181338477XX, except a few times from +85294985XXX.
Problem is that lately I've been receiving codes directly from Italian ...
6
votes
0answers
39 views
What are the implications of publicizing a consumer secret for sharing between developers doing local website development?
In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
6
votes
1answer
182 views
What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?
In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
6
votes
1answer
1k views
Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?
I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...).
It could be a ...
6
votes
2answers
238 views
What are the security implications of linking a domain account with a personal Microsoft account in Windows 8?
Besides being able to mess up settings and having access to the personal SkyDrive account, what else might an attacker on the corporate network be able to do when the accounts are linked and settings ...
5
votes
2answers
104 views
Detecting and removing Absolute persistance technology
Absolute persistance technology amounts to a persistent rootkit pre-installed by many device manufacturers (Acer, Asus, Dell, HP, Lenovo, Samsung, Toshiba, etc) to facilitate LoJack for laptops, and ...
5
votes
0answers
129 views
PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)
Short Question:
Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1?
Assumption: No vulnerabilities exist when ...
5
votes
0answers
748 views
Designing single-sign-on with JSONP/CORS?
I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions).
I would like to do something ...
5
votes
0answers
375 views
Webapp2 security
I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
4
votes
1answer
158 views
How secure is OpenSSH on FreeBSD?
In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up.
Theo de Raadt had this to say:
... as long as you aren't using ...
