Unanswered Questions
5,686 questions with no upvoted or accepted answers
18
votes
0answers
6k views
How to crack (get secret from) Android Keystore System
I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
13
votes
2answers
2k views
What unique fingerprinting information can an iOS 10 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
10
votes
0answers
2k views
TPM PCR value unchanged with BIOS configuration changes
I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
8
votes
2answers
201 views
SAML 2.0 Multiple AuthnStatements
If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
8
votes
3answers
443 views
How much of a security issue discontinued vendor security patches are on Android?
As an example, the original OnePlus One has good LineageOS support, but the vendor security patches were seemingly discontinued three years ago:
What are the security implications and is the vendor ...
7
votes
1answer
180 views
How can I exploit a Buffer Overflow on a Raspberry Pi 4?
I am trying to exploit a bufferoverflow on raspberry pi 4 which makes use of Cortex-A72 (ARM v8) 64-bit SoC.
The linux kernel version is v4.19 and the OS a Debian Buster compiled for the raspberry pi ...
7
votes
1answer
1k views
TCP Sack panic proof of concept?
For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies?
[1] ...
7
votes
0answers
3k views
Meterpreter (Metasploit) anonymous reverse connection over Tor2web
The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box.
I've ...
7
votes
0answers
223 views
How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?
The DISA Application Developer STIG specifies:
Group ID (Vulid): V-69565
Rule ID: SV-84187r1_rule
Rule Version (STIG-ID): APSC-DV-001730
Rule Title: The application must require the change of at ...
7
votes
0answers
244 views
Penetration-resistance of a HaLVM unikernel
A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
7
votes
1answer
3k views
Do fTPM implementations protect against physical attacks?
I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC.
As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
7
votes
1answer
675 views
Are there regulations that govern how social security numbers are stored and viewed?
I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
6
votes
1answer
197 views
Recovery of EEPROM data after bulk erase operation
Is there any research into the recovery of data stored in an EEPROM after the high-voltage bulk erase (not bytewise or pagewise erase) operation? I'm wondering about typical low-capacity EEPROMs which ...
6
votes
1answer
101 views
Opt-in a security profile at runtime, without tedious setup
I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish.
I would like to be able to ...
6
votes
0answers
528 views
What is the difference between TEE and HSM in Android Pie?
Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox).
What is the actual difference between TEE and HSM?
Does ...
